better-auth 1.8.0-beta.4 → 1.8.0-beta.6

package/dist/api/dispatch.d.mts

@@ -1,5 +1,6 @@
 import { AuthContext } from "@better-auth/core";
 import { Endpoint, EndpointContext, InputContext } from "better-call";
+import "@better-auth/core/api";
 //#region src/api/dispatch.d.ts
 /**
  * Input accepted by {@link dispatchAuthEndpoint}. `context` must already be a

package/dist/api/dispatch.mjs

@@ -6,6 +6,7 @@ import { APIError } from "@better-auth/core/error";
 import { createDefu } from "defu";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, createWithSpan } from "@better-auth/core/instrumentation";
 import { kAPIErrorHeaderSymbol, toResponse } from "better-call";
+import { getInternalAuthCompletion } from "@better-auth/core/utils/auth-completion";
 //#region src/api/dispatch.ts
 const defuReplaceArrays = createDefu((obj, key, value) => {
 	if (Array.isArray(obj[key]) && Array.isArray(value)) {
@@ -14,6 +15,18 @@ const defuReplaceArrays = createDefu((obj, key, value) => {
 	}
 });
 const hooksSourceWeakMap = /* @__PURE__ */ new WeakMap();
+const signInGates = /* @__PURE__ */ new WeakSet();
+/**
+* Runs a plugin after hook ahead of every other plugin after hook, so a sign-in
+* it withholds (such as a pending two-factor challenge) is never observed as
+* complete, regardless of plugin registration order.
+*
+* @internal
+*/
+function asSignInGate(hook) {
+	signInGates.add(hook.handler);
+	return hook;
+}
 /**
 * Resolves the operation id used for spans, preferring an explicit
 * `operationId`, then the OpenAPI one, then the caller's `fallback` (the
@@ -163,12 +176,19 @@ function getHooks(authContext) {
 	const pluginAfterHooks = plugins.flatMap((plugin) => (plugin.hooks?.after ?? []).map((h) => {
 		hooksSourceWeakMap.set(h.handler, `plugin:${plugin.id}`);
 		return h;
-	}));
+	})).sort((a, b) => Number(signInGates.has(b.handler)) - Number(signInGates.has(a.handler)));
+	const completionHooks = plugins.flatMap((plugin) => {
+		const completion = getInternalAuthCompletion(plugin);
+		if (!completion) return [];
+		hooksSourceWeakMap.set(completion.handler, `plugin:${plugin.id}`);
+		return [completion];
+	});
 	if (pluginBeforeHooks.length) beforeHooks.push(...pluginBeforeHooks);
 	if (pluginAfterHooks.length) afterHooks.push(...pluginAfterHooks);
 	return {
 		beforeHooks,
-		afterHooks
+		afterHooks,
+		completionHooks
 	};
 }
 /**
@@ -208,7 +228,7 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		[ATTR_HTTP_ROUTE]: route,
 		[ATTR_OPERATION_ID]: operationId
 	}, async () => runWithEndpointContext(internalContext, async () => {
-		const { beforeHooks, afterHooks } = getHooks(internalContext.context);
+		const { beforeHooks, afterHooks, completionHooks } = getHooks(internalContext.context);
 		const before = await runBeforeHooks(internalContext, beforeHooks, endpoint, operationId);
 		if ("context" in before && before.context && typeof before.context === "object") {
 			const { headers, ...rest } = before.context;
@@ -244,9 +264,12 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		if (result instanceof Response) return result;
 		internalContext.context.returned = result.response;
 		mergeResponseHeaders(internalContext.context, result.headers);
-		const after = await runAfterHooks(internalContext, afterHooks, endpoint, operationId);
-		if (after.response !== void 0) result.response = after.response;
-		result.headers = after.headers ?? result.headers;
+		await runAfterHooks(internalContext, afterHooks, endpoint, operationId);
+		const matchingCompletions = completionHooks.filter((hook) => hook.matcher(internalContext));
+		if (matchingCompletions.length > 1) throw new APIError("INTERNAL_SERVER_ERROR", { message: "Multiple authentication completion handlers matched." });
+		const completed = await runAfterHooks(internalContext, matchingCompletions, endpoint, operationId);
+		if (completed.response !== void 0) result.response = completed.response;
+		result.headers = completed.headers ?? result.headers;
 		if (isAPIError(result.response) && shouldPublishLog(internalContext.context.logger.level, "debug")) result.response.stack = result.response.errorStack;
 		if (isAPIError(result.response) && !shouldReturnResponse) {
 			if (result.headers) Object.defineProperty(result.response, kAPIErrorHeaderSymbol, {
@@ -274,4 +297,4 @@ async function dispatchAuthEndpoint(endpoint, input) {
 	}));
 }
 //#endregion
-export { dispatchAuthEndpoint, getOperationId };
+export { asSignInGate, dispatchAuthEndpoint, getOperationId };

package/dist/api/index.mjs

@@ -2,9 +2,9 @@ import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
-import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";

package/dist/api/routes/account.mjs

@@ -1,13 +1,16 @@
 import { shouldBindAccountCookieToSessionUser } from "../../context/store-capabilities.mjs";
 import { parseAccountOutput } from "../../db/schema.mjs";
+import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { resolveOAuthAccountKeyForAPI } from "../../oauth2/account-key.mjs";
 import { missingEmailLogMessage } from "../../oauth2/errors.mjs";
+import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
+import { toBoolean } from "../../utils/boolean.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
-import { freshSessionMiddleware, getSessionFromCtx, isStateful, sessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -129,7 +132,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 		*/
 		additionalData: z.record(z.string(), z.any()).optional()
 	}),
-	use: [sessionMiddleware],
+	use: [sensitiveSessionMiddleware],
 	metadata: { openapi: {
 		description: "Link a social account to the user",
 		operationId: "linkSocialAccount",
@@ -169,11 +172,12 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);
 		}
-		const linkingUserInfo = await provider.getUserInfo({
+		const oauthTokens = {
 			idToken: token,
 			accessToken: c.body.idToken.accessToken,
 			refreshToken: c.body.idToken.refreshToken
-		});
+		};
+		const linkingUserInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!linkingUserInfo || !linkingUserInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -204,7 +208,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			});
 		}
 		if (linkedAccount) throw APIError.from("CONFLICT", BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED);
-		if (!c.context.trustedProviders.includes(provider.id) && !linkingUserInfo.user.emailVerified || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
+		if (!c.context.trustedProviders.includes(provider.id) && !toBoolean(linkingUserInfo.user.emailVerified) || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
 			message: "Account not linked - linking not allowed",
 			code: "LINKING_NOT_ALLOWED"
 		});
@@ -237,7 +241,11 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 	const state = await generateState(c, {
 		link: {
 			userId: session.user.id,
-			email: session.user.email
+			email: session.user.email,
+			encryptedSessionToken: isStateful(c) ? await symmetricEncrypt({
+				key: derivePurposeKey(c.context.secretConfig, "oauth-link-session-token"),
+				data: session.session.token
+			}) : void 0
 		},
 		additionalData: c.body.additionalData,
 		idTokenNonce

package/dist/api/routes/email-verification.mjs

@@ -26,7 +26,7 @@ async function sendVerificationEmailFn(ctx, user) {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.VERIFICATION_EMAIL_NOT_ENABLED);
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 	const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 	await ctx.context.options.emailVerification.sendVerificationEmail({
@@ -183,24 +183,30 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 	const parsed = z.object({
 		email: z.email(),
 		updateTo: z.string().optional(),
-		requestType: z.string().optional()
+		requestType: z.string().optional(),
+		userId: z.string().optional()
 	}).parse(jwt.payload);
-	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
-	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
 	if (parsed.updateTo) {
+		if (!parsed.userId) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
+		const boundUser = await ctx.context.internalAdapter.findUserById(parsed.userId);
+		if (!boundUser) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+		if (boundUser.email.toLowerCase() !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 		const session = await getSessionFromCtx(ctx);
-		if (session && session.user.email !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
+		if (session && session.user.id !== boundUser.id) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
 		switch (parsed.requestType) {
 			/**
 			* User clicks confirmation -> sends verification to new email
 			*/
 			case "change-email-confirmation": {
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, {
+					requestType: "change-email-verification",
+					userId: boundUser.id
+				});
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				const url = `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`;
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: {
-						...user.user,
+						...boundUser,
 						email: parsed.updateTo
 					},
 					url,
@@ -213,26 +219,18 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* User clicks verification -> updates email
 			*/
 			case "change-email-verification": {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const emailVerified = boundUser.emailVerified;
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
-					emailVerified: true
+					emailVerified
 				});
-				if (ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (emailVerified && ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
-						emailVerified: true
+						emailVerified
 					}
 				});
 				if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
@@ -248,30 +246,21 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* - updates email immediately
 			*/
 			default: {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
 					emailVerified: false
 				});
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo);
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo, void 0, void 0, { userId: boundUser.id });
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: updatedUser,
 					url: `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`,
 					token: newToken
 				}, safeCloneRequest(ctx.request)));
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
 						emailVerified: false
 					}
@@ -284,6 +273,9 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			}
 		}
 	}
+	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
+	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+	if (parsed.userId && parsed.userId !== user.user.id) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 	if (user.user.emailVerified) {
 		if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
 		return ctx.json({

package/dist/api/routes/sign-in.mjs

@@ -167,7 +167,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			refreshToken: c.body.idToken.refreshToken,
 			user: c.body.idToken.user
 		};
-		const userInfo = await provider.getUserInfo(oauthTokens);
+		const userInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!userInfo || !userInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -338,7 +338,7 @@ const signInEmail = () => createAuthEndpoint("/sign-in/email", {
 	if (ctx.context.options?.emailAndPassword?.requireEmailVerification && !user.emailVerified) {
 		if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
 		if (ctx.context.options?.emailVerification?.sendOnSignIn) {
-			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 			const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 			await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({

package/dist/api/routes/sign-up.mjs

@@ -251,7 +251,7 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 			const callbackURL = body.callbackURL ? encodeURIComponent(body.callbackURL) : encodeURIComponent("/");
 			const request = safeCloneRequest(ctx.request);
 			await queueAfterTransactionHook(async () => {
-				const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+				const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 				const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 				await ctx.context.runInBackgroundOrAwait(sendVerificationEmail({
 					user,

package/dist/api/routes/update-user.mjs

@@ -450,7 +450,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
 	if (await ctx.context.internalAdapter.findUserByEmail(newEmail)) {
-		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn);
+		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 		ctx.context.logger.info("Change email attempt for existing email");
 		return ctx.json({ status: true });
 	}
@@ -467,7 +467,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 			}
 		});
 		if (canSendVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 			await ctx.context.runInBackgroundOrAwait(canSendVerification({
 				user: {
@@ -484,7 +484,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 	* If the email is verified, we need to send a verification email
 	*/
 	if (canSendConfirmation) {
-		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-confirmation" });
+		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+			requestType: "change-email-confirmation",
+			userId: ctx.context.session.user.id
+		});
 		const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 		await ctx.context.runInBackgroundOrAwait(canSendConfirmation({
 			user: ctx.context.session.user,
@@ -498,7 +501,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+		requestType: "change-email-verification",
+		userId: ctx.context.session.user.id
+	});
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 	await ctx.context.runInBackgroundOrAwait(canSendVerification({
 		user: {

package/dist/auth/trusted-origins.mjs

@@ -1,9 +1,24 @@
 import { wildcardMatch } from "../utils/wildcard.mjs";
 import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
+import * as z from "zod";
 //#region src/auth/trusted-origins.ts
 const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
 const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
+const IP_WILDCARD_HOST_PATTERN = /^(?=.*\d)[\d*?.]+$/;
+const ipv4Schema = z.ipv4();
+/**
+* A wildcard host made only of digits, dots and wildcards (`192.168.*.*`,
+* `10.*`) names an address range, so it admits only an IPv4 address. A plain
+* `*` would otherwise cross `.` and let `192.168.attacker.com` match. Other
+* hosts keep the documented subdomain matching.
+*/
+const isAllowedIPv4Host = (patternAuthority, authority) => {
+	const [patternHost = ""] = patternAuthority.split(":");
+	if (!IP_WILDCARD_HOST_PATTERN.test(patternHost)) return true;
+	const [host = ""] = authority.split(":");
+	return z.validate(ipv4Schema, host);
+};
 /**
 * Resolves `.` and `..` segments in a path after percent-decoding so a
 * path-pinned pattern cannot be bypassed with traversal: e.g.
@@ -33,7 +48,7 @@ const normalizePath = (path) => {
 * host); the path is percent-decoded and resolved so traversal cannot bypass
 * a path-pinned pattern.
 */
-const parseCustomSchemeOrigin = (value) => {
+const parseCustomSchemeOrigin = (value, wildcardPattern = false) => {
 	if (CONTROL_CHARACTER_PATTERN.test(value)) return null;
 	const schemeEnd = value.indexOf(":");
 	if (schemeEnd <= 0) return null;
@@ -42,7 +57,7 @@ const parseCustomSchemeOrigin = (value) => {
 	let authority = "";
 	if (rest.startsWith("//")) {
 		rest = rest.slice(2);
-		const authorityEnd = rest.search(/[/?#]/);
+		const authorityEnd = rest.search(wildcardPattern ? /[/#]/ : /[/?#]/);
 		if (authorityEnd === -1) {
 			authority = rest;
 			rest = "";
@@ -51,7 +66,7 @@ const parseCustomSchemeOrigin = (value) => {
 			rest = rest.slice(authorityEnd);
 		}
 	}
-	const pathEnd = rest.search(/[?#]/);
+	const pathEnd = rest.search(wildcardPattern ? /#/ : /[?#]/);
 	const path = normalizePath(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
 	return {
 		scheme,
@@ -87,17 +102,27 @@ const isSafeRelativeURL = (value) => {
 */
 const matchesOriginPattern = (url, pattern, settings) => {
 	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
-	if (pattern.includes("*") || pattern.includes("?")) {
-		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
+	const hasWildcard = pattern.includes("*") || pattern.includes("?");
+	if (hasWildcard && !pattern.includes("://")) {
 		const host = getHost(url);
 		if (!host) return false;
-		return wildcardMatch(pattern)(host);
+		return wildcardMatch(pattern)(host) && isAllowedIPv4Host(pattern, host);
 	}
 	const protocol = getProtocol(url);
-	if (protocol === "http:" || protocol === "https:" || !protocol) return pattern === getOrigin(url);
+	if (protocol === "http:" || protocol === "https:" || !protocol) {
+		if (!hasWildcard) return pattern === getOrigin(url);
+		const origin = getOrigin(url);
+		if (origin === null || !wildcardMatch(pattern)(origin)) return false;
+		return isAllowedIPv4Host(pattern.slice(pattern.indexOf("://") + 3), origin.slice(origin.indexOf("://") + 3));
+	}
 	const parsed = parseCustomSchemeOrigin(url);
-	const parsedPattern = parseCustomSchemeOrigin(pattern);
+	const parsedPattern = parseCustomSchemeOrigin(pattern, hasWildcard);
 	if (!parsed || !parsedPattern || parsed.scheme !== parsedPattern.scheme) return false;
+	if (hasWildcard) {
+		if (parsed.authority.includes("@")) return false;
+		if (parsedPattern.authority && !(wildcardMatch(parsedPattern.authority)(parsed.authority) && isAllowedIPv4Host(parsedPattern.authority, parsed.authority))) return false;
+		return !parsedPattern.path || wildcardMatch(parsedPattern.path)(parsed.path || "/");
+	}
 	if (parsedPattern.authority && parsed.authority !== parsedPattern.authority) return false;
 	if (!parsedPattern.path) return true;
 	return parsed.path === parsedPattern.path || parsed.path.startsWith(`${parsedPattern.path}/`);

package/dist/client/index.d.mts

@@ -16,7 +16,8 @@ import { OrganizationOptions } from "../plugins/organization/types.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "../plugins/organization/schema.mjs";
 import { getOrgAdapter } from "../plugins/organization/adapter.mjs";
 import { hasPermission } from "../plugins/organization/has-permission.mjs";
-import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "../plugins/organization/organization.mjs";
+import { parseRoles } from "../plugins/organization/roles.mjs";
+import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization } from "../plugins/organization/organization.mjs";
 import "../plugins/organization/index.mjs";
 import { BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { DBPrimitive } from "@better-auth/core/db";

package/dist/cookies/index.mjs

@@ -177,6 +177,7 @@ async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
 		...overrides
 	});
 	if (dontRememberMe) await ctx.setSignedCookie(ctx.context.authCookies.dontRememberToken.name, "true", ctx.context.secret, ctx.context.authCookies.dontRememberToken.attributes);
+	else if (dontRememberMeCookie) expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
 	await setCookieCache(ctx, session, dontRememberMe);
 	ctx.context.setNewSession(session);
 }

package/dist/db/internal-adapter.mjs

@@ -38,7 +38,7 @@ const createInternalAdapter = (adapter, ctx) => {
 	* or `deleteUserSessions` sweeping a user's accumulated preserved rows) would
 	* re-match it and re-fire the hooks, re-dispatching back-channel logout.
 	*/
-	const endPreservedSessions = (where) => {
+	const endPreservedSessions = (where, afterEnd) => {
 		const liveSessions = [...where, {
 			field: "expiresAt",
 			value: /* @__PURE__ */ new Date(),
@@ -51,6 +51,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					where: liveSessions,
 					update: { expiresAt: /* @__PURE__ */ new Date() }
 				});
+				await afterEnd?.();
 			},
 			executeMainFn: false
 		});
@@ -78,10 +79,20 @@ const createInternalAdapter = (adapter, ctx) => {
 		const activeSessions = await secondaryStorage.get(`active-sessions-${userId}`);
 		return activeSessions ? safeJSONParse(activeSessions) || [] : [];
 	}
-	async function deleteCachedUserSessions(userId, sessionReferences) {
+	const revokedBeforeKey = (userId) => `revoked-sessions-before-${userId}`;
+	const revokedBeforeTTL = Math.max(sessionExpiration, 86400, Number(options.plugins?.find((plugin) => plugin.id === "admin")?.options?.impersonationSessionDuration) || 0);
+	async function isRevokedSession(session, revokedBeforeByUser) {
+		if (!secondaryStorage) return false;
+		const revokedBefore = revokedBeforeByUser?.get(session.userId) ?? Number(await secondaryStorage.get(revokedBeforeKey(session.userId)));
+		revokedBeforeByUser?.set(session.userId, revokedBefore);
+		return new Date(session.createdAt).getTime() < revokedBefore;
+	}
+	async function deleteCachedUserSessions(userId, sessionReferences, revokedAt) {
 		if (!secondaryStorage) return;
+		const previousRevokedBefore = Number(await secondaryStorage.get(revokedBeforeKey(userId)));
+		await secondaryStorage.set(revokedBeforeKey(userId), String(Math.max(revokedAt, previousRevokedBefore || 0)), revokedBeforeTTL);
 		const deletedTokens = new Set(sessionReferences.map((session) => session.token));
-		for (const { token } of sessionReferences) await secondaryStorage.delete(token);
+		for (const token of deletedTokens) await secondaryStorage.delete(token);
 		const activeSessionsKey = `active-sessions-${userId}`;
 		const currentSessionReferences = await getActiveSessionReferences(userId);
 		const now = Date.now();
@@ -97,7 +108,8 @@ const createInternalAdapter = (adapter, ctx) => {
 	async function queueCachedUserSessionDeletion(userId, sessionReferences) {
 		if (!secondaryStorage) return;
 		const references = sessionReferences ?? await getActiveSessionReferences(userId);
-		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references), { onError(error) {
+		const revokedAt = Date.now();
+		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references, revokedAt), { onError(error) {
 			logger.error("Failed to delete committed user sessions from secondary storage", error);
 		} });
 	}
@@ -194,6 +206,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				const now = Date.now();
 				const seenTokens = /* @__PURE__ */ new Set();
 				const sessions = [];
+				const revokedBeforeByUser = /* @__PURE__ */ new Map();
 				for (const { token, expiresAt } of list) {
 					if (expiresAt <= now || seenTokens.has(token)) continue;
 					seenTokens.add(token);
@@ -201,7 +214,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					if (!data) continue;
 					try {
 						const parsed = typeof data === "string" ? JSON.parse(data) : data;
-						if (!parsed?.session) continue;
+						if (!parsed?.session || await isRevokedSession(parsed.session, revokedBeforeByUser)) continue;
 						sessions.push(parseSessionOutput(ctx.options, {
 							...parsed.session,
 							expiresAt: new Date(parsed.session.expiresAt)
@@ -312,7 +325,10 @@ const createInternalAdapter = (adapter, ctx) => {
 				});
 				const sessionTTL = getTTLSeconds(data.expiresAt, now);
 				if (sessionTTL > 0) await secondaryStorage.set(data.token, JSON.stringify({
-					session: sessionData,
+					session: {
+						...sessionData,
+						createdAt: data.createdAt
+					},
 					user
 				}), sessionTTL);
 				return sessionData;
@@ -336,7 +352,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				if (!sessionStringified && (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase)) return null;
 				if (sessionStringified) {
 					const s = safeJSONParse(sessionStringified);
-					if (!s) return null;
+					if (!s || await isRevokedSession(s.session)) return null;
 					return {
 						session: parseSessionOutput(ctx.options, {
 							...s.session,
@@ -372,11 +388,12 @@ const createInternalAdapter = (adapter, ctx) => {
 			const uniqueTokens = [...new Set(sessionTokens)];
 			const sessionsByToken = /* @__PURE__ */ new Map();
 			const missingTokens = [];
+			const revokedBeforeByUser = /* @__PURE__ */ new Map();
 			if (secondaryStorage) for (const sessionToken of uniqueTokens) {
 				const sessionStringified = await secondaryStorage.get(sessionToken);
 				if (sessionStringified) try {
 					const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
-					if (!s) continue;
+					if (!s || await isRevokedSession(s.session, revokedBeforeByUser)) continue;
 					const expiresAt = new Date(s.session.expiresAt);
 					if (options?.onlyActiveSessions && expiresAt <= /* @__PURE__ */ new Date()) continue;
 					const session = {
@@ -517,23 +534,39 @@ const createInternalAdapter = (adapter, ctx) => {
 		},
 		deleteUserSessions: async (userId) => {
 			const sessionReferences = await getActiveSessionReferences(userId);
-			if (secondaryStorage) {
-				if (!options.session?.storeSessionInDatabase) {
-					await queueCachedUserSessionDeletion(userId, sessionReferences);
-					return;
-				}
-				if (ctx.options.session?.preserveSessionInDatabase) {
-					if (await endPreservedSessions([{
-						field: "userId",
-						value: userId
-					}]) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences);
-					return;
-				}
+			if (!secondaryStorage) {
+				await deleteManyWithHooks([{
+					field: "userId",
+					value: userId
+				}], "session", void 0);
+				return;
+			}
+			if (!options.session?.storeSessionInDatabase) {
+				await queueCachedUserSessionDeletion(userId, sessionReferences);
+				return;
+			}
+			const revokeCachedSessions = async () => queueCachedUserSessionDeletion(userId, [...sessionReferences, ...await getActiveSessionReferences(userId)]);
+			if (ctx.options.session?.preserveSessionInDatabase) {
+				await endPreservedSessions([{
+					field: "userId",
+					value: userId
+				}], revokeCachedSessions);
+				return;
 			}
-			if (await deleteManyWithHooks([{
+			await deleteManyWithHooks([{
 				field: "userId",
 				value: userId
-			}], "session", void 0) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences);
+			}], "session", {
+				fn: async (where) => {
+					const deleted = await (await getCurrentAdapter(adapter)).deleteMany({
+						model: "session",
+						where
+					});
+					await revokeCachedSessions();
+					return deleted;
+				},
+				executeMainFn: false
+			});
 		},
 		deleteSessions: async (sessionTokens) => {
 			if (secondaryStorage) {
@@ -590,6 +623,8 @@ const createInternalAdapter = (adapter, ctx) => {
 				join: { ...options?.includeAccounts ? { account: true } : {} }
 			});
 			if (!result) return null;
+			const normalize = (value) => value.normalize("NFC").toLowerCase();
+			if (normalize(result.email) !== normalize(email)) return null;
 			const { account: accounts, ...user } = result;
 			return {
 				user,