better-auth 1.7.9 → 1.7.10

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.9";
+var version = "1.7.10";
 //#endregion
 export { version };

package/dist/plugins/last-login-method/index.mjs

@@ -9,6 +9,7 @@ const lastLoginMethod = (userConfig) => {
 		const path = ctx.path;
 		if (!path) return null;
 		if (path.startsWith("/callback/")) return ctx.params?.id || path.split("/").pop();
+		if (path === "/one-tap/callback") return "google";
 		if (path === "/sign-in/email" || path === "/sign-up/email") return "email";
 		if (path.includes("siwe")) return "siwe";
 		if (path.includes("/passkey/verify-authentication")) return "passkey";

package/dist/plugins/one-tap/client.d.mts

@@ -81,7 +81,7 @@ interface GoogleOneTapOptions {
   /**
    * Cancel the flow when the user taps outside the prompt
    *
-   * Note: To use this option, disable `promptOptions.fedCM`
+   * Note: This may have no effect, as FedCM lets the browser manage dismissal
    */
   cancelOnTapOutside?: boolean | undefined;
   /**
@@ -119,7 +119,9 @@ interface GoogleOneTapOptions {
      */
     maxAttempts?: number;
     /**
-     * Whether to support FedCM (Federated Credential Management) support.
+     * Whether to call `navigator.credentials.preventSilentAccess()` on
+     * sign-out to clear the browser's FedCM credential state. FedCM for
+     * the prompt itself is managed by Google and cannot be disabled.
      *
      * @see {@link https://developer.chrome.com/docs/identity/fedcm/overview}
      * @default true

package/dist/plugins/one-tap/client.mjs

@@ -9,10 +9,7 @@ function isFedCMSupported() {
 * Reasons that should NOT trigger a retry.
 * @see https://developers.google.com/identity/gsi/web/reference/js-reference
 */
-const noRetryReasons = {
-	dismissed: ["credential_returned", "cancel_called"],
-	skipped: ["user_cancel", "tap_outside"]
-};
+const noRetryReasons = { dismissed: ["credential_returned", "cancel_called"] };
 const oneTapClient = (options) => {
 	return {
 		id: "one-tap",
@@ -58,9 +55,9 @@ const oneTapClient = (options) => {
 							if (isSafeUrlScheme(target)) window.location.href = target;
 						}
 					}
-					const { autoSelect, cancelOnTapOutside, context } = opts ?? {};
-					const contextValue = context ?? options.context ?? "signin";
-					const useFedCM = options.promptOptions?.fedCM !== false;
+					const autoSelect = opts?.autoSelect ?? options.autoSelect;
+					const cancelOnTapOutside = opts?.cancelOnTapOutside ?? options.cancelOnTapOutside;
+					const contextValue = opts?.context ?? options.context ?? "signin";
 					window.google?.accounts.id.initialize({
 						client_id: options.clientId,
 						callback: async (response) => {
@@ -76,7 +73,6 @@ const oneTapClient = (options) => {
 						ux_mode: opts?.uxMode || "popup",
 						nonce: opts?.nonce,
 						itp_support: true,
-						use_fedcm_for_prompt: useFedCM,
 						...options.additionalOptions
 					});
 					window.google?.accounts.id.renderButton(container, opts.button.config ?? { type: "icon" });
@@ -97,8 +93,9 @@ const oneTapClient = (options) => {
 						if (isSafeUrlScheme(target)) window.location.href = target;
 					}
 				}
-				const { autoSelect, cancelOnTapOutside, context } = opts ?? {};
-				const contextValue = context ?? options.context ?? "signin";
+				const autoSelect = opts?.autoSelect ?? options.autoSelect;
+				const cancelOnTapOutside = opts?.cancelOnTapOutside ?? options.cancelOnTapOutside;
+				const contextValue = opts?.context ?? options.context ?? "signin";
 				isRequestInProgress = true;
 				try {
 					await loadGoogleScript();
@@ -106,7 +103,6 @@ const oneTapClient = (options) => {
 						let isResolved = false;
 						const baseDelay = options.promptOptions?.baseDelay ?? 1e3;
 						const maxAttempts = options.promptOptions?.maxAttempts ?? 5;
-						const useFedCM = options.promptOptions?.fedCM !== false;
 						window.google?.accounts.id.initialize({
 							client_id: options.clientId,
 							callback: async (response) => {
@@ -128,7 +124,6 @@ const oneTapClient = (options) => {
 							* @see {@link https://developers.google.com/identity/gsi/web/guides/overview}
 							*/
 							itp_support: true,
-							use_fedcm_for_prompt: useFedCM,
 							...options.additionalOptions
 						});
 						const handlePrompt = (attempt) => {
@@ -150,19 +145,8 @@ const oneTapClient = (options) => {
 										resolve();
 									}
 								} else if (notification.isSkippedMoment?.()) {
-									const reason = notification.getSkippedReason?.();
-									if (!reason || noRetryReasons.skipped.includes(reason)) {
-										opts?.onPromptNotification?.(notification);
-										resolve();
-										return;
-									}
-									if (attempt < maxAttempts) {
-										const delay = Math.pow(2, attempt) * baseDelay;
-										setTimeout(() => handlePrompt(attempt + 1), delay);
-									} else {
-										opts?.onPromptNotification?.(notification);
-										resolve();
-									}
+									opts?.onPromptNotification?.(notification);
+									resolve();
 								} else if (notification.isNotDisplayed?.()) {
 									opts?.onPromptNotification?.(notification);
 									resolve();

package/dist/plugins/one-tap/index.mjs

@@ -1,5 +1,7 @@
 import { parseUserOutput } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
+import { getAwaitableValue } from "../../context/helpers.mjs";
+import { toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES } from "../../oauth2/errors.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
@@ -58,16 +60,32 @@ const oneTap = (options) => ({
 			ctx.context.logger.error(`Google One Tap sign-in rejected: id token hosted domain (hd) "${payload.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${configuredHostedDomain}".`);
 			throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
 		}
-		const { email: rawEmail, email_verified, name, picture, sub } = payload;
+		const googleOAuthProvider = await getAwaitableValue(ctx.context.socialProviders, { value: "google" });
+		const providerResult = googleOAuthProvider ? await googleOAuthProvider.getUserInfo({ idToken }) : {
+			user: {
+				name: payload.name,
+				email: payload.email,
+				image: payload.picture,
+				emailVerified: toBoolean(payload.email_verified)
+			},
+			data: payload
+		};
+		if (!providerResult?.user) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+		const providerUser = providerResult.user;
+		const { sub } = payload;
+		const { email: rawEmail, name, image } = providerUser;
 		if (typeof rawEmail !== "string" || !rawEmail) throw new APIError$1("BAD_REQUEST", { message: "Email not available in token" });
 		if (typeof sub !== "string" || !sub) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+		const email = rawEmail.toLowerCase();
+		const emailVerified = toBoolean(providerUser.emailVerified);
 		const result = await handleOAuthUserInfo(ctx, {
 			userInfo: {
+				...providerUser,
 				id: sub,
-				email: rawEmail.toLowerCase(),
-				emailVerified: typeof email_verified === "boolean" ? email_verified : toBoolean(email_verified),
+				email,
+				emailVerified,
 				name: typeof name === "string" ? name : "",
-				image: typeof picture === "string" ? picture : void 0
+				image: typeof image === "string" ? image : void 0
 			},
 			account: {
 				providerId: "google",
@@ -76,11 +94,12 @@ const oneTap = (options) => ({
 				scope: "openid,profile,email"
 			},
 			disableSignUp: options?.disableSignup || googleProvider?.disableSignUp,
+			overrideUserInfo: googleProvider?.overrideUserInfoOnSignIn,
 			source: {
 				method: "oauth",
 				oauth: {
 					providerId: "google",
-					profile: payload
+					profile: toOAuthProfileRecord(providerResult.data)
 				}
 			}
 		});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.9",
+  "version": "1.7.10",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -221,6 +221,11 @@
       "types": "./dist/plugins/bearer/index.d.mts",
       "default": "./dist/plugins/bearer/index.mjs"
     },
+    "./plugins/captcha": {
+      "dev-source": "./src/plugins/captcha/index.ts",
+      "types": "./dist/plugins/captcha/index.d.mts",
+      "default": "./dist/plugins/captcha/index.mjs"
+    },
     "./plugins/custom-session": {
       "dev-source": "./src/plugins/custom-session/index.ts",
       "types": "./dist/plugins/custom-session/index.d.mts",
@@ -276,6 +281,16 @@
       "types": "./dist/plugins/one-time-token/index.d.mts",
       "default": "./dist/plugins/one-time-token/index.mjs"
     },
+    "./plugins/one-tap": {
+      "dev-source": "./src/plugins/one-tap/index.ts",
+      "types": "./dist/plugins/one-tap/index.d.mts",
+      "default": "./dist/plugins/one-tap/index.mjs"
+    },
+    "./plugins/open-api": {
+      "dev-source": "./src/plugins/open-api/index.ts",
+      "types": "./dist/plugins/open-api/index.d.mts",
+      "default": "./dist/plugins/open-api/index.mjs"
+    },
     "./plugins/phone-number": {
       "dev-source": "./src/plugins/phone-number/index.ts",
       "types": "./dist/plugins/phone-number/index.d.mts",
@@ -355,6 +370,9 @@
       "api": [
         "./dist/api/index.d.mts"
       ],
+      "test": [
+        "./dist/test-utils/index.d.mts"
+      ],
       "db": [
         "./dist/db/index.d.mts"
       ],
@@ -415,6 +433,9 @@
       "plugins/bearer": [
         "./dist/plugins/bearer/index.d.mts"
       ],
+      "plugins/captcha": [
+        "./dist/plugins/captcha/index.d.mts"
+      ],
       "plugins/custom-session": [
         "./dist/plugins/custom-session/index.d.mts"
       ],
@@ -433,12 +454,21 @@
       "plugins/one-time-token": [
         "./dist/plugins/one-time-token/index.d.mts"
       ],
+      "plugins/one-tap": [
+        "./dist/plugins/one-tap/index.d.mts"
+      ],
+      "plugins/open-api": [
+        "./dist/plugins/open-api/index.d.mts"
+      ],
       "plugins/jwt": [
         "./dist/plugins/jwt/index.d.mts"
       ],
       "plugins/magic-link": [
         "./dist/plugins/magic-link/index.d.mts"
       ],
+      "plugins/multi-session": [
+        "./dist/plugins/multi-session/index.d.mts"
+      ],
       "plugins/organization": [
         "./dist/plugins/organization/index.d.mts"
       ],
@@ -473,13 +503,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.9",
-    "@better-auth/drizzle-adapter": "1.7.9",
-    "@better-auth/kysely-adapter": "1.7.9",
-    "@better-auth/memory-adapter": "1.7.9",
-    "@better-auth/mongo-adapter": "1.7.9",
-    "@better-auth/prisma-adapter": "1.7.9",
-    "@better-auth/telemetry": "1.7.9"
+    "@better-auth/core": "1.7.10",
+    "@better-auth/drizzle-adapter": "1.7.10",
+    "@better-auth/kysely-adapter": "1.7.10",
+    "@better-auth/memory-adapter": "1.7.10",
+    "@better-auth/mongo-adapter": "1.7.10",
+    "@better-auth/prisma-adapter": "1.7.10",
+    "@better-auth/telemetry": "1.7.10"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",