better-auth 1.7.6 → 1.7.8

package/dist/plugins/email-otp/routes.mjs

@@ -6,7 +6,7 @@ import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
 import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
-import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword } from "../../utils/password.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
 import { splitAtLastColon, toOTPIdentifier } from "./utils.mjs";
@@ -584,20 +584,18 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	const email = ctx.body.email.toLowerCase();
 	assertPasswordNotTooShort(ctx, ctx.body.password);
 	assertPasswordNotTooLong(ctx, ctx.body.password);
-	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("forget-password", email), ctx.body.otp);
+	const identifier = toOTPIdentifier("forget-password", email);
+	let otpConsumed = false;
+	if (!await matchesUsableStoredOTP(ctx, opts, identifier, ctx.body.otp)) {
+		await atomicVerifyOTP(ctx, opts, identifier, ctx.body.otp);
+		otpConsumed = true;
+	}
 	const user = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const passwordHash = await ctx.context.password.hash(ctx.body.password);
-	if (!await ctx.context.internalAdapter.findCredentialAccount(user.user.id)) await ctx.context.internalAdapter.createAccount({
-		userId: user.user.id,
-		providerId: "credential",
-		accountId: user.user.id,
-		password: passwordHash
-	});
-	else await ctx.context.internalAdapter.updatePassword(user.user.id, passwordHash);
+	await resetCredentialPassword(ctx, user.user.id, passwordHash, otpConsumed ? void 0 : () => atomicVerifyOTP(ctx, opts, identifier, ctx.body.otp));
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user: user.user }, ctx.request);
 	if (!user.user.emailVerified) await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
-	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(user.user.id);
 	return ctx.json({ success: true });
 });
 const requestEmailChangeEmailOTPBodySchema = z.object({
@@ -748,6 +746,17 @@ const changeEmailEmailOTP = (opts) => createAuthEndpoint("/email-otp/change-emai
 });
 const defaultOTPGenerator = (options) => generateRandomString(options.otpLength ?? 6, "0-9");
 /**
+* Reports whether the provided OTP matches a stored, unexpired record with
+* attempts left, without consuming it or counting an attempt.
+*/
+async function matchesUsableStoredOTP(ctx, opts, identifier, providedOTP) {
+	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
+	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return false;
+	const [otpValue, attempts] = splitAtLastColon(existing.value);
+	if (parseInt(attempts || "0") >= (opts?.allowedAttempts || 3)) return false;
+	return verifyStoredOTP(ctx, opts, otpValue, providedOTP);
+}
+/**
 * Verifies a single-use OTP with race-condition protection.
 *
 * The atomic consume is the single gate: only the first concurrent caller

package/dist/plugins/generic-oauth/index.d.mts

@@ -9,10 +9,12 @@ import { OktaOptions, okta } from "./providers/okta.mjs";
 import { PatreonOptions, patreon } from "./providers/patreon.mjs";
 import { SlackOptions, slack } from "./providers/slack.mjs";
 import { YandexOptions, yandex } from "./providers/yandex.mjs";
+import * as _$_better_auth_core0 from "@better-auth/core";
 import { AuthContext } from "@better-auth/core";
 import * as _$_better_auth_core_oauth20 from "@better-auth/core/oauth2";
 import { OAuthProvider } from "@better-auth/core/oauth2";
 import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+import * as _$better_call0 from "better-call";
 
 //#region src/plugins/generic-oauth/index.d.ts
 declare module "@better-auth/core" {
@@ -27,6 +29,10 @@ declare module "@better-auth/core" {
  * Extracts common fields from GenericOAuthConfig for provider helpers.
  */
 type BaseOAuthProviderOptions = Pick<GenericOAuthConfig, "clientId" | "clientSecret" | "tokenEndpointAuth" | "scopes" | "redirectURI" | "endSessionEndpoint" | "postLogoutRedirectURI" | "disableProviderLogout" | "pkce" | "disableImplicitSignUp" | "disableSignUp" | "overrideUserInfo">;
+type PendingDiscovery = Map<string, {
+  config: GenericOAuthConfig;
+  attempt?: Promise<void> | undefined;
+}>;
 /**
  * A generic OAuth plugin that registers any OAuth/OIDC provider
  * as a first-class social provider.
@@ -40,8 +46,15 @@ declare const genericOAuth: <const ID extends string>(options: GenericOAuthOptio
   init: (ctx: AuthContext) => Promise<{
     context: {
       socialProviders: OAuthProvider<object, Partial<_$_better_auth_core_oauth20.ProviderOptions<object>>>[];
+      genericOAuthPendingDiscovery: PendingDiscovery;
     };
   }>;
+  hooks: {
+    before: {
+      matcher: (context: _$_better_auth_core0.HookEndpointContext) => boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
   options: GenericOAuthOptions<ID>;
   $ERROR_CODES: {
     INVALID_OAUTH_CONFIGURATION: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_OAUTH_CONFIGURATION">;

package/dist/plugins/generic-oauth/index.mjs

@@ -12,6 +12,7 @@ import { slack } from "./providers/slack.mjs";
 import { yandex } from "./providers/yandex.mjs";
 import { APIError } from "@better-auth/core/error";
 import { applyDefaultAccessTokenExpiry, createAuthorizationURL, refreshAccessToken, validateAuthorizationCode, verifyProviderIdToken } from "@better-auth/core/oauth2";
+import { createAuthMiddleware } from "@better-auth/core/api";
 import { createRemoteJWKSet, decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/generic-oauth/index.ts
@@ -21,10 +22,20 @@ function isSecretlessTokenEndpointAuth(tokenEndpointAuth) {
 function isClientSecretTokenEndpointAuth(tokenEndpointAuth) {
 	return tokenEndpointAuth?.method === "client_secret_basic" || tokenEndpointAuth?.method === "client_secret_post";
 }
-async function fetchDiscovery(url, headers) {
+/** A request waits on a discovery retry, so bound it (the SSO plugin uses 10s too). */
+const DISCOVERY_RETRY_TIMEOUT_MS = 1e4;
+/**
+* Providers skipped because startup discovery failed. Init stores them on each auth
+* instance's context, so one plugin object can serve several instances. It is a context
+* field rather than a WeakMap because requests see copies of the context, and a later
+* plugin may replace `socialProviders`.
+*/
+const getPendingDiscovery = (ctx) => ctx.genericOAuthPendingDiscovery;
+async function fetchDiscovery(url, headers, timeout) {
 	const result = await betterFetch(url, {
 		method: "GET",
-		headers
+		headers,
+		signal: timeout ? AbortSignal.timeout(timeout) : void 0
 	});
 	if (result.error || !result.data) return null;
 	if (result.data.issuer) try {
@@ -74,203 +85,235 @@ const genericOAuth = (options) => {
 		seenIds.add(id);
 	}
 	if (nonUniqueIds.size > 0) console.warn(`Duplicate provider IDs found: ${Array.from(nonUniqueIds).join(", ")}`);
-	return {
-		id: "generic-oauth",
-		version: PACKAGE_VERSION,
-		init: async (ctx) => {
-			const genericProviders = [];
-			for (const c of options.config) {
-				let authorizationUrl = c.authorizationUrl;
-				let tokenUrl = c.tokenUrl;
-				let userInfoUrl = c.userInfoUrl;
-				let endSessionEndpoint = c.endSessionEndpoint;
-				let issuer;
-				let isOidc = false;
-				let idTokenConfig;
-				if (c.discoveryUrl) {
-					const discovered = await fetchDiscovery(c.discoveryUrl, c.discoveryHeaders).catch((err) => {
-						ctx.logger.error(`Discovery fetch failed for "${c.providerId}": ${err}`);
-						return null;
-					});
-					if (discovered) {
-						authorizationUrl ??= discovered.authorization_endpoint;
-						tokenUrl ??= discovered.token_endpoint;
-						userInfoUrl ??= discovered.userinfo_endpoint;
-						endSessionEndpoint ??= discovered.end_session_endpoint;
-						issuer = discovered.issuer;
-						const signingAlgs = discovered.id_token_signing_alg_values_supported;
-						isOidc = Array.isArray(signingAlgs) && signingAlgs.length > 0;
-						if (discovered.jwks_uri && discovered.issuer) {
-							let jwksUrl;
-							try {
-								jwksUrl = new URL(discovered.jwks_uri, c.discoveryUrl);
-							} catch {
-								ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
-								continue;
-							}
-							idTokenConfig = {
-								jwks: createRemoteJWKSet(jwksUrl),
-								issuer: discovered.issuer,
-								audience: c.clientId,
-								algorithms: isOidc ? signingAlgs : void 0
-							};
+	const buildProviders = async (configs, ctx, discoveryTimeout) => {
+		const genericProviders = [];
+		for (const c of configs) {
+			let authorizationUrl = c.authorizationUrl;
+			let tokenUrl = c.tokenUrl;
+			let userInfoUrl = c.userInfoUrl;
+			let endSessionEndpoint = c.endSessionEndpoint;
+			let issuer;
+			let isOidc = false;
+			let idTokenConfig;
+			if (c.discoveryUrl) {
+				const discovered = await fetchDiscovery(c.discoveryUrl, c.discoveryHeaders, discoveryTimeout).catch((err) => {
+					ctx.logger.error(`Discovery fetch failed for "${c.providerId}": ${err}`);
+					return null;
+				});
+				if (discovered) {
+					authorizationUrl ??= discovered.authorization_endpoint;
+					tokenUrl ??= discovered.token_endpoint;
+					userInfoUrl ??= discovered.userinfo_endpoint;
+					endSessionEndpoint ??= discovered.end_session_endpoint;
+					issuer = discovered.issuer;
+					const signingAlgs = discovered.id_token_signing_alg_values_supported;
+					isOidc = Array.isArray(signingAlgs) && signingAlgs.length > 0;
+					if (discovered.jwks_uri && discovered.issuer) {
+						let jwksUrl;
+						try {
+							jwksUrl = new URL(discovered.jwks_uri, c.discoveryUrl);
+						} catch {
+							ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
+							continue;
 						}
-					}
-					if (!authorizationUrl || !tokenUrl && !c.getToken) {
-						ctx.logger.error(`Provider "${c.providerId}": discovery left no usable authorization endpoint or token exchange. Provider skipped.`);
-						continue;
+						idTokenConfig = {
+							jwks: createRemoteJWKSet(jwksUrl),
+							issuer: discovered.issuer,
+							audience: c.clientId,
+							algorithms: isOidc ? signingAlgs : void 0
+						};
 					}
 				}
-				if (c.requireIdTokenVerification && !idTokenConfig) {
-					if (c.discoveryUrl) {
-						ctx.logger.error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri. Provider skipped.`);
-						continue;
-					}
-					throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
+				if (!authorizationUrl || !tokenUrl && !c.getToken) {
+					ctx.logger.error(`Provider "${c.providerId}": discovery left no usable authorization endpoint or token exchange. Provider skipped.`);
+					continue;
 				}
-				const tokenEndpointAuth = c.tokenEndpointAuth;
-				if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
-				if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
-				if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
-				const accountSubject = c.accountSubject;
-				const provider = {
-					id: c.providerId,
-					name: c.name ?? c.providerId,
-					issuer,
-					accountSubject: ({ tokens, profile }) => {
-						const genericProfile = profile;
-						if (accountSubject) return accountSubject({
-							tokens,
-							profile: genericProfile
-						});
-						return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
-					},
-					idToken: idTokenConfig,
-					requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
-					allowIdpInitiated: c.allowIdpInitiated,
-					async createEndSessionURL(data) {
-						if (c.disableProviderLogout) return null;
-						if (!endSessionEndpoint) return null;
-						let url;
-						try {
-							url = new URL(endSessionEndpoint);
-						} catch {
+			}
+			if (c.requireIdTokenVerification && !idTokenConfig) {
+				if (c.discoveryUrl) {
+					ctx.logger.error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri. Provider skipped.`);
+					continue;
+				}
+				throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
+			}
+			const tokenEndpointAuth = c.tokenEndpointAuth;
+			if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
+			if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
+			if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
+			const accountSubject = c.accountSubject;
+			const provider = {
+				id: c.providerId,
+				name: c.name ?? c.providerId,
+				issuer,
+				accountSubject: ({ tokens, profile }) => {
+					const genericProfile = profile;
+					if (accountSubject) return accountSubject({
+						tokens,
+						profile: genericProfile
+					});
+					return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
+				},
+				idToken: idTokenConfig,
+				requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
+				allowIdpInitiated: c.allowIdpInitiated,
+				async createEndSessionURL(data) {
+					if (c.disableProviderLogout) return null;
+					if (!endSessionEndpoint) return null;
+					let url;
+					try {
+						url = new URL(endSessionEndpoint);
+					} catch {
+						return null;
+					}
+					if (data.idToken) url.searchParams.set("id_token_hint", data.idToken);
+					const configuredRedirectURI = data.postLogoutRedirectURI ?? c.postLogoutRedirectURI;
+					const postLogoutRedirectURI = configuredRedirectURI ? new URL(configuredRedirectURI, ctx.baseURL).toString() : void 0;
+					if (postLogoutRedirectURI) {
+						url.searchParams.set("post_logout_redirect_uri", postLogoutRedirectURI);
+						url.searchParams.set("client_id", c.clientId);
+						if (data.state) url.searchParams.set("state", data.state);
+					} else if (!data.idToken) url.searchParams.set("client_id", c.clientId);
+					return url;
+				},
+				createAuthorizationURL(data) {
+					if (!authorizationUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.INVALID_OAUTH_CONFIGURATION);
+					return createAuthorizationURL({
+						id: c.providerId,
+						options: {
+							clientId: c.clientId,
+							clientSecret: c.clientSecret,
+							redirectURI: c.redirectURI
+						},
+						authorizationEndpoint: authorizationUrl,
+						state: data.state,
+						codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
+						scopes: (() => {
+							const merged = [...data.scopes ?? [], ...c.scopes ?? []];
+							if (isOidc && !merged.includes("openid")) merged.unshift("openid");
+							return merged;
+						})(),
+						redirectURI: data.redirectURI,
+						prompt: c.prompt,
+						accessType: c.accessType,
+						responseType: c.responseType,
+						responseMode: c.responseMode,
+						nonce: data.idTokenNonce,
+						additionalParams: {
+							...c.authorizationUrlParams ?? {},
+							...data.additionalParams ?? {}
+						},
+						loginHint: data.loginHint
+					});
+				},
+				async validateAuthorizationCode(data) {
+					if (c.getToken) return applyDefaultAccessTokenExpiry(await c.getToken(data), c.accessTokenExpiresIn);
+					if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
+					return applyDefaultAccessTokenExpiry(await validateAuthorizationCode({
+						headers: c.authorizationHeaders,
+						code: data.code,
+						codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
+						redirectURI: data.redirectURI,
+						options: {
+							clientId: c.clientId,
+							clientSecret: c.clientSecret,
+							redirectURI: c.redirectURI
+						},
+						tokenEndpoint: tokenUrl,
+						authentication: c.authentication,
+						tokenEndpointAuth,
+						additionalParams: c.tokenUrlParams
+					}), c.accessTokenExpiresIn);
+				},
+				async getUserInfo(tokens) {
+					const { expectedIdTokenNonce, ...oauthTokens } = tokens;
+					if (oauthTokens.idToken && provider.idToken) {
+						if (!await verifyProviderIdToken(provider, oauthTokens.idToken, expectedIdTokenNonce)) {
+							ctx.logger.error(`Provider "${c.providerId}": id_token failed verification against the discovery JWKS or expected nonce`);
 							return null;
 						}
-						if (data.idToken) url.searchParams.set("id_token_hint", data.idToken);
-						const configuredRedirectURI = data.postLogoutRedirectURI ?? c.postLogoutRedirectURI;
-						const postLogoutRedirectURI = configuredRedirectURI ? new URL(configuredRedirectURI, ctx.baseURL).toString() : void 0;
-						if (postLogoutRedirectURI) {
-							url.searchParams.set("post_logout_redirect_uri", postLogoutRedirectURI);
-							url.searchParams.set("client_id", c.clientId);
-							if (data.state) url.searchParams.set("state", data.state);
-						} else if (!data.idToken) url.searchParams.set("client_id", c.clientId);
-						return url;
-					},
-					createAuthorizationURL(data) {
-						if (!authorizationUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.INVALID_OAUTH_CONFIGURATION);
-						return createAuthorizationURL({
-							id: c.providerId,
-							options: {
-								clientId: c.clientId,
-								clientSecret: c.clientSecret,
-								redirectURI: c.redirectURI
-							},
-							authorizationEndpoint: authorizationUrl,
-							state: data.state,
-							codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
-							scopes: (() => {
-								const merged = [...data.scopes ?? [], ...c.scopes ?? []];
-								if (isOidc && !merged.includes("openid")) merged.unshift("openid");
-								return merged;
-							})(),
-							redirectURI: data.redirectURI,
-							prompt: c.prompt,
-							accessType: c.accessType,
-							responseType: c.responseType,
-							responseMode: c.responseMode,
-							nonce: data.idTokenNonce,
-							additionalParams: {
-								...c.authorizationUrlParams ?? {},
-								...data.additionalParams ?? {}
-							},
-							loginHint: data.loginHint
-						});
-					},
-					async validateAuthorizationCode(data) {
-						if (c.getToken) return applyDefaultAccessTokenExpiry(await c.getToken(data), c.accessTokenExpiresIn);
-						if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
-						return applyDefaultAccessTokenExpiry(await validateAuthorizationCode({
-							headers: c.authorizationHeaders,
-							code: data.code,
-							codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
-							redirectURI: data.redirectURI,
-							options: {
-								clientId: c.clientId,
-								clientSecret: c.clientSecret,
-								redirectURI: c.redirectURI
-							},
-							tokenEndpoint: tokenUrl,
-							authentication: c.authentication,
-							tokenEndpointAuth,
-							additionalParams: c.tokenUrlParams
-						}), c.accessTokenExpiresIn);
-					},
-					async getUserInfo(tokens) {
-						const { expectedIdTokenNonce, ...oauthTokens } = tokens;
-						if (oauthTokens.idToken && provider.idToken) {
-							if (!await verifyProviderIdToken(provider, oauthTokens.idToken, expectedIdTokenNonce)) {
-								ctx.logger.error(`Provider "${c.providerId}": id_token failed verification against the discovery JWKS or expected nonce`);
-								return null;
-							}
-						}
-						const raw = c.getUserInfo ? await c.getUserInfo(oauthTokens) : await fetchUserInfo(oauthTokens, userInfoUrl);
-						if (!raw) return null;
-						const mapped = c.mapProfileToUser ? await c.mapProfileToUser(raw) : {};
-						const user = {
-							email: raw.email,
-							emailVerified: raw.emailVerified,
-							image: raw.image,
-							name: raw.name,
-							...mapped
-						};
-						return {
-							user: {
-								...user,
-								image: user.image ?? void 0
-							},
-							data: raw
-						};
-					},
-					async refreshAccessToken(refreshToken, refreshCtx) {
-						if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
-						const resolvedRefreshParams = typeof c.refreshTokenParams === "function" ? await c.refreshTokenParams(refreshCtx) : c.refreshTokenParams;
-						return applyDefaultAccessTokenExpiry(await refreshAccessToken({
-							refreshToken,
-							options: {
-								clientId: c.clientId,
-								clientSecret: c.clientSecret
-							},
-							authentication: c.authentication,
-							tokenEndpointAuth,
-							tokenEndpoint: tokenUrl,
-							extraParams: resolvedRefreshParams
-						}), c.accessTokenExpiresIn);
-					},
-					disableImplicitSignUp: c.disableImplicitSignUp,
-					disableSignUp: c.disableSignUp,
-					options: {
-						disableSignUp: c.disableSignUp,
-						overrideUserInfoOnSignIn: c.overrideUserInfo,
-						requireEmailVerification: c.requireEmailVerification
 					}
-				};
-				genericProviders.push(provider);
-			}
+					const raw = c.getUserInfo ? await c.getUserInfo(oauthTokens) : await fetchUserInfo(oauthTokens, userInfoUrl);
+					if (!raw) return null;
+					const mapped = c.mapProfileToUser ? await c.mapProfileToUser(raw) : {};
+					const user = {
+						email: raw.email,
+						emailVerified: raw.emailVerified,
+						image: raw.image,
+						name: raw.name,
+						...mapped
+					};
+					return {
+						user: {
+							...user,
+							image: user.image ?? void 0
+						},
+						data: raw
+					};
+				},
+				async refreshAccessToken(refreshToken, refreshCtx) {
+					if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
+					const resolvedRefreshParams = typeof c.refreshTokenParams === "function" ? await c.refreshTokenParams(refreshCtx) : c.refreshTokenParams;
+					return applyDefaultAccessTokenExpiry(await refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: c.clientId,
+							clientSecret: c.clientSecret
+						},
+						authentication: c.authentication,
+						tokenEndpointAuth,
+						tokenEndpoint: tokenUrl,
+						extraParams: resolvedRefreshParams
+					}), c.accessTokenExpiresIn);
+				},
+				disableImplicitSignUp: c.disableImplicitSignUp,
+				disableSignUp: c.disableSignUp,
+				options: {
+					disableSignUp: c.disableSignUp,
+					overrideUserInfoOnSignIn: c.overrideUserInfo,
+					requireEmailVerification: c.requireEmailVerification
+				}
+			};
+			genericProviders.push(provider);
+		}
+		return genericProviders;
+	};
+	const retryDiscovery = (ctx, providerId) => {
+		const pendingDiscovery = getPendingDiscovery(ctx);
+		const pending = pendingDiscovery?.get(providerId);
+		if (!pending) return;
+		pending.attempt ??= buildProviders([pending.config], ctx, DISCOVERY_RETRY_TIMEOUT_MS).then(([provider]) => {
+			if (!provider) return;
+			pendingDiscovery?.delete(providerId);
+			ctx.socialProviders.unshift(provider);
+		}).finally(() => {
+			pending.attempt = void 0;
+		});
+		return pending.attempt;
+	};
+	const requestedProviderId = (context) => {
+		const id = context.body?.provider ?? context.body?.providerId ?? context.query?.provider ?? context.params?.id;
+		return typeof id === "string" ? id : void 0;
+	};
+	return {
+		id: "generic-oauth",
+		version: PACKAGE_VERSION,
+		init: async (ctx) => {
+			const genericProviders = await buildProviders(options.config, ctx);
+			const built = new Set(genericProviders.map((p) => p.id));
+			const genericOAuthPendingDiscovery = new Map(options.config.filter((c) => !built.has(c.providerId)).map((c) => [c.providerId, { config: c }]));
 			const existingIds = new Set(ctx.socialProviders.map((p) => p.id));
 			for (const gp of genericProviders) if (existingIds.has(gp.id)) ctx.logger.warn(`Generic OAuth provider "${gp.id}" shadows a built-in social provider with the same ID`);
-			return { context: { socialProviders: genericProviders.concat(ctx.socialProviders) } };
+			return { context: {
+				socialProviders: genericProviders.concat(ctx.socialProviders),
+				genericOAuthPendingDiscovery
+			} };
 		},
+		hooks: { before: [{
+			matcher: (context) => getPendingDiscovery(context.context)?.has(requestedProviderId(context) ?? "") === true,
+			handler: createAuthMiddleware(async (ctx) => {
+				await retryDiscovery(ctx.context, requestedProviderId(ctx) ?? "");
+			})
+		}] },
 		options,
 		$ERROR_CODES: GENERIC_OAUTH_ERROR_CODES
 	};

package/dist/plugins/last-login-method/index.mjs

@@ -27,9 +27,9 @@ const lastLoginMethod = (userConfig) => {
 		return config.customResolveMethod?.(resolveContext) ?? defaultResolveMethod(resolveContext);
 	};
 	const config = {
-		cookieName: "better-auth.last_used_login_method",
-		maxAge: 3600 * 24 * 30,
-		...userConfig
+		...userConfig,
+		cookieName: userConfig?.cookieName ?? "better-auth.last_used_login_method",
+		maxAge: userConfig?.maxAge ?? 3600 * 24 * 30
 	};
 	return {
 		id: "last-login-method",

package/dist/plugins/magic-link/index.mjs

@@ -23,6 +23,20 @@ const magicLinkVerifyQuerySchema = z.object({
 	errorCallbackURL: z.string().meta({ description: "URL to redirect after error." }).optional(),
 	newUserCallbackURL: z.string().meta({ description: "URL to redirect after new user signup. Only used if the user is registering for the first time." }).optional()
 });
+const magicLinkRecordSchema = z.object({
+	type: z.literal("magic-link"),
+	email: z.email(),
+	name: z.string().optional()
+}).strict();
+function parseMagicLinkRecord(value) {
+	try {
+		const parsed = JSON.parse(value);
+		return magicLinkRecordSchema.safeParse(parsed);
+	} catch {
+		return null;
+	}
+}
+const magicLinkIdentifier = (storedToken) => `magic-link:${storedToken}`;
 const magicLink = (options) => {
 	const opts = {
 		storeToken: "plain",
@@ -75,8 +89,9 @@ const magicLink = (options) => {
 				const verificationToken = opts?.generateToken ? await opts.generateToken(email) : generateRandomString(32, "a-z", "A-Z");
 				const storedToken = await storeToken(ctx, verificationToken);
 				await ctx.context.internalAdapter.createVerificationValue({
-					identifier: storedToken,
+					identifier: magicLinkIdentifier(storedToken),
 					value: JSON.stringify({
+						type: "magic-link",
 						email,
 						name: ctx.body.name
 					}),
@@ -117,15 +132,9 @@ const magicLink = (options) => {
 				method: "GET",
 				query: magicLinkVerifyQuerySchema,
 				use: [
-					originCheck((ctx) => {
-						return ctx.query.callbackURL ? decodeURIComponent(ctx.query.callbackURL) : "/";
-					}),
-					originCheck((ctx) => {
-						return ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : "/";
-					}),
-					originCheck((ctx) => {
-						return ctx.query.errorCallbackURL ? decodeURIComponent(ctx.query.errorCallbackURL) : "/";
-					})
+					originCheck((ctx) => ctx.query.callbackURL || "/"),
+					originCheck((ctx) => ctx.query.newUserCallbackURL || "/"),
+					originCheck((ctx) => ctx.query.errorCallbackURL || "/")
 				],
 				requireHeaders: true,
 				metadata: { openapi: {
@@ -144,18 +153,22 @@ const magicLink = (options) => {
 				} }
 			}, async (ctx) => {
 				const token = ctx.query.token;
-				const callbackURL = new URL(ctx.query.callbackURL ? decodeURIComponent(ctx.query.callbackURL) : "/", ctx.context.baseURL).toString();
-				const errorCallbackURL = new URL(ctx.query.errorCallbackURL ? decodeURIComponent(ctx.query.errorCallbackURL) : callbackURL, ctx.context.baseURL);
+				const callbackURL = new URL(ctx.query.callbackURL || "/", ctx.context.baseURL).toString();
+				const errorCallbackURL = new URL(ctx.query.errorCallbackURL || callbackURL, ctx.context.baseURL);
 				function redirectWithError(error, description) {
 					errorCallbackURL.searchParams.set("error", error);
 					if (description) errorCallbackURL.searchParams.set("error_description", description);
 					throw ctx.redirect(errorCallbackURL.toString());
 				}
-				const newUserCallbackURL = new URL(ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : callbackURL, ctx.context.baseURL).toString();
-				const storedToken = await storeToken(ctx, token);
-				const tokenValue = await ctx.context.internalAdapter.consumeVerificationValue(storedToken);
+				const newUserCallbackURL = new URL(ctx.query.newUserCallbackURL || callbackURL, ctx.context.baseURL).toString();
+				const identifier = magicLinkIdentifier(await storeToken(ctx, token));
+				const pendingValue = await ctx.context.internalAdapter.findVerificationValue(identifier);
+				if (!pendingValue || !parseMagicLinkRecord(pendingValue.value)?.success) redirectWithError("INVALID_TOKEN");
+				const tokenValue = await ctx.context.internalAdapter.consumeVerificationValue(identifier);
 				if (!tokenValue) redirectWithError("INVALID_TOKEN");
-				const { email, name } = JSON.parse(tokenValue.value);
+				const record = parseMagicLinkRecord(tokenValue.value);
+				if (!record?.success) redirectWithError("INVALID_TOKEN");
+				const { email, name } = record.data;
 				let isNewUser = false;
 				let user = await ctx.context.internalAdapter.findUserByEmail(email).then((res) => res?.user);
 				if (!user) if (!opts.disableSignUp) {