better-auth 1.7.7 → 1.7.8

package/dist/plugins/generic-oauth/index.mjs

@@ -12,6 +12,7 @@ import { slack } from "./providers/slack.mjs";
 import { yandex } from "./providers/yandex.mjs";
 import { APIError } from "@better-auth/core/error";
 import { applyDefaultAccessTokenExpiry, createAuthorizationURL, refreshAccessToken, validateAuthorizationCode, verifyProviderIdToken } from "@better-auth/core/oauth2";
+import { createAuthMiddleware } from "@better-auth/core/api";
 import { createRemoteJWKSet, decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/generic-oauth/index.ts
@@ -21,10 +22,20 @@ function isSecretlessTokenEndpointAuth(tokenEndpointAuth) {
 function isClientSecretTokenEndpointAuth(tokenEndpointAuth) {
 	return tokenEndpointAuth?.method === "client_secret_basic" || tokenEndpointAuth?.method === "client_secret_post";
 }
-async function fetchDiscovery(url, headers) {
+/** A request waits on a discovery retry, so bound it (the SSO plugin uses 10s too). */
+const DISCOVERY_RETRY_TIMEOUT_MS = 1e4;
+/**
+* Providers skipped because startup discovery failed. Init stores them on each auth
+* instance's context, so one plugin object can serve several instances. It is a context
+* field rather than a WeakMap because requests see copies of the context, and a later
+* plugin may replace `socialProviders`.
+*/
+const getPendingDiscovery = (ctx) => ctx.genericOAuthPendingDiscovery;
+async function fetchDiscovery(url, headers, timeout) {
 	const result = await betterFetch(url, {
 		method: "GET",
-		headers
+		headers,
+		signal: timeout ? AbortSignal.timeout(timeout) : void 0
 	});
 	if (result.error || !result.data) return null;
 	if (result.data.issuer) try {
@@ -74,203 +85,235 @@ const genericOAuth = (options) => {
 		seenIds.add(id);
 	}
 	if (nonUniqueIds.size > 0) console.warn(`Duplicate provider IDs found: ${Array.from(nonUniqueIds).join(", ")}`);
-	return {
-		id: "generic-oauth",
-		version: PACKAGE_VERSION,
-		init: async (ctx) => {
-			const genericProviders = [];
-			for (const c of options.config) {
-				let authorizationUrl = c.authorizationUrl;
-				let tokenUrl = c.tokenUrl;
-				let userInfoUrl = c.userInfoUrl;
-				let endSessionEndpoint = c.endSessionEndpoint;
-				let issuer;
-				let isOidc = false;
-				let idTokenConfig;
-				if (c.discoveryUrl) {
-					const discovered = await fetchDiscovery(c.discoveryUrl, c.discoveryHeaders).catch((err) => {
-						ctx.logger.error(`Discovery fetch failed for "${c.providerId}": ${err}`);
-						return null;
-					});
-					if (discovered) {
-						authorizationUrl ??= discovered.authorization_endpoint;
-						tokenUrl ??= discovered.token_endpoint;
-						userInfoUrl ??= discovered.userinfo_endpoint;
-						endSessionEndpoint ??= discovered.end_session_endpoint;
-						issuer = discovered.issuer;
-						const signingAlgs = discovered.id_token_signing_alg_values_supported;
-						isOidc = Array.isArray(signingAlgs) && signingAlgs.length > 0;
-						if (discovered.jwks_uri && discovered.issuer) {
-							let jwksUrl;
-							try {
-								jwksUrl = new URL(discovered.jwks_uri, c.discoveryUrl);
-							} catch {
-								ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
-								continue;
-							}
-							idTokenConfig = {
-								jwks: createRemoteJWKSet(jwksUrl),
-								issuer: discovered.issuer,
-								audience: c.clientId,
-								algorithms: isOidc ? signingAlgs : void 0
-							};
+	const buildProviders = async (configs, ctx, discoveryTimeout) => {
+		const genericProviders = [];
+		for (const c of configs) {
+			let authorizationUrl = c.authorizationUrl;
+			let tokenUrl = c.tokenUrl;
+			let userInfoUrl = c.userInfoUrl;
+			let endSessionEndpoint = c.endSessionEndpoint;
+			let issuer;
+			let isOidc = false;
+			let idTokenConfig;
+			if (c.discoveryUrl) {
+				const discovered = await fetchDiscovery(c.discoveryUrl, c.discoveryHeaders, discoveryTimeout).catch((err) => {
+					ctx.logger.error(`Discovery fetch failed for "${c.providerId}": ${err}`);
+					return null;
+				});
+				if (discovered) {
+					authorizationUrl ??= discovered.authorization_endpoint;
+					tokenUrl ??= discovered.token_endpoint;
+					userInfoUrl ??= discovered.userinfo_endpoint;
+					endSessionEndpoint ??= discovered.end_session_endpoint;
+					issuer = discovered.issuer;
+					const signingAlgs = discovered.id_token_signing_alg_values_supported;
+					isOidc = Array.isArray(signingAlgs) && signingAlgs.length > 0;
+					if (discovered.jwks_uri && discovered.issuer) {
+						let jwksUrl;
+						try {
+							jwksUrl = new URL(discovered.jwks_uri, c.discoveryUrl);
+						} catch {
+							ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
+							continue;
 						}
-					}
-					if (!authorizationUrl || !tokenUrl && !c.getToken) {
-						ctx.logger.error(`Provider "${c.providerId}": discovery left no usable authorization endpoint or token exchange. Provider skipped.`);
-						continue;
+						idTokenConfig = {
+							jwks: createRemoteJWKSet(jwksUrl),
+							issuer: discovered.issuer,
+							audience: c.clientId,
+							algorithms: isOidc ? signingAlgs : void 0
+						};
 					}
 				}
-				if (c.requireIdTokenVerification && !idTokenConfig) {
-					if (c.discoveryUrl) {
-						ctx.logger.error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri. Provider skipped.`);
-						continue;
-					}
-					throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
+				if (!authorizationUrl || !tokenUrl && !c.getToken) {
+					ctx.logger.error(`Provider "${c.providerId}": discovery left no usable authorization endpoint or token exchange. Provider skipped.`);
+					continue;
 				}
-				const tokenEndpointAuth = c.tokenEndpointAuth;
-				if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
-				if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
-				if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
-				const accountSubject = c.accountSubject;
-				const provider = {
-					id: c.providerId,
-					name: c.name ?? c.providerId,
-					issuer,
-					accountSubject: ({ tokens, profile }) => {
-						const genericProfile = profile;
-						if (accountSubject) return accountSubject({
-							tokens,
-							profile: genericProfile
-						});
-						return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
-					},
-					idToken: idTokenConfig,
-					requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
-					allowIdpInitiated: c.allowIdpInitiated,
-					async createEndSessionURL(data) {
-						if (c.disableProviderLogout) return null;
-						if (!endSessionEndpoint) return null;
-						let url;
-						try {
-							url = new URL(endSessionEndpoint);
-						} catch {
+			}
+			if (c.requireIdTokenVerification && !idTokenConfig) {
+				if (c.discoveryUrl) {
+					ctx.logger.error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri. Provider skipped.`);
+					continue;
+				}
+				throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
+			}
+			const tokenEndpointAuth = c.tokenEndpointAuth;
+			if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
+			if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
+			if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
+			const accountSubject = c.accountSubject;
+			const provider = {
+				id: c.providerId,
+				name: c.name ?? c.providerId,
+				issuer,
+				accountSubject: ({ tokens, profile }) => {
+					const genericProfile = profile;
+					if (accountSubject) return accountSubject({
+						tokens,
+						profile: genericProfile
+					});
+					return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
+				},
+				idToken: idTokenConfig,
+				requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
+				allowIdpInitiated: c.allowIdpInitiated,
+				async createEndSessionURL(data) {
+					if (c.disableProviderLogout) return null;
+					if (!endSessionEndpoint) return null;
+					let url;
+					try {
+						url = new URL(endSessionEndpoint);
+					} catch {
+						return null;
+					}
+					if (data.idToken) url.searchParams.set("id_token_hint", data.idToken);
+					const configuredRedirectURI = data.postLogoutRedirectURI ?? c.postLogoutRedirectURI;
+					const postLogoutRedirectURI = configuredRedirectURI ? new URL(configuredRedirectURI, ctx.baseURL).toString() : void 0;
+					if (postLogoutRedirectURI) {
+						url.searchParams.set("post_logout_redirect_uri", postLogoutRedirectURI);
+						url.searchParams.set("client_id", c.clientId);
+						if (data.state) url.searchParams.set("state", data.state);
+					} else if (!data.idToken) url.searchParams.set("client_id", c.clientId);
+					return url;
+				},
+				createAuthorizationURL(data) {
+					if (!authorizationUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.INVALID_OAUTH_CONFIGURATION);
+					return createAuthorizationURL({
+						id: c.providerId,
+						options: {
+							clientId: c.clientId,
+							clientSecret: c.clientSecret,
+							redirectURI: c.redirectURI
+						},
+						authorizationEndpoint: authorizationUrl,
+						state: data.state,
+						codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
+						scopes: (() => {
+							const merged = [...data.scopes ?? [], ...c.scopes ?? []];
+							if (isOidc && !merged.includes("openid")) merged.unshift("openid");
+							return merged;
+						})(),
+						redirectURI: data.redirectURI,
+						prompt: c.prompt,
+						accessType: c.accessType,
+						responseType: c.responseType,
+						responseMode: c.responseMode,
+						nonce: data.idTokenNonce,
+						additionalParams: {
+							...c.authorizationUrlParams ?? {},
+							...data.additionalParams ?? {}
+						},
+						loginHint: data.loginHint
+					});
+				},
+				async validateAuthorizationCode(data) {
+					if (c.getToken) return applyDefaultAccessTokenExpiry(await c.getToken(data), c.accessTokenExpiresIn);
+					if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
+					return applyDefaultAccessTokenExpiry(await validateAuthorizationCode({
+						headers: c.authorizationHeaders,
+						code: data.code,
+						codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
+						redirectURI: data.redirectURI,
+						options: {
+							clientId: c.clientId,
+							clientSecret: c.clientSecret,
+							redirectURI: c.redirectURI
+						},
+						tokenEndpoint: tokenUrl,
+						authentication: c.authentication,
+						tokenEndpointAuth,
+						additionalParams: c.tokenUrlParams
+					}), c.accessTokenExpiresIn);
+				},
+				async getUserInfo(tokens) {
+					const { expectedIdTokenNonce, ...oauthTokens } = tokens;
+					if (oauthTokens.idToken && provider.idToken) {
+						if (!await verifyProviderIdToken(provider, oauthTokens.idToken, expectedIdTokenNonce)) {
+							ctx.logger.error(`Provider "${c.providerId}": id_token failed verification against the discovery JWKS or expected nonce`);
 							return null;
 						}
-						if (data.idToken) url.searchParams.set("id_token_hint", data.idToken);
-						const configuredRedirectURI = data.postLogoutRedirectURI ?? c.postLogoutRedirectURI;
-						const postLogoutRedirectURI = configuredRedirectURI ? new URL(configuredRedirectURI, ctx.baseURL).toString() : void 0;
-						if (postLogoutRedirectURI) {
-							url.searchParams.set("post_logout_redirect_uri", postLogoutRedirectURI);
-							url.searchParams.set("client_id", c.clientId);
-							if (data.state) url.searchParams.set("state", data.state);
-						} else if (!data.idToken) url.searchParams.set("client_id", c.clientId);
-						return url;
-					},
-					createAuthorizationURL(data) {
-						if (!authorizationUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.INVALID_OAUTH_CONFIGURATION);
-						return createAuthorizationURL({
-							id: c.providerId,
-							options: {
-								clientId: c.clientId,
-								clientSecret: c.clientSecret,
-								redirectURI: c.redirectURI
-							},
-							authorizationEndpoint: authorizationUrl,
-							state: data.state,
-							codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
-							scopes: (() => {
-								const merged = [...data.scopes ?? [], ...c.scopes ?? []];
-								if (isOidc && !merged.includes("openid")) merged.unshift("openid");
-								return merged;
-							})(),
-							redirectURI: data.redirectURI,
-							prompt: c.prompt,
-							accessType: c.accessType,
-							responseType: c.responseType,
-							responseMode: c.responseMode,
-							nonce: data.idTokenNonce,
-							additionalParams: {
-								...c.authorizationUrlParams ?? {},
-								...data.additionalParams ?? {}
-							},
-							loginHint: data.loginHint
-						});
-					},
-					async validateAuthorizationCode(data) {
-						if (c.getToken) return applyDefaultAccessTokenExpiry(await c.getToken(data), c.accessTokenExpiresIn);
-						if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
-						return applyDefaultAccessTokenExpiry(await validateAuthorizationCode({
-							headers: c.authorizationHeaders,
-							code: data.code,
-							codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
-							redirectURI: data.redirectURI,
-							options: {
-								clientId: c.clientId,
-								clientSecret: c.clientSecret,
-								redirectURI: c.redirectURI
-							},
-							tokenEndpoint: tokenUrl,
-							authentication: c.authentication,
-							tokenEndpointAuth,
-							additionalParams: c.tokenUrlParams
-						}), c.accessTokenExpiresIn);
-					},
-					async getUserInfo(tokens) {
-						const { expectedIdTokenNonce, ...oauthTokens } = tokens;
-						if (oauthTokens.idToken && provider.idToken) {
-							if (!await verifyProviderIdToken(provider, oauthTokens.idToken, expectedIdTokenNonce)) {
-								ctx.logger.error(`Provider "${c.providerId}": id_token failed verification against the discovery JWKS or expected nonce`);
-								return null;
-							}
-						}
-						const raw = c.getUserInfo ? await c.getUserInfo(oauthTokens) : await fetchUserInfo(oauthTokens, userInfoUrl);
-						if (!raw) return null;
-						const mapped = c.mapProfileToUser ? await c.mapProfileToUser(raw) : {};
-						const user = {
-							email: raw.email,
-							emailVerified: raw.emailVerified,
-							image: raw.image,
-							name: raw.name,
-							...mapped
-						};
-						return {
-							user: {
-								...user,
-								image: user.image ?? void 0
-							},
-							data: raw
-						};
-					},
-					async refreshAccessToken(refreshToken, refreshCtx) {
-						if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
-						const resolvedRefreshParams = typeof c.refreshTokenParams === "function" ? await c.refreshTokenParams(refreshCtx) : c.refreshTokenParams;
-						return applyDefaultAccessTokenExpiry(await refreshAccessToken({
-							refreshToken,
-							options: {
-								clientId: c.clientId,
-								clientSecret: c.clientSecret
-							},
-							authentication: c.authentication,
-							tokenEndpointAuth,
-							tokenEndpoint: tokenUrl,
-							extraParams: resolvedRefreshParams
-						}), c.accessTokenExpiresIn);
-					},
-					disableImplicitSignUp: c.disableImplicitSignUp,
-					disableSignUp: c.disableSignUp,
-					options: {
-						disableSignUp: c.disableSignUp,
-						overrideUserInfoOnSignIn: c.overrideUserInfo,
-						requireEmailVerification: c.requireEmailVerification
 					}
-				};
-				genericProviders.push(provider);
-			}
+					const raw = c.getUserInfo ? await c.getUserInfo(oauthTokens) : await fetchUserInfo(oauthTokens, userInfoUrl);
+					if (!raw) return null;
+					const mapped = c.mapProfileToUser ? await c.mapProfileToUser(raw) : {};
+					const user = {
+						email: raw.email,
+						emailVerified: raw.emailVerified,
+						image: raw.image,
+						name: raw.name,
+						...mapped
+					};
+					return {
+						user: {
+							...user,
+							image: user.image ?? void 0
+						},
+						data: raw
+					};
+				},
+				async refreshAccessToken(refreshToken, refreshCtx) {
+					if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
+					const resolvedRefreshParams = typeof c.refreshTokenParams === "function" ? await c.refreshTokenParams(refreshCtx) : c.refreshTokenParams;
+					return applyDefaultAccessTokenExpiry(await refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: c.clientId,
+							clientSecret: c.clientSecret
+						},
+						authentication: c.authentication,
+						tokenEndpointAuth,
+						tokenEndpoint: tokenUrl,
+						extraParams: resolvedRefreshParams
+					}), c.accessTokenExpiresIn);
+				},
+				disableImplicitSignUp: c.disableImplicitSignUp,
+				disableSignUp: c.disableSignUp,
+				options: {
+					disableSignUp: c.disableSignUp,
+					overrideUserInfoOnSignIn: c.overrideUserInfo,
+					requireEmailVerification: c.requireEmailVerification
+				}
+			};
+			genericProviders.push(provider);
+		}
+		return genericProviders;
+	};
+	const retryDiscovery = (ctx, providerId) => {
+		const pendingDiscovery = getPendingDiscovery(ctx);
+		const pending = pendingDiscovery?.get(providerId);
+		if (!pending) return;
+		pending.attempt ??= buildProviders([pending.config], ctx, DISCOVERY_RETRY_TIMEOUT_MS).then(([provider]) => {
+			if (!provider) return;
+			pendingDiscovery?.delete(providerId);
+			ctx.socialProviders.unshift(provider);
+		}).finally(() => {
+			pending.attempt = void 0;
+		});
+		return pending.attempt;
+	};
+	const requestedProviderId = (context) => {
+		const id = context.body?.provider ?? context.body?.providerId ?? context.query?.provider ?? context.params?.id;
+		return typeof id === "string" ? id : void 0;
+	};
+	return {
+		id: "generic-oauth",
+		version: PACKAGE_VERSION,
+		init: async (ctx) => {
+			const genericProviders = await buildProviders(options.config, ctx);
+			const built = new Set(genericProviders.map((p) => p.id));
+			const genericOAuthPendingDiscovery = new Map(options.config.filter((c) => !built.has(c.providerId)).map((c) => [c.providerId, { config: c }]));
 			const existingIds = new Set(ctx.socialProviders.map((p) => p.id));
 			for (const gp of genericProviders) if (existingIds.has(gp.id)) ctx.logger.warn(`Generic OAuth provider "${gp.id}" shadows a built-in social provider with the same ID`);
-			return { context: { socialProviders: genericProviders.concat(ctx.socialProviders) } };
+			return { context: {
+				socialProviders: genericProviders.concat(ctx.socialProviders),
+				genericOAuthPendingDiscovery
+			} };
 		},
+		hooks: { before: [{
+			matcher: (context) => getPendingDiscovery(context.context)?.has(requestedProviderId(context) ?? "") === true,
+			handler: createAuthMiddleware(async (ctx) => {
+				await retryDiscovery(ctx.context, requestedProviderId(ctx) ?? "");
+			})
+		}] },
 		options,
 		$ERROR_CODES: GENERIC_OAUTH_ERROR_CODES
 	};

package/dist/plugins/last-login-method/index.mjs

@@ -27,9 +27,9 @@ const lastLoginMethod = (userConfig) => {
 		return config.customResolveMethod?.(resolveContext) ?? defaultResolveMethod(resolveContext);
 	};
 	const config = {
-		cookieName: "better-auth.last_used_login_method",
-		maxAge: 3600 * 24 * 30,
-		...userConfig
+		...userConfig,
+		cookieName: userConfig?.cookieName ?? "better-auth.last_used_login_method",
+		maxAge: userConfig?.maxAge ?? 3600 * 24 * 30
 	};
 	return {
 		id: "last-login-method",

package/dist/plugins/magic-link/index.mjs

@@ -132,15 +132,9 @@ const magicLink = (options) => {
 				method: "GET",
 				query: magicLinkVerifyQuerySchema,
 				use: [
-					originCheck((ctx) => {
-						return ctx.query.callbackURL ? decodeURIComponent(ctx.query.callbackURL) : "/";
-					}),
-					originCheck((ctx) => {
-						return ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : "/";
-					}),
-					originCheck((ctx) => {
-						return ctx.query.errorCallbackURL ? decodeURIComponent(ctx.query.errorCallbackURL) : "/";
-					})
+					originCheck((ctx) => ctx.query.callbackURL || "/"),
+					originCheck((ctx) => ctx.query.newUserCallbackURL || "/"),
+					originCheck((ctx) => ctx.query.errorCallbackURL || "/")
 				],
 				requireHeaders: true,
 				metadata: { openapi: {
@@ -159,14 +153,14 @@ const magicLink = (options) => {
 				} }
 			}, async (ctx) => {
 				const token = ctx.query.token;
-				const callbackURL = new URL(ctx.query.callbackURL ? decodeURIComponent(ctx.query.callbackURL) : "/", ctx.context.baseURL).toString();
-				const errorCallbackURL = new URL(ctx.query.errorCallbackURL ? decodeURIComponent(ctx.query.errorCallbackURL) : callbackURL, ctx.context.baseURL);
+				const callbackURL = new URL(ctx.query.callbackURL || "/", ctx.context.baseURL).toString();
+				const errorCallbackURL = new URL(ctx.query.errorCallbackURL || callbackURL, ctx.context.baseURL);
 				function redirectWithError(error, description) {
 					errorCallbackURL.searchParams.set("error", error);
 					if (description) errorCallbackURL.searchParams.set("error_description", description);
 					throw ctx.redirect(errorCallbackURL.toString());
 				}
-				const newUserCallbackURL = new URL(ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : callbackURL, ctx.context.baseURL).toString();
+				const newUserCallbackURL = new URL(ctx.query.newUserCallbackURL || callbackURL, ctx.context.baseURL).toString();
 				const identifier = magicLinkIdentifier(await storeToken(ctx, token));
 				const pendingValue = await ctx.context.internalAdapter.findVerificationValue(identifier);
 				if (!pendingValue || !parseMagicLinkRecord(pendingValue.value)?.success) redirectWithError("INVALID_TOKEN");

package/dist/plugins/open-api/index.mjs

@@ -1,5 +1,4 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import "../../utils/index.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { generator } from "./generator.mjs";

package/dist/plugins/organization/routes/crud-members.d.mts

@@ -1009,48 +1009,7 @@ declare const getActiveMemberRole: <O extends OrganizationOptions>(options: O) =
     };
   }>>)[];
 }, {
-  role: (((O["teams"] extends {
-    enabled: true;
-  } ? {
-    id: string;
-    organizationId: string;
-    role: InferOrganizationRolesFromOption<O>;
-    createdAt: Date;
-    userId: string;
-    teamId?: string | undefined;
-    user: {
-      id: string;
-      email: string;
-      name: string;
-      image?: string | undefined;
-    };
-  } : {
-    id: string;
-    organizationId: string;
-    role: InferOrganizationRolesFromOption<O>;
-    createdAt: Date;
-    userId: string;
-    user: {
-      id: string;
-      email: string;
-      name: string;
-      image?: string | undefined;
-    };
-  }) & (O["schema"] extends {
-    member?: {
-      additionalFields: infer Field extends Record<string, _$_better_auth_core_db0.DBFieldAttribute>;
-    } | undefined;
-  } ? FieldAttributeToObject<Field> : {}) extends infer T ? { [K in keyof T]: T[K] } : never) & {
-    user: {
-      id: string;
-      createdAt: Date;
-      updatedAt: Date;
-      email: string;
-      emailVerified: boolean;
-      name: string;
-      image?: string | null | undefined;
-    };
-  })["role"];
+  role: InferOrganizationRolesFromOption<O>;
 }>;
 //#endregion
 export { addMember, getActiveMember, getActiveMemberRole, leaveOrganization, listMembers, removeMember, updateMemberRole };

package/dist/plugins/organization/routes/crud-members.mjs

@@ -512,7 +512,7 @@ const getActiveMemberRole = (options) => createAuthEndpoint("/organization/get-a
 		organizationId
 	});
 	if (!member) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION);
-	return ctx.json({ role: member?.role });
+	return ctx.json({ role: member.role });
 });
 //#endregion
 export { addMember, getActiveMember, getActiveMemberRole, leaveOrganization, listMembers, removeMember, updateMemberRole };

package/dist/plugins/phone-number/routes.mjs

@@ -4,8 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
-import "../../utils/index.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword } from "../../utils/password.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -176,15 +175,19 @@ const sendPhoneNumberOTP = (opts) => createAuthEndpoint("/phone-number/send-otp"
 async function verifyAndConsumePhoneNumberOTP(ctx, opts, body) {
 	const { phoneNumber, code } = body;
 	if (opts.verifyOTP) {
-		if (!await opts.verifyOTP({
-			phoneNumber,
-			code
-		}, ctx)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(phoneNumber);
+		await verifyWithCustomVerifier(ctx, opts.verifyOTP, phoneNumber, code, phoneNumber);
 		return;
 	}
 	await verifyPhoneNumberOTP(ctx, opts, phoneNumber, code);
 }
+/** Checks the code with `verifyOTP`, then drops the code stored under `identifier`. */
+async function verifyWithCustomVerifier(ctx, verifyOTP, phoneNumber, code, identifier) {
+	if (!await verifyOTP({
+		phoneNumber,
+		code
+	}, ctx)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
+	await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
+}
 /**
 * ### API Methods
 *
@@ -460,7 +463,17 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		} }
 	} }
 }, async (ctx) => {
-	await verifyPhoneNumberOTP(ctx, opts, `${ctx.body.phoneNumber}-request-password-reset`, ctx.body.otp);
+	const phoneResetIdentifier = `${ctx.body.phoneNumber}-request-password-reset`;
+	let otpConsumed = false;
+	if (opts.verifyOTP) {
+		assertPasswordNotTooShort(ctx, ctx.body.newPassword);
+		assertPasswordNotTooLong(ctx, ctx.body.newPassword);
+		await verifyWithCustomVerifier(ctx, opts.verifyOTP, ctx.body.phoneNumber, ctx.body.otp, phoneResetIdentifier);
+		otpConsumed = true;
+	} else if (!await matchesUsableStoredPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp)) {
+		await verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp);
+		otpConsumed = true;
+	}
 	const user = await ctx.context.adapter.findOne({
 		model: "user",
 		where: [{
@@ -472,15 +485,8 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
 	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
 	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
-	if (!await ctx.context.internalAdapter.findCredentialAccount(user.id)) await ctx.context.internalAdapter.createAccount({
-		userId: user.id,
-		providerId: "credential",
-		accountId: user.id,
-		password: hashedPassword
-	});
-	else await ctx.context.internalAdapter.updatePassword(user.id, hashedPassword);
+	await resetCredentialPassword(ctx, user.id, hashedPassword, otpConsumed ? void 0 : () => verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp));
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user }, ctx.request);
-	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(user.id);
 	return ctx.json({ status: true });
 });
 /**
@@ -519,6 +525,17 @@ async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode) {
 		throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
 	}
 }
+/**
+* Reports whether the provided code matches a stored, unexpired record with
+* attempts left, without consuming it or counting an attempt.
+*/
+async function matchesUsableStoredPhoneNumberOTP(ctx, opts, identifier, providedCode) {
+	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
+	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return false;
+	const [otpValue, rawAttempts] = existing.value.split(":");
+	if (parseVerificationAttempts(rawAttempts) >= (opts?.allowedAttempts ?? 3)) return false;
+	return otpValue === providedCode;
+}
 function parseVerificationAttempts(value) {
 	const attempts = Number(value ?? 0);
 	return Number.isSafeInteger(attempts) && attempts > 0 ? attempts : 0;