Gustavo Valverde
fdbf32fa8b
Merge branch 'fix/oauth-provider-trusted-client-guard' into refactor/oauth-provider-rotation-precheck
...
# Conflicts:
# packages/oauth-provider/src/client-key-rotation.test.ts
2026-10-14 22:13:19 +01:00
Gustavo Valverde
f109de7cc7
Merge branch 'feat/oauth-provider-client-key-rotation' into fix/oauth-provider-trusted-client-guard
2026-10-14 22:12:52 +01:00
Gustavo Valverde
0e88c12cab
chore(oauth-provider): format rotation tests for Biome 2.5.15
2026-10-14 22:12:37 +01:00
Gustavo Valverde
48aaf2f67c
Merge branch 'fix/oauth-provider-trusted-client-guard' into refactor/oauth-provider-rotation-precheck
2026-10-14 22:09:09 +01:00
Gustavo Valverde
10f1c5842b
Merge branch 'feat/oauth-provider-client-key-rotation' into fix/oauth-provider-trusted-client-guard
2026-10-14 22:09:09 +01:00
Gustavo Valverde
ee8b50e9c8
Merge branch 'main' of github.com:better-auth/better-auth into feat/oauth-provider-client-key-rotation
...
# Conflicts:
# packages/oauth-provider/src/private-key-jwt.test.ts
2026-10-14 22:08:51 +01:00
Taesu and GitHub
c03ced528a
chore: bump @biomejs/biome ( #11760 )
2026-10-14 21:01:10 +00:00
Taesu and GitHub
6edaa61e62
fix(api): await onAPIError.onError and log hook failures ( #11766 )
2026-10-14 20:13:05 +00:00
Gustavo Valverde and GitHub
bdf20eb93e
fix(demo): link dynamically registered MCP clients to the MCP resource ( #11764 )
2026-10-14 19:47:33 +00:00
0a1a87e388
fix(oauth-provider): distinguish post-login continuation from initial selection ( #11185 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 18:32:15 +00:00
54a09948e8
fix(oauth-provider): validate DPoP against public URL ( #10799 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 18:27:25 +00:00
better-release[bot] and GitHub
5f4cc5c110
chore: release v1.7.8 ( #11513 )
2026-10-14 18:47:06 +01:00
Gustavo Valverde and GitHub
133765b48e
ci(release): keep PR titles for every changeset a PR adds ( #11759 )
2026-10-14 18:24:04 +01:00
e78f15aa31
fix(core): allow 30s of clock skew when verifying ID tokens ( #11749 )
...
Co-authored-by: Lohith <ssvlohith@gmail.com >
2026-10-14 17:06:19 +01:00
60525e08fd
fix(core): verify microsoft entra id tokens when jwks keys omit alg ( #11663 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 17:04:35 +01:00
e9d9921217
fix(generic-oauth): retry discovery for providers skipped at startup ( #11750 )
...
Co-authored-by: mangomac <mangomac@users.noreply.github.com >
2026-10-14 16:53:53 +01:00
916ef5c530
fix(mongo-adapter): retry a transaction aborted with a transient error ( #11515 )
...
Co-authored-by: Maxwell Afamefuna Nzekwe <70326615+maxnze1@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 16:30:50 +01:00
aaf0d7da3e
fix(oauth-provider): keep auth working when startup resource seeding fails ( #11726 )
...
Co-authored-by: Panagiotis Plytas <34184381+pplytas@users.noreply.github.com >
Co-authored-by: Arjun Vijay Prakash <137415649+ArjunCodess@users.noreply.github.com >
Co-authored-by: Tushar <192458782+Tushar-Khandelwal-2004@users.noreply.github.com >
Co-authored-by: zoom-dustin-moriarty <221604897+zoom-dustin-moriarty@users.noreply.github.com >
2026-10-14 12:33:21 +01:00
f0ce580fbd
fix(phone-number): use custom verifyOTP when resetting the password ( #10698 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 11:37:54 +01:00
Gustavo Valverde and GitHub
adbdc06e33
fix(sso): stop treating the SAML post-login redirect as an identity field ( #11743 )
2026-10-14 09:33:05 +00:00
c3f11cc1a1
docs(sso): clarify SAML callbackUrl vs ACS endpoint in 1.7 ( #11703 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:18:24 +01:00
182e92bd8a
fix(sso): allow rotating SAML IdP signing certificate with linked accounts ( #11687 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:16:38 +01:00
a878f9ab47
fix(sso): support array of emails in OIDC claim resolution ( #11640 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:16:10 +01:00
Gustavo Valverde and GitHub
3ddc6096e5
fix(demo): keep OAuth token responses uncacheable in development ( #11742 )
2026-10-14 09:27:24 +01:00
0cfe07dccd
fix(drizzle-adapter): support dates in string columns ( #11731 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-10-14 08:50:41 +01:00
ea85d133d6
fix(mongo-adapter): abort a transaction whose commit did not complete ( #11602 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-13 20:47:45 +01:00
1d95ebf3fe
fix(session): fall back to database for bulk session lookups ( #11718 )
...
Co-authored-by: choksi2212 <choksi2212@users.noreply.github.com >
2026-10-13 03:15:11 +00:00
876ee038ec
test(organization): create shared fixtures in beforeAll ( #11709 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-10-13 01:26:34 +00:00
Remco and GitHub
a2a74e1524
docs: open header dropdowns on activation instead of focus ( #11678 )
2026-10-13 08:39:01 +09:00
Menachem Hornbacher and GitHub
6700372896
docs: update JWT docs to list all fields ( #11339 )
2026-10-13 08:28:39 +09:00
Deepanshu Pal and GitHub
7393f6350e
docs: fix Electron and Polar example syntax ( #11587 )
2026-10-13 08:25:54 +09:00
23ee48ad9a
docs: add good-webhooks to community plugins ( #11697 )
...
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-13 08:16:17 +09:00
766cfb3f42
fix(magic-link): stop double-decoding callback URLs on verify ( #11174 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-12 21:32:53 +00:00
Taesu and GitHub
9725f1b361
fix(core): prevent stalled AsyncLocalStorage initialization ( #11711 )
2026-10-12 21:19:17 +00:00
Taesu and GitHub
c46d2a6ac4
fix(core): resolve pure AsyncLocalStorage on first use ( #11712 )
2026-10-12 21:19:10 +00:00
6c89bb18f1
fix(sso): accept partial mappings when updating a provider ( #11378 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-12 13:36:49 +00:00
Gustavo Valverde
472a5f22ff
refactor(oauth-provider): refuse unrotatable clients before verifying the assertion
...
verifyClientAssertion takes an `assertClient` precondition that runs on the looked-up client before any key is fetched or the jti is consumed. Key rotation uses it, so a jwks_uri or trusted client is refused without a JWKS fetch, a signature check, or spending the assertion.
2026-10-12 14:18:42 +01:00
Gustavo Valverde
fe62de2b3b
fix(oauth-provider): refuse trusted-client changes with 400, not 500
...
Updating, deleting, or rotating the secret of a client configured in code through `cachedTrustedClients` is a deliberate refusal, but the three management endpoints reported it as a 500 server failure. They now share one guard with client key rotation and return 400 `invalid_client`.
2026-10-12 14:17:21 +01:00
Gustavo Valverde
3390792bbe
feat(oauth-provider): let private_key_jwt clients rotate their own keys
...
A confidential client with inline `jwks` can now replace its keys at
`POST /oauth2/client/rotate-keys` without a user session. The request
carries the complete new JWK Set and a client assertion signed by a
current key, addressed to the rotation endpoint itself, so an assertion
minted for the token endpoint or the issuer cannot be redirected here.
Enabled with `allowClientKeyRotation`.
Keys left out of the new set stop verifying at once. A client rolls a
key in two steps, the way a jwks_uri client does: it sends the old and
new keys together, then drops the old key once every instance signs with
the new one. Only current keys can authorize a rotation, matching
RFC 7592, node-oidc-provider, Ory Hydra, and Keycloak, where only the
current management credential can change a client.
The write is guarded on the exact key set the assertion was verified
against, so a concurrent rotation fails with 409 instead of overwriting.
No schema change is needed.
2026-10-12 14:15:06 +01:00
Gustavo Valverde and GitHub
fe2559b7a0
docs(oauth-provider): show client-aware access token claims ( #11656 )
2026-10-11 18:29:53 +00:00
Gustavo Valverde and GitHub
847acd02bb
feat(oauth-provider): pass client ID to privilege checks ( #11658 )
2026-10-11 18:29:52 +00:00
Gustavo Valverde and GitHub
38f3bb34af
feat(oauth-provider): link resources during managed client registration ( #11655 )
2026-10-11 18:29:51 +00:00
Gustavo Valverde and GitHub
1a9be41d18
feat(oauth-provider): allow client disable through admin update ( #11654 )
2026-10-10 14:52:35 +01:00
Gustavo Valverde and GitHub
8409fb250d
fix(scim): return 409 when concurrent updates claim the same unique key ( #11669 )
2026-10-10 11:38:31 +00:00
Talat Mahmud and GitHub
ef5c12c696
docs: add @octopi-ai/better-enrollment to community plugins ( #11653 )
2026-10-10 17:06:56 +09:00
9904b29ece
fix(kysely-adapter): allow concurrent queries on the D1 dialect ( #11490 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-10 07:59:43 +00:00
e15625ff38
fix(better-auth): allow SvelteKit 3 as a peer dependency ( #11488 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-09 16:33:41 +00:00
Taesu and GitHub
53307a7c60
docs(integrations): add Effect integration guide ( #11566 )
2026-10-09 09:41:45 +00:00
62146108c7
fix(oauth-provider): accept host-bearing custom-scheme native redirects ( #10956 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-09 08:59:37 +01:00
07a09389ef
fix(password): consume the reset token inside the reset transaction ( #11646 )
...
Co-authored-by: edenbuilds <279970382+edenbuilds@users.noreply.github.com >
Co-authored-by: omkar1work <omkar1work@gmail.com >
2026-10-09 06:44:53 +00:00
Gustavo Valverde
TaesuandGitHub
better-release[bot]andGitHub
RemcoandGitHub
Menachem HornbacherandGitHub
Deepanshu PalandGitHub
Talat MahmudandGitHub
