Gustavo Valverde
472a5f22ff
refactor(oauth-provider): refuse unrotatable clients before verifying the assertion
...
verifyClientAssertion takes an `assertClient` precondition that runs on the looked-up client before any key is fetched or the jti is consumed. Key rotation uses it, so a jwks_uri or trusted client is refused without a JWKS fetch, a signature check, or spending the assertion.
2026-10-12 14:18:42 +01:00
Gustavo Valverde
fe62de2b3b
fix(oauth-provider): refuse trusted-client changes with 400, not 500
...
Updating, deleting, or rotating the secret of a client configured in code through `cachedTrustedClients` is a deliberate refusal, but the three management endpoints reported it as a 500 server failure. They now share one guard with client key rotation and return 400 `invalid_client`.
2026-10-12 14:17:21 +01:00
Gustavo Valverde
3390792bbe
feat(oauth-provider): let private_key_jwt clients rotate their own keys
...
A confidential client with inline `jwks` can now replace its keys at
`POST /oauth2/client/rotate-keys` without a user session. The request
carries the complete new JWK Set and a client assertion signed by a
current key, addressed to the rotation endpoint itself, so an assertion
minted for the token endpoint or the issuer cannot be redirected here.
Enabled with `allowClientKeyRotation`.
Keys left out of the new set stop verifying at once. A client rolls a
key in two steps, the way a jwks_uri client does: it sends the old and
new keys together, then drops the old key once every instance signs with
the new one. Only current keys can authorize a rotation, matching
RFC 7592, node-oidc-provider, Ory Hydra, and Keycloak, where only the
current management credential can change a client.
The write is guarded on the exact key set the assertion was verified
against, so a concurrent rotation fails with 409 instead of overwriting.
No schema change is needed.
2026-10-12 14:15:06 +01:00
Gustavo Valverde and GitHub
fe2559b7a0
docs(oauth-provider): show client-aware access token claims ( #11656 )
2026-10-11 18:29:53 +00:00
Gustavo Valverde and GitHub
847acd02bb
feat(oauth-provider): pass client ID to privilege checks ( #11658 )
2026-10-11 18:29:52 +00:00
Gustavo Valverde and GitHub
38f3bb34af
feat(oauth-provider): link resources during managed client registration ( #11655 )
2026-10-11 18:29:51 +00:00
Gustavo Valverde and GitHub
1a9be41d18
feat(oauth-provider): allow client disable through admin update ( #11654 )
2026-10-10 14:52:35 +01:00
Gustavo Valverde and GitHub
8409fb250d
fix(scim): return 409 when concurrent updates claim the same unique key ( #11669 )
2026-10-10 11:38:31 +00:00
Talat Mahmud and GitHub
ef5c12c696
docs: add @octopi-ai/better-enrollment to community plugins ( #11653 )
2026-10-10 17:06:56 +09:00
9904b29ece
fix(kysely-adapter): allow concurrent queries on the D1 dialect ( #11490 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-10 07:59:43 +00:00
e15625ff38
fix(better-auth): allow SvelteKit 3 as a peer dependency ( #11488 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-09 16:33:41 +00:00
Taesu and GitHub
53307a7c60
docs(integrations): add Effect integration guide ( #11566 )
2026-10-09 09:41:45 +00:00
62146108c7
fix(oauth-provider): accept host-bearing custom-scheme native redirects ( #10956 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-09 08:59:37 +01:00
07a09389ef
fix(password): consume the reset token inside the reset transaction ( #11646 )
...
Co-authored-by: edenbuilds <279970382+edenbuilds@users.noreply.github.com >
Co-authored-by: omkar1work <omkar1work@gmail.com >
2026-10-09 06:44:53 +00:00
Gustavo Valverde and GitHub
67743ed6e8
fix(password): revoke sessions and write the new password atomically ( #11626 )
2026-10-09 06:44:52 +00:00
Gustavo Valverde and GitHub
92dfceaa14
fix(session): defer secondary-storage writes only when the database holds the session ( #11643 )
2026-10-09 06:44:52 +00:00
Gustavo Valverde and GitHub
a9f455d586
fix(core): run after-commit hooks when the transaction fallback rolls nothing back ( #11645 )
2026-10-09 06:44:51 +00:00
Gustavo Valverde and GitHub
f556970135
fix(scim): match attribute names case-insensitively ( #11644 )
2026-10-08 19:25:50 +01:00
39f09800b7
fix(scim): treat JSON null as unassigned in SCIM requests ( #11638 )
...
Co-authored-by: Jonathan Samines <jn.samines@gmail.com >
Co-authored-by: sufiyan733 <kanekigaming786@gmail.com >
2026-10-08 18:33:14 +01:00
666e1def97
chore(scim): ensure inactive SCIM user resources can be reactivated ( #11167 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-08 16:59:55 +00:00
61f64f46ad
fix(sso): reject mismatched OIDC issuers ( #11438 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-08 16:25:31 +00:00
Taesu and GitHub
b1cfc1ec1e
fix(db): omit non-returned fields from output schema types ( #11565 )
2026-10-08 15:58:31 +00:00
Drew and GitHub
435645e5eb
fix(core): name Atlassian in user info error log ( #11592 )
2026-10-09 00:09:41 +09:00
369176e7f6
fix(db): keep derived replay-marker ids under uuid and serial ids ( #11625 )
...
Co-authored-by: Chandan P <95340276+NoiceHax@users.noreply.github.com >
Co-authored-by: onmax <22072217+onmax@users.noreply.github.com >
2026-10-08 14:31:59 +00:00
Gustavo Valverde and GitHub
2627237fae
fix(organization): published types fail with skipLibCheck: false ( #11637 )
2026-10-08 14:30:44 +00:00
Gustavo Valverde and GitHub
a5d582aaff
fix(mcp): keep McpOptions assignable to OAuthOptions under exactOptionalPropertyTypes ( #11635 )
2026-10-08 15:21:14 +01:00
c68b2cd8a5
fix(oauth-provider): resolve exactOptionalPropertyTypes incompatibility ( #10266 )
...
Co-authored-by: shiminshen <16914659+shiminshen@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-08 12:20:42 +00:00
Taesu and GitHub
0e1a9c8413
refactor(db): remove unnecessary any from toZodSchema ( #11552 )
2026-10-03 12:02:27 +09:00
193efff3d2
fix(custom-session): forward session cookie cleanup when session is null ( #10591 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-03 02:33:45 +00:00
3d1f008ae3
fix(db): use static zod lookup in toZodSchema so locales tree-shake ( #10866 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-03 02:33:10 +00:00
352d04c8eb
fix(custom-session): propagate session lookup errors ( #11391 )
...
Co-authored-by: arjunpkulkarni <arjunpkulkarni@gmail.com >
Co-authored-by: breken-ai <312387581+breken-ai@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-10-03 01:11:33 +00:00
Taesu and GitHub
733f7934a1
docs(mongo-adapter): clarify transaction setup ( #11550 )
2026-10-03 10:07:35 +09:00
Taesu and GitHub
1bd5c37884
fix(last-login-method): keep defaults for undefined options ( #11549 )
2026-10-03 00:50:42 +00:00
Taesu and GitHub
678c555beb
chore: bump better-call ( #11540 )
2026-10-03 08:38:30 +09:00
Taesu and GitHub
031ec9846c
chore: bump tanstack start devDeps ( #11539 )
2026-10-02 22:23:42 +00:00
813326536c
fix(mongodb-adapter): don't abort a transaction after commit was attempted ( #11014 )
...
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-03 05:53:10 +09:00
Jonathan Samines and GitHub
7eb961f4af
docs: add documentation for new dash/sentinel options ( #11526 )
2026-10-02 11:34:47 -06:00
72a6394e30
fix(stripe): bail out of checkout.session.completed for non-subscription modes ( #9684 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-01 18:15:28 +00:00
Taesu and GitHub
4175b34a8f
fix(deps): align @better-auth/utils with better-call ( #11512 )
2026-10-01 15:14:19 +00:00
Taesu and GitHub
c46992f6ce
fix(db): preserve foreign key identity in migrations ( #11505 )
2026-10-01 15:07:41 +00:00
Taesu and GitHub
9b104a22e7
docs(captcha): clarify protected endpoints ( #11511 )
2026-10-01 23:48:23 +09:00
4738fef731
docs(rate-limit): correct default window ( #11492 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-01 16:17:38 +09:00
12cf61b3ce
docs(email-password): correct APIMethod contracts ( #11499 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-10-01 15:56:12 +09:00
55b67da016
docs(magic-link): correct APIMethod contract and document rateLimit ( #11497 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-01 15:53:51 +09:00
better-release[bot] and GitHub
db02f23391
chore: release v1.7.7 ( #11413 )
2026-09-30 22:25:23 +01:00
Gustavo Valverde and GitHub
07bdf7ecaf
fix(kysely-adapter): recheck consumeOne guards on deletion ( #11495 )
2026-09-30 20:56:12 +00:00
Gustavo Valverde and GitHub
ac54bfd678
fix(auth): isolate verification records and encryption purposes ( #11494 )
2026-09-30 20:56:11 +00:00
Taesu and GitHub
69defbcaba
fix(organization): refresh active organization after email sign-in ( #11375 )
2026-09-30 19:29:52 +00:00
Taesu and GitHub
55cb92e940
fix(auth): honor social disableSignUp for ID token sign-in ( #11491 )
2026-09-30 19:19:55 +00:00
35d7cd3892
fix(drizzle-adapter): re-check the incrementOne guard on the UPDATE ( #11331 )
...
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-09-30 19:10:44 +00:00
Gustavo Valverde
Talat MahmudandGitHub
TaesuandGitHub
DrewandGitHub
better-release[bot]andGitHub
