Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
91f235f860
feat(auth): add per-provider requireEmailVerification for social sign-in ( #9929 )
...
Co-authored-by: Gautam Manchandani <161146829+GautamBytes@users.noreply.github.com >
2026-06-08 00:31:20 +00:00
41cca606d1
feat(auth): add user.validateUserInfo provisioning gate ( #9864 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 14:34:48 -07:00
7fe0e2b165
feat: add clientAssertion support to the Microsoft Entra ID social provider ( #9898 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Bereket Engida <Bekacru@gmail.com >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 20:28:46 -07:00
Gustavo Valverde and GitHub
4f53b61f49
refactor(oauth)!: verify provider id_tokens with a single shared verifier ( #9828 )
2026-06-05 08:00:03 -04:00
Gustavo Valverde and GitHub
40b392ae21
feat(oauth)!: accumulate granted scopes as grantedScopes string[] ( #9825 )
2026-06-04 17:54:52 -04:00
Gustavo Valverde
1f4ca6e1e4
chore: sync main to next
...
Pull in #9845 (runtime-safe redirect-uri validation and fragment rejection) now that it merged to main, so next gets the corrected validation directly instead of waiting for a later sync.
2026-05-31 13:39:57 +01:00
Gustavo Valverde and GitHub
13abc7922b
fix(core): make redirect-uri validation runtime-safe and reject fragments ( #9845 )
2026-05-31 13:37:39 +01:00
Gustavo Valverde
065f5ad72d
chore: sync main to next
...
Brings the v1.6.13 stable fixes into next: redirect_uri scheme validation in oidc-provider and mcp (#9838 ), clientPrivileges enforcement on dynamic client registration (#9837 ), null organization logo support (#9842 ), the consumeOne non-numeric deleteMany guard (#9831 ), and the db-adapter guide alignment (#9830 ).
Conflicts were limited to release version bumps and CHANGELOG entries; resolved by keeping next's 1.7.0-beta.3 line. The ten changesets consumed by the v1.6.13 release are accepted as deleted, and no external dependencies changed.
2026-05-31 13:02:15 +01:00
Gustavo Valverde and GitHub
be32012ca3
fix(oauth): validate redirect_uri schemes in oidc-provider and mcp ( #9838 )
2026-05-31 11:38:52 +01:00
Taesu and GitHub
5c3e248cbf
fix(core): throw on non-numeric deleteMany in consumeOne fallback ( #9831 )
2026-05-31 09:00:18 +00:00
Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
43c08a2bc7
fix(account): scope OAuth account identity and fix buggy internalAdapter helpers ( #9818 )
...
Co-authored-by: Krish Garg <kgarg@chapman.edu >
2026-05-30 20:48:10 +00:00
23d7cbfa79
fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow ( #8758 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 19:48:38 +01:00
5f282bd382
fix(account): default storeStateStrategy to "database" when using secondaryStorage ( #9591 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 11:05:28 +01:00
Gustavo Valverde and GitHub
c5b9f93498
fix(generic-oauth): add accessTokenExpiresIn for providers that omit expires_in ( #9799 )
2026-05-29 20:49:59 +00:00
a3b0c63de9
fix: accept hashed nonces for native iOS sign-in with Apple ( #8870 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-28 12:35:09 +00:00
7bf5449b11
fix(oauth2): map jose token verification errors ( #9655 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-27 09:45:02 +00:00
Taesu and GitHub
83fa3695e7
feat(core): add string case conversion utilities ( #9727 )
2026-05-24 23:40:22 +00:00
Gustavo Valverde and GitHub
e7eb45b065
feat(oauth): per-request additionalParams and loginHint ( #9305 )
2026-05-19 17:18:43 +00:00
f77060af3a
fix: consumeVerificationValue returns null for expired rows ( #9624 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-19 16:37:55 +00:00
03e6c94e96
feat(generic-oauth,sso): support IDP-initiated flows via secure bounce ( #9301 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-05-19 12:29:04 +00:00
Gustavo Valverde and GitHub
1e5b808472
refactor(oauth): single-source Basic credentials + getHttpTestInstance ( #9657 )
2026-05-17 19:23:45 +00:00
aebf66d8e6
feat: add token endpoint client authentication ( #9625 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-16 18:27:15 +00:00
Gustavo Valverde and GitHub
da7e50beee
fix(oauth): block OAuth linking to unverified local accounts ( #9578 )
2026-05-12 14:20:19 +00:00
Gustavo Valverde and GitHub
0cbddb8fa4
refactor(db): rename claimOne adapter primitive to consumeOne ( #9568 )
2026-05-12 07:44:07 +00:00
Gustavo Valverde and GitHub
a2c0c9346e
feat(db): add atomic claimOne adapter primitive ( #9560 )
2026-05-11 20:10:29 +00:00
Maxwell and GitHub
ee93485499
fix: add error code to change-email-disabled ( #8948 )
2026-05-11 11:49:38 +00:00
Gustavo Valverde and GitHub
e21d744987
fix(rate-limit): widen ipv6Subnet type and correct default in docs ( #9545 )
2026-05-11 07:04:16 +00:00
Taesu
2b83087180
chore: sync main to next
2026-05-10 03:45:29 +09:00
Taesu and GitHub
15ff28a957
fix(internal-adapter): rename deleteAccount param from accountId to id ( #9503 )
2026-05-09 13:50:32 +00:00
3a9a2c37ee
chore: expose refreshUserSessions on internal adapter ( #7764 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-05-07 10:17:56 +00:00
2220a6d6c2
fix(core): use pure instrumentation entry for workerd ( #9395 )
...
Co-authored-by: cyphercodes <7407177+cyphercodes@users.noreply.github.com >
2026-04-29 12:59:31 -07:00
815ecf62b6
fix(core): resolve instrumentation via package self-reference in adapter factory ( #9340 )
...
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com >
2026-04-24 05:12:34 +00:00
Gustavo Valverde and GitHub
9aa8e63de8
fix(oauth): support mapProfileToUser fallback for providers that may omit email ( #9331 )
2026-04-23 10:15:36 +00:00
Gustavo Valverde
eb3cd10d50
chore: resolve main-to-next sync conflicts
...
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
2026-04-22 14:54:27 +01:00
Gustavo Valverde and GitHub
4f373eed8a
feat(social-providers): accept array of Client IDs for ID token audience ( #9292 )
2026-04-22 09:02:56 +00:00
Ray and GitHub
4a180f0b0c
fix(core): serve noop ./instrumentation on browser and edge conditions ( #9281 )
2026-04-22 08:44:00 +00:00
307196a405
fix(api): preserve response headers when APIError is thrown ( #9211 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-22 06:47:16 +00:00
Taesu and GitHub
b5742f9d08
feat(core): add mapConcurrent bounded-concurrency utility ( #9227 )
2026-04-21 15:31:08 +00:00
Gustavo Valverde and GitHub
e64ff720fb
fix: unify host classification and close SSRF gaps across packages ( #9226 )
2026-04-17 23:25:25 +00:00
a844c7dd08
chore(core): update @opentelemetry/api dep declaration to be optional ( #9111 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-17 14:26:40 +00:00
Gustavo Valverde
225976c7d2
chore: main to next conflict resolution
...
Resolve the main to next sync discrepancies after the v1.6.4 release.
Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main
2026-04-15 15:40:35 +01:00
acbd6ef69f
fix: honor forceAllowId UUIDs on postgres adapters ( #9068 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-14 13:05:11 +00:00
Gustavo Valverde and GitHub
c7d22539ec
refactor(generic-oauth)!: rewrite as first-class social provider with RFC compliance ( #9069 )
2026-04-13 12:02:16 +00:00
Gustavo Valverde and GitHub
93d3871bd2
feat(oauth): add private_key_jwt client authentication (RFC 7523) ( #8836 )
2026-04-10 08:22:05 +00:00
Taesu and GitHub
475d512376
chore: revert better-call v2 migration, downgrade to v1.3.5 ( #8973 )
2026-04-05 23:18:54 +00:00
5970053e6a
docs: improve descriptions for appName, trustedOrigins, useSecureCookies ( #8935 )
...
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-03 18:31:00 +00:00
31d5e88b88
fix(instrumentation): don't mark redirect APIErrors as span errors ( #8850 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-01 22:49:49 +10:00
Jonathan Samines and GitHub
cd01a42e60
feat: expose plugin version ( #8750 )
2026-03-31 16:08:21 +00:00
Gustavo ValverdeandGitHub
TaesuandGitHub
Taesu
RayandGitHub
