diff --git a/.changeset/pre.json b/.changeset/pre.json index 2146260f3b..c118564ae6 100644 --- a/.changeset/pre.json +++ b/.changeset/pre.json @@ -39,11 +39,13 @@ "cli-requires-node-22", "cloudflare-create-require-runtime", "code-replay-invalid-grant", + "compound-database-indexes", "consume-phone-number-otp", "cool-lights-burn", "create-initial-admin-cli", "dcr-graceful-override-confidential", "dcr-pkce-policy", + "drizzle-relations-v2-schema-name", "dynamic-baseurl-hardening", "fiery-guests-visit", "fix-2fa-bypass", @@ -62,10 +64,14 @@ "honest-regions-jam", "honest-symbols-stick", "host-classifier-ssrf-hardening", + "hungry-camels-listen", "hungry-drinks-read", "i18n-built-in-translations", "id-token-claim-authority", + "issuer-scoped-account-identities", + "joins-out-of-experimental", "kysely-migrate-add-column-defaults", + "kysely-migration-constants", "lovely-toes-swim", "mcp-oauth-provider-migration", "microsoft-client-assertion", @@ -89,6 +95,7 @@ "oauth-signup-transaction", "oidc-id-token-userinfo-claims", "oidc-offline-access-nonce", + "organization-get-organization", "pr-8926", "pr-8931", "pr-8977", @@ -108,10 +115,14 @@ "restore-stripe-cancel-event-required", "safe-url-runtime-fragment", "saml-response-validation-hardening", + "schema-preserving-sso-user-resolution", + "scim-active-user-link", + "scim-decoupled-provisioning", "scim-group-resources", "scim-org-scoped-connections", "scim-personal-provider-ownership", "silver-gardens-wander", + "siwe-addressless-nonces", "social-auth-validation", "sso-oidc-manual-redirects", "sso-provider-additional-fields", @@ -119,6 +130,7 @@ "sso-saml-model-split", "sso-upgrade-samlify", "strict-one-tap-audience", + "tidy-ravens-revoke", "tighten-adapter-peerdeps", "two-factor-otp-enable", "userinfo-form-body-token", diff --git a/packages/api-key/CHANGELOG.md b/packages/api-key/CHANGELOG.md index 837f78e04b..04bf7082ff 100644 --- a/packages/api-key/CHANGELOG.md +++ b/packages/api-key/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/api-key +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/api-key/package.json b/packages/api-key/package.json index 817e84b018..19f4f7e7a3 100644 --- a/packages/api-key/package.json +++ b/packages/api-key/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/api-key", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "API Key plugin for Better Auth.", "type": "module", "license": "MIT", diff --git a/packages/better-auth/CHANGELOG.md b/packages/better-auth/CHANGELOG.md index 4a70ed3f7b..9b05514f94 100644 --- a/packages/better-auth/CHANGELOG.md +++ b/packages/better-auth/CHANGELOG.md @@ -1,5 +1,60 @@ # better-auth +## 1.7.0-rc.2 + +### Minor Changes + +- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write. + +- [#10403](https://github.com/better-auth/better-auth/pull/10403) [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Scope account identity by trusted issuer instead of provider configuration. Accounts now use the unique `(issuer, providerAccountId)` key, so aliases for one OpenID Connect issuer deduplicate one external identity while equal subjects from different issuers remain separate. This identity deduplication does not introduce independent grant or provider lifecycle records for aliases. + + This release is breaking. `Account.accountId` is renamed to `Account.providerAccountId`, and `Account.issuer` is required. Account-specific APIs select the local `Account.id` through `accountId`; token and provider-profile APIs can instead select the signed account cookie with `useAccountCookie: true`. Credential accounts use `local:credential` and the linked user's stable `id` as their provider identity. + + OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses `sub`, plain OAuth uses `id`, and providers can declare `accountSubject` for another immutable field; Better Auth no longer switches between `sub` and `id` at runtime. `getUserInfo().user` no longer carries provider identity, and `mapProfileToUser` cannot return `id`. Read the selected identity from `accountInfo.account.providerAccountId` instead of `accountInfo.user.id`. The generic `microsoftEntraId` helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities. + + SSO account subjects are now protocol-defined. OIDC uses the verified `sub` claim, and SAML uses the signed `NameID`; `mapping.id` is removed from both configurations. A manual SAML configuration without metadata XML must set `idpMetadata.entityID`, because `samlConfig.issuer` identifies the service provider and no longer acts as the IdP identity. + + Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically. + +- [#10359](https://github.com/better-auth/better-auth/pull/10359) [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Database joins have moved out of `experimental` into a stable option at `advanced.database.joins` (default: `false`). + + If you previously set `experimental: { joins: true }`, update your config to: + + ```ts + advanced: { + database: { + joins: true, + }, + } + ``` + + Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (`npx auth@latest generate`). + +- [#10397](https://github.com/better-auth/better-auth/pull/10397) [`bb6c102`](https://github.com/better-auth/better-auth/commit/bb6c1021e8f6200e60ff852cbd95fb6841a0ec4b) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Add `organization.getOrganization()` to fetch organization metadata without members or invitations. + +- [#10473](https://github.com/better-auth/better-auth/pull/10473) [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Add transactional OIDC user resolution so applications can link verified issuer and subject pairs to exact existing users while preserving or updating the local profile. + +- [#10234](https://github.com/better-auth/better-auth/pull/10234) [`973fdde`](https://github.com/better-auth/better-auth/commit/973fdde79d9746b15d5ac0427049e8a008a7705c) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - The SIWE plugin now issues nonces before the wallet address or Chain ID is known. `authClient.siwe.nonce()` and `authClient.siwe.getNonce()` no longer accept wallet fields, `getNonce` must return an ERC-4361 nonce (8-250 alphanumeric characters), and SIWE verification now reads the wallet address and Chain ID from the signed ERC-4361 message. + +### Patch Changes + +- [#10299](https://github.com/better-auth/better-auth/pull/10299) [`cf8eaac`](https://github.com/better-auth/better-auth/commit/cf8eaac26e11bcdb7309d537f1730b2559963861) Thanks [@momomuchu](https://github.com/momomuchu)! - widen drizzle-kit peer dependency range + +- [#10390](https://github.com/better-auth/better-auth/pull/10390) [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - SCIM connections can now provision Users, Groups, and direct memberships into application-defined provisioning domains without the organization or SSO plugins. Applications can map Group membership to validated custom roles through projections. The service also supports SCIM 2.0 discovery, filtering, pagination, response attribute selection, atomic PATCH operations, and common request patterns used by Microsoft Entra ID and Okta. + + This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic. + + Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions. + +- Updated dependencies [[`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1), [`5d38b13`](https://github.com/better-auth/better-auth/commit/5d38b138c3c73eb06fe247ef6631c66e86ccc92b), [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9), [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545), [`e4818b5`](https://github.com/better-auth/better-auth/commit/e4818b545984dce99e3c798ead5691c5bf775a70), [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a), [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15)]: + - @better-auth/core@1.7.0-rc.2 + - @better-auth/drizzle-adapter@1.7.0-rc.2 + - @better-auth/mongo-adapter@1.7.0-rc.2 + - @better-auth/kysely-adapter@1.7.0-rc.2 + - @better-auth/memory-adapter@1.7.0-rc.2 + - @better-auth/prisma-adapter@1.7.0-rc.2 + - @better-auth/telemetry@1.7.0-rc.2 + ## 1.7.0-rc.1 ### Patch Changes diff --git a/packages/better-auth/package.json b/packages/better-auth/package.json index a88ee6b351..1cf8254341 100644 --- a/packages/better-auth/package.json +++ b/packages/better-auth/package.json @@ -1,6 +1,6 @@ { "name": "better-auth", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "The most comprehensive authentication framework for TypeScript.", "type": "module", "license": "MIT", diff --git a/packages/cimd/CHANGELOG.md b/packages/cimd/CHANGELOG.md index e1789e13ea..3661ebd858 100644 --- a/packages/cimd/CHANGELOG.md +++ b/packages/cimd/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/cimd +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/cimd/package.json b/packages/cimd/package.json index aaecd6311f..10dff8cc65 100644 --- a/packages/cimd/package.json +++ b/packages/cimd/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/cimd", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Client ID Metadata Document plugin for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 47f8c3cb24..c7127c4f0f 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,18 @@ # auth +## 1.7.0-rc.2 + +### Minor Changes + +- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write. + +### Patch Changes + +- Updated dependencies [[`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1), [`cf8eaac`](https://github.com/better-auth/better-auth/commit/cf8eaac26e11bcdb7309d537f1730b2559963861), [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9), [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545), [`bb6c102`](https://github.com/better-auth/better-auth/commit/bb6c1021e8f6200e60ff852cbd95fb6841a0ec4b), [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a), [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15), [`973fdde`](https://github.com/better-auth/better-auth/commit/973fdde79d9746b15d5ac0427049e8a008a7705c)]: + - @better-auth/core@1.7.0-rc.2 + - better-auth@1.7.0-rc.2 + - @better-auth/telemetry@1.7.0-rc.2 + ## 1.7.0-rc.1 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 6913561f8a..69a53ae68e 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "auth", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "The CLI for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index 975fe1368f..955520ab1a 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,45 @@ # @better-auth/core +## 1.7.0-rc.2 + +### Minor Changes + +- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write. + +- [#10403](https://github.com/better-auth/better-auth/pull/10403) [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Scope account identity by trusted issuer instead of provider configuration. Accounts now use the unique `(issuer, providerAccountId)` key, so aliases for one OpenID Connect issuer deduplicate one external identity while equal subjects from different issuers remain separate. This identity deduplication does not introduce independent grant or provider lifecycle records for aliases. + + This release is breaking. `Account.accountId` is renamed to `Account.providerAccountId`, and `Account.issuer` is required. Account-specific APIs select the local `Account.id` through `accountId`; token and provider-profile APIs can instead select the signed account cookie with `useAccountCookie: true`. Credential accounts use `local:credential` and the linked user's stable `id` as their provider identity. + + OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses `sub`, plain OAuth uses `id`, and providers can declare `accountSubject` for another immutable field; Better Auth no longer switches between `sub` and `id` at runtime. `getUserInfo().user` no longer carries provider identity, and `mapProfileToUser` cannot return `id`. Read the selected identity from `accountInfo.account.providerAccountId` instead of `accountInfo.user.id`. The generic `microsoftEntraId` helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities. + + SSO account subjects are now protocol-defined. OIDC uses the verified `sub` claim, and SAML uses the signed `NameID`; `mapping.id` is removed from both configurations. A manual SAML configuration without metadata XML must set `idpMetadata.entityID`, because `samlConfig.issuer` identifies the service provider and no longer acts as the IdP identity. + + Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically. + +- [#10359](https://github.com/better-auth/better-auth/pull/10359) [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Database joins have moved out of `experimental` into a stable option at `advanced.database.joins` (default: `false`). + + If you previously set `experimental: { joins: true }`, update your config to: + + ```ts + advanced: { + database: { + joins: true, + }, + } + ``` + + Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (`npx auth@latest generate`). + +- [#10473](https://github.com/better-auth/better-auth/pull/10473) [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Add transactional OIDC user resolution so applications can link verified issuer and subject pairs to exact existing users while preserving or updating the local profile. + +### Patch Changes + +- [#10390](https://github.com/better-auth/better-auth/pull/10390) [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - SCIM connections can now provision Users, Groups, and direct memberships into application-defined provisioning domains without the organization or SSO plugins. Applications can map Group membership to validated custom roles through projections. The service also supports SCIM 2.0 discovery, filtering, pagination, response attribute selection, atomic PATCH operations, and common request patterns used by Microsoft Entra ID and Okta. + + This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic. + + Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions. + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/core/package.json b/packages/core/package.json index 38185fef58..f6f0a81f03 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/core", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "The most comprehensive authentication framework for TypeScript.", "type": "module", "license": "MIT", diff --git a/packages/drizzle-adapter/CHANGELOG.md b/packages/drizzle-adapter/CHANGELOG.md index 511d4de9b7..e4e44aee1d 100644 --- a/packages/drizzle-adapter/CHANGELOG.md +++ b/packages/drizzle-adapter/CHANGELOG.md @@ -1,5 +1,27 @@ # @better-auth/drizzle-adapter +## 1.7.0-rc.2 + +### Minor Changes + +- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write. + +- [#7169](https://github.com/better-auth/better-auth/pull/7169) [`5d38b13`](https://github.com/better-auth/better-auth/commit/5d38b138c3c73eb06fe247ef6631c66e86ccc92b) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Add a `schemaName` option to the Drizzle Relations v2 adapter config. When set on PostgreSQL, schema generation now emits a `pgSchema("...")` namespace and uses namespaced table definitions (for example, `authSchema.user(...)`), matching the v1 CLI generator behavior. + +- [#10359](https://github.com/better-auth/better-auth/pull/10359) [`8784c1c`](https://github.com/better-auth/better-auth/commit/8784c1c1f4301acf96d980e5bf81ff56435e2545) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Database joins have moved out of `experimental` into a stable option at `advanced.database.joins` (default: `false`). + + If you previously set `experimental: { joins: true }`, update your config to: + + ```ts + advanced: { + database: { + joins: true, + }, + } + ``` + + Adapters that support native joins use them when enabled. If an adapter cannot return joined data for a query, Better Auth falls back to additional queries and combines the results. Drizzle and Prisma users should ensure their schema includes the required relations (`npx auth@latest generate`). + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/drizzle-adapter/package.json b/packages/drizzle-adapter/package.json index 10caf084d5..ce650a0c1f 100644 --- a/packages/drizzle-adapter/package.json +++ b/packages/drizzle-adapter/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/drizzle-adapter", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "bugs": { "url": "https://github.com/better-auth/better-auth/issues" }, diff --git a/packages/electron/CHANGELOG.md b/packages/electron/CHANGELOG.md index fb42719ed3..6127882721 100644 --- a/packages/electron/CHANGELOG.md +++ b/packages/electron/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/electron +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/electron/package.json b/packages/electron/package.json index 841bbc3287..759c32ed0d 100644 --- a/packages/electron/package.json +++ b/packages/electron/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/electron", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Better Auth integration for Electron applications.", "type": "module", "license": "MIT", diff --git a/packages/expo/CHANGELOG.md b/packages/expo/CHANGELOG.md index cbc32dcf72..53911833d2 100644 --- a/packages/expo/CHANGELOG.md +++ b/packages/expo/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/expo +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/expo/package.json b/packages/expo/package.json index e87fb549cc..a728c8d7fc 100644 --- a/packages/expo/package.json +++ b/packages/expo/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/expo", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Better Auth integration for Expo and React Native applications.", "type": "module", "license": "MIT", diff --git a/packages/i18n/CHANGELOG.md b/packages/i18n/CHANGELOG.md index 0ac0beaf91..c8e58131cb 100644 --- a/packages/i18n/CHANGELOG.md +++ b/packages/i18n/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/i18n +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/i18n/package.json b/packages/i18n/package.json index 5984585d74..c8de44f8ae 100644 --- a/packages/i18n/package.json +++ b/packages/i18n/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/i18n", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "i18n plugin for Better Auth - translate error messages", "type": "module", "license": "MIT", diff --git a/packages/kysely-adapter/CHANGELOG.md b/packages/kysely-adapter/CHANGELOG.md index a6b77b73be..f9ccf34480 100644 --- a/packages/kysely-adapter/CHANGELOG.md +++ b/packages/kysely-adapter/CHANGELOG.md @@ -1,5 +1,11 @@ # @better-auth/kysely-adapter +## 1.7.0-rc.2 + +### Patch Changes + +- [#10377](https://github.com/better-auth/better-auth/pull/10377) [`e4818b5`](https://github.com/better-auth/better-auth/commit/e4818b545984dce99e3c798ead5691c5bf775a70) Thanks [@ping-maxwell](https://github.com/ping-maxwell)! - Fix SQLite dialect bundles with Kysely 0.29 by using locally mirrored migration-table constants. + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/kysely-adapter/package.json b/packages/kysely-adapter/package.json index 2d226f8ebc..36cc168328 100644 --- a/packages/kysely-adapter/package.json +++ b/packages/kysely-adapter/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/kysely-adapter", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Kysely adapter for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md index 63ab9dd4cb..14a635bd8b 100644 --- a/packages/mcp/CHANGELOG.md +++ b/packages/mcp/CHANGELOG.md @@ -1,5 +1,12 @@ # @better-auth/mcp +## 1.7.0-rc.2 + +### Patch Changes + +- Updated dependencies [[`69acb7a`](https://github.com/better-auth/better-auth/commit/69acb7a3db3cd148a9cd1db5063dbdc69909165a)]: + - @better-auth/oauth-provider@1.7.0-rc.2 + ## 1.7.0-rc.1 ### Patch Changes diff --git a/packages/mcp/package.json b/packages/mcp/package.json index ed159f7031..732aff6b50 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/mcp", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Model Context Protocol (MCP) plugin for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/memory-adapter/CHANGELOG.md b/packages/memory-adapter/CHANGELOG.md index 939a442bc8..f3e0be3250 100644 --- a/packages/memory-adapter/CHANGELOG.md +++ b/packages/memory-adapter/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/memory-adapter +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/memory-adapter/package.json b/packages/memory-adapter/package.json index be7b18d22a..ffb8899f49 100644 --- a/packages/memory-adapter/package.json +++ b/packages/memory-adapter/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/memory-adapter", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Memory adapter for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/mongo-adapter/CHANGELOG.md b/packages/mongo-adapter/CHANGELOG.md index 1108322c6c..b27f99fbbf 100644 --- a/packages/mongo-adapter/CHANGELOG.md +++ b/packages/mongo-adapter/CHANGELOG.md @@ -1,5 +1,11 @@ # @better-auth/mongo-adapter +## 1.7.0-rc.2 + +### Minor Changes + +- [#10402](https://github.com/better-auth/better-auth/pull/10402) [`763a267`](https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write. + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/mongo-adapter/package.json b/packages/mongo-adapter/package.json index 23bcb65ee5..8b0591ad91 100644 --- a/packages/mongo-adapter/package.json +++ b/packages/mongo-adapter/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/mongo-adapter", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Mongo adapter for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/oauth-provider/CHANGELOG.md b/packages/oauth-provider/CHANGELOG.md index c96168c101..5cac4f6e2e 100644 --- a/packages/oauth-provider/CHANGELOG.md +++ b/packages/oauth-provider/CHANGELOG.md @@ -1,5 +1,11 @@ # @better-auth/oauth-provider +## 1.7.0-rc.2 + +### Patch Changes + +- [#10472](https://github.com/better-auth/better-auth/pull/10472) [`69acb7a`](https://github.com/better-auth/better-auth/commit/69acb7a3db3cd148a9cd1db5063dbdc69909165a) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Revoke session-bound OAuth tokens and deliver back-channel logout only after the related session deletion succeeds. + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/oauth-provider/package.json b/packages/oauth-provider/package.json index 383e0edb2d..d4e9cc1efb 100644 --- a/packages/oauth-provider/package.json +++ b/packages/oauth-provider/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/oauth-provider", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "An oauth provider plugin for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/passkey/CHANGELOG.md b/packages/passkey/CHANGELOG.md index 0cbdbeec39..3244e51b87 100644 --- a/packages/passkey/CHANGELOG.md +++ b/packages/passkey/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/passkey +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/passkey/package.json b/packages/passkey/package.json index 8005e4482e..fd7e0f48e9 100644 --- a/packages/passkey/package.json +++ b/packages/passkey/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/passkey", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Passkey plugin for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/prisma-adapter/CHANGELOG.md b/packages/prisma-adapter/CHANGELOG.md index 2008ce071d..6b2e534628 100644 --- a/packages/prisma-adapter/CHANGELOG.md +++ b/packages/prisma-adapter/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/prisma-adapter +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/prisma-adapter/package.json b/packages/prisma-adapter/package.json index 35a04fe378..ae6a6697b9 100644 --- a/packages/prisma-adapter/package.json +++ b/packages/prisma-adapter/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/prisma-adapter", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Prisma adapter for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/redis-storage/CHANGELOG.md b/packages/redis-storage/CHANGELOG.md index c0c035aa1a..4de4524003 100644 --- a/packages/redis-storage/CHANGELOG.md +++ b/packages/redis-storage/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/redis-storage +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/redis-storage/package.json b/packages/redis-storage/package.json index b7cc43142b..fc6ea6db29 100644 --- a/packages/redis-storage/package.json +++ b/packages/redis-storage/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/redis-storage", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Redis storage for Better Auth secondary storage", "type": "module", "license": "MIT", diff --git a/packages/scim/CHANGELOG.md b/packages/scim/CHANGELOG.md index 2c5d85c49c..53fb3f5f4f 100644 --- a/packages/scim/CHANGELOG.md +++ b/packages/scim/CHANGELOG.md @@ -1,5 +1,19 @@ # @better-auth/scim +## 1.7.0-rc.2 + +### Minor Changes + +- [#10474](https://github.com/better-auth/better-auth/pull/10474) [`dec763e`](https://github.com/better-auth/better-auth/commit/dec763ef2c5af1217888a4d7f3e8b6815cd0df52) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Add `acquireActiveSCIMUserLink` for transaction-safe authentication of provisioned users. The helper maps an exact SCIM connection ID and `externalId` to an active Better Auth User while fencing concurrent subject changes, deactivation, deletion, and connection decommissioning. + + Compose the helper with SSO `resolveUser` to link the provisioned User without matching by email or `userName`. + +- [#10390](https://github.com/better-auth/better-auth/pull/10390) [`0de88f5`](https://github.com/better-auth/better-auth/commit/0de88f5e61d96f460e02b8a526e58acb16455d15) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - SCIM connections can now provision Users, Groups, and direct memberships into application-defined provisioning domains without the organization or SSO plugins. Applications can map Group membership to validated custom roles through projections. The service also supports SCIM 2.0 discovery, filtering, pagination, response attribute selection, atomic PATCH operations, and common request patterns used by Microsoft Entra ID and Okta. + + This replaces the previous SCIM configuration, client APIs, database schema, and organization-backed Group model. Existing SCIM installations cannot migrate provisioning state in place. Follow the SCIM cutover in the 1.7 upgrade guide, including full directory reprovisioning, before resuming traffic. + + Deferred database side effects now run only after a successful transaction. A rolled-back User update no longer refreshes its cached profile, and a rolled-back bulk session revocation no longer invalidates sessions. + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/scim/package.json b/packages/scim/package.json index d7f72433c0..5a468510fe 100644 --- a/packages/scim/package.json +++ b/packages/scim/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/scim", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "SCIM plugin for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/sso/CHANGELOG.md b/packages/sso/CHANGELOG.md index 23a7196585..2bfe8ab3e7 100644 --- a/packages/sso/CHANGELOG.md +++ b/packages/sso/CHANGELOG.md @@ -1,5 +1,21 @@ # @better-auth/sso +## 1.7.0-rc.2 + +### Minor Changes + +- [#10403](https://github.com/better-auth/better-auth/pull/10403) [`dbd302e`](https://github.com/better-auth/better-auth/commit/dbd302e422c66620cde391f6a80ab90ee34182f9) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Scope account identity by trusted issuer instead of provider configuration. Accounts now use the unique `(issuer, providerAccountId)` key, so aliases for one OpenID Connect issuer deduplicate one external identity while equal subjects from different issuers remain separate. This identity deduplication does not introduce independent grant or provider lifecycle records for aliases. + + This release is breaking. `Account.accountId` is renamed to `Account.providerAccountId`, and `Account.issuer` is required. Account-specific APIs select the local `Account.id` through `accountId`; token and provider-profile APIs can instead select the signed account cookie with `useAccountCookie: true`. Credential accounts use `local:credential` and the linked user's stable `id` as their provider identity. + + OAuth provider identity now comes from raw verified profiles. OpenID Connect discovery uses `sub`, plain OAuth uses `id`, and providers can declare `accountSubject` for another immutable field; Better Auth no longer switches between `sub` and `id` at runtime. `getUserInfo().user` no longer carries provider identity, and `mapProfileToUser` cannot return `id`. Read the selected identity from `accountInfo.account.providerAccountId` instead of `accountInfo.user.id`. The generic `microsoftEntraId` helper now requires a concrete tenant GUID; use the built-in Microsoft provider for multi-tenant authorities. + + SSO account subjects are now protocol-defined. OIDC uses the verified `sub` claim, and SAML uses the signed `NameID`; `mapping.id` is removed from both configurations. A manual SAML configuration without metadata XML must set `idpMetadata.entityID`, because `samlConfig.issuer` identifies the service provider and no longer acts as the IdP identity. + + Apply the reviewed account-identity backfill in the Better Auth 1.7 upgrade guide before deploying. The generated schema migration cannot assign trusted issuers or resolve existing identity collisions automatically. + +- [#10473](https://github.com/better-auth/better-auth/pull/10473) [`ed61b47`](https://github.com/better-auth/better-auth/commit/ed61b4798e0ccedadc3b0c0e0a2d08b5d4b7ed5a) Thanks [@gustavovalverde](https://github.com/gustavovalverde)! - Add transactional OIDC user resolution so applications can link verified issuer and subject pairs to exact existing users while preserving or updating the local profile. + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/sso/package.json b/packages/sso/package.json index 959f33294a..4a0bc44ae6 100644 --- a/packages/sso/package.json +++ b/packages/sso/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/sso", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "SSO plugin for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/stripe/CHANGELOG.md b/packages/stripe/CHANGELOG.md index 706fdba91b..31b1f7fae8 100644 --- a/packages/stripe/CHANGELOG.md +++ b/packages/stripe/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/stripe +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/stripe/package.json b/packages/stripe/package.json index aff13c664b..14779618c8 100644 --- a/packages/stripe/package.json +++ b/packages/stripe/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/stripe", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Stripe plugin for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/telemetry/CHANGELOG.md b/packages/telemetry/CHANGELOG.md index 89dcd48634..f8ea46a4f0 100644 --- a/packages/telemetry/CHANGELOG.md +++ b/packages/telemetry/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/telemetry +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/telemetry/package.json b/packages/telemetry/package.json index 6a50de4617..ab486ac855 100644 --- a/packages/telemetry/package.json +++ b/packages/telemetry/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/telemetry", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Telemetry package for Better Auth", "type": "module", "license": "MIT", diff --git a/packages/test-utils/CHANGELOG.md b/packages/test-utils/CHANGELOG.md index 8fed8755e6..37b85d2ba2 100644 --- a/packages/test-utils/CHANGELOG.md +++ b/packages/test-utils/CHANGELOG.md @@ -1,5 +1,7 @@ # @better-auth/test-utils +## 1.7.0-rc.2 + ## 1.7.0-rc.1 ## 1.7.0-rc.0 diff --git a/packages/test-utils/package.json b/packages/test-utils/package.json index 2030b536ae..5786ec4a9a 100644 --- a/packages/test-utils/package.json +++ b/packages/test-utils/package.json @@ -1,6 +1,6 @@ { "name": "@better-auth/test-utils", - "version": "1.7.0-rc.1", + "version": "1.7.0-rc.2", "description": "Testing utilities for Better Auth adapter development", "type": "module", "license": "MIT",