Gustavo Valverde
2ef5a353be
fix(oauth-provider)!: make client authentication grant-bound and single-authority
...
The OAuth Provider extension surface let a grant handler drift from what it issued in two ways. The client-registration check honored a request-supplied grant type while issuance used the provider-bound grant, so a handler could authenticate a client for a permissive grant and mint under a stricter one. And a client-authentication strategy returned the client record the provider then authorized against, so a strategy could supply a client's grants, scopes, or enabled state.
The provider-bound grant is now the sole authority for the registration check, and grantType is removed from OAuthClientAuthenticationRequest. A strategy proves only the client id it authenticated (plus an optional confirmation); the provider resolves and authorizes the client record itself via getClient. The strategy result type is now OAuthClientAuthenticationResult.
2026-06-14 20:23:47 -07:00
Gustavo Valverde and GitHub
aedcb974f0
feat(oauth-provider): add DPoP support ( #10039 )
2026-06-14 18:28:21 -07:00
Gustavo Valverde and GitHub
0143d69195
feat(oauth-provider): support protected dynamic client registration ( #10037 )
2026-06-14 15:00:17 -07:00
Gustavo Valverde and GitHub
050ef2dfcf
feat(oauth-provider): add extension surface ( #10030 )
2026-06-14 11:37:28 -07:00
Gustavo Valverde and GitHub
2fd3d58500
feat(oauth-provider): consistent and audience-scoped token introspection ( #10045 )
2026-06-13 12:58:25 -07:00
Taesu and GitHub
ad35eadd13
fix(one-tap)!: require client id for audience validation ( #10036 )
2026-06-13 01:05:01 +00:00
Gustavo Valverde
9dcc0318da
chore: sync main to next
2026-06-12 17:34:58 -07:00
b4b02660c7
feat(device-authorization): allow pre-binding device codes to a user ( #9995 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-06-12 22:57:37 +00:00
c1a8a64c14
fix(open-api): generate valid OpenAPI schemas for client generators ( #9555 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-06-12 22:24:56 +00:00
Gustavo Valverde and GitHub
6fe9faab65
refactor!: remove deprecated oidc-provider plugin ( #10031 )
2026-06-12 21:45:19 +00:00
Gustavo Valverde
c40989def2
fix: address sync review comments
2026-06-12 10:40:36 -07:00
Gustavo Valverde
6f5c707459
chore: sync main to next
2026-06-12 10:25:24 -07:00
d2a79bae79
feat(oauth-provider)!: model OAuth protected resources explicitly ( #9648 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 10:08:43 -07:00
48070ada8b
feat(sso): support additionalFields on ssoProvider ( #9445 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 10:00:55 -07:00
729fd84034
fix(oauth-provider): canonicalize signed OAuth query params ( #9941 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 15:17:00 +00:00
34558bc52b
feat(session): support JWKS-backed JWT session cookie cache ( #8931 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 15:03:33 +00:00
Taesu and GitHub
def1624a13
docs(changelog): avoid false contributor avatars ( #10019 )
2026-06-12 01:18:52 -07:00
Gustavo Valverde and GitHub
e53582ce55
feat(mcp)!: ship MCP as its own package built on the OAuth provider ( #9992 )
2026-06-11 21:34:38 -07:00
Gustavo Valverde
5ce8d4cb55
chore: keep beta Apple docs component available
2026-06-11 20:03:44 -07:00
Gustavo Valverde
d2949a8700
Merge remote-tracking branch 'origin/main' into chore/sync-main-to-next-20260611
2026-06-11 18:45:33 -07:00
Gustavo Valverde
7a55ae4f52
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-20260611
...
# Conflicts:
# .changeset/accept-invitation-team-capacity.md
# .changeset/adapters-native-increment-one.md
# .changeset/api-key-atomic-quota.md
# .changeset/delete-account-token-single-use.md
# .changeset/device-code-single-use.md
# .changeset/electron-code-single-use.md
# .changeset/email-otp-attempts-atomic.md
# .changeset/increment-one-primitive.md
# .changeset/memory-adapter-transaction-isolation.md
# .changeset/one-time-token-single-use.md
# .changeset/passkey-ceremony-binding.md
# .changeset/password-reset-token-single-use.md
# .changeset/phone-otp-attempts-atomic.md
# .changeset/rate-limit-atomic-consume.md
# .changeset/redis-increment.md
# .changeset/reserve-verification-value.md
# .changeset/saml-replay-reserve.md
# .changeset/siwe-nonce-single-use.md
# .changeset/two-factor-challenge-single-use.md
# .changeset/twofactor-otp-attempts-atomic.md
# packages/api-key/src/adapter.ts
# packages/api-key/src/api-key.test.ts
# packages/better-auth/src/api/rate-limiter/index.ts
# packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts
# packages/better-auth/src/db/internal-adapter.ts
# packages/better-auth/src/plugins/device-authorization/routes.ts
# packages/better-auth/src/plugins/organization/adapter.ts
# packages/better-auth/src/plugins/organization/routes/crud-invites.ts
# packages/better-auth/src/plugins/organization/routes/crud-members.ts
# packages/better-auth/src/plugins/organization/routes/crud-team.ts
# packages/better-auth/src/plugins/organization/team.test.ts
# packages/better-auth/src/plugins/phone-number/routes.ts
# packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
# packages/core/src/db/adapter/factory.ts
# packages/core/src/db/adapter/index.ts
# packages/core/src/db/type.ts
# packages/core/src/types/context.ts
# packages/core/src/types/init-options.ts
# packages/drizzle-adapter/src/drizzle-adapter.test.ts
# packages/drizzle-adapter/src/drizzle-adapter.ts
# packages/electron/test/electron.test.ts
# packages/kysely-adapter/src/kysely-adapter.ts
# packages/memory-adapter/src/memory-adapter.ts
# packages/mongo-adapter/src/mongodb-adapter.test.ts
# packages/mongo-adapter/src/mongodb-adapter.ts
# packages/passkey/src/routes.ts
# packages/prisma-adapter/src/prisma-adapter.ts
# packages/redis-storage/src/redis-storage.ts
# packages/redis-storage/test/redis-storage.test.ts
# packages/sso/src/saml.test.ts
2026-06-11 18:45:17 -07:00
Gustavo Valverde
381fc6cfaf
chore: sync main to next
2026-06-11 18:18:13 -07:00
ZerGo0 and GitHub
029cbdc072
docs: update Apple client secret JWT guidance ( #9938 )
2026-06-11 17:54:44 -07:00
Gustavo Valverde and GitHub
86ccb5de91
feat(auth)!: harden atomic state transitions ( #10000 )
2026-06-12 00:46:44 +00:00
Jordan Kahtava and GitHub
44a24ed948
docs: highlighted emailVerified requirement on manually inserted users ( #9999 )
2026-06-11 17:45:37 -07:00
Gautam Manchandani and GitHub
bf39cbf13f
feat(phone-number): add server-side OTP consumption API ( #9766 )
2026-06-11 16:58:16 -07:00
Taesu and GitHub
b36c38f984
feat(captcha)!: support wildcard endpoint matching ( #10004 )
2026-06-11 23:47:25 +00:00
Damien Maspero and GitHub
e468ff37ce
docs: update Node.js built-in SQLite status to Release Candidate ( #9914 )
2026-06-10 23:13:39 -07:00
Taesu and GitHub
3e99e6c77e
fix(admin): create credential account in setUserPassword when missing ( #9482 )
2026-06-11 05:36:55 +00:00
6987c628f1
fix(cli): resolve SvelteKit, Vite asset, and Cloudflare virtual-module imports ( #9834 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-11 01:06:43 +00:00
Gustavo Valverde
d7bba8ee33
Merge origin/next into chore/sync-main-to-next
2026-06-10 11:34:38 -07:00
Gustavo Valverde
bf7f2c5b4e
chore: sync main to next
2026-06-10 11:30:38 -07:00
Eric Luce and GitHub
82dbc9b8bf
docs: add ProofKit FileMaker adapter ( #9980 )
2026-06-10 11:26:02 -07:00
Prakash Kumar and GitHub
128bc34572
docs: add horizontal scrolling to landing page code block ( #9975 )
2026-06-09 23:22:24 -07:00
Bereket Engida and GitHub
cb1cbfa4cc
fix: address bug findings across packages ( #9974 )
2026-06-09 19:46:12 -07:00
Gustavo Valverde and GitHub
87e7aa5e0f
fix(api): validate Origin/Referer on cookieless email sign-in and sign-up ( #9973 )
2026-06-10 01:43:41 +00:00
Gustavo Valverde and GitHub
76a33429fc
fix(session): fire session-delete hooks for preserved sessions on secondaryStorage ( #9969 )
2026-06-10 00:40:56 +00:00
Gustavo Valverde and GitHub
3e852a2650
fix(oauth-provider): report unsupported_token_type for JWT access-token revocation ( #9970 )
2026-06-10 00:39:26 +00:00
Gustavo Valverde and GitHub
7abaaed53f
fix(oauth-provider): make private_key_jwt jti single-use atomic across processes ( #9964 )
2026-06-10 00:36:06 +00:00
Gustavo Valverde and GitHub
ec8a38c08f
feat(generic-oauth): verify discovery id_tokens and enable id_token sign-in ( #9966 )
2026-06-10 00:34:26 +00:00
Paola Estefanía de Campos and GitHub
afcb4dd7f3
docs(two-factor): document newSession is null during 2FA challenge ( #9957 )
2026-06-09 13:15:00 -07:00
Taesu and GitHub
6a8dfa4f3e
docs(changelog): show contributor avatars with proper size and styling ( #9956 )
2026-06-09 19:44:32 +00:00
Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
0cbaf81bed
feat(oauth): server-trusted state channel; fix anonymous cookieless linking ( #9930 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-08 01:00:05 +00:00
91f235f860
feat(auth): add per-provider requireEmailVerification for social sign-in ( #9929 )
...
Co-authored-by: Gautam Manchandani <161146829+GautamBytes@users.noreply.github.com >
2026-06-08 00:31:20 +00:00
e0140297a5
fix(electron)!: enforce S256 PKCE and harden origin checks ( #9645 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 23:43:06 +00:00
d23735b1de
feat(passkey): resolve authenticator name from AAGUID at read time ( #9927 )
...
Co-authored-by: Maxwell Weru <1645026+mburumaxwell@users.noreply.github.com >
2026-06-07 23:22:39 +00:00
ea64709ae6
docs: security update for June 2026 ( #9884 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-07 14:41:58 -07:00
41cca606d1
feat(auth): add user.validateUserInfo provisioning gate ( #9864 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 14:34:48 -07:00
Gustavo Valverde and GitHub
b32094a46d
docs(oauth-provider): reframe back-channel logout changeset and fill doc gaps ( #9916 )
2026-06-06 07:39:23 -07:00
Gustavo Valverde
TaesuandGitHub
ZerGo0andGitHub
Jordan KahtavaandGitHub
Damien MasperoandGitHub
Eric LuceandGitHub
Prakash KumarandGitHub
Bereket EngidaandGitHub
Paola Estefanía de CamposandGitHub
