Gustavo Valverde
be653ab90d
docs(two-factor): merge enforcement-scope clarification into OTP rewrite ( #9607 )
...
Layers main's #9607 clarification onto next's #9057 OTP-enablement rewrite.
The "Sign In with 2FA" section now states that 2FA sign-in enforcement
applies to the credential endpoints (/sign-in/email, /sign-in/username,
/sign-in/phone-number) and that passwordless flows are not gated by default,
with guidance to add custom hook handling to require it. The passwordless
callout and the allowPasswordless option note that the flag does not change
which sign-in methods are challenged. main's edit to the removed
skipVerificationOnEnable bullet is dropped, since next deleted that option.
(cherry picked from commit 6156cef51329e1c38544aa06eb5072d8a06ece7a)
2026-05-31 00:10:36 +01:00
Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
Gustavo Valverde and GitHub
e8696388bf
docs(oauth-provider): align metadata routing guidance ( #9768 )
2026-05-30 22:32:09 +01:00
23d7cbfa79
fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow ( #8758 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 19:48:38 +01:00
d3919dc1a5
feat(account): support server-side accountInfo calls without session headers ( #9813 )
...
Co-authored-by: Nathan Colosimo <nathancolosimo@gmail.com >
2026-05-30 12:45:40 +01:00
5f282bd382
fix(account): default storeStateStrategy to "database" when using secondaryStorage ( #9591 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 11:05:28 +01:00
Taesu and GitHub
e131d3ac5b
fix(api-key): verify non-default keys when configId is omitted ( #9794 )
2026-05-30 03:14:57 +00:00
Gustavo Valverde and GitHub
c5b9f93498
fix(generic-oauth): add accessTokenExpiresIn for providers that omit expires_in ( #9799 )
2026-05-29 20:49:59 +00:00
17cd433c66
fix(oauth-proxy): missing state-cookie skip for oauth-proxy ( #9385 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-29 15:06:34 +00:00
093115e162
docs(oauth): added Roblox provider and alphabetized "providers without email" table ( #9786 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-29 03:16:35 +00:00
ac96316af3
fix(oauth): forward specific callback error codes via shared redirectOnError ( #9788 )
...
Co-authored-by: Gautam Manchandani <manchandanigautam@gmail.com >
2026-05-28 21:42:16 +00:00
Gustavo Valverde and GitHub
e7eb45b065
feat(oauth): per-request additionalParams and loginHint ( #9305 )
2026-05-19 17:18:43 +00:00
Maxwell and GitHub
adc8d7f1af
docs: microsoft base64 profile image warning ( #9692 )
2026-05-19 16:41:44 +00:00
03e6c94e96
feat(generic-oauth,sso): support IDP-initiated flows via secure bounce ( #9301 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-05-19 12:29:04 +00:00
602ec40293
feat(sso)!: support multiple IdP signing certificates ( #8805 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-18 03:07:37 +00:00
aebf66d8e6
feat: add token endpoint client authentication ( #9625 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-16 18:27:15 +00:00
db4263cd3d
chore: use correct auth cli ( #9638 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-16 02:27:55 +00:00
Gautam Manchandani and GitHub
95765cfedd
docs: clarify 2fa sign-in enforcement scope ( #9607 )
2026-05-14 08:45:10 +00:00
Gautam Manchandani and GitHub
29599d32b5
docs: document account storeStateStrategy ( #9557 )
2026-05-12 13:16:23 +00:00
Gustavo Valverde and GitHub
5f09d566a6
fix(magic-link): consume verification token atomically on verify ( #9572 )
2026-05-12 12:50:38 +00:00
Gustavo Valverde and GitHub
99a254a79b
fix(device-authorization): bind approval to verifier session ( #9573 )
2026-05-12 11:40:18 +00:00
Gautam Manchandani and GitHub
15bb1690b2
feat(cli): add create-admin command ( #9547 )
2026-05-12 10:30:04 +00:00
86765f1597
fix(sso): require org admin role to register SSO providers ( #9220 )
...
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-11 17:04:01 +00:00
Jonathan Samines and GitHub
eae63a9aff
docs: add docs for infra timeout options ( #9559 )
2026-05-11 08:59:03 -06:00
Gustavo Valverde and GitHub
e21d744987
fix(rate-limit): widen ipv6Subnet type and correct default in docs ( #9545 )
2026-05-11 07:04:16 +00:00
Taesu
2b83087180
chore: sync main to next
2026-05-10 03:45:29 +09:00
fde043207e
fix: improve link accessibility issues ( #9521 )
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-05-09 11:31:27 +00:00
Muzzaiyyan Hussain and GitHub
b96bbfe9b7
docs: improve adapter link accessibility ( #9517 )
2026-05-09 11:01:17 +00:00
Muzzaiyyan Hussain and GitHub
ea5bcfaa95
docs: improve accessibility of documentation links ( #9518 )
2026-05-09 11:00:42 +00:00
Jonathan Samines and GitHub
2f9454b625
docs: add docs for infra getAllAuditLogs() ( #9478 )
2026-05-06 19:47:38 -06:00
729c00d74c
feat(username): add immutable username option ( #9240 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 20:58:46 +00:00
30a1fb9c05
feat(i18n): add built-in translations for 22 languages ( #9157 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
2026-05-06 11:51:17 +00:00
Gautam Manchandani and GitHub
4b34df8bdc
docs: fix organization invite callout list ( #9442 )
2026-05-03 19:00:15 +00:00
Taesu and GitHub
eb6061acb1
docs(stripe): document user deletion with active subscriptions recipe ( #9404 )
2026-04-30 22:44:30 +00:00
c8ec03d26e
docs: add MikroORM better-auth adapter to community adapters ( #9379 )
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-04-28 22:56:02 +00:00
Taesu and GitHub
5d24a7478b
fix(stripe): expose stripeSubscription in onSubscriptionUpdate and fix stale snapshot ( #9354 )
2026-04-26 09:41:11 +00:00
b67783d364
docs(hooks): add example for handling multiple endpoints in a single hook ( #8792 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-25 00:26:20 +00:00
89af592e93
docs: add revokeSessionsOnPasswordReset to password reset section ( #8551 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-25 00:19:51 +00:00
c1336c563d
fix(organization): scope setActiveTeam to active organization ( #9239 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-24 23:48:16 +00:00
7fbe9282ba
docs: update import path for drizzleAdapter ( #9218 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-24 23:22:13 +00:00
Taesu and GitHub
ae3374c6d5
docs: clean up DatabaseTable component ( #9342 )
2026-04-24 06:37:38 +00:00
Gustavo Valverde and GitHub
9aa8e63de8
fix(oauth): support mapProfileToUser fallback for providers that may omit email ( #9331 )
2026-04-23 10:15:36 +00:00
Gustavo Valverde and GitHub
8e3cc3453c
fix(oauth-provider): accept authorization flows without state ( #9328 )
2026-04-23 07:00:05 +00:00
Taesu and GitHub
4e8e4c7fc5
feat(client): add hydrateSession for SSR session hydration ( #8733 )
2026-04-22 21:09:45 +00:00
Gustavo Valverde
eb3cd10d50
chore: resolve main-to-next sync conflicts
...
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
2026-04-22 14:54:27 +01:00
Gustavo Valverde and GitHub
4f373eed8a
feat(social-providers): accept array of Client IDs for ID token audience ( #9292 )
2026-04-22 09:02:56 +00:00
9ab0346dae
docs: add subsection for advanced database configuration options ( #9149 )
...
Co-authored-by: Morgan PEYRE <morgan.peyre@brickcode.tech >
2026-04-22 05:29:41 +00:00
26d0cec9bd
docs: improve Nuxt integration guide ( #9232 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-21 15:30:22 +00:00
954b664f4f
feat(org): allow passing userId and organizationId to listUserTeams API ( #8977 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-21 08:15:16 +00:00
Taesu and GitHub
2ee50c581f
docs: add stable/beta versioning with build-time content sync ( #9258 )
2026-04-21 03:49:33 +00:00
Gustavo Valverde
Jonathan SaminesandGitHub
Muzzaiyyan HussainandGitHub
