Gustavo Valverde
2b04ffb809
fix(oauth-provider): never hold discovered clients for approval
...
A client ID metadata document identifies client software that every
user and organization running it shares. Approving such a client made
the first organization to consent its owner, which let that
organization's members change its redirect URIs or delete it for
everyone. Only open dynamic registration now creates pending clients.
A metadata refresh still keeps a scope ceiling or a disable committed
while it runs.
2026-10-15 16:04:53 +01:00
Gustavo Valverde
ec6284f30d
feat(oauth-provider): approve self-registered clients at consent
...
Add approvePendingClient. With it defined, a client created by open
dynamic registration or discovered through CIMD stays pending until a
user consents. A pending client cannot authenticate at the token,
introspection, revocation, or device authorization endpoints, and the
authorization endpoint always sends its users to consent. A pending
client must register authorization_code, since consent is the only way
to approve it. Registrations by a signed-in user or with an initial
access token are not pending.
When the user accepts, the callback names the owner (clientReference).
The update is conditional on the client still being pending and
ownerless and runs in the same transaction as the consent, so concurrent
approvals produce one winner and an owned client is never reassigned.
Returning false redirects to the client with access_denied, like a
denied consent.
Approval grants no machine access. Open registration may request
client_credentials, but the scope limit is still assigned only through
adminUpdateOAuthClient, which clientPrivileges gates.
A CIMD refresh no longer writes the scope limit, disabled, skipConsent,
or enableEndSession from its pre-fetch snapshot, so a change committed
during the fetch is kept.
Without the option, behavior is unchanged. Adds a nullable pending
column to oauthClient.
2026-10-15 15:52:59 +01:00
Gustavo Valverde and GitHub
296133cc41
fix(oauth-provider): check DPoP before a polled grant consumes its request ( #11826 )
2026-10-15 15:09:47 +01:00
Gustavo Valverde and GitHub
c7c8331400
feat(oauth-provider): add RFC 8693 token exchange ( #11763 )
2026-10-15 15:07:26 +01:00
Gustavo Valverde and GitHub
0be0e23762
feat(ciba): complete requests from server code ( #11812 )
2026-10-15 13:46:02 +00:00
Gustavo Valverde and GitHub
25f7617db6
feat(ciba): add backchannel authentication plugin ( #11785 )
2026-10-15 13:46:01 +00:00
Gustavo Valverde
62a267ad18
Merge remote-tracking branch 'origin/main' into sync-work
2026-10-15 14:24:06 +01:00
eebd47a0e7
fix(last-login-method): record Google One Tap sign-ins ( #11393 )
...
Co-authored-by: arjunpkulkarni <arjunpkulkarni@gmail.com >
Co-authored-by: breken-ai <312387581+breken-ai@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-15 14:15:38 +01:00
eaecb7229e
fix(one-tap): apply the Google provider's mapProfileToUser and getUserInfo ( #11819 )
...
Co-authored-by: kaiizer777 <kanekigaming786@gmail.com >
2026-10-15 13:02:59 +00:00
09d07e6fea
fix(one-tap): stop calling prompt moment methods unsupported under FedCM ( #11821 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-10-15 12:58:29 +00:00
Gustavo Valverde
609e141202
Merge remote-tracking branch 'origin/main' into sync-work
...
# Conflicts:
# docs/content/docs/plugins/oauth-provider.mdx
# packages/oauth-provider/src/device-code.ts
# packages/oauth-provider/src/introspect.ts
# packages/oauth-provider/src/register.ts
# packages/oauth-provider/src/revoke.ts
# packages/oauth-provider/src/token.ts
2026-10-15 13:21:22 +01:00
8f3da46ae5
fix(oauth-provider): return invalid_client for an unknown client at the token endpoint ( #11176 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-15 13:02:05 +01:00
906c32f4b5
fix(oauth-provider): keep the supported grants from a dynamic registration ( #11797 )
...
Co-authored-by: Bereket Engida <Bekacru@gmail.com >
2026-10-15 12:02:00 +01:00
Gustavo Valverde
81b082a519
Merge remote-tracking branch 'origin/main' into chore/sync-main-to-next-11784-20261015
...
# Conflicts:
# docs/content/docs/plugins/oauth-provider.mdx
# packages/oauth-provider/src/authorize.ts
# packages/oauth-provider/src/oauthClient/endpoints.ts
# packages/oauth-provider/src/register.ts
# packages/oauth-provider/src/token.test.ts
2026-10-15 11:56:08 +01:00
99cdfe7c2e
fix(oauth-provider): keep consent separate per reference ( #11801 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-10-15 11:11:01 +01:00
Gustavo Valverde and GitHub
2fa7e2f8bb
fix(oauth-provider): infer native for http loopback redirect URIs ( #11798 )
2026-10-15 09:11:34 +00:00
Gustavo Valverde and GitHub
9f532221be
fix(oauth-provider)!: follow RFC 7009 and RFC 7662 token lookup in revoke and introspect ( #11796 )
2026-10-15 10:07:05 +01:00
Gustavo Valverde and GitHub
cdd491b9d0
fix(oauth-provider): build DPoP htu from the request path ( #11786 )
2026-10-15 08:35:46 +00:00
Gustavo Valverde and GitHub
fe550a9c57
feat(oauth-provider): let private_key_jwt clients rotate their own keys ( #11695 )
2026-10-15 08:08:25 +00:00
Gustavo Valverde and GitHub
6e5a88e57b
fix(oauth-provider)!: store pairwise sectors and isolate native clients ( #11650 )
2026-10-15 07:57:45 +00:00
Gustavo Valverde and GitHub
cd404a0b46
feat(oauth-provider): carry acr and amr through the device code grant ( #11788 )
2026-10-15 07:15:20 +00:00
Gustavo Valverde and GitHub
ed71a211e8
feat(oauth-provider): assert acr and amr through authenticationContext ( #11787 )
2026-10-15 07:15:19 +00:00
Gustavo Valverde and GitHub
034da07dbe
feat(oauth-provider)!: approve device codes through the consent flow ( #11610 )
2026-10-15 06:51:01 +01:00
Gustavo Valverde and GitHub
ec0afdef5a
fix(device-authorization)!: record one decision per device code ( #11772 )
2026-10-15 05:35:45 +00:00
Gustavo Valverde
ba634fdab6
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-11762-20261015
...
# Conflicts:
# packages/oauth-provider/src/authorize.ts
2026-10-15 05:08:49 +01:00
Gustavo Valverde and GitHub
2417879cf6
feat(oauth-provider): let extensions validate their client registration metadata ( #11767 )
2026-10-15 04:58:52 +01:00
Gustavo Valverde
6669efe5b4
chore: sync main to next
2026-10-15 04:54:22 +01:00
Taesu and GitHub
c03ced528a
chore: bump @biomejs/biome ( #11760 )
2026-10-14 21:01:10 +00:00
5fd850f926
fix(auth)!: send sign-up emails and cache OAuth sessions after the commit ( #11751 )
...
Co-authored-by: Bilal Atique <bilalbinatique@gmail.com >
2026-10-14 19:57:48 +00:00
0a1a87e388
fix(oauth-provider): distinguish post-login continuation from initial selection ( #11185 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 18:32:15 +00:00
Gustavo Valverde and GitHub
0d4609f4a9
fix(oauth-provider)!: reject repeated OAuth request parameters ( #11746 )
2026-10-14 18:30:10 +00:00
54a09948e8
fix(oauth-provider): validate DPoP against public URL ( #10799 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 18:27:25 +00:00
c750fc5ad2
feat(oauth-provider): add OIDC front-channel logout ( #9923 )
...
Co-authored-by: shiminshen <16914659+shiminshen@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 18:54:59 +01:00
Gustavo Valverde and GitHub
1c8b98e8d1
Merge pull request #11631 from better-auth/main
...
chore: sync main to next
2026-10-14 18:52:57 +01:00
e78f15aa31
fix(core): allow 30s of clock skew when verifying ID tokens ( #11749 )
...
Co-authored-by: Lohith <ssvlohith@gmail.com >
2026-10-14 17:06:19 +01:00
e9d9921217
fix(generic-oauth): retry discovery for providers skipped at startup ( #11750 )
...
Co-authored-by: mangomac <mangomac@users.noreply.github.com >
2026-10-14 16:53:53 +01:00
916ef5c530
fix(mongo-adapter): retry a transaction aborted with a transient error ( #11515 )
...
Co-authored-by: Maxwell Afamefuna Nzekwe <70326615+maxnze1@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 16:30:50 +01:00
aaf0d7da3e
fix(oauth-provider): keep auth working when startup resource seeding fails ( #11726 )
...
Co-authored-by: Panagiotis Plytas <34184381+pplytas@users.noreply.github.com >
Co-authored-by: Arjun Vijay Prakash <137415649+ArjunCodess@users.noreply.github.com >
Co-authored-by: Tushar <192458782+Tushar-Khandelwal-2004@users.noreply.github.com >
Co-authored-by: zoom-dustin-moriarty <221604897+zoom-dustin-moriarty@users.noreply.github.com >
2026-10-14 12:33:21 +01:00
f0ce580fbd
fix(phone-number): use custom verifyOTP when resetting the password ( #10698 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 11:37:54 +01:00
c3f11cc1a1
docs(sso): clarify SAML callbackUrl vs ACS endpoint in 1.7 ( #11703 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:18:24 +01:00
182e92bd8a
fix(sso): allow rotating SAML IdP signing certificate with linked accounts ( #11687 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:16:38 +01:00
a878f9ab47
fix(sso): support array of emails in OIDC claim resolution ( #11640 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:16:10 +01:00
0cfe07dccd
fix(drizzle-adapter): support dates in string columns ( #11731 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-10-14 08:50:41 +01:00
1d95ebf3fe
fix(session): fall back to database for bulk session lookups ( #11718 )
...
Co-authored-by: choksi2212 <choksi2212@users.noreply.github.com >
2026-10-13 03:15:11 +00:00
Remco and GitHub
a2a74e1524
docs: open header dropdowns on activation instead of focus ( #11678 )
2026-10-13 08:39:01 +09:00
Menachem Hornbacher and GitHub
6700372896
docs: update JWT docs to list all fields ( #11339 )
2026-10-13 08:28:39 +09:00
Deepanshu Pal and GitHub
7393f6350e
docs: fix Electron and Polar example syntax ( #11587 )
2026-10-13 08:25:54 +09:00
23ee48ad9a
docs: add good-webhooks to community plugins ( #11697 )
...
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-13 08:16:17 +09:00
Gustavo Valverde and GitHub
fe2559b7a0
docs(oauth-provider): show client-aware access token claims ( #11656 )
2026-10-11 18:29:53 +00:00
Gustavo Valverde and GitHub
847acd02bb
feat(oauth-provider): pass client ID to privilege checks ( #11658 )
2026-10-11 18:29:52 +00:00
Gustavo Valverde
TaesuandGitHub
RemcoandGitHub
Menachem HornbacherandGitHub
Deepanshu PalandGitHub
