fix: cast dates from session to Date when using date methods (#3704)

* fix: cast dates from session to Date when using date methods

* add changeset

.changeset/breezy-rice-grin.md

@@ -0,0 +1,5 @@
+---
+"better-auth": patch
+---
+
+fix: cast dates from session to Date when using date methods

packages/better-auth/src/api/routes/update-user.ts

@@ -519,7 +519,7 @@ export const deleteUser = createAuthEndpoint(
 		}
 
 		if (!ctx.body.password && ctx.context.sessionConfig.freshAge !== 0) {
-			const currentAge = session.session.createdAt.getTime();
+			const currentAge = new Date(session.session.createdAt).getTime();
 			const freshAge = ctx.context.sessionConfig.freshAge * 1000;
 			const now = Date.now();
 			if (now - currentAge > freshAge * 1000) {

packages/better-auth/src/plugins/mcp/authorize.ts

@@ -183,7 +183,7 @@ export async function authorizeMCPOAuth(
 					redirectURI: query.redirect_uri,
 					scope: requestScope,
 					userId: session.user.id,
-					authTime: session.session.createdAt.getTime(),
+					authTime: new Date(session.session.createdAt).getTime(),
 					/**
 					 * If the prompt is set to `consent`, then we need
 					 * to require the user to consent to the scopes.

packages/better-auth/src/plugins/mcp/index.ts

@@ -577,7 +577,9 @@ export const mcp = (options: MCPOptions) => {
 						sub: user.id,
 						aud: client_id.toString(),
 						iat: Date.now(),
-						auth_time: ctx.context.session?.session.createdAt.getTime(),
+						auth_time: ctx.context.session
+							? new Date(ctx.context.session.session.createdAt).getTime()
+							: undefined,
 						nonce: value.nonce,
 						acr: "urn:mace:incommon:iap:silver", // default to silver - ⚠︎ this should be configurable and should be validated against the client's metadata
 						...userClaims,

packages/better-auth/src/plugins/oidc-provider/authorize.ts

@@ -193,7 +193,7 @@ export async function authorize(
 					redirectURI: query.redirect_uri,
 					scope: requestScope,
 					userId: session.user.id,
-					authTime: session.session.createdAt.getTime(),
+					authTime: new Date(session.session.createdAt).getTime(),
 					/**
 					 * If the prompt is set to `consent`, then we need
 					 * to require the user to consent to the scopes.

packages/better-auth/src/plugins/oidc-provider/index.ts

@@ -761,7 +761,9 @@ export const oidcProvider = (options: OIDCOptions) => {
 						sub: user.id,
 						aud: client_id.toString(),
 						iat: Date.now(),
-						auth_time: ctx.context.session?.session.createdAt.getTime(),
+						auth_time: ctx.context.session
+							? new Date(ctx.context.session.session.createdAt).getTime()
+							: undefined,
 						nonce: value.nonce,
 						acr: "urn:mace:incommon:iap:silver", // default to silver - ⚠︎ this should be configurable and should be validated against the client's metadata
 						...userClaims,