fix(facebook)!: align Limited Login profile claims

.changeset/facebook-profile-types.md

@@ -0,0 +1,5 @@
+---
+"@better-auth/core": minor
+---
+
+Facebook Limited Login profile callbacks now accept tokens without name, email, or picture claims. Profile mappings must handle these omitted values.

packages/core/src/social-providers/facebook.test.ts

@@ -1,4 +1,5 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { UnsecuredJWT } from "jose";
+import { assertType, beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("@better-fetch/fetch", () => ({
 	betterFetch: vi.fn(),
@@ -6,6 +7,7 @@ vi.mock("@better-fetch/fetch", () => ({
 
 import { betterFetch } from "@better-fetch/fetch";
 
+import type { FacebookLimitedLoginProfile } from "./facebook";
 import { facebook } from "./facebook";
 
 const mockedBetterFetch = vi.mocked(betterFetch);
@@ -134,3 +136,22 @@ describe("facebook.getUserInfo (opaque access token)", () => {
 		expect(mockedBetterFetch).not.toHaveBeenCalled();
 	});
 });
+
+/**
+ * @see https://github.com/facebook/facebook-ios-sdk/blob/main/FBSDKCoreKit/FBSDKCoreKit/AuthenticationTokenClaims.swift
+ */
+it("accepts Facebook Limited Login without optional profile claims", async () => {
+	const profile = { sub: "fb-user" };
+	assertType<FacebookLimitedLoginProfile>(profile);
+	const result = await facebook(options).getUserInfo({
+		idToken: new UnsecuredJWT(profile).encode(),
+	});
+
+	expect(result?.data).toMatchObject(profile);
+	expect(result?.user).toEqual({
+		name: undefined,
+		email: undefined,
+		image: undefined,
+		emailVerified: false,
+	});
+});

packages/core/src/social-providers/facebook.ts

@@ -26,9 +26,9 @@ export interface FacebookGraphProfile {
 
 export interface FacebookLimitedLoginProfile {
 	sub: string;
-	email: string;
-	name: string;
-	picture: string;
+	email?: string;
+	name?: string;
+	picture?: string;
 }
 
 export type FacebookProfile =