better-auth 1.7.7 → 1.7.8

package/dist/utils/password.mjs

@@ -1,3 +1,4 @@
+import { runWithTransaction } from "@better-auth/core/context";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 //#region src/utils/password.ts
 function assertPasswordNotTooShort(ctx, password) {
@@ -12,6 +13,37 @@ function assertPasswordNotTooLong(ctx, password) {
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
 	}
 }
+/**
+* Sets a user's credential password after a reset, revoking their sessions
+* when `emailAndPassword.revokeSessionsOnPasswordReset` is enabled.
+*
+* `consumeResetToken` spends the single-use reset token or OTP and throws when
+* it is no longer valid. It runs first inside the same transaction as
+* revocation and the password write, so a failure in any of them leaves all
+* three unchanged and the user can retry. Verification values held only in
+* secondary storage are consumed with `getAndDelete`, which can't roll back,
+* so a later failure there still spends the token. Secondary-storage sessions are
+* removed by an after-commit hook, so they can't roll back with the write.
+* Sessions are revoked before the write so that on an adapter without
+* transactions a failure still keeps the old password rather than committing a
+* new one while existing sessions stay valid.
+*/
+async function resetCredentialPassword(ctx, userId, passwordHash, consumeResetToken) {
+	await runWithTransaction(ctx.context.adapter, async () => {
+		await consumeResetToken?.();
+		if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(userId);
+		if (!await ctx.context.internalAdapter.findCredentialAccount(userId)) {
+			await ctx.context.internalAdapter.createAccount({
+				userId,
+				providerId: "credential",
+				accountId: userId,
+				password: passwordHash
+			});
+			return;
+		}
+		await ctx.context.internalAdapter.updatePassword(userId, passwordHash);
+	});
+}
 async function validatePassword(ctx, data) {
 	assertPasswordNotTooLong(ctx, data.password);
 	const credentialAccount = await ctx.context.internalAdapter.findCredentialAccount(data.userId);
@@ -43,4 +75,4 @@ async function shouldRequirePassword(ctx, userId, allowPasswordless) {
 	return Boolean(credentialAccount?.password);
 }
 //#endregion
-export { assertPasswordNotTooLong, assertPasswordNotTooShort, checkPassword, shouldRequirePassword, validatePassword };
+export { assertPasswordNotTooLong, assertPasswordNotTooShort, checkPassword, resetCredentialPassword, shouldRequirePassword, validatePassword };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.7",
+  "version": "1.7.8",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -463,23 +463,23 @@
     }
   },
   "dependencies": {
-    "@better-auth/utils": "0.4.2",
+    "@better-auth/utils": "0.5.0",
     "@better-fetch/fetch": "1.3.2",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "better-call": "1.4.0",
+    "better-call": "1.4.2",
     "defu": "^6.1.4",
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.7",
-    "@better-auth/drizzle-adapter": "1.7.7",
-    "@better-auth/kysely-adapter": "1.7.7",
-    "@better-auth/memory-adapter": "1.7.7",
-    "@better-auth/mongo-adapter": "1.7.7",
-    "@better-auth/prisma-adapter": "1.7.7",
-    "@better-auth/telemetry": "1.7.7"
+    "@better-auth/core": "1.7.8",
+    "@better-auth/drizzle-adapter": "1.7.8",
+    "@better-auth/kysely-adapter": "1.7.8",
+    "@better-auth/memory-adapter": "1.7.8",
+    "@better-auth/mongo-adapter": "1.7.8",
+    "@better-auth/prisma-adapter": "1.7.8",
+    "@better-auth/telemetry": "1.7.8"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -487,8 +487,8 @@
     "@opentelemetry/sdk-trace-base": "^2.10.0",
     "@opentelemetry/sdk-trace-node": "^2.10.0",
     "@sveltejs/kit": "^2.70.1",
-    "@tanstack/react-start": "^1.168.4",
-    "@tanstack/solid-start": "^1.168.4",
+    "@tanstack/react-start": "^1.168.60",
+    "@tanstack/solid-start": "^1.168.57",
     "@types/bun": "^1.3.14",
     "@types/google.accounts": "^0.0.18",
     "@types/pg": "^8.20.0",
@@ -511,7 +511,7 @@
   "peerDependencies": {
     "@lynx-js/react": "*",
     "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0",
-    "@sveltejs/kit": "^2.0.0",
+    "@sveltejs/kit": "^2.0.0 || ^3.0.0",
     "@tanstack/react-start": "^1.0.0",
     "@tanstack/solid-start": "^1.0.0",
     "drizzle-kit": ">=0.31.4 || >=1.0.0-beta.1",

package/dist/utils/index.mjs

@@ -1,5 +0,0 @@
-import "./url.mjs";
-import "../state.mjs";
-import "../oauth2/state.mjs";
-import "./hide-metadata.mjs";
-export {};