better-auth 1.8.0-beta.3 → 1.8.0-beta.5

package/dist/api/dispatch.d.mts

@@ -1,5 +1,6 @@
 import { AuthContext } from "@better-auth/core";
 import { Endpoint, EndpointContext, InputContext } from "better-call";
+import "@better-auth/core/api";
 //#region src/api/dispatch.d.ts
 /**
  * Input accepted by {@link dispatchAuthEndpoint}. `context` must already be a

package/dist/api/dispatch.mjs

@@ -6,6 +6,7 @@ import { APIError } from "@better-auth/core/error";
 import { createDefu } from "defu";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, createWithSpan } from "@better-auth/core/instrumentation";
 import { kAPIErrorHeaderSymbol, toResponse } from "better-call";
+import { getInternalAuthCompletion } from "@better-auth/core/utils/auth-completion";
 //#region src/api/dispatch.ts
 const defuReplaceArrays = createDefu((obj, key, value) => {
 	if (Array.isArray(obj[key]) && Array.isArray(value)) {
@@ -14,6 +15,18 @@ const defuReplaceArrays = createDefu((obj, key, value) => {
 	}
 });
 const hooksSourceWeakMap = /* @__PURE__ */ new WeakMap();
+const signInGates = /* @__PURE__ */ new WeakSet();
+/**
+* Runs a plugin after hook ahead of every other plugin after hook, so a sign-in
+* it withholds (such as a pending two-factor challenge) is never observed as
+* complete, regardless of plugin registration order.
+*
+* @internal
+*/
+function asSignInGate(hook) {
+	signInGates.add(hook.handler);
+	return hook;
+}
 /**
 * Resolves the operation id used for spans, preferring an explicit
 * `operationId`, then the OpenAPI one, then the caller's `fallback` (the
@@ -163,12 +176,19 @@ function getHooks(authContext) {
 	const pluginAfterHooks = plugins.flatMap((plugin) => (plugin.hooks?.after ?? []).map((h) => {
 		hooksSourceWeakMap.set(h.handler, `plugin:${plugin.id}`);
 		return h;
-	}));
+	})).sort((a, b) => Number(signInGates.has(b.handler)) - Number(signInGates.has(a.handler)));
+	const completionHooks = plugins.flatMap((plugin) => {
+		const completion = getInternalAuthCompletion(plugin);
+		if (!completion) return [];
+		hooksSourceWeakMap.set(completion.handler, `plugin:${plugin.id}`);
+		return [completion];
+	});
 	if (pluginBeforeHooks.length) beforeHooks.push(...pluginBeforeHooks);
 	if (pluginAfterHooks.length) afterHooks.push(...pluginAfterHooks);
 	return {
 		beforeHooks,
-		afterHooks
+		afterHooks,
+		completionHooks
 	};
 }
 /**
@@ -208,7 +228,7 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		[ATTR_HTTP_ROUTE]: route,
 		[ATTR_OPERATION_ID]: operationId
 	}, async () => runWithEndpointContext(internalContext, async () => {
-		const { beforeHooks, afterHooks } = getHooks(internalContext.context);
+		const { beforeHooks, afterHooks, completionHooks } = getHooks(internalContext.context);
 		const before = await runBeforeHooks(internalContext, beforeHooks, endpoint, operationId);
 		if ("context" in before && before.context && typeof before.context === "object") {
 			const { headers, ...rest } = before.context;
@@ -243,10 +263,13 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		});
 		if (result instanceof Response) return result;
 		internalContext.context.returned = result.response;
-		internalContext.context.responseHeaders = result.headers ?? void 0;
-		const after = await runAfterHooks(internalContext, afterHooks, endpoint, operationId);
-		if (after.response !== void 0) result.response = after.response;
-		result.headers = after.headers ?? result.headers;
+		mergeResponseHeaders(internalContext.context, result.headers);
+		await runAfterHooks(internalContext, afterHooks, endpoint, operationId);
+		const matchingCompletions = completionHooks.filter((hook) => hook.matcher(internalContext));
+		if (matchingCompletions.length > 1) throw new APIError("INTERNAL_SERVER_ERROR", { message: "Multiple authentication completion handlers matched." });
+		const completed = await runAfterHooks(internalContext, matchingCompletions, endpoint, operationId);
+		if (completed.response !== void 0) result.response = completed.response;
+		result.headers = completed.headers ?? result.headers;
 		if (isAPIError(result.response) && shouldPublishLog(internalContext.context.logger.level, "debug")) result.response.stack = result.response.errorStack;
 		if (isAPIError(result.response) && !shouldReturnResponse) {
 			if (result.headers) Object.defineProperty(result.response, kAPIErrorHeaderSymbol, {
@@ -274,4 +297,4 @@ async function dispatchAuthEndpoint(endpoint, input) {
 	}));
 }
 //#endregion
-export { dispatchAuthEndpoint, getOperationId };
+export { asSignInGate, dispatchAuthEndpoint, getOperationId };

package/dist/api/index.mjs

@@ -2,9 +2,9 @@ import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
-import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";

package/dist/api/routes/account.mjs

@@ -1,13 +1,16 @@
 import { shouldBindAccountCookieToSessionUser } from "../../context/store-capabilities.mjs";
 import { parseAccountOutput } from "../../db/schema.mjs";
+import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { resolveOAuthAccountKeyForAPI } from "../../oauth2/account-key.mjs";
 import { missingEmailLogMessage } from "../../oauth2/errors.mjs";
+import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
+import { toBoolean } from "../../utils/boolean.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
-import { freshSessionMiddleware, getSessionFromCtx, isStateful, sessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -129,7 +132,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 		*/
 		additionalData: z.record(z.string(), z.any()).optional()
 	}),
-	use: [sessionMiddleware],
+	use: [sensitiveSessionMiddleware],
 	metadata: { openapi: {
 		description: "Link a social account to the user",
 		operationId: "linkSocialAccount",
@@ -169,11 +172,12 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);
 		}
-		const linkingUserInfo = await provider.getUserInfo({
+		const oauthTokens = {
 			idToken: token,
 			accessToken: c.body.idToken.accessToken,
 			refreshToken: c.body.idToken.refreshToken
-		});
+		};
+		const linkingUserInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!linkingUserInfo || !linkingUserInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -204,7 +208,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			});
 		}
 		if (linkedAccount) throw APIError.from("CONFLICT", BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED);
-		if (!c.context.trustedProviders.includes(provider.id) && !linkingUserInfo.user.emailVerified || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
+		if (!c.context.trustedProviders.includes(provider.id) && !toBoolean(linkingUserInfo.user.emailVerified) || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
 			message: "Account not linked - linking not allowed",
 			code: "LINKING_NOT_ALLOWED"
 		});
@@ -237,7 +241,11 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 	const state = await generateState(c, {
 		link: {
 			userId: session.user.id,
-			email: session.user.email
+			email: session.user.email,
+			encryptedSessionToken: isStateful(c) ? await symmetricEncrypt({
+				key: derivePurposeKey(c.context.secretConfig, "oauth-link-session-token"),
+				data: session.session.token
+			}) : void 0
 		},
 		additionalData: c.body.additionalData,
 		idTokenNonce

package/dist/api/routes/email-verification.mjs

@@ -26,7 +26,7 @@ async function sendVerificationEmailFn(ctx, user) {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.VERIFICATION_EMAIL_NOT_ENABLED);
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 	const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 	await ctx.context.options.emailVerification.sendVerificationEmail({
@@ -183,24 +183,30 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 	const parsed = z.object({
 		email: z.email(),
 		updateTo: z.string().optional(),
-		requestType: z.string().optional()
+		requestType: z.string().optional(),
+		userId: z.string().optional()
 	}).parse(jwt.payload);
-	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
-	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
 	if (parsed.updateTo) {
+		if (!parsed.userId) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
+		const boundUser = await ctx.context.internalAdapter.findUserById(parsed.userId);
+		if (!boundUser) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+		if (boundUser.email.toLowerCase() !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 		const session = await getSessionFromCtx(ctx);
-		if (session && session.user.email !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
+		if (session && session.user.id !== boundUser.id) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
 		switch (parsed.requestType) {
 			/**
 			* User clicks confirmation -> sends verification to new email
 			*/
 			case "change-email-confirmation": {
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, {
+					requestType: "change-email-verification",
+					userId: boundUser.id
+				});
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				const url = `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`;
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: {
-						...user.user,
+						...boundUser,
 						email: parsed.updateTo
 					},
 					url,
@@ -213,26 +219,18 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* User clicks verification -> updates email
 			*/
 			case "change-email-verification": {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const emailVerified = boundUser.emailVerified;
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
-					emailVerified: true
+					emailVerified
 				});
-				if (ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (emailVerified && ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
-						emailVerified: true
+						emailVerified
 					}
 				});
 				if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
@@ -248,30 +246,21 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* - updates email immediately
 			*/
 			default: {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
 					emailVerified: false
 				});
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo);
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo, void 0, void 0, { userId: boundUser.id });
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: updatedUser,
 					url: `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`,
 					token: newToken
 				}, safeCloneRequest(ctx.request)));
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
 						emailVerified: false
 					}
@@ -284,6 +273,9 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			}
 		}
 	}
+	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
+	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+	if (parsed.userId && parsed.userId !== user.user.id) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 	if (user.user.emailVerified) {
 		if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
 		return ctx.json({

package/dist/api/routes/sign-in.mjs

@@ -167,7 +167,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			refreshToken: c.body.idToken.refreshToken,
 			user: c.body.idToken.user
 		};
-		const userInfo = await provider.getUserInfo(oauthTokens);
+		const userInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!userInfo || !userInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -338,7 +338,7 @@ const signInEmail = () => createAuthEndpoint("/sign-in/email", {
 	if (ctx.context.options?.emailAndPassword?.requireEmailVerification && !user.emailVerified) {
 		if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
 		if (ctx.context.options?.emailVerification?.sendOnSignIn) {
-			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 			const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 			await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({

package/dist/api/routes/sign-up.mjs

@@ -251,7 +251,7 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 			const callbackURL = body.callbackURL ? encodeURIComponent(body.callbackURL) : encodeURIComponent("/");
 			const request = safeCloneRequest(ctx.request);
 			await queueAfterTransactionHook(async () => {
-				const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+				const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 				const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 				await ctx.context.runInBackgroundOrAwait(sendVerificationEmail({
 					user,

package/dist/api/routes/update-user.mjs

@@ -450,7 +450,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
 	if (await ctx.context.internalAdapter.findUserByEmail(newEmail)) {
-		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn);
+		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 		ctx.context.logger.info("Change email attempt for existing email");
 		return ctx.json({ status: true });
 	}
@@ -467,7 +467,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 			}
 		});
 		if (canSendVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 			await ctx.context.runInBackgroundOrAwait(canSendVerification({
 				user: {
@@ -484,7 +484,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 	* If the email is verified, we need to send a verification email
 	*/
 	if (canSendConfirmation) {
-		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-confirmation" });
+		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+			requestType: "change-email-confirmation",
+			userId: ctx.context.session.user.id
+		});
 		const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 		await ctx.context.runInBackgroundOrAwait(canSendConfirmation({
 			user: ctx.context.session.user,
@@ -498,7 +501,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+		requestType: "change-email-verification",
+		userId: ctx.context.session.user.id
+	});
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 	await ctx.context.runInBackgroundOrAwait(canSendVerification({
 		user: {

package/dist/auth/trusted-origins.mjs

@@ -4,6 +4,19 @@ import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
 const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
 const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
+const IP_WILDCARD_HOST_PATTERN = /^(?=.*\d)[\d*?.]+$/;
+const IPV4_HOST_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/**
+* A wildcard host made only of digits, dots and wildcards (`192.168.*.*`,
+* `10.*`) names an address range, so it admits only an IPv4 address. A plain
+* `*` would otherwise cross `.` and let `192.168.attacker.com` match. Other
+* hosts keep the documented subdomain matching.
+*/
+const isAllowedIPv4Host = (patternAuthority, authority) => {
+	const patternHost = patternAuthority.split(":")[0];
+	if (!IP_WILDCARD_HOST_PATTERN.test(patternHost)) return true;
+	return IPV4_HOST_PATTERN.test(authority.split(":")[0]);
+};
 /**
 * Resolves `.` and `..` segments in a path after percent-decoding so a
 * path-pinned pattern cannot be bypassed with traversal: e.g.
@@ -33,7 +46,7 @@ const normalizePath = (path) => {
 * host); the path is percent-decoded and resolved so traversal cannot bypass
 * a path-pinned pattern.
 */
-const parseCustomSchemeOrigin = (value) => {
+const parseCustomSchemeOrigin = (value, wildcardPattern = false) => {
 	if (CONTROL_CHARACTER_PATTERN.test(value)) return null;
 	const schemeEnd = value.indexOf(":");
 	if (schemeEnd <= 0) return null;
@@ -42,7 +55,7 @@ const parseCustomSchemeOrigin = (value) => {
 	let authority = "";
 	if (rest.startsWith("//")) {
 		rest = rest.slice(2);
-		const authorityEnd = rest.search(/[/?#]/);
+		const authorityEnd = rest.search(wildcardPattern ? /[/#]/ : /[/?#]/);
 		if (authorityEnd === -1) {
 			authority = rest;
 			rest = "";
@@ -51,7 +64,7 @@ const parseCustomSchemeOrigin = (value) => {
 			rest = rest.slice(authorityEnd);
 		}
 	}
-	const pathEnd = rest.search(/[?#]/);
+	const pathEnd = rest.search(wildcardPattern ? /#/ : /[?#]/);
 	const path = normalizePath(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
 	return {
 		scheme,
@@ -87,17 +100,27 @@ const isSafeRelativeURL = (value) => {
 */
 const matchesOriginPattern = (url, pattern, settings) => {
 	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
-	if (pattern.includes("*") || pattern.includes("?")) {
-		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
+	const hasWildcard = pattern.includes("*") || pattern.includes("?");
+	if (hasWildcard && !pattern.includes("://")) {
 		const host = getHost(url);
 		if (!host) return false;
-		return wildcardMatch(pattern)(host);
+		return wildcardMatch(pattern)(host) && isAllowedIPv4Host(pattern, host);
 	}
 	const protocol = getProtocol(url);
-	if (protocol === "http:" || protocol === "https:" || !protocol) return pattern === getOrigin(url);
+	if (protocol === "http:" || protocol === "https:" || !protocol) {
+		if (!hasWildcard) return pattern === getOrigin(url);
+		const origin = getOrigin(url);
+		if (origin === null || !wildcardMatch(pattern)(origin)) return false;
+		return isAllowedIPv4Host(pattern.slice(pattern.indexOf("://") + 3), origin.slice(origin.indexOf("://") + 3));
+	}
 	const parsed = parseCustomSchemeOrigin(url);
-	const parsedPattern = parseCustomSchemeOrigin(pattern);
+	const parsedPattern = parseCustomSchemeOrigin(pattern, hasWildcard);
 	if (!parsed || !parsedPattern || parsed.scheme !== parsedPattern.scheme) return false;
+	if (hasWildcard) {
+		if (parsed.authority.includes("@")) return false;
+		if (parsedPattern.authority && !(wildcardMatch(parsedPattern.authority)(parsed.authority) && isAllowedIPv4Host(parsedPattern.authority, parsed.authority))) return false;
+		return !parsedPattern.path || wildcardMatch(parsedPattern.path)(parsed.path || "/");
+	}
 	if (parsedPattern.authority && parsed.authority !== parsedPattern.authority) return false;
 	if (!parsedPattern.path) return true;
 	return parsed.path === parsedPattern.path || parsed.path.startsWith(`${parsedPattern.path}/`);

package/dist/client/index.d.mts

@@ -16,7 +16,8 @@ import { OrganizationOptions } from "../plugins/organization/types.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "../plugins/organization/schema.mjs";
 import { getOrgAdapter } from "../plugins/organization/adapter.mjs";
 import { hasPermission } from "../plugins/organization/has-permission.mjs";
-import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "../plugins/organization/organization.mjs";
+import { parseRoles } from "../plugins/organization/roles.mjs";
+import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization } from "../plugins/organization/organization.mjs";
 import "../plugins/organization/index.mjs";
 import { BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { DBPrimitive } from "@better-auth/core/db";

package/dist/client/parser.mjs

@@ -1,10 +1,4 @@
 //#region src/client/parser.ts
-const PROTO_POLLUTION_PATTERNS = {
-	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
-	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
-	protoShort: /"__proto__"\s*:/,
-	constructorShort: /"constructor"\s*:/
-};
 const JSON_SIGNATURE = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
 const SPECIAL_VALUES = {
 	true: true,
@@ -40,14 +34,10 @@ function betterJSONParse(value, options = {}) {
 		if (strict) throw new SyntaxError("[better-json] Invalid JSON");
 		return value;
 	}
-	if (Object.entries(PROTO_POLLUTION_PATTERNS).some(([key, pattern]) => {
-		const matches = pattern.test(trimmed);
-		if (matches && warnings) console.warn(`[better-json] Detected potential prototype pollution attempt using ${key} pattern`);
-		return matches;
-	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
 	try {
 		const secureReviver = (key, value) => {
 			if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+				if (strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
 				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
 				return;
 			}

package/dist/client/vue/index.mjs

@@ -1,3 +1,4 @@
+import { trimTrailingSlashes } from "../../utils/url.mjs";
 import { getClientConfig } from "../config.mjs";
 import { createDynamicPathProxy } from "../proxy.mjs";
 import { useStore } from "./vue-store.mjs";
@@ -16,18 +17,23 @@ function toHeadersInit(headers) {
 }
 function createAuthClient(options) {
 	const { baseURL, pluginPathMethods, pluginsActions, pluginsAtoms, hydrateSession, $sessionSignal, $fetch, $store, atomListeners } = getClientConfig(options, false);
-	const sessionCacheKey = [
-		"better-auth",
-		"session",
-		options?.baseURL || "inferred",
-		options?.basePath ?? "/api/auth"
-	].join(":");
+	const baseURLKey = options?.baseURL || "inferred";
+	const basePath = options?.basePath ?? "/api/auth";
+	const sessionCacheKey = `better-auth:session:${baseURLKey}:${basePath}`;
+	const sessionPath = trimTrailingSlashes(basePath.startsWith("/") ? basePath : `/${basePath}`);
+	/**
+	* Stays relative without an explicit `baseURL` so the SSR session fetch
+	* forwards the incoming cookies.
+	*
+	* @see https://nuxt.com/docs/4.x/getting-started/data-fetching
+	*/
+	const sessionURL = `${options?.baseURL ? baseURL : sessionPath}/get-session`;
 	const resolvedHooks = {};
 	for (const [key, value] of Object.entries(pluginsAtoms)) resolvedHooks[getAtomKey(key)] = () => useStore(value);
 	function useSession(useFetch) {
 		if (useFetch) {
 			const sessionSignal = useStore($sessionSignal);
-			return useFetch(`${baseURL}/get-session`, {
+			return useFetch(sessionURL, {
 				headers: toHeadersInit(options?.fetchOptions?.headers),
 				key: sessionCacheKey,
 				watch: [sessionSignal]

package/dist/context/secret-utils.mjs

@@ -12,12 +12,12 @@ function estimateEntropy(str) {
 }
 function parseSecretsEnv(envValue) {
 	if (!envValue) return null;
-	return envValue.split(",").map((entry) => {
+	return envValue.split(",").map((entry, index) => {
 		entry = entry.trim();
 		const colonIdx = entry.indexOf(":");
-		if (colonIdx === -1) throw new BetterAuthError(`Invalid BETTER_AUTH_SECRETS entry: "${entry}". Expected format: "<version>:<secret>"`);
+		if (colonIdx === -1) throw new BetterAuthError(`Invalid BETTER_AUTH_SECRETS entry at position ${index + 1}. Expected format: "<version>:<secret>"`);
 		const version = parseInt(entry.slice(0, colonIdx), 10);
-		if (!Number.isInteger(version) || version < 0) throw new BetterAuthError(`Invalid version in BETTER_AUTH_SECRETS: "${entry.slice(0, colonIdx)}". Version must be a non-negative integer.`);
+		if (!Number.isInteger(version) || version < 0) throw new BetterAuthError(`Invalid version in BETTER_AUTH_SECRETS entry at position ${index + 1}. Version must be a non-negative integer.`);
 		const value = entry.slice(colonIdx + 1).trim();
 		if (!value) throw new BetterAuthError(`Empty secret value for version ${version} in BETTER_AUTH_SECRETS.`);
 		return {

package/dist/db/internal-adapter.mjs

@@ -78,8 +78,18 @@ const createInternalAdapter = (adapter, ctx) => {
 		const activeSessions = await secondaryStorage.get(`active-sessions-${userId}`);
 		return activeSessions ? safeJSONParse(activeSessions) || [] : [];
 	}
-	async function deleteCachedUserSessions(userId, sessionReferences) {
+	const revokedBeforeKey = (userId) => `revoked-sessions-before-${userId}`;
+	const revokedBeforeTTL = Math.max(sessionExpiration, 86400, Number(options.plugins?.find((plugin) => plugin.id === "admin")?.options?.impersonationSessionDuration) || 0);
+	async function isRevokedSession(session, revokedBeforeByUser) {
+		if (!secondaryStorage) return false;
+		const revokedBefore = revokedBeforeByUser?.get(session.userId) ?? Number(await secondaryStorage.get(revokedBeforeKey(session.userId)));
+		revokedBeforeByUser?.set(session.userId, revokedBefore);
+		return new Date(session.createdAt).getTime() < revokedBefore;
+	}
+	async function deleteCachedUserSessions(userId, sessionReferences, revokedAt) {
 		if (!secondaryStorage) return;
+		const previousRevokedBefore = Number(await secondaryStorage.get(revokedBeforeKey(userId)));
+		await secondaryStorage.set(revokedBeforeKey(userId), String(Math.max(revokedAt, previousRevokedBefore || 0)), revokedBeforeTTL);
 		const deletedTokens = new Set(sessionReferences.map((session) => session.token));
 		for (const { token } of sessionReferences) await secondaryStorage.delete(token);
 		const activeSessionsKey = `active-sessions-${userId}`;
@@ -97,7 +107,8 @@ const createInternalAdapter = (adapter, ctx) => {
 	async function queueCachedUserSessionDeletion(userId, sessionReferences) {
 		if (!secondaryStorage) return;
 		const references = sessionReferences ?? await getActiveSessionReferences(userId);
-		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references), { onError(error) {
+		const revokedAt = Date.now();
+		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references, revokedAt), { onError(error) {
 			logger.error("Failed to delete committed user sessions from secondary storage", error);
 		} });
 	}
@@ -194,6 +205,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				const now = Date.now();
 				const seenTokens = /* @__PURE__ */ new Set();
 				const sessions = [];
+				const revokedBeforeByUser = /* @__PURE__ */ new Map();
 				for (const { token, expiresAt } of list) {
 					if (expiresAt <= now || seenTokens.has(token)) continue;
 					seenTokens.add(token);
@@ -201,7 +213,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					if (!data) continue;
 					try {
 						const parsed = typeof data === "string" ? JSON.parse(data) : data;
-						if (!parsed?.session) continue;
+						if (!parsed?.session || await isRevokedSession(parsed.session, revokedBeforeByUser)) continue;
 						sessions.push(parseSessionOutput(ctx.options, {
 							...parsed.session,
 							expiresAt: new Date(parsed.session.expiresAt)
@@ -312,7 +324,10 @@ const createInternalAdapter = (adapter, ctx) => {
 				});
 				const sessionTTL = getTTLSeconds(data.expiresAt, now);
 				if (sessionTTL > 0) await secondaryStorage.set(data.token, JSON.stringify({
-					session: sessionData,
+					session: {
+						...sessionData,
+						createdAt: data.createdAt
+					},
 					user
 				}), sessionTTL);
 				return sessionData;
@@ -336,7 +351,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				if (!sessionStringified && (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase)) return null;
 				if (sessionStringified) {
 					const s = safeJSONParse(sessionStringified);
-					if (!s) return null;
+					if (!s || await isRevokedSession(s.session)) return null;
 					return {
 						session: parseSessionOutput(ctx.options, {
 							...s.session,
@@ -372,11 +387,12 @@ const createInternalAdapter = (adapter, ctx) => {
 			const uniqueTokens = [...new Set(sessionTokens)];
 			const sessionsByToken = /* @__PURE__ */ new Map();
 			const missingTokens = [];
+			const revokedBeforeByUser = /* @__PURE__ */ new Map();
 			if (secondaryStorage) for (const sessionToken of uniqueTokens) {
 				const sessionStringified = await secondaryStorage.get(sessionToken);
 				if (sessionStringified) try {
 					const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
-					if (!s) continue;
+					if (!s || await isRevokedSession(s.session, revokedBeforeByUser)) continue;
 					const expiresAt = new Date(s.session.expiresAt);
 					if (options?.onlyActiveSessions && expiresAt <= /* @__PURE__ */ new Date()) continue;
 					const session = {
@@ -590,6 +606,8 @@ const createInternalAdapter = (adapter, ctx) => {
 				join: { ...options?.includeAccounts ? { account: true } : {} }
 			});
 			if (!result) return null;
+			const normalize = (value) => value.normalize("NFC").toLowerCase();
+			if (normalize(result.email) !== normalize(email)) return null;
 			const { account: accounts, ...user } = result;
 			return {
 				user,