sonamu 0.11.13 → 0.11.14

package/dist/auth/better-auth-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-request.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAK9C,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GACnC,OAAO,CAYT"}
+{"version":3,"file":"better-auth-request.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAiD9C,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GACnC,OAAO,CAYT"}

package/dist/auth/better-auth-request.js

@@ -1,7 +1,30 @@
 import { __esmMin } from "../_virtual/_rolldown/runtime.js";
 import { convertFastifyHeadersToStandard, init_utils } from "../utils/utils.js";
 import { init_client_ip, replaceClientIpHeaders } from "./audit-log/client-ip.js";
+import { z } from "zod";
 //#region src/auth/better-auth-request.ts
+/** charset 등 파라미터나 대소문자 변형도 포함해 urlencoded content-type인지 판별한다 (RFC 9110 §8.3.1) */
+function isUrlEncodedContentType(headers) {
+	return headers.get("content-type")?.toLowerCase().startsWith("application/x-www-form-urlencoded") ?? false;
+}
+/**
+* Fastify가 파싱한 본문을 원래 content-type에 맞게 재직렬화한다.
+* urlencoded 본문을 JSON으로 재직렬화하면 better-auth가 폼 콜백(예: Apple form_post)을
+* 해석하지 못하므로(state_not_found), content-type과 본문 포맷을 일치시킨다.
+*/
+function serializeBody(request, headers) {
+	if (!isUrlEncodedContentType(headers)) return JSON.stringify(request.body);
+	const rawBody = rawUrlEncodedBodySchema.safeParse(request.body);
+	if (rawBody.success) return rawBody.data;
+	const recordBody = urlEncodedRecordSchema.safeParse(request.body);
+	if (!recordBody.success) return JSON.stringify(request.body);
+	const params = new URLSearchParams();
+	for (const [key, value] of Object.entries(recordBody.data)) {
+		const items = Array.isArray(value) ? value : [value];
+		for (const item of items) params.append(key, String(item));
+	}
+	return params.toString();
+}
 function createBetterAuthRequest(request, ipAddressHeaders) {
 	const url = new URL(request.url, `http://${request.headers.host}`);
 	const headers = convertFastifyHeadersToStandard(request.headers);
@@ -10,15 +33,23 @@ function createBetterAuthRequest(request, ipAddressHeaders) {
 		method: request.method,
 		headers
 	};
-	if (request.body) init.body = JSON.stringify(request.body);
+	if (request.body) init.body = serializeBody(request, headers);
 	return new Request(url.toString(), init);
 }
+var rawUrlEncodedBodySchema, urlEncodedValueSchema, urlEncodedRecordSchema;
 var init_better_auth_request = __esmMin((() => {
 	init_utils();
 	init_client_ip();
+	rawUrlEncodedBodySchema = z.string();
+	urlEncodedValueSchema = z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	]);
+	urlEncodedRecordSchema = z.record(z.string(), z.union([urlEncodedValueSchema, z.array(urlEncodedValueSchema)]));
 }));
 //#endregion
 init_better_auth_request();
 export { createBetterAuthRequest, init_better_auth_request };
 
-//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmV0dGVyLWF1dGgtcmVxdWVzdC5qcyIsIm5hbWVzIjpbXSwic291cmNlcyI6WyIuLi8uLi9zcmMvYXV0aC9iZXR0ZXItYXV0aC1yZXF1ZXN0LnRzIl0sInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IHR5cGUgRmFzdGlmeVJlcXVlc3QgfSBmcm9tIFwiZmFzdGlmeVwiO1xuXG5pbXBvcnQgeyBjb252ZXJ0RmFzdGlmeUhlYWRlcnNUb1N0YW5kYXJkIH0gZnJvbSBcIi4uL3V0aWxzL3V0aWxzXCI7XG5pbXBvcnQgeyByZXBsYWNlQ2xpZW50SXBIZWFkZXJzIH0gZnJvbSBcIi4vYXVkaXQtbG9nL2NsaWVudC1pcFwiO1xuXG5leHBvcnQgZnVuY3Rpb24gY3JlYXRlQmV0dGVyQXV0aFJlcXVlc3QoXG4gIHJlcXVlc3Q6IEZhc3RpZnlSZXF1ZXN0LFxuICBpcEFkZHJlc3NIZWFkZXJzPzogcmVhZG9ubHkgc3RyaW5nW10sXG4pOiBSZXF1ZXN0IHtcbiAgY29uc3QgdXJsID0gbmV3IFVSTChyZXF1ZXN0LnVybCwgYGh0dHA6Ly8ke3JlcXVlc3QuaGVhZGVycy5ob3N0fWApO1xuICBjb25zdCBoZWFkZXJzID0gY29udmVydEZhc3RpZnlIZWFkZXJzVG9TdGFuZGFyZChyZXF1ZXN0LmhlYWRlcnMpO1xuXG4gIHJlcGxhY2VDbGllbnRJcEhlYWRlcnMoaGVhZGVycywgcmVxdWVzdC5pcCwgaXBBZGRyZXNzSGVhZGVycyk7XG5cbiAgY29uc3QgaW5pdDogUmVxdWVzdEluaXQgPSB7XG4gICAgbWV0aG9kOiByZXF1ZXN0Lm1ldGhvZCxcbiAgICBoZWFkZXJzLFxuICB9O1xuICBpZiAocmVxdWVzdC5ib2R5KSBpbml0LmJvZHkgPSBKU09OLnN0cmluZ2lmeShyZXF1ZXN0LmJvZHkpO1xuICByZXR1cm4gbmV3IFJlcXVlc3QodXJsLnRvU3RyaW5nKCksIGluaXQpO1xufVxuIl0sIm1hcHBpbmdzIjoiOzs7O0FBS0EsU0FBZ0Isd0JBQ2QsU0FDQSxrQkFDUztDQUNULE1BQU0sTUFBTSxJQUFJLElBQUksUUFBUSxLQUFLLFVBQVUsUUFBUSxRQUFRLE1BQU07Q0FDakUsTUFBTSxVQUFVLGdDQUFnQyxRQUFRLE9BQU87Q0FFL0QsdUJBQXVCLFNBQVMsUUFBUSxJQUFJLGdCQUFnQjtDQUU1RCxNQUFNLE9BQW9CO0VBQ3hCLFFBQVEsUUFBUTtFQUNoQjtDQUNGO0NBQ0EsSUFBSSxRQUFRLE1BQU0sS0FBSyxPQUFPLEtBQUssVUFBVSxRQUFRLElBQUk7Q0FDekQsT0FBTyxJQUFJLFFBQVEsSUFBSSxTQUFTLEdBQUcsSUFBSTtBQUN6Qzs7WUFsQmdFO2dCQUNGIn0=
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmV0dGVyLWF1dGgtcmVxdWVzdC5qcyIsIm5hbWVzIjpbXSwic291cmNlcyI6WyIuLi8uLi9zcmMvYXV0aC9iZXR0ZXItYXV0aC1yZXF1ZXN0LnRzIl0sInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IHR5cGUgRmFzdGlmeVJlcXVlc3QgfSBmcm9tIFwiZmFzdGlmeVwiO1xuaW1wb3J0IHsgeiB9IGZyb20gXCJ6b2RcIjtcblxuaW1wb3J0IHsgY29udmVydEZhc3RpZnlIZWFkZXJzVG9TdGFuZGFyZCB9IGZyb20gXCIuLi91dGlscy91dGlsc1wiO1xuaW1wb3J0IHsgcmVwbGFjZUNsaWVudElwSGVhZGVycyB9IGZyb20gXCIuL2F1ZGl0LWxvZy9jbGllbnQtaXBcIjtcblxuLyoqIGNoYXJzZXQg65OxIO2MjOudvOuvuO2EsOuCmCDrjIDshozrrLjsnpAg67OA7ZiV64+EIO2PrO2VqO2VtCB1cmxlbmNvZGVkIGNvbnRlbnQtdHlwZeyduOyngCDtjJDrs4TtlZzri6QgKFJGQyA5MTEwIMKnOC4zLjEpICovXG5mdW5jdGlvbiBpc1VybEVuY29kZWRDb250ZW50VHlwZShoZWFkZXJzOiBIZWFkZXJzKTogYm9vbGVhbiB7XG4gIHJldHVybiAoXG4gICAgaGVhZGVycy5nZXQoXCJjb250ZW50LXR5cGVcIik/LnRvTG93ZXJDYXNlKCkuc3RhcnRzV2l0aChcImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZFwiKSA/P1xuICAgIGZhbHNlXG4gICk7XG59XG5cbi8qKiDtjIzshJzqsIAg67O466y47J2EIOqwgOqzte2VmOyngCDslYrqs6Ag64SY6ri0IOqyveyasOydmCDsm5DrrLggdXJsZW5jb2RlZCDrrLjsnpDsl7QgKi9cbmNvbnN0IHJhd1VybEVuY29kZWRCb2R5U2NoZW1hID0gei5zdHJpbmcoKTtcblxuLyoqIEZhc3RpZnkgdXJsZW5jb2RlZCDtjIzshJzqsIAg7IOd7ISx7ZWY64qUIO2CpC3qsJIg67O466y4ICjrsJjrs7Ug7YKk64qUIOuwsOyXtOuhnCDtjIzsi7HrkKgpICovXG5jb25zdCB1cmxFbmNvZGVkVmFsdWVTY2hlbWEgPSB6LnVuaW9uKFt6LnN0cmluZygpLCB6Lm51bWJlcigpLCB6LmJvb2xlYW4oKV0pO1xuY29uc3QgdXJsRW5jb2RlZFJlY29yZFNjaGVtYSA9IHoucmVjb3JkKFxuICB6LnN0cmluZygpLFxuICB6LnVuaW9uKFt1cmxFbmNvZGVkVmFsdWVTY2hlbWEsIHouYXJyYXkodXJsRW5jb2RlZFZhbHVlU2NoZW1hKV0pLFxuKTtcblxuLyoqXG4gKiBGYXN0aWZ56rCAIO2MjOyLse2VnCDrs7jrrLjsnYQg7JuQ656YIGNvbnRlbnQtdHlwZeyXkCDrp57qsowg7J6s7KeB66Cs7ZmU7ZWc64ukLlxuICogdXJsZW5jb2RlZCDrs7jrrLjsnYQgSlNPTuycvOuhnCDsnqzsp4HroKztmZTtlZjrqbQgYmV0dGVyLWF1dGjqsIAg7Y+8IOy9nOuwsSjsmIg6IEFwcGxlIGZvcm1fcG9zdCnsnYRcbiAqIO2VtOyEne2VmOyngCDrqrvtlZjrr4DroZwoc3RhdGVfbm90X2ZvdW5kKSwgY29udGVudC10eXBl6rO8IOuzuOusuCDtj6zrp7fsnYQg7J287LmY7Iuc7YKo64ukLlxuICovXG5mdW5jdGlvbiBzZXJpYWxpemVCb2R5KHJlcXVlc3Q6IEZhc3RpZnlSZXF1ZXN0LCBoZWFkZXJzOiBIZWFkZXJzKTogc3RyaW5nIHtcbiAgaWYgKCFpc1VybEVuY29kZWRDb250ZW50VHlwZShoZWFkZXJzKSkgcmV0dXJuIEpTT04uc3RyaW5naWZ5KHJlcXVlc3QuYm9keSk7XG5cbiAgLy8g7J2066+4IHVybGVuY29kZWQg66y47J6Q7Je07J2066m0IOq3uOuMgOuhnCDsoITri6ztlbQg6rCSIOyZnOqzoeydhCDtlLztlZzri6RcbiAgY29uc3QgcmF3Qm9keSA9IHJhd1VybEVuY29kZWRCb2R5U2NoZW1hLnNhZmVQYXJzZShyZXF1ZXN0LmJvZHkpO1xuICBpZiAocmF3Qm9keS5zdWNjZXNzKSByZXR1cm4gcmF3Qm9keS5kYXRhO1xuXG4gIGNvbnN0IHJlY29yZEJvZHkgPSB1cmxFbmNvZGVkUmVjb3JkU2NoZW1hLnNhZmVQYXJzZShyZXF1ZXN0LmJvZHkpO1xuICAvLyDsmIjsg4Eg67CWIO2Yle2DnOydmCDrs7jrrLjsnYAg6riw7KG0IOuPmeyekShKU09OIOyngeugrO2ZlCnsnYQg7Jyg7KeA7ZWc64ukXG4gIGlmICghcmVjb3JkQm9keS5zdWNjZXNzKSByZXR1cm4gSlNPTi5zdHJpbmdpZnkocmVxdWVzdC5ib2R5KTtcblxuICBjb25zdCBwYXJhbXMgPSBuZXcgVVJMU2VhcmNoUGFyYW1zKCk7XG4gIGZvciAoY29uc3QgW2tleSwgdmFsdWVdIG9mIE9iamVjdC5lbnRyaWVzKHJlY29yZEJvZHkuZGF0YSkpIHtcbiAgICAvLyDrsLDsl7TsnYAgXCJhLGJcIuuhnCDtlansuZjsp4Ag7JWK6rOgIOuwmOuztSDtgqQodGFncz1hJnRhZ3M9YinroZwg7KeB66Cs7ZmU7ZWc64ukXG4gICAgY29uc3QgaXRlbXMgPSBBcnJheS5pc0FycmF5KHZhbHVlKSA/IHZhbHVlIDogW3ZhbHVlXTtcbiAgICBmb3IgKGNvbnN0IGl0ZW0gb2YgaXRlbXMpIHBhcmFtcy5hcHBlbmQoa2V5LCBTdHJpbmcoaXRlbSkpO1xuICB9XG4gIHJldHVybiBwYXJhbXMudG9TdHJpbmcoKTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGNyZWF0ZUJldHRlckF1dGhSZXF1ZXN0KFxuICByZXF1ZXN0OiBGYXN0aWZ5UmVxdWVzdCxcbiAgaXBBZGRyZXNzSGVhZGVycz86IHJlYWRvbmx5IHN0cmluZ1tdLFxuKTogUmVxdWVzdCB7XG4gIGNvbnN0IHVybCA9IG5ldyBVUkwocmVxdWVzdC51cmwsIGBodHRwOi8vJHtyZXF1ZXN0LmhlYWRlcnMuaG9zdH1gKTtcbiAgY29uc3QgaGVhZGVycyA9IGNvbnZlcnRGYXN0aWZ5SGVhZGVyc1RvU3RhbmRhcmQocmVxdWVzdC5oZWFkZXJzKTtcblxuICByZXBsYWNlQ2xpZW50SXBIZWFkZXJzKGhlYWRlcnMsIHJlcXVlc3QuaXAsIGlwQWRkcmVzc0hlYWRlcnMpO1xuXG4gIGNvbnN0IGluaXQ6IFJlcXVlc3RJbml0ID0ge1xuICAgIG1ldGhvZDogcmVxdWVzdC5tZXRob2QsXG4gICAgaGVhZGVycyxcbiAgfTtcbiAgaWYgKHJlcXVlc3QuYm9keSkgaW5pdC5ib2R5ID0gc2VyaWFsaXplQm9keShyZXF1ZXN0LCBoZWFkZXJzKTtcbiAgcmV0dXJuIG5ldyBSZXF1ZXN0KHVybC50b1N0cmluZygpLCBpbml0KTtcbn1cbiJdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBT0EsU0FBUyx3QkFBd0IsU0FBMkI7Q0FDMUQsT0FDRSxRQUFRLElBQUksY0FBYyxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUMsV0FBVyxtQ0FBbUMsS0FDekY7QUFFSjs7Ozs7O0FBaUJBLFNBQVMsY0FBYyxTQUF5QixTQUEwQjtDQUN4RSxJQUFJLENBQUMsd0JBQXdCLE9BQU8sR0FBRyxPQUFPLEtBQUssVUFBVSxRQUFRLElBQUk7Q0FHekUsTUFBTSxVQUFVLHdCQUF3QixVQUFVLFFBQVEsSUFBSTtDQUM5RCxJQUFJLFFBQVEsU0FBUyxPQUFPLFFBQVE7Q0FFcEMsTUFBTSxhQUFhLHVCQUF1QixVQUFVLFFBQVEsSUFBSTtDQUVoRSxJQUFJLENBQUMsV0FBVyxTQUFTLE9BQU8sS0FBSyxVQUFVLFFBQVEsSUFBSTtDQUUzRCxNQUFNLFNBQVMsSUFBSSxnQkFBZ0I7Q0FDbkMsS0FBSyxNQUFNLENBQUMsS0FBSyxVQUFVLE9BQU8sUUFBUSxXQUFXLElBQUksR0FBRztFQUUxRCxNQUFNLFFBQVEsTUFBTSxRQUFRLEtBQUssSUFBSSxRQUFRLENBQUMsS0FBSztFQUNuRCxLQUFLLE1BQU0sUUFBUSxPQUFPLE9BQU8sT0FBTyxLQUFLLE9BQU8sSUFBSSxDQUFDO0NBQzNEO0NBQ0EsT0FBTyxPQUFPLFNBQVM7QUFDekI7QUFFQSxTQUFnQix3QkFDZCxTQUNBLGtCQUNTO0NBQ1QsTUFBTSxNQUFNLElBQUksSUFBSSxRQUFRLEtBQUssVUFBVSxRQUFRLFFBQVEsTUFBTTtDQUNqRSxNQUFNLFVBQVUsZ0NBQWdDLFFBQVEsT0FBTztDQUUvRCx1QkFBdUIsU0FBUyxRQUFRLElBQUksZ0JBQWdCO0NBRTVELE1BQU0sT0FBb0I7RUFDeEIsUUFBUSxRQUFRO0VBQ2hCO0NBQ0Y7Q0FDQSxJQUFJLFFBQVEsTUFBTSxLQUFLLE9BQU8sY0FBYyxTQUFTLE9BQU87Q0FDNUQsT0FBTyxJQUFJLFFBQVEsSUFBSSxTQUFTLEdBQUcsSUFBSTtBQUN6Qzs7O1lBN0RnRTtnQkFDRjtDQVd4RCwwQkFBMEIsRUFBRSxPQUFPO0NBR25DLHdCQUF3QixFQUFFLE1BQU07RUFBQyxFQUFFLE9BQU87RUFBRyxFQUFFLE9BQU87RUFBRyxFQUFFLFFBQVE7Q0FBQyxDQUFDO0NBQ3JFLHlCQUF5QixFQUFFLE9BQy9CLEVBQUUsT0FBTyxHQUNULEVBQUUsTUFBTSxDQUFDLHVCQUF1QixFQUFFLE1BQU0scUJBQXFCLENBQUMsQ0FBQyxDQUNqRSJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sonamu",
-  "version": "0.11.13",
+  "version": "0.11.14",
   "description": "Sonamu — TypeScript Fullstack API Framework",
   "keywords": [
     "framework",

package/src/auth/__tests__/better-auth-request.test.ts

@@ -0,0 +1,210 @@
+import { type FastifyRequest } from "fastify";
+import { describe, expect, test } from "vitest";
+
+import { createBetterAuthRequest } from "../better-auth-request";
+
+// createBetterAuthRequest가 실제로 사용하는 FastifyRequest 필드만 추린 최소 모킹 타입
+type MockableRequestFields = Pick<FastifyRequest, "url" | "method" | "headers" | "body" | "ip">;
+
+function createMockFastifyRequest(overrides: {
+  url?: string;
+  method?: string;
+  headers?: Record<string, string | string[]>;
+  body?: unknown;
+  ip?: string;
+}): FastifyRequest {
+  const mock: MockableRequestFields = {
+    url: overrides.url ?? "/api/auth/callback/apple",
+    method: overrides.method ?? "POST",
+    headers: { host: "localhost:3000", ...overrides.headers },
+    body: overrides.body ?? null,
+    ip: overrides.ip ?? "127.0.0.1",
+  };
+  // SAFETY: 대상 함수는 위 필드만 접근하므로 최소 모킹을 FastifyRequest로 간주해도 안전하다.
+  return mock as FastifyRequest;
+}
+
+describe("createBetterAuthRequest — urlencoded 본문 직렬화 (SON-549)", () => {
+  test("urlencoded POST 콜백 본문을 JSON이 아닌 urlencoded로 직렬화한다", async () => {
+    // Apple Sign-In form_post 콜백 형태의 본문
+    const body = {
+      state: "abc123",
+      code: "authcode-456",
+      user: '{"name":{"firstName":"길동"}}',
+    };
+    const request = createMockFastifyRequest({
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body,
+    });
+
+    const result = createBetterAuthRequest(request);
+    const text = await result.text();
+
+    // JSON 직렬화 결과가 아니어야 한다
+    expect(text).not.toBe(JSON.stringify(body));
+
+    // urlencoded로 재파싱 시 원본 값이 모두 복원되어야 한다
+    const params = new URLSearchParams(text);
+    expect(params.get("state")).toBe("abc123");
+    expect(params.get("code")).toBe("authcode-456");
+    expect(params.get("user")).toBe('{"name":{"firstName":"길동"}}');
+  });
+
+  test("charset 파라미터가 붙은 content-type도 urlencoded로 처리한다", async () => {
+    const body = { state: "abc123", code: "authcode-456" };
+    const request = createMockFastifyRequest({
+      headers: {
+        "content-type": "application/x-www-form-urlencoded; charset=UTF-8",
+      },
+      body,
+    });
+
+    const result = createBetterAuthRequest(request);
+    const params = new URLSearchParams(await result.text());
+
+    expect(params.get("state")).toBe("abc123");
+    expect(params.get("code")).toBe("authcode-456");
+  });
+
+  test("특수문자(=, &, +, 공백, 한글)가 포함된 값이 왕복 보존된다", async () => {
+    const trickyState = "a=b&c+d e한글";
+    const body = { state: trickyState, code: "x" };
+    const request = createMockFastifyRequest({
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body,
+    });
+
+    const result = createBetterAuthRequest(request);
+    const params = new URLSearchParams(await result.text());
+
+    expect(params.get("state")).toBe(trickyState);
+    expect(params.get("code")).toBe("x");
+  });
+
+  test("본문이 이미 urlencoded 문자열이면 값이 그대로 보존된다", async () => {
+    const request = createMockFastifyRequest({
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: "state=abc&code=def",
+    });
+
+    const result = createBetterAuthRequest(request);
+    const params = new URLSearchParams(await result.text());
+
+    expect(params.get("state")).toBe("abc");
+    expect(params.get("code")).toBe("def");
+  });
+
+  test("배열 값은 반복 키로 직렬화되어 값 손실이 없다", async () => {
+    const request = createMockFastifyRequest({
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: { tags: ["a", "b"] },
+    });
+
+    const result = createBetterAuthRequest(request);
+    const params = new URLSearchParams(await result.text());
+
+    // "a,b"로 합쳐지지 않고 반복 키(tags=a&tags=b)로 유지되어야 한다
+    expect(params.getAll("tags")).toEqual(["a", "b"]);
+  });
+
+  test("대소문자가 섞인 content-type 값도 urlencoded로 감지한다", async () => {
+    // HTTP 미디어 타입은 대소문자를 구분하지 않으며(RFC 9110 §8.3.1),
+    // Fastify 파서 조회도 소문자화된 타입으로 매칭하므로 브리지도 동일하게 감지해야 한다
+    const body = { state: "mixed-case", code: "authcode-789" };
+    const request = createMockFastifyRequest({
+      headers: {
+        "content-type": "Application/X-WWW-Form-Urlencoded; charset=UTF-8",
+      },
+      body,
+    });
+
+    const result = createBetterAuthRequest(request);
+    const text = await result.text();
+
+    expect(text).not.toBe(JSON.stringify(body));
+
+    const params = new URLSearchParams(text);
+    expect(params.get("state")).toBe("mixed-case");
+    expect(params.get("code")).toBe("authcode-789");
+  });
+
+  test("urlencoded content-type에 중첩 객체 본문이면 JSON 직렬화 폴백을 유지한다", async () => {
+    // qs 계열 파서가 생성하는 중첩 객체는 평탄한 레코드가 아니므로
+    // 본문을 버리거나 예외를 던지지 않고 기존 JSON 직렬화로 보존해야 한다
+    const body = { user: { name: "길동" } };
+    const request = createMockFastifyRequest({
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body,
+    });
+
+    const result = createBetterAuthRequest(request);
+
+    expect(await result.text()).toBe(JSON.stringify(body));
+  });
+});
+
+describe("createBetterAuthRequest — 기존 동작 회귀 보장", () => {
+  test("JSON POST 본문은 JSON.stringify 결과 그대로 전달한다", async () => {
+    const body = { email: "user@example.com", password: "secret" };
+    const request = createMockFastifyRequest({
+      headers: { "content-type": "application/json" },
+      body,
+    });
+
+    const result = createBetterAuthRequest(request);
+
+    expect(await result.text()).toBe(JSON.stringify(body));
+  });
+
+  test("content-type 없는 POST 본문은 JSON.stringify를 유지한다", async () => {
+    const body = { foo: "bar" };
+    const request = createMockFastifyRequest({ body });
+
+    const result = createBetterAuthRequest(request);
+
+    expect(await result.text()).toBe(JSON.stringify(body));
+  });
+
+  test("GET 요청은 본문 없이 메서드와 URL을 보존한다", () => {
+    const request = createMockFastifyRequest({
+      url: "/api/auth/session?foo=bar",
+      method: "GET",
+      body: null,
+    });
+
+    const result = createBetterAuthRequest(request);
+
+    expect(result.body).toBeNull();
+    expect(result.method).toBe("GET");
+    expect(result.url).toBe("http://localhost:3000/api/auth/session?foo=bar");
+  });
+
+  test("urlencoded 경로에서도 클라이언트 IP 치환과 기타 헤더가 유지된다", async () => {
+    const request = createMockFastifyRequest({
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        "x-forwarded-for": "9.9.9.9",
+        "user-agent": "test-agent",
+        cookie: "session=xyz",
+      },
+      body: { state: "abc" },
+      ip: "1.2.3.4",
+    });
+
+    const result = createBetterAuthRequest(request, ["x-custom-ip"]);
+
+    // replaceClientIpHeaders가 신뢰 가능한 request.ip로 치환해야 한다
+    expect(result.headers.get("x-forwarded-for")).toBe("1.2.3.4");
+    expect(result.headers.get("x-real-ip")).toBe("1.2.3.4");
+    expect(result.headers.get("x-custom-ip")).toBe("1.2.3.4");
+
+    // 그 외 헤더는 변경 없이 전달되어야 한다
+    expect(result.headers.get("user-agent")).toBe("test-agent");
+    expect(result.headers.get("cookie")).toBe("session=xyz");
+    expect(result.headers.get("content-type")).toBe("application/x-www-form-urlencoded");
+
+    // urlencoded 본문 직렬화도 함께 보장한다
+    const params = new URLSearchParams(await result.text());
+    expect(params.get("state")).toBe("abc");
+  });
+});

package/src/auth/better-auth-request.ts

@@ -1,8 +1,52 @@
 import { type FastifyRequest } from "fastify";
+import { z } from "zod";
 
 import { convertFastifyHeadersToStandard } from "../utils/utils";
 import { replaceClientIpHeaders } from "./audit-log/client-ip";
 
+/** charset 등 파라미터나 대소문자 변형도 포함해 urlencoded content-type인지 판별한다 (RFC 9110 §8.3.1) */
+function isUrlEncodedContentType(headers: Headers): boolean {
+  return (
+    headers.get("content-type")?.toLowerCase().startsWith("application/x-www-form-urlencoded") ??
+    false
+  );
+}
+
+/** 파서가 본문을 가공하지 않고 넘긴 경우의 원문 urlencoded 문자열 */
+const rawUrlEncodedBodySchema = z.string();
+
+/** Fastify urlencoded 파서가 생성하는 키-값 본문 (반복 키는 배열로 파싱됨) */
+const urlEncodedValueSchema = z.union([z.string(), z.number(), z.boolean()]);
+const urlEncodedRecordSchema = z.record(
+  z.string(),
+  z.union([urlEncodedValueSchema, z.array(urlEncodedValueSchema)]),
+);
+
+/**
+ * Fastify가 파싱한 본문을 원래 content-type에 맞게 재직렬화한다.
+ * urlencoded 본문을 JSON으로 재직렬화하면 better-auth가 폼 콜백(예: Apple form_post)을
+ * 해석하지 못하므로(state_not_found), content-type과 본문 포맷을 일치시킨다.
+ */
+function serializeBody(request: FastifyRequest, headers: Headers): string {
+  if (!isUrlEncodedContentType(headers)) return JSON.stringify(request.body);
+
+  // 이미 urlencoded 문자열이면 그대로 전달해 값 왜곡을 피한다
+  const rawBody = rawUrlEncodedBodySchema.safeParse(request.body);
+  if (rawBody.success) return rawBody.data;
+
+  const recordBody = urlEncodedRecordSchema.safeParse(request.body);
+  // 예상 밖 형태의 본문은 기존 동작(JSON 직렬화)을 유지한다
+  if (!recordBody.success) return JSON.stringify(request.body);
+
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(recordBody.data)) {
+    // 배열은 "a,b"로 합치지 않고 반복 키(tags=a&tags=b)로 직렬화한다
+    const items = Array.isArray(value) ? value : [value];
+    for (const item of items) params.append(key, String(item));
+  }
+  return params.toString();
+}
+
 export function createBetterAuthRequest(
   request: FastifyRequest,
   ipAddressHeaders?: readonly string[],
@@ -16,6 +60,6 @@ export function createBetterAuthRequest(
     method: request.method,
     headers,
   };
-  if (request.body) init.body = JSON.stringify(request.body);
+  if (request.body) init.body = serializeBody(request, headers);
   return new Request(url.toString(), init);
 }