Gustavo Valverde
539a1adac8
fix(auth): request the TikTok identity scope and keep provider bindings on refresh
...
TikTok returns `open_id`, `union_id`, `display_name`, and `avatar_large_url`
only under `user.info.basic`, while `username` belongs to `user.info.profile`.
Sign-in requested the profile scope alone and read fields from both, which held
together only because the identity subject was not load-bearing. It is now.
Updating a session or a user profile reissued the session cookie through the
new-sign-in path, which clears the provider account binding. Same-user refreshes
keep their binding, as the password-change path already does.
2026-07-17 12:58:34 +01:00
Gustavo Valverde
6cb30980a6
docs: align the identity backfill table padding
2026-07-17 12:45:57 +01:00
Gustavo Valverde
92d4e229ce
fix(auth): isolate provider identities and tokens from provider aliases
...
OAuth providers without an issuer shared the `local:` namespace with
credential and SIWE identities, so a provider ID could resolve to an
internal method's identity and inherit its user. An identity match skips
every implicit-linking gate, which made that namespace the only thing
standing between an aliased provider and another method's account.
Token and account-info routes resolved their provider configuration from
the public `providerId` alias, so an SSO provider registered under a
social provider's alias could redeem its stored tokens against that
provider's client credentials. Provider instances already namespace
identity and account keys, so resolve configuration from them too.
TikTok is typed as always returning `union_id`, but the field is not
guaranteed. Reject that authentication instead of deriving a subject
from a missing value.
Correct the SSO domain rule, which rejects a provider unless every entry
resolves; the joins section, which documented an `experimental` option
that does not exist; and the Okta example, which enabled IdP-initiated
SAML that the plugin disables by default.
2026-07-17 11:53:02 +01:00
Gustavo Valverde
1e2006dc35
docs: document 1.7 identity migration
2026-07-17 08:38:38 +01:00
Gustavo Valverde
a4a30946ba
feat(auth)!: separate identities from provider accounts
2026-07-16 20:45:00 +01:00
Gustavo Valverde and GitHub
dbd302e422
feat(auth)!: scope accounts by issuer ( #10403 )
2026-07-16 17:24:34 +01:00
Gustavo Valverde and GitHub
763a2671c5
feat(db): add compound table indexes ( #10402 )
2026-07-16 14:31:48 +01:00
Gustavo Valverde and GitHub
0de88f5e61
feat(scim)!: decouple provisioning from the organization plugin ( #10390 )
2026-07-16 11:17:06 +01:00
bb6c1021e8
feat(organization): add getOrganization for metadata-only fetches ( #10397 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-15 12:49:26 +00:00
Maxwell and GitHub
8784c1c1f4
chore!: move joins to advanced.database.joins ( #10359 )
2026-07-14 22:21:38 +00:00
5d38b138c3
feat(drizzle): generate drizzle schema with schema namespace ( #7169 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-07-07 17:57:24 +00:00
Gustavo Valverde
d474e89705
fix(sync): address main to next review comments
2026-06-29 18:25:43 -04:00
Gustavo Valverde
c02ea52953
chore(sync): merge main into next
...
Resolve the sync conflicts by keeping the next release train package versions, carrying the 1.6.23 stable changelog entries forward, and unioning the cspell word list.
2026-06-29 18:12:01 -04:00
5daa03abf8
docs: add Better Auth 1.7 Release Candidate pages ( #10169 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-06-29 18:02:13 -04:00
8581f97ea0
feat(oauth): add Yandex social provider ( #9138 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-27 03:32:45 +00:00
Taesu and GitHub
39c2d59b34
docs: centralize font setup ( #10256 )
2026-06-26 22:45:44 +00:00
Gustavo Valverde and GitHub
dfecb481fa
feat(scim)!: isolate provider connections by organization ( #10249 )
2026-06-26 22:38:00 +01:00
Gustavo Valverde
010bd65811
chore: resolve 10246 main-to-next sync conflicts
2026-06-26 13:54:08 +01:00
Gustavo Valverde and GitHub
3a035e968e
fix(two-factor): add account-level verification lockout ( #10240 )
2026-06-26 13:40:00 +01:00
Gustavo Valverde and GitHub
7c126dcd1a
fix(scim): scope write-path operations and honor the active attribute ( #10242 )
2026-06-26 12:29:00 +00:00
Gustavo Valverde and GitHub
8bd43d9d83
fix(core): refuse redirects on server-side OAuth requests ( #10241 )
2026-06-26 12:28:17 +00:00
Gustavo Valverde and GitHub
c06a56d83a
fix: revoke unproven credentials on magic-link/email-OTP sign-in ( #10239 )
2026-06-26 13:20:07 +01:00
ea06c5a71f
feat(drizzle-adapter): support Drizzle Relations v2 ( #9489 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-26 11:01:48 +00:00
Gustavo Valverde
4bcda56649
chore: resolve 10178 main-to-next sync conflicts
...
Merges origin/main into origin/next for the replacement sync PR and records the hand-resolved package metadata, changelog, OAuth/social provider, admin, SIWE, SCIM, SSO, username, rate-limiter, and next-owned MCP/OIDC provider conflicts.
2026-06-26 06:33:24 +01:00
b5bec193a5
fix(oauth): apply user input rules to provider profiles ( #10196 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 04:06:54 +00:00
90d509e0b9
fix(adapter): fail closed on update misses ( #10180 )
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:56:39 +00:00
816d7f9252
fix(one-tap): apply configured Google hosted domain (hd) on the callback ( #10197 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:56:20 +00:00
Gustavo Valverde and GitHub
5838df2f41
feat(oauth-provider): add refresh token reuse interval ( #10145 )
2026-06-26 03:49:27 +00:00
fa1e036ae7
fix(sso): validate SAML response binding against the Service Provider ( #10226 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:07:43 +00:00
fcabaaffcb
fix(sso): require DNS proof for every domain listed on a provider ( #10227 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 02:49:15 +00:00
Gustavo Valverde and GitHub
1bc370aef5
fix(siwe): reject sign-in when the provided email already belongs to another account ( #10228 )
2026-06-26 02:21:45 +00:00
Taesu and GitHub
5f86c3bed7
docs: restore lubiah community adapter ( #10230 )
2026-06-25 13:44:27 -07:00
Maxwell and GitHub
82cbbd6f1d
docs: add missing disable-implicit-linking docs ( #10218 )
2026-06-25 10:59:14 +00:00
5953157acf
fix: harden forwarded client IP resolution ( #10203 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-25 04:55:10 +00:00
Taesu and GitHub
e7c8066cf1
docs: refine warning guidance across plugin docs ( #10185 )
2026-06-21 22:39:30 -07:00
moonevm and GitHub
6e5f7e656b
docs: fix the code block format on the Stripe plugin page ( #10181 )
2026-06-21 02:31:43 -07:00
bdda5162f9
docs: remove extra spaces in documentation ( #10174 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-20 22:48:59 -07:00
Gustavo Valverde and GitHub
6ddb5554c0
chore(deps)!: upgrade dependencies to latest ( #10170 )
2026-06-20 10:15:37 -07:00
Gustavo Valverde
3b170f2f40
chore: sync main to next
2026-06-20 09:15:00 -07:00
Roman Sirokov and GitHub
58549652dd
docs: fix open in markdown url ( #10162 )
2026-06-20 02:06:21 +00:00
Gustavo Valverde and GitHub
e3125e872d
feat(oauth-provider): honor requested UserInfo claims via a claim registry ( #10156 )
2026-06-19 18:08:35 -07:00
Gustavo Valverde and GitHub
dd42701af4
fix(oauth-provider): allow nonce-bound offline access without PKCE ( #10153 )
2026-06-19 11:18:05 -07:00
Gustavo Valverde and GitHub
d368217efc
fix(oauth-provider): keep OIDC scope claims on UserInfo ( #10152 )
2026-06-19 10:55:51 -07:00
Gustavo Valverde and GitHub
a8200b297c
feat(oauth-provider): allow confidential DCR clients without PKCE ( #10146 )
2026-06-19 06:29:08 -07:00
Gustavo Valverde and GitHub
1f8b0282de
fix(oauth-provider): preserve dcr client key metadata ( #10144 )
2026-06-18 22:46:03 -07:00
Gustavo Valverde and GitHub
335cda702e
feat(oauth-provider)!: make id-token claim authority explicit ( #10140 )
2026-06-18 14:25:12 -07:00
Gustavo Valverde and GitHub
3a79aff58e
feat(google): add includeGrantedScopes option ( #10129 )
2026-06-18 08:31:10 -07:00
Gustavo Valverde and GitHub
97903c9cca
fix(oauth): preserve account.scope across re-auth and refresh ( #10128 )
2026-06-18 08:17:27 -07:00
Gustavo Valverde and GitHub
27f06181c7
revert(oauth): remove granted scopes architecture ( #10123 )
2026-06-17 22:27:20 -07:00
Gustavo Valverde and GitHub
de8394de20
fix(cimd): route client_id SSRF checks through the shared host classifier ( #10126 )
2026-06-17 18:29:06 -07:00
Gustavo Valverde
moonevmandGitHub
Roman SirokovandGitHub