next's #9069 rewrote generic-oauth to flow through the core social provider
and callback. The #9799 accessTokenExpiresIn source fix merged in cleanly
(its config field and the applyDefaultAccessTokenExpiry wiring land on the
three token paths); main's regression tests still targeted the old
signIn.oauth2 plugin API. This ports them onto signIn.social so they keep
guarding the behavior:
- #9799: getAccessToken refreshes once the accessTokenExpiresIn window passes
when the provider omits expires_in, does not refresh when it is unset, and
applies it to a custom getToken result.
- #9792: the verify-email link preserves the encoded callbackURL.
- #9702: a session hook throwing an APIError redirects to the cross-origin
errorCallbackURL with the hook's code (proves the rewritten callback's
hook-error forwarding).
- #9578: implicit-link tests mark the local user verified so linking is
allowed under the default-on requireLocalEmailVerified gate.
A stale IDP-bounce assertion is updated to next's state-error vocabulary.
All 71 tests pass.
(cherry picked from commit 52adab0db3f463295a0c4e3152d770f4ce40b2d2)
Layers main's #9607 clarification onto next's #9057 OTP-enablement rewrite.
The "Sign In with 2FA" section now states that 2FA sign-in enforcement
applies to the credential endpoints (/sign-in/email, /sign-in/username,
/sign-in/phone-number) and that passwordless flows are not gated by default,
with guidance to add custom hook handling to require it. The passwordless
callout and the allowPasswordless option note that the flag does not change
which sign-in methods are challenged. main's edit to the removed
skipVerificationOnEnable bullet is dropped, since next deleted that option.
(cherry picked from commit 6156cef51329e1c38544aa06eb5072d8a06ece7a)
Re-applies two main fixes onto next's refactored metadata layer.
- #9448: registration_endpoint is now advertised only when dynamic client
registration is enabled. With DCR off, the field was still advertised in
authorization-server and OpenID metadata while the endpoint itself was
disabled, so clients attempted a registration that failed.
- #9668: the authorization-server and OpenID discovery documents are served
again at their path-prefixed (RFC 8414 path-insertion and issuer-appended)
aliases via an onRequest handler, with HEAD support and a 405 for
non-GET/HEAD. next's refactor kept the server-only metadata endpoints but
dropped the request handler that exposes them over HTTP. The handler is
adapted to next's metadata (CIMD-aware public-client flag and merged
discovery metadata) and metadataResponse is exported for it.
#9601 (preserve colons in Basic Auth secret) is already covered: next routes
Basic parsing through @better-auth/core decodeBasicCredentials, which splits
on the first colon, so no change to utils/index.ts.
The merged metadata test suite (union of next and main, including the
DCR-conditional and alias cases) passes.
(cherry picked from commit 66a7b0b62d76e36474ebdca189f59200daa3ec76)
Re-applies three main fixes onto next's rewritten OAuth callback, which
now routes generic-oauth through the shared callback route.
- #9702/#9788: a before-callback hook that rejects sign-in (the banned-user
guard is the flagship case) now redirects to the per-flow errorURL
carrying the hook's machine-readable code and message, instead of
surfacing a raw error response. handleOAuthUserInfo is wrapped in
try/catch; the hook's APIError code is forwarded verbatim (it is
app-defined, not a member of OAUTH_CALLBACK_ERROR_CODES) via next's
local redirectOnError closure. The admin plugin's stale inline /callback
redirect is removed so the banned-user path flows through that single
forwarder and emits BANNED_USER with a URL-encoded description.
- #8758: accountLinking.updateUserInfoOnLink now applies on the explicit
OAuth link path, not only id-token linking.
The regression tests (banned social sign-in emits error=BANNED_USER, the
cross-origin errorCallbackURL case, and the 403-JSON id-token case) arrived
via the merge and were red on the baseline; these source changes make them
pass.
(cherry picked from commit 1d893ae572277447025e29462946a7aeb11443ac)
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577.
Gustavo Valverde
better-release[bot]andGitHub
Jonathan SaminesandGitHub
