better-auth 1.8.0-beta.4 → 1.8.0-beta.5

package/dist/api/dispatch.d.mts

@@ -1,5 +1,6 @@
 import { AuthContext } from "@better-auth/core";
 import { Endpoint, EndpointContext, InputContext } from "better-call";
+import "@better-auth/core/api";
 //#region src/api/dispatch.d.ts
 /**
  * Input accepted by {@link dispatchAuthEndpoint}. `context` must already be a

package/dist/api/dispatch.mjs

@@ -6,6 +6,7 @@ import { APIError } from "@better-auth/core/error";
 import { createDefu } from "defu";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, createWithSpan } from "@better-auth/core/instrumentation";
 import { kAPIErrorHeaderSymbol, toResponse } from "better-call";
+import { getInternalAuthCompletion } from "@better-auth/core/utils/auth-completion";
 //#region src/api/dispatch.ts
 const defuReplaceArrays = createDefu((obj, key, value) => {
 	if (Array.isArray(obj[key]) && Array.isArray(value)) {
@@ -14,6 +15,18 @@ const defuReplaceArrays = createDefu((obj, key, value) => {
 	}
 });
 const hooksSourceWeakMap = /* @__PURE__ */ new WeakMap();
+const signInGates = /* @__PURE__ */ new WeakSet();
+/**
+* Runs a plugin after hook ahead of every other plugin after hook, so a sign-in
+* it withholds (such as a pending two-factor challenge) is never observed as
+* complete, regardless of plugin registration order.
+*
+* @internal
+*/
+function asSignInGate(hook) {
+	signInGates.add(hook.handler);
+	return hook;
+}
 /**
 * Resolves the operation id used for spans, preferring an explicit
 * `operationId`, then the OpenAPI one, then the caller's `fallback` (the
@@ -163,12 +176,19 @@ function getHooks(authContext) {
 	const pluginAfterHooks = plugins.flatMap((plugin) => (plugin.hooks?.after ?? []).map((h) => {
 		hooksSourceWeakMap.set(h.handler, `plugin:${plugin.id}`);
 		return h;
-	}));
+	})).sort((a, b) => Number(signInGates.has(b.handler)) - Number(signInGates.has(a.handler)));
+	const completionHooks = plugins.flatMap((plugin) => {
+		const completion = getInternalAuthCompletion(plugin);
+		if (!completion) return [];
+		hooksSourceWeakMap.set(completion.handler, `plugin:${plugin.id}`);
+		return [completion];
+	});
 	if (pluginBeforeHooks.length) beforeHooks.push(...pluginBeforeHooks);
 	if (pluginAfterHooks.length) afterHooks.push(...pluginAfterHooks);
 	return {
 		beforeHooks,
-		afterHooks
+		afterHooks,
+		completionHooks
 	};
 }
 /**
@@ -208,7 +228,7 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		[ATTR_HTTP_ROUTE]: route,
 		[ATTR_OPERATION_ID]: operationId
 	}, async () => runWithEndpointContext(internalContext, async () => {
-		const { beforeHooks, afterHooks } = getHooks(internalContext.context);
+		const { beforeHooks, afterHooks, completionHooks } = getHooks(internalContext.context);
 		const before = await runBeforeHooks(internalContext, beforeHooks, endpoint, operationId);
 		if ("context" in before && before.context && typeof before.context === "object") {
 			const { headers, ...rest } = before.context;
@@ -244,9 +264,12 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		if (result instanceof Response) return result;
 		internalContext.context.returned = result.response;
 		mergeResponseHeaders(internalContext.context, result.headers);
-		const after = await runAfterHooks(internalContext, afterHooks, endpoint, operationId);
-		if (after.response !== void 0) result.response = after.response;
-		result.headers = after.headers ?? result.headers;
+		await runAfterHooks(internalContext, afterHooks, endpoint, operationId);
+		const matchingCompletions = completionHooks.filter((hook) => hook.matcher(internalContext));
+		if (matchingCompletions.length > 1) throw new APIError("INTERNAL_SERVER_ERROR", { message: "Multiple authentication completion handlers matched." });
+		const completed = await runAfterHooks(internalContext, matchingCompletions, endpoint, operationId);
+		if (completed.response !== void 0) result.response = completed.response;
+		result.headers = completed.headers ?? result.headers;
 		if (isAPIError(result.response) && shouldPublishLog(internalContext.context.logger.level, "debug")) result.response.stack = result.response.errorStack;
 		if (isAPIError(result.response) && !shouldReturnResponse) {
 			if (result.headers) Object.defineProperty(result.response, kAPIErrorHeaderSymbol, {
@@ -274,4 +297,4 @@ async function dispatchAuthEndpoint(endpoint, input) {
 	}));
 }
 //#endregion
-export { dispatchAuthEndpoint, getOperationId };
+export { asSignInGate, dispatchAuthEndpoint, getOperationId };

package/dist/api/index.mjs

@@ -2,9 +2,9 @@ import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
-import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";

package/dist/api/routes/account.mjs

@@ -1,13 +1,16 @@
 import { shouldBindAccountCookieToSessionUser } from "../../context/store-capabilities.mjs";
 import { parseAccountOutput } from "../../db/schema.mjs";
+import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { resolveOAuthAccountKeyForAPI } from "../../oauth2/account-key.mjs";
 import { missingEmailLogMessage } from "../../oauth2/errors.mjs";
+import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
+import { toBoolean } from "../../utils/boolean.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
-import { freshSessionMiddleware, getSessionFromCtx, isStateful, sessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -129,7 +132,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 		*/
 		additionalData: z.record(z.string(), z.any()).optional()
 	}),
-	use: [sessionMiddleware],
+	use: [sensitiveSessionMiddleware],
 	metadata: { openapi: {
 		description: "Link a social account to the user",
 		operationId: "linkSocialAccount",
@@ -169,11 +172,12 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);
 		}
-		const linkingUserInfo = await provider.getUserInfo({
+		const oauthTokens = {
 			idToken: token,
 			accessToken: c.body.idToken.accessToken,
 			refreshToken: c.body.idToken.refreshToken
-		});
+		};
+		const linkingUserInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!linkingUserInfo || !linkingUserInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -204,7 +208,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			});
 		}
 		if (linkedAccount) throw APIError.from("CONFLICT", BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED);
-		if (!c.context.trustedProviders.includes(provider.id) && !linkingUserInfo.user.emailVerified || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
+		if (!c.context.trustedProviders.includes(provider.id) && !toBoolean(linkingUserInfo.user.emailVerified) || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
 			message: "Account not linked - linking not allowed",
 			code: "LINKING_NOT_ALLOWED"
 		});
@@ -237,7 +241,11 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 	const state = await generateState(c, {
 		link: {
 			userId: session.user.id,
-			email: session.user.email
+			email: session.user.email,
+			encryptedSessionToken: isStateful(c) ? await symmetricEncrypt({
+				key: derivePurposeKey(c.context.secretConfig, "oauth-link-session-token"),
+				data: session.session.token
+			}) : void 0
 		},
 		additionalData: c.body.additionalData,
 		idTokenNonce

package/dist/api/routes/email-verification.mjs

@@ -26,7 +26,7 @@ async function sendVerificationEmailFn(ctx, user) {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.VERIFICATION_EMAIL_NOT_ENABLED);
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 	const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 	await ctx.context.options.emailVerification.sendVerificationEmail({
@@ -183,24 +183,30 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 	const parsed = z.object({
 		email: z.email(),
 		updateTo: z.string().optional(),
-		requestType: z.string().optional()
+		requestType: z.string().optional(),
+		userId: z.string().optional()
 	}).parse(jwt.payload);
-	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
-	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
 	if (parsed.updateTo) {
+		if (!parsed.userId) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
+		const boundUser = await ctx.context.internalAdapter.findUserById(parsed.userId);
+		if (!boundUser) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+		if (boundUser.email.toLowerCase() !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 		const session = await getSessionFromCtx(ctx);
-		if (session && session.user.email !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
+		if (session && session.user.id !== boundUser.id) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
 		switch (parsed.requestType) {
 			/**
 			* User clicks confirmation -> sends verification to new email
 			*/
 			case "change-email-confirmation": {
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, {
+					requestType: "change-email-verification",
+					userId: boundUser.id
+				});
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				const url = `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`;
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: {
-						...user.user,
+						...boundUser,
 						email: parsed.updateTo
 					},
 					url,
@@ -213,26 +219,18 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* User clicks verification -> updates email
 			*/
 			case "change-email-verification": {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const emailVerified = boundUser.emailVerified;
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
-					emailVerified: true
+					emailVerified
 				});
-				if (ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (emailVerified && ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
-						emailVerified: true
+						emailVerified
 					}
 				});
 				if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
@@ -248,30 +246,21 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* - updates email immediately
 			*/
 			default: {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
 					emailVerified: false
 				});
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo);
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo, void 0, void 0, { userId: boundUser.id });
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: updatedUser,
 					url: `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`,
 					token: newToken
 				}, safeCloneRequest(ctx.request)));
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
 						emailVerified: false
 					}
@@ -284,6 +273,9 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			}
 		}
 	}
+	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
+	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+	if (parsed.userId && parsed.userId !== user.user.id) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 	if (user.user.emailVerified) {
 		if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
 		return ctx.json({

package/dist/api/routes/sign-in.mjs

@@ -167,7 +167,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			refreshToken: c.body.idToken.refreshToken,
 			user: c.body.idToken.user
 		};
-		const userInfo = await provider.getUserInfo(oauthTokens);
+		const userInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!userInfo || !userInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -338,7 +338,7 @@ const signInEmail = () => createAuthEndpoint("/sign-in/email", {
 	if (ctx.context.options?.emailAndPassword?.requireEmailVerification && !user.emailVerified) {
 		if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
 		if (ctx.context.options?.emailVerification?.sendOnSignIn) {
-			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 			const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 			await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({

package/dist/api/routes/sign-up.mjs

@@ -251,7 +251,7 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 			const callbackURL = body.callbackURL ? encodeURIComponent(body.callbackURL) : encodeURIComponent("/");
 			const request = safeCloneRequest(ctx.request);
 			await queueAfterTransactionHook(async () => {
-				const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+				const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 				const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 				await ctx.context.runInBackgroundOrAwait(sendVerificationEmail({
 					user,

package/dist/api/routes/update-user.mjs

@@ -450,7 +450,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
 	if (await ctx.context.internalAdapter.findUserByEmail(newEmail)) {
-		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn);
+		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 		ctx.context.logger.info("Change email attempt for existing email");
 		return ctx.json({ status: true });
 	}
@@ -467,7 +467,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 			}
 		});
 		if (canSendVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 			await ctx.context.runInBackgroundOrAwait(canSendVerification({
 				user: {
@@ -484,7 +484,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 	* If the email is verified, we need to send a verification email
 	*/
 	if (canSendConfirmation) {
-		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-confirmation" });
+		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+			requestType: "change-email-confirmation",
+			userId: ctx.context.session.user.id
+		});
 		const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 		await ctx.context.runInBackgroundOrAwait(canSendConfirmation({
 			user: ctx.context.session.user,
@@ -498,7 +501,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+		requestType: "change-email-verification",
+		userId: ctx.context.session.user.id
+	});
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 	await ctx.context.runInBackgroundOrAwait(canSendVerification({
 		user: {

package/dist/auth/trusted-origins.mjs

@@ -4,6 +4,19 @@ import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
 const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
 const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
+const IP_WILDCARD_HOST_PATTERN = /^(?=.*\d)[\d*?.]+$/;
+const IPV4_HOST_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/**
+* A wildcard host made only of digits, dots and wildcards (`192.168.*.*`,
+* `10.*`) names an address range, so it admits only an IPv4 address. A plain
+* `*` would otherwise cross `.` and let `192.168.attacker.com` match. Other
+* hosts keep the documented subdomain matching.
+*/
+const isAllowedIPv4Host = (patternAuthority, authority) => {
+	const patternHost = patternAuthority.split(":")[0];
+	if (!IP_WILDCARD_HOST_PATTERN.test(patternHost)) return true;
+	return IPV4_HOST_PATTERN.test(authority.split(":")[0]);
+};
 /**
 * Resolves `.` and `..` segments in a path after percent-decoding so a
 * path-pinned pattern cannot be bypassed with traversal: e.g.
@@ -33,7 +46,7 @@ const normalizePath = (path) => {
 * host); the path is percent-decoded and resolved so traversal cannot bypass
 * a path-pinned pattern.
 */
-const parseCustomSchemeOrigin = (value) => {
+const parseCustomSchemeOrigin = (value, wildcardPattern = false) => {
 	if (CONTROL_CHARACTER_PATTERN.test(value)) return null;
 	const schemeEnd = value.indexOf(":");
 	if (schemeEnd <= 0) return null;
@@ -42,7 +55,7 @@ const parseCustomSchemeOrigin = (value) => {
 	let authority = "";
 	if (rest.startsWith("//")) {
 		rest = rest.slice(2);
-		const authorityEnd = rest.search(/[/?#]/);
+		const authorityEnd = rest.search(wildcardPattern ? /[/#]/ : /[/?#]/);
 		if (authorityEnd === -1) {
 			authority = rest;
 			rest = "";
@@ -51,7 +64,7 @@ const parseCustomSchemeOrigin = (value) => {
 			rest = rest.slice(authorityEnd);
 		}
 	}
-	const pathEnd = rest.search(/[?#]/);
+	const pathEnd = rest.search(wildcardPattern ? /#/ : /[?#]/);
 	const path = normalizePath(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
 	return {
 		scheme,
@@ -87,17 +100,27 @@ const isSafeRelativeURL = (value) => {
 */
 const matchesOriginPattern = (url, pattern, settings) => {
 	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
-	if (pattern.includes("*") || pattern.includes("?")) {
-		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
+	const hasWildcard = pattern.includes("*") || pattern.includes("?");
+	if (hasWildcard && !pattern.includes("://")) {
 		const host = getHost(url);
 		if (!host) return false;
-		return wildcardMatch(pattern)(host);
+		return wildcardMatch(pattern)(host) && isAllowedIPv4Host(pattern, host);
 	}
 	const protocol = getProtocol(url);
-	if (protocol === "http:" || protocol === "https:" || !protocol) return pattern === getOrigin(url);
+	if (protocol === "http:" || protocol === "https:" || !protocol) {
+		if (!hasWildcard) return pattern === getOrigin(url);
+		const origin = getOrigin(url);
+		if (origin === null || !wildcardMatch(pattern)(origin)) return false;
+		return isAllowedIPv4Host(pattern.slice(pattern.indexOf("://") + 3), origin.slice(origin.indexOf("://") + 3));
+	}
 	const parsed = parseCustomSchemeOrigin(url);
-	const parsedPattern = parseCustomSchemeOrigin(pattern);
+	const parsedPattern = parseCustomSchemeOrigin(pattern, hasWildcard);
 	if (!parsed || !parsedPattern || parsed.scheme !== parsedPattern.scheme) return false;
+	if (hasWildcard) {
+		if (parsed.authority.includes("@")) return false;
+		if (parsedPattern.authority && !(wildcardMatch(parsedPattern.authority)(parsed.authority) && isAllowedIPv4Host(parsedPattern.authority, parsed.authority))) return false;
+		return !parsedPattern.path || wildcardMatch(parsedPattern.path)(parsed.path || "/");
+	}
 	if (parsedPattern.authority && parsed.authority !== parsedPattern.authority) return false;
 	if (!parsedPattern.path) return true;
 	return parsed.path === parsedPattern.path || parsed.path.startsWith(`${parsedPattern.path}/`);

package/dist/client/index.d.mts

@@ -16,7 +16,8 @@ import { OrganizationOptions } from "../plugins/organization/types.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "../plugins/organization/schema.mjs";
 import { getOrgAdapter } from "../plugins/organization/adapter.mjs";
 import { hasPermission } from "../plugins/organization/has-permission.mjs";
-import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "../plugins/organization/organization.mjs";
+import { parseRoles } from "../plugins/organization/roles.mjs";
+import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization } from "../plugins/organization/organization.mjs";
 import "../plugins/organization/index.mjs";
 import { BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { DBPrimitive } from "@better-auth/core/db";

package/dist/db/internal-adapter.mjs

@@ -78,8 +78,18 @@ const createInternalAdapter = (adapter, ctx) => {
 		const activeSessions = await secondaryStorage.get(`active-sessions-${userId}`);
 		return activeSessions ? safeJSONParse(activeSessions) || [] : [];
 	}
-	async function deleteCachedUserSessions(userId, sessionReferences) {
+	const revokedBeforeKey = (userId) => `revoked-sessions-before-${userId}`;
+	const revokedBeforeTTL = Math.max(sessionExpiration, 86400, Number(options.plugins?.find((plugin) => plugin.id === "admin")?.options?.impersonationSessionDuration) || 0);
+	async function isRevokedSession(session, revokedBeforeByUser) {
+		if (!secondaryStorage) return false;
+		const revokedBefore = revokedBeforeByUser?.get(session.userId) ?? Number(await secondaryStorage.get(revokedBeforeKey(session.userId)));
+		revokedBeforeByUser?.set(session.userId, revokedBefore);
+		return new Date(session.createdAt).getTime() < revokedBefore;
+	}
+	async function deleteCachedUserSessions(userId, sessionReferences, revokedAt) {
 		if (!secondaryStorage) return;
+		const previousRevokedBefore = Number(await secondaryStorage.get(revokedBeforeKey(userId)));
+		await secondaryStorage.set(revokedBeforeKey(userId), String(Math.max(revokedAt, previousRevokedBefore || 0)), revokedBeforeTTL);
 		const deletedTokens = new Set(sessionReferences.map((session) => session.token));
 		for (const { token } of sessionReferences) await secondaryStorage.delete(token);
 		const activeSessionsKey = `active-sessions-${userId}`;
@@ -97,7 +107,8 @@ const createInternalAdapter = (adapter, ctx) => {
 	async function queueCachedUserSessionDeletion(userId, sessionReferences) {
 		if (!secondaryStorage) return;
 		const references = sessionReferences ?? await getActiveSessionReferences(userId);
-		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references), { onError(error) {
+		const revokedAt = Date.now();
+		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references, revokedAt), { onError(error) {
 			logger.error("Failed to delete committed user sessions from secondary storage", error);
 		} });
 	}
@@ -194,6 +205,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				const now = Date.now();
 				const seenTokens = /* @__PURE__ */ new Set();
 				const sessions = [];
+				const revokedBeforeByUser = /* @__PURE__ */ new Map();
 				for (const { token, expiresAt } of list) {
 					if (expiresAt <= now || seenTokens.has(token)) continue;
 					seenTokens.add(token);
@@ -201,7 +213,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					if (!data) continue;
 					try {
 						const parsed = typeof data === "string" ? JSON.parse(data) : data;
-						if (!parsed?.session) continue;
+						if (!parsed?.session || await isRevokedSession(parsed.session, revokedBeforeByUser)) continue;
 						sessions.push(parseSessionOutput(ctx.options, {
 							...parsed.session,
 							expiresAt: new Date(parsed.session.expiresAt)
@@ -312,7 +324,10 @@ const createInternalAdapter = (adapter, ctx) => {
 				});
 				const sessionTTL = getTTLSeconds(data.expiresAt, now);
 				if (sessionTTL > 0) await secondaryStorage.set(data.token, JSON.stringify({
-					session: sessionData,
+					session: {
+						...sessionData,
+						createdAt: data.createdAt
+					},
 					user
 				}), sessionTTL);
 				return sessionData;
@@ -336,7 +351,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				if (!sessionStringified && (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase)) return null;
 				if (sessionStringified) {
 					const s = safeJSONParse(sessionStringified);
-					if (!s) return null;
+					if (!s || await isRevokedSession(s.session)) return null;
 					return {
 						session: parseSessionOutput(ctx.options, {
 							...s.session,
@@ -372,11 +387,12 @@ const createInternalAdapter = (adapter, ctx) => {
 			const uniqueTokens = [...new Set(sessionTokens)];
 			const sessionsByToken = /* @__PURE__ */ new Map();
 			const missingTokens = [];
+			const revokedBeforeByUser = /* @__PURE__ */ new Map();
 			if (secondaryStorage) for (const sessionToken of uniqueTokens) {
 				const sessionStringified = await secondaryStorage.get(sessionToken);
 				if (sessionStringified) try {
 					const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
-					if (!s) continue;
+					if (!s || await isRevokedSession(s.session, revokedBeforeByUser)) continue;
 					const expiresAt = new Date(s.session.expiresAt);
 					if (options?.onlyActiveSessions && expiresAt <= /* @__PURE__ */ new Date()) continue;
 					const session = {
@@ -590,6 +606,8 @@ const createInternalAdapter = (adapter, ctx) => {
 				join: { ...options?.includeAccounts ? { account: true } : {} }
 			});
 			if (!result) return null;
+			const normalize = (value) => value.normalize("NFC").toLowerCase();
+			if (normalize(result.email) !== normalize(email)) return null;
 			const { account: accounts, ...user } = result;
 			return {
 				user,

package/dist/index.d.mts

@@ -7,8 +7,8 @@ import { InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPlug
 import { Auth } from "./types/auth.mjs";
 import { BetterAuthAdvancedOptions, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, StoreIdentifierOption, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource } from "./types/index.mjs";
 import { betterAuth } from "./auth/full.mjs";
+import { StateData, generateGenericState, getAuthStateVerificationIdentifier, parseGenericState } from "./state.mjs";
 import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
-import { StateData, generateGenericState, parseGenericState } from "./state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
 import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./utils/url.mjs";
 import "./utils/index.mjs";
@@ -28,4 +28,4 @@ export * from "@better-auth/core/utils/json";
 export * from "@better-auth/core/social-providers";
 export type * from "better-call";
 export type * from "zod";
-export { APIError, type Account, type AdditionalSessionFieldsInput, type AdditionalUserFieldsInput, type Auth, type BetterAuthAdvancedOptions, type BetterAuthClientOptions, type BetterAuthClientPlugin, type BetterAuthCookies, type BetterAuthOptions, type BetterAuthPlugin, type BetterAuthRateLimitOptions, type ClientAtomListener, type ClientStore, type DBAdapter, type DBAdapterInstance, type DBAdapterSchemaCreation, type DBTransactionAdapter, type ExtractPluginField, FilteredAPI, GenerateStateOptions, HIDE_METADATA, type HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, type InferOptionSchema, type InferPluginContext, type InferPluginErrorCodes, type InferPluginFieldFromTuple, type InferPluginIDs, type InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, type IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, type JoinConfig, type JoinOption, type OverrideMerge, type Prettify, type PrettifyDeep, type RateLimit, type RequiredKeysOf, type Session, SessionQueryParams, type StandardSchemaV1, type StateData, type StoreIdentifierOption, type StripEmptyObjects, type TelemetryEvent, type UnionToIntersection, type User, type UserProvisioningSource, type ValidateUserInfoAction, type ValidateUserInfoMethod, type ValidateUserInfoOAuthInfo, type ValidateUserInfoResult, type ValidateUserInfoSSOInfo, type ValidateUserInfoSource, type Verification, type Where, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };
+export { APIError, type Account, type AdditionalSessionFieldsInput, type AdditionalUserFieldsInput, type Auth, type BetterAuthAdvancedOptions, type BetterAuthClientOptions, type BetterAuthClientPlugin, type BetterAuthCookies, type BetterAuthOptions, type BetterAuthPlugin, type BetterAuthRateLimitOptions, type ClientAtomListener, type ClientStore, type DBAdapter, type DBAdapterInstance, type DBAdapterSchemaCreation, type DBTransactionAdapter, type ExtractPluginField, FilteredAPI, GenerateStateOptions, HIDE_METADATA, type HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, type InferOptionSchema, type InferPluginContext, type InferPluginErrorCodes, type InferPluginFieldFromTuple, type InferPluginIDs, type InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, type IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, type JoinConfig, type JoinOption, type OverrideMerge, type Prettify, type PrettifyDeep, type RateLimit, type RequiredKeysOf, type Session, SessionQueryParams, type StandardSchemaV1, type StateData, type StoreIdentifierOption, type StripEmptyObjects, type TelemetryEvent, type UnionToIntersection, type User, type UserProvisioningSource, type ValidateUserInfoAction, type ValidateUserInfoMethod, type ValidateUserInfoOAuthInfo, type ValidateUserInfoResult, type ValidateUserInfoSSOInfo, type ValidateUserInfoSource, type Verification, type Where, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getAuthStateVerificationIdentifier, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./utils/url.mjs";
-import { generateGenericState, parseGenericState } from "./state.mjs";
+import { generateGenericState, getAuthStateVerificationIdentifier, parseGenericState } from "./state.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
 import { APIError } from "./api/index.mjs";
@@ -14,4 +14,4 @@ export * from "@better-auth/core/oauth2";
 export * from "@better-auth/core/utils/error-codes";
 export * from "@better-auth/core/utils/id";
 export * from "@better-auth/core/utils/json";
-export { APIError, HIDE_METADATA, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };
+export { APIError, HIDE_METADATA, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getAuthStateVerificationIdentifier, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/dist/oauth2/link-account.d.mts

@@ -1,5 +1,6 @@
 import { Account, User } from "../types/models.mjs";
 import "../types/index.mjs";
+import { StateData } from "../state.mjs";
 import { GenericEndpointContext, UserProvisioningSource } from "@better-auth/core";
 //#region src/oauth2/link-account.d.ts
 type OAuthAccountData = Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
@@ -16,10 +17,7 @@ type LinkedProviderProfile = {
   image?: string | null | undefined;
 };
 interface LinkOAuthAccountOptions {
-  link: {
-    userId: string;
-    email: string;
-  };
+  link: NonNullable<StateData["link"]>;
   userInfo: LinkedProviderProfile;
   account: OAuthAccountData;
   profile: Record<string, unknown>;
@@ -35,7 +33,7 @@ interface LinkOAuthAccountFailure {
 type LinkOAuthAccountResult = {
   linked: true;
 } | LinkOAuthAccountFailure;
-export declare function linkOAuthAccount(c: GenericEndpointContext, { link, userInfo, account, profile, scopes }: LinkOAuthAccountOptions): Promise<LinkOAuthAccountResult>;
+export declare function linkOAuthAccount(c: GenericEndpointContext, opts: LinkOAuthAccountOptions): Promise<LinkOAuthAccountResult>;
 export declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
   userInfo: Omit<User, "createdAt" | "updatedAt">;
   account: OAuthAccountData;