better-auth 1.7.6 → 1.7.8

package/dist/plugins/oauth-proxy/index.d.mts

@@ -41,12 +41,11 @@ interface OAuthProxyOptions {
    * A dedicated secret used to encrypt and decrypt data passed between
    * servers during the OAuth proxy flow.
    *
-   * When set, this secret is used **instead of** the global
-   * `BETTER_AUTH_SECRET` for all OAuth proxy encryption operations.
-   * This limits the blast radius if the secret is shared across
-   * environments (production, preview, development): a leaked proxy
-   * secret cannot be used to forge sessions or decrypt other data
-   * protected by the main secret.
+   * When set, keys derived from this secret are used **instead of** keys
+   * derived from `BETTER_AUTH_SECRET` for OAuth proxy encryption.
+   * This limits exposure of data protected only by the main secret if
+   * the proxy secret is shared across environments (production, preview,
+   * development). A compromised proxy secret can still affect OAuth flows.
    *
    * All environments participating in the OAuth proxy flow must share
    * the same `secret` value.

package/dist/plugins/oauth-proxy/index.mjs

@@ -9,7 +9,8 @@ import { redirectOnError } from "../../oauth2/errors.mjs";
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { setOAuthState } from "../../api/state/oauth.mjs";
-import { parseGenericState } from "../../state.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
+import { getAuthStateVerificationIdentifier, parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
@@ -66,7 +67,7 @@ const oauthCallbackQuerySchema = z.object({
 });
 const oAuthProxy = (opts) => {
 	const maxAge = opts?.maxAge ?? 60;
-	const getEncryptionKey = (ctx) => opts?.secret ?? ctx.context.secretConfig;
+	const getEncryptionKey = (ctx, purpose) => derivePurposeKey(opts?.secret ?? ctx.context.secretConfig, purpose);
 	const oauthProxyCompletion = createAuthEndpoint("/callback/:id/oauth-proxy", {
 		method: "GET",
 		operationId: "oauthProxyCompletion",
@@ -84,7 +85,7 @@ const oAuthProxy = (opts) => {
 		let decryptedPayload;
 		try {
 			decryptedPayload = await symmetricDecrypt({
-				key: getEncryptionKey(ctx),
+				key: getEncryptionKey(ctx, "oauth-proxy-profile"),
 				data: encryptedProfile
 			});
 		} catch (e) {
@@ -225,7 +226,7 @@ const oAuthProxy = (opts) => {
 					let statePackage;
 					try {
 						statePackage = parseJSON(await symmetricDecrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-package"),
 							data: state
 						}));
 					} catch {
@@ -245,7 +246,7 @@ const oAuthProxy = (opts) => {
 					let stateData;
 					try {
 						stateData = parseJSON(await symmetricDecrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-state"),
 							data: statePackage.stateCookie
 						}));
 					} catch (e) {
@@ -338,7 +339,7 @@ const oAuthProxy = (opts) => {
 						timestamp: Date.now()
 					};
 					const encryptedPayload = await symmetricEncrypt({
-						key: getEncryptionKey(ctx),
+						key: getEncryptionKey(ctx, "oauth-proxy-profile"),
 						data: JSON.stringify(payload)
 					});
 					proxyCallbackURL.searchParams.set("profile", encryptedPayload);
@@ -366,11 +367,11 @@ const oAuthProxy = (opts) => {
 								const oauthStateCookie = ctx.context.createAuthCookie("oauth_state");
 								const encryptedCookieValue = parseSetCookieHeader(setCookieHeader).get(oauthStateCookie.name)?.value;
 								if (encryptedCookieValue) plaintextState = await symmetricDecrypt({
-									key: ctx.context.secretConfig,
+									key: derivePurposeKey(ctx.context.secretConfig, "oauth-state-cookie"),
 									data: encryptedCookieValue
 								});
 							}
-						} else plaintextState = (await ctx.context.internalAdapter.findVerificationValue(originalState))?.value;
+						} else plaintextState = (await ctx.context.internalAdapter.findVerificationValue(getAuthStateVerificationIdentifier(originalState)))?.value;
 						if (!plaintextState) {
 							ctx.context.logger.warn("No OAuth state found for proxy");
 							return;
@@ -378,13 +379,13 @@ const oAuthProxy = (opts) => {
 						const statePackage = {
 							state: originalState,
 							stateCookie: await symmetricEncrypt({
-								key: getEncryptionKey(ctx),
+								key: getEncryptionKey(ctx, "oauth-proxy-state"),
 								data: plaintextState
 							}),
 							isOAuthProxy: true
 						};
 						const encryptedPackage = await symmetricEncrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-package"),
 							data: JSON.stringify(statePackage)
 						});
 						oauthURL.searchParams.set("state", encryptedPackage);

package/dist/plugins/organization/client.mjs

@@ -1,5 +1,6 @@
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { useAuthQuery } from "../../client/query.mjs";
+import { matchesSessionSignal } from "../../client/config.mjs";
 import { adminAc, defaultRoles, memberAc, ownerAc } from "./access/statement.mjs";
 import { ORGANIZATION_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermissionFn } from "./permission.mjs";
@@ -71,7 +72,7 @@ const organizationClient = (options) => {
 			},
 			{
 				matcher(path) {
-					return path === "/sign-out" || path.startsWith("/organization");
+					return matchesSessionSignal(path) || path.startsWith("/organization");
 				},
 				signal: "$activeOrgSignal"
 			},

package/dist/plugins/organization/routes/crud-members.d.mts

@@ -1009,48 +1009,7 @@ declare const getActiveMemberRole: <O extends OrganizationOptions>(options: O) =
     };
   }>>)[];
 }, {
-  role: (((O["teams"] extends {
-    enabled: true;
-  } ? {
-    id: string;
-    organizationId: string;
-    role: InferOrganizationRolesFromOption<O>;
-    createdAt: Date;
-    userId: string;
-    teamId?: string | undefined;
-    user: {
-      id: string;
-      email: string;
-      name: string;
-      image?: string | undefined;
-    };
-  } : {
-    id: string;
-    organizationId: string;
-    role: InferOrganizationRolesFromOption<O>;
-    createdAt: Date;
-    userId: string;
-    user: {
-      id: string;
-      email: string;
-      name: string;
-      image?: string | undefined;
-    };
-  }) & (O["schema"] extends {
-    member?: {
-      additionalFields: infer Field extends Record<string, _$_better_auth_core_db0.DBFieldAttribute>;
-    } | undefined;
-  } ? FieldAttributeToObject<Field> : {}) extends infer T ? { [K in keyof T]: T[K] } : never) & {
-    user: {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
-    };
-  })["role"];
+  role: InferOrganizationRolesFromOption<O>;
 }>;
 //#endregion
 export { addMember, getActiveMember, getActiveMemberRole, leaveOrganization, listMembers, removeMember, updateMemberRole };

package/dist/plugins/organization/routes/crud-members.mjs

@@ -512,7 +512,7 @@ const getActiveMemberRole = (options) => createAuthEndpoint("/organization/get-a
 		organizationId
 	});
 	if (!member) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION);
-	return ctx.json({ role: member?.role });
+	return ctx.json({ role: member.role });
 });
 //#endregion
 export { addMember, getActiveMember, getActiveMemberRole, leaveOrganization, listMembers, removeMember, updateMemberRole };

package/dist/plugins/phone-number/routes.mjs

@@ -4,7 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword } from "../../utils/password.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -175,15 +175,19 @@ const sendPhoneNumberOTP = (opts) => createAuthEndpoint("/phone-number/send-otp"
 async function verifyAndConsumePhoneNumberOTP(ctx, opts, body) {
 	const { phoneNumber, code } = body;
 	if (opts.verifyOTP) {
-		if (!await opts.verifyOTP({
-			phoneNumber,
-			code
-		}, ctx)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(phoneNumber);
+		await verifyWithCustomVerifier(ctx, opts.verifyOTP, phoneNumber, code, phoneNumber);
 		return;
 	}
 	await verifyPhoneNumberOTP(ctx, opts, phoneNumber, code);
 }
+/** Checks the code with `verifyOTP`, then drops the code stored under `identifier`. */
+async function verifyWithCustomVerifier(ctx, verifyOTP, phoneNumber, code, identifier) {
+	if (!await verifyOTP({
+		phoneNumber,
+		code
+	}, ctx)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
+	await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
+}
 /**
 * ### API Methods
 *
@@ -459,7 +463,17 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		} }
 	} }
 }, async (ctx) => {
-	await verifyPhoneNumberOTP(ctx, opts, `${ctx.body.phoneNumber}-request-password-reset`, ctx.body.otp);
+	const phoneResetIdentifier = `${ctx.body.phoneNumber}-request-password-reset`;
+	let otpConsumed = false;
+	if (opts.verifyOTP) {
+		assertPasswordNotTooShort(ctx, ctx.body.newPassword);
+		assertPasswordNotTooLong(ctx, ctx.body.newPassword);
+		await verifyWithCustomVerifier(ctx, opts.verifyOTP, ctx.body.phoneNumber, ctx.body.otp, phoneResetIdentifier);
+		otpConsumed = true;
+	} else if (!await matchesUsableStoredPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp)) {
+		await verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp);
+		otpConsumed = true;
+	}
 	const user = await ctx.context.adapter.findOne({
 		model: "user",
 		where: [{
@@ -471,15 +485,8 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
 	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
 	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
-	if (!await ctx.context.internalAdapter.findCredentialAccount(user.id)) await ctx.context.internalAdapter.createAccount({
-		userId: user.id,
-		providerId: "credential",
-		accountId: user.id,
-		password: hashedPassword
-	});
-	else await ctx.context.internalAdapter.updatePassword(user.id, hashedPassword);
+	await resetCredentialPassword(ctx, user.id, hashedPassword, otpConsumed ? void 0 : () => verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp));
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user }, ctx.request);
-	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(user.id);
 	return ctx.json({ status: true });
 });
 /**
@@ -518,6 +525,17 @@ async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode) {
 		throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
 	}
 }
+/**
+* Reports whether the provided code matches a stored, unexpired record with
+* attempts left, without consuming it or counting an attempt.
+*/
+async function matchesUsableStoredPhoneNumberOTP(ctx, opts, identifier, providedCode) {
+	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
+	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return false;
+	const [otpValue, rawAttempts] = existing.value.split(":");
+	if (parseVerificationAttempts(rawAttempts) >= (opts?.allowedAttempts ?? 3)) return false;
+	return otpValue === providedCode;
+}
 function parseVerificationAttempts(value) {
 	const attempts = Number(value ?? 0);
 	return Number.isSafeInteger(attempts) && attempts > 0 ? attempts : 0;

package/dist/state.mjs

@@ -1,6 +1,7 @@
 import { generateRandomString } from "./crypto/random.mjs";
 import { symmetricDecrypt, symmetricEncrypt } from "./crypto/index.mjs";
 import { expireCookie } from "./cookies/index.mjs";
+import { derivePurposeKey } from "./crypto/purpose.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import * as z from "zod";
 //#region src/state.ts
@@ -32,6 +33,8 @@ const stateDataSchema = z.looseObject({
 	*/
 	serverContext: z.record(z.string(), z.unknown()).optional()
 });
+/** Verification key for database-backed OAuth and SAML relay state. */
+const getAuthStateVerificationIdentifier = (state) => `auth-state:${state}`;
 const INTERNAL_STATE_KEYS = new Set(Object.keys(stateDataSchema.shape));
 var StateError = class extends BetterAuthError {
 	code;
@@ -59,7 +62,7 @@ async function generateGenericState(c, stateData, settings) {
 			oauthState: state
 		};
 		const encryptedData = await symmetricEncrypt({
-			key: c.context.secretConfig,
+			key: derivePurposeKey(c.context.secretConfig, "oauth-state-cookie"),
 			data: JSON.stringify(payload)
 		});
 		const stateCookie = c.context.createAuthCookie(settings?.cookieName ?? "oauth_state", { maxAge: 600 });
@@ -78,7 +81,7 @@ async function generateGenericState(c, stateData, settings) {
 			...stateData,
 			oauthState: state
 		}),
-		identifier: state,
+		identifier: getAuthStateVerificationIdentifier(state),
 		expiresAt
 	})) throw new StateError("Unable to create verification. Make sure the database adapter is properly working and there is a verification table in the database", { code: "state_generation_error" });
 	return {
@@ -99,7 +102,7 @@ async function parseGenericState(c, state, settings) {
 		});
 		try {
 			const decryptedData = await symmetricDecrypt({
-				key: c.context.secretConfig,
+				key: derivePurposeKey(c.context.secretConfig, "oauth-state-cookie"),
 				data: encryptedData
 			});
 			parsedData = stateDataSchema.parse(JSON.parse(decryptedData));
@@ -117,7 +120,7 @@ async function parseGenericState(c, state, settings) {
 		});
 		expireCookie(c, stateCookie);
 	} else {
-		const data = await c.context.internalAdapter.findVerificationValue(state);
+		const data = await c.context.internalAdapter.findVerificationValue(getAuthStateVerificationIdentifier(state));
 		if (!data) throw new StateError("State mismatch: verification not found", {
 			code: "state_mismatch",
 			details: { state }
@@ -136,7 +139,7 @@ async function parseGenericState(c, state, settings) {
 			errorURL: parsedData.errorURL
 		});
 		expireCookie(c, stateCookie);
-		await c.context.internalAdapter.deleteVerificationByIdentifier(state);
+		await c.context.internalAdapter.deleteVerificationByIdentifier(getAuthStateVerificationIdentifier(state));
 	}
 	if (parsedData.expiresAt < Date.now()) throw new StateError("Invalid state: request expired", {
 		code: "state_mismatch",
@@ -146,4 +149,4 @@ async function parseGenericState(c, state, settings) {
 	return parsedData;
 }
 //#endregion
-export { INTERNAL_STATE_KEYS, StateError, generateGenericState, parseGenericState };
+export { INTERNAL_STATE_KEYS, StateError, generateGenericState, getAuthStateVerificationIdentifier, parseGenericState };

package/dist/utils/hashing.mjs

@@ -1,5 +1,5 @@
-import { keccak_256 } from "@noble/hashes/sha3.js";
 import { utf8ToBytes } from "@noble/hashes/utils.js";
+import { keccak_256 } from "@noble/hashes/sha3.js";
 //#region src/utils/hashing.ts
 /**
 * TS implementation of ERC-55 ("Mixed-case checksum address encoding") using @noble/hashes

package/dist/utils/middleware-response.mjs

@@ -2,6 +2,9 @@
 const middlewareResponse = ({ message, status, code }) => ({ response: new Response(JSON.stringify({
 	message,
 	code
-}), { status }) });
+}), {
+	status,
+	headers: { "Content-Type": "application/json" }
+}) });
 //#endregion
 export { middlewareResponse };

package/dist/utils/password.mjs

@@ -1,3 +1,4 @@
+import { runWithTransaction } from "@better-auth/core/context";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 //#region src/utils/password.ts
 function assertPasswordNotTooShort(ctx, password) {
@@ -12,6 +13,37 @@ function assertPasswordNotTooLong(ctx, password) {
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
 	}
 }
+/**
+* Sets a user's credential password after a reset, revoking their sessions
+* when `emailAndPassword.revokeSessionsOnPasswordReset` is enabled.
+*
+* `consumeResetToken` spends the single-use reset token or OTP and throws when
+* it is no longer valid. It runs first inside the same transaction as
+* revocation and the password write, so a failure in any of them leaves all
+* three unchanged and the user can retry. Verification values held only in
+* secondary storage are consumed with `getAndDelete`, which can't roll back,
+* so a later failure there still spends the token. Secondary-storage sessions are
+* removed by an after-commit hook, so they can't roll back with the write.
+* Sessions are revoked before the write so that on an adapter without
+* transactions a failure still keeps the old password rather than committing a
+* new one while existing sessions stay valid.
+*/
+async function resetCredentialPassword(ctx, userId, passwordHash, consumeResetToken) {
+	await runWithTransaction(ctx.context.adapter, async () => {
+		await consumeResetToken?.();
+		if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(userId);
+		if (!await ctx.context.internalAdapter.findCredentialAccount(userId)) {
+			await ctx.context.internalAdapter.createAccount({
+				userId,
+				providerId: "credential",
+				accountId: userId,
+				password: passwordHash
+			});
+			return;
+		}
+		await ctx.context.internalAdapter.updatePassword(userId, passwordHash);
+	});
+}
 async function validatePassword(ctx, data) {
 	assertPasswordNotTooLong(ctx, data.password);
 	const credentialAccount = await ctx.context.internalAdapter.findCredentialAccount(data.userId);
@@ -43,4 +75,4 @@ async function shouldRequirePassword(ctx, userId, allowPasswordless) {
 	return Boolean(credentialAccount?.password);
 }
 //#endregion
-export { assertPasswordNotTooLong, assertPasswordNotTooShort, checkPassword, shouldRequirePassword, validatePassword };
+export { assertPasswordNotTooLong, assertPasswordNotTooShort, checkPassword, resetCredentialPassword, shouldRequirePassword, validatePassword };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.6",
+  "version": "1.7.8",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -463,23 +463,23 @@
     }
   },
   "dependencies": {
-    "@better-auth/utils": "0.4.2",
+    "@better-auth/utils": "0.5.0",
     "@better-fetch/fetch": "1.3.2",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "better-call": "1.4.0",
+    "better-call": "1.4.2",
     "defu": "^6.1.4",
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.6",
-    "@better-auth/drizzle-adapter": "1.7.6",
-    "@better-auth/kysely-adapter": "1.7.6",
-    "@better-auth/memory-adapter": "1.7.6",
-    "@better-auth/mongo-adapter": "1.7.6",
-    "@better-auth/prisma-adapter": "1.7.6",
-    "@better-auth/telemetry": "1.7.6"
+    "@better-auth/core": "1.7.8",
+    "@better-auth/drizzle-adapter": "1.7.8",
+    "@better-auth/kysely-adapter": "1.7.8",
+    "@better-auth/memory-adapter": "1.7.8",
+    "@better-auth/mongo-adapter": "1.7.8",
+    "@better-auth/prisma-adapter": "1.7.8",
+    "@better-auth/telemetry": "1.7.8"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -487,8 +487,8 @@
     "@opentelemetry/sdk-trace-base": "^2.10.0",
     "@opentelemetry/sdk-trace-node": "^2.10.0",
     "@sveltejs/kit": "^2.70.1",
-    "@tanstack/react-start": "^1.168.4",
-    "@tanstack/solid-start": "^1.168.4",
+    "@tanstack/react-start": "^1.168.60",
+    "@tanstack/solid-start": "^1.168.57",
     "@types/bun": "^1.3.14",
     "@types/google.accounts": "^0.0.18",
     "@types/pg": "^8.20.0",
@@ -511,7 +511,7 @@
   "peerDependencies": {
     "@lynx-js/react": "*",
     "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0",
-    "@sveltejs/kit": "^2.0.0",
+    "@sveltejs/kit": "^2.0.0 || ^3.0.0",
     "@tanstack/react-start": "^1.0.0",
     "@tanstack/solid-start": "^1.0.0",
     "drizzle-kit": ">=0.31.4 || >=1.0.0-beta.1",