Gustavo Valverde and GitHub
a8ea86e25e
fix(scim)!: always bind personal SCIM connections to their creator ( #9840 )
2026-05-31 12:53:18 +00:00
Gustavo Valverde
065f5ad72d
chore: sync main to next
...
Brings the v1.6.13 stable fixes into next: redirect_uri scheme validation in oidc-provider and mcp (#9838 ), clientPrivileges enforcement on dynamic client registration (#9837 ), null organization logo support (#9842 ), the consumeOne non-numeric deleteMany guard (#9831 ), and the db-adapter guide alignment (#9830 ).
Conflicts were limited to release version bumps and CHANGELOG entries; resolved by keeping next's 1.7.0-beta.3 line. The ten changesets consumed by the v1.6.13 release are accepted as deleted, and no external dependencies changed.
2026-05-31 13:02:15 +01:00
Taesu and GitHub
df9e8b2951
docs: align db adapter guide with adapter contract ( #9830 )
2026-05-31 09:01:50 +00:00
Gustavo Valverde
be653ab90d
docs(two-factor): merge enforcement-scope clarification into OTP rewrite ( #9607 )
...
Layers main's #9607 clarification onto next's #9057 OTP-enablement rewrite.
The "Sign In with 2FA" section now states that 2FA sign-in enforcement
applies to the credential endpoints (/sign-in/email, /sign-in/username,
/sign-in/phone-number) and that passwordless flows are not gated by default,
with guidance to add custom hook handling to require it. The passwordless
callout and the allowPasswordless option note that the flag does not change
which sign-in methods are challenged. main's edit to the removed
skipVerificationOnEnable bullet is dropped, since next deleted that option.
(cherry picked from commit 6156cef51329e1c38544aa06eb5072d8a06ece7a)
2026-05-31 00:10:36 +01:00
Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
Gustavo Valverde and GitHub
e8696388bf
docs(oauth-provider): align metadata routing guidance ( #9768 )
2026-05-30 22:32:09 +01:00
23d7cbfa79
fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow ( #8758 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 19:48:38 +01:00
d3919dc1a5
feat(account): support server-side accountInfo calls without session headers ( #9813 )
...
Co-authored-by: Nathan Colosimo <nathancolosimo@gmail.com >
2026-05-30 12:45:40 +01:00
5f282bd382
fix(account): default storeStateStrategy to "database" when using secondaryStorage ( #9591 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 11:05:28 +01:00
Taesu and GitHub
e131d3ac5b
fix(api-key): verify non-default keys when configId is omitted ( #9794 )
2026-05-30 03:14:57 +00:00
Gustavo Valverde and GitHub
c5b9f93498
fix(generic-oauth): add accessTokenExpiresIn for providers that omit expires_in ( #9799 )
2026-05-29 20:49:59 +00:00
17cd433c66
fix(oauth-proxy): missing state-cookie skip for oauth-proxy ( #9385 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-29 15:06:34 +00:00
093115e162
docs(oauth): added Roblox provider and alphabetized "providers without email" table ( #9786 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-29 03:16:35 +00:00
ac96316af3
fix(oauth): forward specific callback error codes via shared redirectOnError ( #9788 )
...
Co-authored-by: Gautam Manchandani <manchandanigautam@gmail.com >
2026-05-28 21:42:16 +00:00
Gustavo Valverde and GitHub
e7eb45b065
feat(oauth): per-request additionalParams and loginHint ( #9305 )
2026-05-19 17:18:43 +00:00
Maxwell and GitHub
adc8d7f1af
docs: microsoft base64 profile image warning ( #9692 )
2026-05-19 16:41:44 +00:00
03e6c94e96
feat(generic-oauth,sso): support IDP-initiated flows via secure bounce ( #9301 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-05-19 12:29:04 +00:00
602ec40293
feat(sso)!: support multiple IdP signing certificates ( #8805 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-18 03:07:37 +00:00
aebf66d8e6
feat: add token endpoint client authentication ( #9625 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-16 18:27:15 +00:00
db4263cd3d
chore: use correct auth cli ( #9638 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-16 02:27:55 +00:00
Gautam Manchandani and GitHub
95765cfedd
docs: clarify 2fa sign-in enforcement scope ( #9607 )
2026-05-14 08:45:10 +00:00
Gautam Manchandani and GitHub
29599d32b5
docs: document account storeStateStrategy ( #9557 )
2026-05-12 13:16:23 +00:00
Gustavo Valverde and GitHub
5f09d566a6
fix(magic-link): consume verification token atomically on verify ( #9572 )
2026-05-12 12:50:38 +00:00
Gustavo Valverde and GitHub
99a254a79b
fix(device-authorization): bind approval to verifier session ( #9573 )
2026-05-12 11:40:18 +00:00
Gautam Manchandani and GitHub
15bb1690b2
feat(cli): add create-admin command ( #9547 )
2026-05-12 10:30:04 +00:00
86765f1597
fix(sso): require org admin role to register SSO providers ( #9220 )
...
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-11 17:04:01 +00:00
Jonathan Samines and GitHub
eae63a9aff
docs: add docs for infra timeout options ( #9559 )
2026-05-11 08:59:03 -06:00
Gustavo Valverde and GitHub
e21d744987
fix(rate-limit): widen ipv6Subnet type and correct default in docs ( #9545 )
2026-05-11 07:04:16 +00:00
Taesu
2b83087180
chore: sync main to next
2026-05-10 03:45:29 +09:00
fde043207e
fix: improve link accessibility issues ( #9521 )
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-05-09 11:31:27 +00:00
Muzzaiyyan Hussain and GitHub
b96bbfe9b7
docs: improve adapter link accessibility ( #9517 )
2026-05-09 11:01:17 +00:00
Muzzaiyyan Hussain and GitHub
ea5bcfaa95
docs: improve accessibility of documentation links ( #9518 )
2026-05-09 11:00:42 +00:00
Jonathan Samines and GitHub
2f9454b625
docs: add docs for infra getAllAuditLogs() ( #9478 )
2026-05-06 19:47:38 -06:00
729c00d74c
feat(username): add immutable username option ( #9240 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-06 20:58:46 +00:00
30a1fb9c05
feat(i18n): add built-in translations for 22 languages ( #9157 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
2026-05-06 11:51:17 +00:00
Gautam Manchandani and GitHub
4b34df8bdc
docs: fix organization invite callout list ( #9442 )
2026-05-03 19:00:15 +00:00
Taesu and GitHub
eb6061acb1
docs(stripe): document user deletion with active subscriptions recipe ( #9404 )
2026-04-30 22:44:30 +00:00
c8ec03d26e
docs: add MikroORM better-auth adapter to community adapters ( #9379 )
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-04-28 22:56:02 +00:00
Taesu and GitHub
5d24a7478b
fix(stripe): expose stripeSubscription in onSubscriptionUpdate and fix stale snapshot ( #9354 )
2026-04-26 09:41:11 +00:00
b67783d364
docs(hooks): add example for handling multiple endpoints in a single hook ( #8792 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-25 00:26:20 +00:00
89af592e93
docs: add revokeSessionsOnPasswordReset to password reset section ( #8551 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-25 00:19:51 +00:00
c1336c563d
fix(organization): scope setActiveTeam to active organization ( #9239 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-24 23:48:16 +00:00
7fbe9282ba
docs: update import path for drizzleAdapter ( #9218 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-24 23:22:13 +00:00
Taesu and GitHub
ae3374c6d5
docs: clean up DatabaseTable component ( #9342 )
2026-04-24 06:37:38 +00:00
Gustavo Valverde and GitHub
9aa8e63de8
fix(oauth): support mapProfileToUser fallback for providers that may omit email ( #9331 )
2026-04-23 10:15:36 +00:00
Gustavo Valverde and GitHub
8e3cc3453c
fix(oauth-provider): accept authorization flows without state ( #9328 )
2026-04-23 07:00:05 +00:00
Taesu and GitHub
4e8e4c7fc5
feat(client): add hydrateSession for SSR session hydration ( #8733 )
2026-04-22 21:09:45 +00:00
Gustavo Valverde
eb3cd10d50
chore: resolve main-to-next sync conflicts
...
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
2026-04-22 14:54:27 +01:00
Gustavo Valverde and GitHub
4f373eed8a
feat(social-providers): accept array of Client IDs for ID token audience ( #9292 )
2026-04-22 09:02:56 +00:00
9ab0346dae
docs: add subsection for advanced database configuration options ( #9149 )
...
Co-authored-by: Morgan PEYRE <morgan.peyre@brickcode.tech >
2026-04-22 05:29:41 +00:00
Gustavo ValverdeandGitHub
TaesuandGitHub
Jonathan SaminesandGitHub
Muzzaiyyan HussainandGitHub
