github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7244] [MERGED] v1.4.11 #24070

New Issue
Closed
opened 2026-04-15 22:09:44 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:09:44 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7244
Author: @himself65
Created: 1/10/2026
Status: ✅ Merged
Merged: 1/12/2026
Merged by: @himself65

Base: main ← Head: v1.4.11-staging

📝 Commits (10+)

  • 71722b3 fix(stripe): Improve error handling and subscriptionSuccess route (#7087)
  • 7bd9c91 fix(stripe): pass metadata to subscription object in upgrade method (#7090)
  • d05f7a2 feat: add auth.api.verifyPassword (#6934)
  • 068030f fix: filter null values from dynamic trusted origins (#7080)
  • f00bb9a chore: explicit export auth.ts (#7095)
  • ba54b16 fix(prisma-adapter): lift eq AND conditions to root so update detects unique where field (#7096)
  • 51dd1f4 fix(stripe): prevent duplicate subscription creation when a subscription already exists (#7104)
  • 4deeea6 fix(core): detect dual module error (#7097)
  • f53549a feat(generic-oauth): add Gumroad login support (#7100)
  • 9500fdd fix(organization): use opts pattern to enable hook injection (#7130)

📊 Changes

120 files changed (+7486 additions, -974 deletions)

View changed files

📝 .cspell/company-names.txt (+2 -1)
📝 .cspell/tech-terms.txt (+2 -0)
➕ .github/workflows/claude.yml (+50 -0)
📝 .github/workflows/e2e.yml (+1 -1)
📝 .gitignore (+2 -0)
📝 demo/nextjs/package.json (+1 -1)
📝 docs/components/builder/index.tsx (+6 -1)
📝 docs/components/community-plugins-table.tsx (+11 -0)
📝 docs/components/features.tsx (+11 -5)
📝 docs/components/github-stat.tsx (+8 -1)
📝 docs/components/landing/hero.tsx (+12 -2)
📝 docs/components/landing/testimonials.tsx (+7 -2)
📝 docs/components/logo.tsx (+2 -0)
📝 docs/components/nav-bar.tsx (+2 -0)
📝 docs/components/nav-link.tsx (+10 -1)
📝 docs/components/theme-toggle.tsx (+2 -0)
📝 docs/content/docs/adapters/community-adapters.mdx (+1 -0)
📝 docs/content/docs/concepts/users-accounts.mdx (+19 -2)
📝 docs/content/docs/integrations/expo.mdx (+15 -7)
📝 docs/content/docs/plugins/anonymous.mdx (+27 -2)

...and 80 more files

📄 Description

Summary by cubic

Improved Stripe reliability with organization billing and stronger webhooks. Added verifyPassword, Gumroad OAuth, anonymous user deletion, clearer CSRF vs origin checks, SAML single-assertion validation, and a Prisma update fix.

  • New Features

    • Added auth.api.verifyPassword for server-side password verification (OpenAPI + docs).
    • Added Gumroad provider to Generic OAuth (docs updated).
    • Stripe: organization customers supported (bill by user or organization, with customerType and org stripeCustomerId).
    • Anonymous: added delete-anonymous-user endpoint (docs updated).
    • Email Verification: introduced beforeEmailVerification and afterEmailVerification hooks (onEmailVerification deprecated).
    • Core: added getPlugin API on AuthContext (used by OIDC provider).

  • Bug Fixes

    • Stripe: centralized error codes, stricter webhook validation, prevent duplicate subscription creation, handle missing subscription items, pass metadata in upgrade, and harden subscriptionSuccess.
    • Security: separate CSRF and origin checks; filter null/empty values from dynamic trustedOrigins.
    • Prisma adapter: lift simple eq AND conditions to root on update so unique fields are honored.
    • Core: detect multiple Better Auth imports and log an error.
    • Email Verification: enforce correct errors (EMAIL_MISMATCH, EMAIL_ALREADY_VERIFIED) and call hooks correctly; Email OTP calls before/after hooks when override is enabled.
    • SSO SAML: reject responses containing multiple assertions.
    • OpenAPI: correctly infer types for ZodDefault fields.
    • Rate limiter: expire and clean up memory entries.
    • Redirects: set Location header for social sign-in, account linking, and email sign-in with callbackURL.
    • MCP: restore ctx.query from cookie in OAuth flow to fix post-login redirect.
    • One Tap: respect user dismiss reasons to avoid unnecessary retries.
    • API Key: remove strict length pre-check, standardize INVALID_API_KEY error, and migrate legacy double-stringified metadata.
    • Passkey: add client-side error logging on verification failures.
    • Anonymous: prevent cleanup from deleting fresh sessions.
    • Two-Factor: fix backup code updates (update by id), ensure correct parsing, allow regenerating multiple times, and add missing client endpoints for verification.

Written for commit dd465f34db. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7244 **Author:** [@himself65](https://github.com/himself65) **Created:** 1/10/2026 **Status:** ✅ Merged **Merged:** 1/12/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `main` ← **Head:** `v1.4.11-staging` --- ### 📝 Commits (10+) - [`71722b3`](https://github.com/better-auth/better-auth/commit/71722b38e46f83bdc3139f83590cb4cedf87bc57) fix(stripe): Improve error handling and `subscriptionSuccess` route (#7087) - [`7bd9c91`](https://github.com/better-auth/better-auth/commit/7bd9c919229ea9c10fe6a721d4ddf0d23f16760b) fix(stripe): pass metadata to subscription object in upgrade method (#7090) - [`d05f7a2`](https://github.com/better-auth/better-auth/commit/d05f7a2881c1dca5a83f663b70a2cdbf41d5a241) feat: add `auth.api.verifyPassword` (#6934) - [`068030f`](https://github.com/better-auth/better-auth/commit/068030f888bb150e2aa9d445c51e87f7479c75d3) fix: filter null values from dynamic trusted origins (#7080) - [`f00bb9a`](https://github.com/better-auth/better-auth/commit/f00bb9aeb67de383f5cfc9e7b6f01458dcbb6490) chore: explicit export `auth.ts` (#7095) - [`ba54b16`](https://github.com/better-auth/better-auth/commit/ba54b16874cf54ff6e0248390175ff09de38d78a) fix(prisma-adapter): lift eq AND conditions to root so update detects unique where field (#7096) - [`51dd1f4`](https://github.com/better-auth/better-auth/commit/51dd1f49e5b3e702950f773db8a4aaba01f1b315) fix(stripe): prevent duplicate subscription creation when a subscription already exists (#7104) - [`4deeea6`](https://github.com/better-auth/better-auth/commit/4deeea639f1480e75551cee83cb21d61795dc328) fix(core): detect dual module error (#7097) - [`f53549a`](https://github.com/better-auth/better-auth/commit/f53549a19ecea0c77b6014f1b7de6bb735afaf2b) feat(generic-oauth): add `Gumroad` login support (#7100) - [`9500fdd`](https://github.com/better-auth/better-auth/commit/9500fdda0799e7b9a3fdce7fa6a06082ca60dbf9) fix(organization): use opts pattern to enable hook injection (#7130) ### 📊 Changes **120 files changed** (+7486 additions, -974 deletions) <details> <summary>View changed files</summary> 📝 `.cspell/company-names.txt` (+2 -1) 📝 `.cspell/tech-terms.txt` (+2 -0) ➕ `.github/workflows/claude.yml` (+50 -0) 📝 `.github/workflows/e2e.yml` (+1 -1) 📝 `.gitignore` (+2 -0) 📝 `demo/nextjs/package.json` (+1 -1) 📝 `docs/components/builder/index.tsx` (+6 -1) 📝 `docs/components/community-plugins-table.tsx` (+11 -0) 📝 `docs/components/features.tsx` (+11 -5) 📝 `docs/components/github-stat.tsx` (+8 -1) 📝 `docs/components/landing/hero.tsx` (+12 -2) 📝 `docs/components/landing/testimonials.tsx` (+7 -2) 📝 `docs/components/logo.tsx` (+2 -0) 📝 `docs/components/nav-bar.tsx` (+2 -0) 📝 `docs/components/nav-link.tsx` (+10 -1) 📝 `docs/components/theme-toggle.tsx` (+2 -0) 📝 `docs/content/docs/adapters/community-adapters.mdx` (+1 -0) 📝 `docs/content/docs/concepts/users-accounts.mdx` (+19 -2) 📝 `docs/content/docs/integrations/expo.mdx` (+15 -7) 📝 `docs/content/docs/plugins/anonymous.mdx` (+27 -2) _...and 80 more files_ </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Improved Stripe reliability with organization billing and stronger webhooks. Added verifyPassword, Gumroad OAuth, anonymous user deletion, clearer CSRF vs origin checks, SAML single-assertion validation, and a Prisma update fix. - **New Features** - Added auth.api.verifyPassword for server-side password verification (OpenAPI + docs). - Added Gumroad provider to Generic OAuth (docs updated). - Stripe: organization customers supported (bill by user or organization, with customerType and org stripeCustomerId). - Anonymous: added delete-anonymous-user endpoint (docs updated). - Email Verification: introduced beforeEmailVerification and afterEmailVerification hooks (onEmailVerification deprecated). - Core: added getPlugin API on AuthContext (used by OIDC provider). - **Bug Fixes** - Stripe: centralized error codes, stricter webhook validation, prevent duplicate subscription creation, handle missing subscription items, pass metadata in upgrade, and harden subscriptionSuccess. - Security: separate CSRF and origin checks; filter null/empty values from dynamic trustedOrigins. - Prisma adapter: lift simple eq AND conditions to root on update so unique fields are honored. - Core: detect multiple Better Auth imports and log an error. - Email Verification: enforce correct errors (EMAIL_MISMATCH, EMAIL_ALREADY_VERIFIED) and call hooks correctly; Email OTP calls before/after hooks when override is enabled. - SSO SAML: reject responses containing multiple assertions. - OpenAPI: correctly infer types for ZodDefault fields. - Rate limiter: expire and clean up memory entries. - Redirects: set Location header for social sign-in, account linking, and email sign-in with callbackURL. - MCP: restore ctx.query from cookie in OAuth flow to fix post-login redirect. - One Tap: respect user dismiss reasons to avoid unnecessary retries. - API Key: remove strict length pre-check, standardize INVALID_API_KEY error, and migrate legacy double-stringified metadata. - Passkey: add client-side error logging on verification failures. - Anonymous: prevent cleanup from deleting fresh sessions. - Two-Factor: fix backup code updates (update by id), ensure correct parsing, allow regenerating multiple times, and add missing client endpoints for verification. <sup>Written for commit dd465f34dba6fefa19e83f4a81dccbda83463011. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:09:44 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#24070
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?