better-auth 1.7.9 → 1.8.0-beta.0

package/dist/api/routes/sign-up.mjs

@@ -5,7 +5,7 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
 import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
-import { runWithTransaction } from "@better-auth/core/context";
+import { queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
 import { isDevelopment } from "@better-auth/core/env";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
@@ -198,7 +198,13 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 				* between existing and non-existing emails.
 				*/
 				await ctx.context.password.hash(password);
-				if (ctx.context.options.emailAndPassword?.onExistingUserSignUp) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailAndPassword.onExistingUserSignUp({ user: dbUser.user }, safeCloneRequest(ctx.request)));
+				const onExistingUserSignUp = ctx.context.options.emailAndPassword?.onExistingUserSignUp;
+				if (onExistingUserSignUp) {
+					const request = safeCloneRequest(ctx.request);
+					await queueAfterTransactionHook(async () => {
+						await ctx.context.runInBackgroundOrAwait(onExistingUserSignUp({ user: dbUser.user }, request));
+					}, { onError: (error) => ctx.context.logger.error("Failed to run onExistingUserSignUp after sign-up", error) });
+				}
 				return buildGenericDuplicateResponse();
 			}
 			throw APIError.from("UNPROCESSABLE_ENTITY", BASE_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);
@@ -238,15 +244,21 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 			accountId: createdUser.id,
 			password: hash
 		});
-		if (ctx.context.options.emailVerification?.sendOnSignUp ?? ctx.context.options.emailAndPassword.requireEmailVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, createdUser.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+		const shouldSendVerificationEmail = ctx.context.options.emailVerification?.sendOnSignUp ?? ctx.context.options.emailAndPassword.requireEmailVerification;
+		const sendVerificationEmail = ctx.context.options.emailVerification?.sendVerificationEmail;
+		if (shouldSendVerificationEmail && sendVerificationEmail) {
+			const user = createdUser;
 			const callbackURL = body.callbackURL ? encodeURIComponent(body.callbackURL) : encodeURIComponent("/");
-			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
-			if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
-				user: createdUser,
-				url,
-				token
-			}, safeCloneRequest(ctx.request)));
+			const request = safeCloneRequest(ctx.request);
+			await queueAfterTransactionHook(async () => {
+				const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+				const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
+				await ctx.context.runInBackgroundOrAwait(sendVerificationEmail({
+					user,
+					url,
+					token
+				}, request));
+			}, { onError: (error) => ctx.context.logger.error("Failed to send the sign-up verification email", error) });
 		}
 		if (shouldSkipAutoSignIn) return ctx.json({
 			token: null,

package/dist/oauth2/link-account.mjs

@@ -310,16 +310,16 @@ async function handleOAuthUserInfo(c, opts) {
 		isRegister: false
 	};
 	const requireEmailVerification = c.context.socialProviders.find((p) => p.id === account.providerId)?.options?.requireEmailVerification;
-	if (isRegister && !user.emailVerified && (c.context.options.emailVerification?.sendOnSignUp ?? requireEmailVerification)) await dispatchVerificationEmail(c, user, callbackURL, opts.deferNonDatabaseWrites);
+	if (isRegister && !user.emailVerified && (c.context.options.emailVerification?.sendOnSignUp ?? requireEmailVerification)) await dispatchVerificationEmail(c, user, callbackURL);
 	if (requireEmailVerification && !user.emailVerified) {
-		if (!isRegister && c.context.options.emailVerification?.sendOnSignIn) await dispatchVerificationEmail(c, user, callbackURL, opts.deferNonDatabaseWrites);
+		if (!isRegister && c.context.options.emailVerification?.sendOnSignIn) await dispatchVerificationEmail(c, user, callbackURL);
 		return {
 			error: OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_VERIFIED,
 			data: null,
 			isRegister
 		};
 	}
-	const session = await c.context.internalAdapter.createSession(user.id, void 0, void 0, void 0, { deferSecondaryStorageWrites: opts.deferNonDatabaseWrites === true });
+	const session = await c.context.internalAdapter.createSession(user.id, void 0, void 0, void 0, { deferSecondaryStorageWrites: true });
 	if (!session) return {
 		error: "unable to create session",
 		data: null,
@@ -339,7 +339,7 @@ async function handleOAuthUserInfo(c, opts) {
 		accountCookie: pendingAccountCookie
 	};
 }
-async function dispatchVerificationEmail(c, user, callbackURL, deferUntilAfterTransaction) {
+async function dispatchVerificationEmail(c, user, callbackURL) {
 	const sendVerificationEmail = c.context.options.emailVerification?.sendVerificationEmail;
 	if (!sendVerificationEmail) return;
 	const send = async () => {
@@ -355,8 +355,7 @@ async function dispatchVerificationEmail(c, user, callbackURL, deferUntilAfterTr
 			c.context.logger.error("Failed to send OAuth verification email", e);
 		}
 	};
-	if (deferUntilAfterTransaction) await queueAfterTransactionHook(send);
-	else await send();
+	await queueAfterTransactionHook(send);
 }
 /**
 * Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.9";
+var version = "1.8.0-beta.0";
 //#endregion
 export { version };

package/dist/plugins/device-authorization/index.d.mts

@@ -1,6 +1,6 @@
 import { TimeString, ms, sec } from "../../utils/time.mjs";
 import { DeviceCode } from "./schema.mjs";
-import { DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, redeemDeviceCode } from "./routes.mjs";
+import { DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, assertDeviceCodePending, buildVerificationUris, decideDeviceCode, findDeviceCodeByUserCode, redeemDeviceCode } from "./routes.mjs";
 import { GenericEndpointContext, StandardSchemaV1 } from "@better-auth/core";
 import { DBFieldAttribute } from "@better-auth/core/db";
 import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
@@ -74,7 +74,7 @@ interface DeviceAuthorizationGrantAuthorization {
  * A token grant that contributes its request state to device authorization
  * without expanding the standalone plugin's database or endpoint contracts.
  */
-interface DeviceAuthorizationGrant<RequestFields extends z.ZodRawShape = z.ZodRawShape, VerificationContext extends Record<string, unknown> = Record<string, unknown>> {
+interface DeviceAuthorizationGrant<RequestFields extends z.ZodRawShape = z.ZodRawShape> {
   /** Additional request fields accepted only when this grant is configured. */
   requestSchemaFields: RequestFields;
   /** Additional request errors introduced by the grant's protocol extensions. */
@@ -90,15 +90,16 @@ interface DeviceAuthorizationGrant<RequestFields extends z.ZodRawShape = z.ZodRa
     ctx: GenericEndpointContext;
     request: DeviceAuthorizationRequest & z.infer<z.ZodObject<RequestFields>>;
   }) => DeviceAuthorizationGrantAuthorization | undefined | Promise<DeviceAuthorizationGrantAuthorization | undefined>;
-  /** Refuse the standalone session-token endpoint for grant-owned codes. */
-  assertSessionRedemption: (input: {
+  /**
+   * Throw when a code this grant issued reaches a standalone endpoint:
+   * `/device/token` (`redeem`) or `/device`, `/device/approve`, `/device/deny`
+   * (`approve`). The error should name the endpoint to use instead.
+   */
+  assertStandaloneUse: (input: {
     ctx: GenericEndpointContext;
     deviceCode: Record<string, unknown>;
+    use: "redeem" | "approve";
   }) => void | Promise<void>;
-  /** Add grant-owned information to the owner-only verification response. */
-  getVerificationContext: (deviceCode: Record<string, unknown>) => VerificationContext | undefined;
-  /** OpenAPI properties matching `getVerificationContext()`. */
-  verificationOpenAPIProperties?: Record<string, Record<string, unknown>>;
 }
 type DeviceAuthorizationPluginOptions<Grant extends DeviceAuthorizationGrant | undefined = undefined> = Partial<DeviceAuthorizationOptions> & {
   /** Optional token grant that extends the device authorization flow. */grant?: Grant;
@@ -158,37 +159,37 @@ declare const deviceAuthorization: <Grant extends DeviceAuthorizationGrant | und
       cloneRequest: true;
       body: z.ZodObject<(("scope" | "user_id" | "client_id") & keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends never ? {
+      }>> ? RequestFields : Record<never, never>) extends never ? {
         client_id: z.ZodString;
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
       } & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_1 ? { -readonly [P in keyof T_1]: T_1[P] } : never) : ({
+      }>> ? RequestFields : Record<never, never>) extends infer T_1 ? { -readonly [P in keyof T_1]: T_1[P] } : never) : ({
         client_id: z.ZodString;
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
       } extends infer T_2 extends z.core.util.SomeObject ? { [K in keyof T_2 as K extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K]: T_2[K] } : never) & (((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>> ? RequestFields : Record<never, never>) ? never : K]: T_2[K] } : never) & (((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_4 ? { -readonly [P in keyof T_4]: T_4[P] } : never) extends infer T_3 extends z.core.util.SomeObject ? { [K_1 in keyof T_3]: T_3[K_1] } : never)) extends infer T ? { [k in keyof T]: T[k] } : never, z.core.$strip> | z.ZodObject<(("scope" | "user_id" | "client_id") & keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>> ? RequestFields : Record<never, never>) extends infer T_4 ? { -readonly [P in keyof T_4]: T_4[P] } : never) extends infer T_3 extends z.core.util.SomeObject ? { [K_1 in keyof T_3]: T_3[K_1] } : never)) extends infer T ? { [k in keyof T]: T[k] } : never, z.core.$strip> | z.ZodObject<(("scope" | "user_id" | "client_id") & keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends never ? {
+      }>> ? RequestFields : Record<never, never>) extends never ? {
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
         client_id: z.ZodOptional<z.ZodString>;
       } & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_6 ? { -readonly [P in keyof T_6]: T_6[P] } : never) : ({
+      }>> ? RequestFields : Record<never, never>) extends infer T_6 ? { -readonly [P in keyof T_6]: T_6[P] } : never) : ({
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
         client_id: z.ZodOptional<z.ZodString>;
       } extends infer T_7 extends z.core.util.SomeObject ? { [K_2 in keyof T_7 as K_2 extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K_2]: T_7[K_2] } : never) & (((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>> ? RequestFields : Record<never, never>) ? never : K_2]: T_7[K_2] } : never) & (((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_9 ? { -readonly [P in keyof T_9]: T_9[P] } : never) extends infer T_8 extends z.core.util.SomeObject ? { [K_1 in keyof T_8]: T_8[K_1] } : never)) extends infer T_5 ? { [k_1 in keyof T_5]: T_5[k_1] } : never, z.core.$strip>;
+      }>> ? RequestFields : Record<never, never>) extends infer T_9 ? { -readonly [P in keyof T_9]: T_9[P] } : never) extends infer T_8 extends z.core.util.SomeObject ? { [K_1 in keyof T_8]: T_8[K_1] } : never)) extends infer T_5 ? { [k_1 in keyof T_5]: T_5[k_1] } : never, z.core.$strip>;
       error: z.ZodObject<{
         error: z.ZodEnum<{ [k_3 in (readonly ["invalid_request", "invalid_client", "unauthorized_client", "invalid_scope", ...Grant extends {
           requestErrorCodes: infer ErrorCodes extends readonly string[];
@@ -307,10 +308,10 @@ declare const deviceAuthorization: <Grant extends DeviceAuthorizationGrant | und
       error: z.ZodObject<{
         error: z.ZodEnum<{
           invalid_request: "invalid_request";
-          authorization_pending: "authorization_pending";
-          slow_down: "slow_down";
           expired_token: "expired_token";
           access_denied: "access_denied";
+          authorization_pending: "authorization_pending";
+          slow_down: "slow_down";
           invalid_grant: "invalid_grant";
         }>;
         error_description: z.ZodString;
@@ -414,13 +415,11 @@ declare const deviceAuthorization: <Grant extends DeviceAuthorizationGrant | und
         };
       };
     }, {
-      user_code: string;
-      status: string;
       client_id?: string | undefined;
       scope?: string | undefined;
-    } & Partial<Grant extends DeviceAuthorizationGrant<infer _RequestFields extends Readonly<{
-      [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-    }>, infer VerificationContext extends Record<string, unknown>> ? VerificationContext : Record<never, never>>>;
+      user_code: string;
+      status: string;
+    }>;
     deviceApprove: _$better_call0.StrictEndpoint<"/device/approve", {
       method: "POST";
       body: z.ZodObject<{
@@ -431,7 +430,6 @@ declare const deviceAuthorization: <Grant extends DeviceAuthorizationGrant | und
           invalid_request: "invalid_request";
           expired_token: "expired_token";
           access_denied: "access_denied";
-          device_code_already_processed: "device_code_already_processed";
           unauthorized: "unauthorized";
         }>;
         error_description: z.ZodString;
@@ -526,7 +524,7 @@ declare const deviceAuthorization: <Grant extends DeviceAuthorizationGrant | und
   options: {
     grant: DeviceAuthorizationGrant<Readonly<{
       [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-    }>, Record<string, unknown>> | undefined;
+    }>> | undefined;
     expiresIn: TimeString;
     interval: TimeString;
     deviceCodeLength: number;
@@ -555,4 +553,4 @@ declare const deviceAuthorization: <Grant extends DeviceAuthorizationGrant | und
   };
 };
 //#endregion
-export { DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, type DeviceCode, type DeviceCodeRedemptionAuthorization, type DeviceCodeRedemptionResult, TimeString, deviceAuthorization, deviceAuthorizationOptionsSchema, ms, redeemDeviceCode, sec };
+export { DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, type DeviceCode, type DeviceCodeRedemptionAuthorization, type DeviceCodeRedemptionResult, TimeString, assertDeviceCodePending, buildVerificationUris, decideDeviceCode, deviceAuthorization, deviceAuthorizationOptionsSchema, findDeviceCodeByUserCode, ms, redeemDeviceCode, sec };

package/dist/plugins/device-authorization/index.mjs

@@ -3,7 +3,7 @@ import { ms } from "../../utils/time.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { DEVICE_AUTHORIZATION_ERROR_CODES } from "./error-codes.mjs";
 import { schema } from "./schema.mjs";
-import { deviceApprove, deviceCode, deviceDeny, deviceToken, deviceVerify, redeemDeviceCode } from "./routes.mjs";
+import { assertDeviceCodePending, buildVerificationUris, decideDeviceCode, deviceCode, deviceDecisionEndpoint, deviceToken, deviceVerify, findDeviceCodeByUserCode, redeemDeviceCode } from "./routes.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import * as z from "zod";
 //#region src/plugins/device-authorization/index.ts
@@ -33,19 +33,11 @@ const deviceAuthorizationRequestFields = new Set([
 	"user_id",
 	"scope"
 ]);
-const deviceVerificationResponseFields = new Set([
-	"user_code",
-	"status",
-	"client_id",
-	"scope"
-]);
 function assertGrantFieldsAreAdditional(grant) {
 	const conflictingDeviceCodeFields = Object.keys(grant?.deviceCodeSchemaFields ?? {}).filter((field) => field in schema.deviceCode.fields);
 	if (conflictingDeviceCodeFields.length > 0) throw new BetterAuthError(`Device authorization grant fields must be additional and cannot redefine deviceCode fields: ${conflictingDeviceCodeFields.join(", ")}`);
 	const conflictingRequestFields = Object.keys(grant?.requestSchemaFields ?? {}).filter((field) => deviceAuthorizationRequestFields.has(field));
 	if (conflictingRequestFields.length > 0) throw new BetterAuthError(`Device authorization grant request fields must be additional and cannot redefine request fields: ${conflictingRequestFields.join(", ")}`);
-	const conflictingVerificationFields = Object.keys(grant?.verificationOpenAPIProperties ?? {}).filter((field) => deviceVerificationResponseFields.has(field));
-	if (conflictingVerificationFields.length > 0) throw new BetterAuthError(`Device authorization grant verification fields must be additional and cannot redefine response fields: ${conflictingVerificationFields.join(", ")}`);
 }
 const deviceAuthorization = (options = {}) => {
 	const { grant: configuredGrant, ...deviceAuthorizationOptions } = options;
@@ -66,8 +58,8 @@ const deviceAuthorization = (options = {}) => {
 			deviceCode: deviceCode(opts, grant),
 			deviceToken: deviceToken(opts, grant),
 			deviceVerify: deviceVerify(grant),
-			deviceApprove,
-			deviceDeny
+			deviceApprove: deviceDecisionEndpoint("/device/approve", grant),
+			deviceDeny: deviceDecisionEndpoint("/device/deny", grant)
 		},
 		rateLimit: [{
 			pathMatcher(path) {
@@ -84,4 +76,4 @@ const deviceAuthorization = (options = {}) => {
 	};
 };
 //#endregion
-export { deviceAuthorization, deviceAuthorizationOptionsSchema, redeemDeviceCode };
+export { assertDeviceCodePending, buildVerificationUris, decideDeviceCode, deviceAuthorization, deviceAuthorizationOptionsSchema, findDeviceCodeByUserCode, redeemDeviceCode };

package/dist/plugins/device-authorization/routes.d.mts

@@ -3,6 +3,39 @@ import { User } from "../../types/models.mjs";
 import { DeviceCode } from "./schema.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
 //#region src/plugins/device-authorization/routes.d.ts
+/**
+ * Preserve exact custom user codes, and normalize only default-alphabet codes.
+ */
+declare function findDeviceCodeByUserCode(ctx: GenericEndpointContext, userCode: string): Promise<{
+  id: string;
+  deviceCode: string;
+  userCode: string;
+  expiresAt: Date;
+  status: string;
+  userId?: string | undefined;
+  lastPolledAt?: Date | undefined;
+  pollingInterval?: number | undefined;
+  clientId?: string | undefined;
+  scope?: string | undefined;
+} | null>;
+/** Throws unless the device code is unexpired and still awaiting a decision. */
+declare function assertDeviceCodePending(deviceCode: DeviceCode): void;
+/**
+ * Records `userId`'s approval or denial of a pending, unexpired device code,
+ * binding an unclaimed code to that user in the same write. The write is
+ * guarded, so a decision that loses a race with another decision, or outlasts
+ * the code, fails instead of overwriting it.
+ */
+declare function decideDeviceCode(ctx: GenericEndpointContext, input: {
+  deviceCode: DeviceCode;
+  userId: string;
+  decision: "approved" | "denied";
+  /**
+   * Fields to persist with the decision, such as grant-owned fields or a
+   * scope the user narrowed on a consent page.
+   */
+  fields?: Record<string, unknown> | undefined;
+}): Promise<void>;
 interface DeviceCodeRedemptionAuthorization<AuthorizationContext> {
   /** Additional ownership predicate used by the atomic claim. */
   ownershipWhere: Where;
@@ -28,5 +61,13 @@ declare function redeemDeviceCode<DeviceCodeFields extends Record<string, unknow
   authorizeRedemption: (deviceCode: DeviceCode & DeviceCodeFields) => DeviceCodeRedemptionAuthorization<AuthorizationContext> | Promise<DeviceCodeRedemptionAuthorization<AuthorizationContext>>;
   prepareRedemption: (deviceCode: DeviceCode & DeviceCodeFields, authorizationContext: AuthorizationContext) => RedemptionContext | Promise<RedemptionContext>;
 }): Promise<DeviceCodeRedemptionResult<DeviceCodeFields, AuthorizationContext, RedemptionContext>>;
+/**
+ * Builds the `verification_uri` and `verification_uri_complete` for a user code,
+ * resolving a relative `verificationUri` against the auth base URL.
+ */
+declare const buildVerificationUris: (verificationUri: string | undefined, baseURL: string, userCode: string) => {
+  verificationUri: string;
+  verificationUriComplete: string;
+};
 //#endregion
-export { DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, redeemDeviceCode };
+export { DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, assertDeviceCodePending, buildVerificationUris, decideDeviceCode, findDeviceCodeByUserCode, redeemDeviceCode };

package/dist/plugins/device-authorization/routes.mjs

@@ -66,6 +66,97 @@ async function findDeviceCodeByUserCode(ctx, userCode) {
 	if (normalizedUserCode === userCode || !defaultUserCodePattern.test(normalizedUserCode)) return exactDeviceCode;
 	return findByUserCode(normalizedUserCode);
 }
+const expiredUserCode = () => new APIError("BAD_REQUEST", {
+	error: "expired_token",
+	error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE.message
+});
+const deviceCodeAlreadyProcessed = () => new APIError("BAD_REQUEST", {
+	error: "invalid_request",
+	error_description: DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_ALREADY_PROCESSED.message
+});
+/** Throws unless the device code is unexpired and still awaiting a decision. */
+function assertDeviceCodePending(deviceCode) {
+	if (deviceCode.expiresAt < /* @__PURE__ */ new Date()) throw expiredUserCode();
+	if (deviceCode.status !== "pending") throw deviceCodeAlreadyProcessed();
+}
+/**
+* Records `userId`'s approval or denial of a pending, unexpired device code,
+* binding an unclaimed code to that user in the same write. The write is
+* guarded, so a decision that loses a race with another decision, or outlasts
+* the code, fails instead of overwriting it.
+*/
+async function decideDeviceCode(ctx, input) {
+	const { deviceCode, userId, decision } = input;
+	if (deviceCode.userId && deviceCode.userId !== userId) throw new APIError("FORBIDDEN", {
+		error: "access_denied",
+		error_description: `You are not authorized to ${decision === "approved" ? "approve" : "deny"} this device authorization`
+	});
+	if (!await ctx.context.adapter.incrementOne({
+		model: "deviceCode",
+		where: [
+			{
+				field: "id",
+				value: deviceCode.id
+			},
+			{
+				field: "status",
+				value: "pending"
+			},
+			{
+				field: "userId",
+				operator: "eq",
+				value: deviceCode.userId ?? null
+			},
+			{
+				field: "expiresAt",
+				operator: "gt",
+				value: /* @__PURE__ */ new Date()
+			}
+		],
+		increment: {},
+		set: {
+			...input.fields,
+			userId,
+			status: decision
+		}
+	})) throw deviceCode.expiresAt <= /* @__PURE__ */ new Date() ? expiredUserCode() : deviceCodeAlreadyProcessed();
+}
+/**
+* Finds the code a standalone endpoint (`/device`, `/device/approve`,
+* `/device/deny`) acts on, refusing codes that a grant approves itself.
+*/
+async function findStandaloneDeviceCode(ctx, grant, userCode) {
+	const deviceCode = await findDeviceCodeByUserCode(ctx, userCode);
+	if (!deviceCode) throw new APIError("BAD_REQUEST", {
+		error: "invalid_request",
+		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message
+	});
+	await grant?.assertStandaloneUse({
+		ctx,
+		deviceCode,
+		use: "approve"
+	});
+	return deviceCode;
+}
+/** Handles `/device/approve` and `/device/deny` for a code the user claimed. */
+async function recordDeviceCodeDecision(ctx, grant, userCode, decision) {
+	const session = await getSessionFromCtx(ctx);
+	if (!session) throw new APIError("UNAUTHORIZED", {
+		error: "unauthorized",
+		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED.message
+	});
+	const deviceCodeRecord = await findStandaloneDeviceCode(ctx, grant, userCode);
+	assertDeviceCodePending(deviceCodeRecord);
+	if (!deviceCodeRecord.userId) throw new APIError("BAD_REQUEST", {
+		error: "invalid_request",
+		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_NOT_CLAIMED.message
+	});
+	await decideDeviceCode(ctx, {
+		deviceCode: deviceCodeRecord,
+		userId: session.user.id,
+		decision
+	});
+}
 const deviceCodeBodySchema = z.object({
 	client_id: z.string().meta({ description: "The client ID of the application" }),
 	user_id: z.string().meta({ description: "The user ID to which the device code should be pre-bound." }).optional(),
@@ -299,6 +390,19 @@ async function redeemDeviceCode(input) {
 		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_DEVICE_CODE.message
 	});
 	const authorization = await input.authorizeRedemption(deviceCodeRecord);
+	if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) {
+		await input.ctx.context.adapter.delete({
+			model: "deviceCode",
+			where: [{
+				field: "id",
+				value: deviceCodeRecord.id
+			}]
+		});
+		throw new APIError("BAD_REQUEST", {
+			error: "expired_token",
+			error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_DEVICE_CODE.message
+		});
+	}
 	if (deviceCodeRecord.lastPolledAt && deviceCodeRecord.pollingInterval) {
 		if (Date.now() - new Date(deviceCodeRecord.lastPolledAt).getTime() < deviceCodeRecord.pollingInterval) throw new APIError("BAD_REQUEST", {
 			error: "slow_down",
@@ -313,19 +417,6 @@ async function redeemDeviceCode(input) {
 		}],
 		update: { lastPolledAt: /* @__PURE__ */ new Date() }
 	});
-	if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) {
-		await input.ctx.context.adapter.delete({
-			model: "deviceCode",
-			where: [{
-				field: "id",
-				value: deviceCodeRecord.id
-			}]
-		});
-		throw new APIError("BAD_REQUEST", {
-			error: "expired_token",
-			error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_DEVICE_CODE.message
-		});
-	}
 	if (deviceCodeRecord.status === "pending") throw new APIError("BAD_REQUEST", {
 		error: "authorization_pending",
 		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHORIZATION_PENDING.message
@@ -438,9 +529,10 @@ Follow [rfc8628#section-3.4](https://datatracker.ietf.org/doc/html/rfc8628#secti
 				error: "invalid_grant",
 				error_description: "Client ID mismatch"
 			});
-			await grant?.assertSessionRedemption({
+			await grant?.assertStandaloneUse({
 				ctx,
-				deviceCode: deviceCodeRecord
+				deviceCode: deviceCodeRecord,
+				use: "redeem"
 			});
 			return {
 				ownershipWhere: {
@@ -508,23 +600,15 @@ const deviceVerify = (grant) => createAuthEndpoint("/device", {
 					scope: {
 						type: "string",
 						description: "The requested scopes, returned only to the authenticated user who owns this request"
-					},
-					...grant?.verificationOpenAPIProperties
+					}
 				}
 			} } }
 		} }
 	} }
 }, async (ctx) => {
 	const { user_code } = ctx.query;
-	const deviceCodeRecord = await findDeviceCodeByUserCode(ctx, user_code);
-	if (!deviceCodeRecord) throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message
-	});
-	if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
-		error: "expired_token",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE.message
-	});
+	const deviceCodeRecord = await findStandaloneDeviceCode(ctx, grant, user_code);
+	if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw expiredUserCode();
 	const session = await getSessionFromCtx(ctx);
 	if (session?.user?.id && !deviceCodeRecord.userId && deviceCodeRecord.status === "pending") {
 		if (await ctx.context.adapter.incrementOne({
@@ -549,149 +633,50 @@ const deviceVerify = (grant) => createAuthEndpoint("/device", {
 		})) deviceCodeRecord.userId = session.user.id;
 	}
 	const canReviewRequest = session?.user.id !== void 0 && deviceCodeRecord.userId === session.user.id;
-	const grantContext = canReviewRequest ? grant?.getVerificationContext(deviceCodeRecord) : void 0;
-	const response = {
-		...canReviewRequest ? grantContext : void 0,
+	return ctx.json({
 		user_code,
 		status: deviceCodeRecord.status,
 		...canReviewRequest ? {
 			client_id: deviceCodeRecord.clientId,
 			scope: deviceCodeRecord.scope
 		} : {}
-	};
-	return ctx.json(response);
-});
-const deviceApprove = createAuthEndpoint("/device/approve", {
-	method: "POST",
-	body: z.object({ userCode: z.string().meta({ description: "The user code to approve" }) }),
-	error: z.object({
-		error: z.enum([
-			"invalid_request",
-			"expired_token",
-			"device_code_already_processed",
-			"unauthorized",
-			"access_denied"
-		]).meta({ description: "Error code" }),
-		error_description: z.string().meta({ description: "Detailed error description" })
-	}),
-	requireHeaders: true,
-	metadata: { openapi: {
-		description: "Approve device authorization",
-		responses: { 200: {
-			description: "Success",
-			content: { "application/json": { schema: {
-				type: "object",
-				properties: { success: { type: "boolean" } }
-			} } }
-		} }
-	} }
-}, async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError("UNAUTHORIZED", {
-		error: "unauthorized",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED.message
-	});
-	const { userCode } = ctx.body;
-	const deviceCodeRecord = await findDeviceCodeByUserCode(ctx, userCode);
-	if (!deviceCodeRecord) throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message
 	});
-	if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
-		error: "expired_token",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE.message
-	});
-	if (deviceCodeRecord.status !== "pending") throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_ALREADY_PROCESSED.message
-	});
-	if (!deviceCodeRecord.userId) throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_NOT_CLAIMED.message
-	});
-	if (deviceCodeRecord.userId !== session.user.id) throw new APIError("FORBIDDEN", {
-		error: "access_denied",
-		error_description: "You are not authorized to approve this device authorization"
-	});
-	await ctx.context.adapter.update({
-		model: "deviceCode",
-		where: [{
-			field: "id",
-			value: deviceCodeRecord.id
-		}],
-		update: {
-			status: "approved",
-			userId: session.user.id
-		}
-	});
-	return ctx.json({ success: true });
 });
-const deviceDeny = createAuthEndpoint("/device/deny", {
-	method: "POST",
-	body: z.object({ userCode: z.string().meta({ description: "The user code to deny" }) }),
-	error: z.object({
-		error: z.enum([
-			"invalid_request",
-			"expired_token",
-			"unauthorized",
-			"access_denied"
-		]).meta({ description: "Error code" }),
-		error_description: z.string().meta({ description: "Detailed error description" })
-	}),
-	requireHeaders: true,
-	metadata: { openapi: {
-		description: "Deny device authorization",
-		responses: { 200: {
-			description: "Success",
-			content: { "application/json": { schema: {
-				type: "object",
-				properties: { success: { type: "boolean" } }
-			} } }
+/** `/device/approve` and `/device/deny`, which differ only in the decision. */
+const deviceDecisionEndpoint = (path, grant) => {
+	const decision = path === "/device/approve" ? "approved" : "denied";
+	const action = decision === "approved" ? "Approve" : "Deny";
+	return createAuthEndpoint(path, {
+		method: "POST",
+		body: z.object({ userCode: z.string().meta({ description: `The user code to ${action.toLowerCase()}` }) }),
+		error: z.object({
+			error: z.enum([
+				"invalid_request",
+				"expired_token",
+				"unauthorized",
+				"access_denied"
+			]).meta({ description: "Error code" }),
+			error_description: z.string().meta({ description: "Detailed error description" })
+		}),
+		requireHeaders: true,
+		metadata: { openapi: {
+			description: `${action} device authorization`,
+			responses: { 200: {
+				description: "Success",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: { success: { type: "boolean" } }
+				} } }
+			} }
 		} }
-	} }
-}, async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError("UNAUTHORIZED", {
-		error: "unauthorized",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED.message
-	});
-	const { userCode } = ctx.body;
-	const deviceCodeRecord = await findDeviceCodeByUserCode(ctx, userCode);
-	if (!deviceCodeRecord) throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message
-	});
-	if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
-		error: "expired_token",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE.message
-	});
-	if (deviceCodeRecord.status !== "pending") throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_ALREADY_PROCESSED.message
-	});
-	if (!deviceCodeRecord.userId) throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_NOT_CLAIMED.message
-	});
-	if (deviceCodeRecord.userId !== session.user.id) throw new APIError("FORBIDDEN", {
-		error: "access_denied",
-		error_description: "You are not authorized to deny this device authorization"
-	});
-	await ctx.context.adapter.update({
-		model: "deviceCode",
-		where: [{
-			field: "id",
-			value: deviceCodeRecord.id
-		}],
-		update: {
-			status: "denied",
-			userId: session.user.id
-		}
+	}, async (ctx) => {
+		await recordDeviceCodeDecision(ctx, grant, ctx.body.userCode, decision);
+		return ctx.json({ success: true });
 	});
-	return ctx.json({ success: true });
-});
+};
 /**
-* @internal
+* Builds the `verification_uri` and `verification_uri_complete` for a user code,
+* resolving a relative `verificationUri` against the auth base URL.
 */
 const buildVerificationUris = (verificationUri, baseURL, userCode) => {
 	const uri = verificationUri || "/device";
@@ -722,4 +707,4 @@ const defaultGenerateUserCode = (length) => {
 	return Array.from(crypto.getRandomValues(chars)).map((byte) => defaultCharset[byte % 32]).join("");
 };
 //#endregion
-export { deviceApprove, deviceCode, deviceDeny, deviceToken, deviceVerify, redeemDeviceCode };
+export { assertDeviceCodePending, buildVerificationUris, decideDeviceCode, deviceCode, deviceDecisionEndpoint, deviceToken, deviceVerify, findDeviceCodeByUserCode, redeemDeviceCode };

package/dist/plugins/index.d.mts

@@ -15,7 +15,7 @@ import { captcha } from "./captcha/index.mjs";
 import { CustomSessionPluginOptions, customSession } from "./custom-session/index.mjs";
 import { TimeString, ms, sec } from "../utils/time.mjs";
 import { DeviceCode } from "./device-authorization/schema.mjs";
-import { DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, redeemDeviceCode } from "./device-authorization/routes.mjs";
+import { DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, assertDeviceCodePending, buildVerificationUris, decideDeviceCode, findDeviceCodeByUserCode, redeemDeviceCode } from "./device-authorization/routes.mjs";
 import { DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, deviceAuthorization, deviceAuthorizationOptionsSchema } from "./device-authorization/index.mjs";
 import { EmailOTPOptions } from "./email-otp/types.mjs";
 import { emailOTP } from "./email-otp/index.mjs";
@@ -66,4 +66,4 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, ValidateRequestContext, VercelBotIdOptions, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, ValidateRequestContext, VercelBotIdOptions, YandexOptions, admin, anonymous, assertDeviceCodePending, auth0, backupCode2fa, bearer, buildVerificationUris, captcha, createAccessControl, createJwk, customSession, decideDeviceCode, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, findDeviceCodeByUserCode, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/index.mjs

@@ -11,7 +11,7 @@ import { anonymous } from "./anonymous/index.mjs";
 import { bearer } from "./bearer/index.mjs";
 import { captcha } from "./captcha/index.mjs";
 import { customSession } from "./custom-session/index.mjs";
-import { redeemDeviceCode } from "./device-authorization/routes.mjs";
+import { assertDeviceCodePending, buildVerificationUris, decideDeviceCode, findDeviceCodeByUserCode, redeemDeviceCode } from "./device-authorization/routes.mjs";
 import { deviceAuthorization, deviceAuthorizationOptionsSchema } from "./device-authorization/index.mjs";
 import { emailOTP } from "./email-otp/index.mjs";
 import { auth0 } from "./generic-oauth/providers/auth0.mjs";
@@ -46,4 +46,4 @@ import { siwe } from "./siwe/index.mjs";
 import { testUtils } from "./test-utils/index.mjs";
 import { twoFactor } from "./two-factor/index.mjs";
 import { username } from "./username/index.mjs";
-export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, auth0, bearer, captcha, createAccessControl, createJwk, customSession, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateExportedKeyPair, genericOAuth, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, microsoftEntraId, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, yandex };
+export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, assertDeviceCodePending, auth0, bearer, buildVerificationUris, captcha, createAccessControl, createJwk, customSession, decideDeviceCode, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, findDeviceCodeByUserCode, generateExportedKeyPair, genericOAuth, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, microsoftEntraId, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, yandex };

package/dist/plugins/last-login-method/index.mjs

@@ -9,6 +9,7 @@ const lastLoginMethod = (userConfig) => {
 		const path = ctx.path;
 		if (!path) return null;
 		if (path.startsWith("/callback/")) return ctx.params?.id || path.split("/").pop();
+		if (path === "/one-tap/callback") return "google";
 		if (path === "/sign-in/email" || path === "/sign-up/email") return "email";
 		if (path.includes("siwe")) return "siwe";
 		if (path.includes("/passkey/verify-authentication")) return "passkey";

package/dist/plugins/one-tap/client.d.mts

@@ -81,7 +81,7 @@ interface GoogleOneTapOptions {
   /**
    * Cancel the flow when the user taps outside the prompt
    *
-   * Note: To use this option, disable `promptOptions.fedCM`
+   * Note: This may have no effect, as FedCM lets the browser manage dismissal
    */
   cancelOnTapOutside?: boolean | undefined;
   /**
@@ -119,7 +119,9 @@ interface GoogleOneTapOptions {
      */
     maxAttempts?: number;
     /**
-     * Whether to support FedCM (Federated Credential Management) support.
+     * Whether to call `navigator.credentials.preventSilentAccess()` on
+     * sign-out to clear the browser's FedCM credential state. FedCM for
+     * the prompt itself is managed by Google and cannot be disabled.
      *
      * @see {@link https://developer.chrome.com/docs/identity/fedcm/overview}
      * @default true

package/dist/plugins/one-tap/client.mjs

@@ -9,10 +9,7 @@ function isFedCMSupported() {
 * Reasons that should NOT trigger a retry.
 * @see https://developers.google.com/identity/gsi/web/reference/js-reference
 */
-const noRetryReasons = {
-	dismissed: ["credential_returned", "cancel_called"],
-	skipped: ["user_cancel", "tap_outside"]
-};
+const noRetryReasons = { dismissed: ["credential_returned", "cancel_called"] };
 const oneTapClient = (options) => {
 	return {
 		id: "one-tap",
@@ -58,9 +55,9 @@ const oneTapClient = (options) => {
 							if (isSafeUrlScheme(target)) window.location.href = target;
 						}
 					}
-					const { autoSelect, cancelOnTapOutside, context } = opts ?? {};
-					const contextValue = context ?? options.context ?? "signin";
-					const useFedCM = options.promptOptions?.fedCM !== false;
+					const autoSelect = opts?.autoSelect ?? options.autoSelect;
+					const cancelOnTapOutside = opts?.cancelOnTapOutside ?? options.cancelOnTapOutside;
+					const contextValue = opts?.context ?? options.context ?? "signin";
 					window.google?.accounts.id.initialize({
 						client_id: options.clientId,
 						callback: async (response) => {
@@ -76,7 +73,6 @@ const oneTapClient = (options) => {
 						ux_mode: opts?.uxMode || "popup",
 						nonce: opts?.nonce,
 						itp_support: true,
-						use_fedcm_for_prompt: useFedCM,
 						...options.additionalOptions
 					});
 					window.google?.accounts.id.renderButton(container, opts.button.config ?? { type: "icon" });
@@ -97,8 +93,9 @@ const oneTapClient = (options) => {
 						if (isSafeUrlScheme(target)) window.location.href = target;
 					}
 				}
-				const { autoSelect, cancelOnTapOutside, context } = opts ?? {};
-				const contextValue = context ?? options.context ?? "signin";
+				const autoSelect = opts?.autoSelect ?? options.autoSelect;
+				const cancelOnTapOutside = opts?.cancelOnTapOutside ?? options.cancelOnTapOutside;
+				const contextValue = opts?.context ?? options.context ?? "signin";
 				isRequestInProgress = true;
 				try {
 					await loadGoogleScript();
@@ -106,7 +103,6 @@ const oneTapClient = (options) => {
 						let isResolved = false;
 						const baseDelay = options.promptOptions?.baseDelay ?? 1e3;
 						const maxAttempts = options.promptOptions?.maxAttempts ?? 5;
-						const useFedCM = options.promptOptions?.fedCM !== false;
 						window.google?.accounts.id.initialize({
 							client_id: options.clientId,
 							callback: async (response) => {
@@ -128,7 +124,6 @@ const oneTapClient = (options) => {
 							* @see {@link https://developers.google.com/identity/gsi/web/guides/overview}
 							*/
 							itp_support: true,
-							use_fedcm_for_prompt: useFedCM,
 							...options.additionalOptions
 						});
 						const handlePrompt = (attempt) => {
@@ -150,19 +145,8 @@ const oneTapClient = (options) => {
 										resolve();
 									}
 								} else if (notification.isSkippedMoment?.()) {
-									const reason = notification.getSkippedReason?.();
-									if (!reason || noRetryReasons.skipped.includes(reason)) {
-										opts?.onPromptNotification?.(notification);
-										resolve();
-										return;
-									}
-									if (attempt < maxAttempts) {
-										const delay = Math.pow(2, attempt) * baseDelay;
-										setTimeout(() => handlePrompt(attempt + 1), delay);
-									} else {
-										opts?.onPromptNotification?.(notification);
-										resolve();
-									}
+									opts?.onPromptNotification?.(notification);
+									resolve();
 								} else if (notification.isNotDisplayed?.()) {
 									opts?.onPromptNotification?.(notification);
 									resolve();

package/dist/plugins/one-tap/index.mjs

@@ -1,5 +1,7 @@
 import { parseUserOutput } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
+import { getAwaitableValue } from "../../context/helpers.mjs";
+import { toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES } from "../../oauth2/errors.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
@@ -58,16 +60,32 @@ const oneTap = (options) => ({
 			ctx.context.logger.error(`Google One Tap sign-in rejected: id token hosted domain (hd) "${payload.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${configuredHostedDomain}".`);
 			throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
 		}
-		const { email: rawEmail, email_verified, name, picture, sub } = payload;
+		const googleOAuthProvider = await getAwaitableValue(ctx.context.socialProviders, { value: "google" });
+		const providerResult = googleOAuthProvider ? await googleOAuthProvider.getUserInfo({ idToken }) : {
+			user: {
+				name: payload.name,
+				email: payload.email,
+				image: payload.picture,
+				emailVerified: toBoolean(payload.email_verified)
+			},
+			data: payload
+		};
+		if (!providerResult?.user) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+		const providerUser = providerResult.user;
+		const { sub } = payload;
+		const { email: rawEmail, name, image } = providerUser;
 		if (typeof rawEmail !== "string" || !rawEmail) throw new APIError$1("BAD_REQUEST", { message: "Email not available in token" });
 		if (typeof sub !== "string" || !sub) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+		const email = rawEmail.toLowerCase();
+		const emailVerified = toBoolean(providerUser.emailVerified);
 		const result = await handleOAuthUserInfo(ctx, {
 			userInfo: {
+				...providerUser,
 				id: sub,
-				email: rawEmail.toLowerCase(),
-				emailVerified: typeof email_verified === "boolean" ? email_verified : toBoolean(email_verified),
+				email,
+				emailVerified,
 				name: typeof name === "string" ? name : "",
-				image: typeof picture === "string" ? picture : void 0
+				image: typeof image === "string" ? image : void 0
 			},
 			account: {
 				providerId: "google",
@@ -76,11 +94,12 @@ const oneTap = (options) => ({
 				scope: "openid,profile,email"
 			},
 			disableSignUp: options?.disableSignup || googleProvider?.disableSignUp,
+			overrideUserInfo: googleProvider?.overrideUserInfoOnSignIn,
 			source: {
 				method: "oauth",
 				oauth: {
 					providerId: "google",
-					profile: payload
+					profile: toOAuthProfileRecord(providerResult.data)
 				}
 			}
 		});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.9",
+  "version": "1.8.0-beta.0",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -221,6 +221,11 @@
       "types": "./dist/plugins/bearer/index.d.mts",
       "default": "./dist/plugins/bearer/index.mjs"
     },
+    "./plugins/captcha": {
+      "dev-source": "./src/plugins/captcha/index.ts",
+      "types": "./dist/plugins/captcha/index.d.mts",
+      "default": "./dist/plugins/captcha/index.mjs"
+    },
     "./plugins/custom-session": {
       "dev-source": "./src/plugins/custom-session/index.ts",
       "types": "./dist/plugins/custom-session/index.d.mts",
@@ -276,6 +281,16 @@
       "types": "./dist/plugins/one-time-token/index.d.mts",
       "default": "./dist/plugins/one-time-token/index.mjs"
     },
+    "./plugins/one-tap": {
+      "dev-source": "./src/plugins/one-tap/index.ts",
+      "types": "./dist/plugins/one-tap/index.d.mts",
+      "default": "./dist/plugins/one-tap/index.mjs"
+    },
+    "./plugins/open-api": {
+      "dev-source": "./src/plugins/open-api/index.ts",
+      "types": "./dist/plugins/open-api/index.d.mts",
+      "default": "./dist/plugins/open-api/index.mjs"
+    },
     "./plugins/phone-number": {
       "dev-source": "./src/plugins/phone-number/index.ts",
       "types": "./dist/plugins/phone-number/index.d.mts",
@@ -355,6 +370,9 @@
       "api": [
         "./dist/api/index.d.mts"
       ],
+      "test": [
+        "./dist/test-utils/index.d.mts"
+      ],
       "db": [
         "./dist/db/index.d.mts"
       ],
@@ -415,6 +433,9 @@
       "plugins/bearer": [
         "./dist/plugins/bearer/index.d.mts"
       ],
+      "plugins/captcha": [
+        "./dist/plugins/captcha/index.d.mts"
+      ],
       "plugins/custom-session": [
         "./dist/plugins/custom-session/index.d.mts"
       ],
@@ -433,12 +454,21 @@
       "plugins/one-time-token": [
         "./dist/plugins/one-time-token/index.d.mts"
       ],
+      "plugins/one-tap": [
+        "./dist/plugins/one-tap/index.d.mts"
+      ],
+      "plugins/open-api": [
+        "./dist/plugins/open-api/index.d.mts"
+      ],
       "plugins/jwt": [
         "./dist/plugins/jwt/index.d.mts"
       ],
       "plugins/magic-link": [
         "./dist/plugins/magic-link/index.d.mts"
       ],
+      "plugins/multi-session": [
+        "./dist/plugins/multi-session/index.d.mts"
+      ],
       "plugins/organization": [
         "./dist/plugins/organization/index.d.mts"
       ],
@@ -473,13 +503,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.9",
-    "@better-auth/drizzle-adapter": "1.7.9",
-    "@better-auth/kysely-adapter": "1.7.9",
-    "@better-auth/memory-adapter": "1.7.9",
-    "@better-auth/mongo-adapter": "1.7.9",
-    "@better-auth/prisma-adapter": "1.7.9",
-    "@better-auth/telemetry": "1.7.9"
+    "@better-auth/core": "1.8.0-beta.0",
+    "@better-auth/drizzle-adapter": "1.8.0-beta.0",
+    "@better-auth/kysely-adapter": "1.8.0-beta.0",
+    "@better-auth/memory-adapter": "1.8.0-beta.0",
+    "@better-auth/mongo-adapter": "1.8.0-beta.0",
+    "@better-auth/prisma-adapter": "1.8.0-beta.0",
+    "@better-auth/telemetry": "1.8.0-beta.0"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",