diff --git a/.changeset/better-auth-family-stable-1-7.md b/.changeset/better-auth-family-stable-1-7.md new file mode 100644 index 0000000000..8df149cebf --- /dev/null +++ b/.changeset/better-auth-family-stable-1-7.md @@ -0,0 +1,55 @@ +--- +"@objectstack/plugin-auth": patch +"@objectstack/platform-objects": patch +"@objectstack/client": patch +--- + +deps(auth): the better-auth family moves off the `1.7.0-rc.2` prerelease onto stable `^1.7.1` (#3002) + +`@objectstack/plugin-auth` shipped with **exact pins on a release candidate** — +`better-auth`, `@better-auth/core`, `@better-auth/oauth-provider` and +`@better-auth/sso` all at `1.7.0-rc.2`. That pin was never housekeeping debt: it was +the remediation for **GHSA-p2fr-6hmx-4528** (`@better-auth/oauth-provider`) and +**GHSA-j8v8-g9cx-5qf4** (`@better-auth/scim`, high — account/provider takeover), both +patched only in `>=1.7.0-beta.4`, so there was no stable line to move to. Upstream has +now shipped one: `npm view dist-tags` reports `latest: 1.7.1` for every family +member. The declarations become `^1.7.1`, which is what a downstream +`npx create-objectstack` install now resolves. + +**`@better-auth/scim` deliberately stays at `1.7.0-rc.1`.** Measured against the +published stable tarball rather than assumed: `@better-auth/scim@1.7.1` ships the rc.2 +**rewrite** — no `scimProvider` model, no generate-token endpoint, and six replacement +models (`scimUser`, `scimGroup`, `scimGroupMember`, `scimSubject`, +`scimConnectionBinding`, `scimIdentityTombstone`). Adopting it is a feature migration +(ADR-0071, tracked separately), not a version bump. The hold stays security-clean: rc.1 +is above the advisory's fix floor, `pnpm audit --audit-level=high` is green, and rc.1's +peer ranges accept the stable 1.7.1 core the rest of the family resolves to. + +**Three pieces of upstream drift are absorbed here, and one of them was a live +sign-in outage waiting to happen.** + +`1.7.0-rc.2` renamed the account model's `accountId` field to `providerAccountId`; +**stable 1.7.0/1.7.1 renamed it back to `accountId`**, keeping the new required +`issuer`. Carrying the rc.2 spelling into the stable line left the field unmapped, so +better-auth's adapter asked for a column named `accountId` and **every sign-up answered +500** — `Unknown field 'accountId' on object 'sys_account'`. The `account_id` column +itself never changed and no data moves; only the camelCase key does. The same rename +reaches `@objectstack/client`: `auth.accounts.list()` (better-auth's `/list-accounts`) +returns `accountId`, and its declared response type said `providerAccountId`. If you +read that field off the client's typed response, rename it. + +`@better-auth/oauth-provider` 1.7.1's client model writes three fields the platform +object did not answer for. `applicationType` is the OIDC spelling of what rc.2 called +`type`, so it maps onto the **existing** `type` column and no data moves; +`clientDiscoveryId` and `clientCredentialsScopes` are genuinely new and are now +declared on `sys_oauth_application` as `client_discovery_id` and +`client_credentials_scopes`. Without them, dynamic client registration +(`POST /oauth2/register`) fails at the driver. + +Two endpoints are newly mounted by the auth catch-all and are now ledgered: +`POST /oauth2/end-session` and `POST /oauth2/end-session/confirm` — the POST form of +OIDC RP-initiated logout, whose `GET` counterpart was already published. + +**Nothing here needs an action on upgrade.** The new columns are additive and optional, +and the field rename is internal to how the plugin talks to better-auth — with the one +exception of the `@objectstack/client` response type named above. diff --git a/content/docs/permissions/authentication.mdx b/content/docs/permissions/authentication.mdx index 5ae59a1b57..dfe6b32550 100644 --- a/content/docs/permissions/authentication.mdx +++ b/content/docs/permissions/authentication.mdx @@ -1048,17 +1048,26 @@ The plugin bridges this gap using better-auth's official **`modelName` / `fields // Declared in the betterAuth() config via AUTH_*_CONFIG constants: user: { modelName: 'sys_user', fields: { emailVerified: 'email_verified', … } }, session: { modelName: 'sys_session', fields: { userId: 'user_id', expiresAt: 'expires_at', … } }, -account: { modelName: 'sys_account', fields: { providerId: 'provider_id', issuer: 'issuer', providerAccountId: 'account_id', … } }, +account: { modelName: 'sys_account', fields: { providerId: 'provider_id', issuer: 'issuer', accountId: 'account_id', … } }, verification: { modelName: 'sys_verification', fields: { expiresAt: 'expires_at', … } }, ``` -better-auth 1.7 identifies an account by `(issuer, providerAccountId)` — `providerAccountId` is -the field formerly called `accountId` (same `account_id` column) and `issuer` names the authority -that vouched for it: an OIDC `iss` for federated logins, or a synthetic `local:credential` / +better-auth 1.7 identifies an account by `(issuer, accountId)`. `issuer` names the authority +that vouched for the id: an OIDC `iss` for federated logins, or a synthetic `local:credential` / `local:oauth:` for providers that carry none. Rows written before 1.7 have no issuer, so the auth plugin stamps them once at boot; accounts from a federated IdP that is no longer registered cannot be derived and are reported in the boot log instead of guessed. + +The account id field's NAME changed twice inside the 1.7 line, so read it off the version you +run rather than off an older note. The `1.7.0-rc.2` pre-release renamed `accountId` → +`providerAccountId`; the stable `1.7.0` / `1.7.1` releases renamed it **back to `accountId`**, +keeping the new `issuer`. The `account_id` column is the same throughout — only the camelCase +key moved. On stable 1.7 the mapping above, and any `internalAdapter.createAccount({ …, +accountId })` call, must use `accountId`; the rc.2 spelling leaves the field unmapped and every +sign-up answers 500 `Unknown field 'accountId' on object 'sys_account'`. + + The ObjectQL adapter factory (`createObjectQLAdapterFactory`) then uses better-auth's `createAdapterFactory` which automatically transforms all data and where-clauses using these mappings — no manual camelCase ↔ snake_case conversion is needed in the adapter. diff --git a/examples/app-showcase/src/security/demo-personas.ts b/examples/app-showcase/src/security/demo-personas.ts index 6957054c14..11bf927224 100644 --- a/examples/app-showcase/src/security/demo-personas.ts +++ b/examples/app-showcase/src/security/demo-personas.ts @@ -40,7 +40,7 @@ * distinct people, a submitter who is not an approver, an out-of-office * delegation decided under the delegate's own identity — was stuck on it, and * each rediscovered the same non-obvious cause: a password hash is not enough. - * better-auth 1.7 keys accounts on `(issuer, providerAccountId)`, so a + * better-auth 1.7 keys accounts on `(issuer, accountId)`, so a * credential row whose `issuer` is not the local credential issuer is INVISIBLE * to sign-in, which then fails `INVALID_EMAIL_OR_PASSWORD` behind a misleading * "User not found" — pointing at the row, which is fine, instead of at the diff --git a/examples/app-showcase/src/security/seed-approval-demo.ts b/examples/app-showcase/src/security/seed-approval-demo.ts index ff6cb7e162..446ef517f8 100644 --- a/examples/app-showcase/src/security/seed-approval-demo.ts +++ b/examples/app-showcase/src/security/seed-approval-demo.ts @@ -92,7 +92,13 @@ interface AuthContextLike { userId: string; providerId: string; issuer: string; - providerAccountId: string; + /** + * The STABLE better-auth 1.7 spelling. `1.7.0-rc.2` briefly called this + * `providerAccountId` and stable 1.7.0 renamed it back (#3002) — under + * the rc.2 spelling the account row is written with no account id and + * the persona silently stays un-loginable. + */ + accountId: string; password: string; }) => Promise; }; @@ -176,7 +182,7 @@ async function assignPositions( * * ## Why this is read and not written * - * better-auth 1.7 keys account identity on `(issuer, providerAccountId)`: + * better-auth 1.7 keys account identity on `(issuer, accountId)`: * `findAccountByKey` looks a credential up under the issuer better-auth mints * for itself, so a row carrying any other value — or none — is INVISIBLE and * sign-in fails `INVALID_EMAIL_OR_PASSWORD` behind a "User not found" warn that @@ -245,7 +251,7 @@ async function ensureCredentialAccount( userId, providerId: 'credential', issuer, - providerAccountId: userId, + accountId: userId, password: hashed, }); ctx.logger?.info?.('[showcase] approval-demo persona is now loginable', { userId }); diff --git a/packages/client/src/index.ts b/packages/client/src/index.ts index b101435868..6c28d59434 100644 --- a/packages/client/src/index.ts +++ b/packages/client/src/index.ts @@ -2788,10 +2788,14 @@ export class ObjectStackClient { return { accounts: accounts as Array<{ id: string; providerId: string; - /** Authority that vouched for `providerAccountId` — an OIDC issuer, or `local:…`. */ + /** Authority that vouched for `accountId` — an OIDC issuer, or `local:…`. */ issuer: string; - /** The user's id at the provider — better-auth 1.7 renamed this from `accountId`. */ - providerAccountId: string; + /** + * The user's id at the provider. `1.7.0-rc.2` briefly published this + * as `providerAccountId`; stable 1.7 answers with `accountId` again + * (#3002), which is what this route returns today. + */ + accountId: string; createdAt?: string; updatedAt?: string; }> }; diff --git a/packages/platform-objects/src/apps/translations/en.objects.generated.ts b/packages/platform-objects/src/apps/translations/en.objects.generated.ts index 686b9ee47e..e7799f450f 100644 --- a/packages/platform-objects/src/apps/translations/en.objects.generated.ts +++ b/packages/platform-objects/src/apps/translations/en.objects.generated.ts @@ -1228,6 +1228,10 @@ export const enObjects: NonNullable = { label: "Client ID", help: "Public OAuth client identifier" }, + client_discovery_id: { + label: "Client Discovery ID", + help: "Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`" + }, client_secret: { label: "Client Secret", help: "OAuth client secret — stored as a SHA-256 digest, never plaintext (`@better-auth/oauth-provider`'s `storeClientSecret`, which defaults to hashed whenever the jwt plugin is enabled; wired in plugin-auth's `AuthManager.buildPluginList()`, oidcProvider branch). Shown once at registration." @@ -1272,6 +1276,10 @@ export const enObjects: NonNullable = { label: "Allowed Scopes", help: "JSON-serialized list of scopes the client may request" }, + client_credentials_scopes: { + label: "Client-Credentials Scopes", + help: "JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants" + }, subject_type: { label: "Subject Type", help: "OIDC subject type (e.g. public, pairwise)" diff --git a/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts b/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts index 0dcaad4ef2..a97709f92e 100644 --- a/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts +++ b/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts @@ -1228,6 +1228,10 @@ export const esESObjects: NonNullable = { label: "ID de cliente", help: "Identificador público del cliente OAuth." }, + client_discovery_id: { + label: "Client Discovery ID", + help: "Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`" + }, client_secret: { label: "Secreto de cliente", help: "Secreto del cliente OAuth (con hash/cifrado en reposo)." @@ -1272,6 +1276,10 @@ export const esESObjects: NonNullable = { label: "Ámbitos permitidos", help: "Lista serializada en JSON de ámbitos que el cliente puede solicitar." }, + client_credentials_scopes: { + label: "Client-Credentials Scopes", + help: "JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants" + }, subject_type: { label: "Tipo de sujeto", help: "Tipo de sujeto OIDC (p. ej. public, pairwise)." diff --git a/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts b/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts index d14ddd1184..e43ce14b11 100644 --- a/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts +++ b/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts @@ -1228,6 +1228,10 @@ export const jaJPObjects: NonNullable = { label: "クライアント ID", help: "公開 OAuth クライアント識別子" }, + client_discovery_id: { + label: "Client Discovery ID", + help: "Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`" + }, client_secret: { label: "クライアントシークレット", help: "OAuth クライアントシークレット（保存時にハッシュ/暗号化済み）" @@ -1272,6 +1276,10 @@ export const jaJPObjects: NonNullable = { label: "許可スコープ", help: "クライアントがリクエスト可能なスコープの JSON シリアライズリスト" }, + client_credentials_scopes: { + label: "Client-Credentials Scopes", + help: "JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants" + }, subject_type: { label: "サブジェクトタイプ", help: "OIDC サブジェクトタイプ（例: public、pairwise）" diff --git a/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts b/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts index f834c0bcb7..7378653bc2 100644 --- a/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts +++ b/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts @@ -1228,6 +1228,10 @@ export const zhCNObjects: NonNullable = { label: "客户端 ID", help: "公开的 OAuth 客户端标识" }, + client_discovery_id: { + label: "Client Discovery ID", + help: "Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`" + }, client_secret: { label: "客户端密钥", help: "OAuth 客户端密钥（静态存储时会哈希/加密）" @@ -1272,6 +1276,10 @@ export const zhCNObjects: NonNullable = { label: "允许的范围", help: "客户端可申请的 scopes 的 JSON 序列化列表" }, + client_credentials_scopes: { + label: "Client-Credentials Scopes", + help: "JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants" + }, subject_type: { label: "主体类型", help: "OIDC 主体类型（例如 public、pairwise）" diff --git a/packages/platform-objects/src/identity/sys-account.object.ts b/packages/platform-objects/src/identity/sys-account.object.ts index 9dd7e12994..852c6598f8 100644 --- a/packages/platform-objects/src/identity/sys-account.object.ts +++ b/packages/platform-objects/src/identity/sys-account.object.ts @@ -35,7 +35,7 @@ export const SysAccount = ObjectSchema.create({ // this, where `accountId` is the account ROW id (better-auth 1.7 narrowed // the body from the old `{ providerId, accountId }` pair, and `accountId` // no longer means the provider's id for the user — that field is now - // `providerAccountId`). The form is locked to the row's values so it acts + // `accountId`). The form is locked to the row's values so it acts // as a one-click confirmation rather than a free-form edit. // // `link_social` is the self-service counterpart — a toolbar action @@ -306,7 +306,7 @@ export const SysAccount = ObjectSchema.create({ indexes: [ { fields: ['user_id'], unique: false }, { fields: ['provider_id', 'account_id'], unique: true }, - // better-auth 1.7 resolves accounts by (issuer, providerAccountId) and + // better-auth 1.7 resolves accounts by (issuer, accountId) and // declares that pair unique on its own `account` table — mirror it here so // the physical table enforces the same identity key the auth code assumes. { fields: ['issuer', 'account_id'], unique: true }, diff --git a/packages/platform-objects/src/identity/sys-oauth-application.object.ts b/packages/platform-objects/src/identity/sys-oauth-application.object.ts index 853af47f62..05e8b289c1 100644 --- a/packages/platform-objects/src/identity/sys-oauth-application.object.ts +++ b/packages/platform-objects/src/identity/sys-oauth-application.object.ts @@ -315,6 +315,15 @@ export const SysOauthApplication = ObjectSchema.create({ group: 'Credentials', }), + // Added with the stable `@better-auth/oauth-provider` 1.7 line (#3002). + client_discovery_id: Field.text({ + label: 'Client Discovery ID', + required: false, + maxLength: 255, + description: 'Opaque identifier the provider uses to look this client up on the discovery path, kept apart from the public `client_id`', + group: 'Credentials', + }), + client_secret: Field.text({ label: 'Client Secret', required: false, @@ -342,6 +351,11 @@ export const SysOauthApplication = ObjectSchema.create({ group: 'Credentials', }), + // Upstream's `applicationType` (OIDC `application_type`) maps onto this + // column — `1.7.0-rc.2` called the field `type`, stable 1.7 renamed it + // (#3002). The column keeps its name and its data; the rename is absorbed + // by the `applicationType: 'type'` mapping in plugin-auth's + // `auth-schema-config.ts`. type: Field.select(['web', 'native', 'user-agent-based', 'public'], { label: 'Client Type', required: false, @@ -391,6 +405,18 @@ export const SysOauthApplication = ObjectSchema.create({ group: 'Credentials', }), + // Added with the stable `@better-auth/oauth-provider` 1.7 line (#3002). + // The plugin writes these two through the adapter, so without the + // declarations a client registration answers 500 at the driver — the + // failure mode `oauth-provider-schema-parity.test.ts` exists to catch. + client_credentials_scopes: Field.textarea({ + label: 'Client-Credentials Scopes', + required: false, + description: + 'JSON-serialized list of scopes the client may request on the client_credentials grant, where there is no user to consent — kept apart from `scopes`, which governs user-delegated grants', + group: 'Credentials', + }), + subject_type: Field.text({ label: 'Subject Type', required: false, diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index ccb4da0f0f..e784d85f19 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -24,17 +24,17 @@ "typecheck": "tsc --noEmit" }, "dependencies": { - "@better-auth/core": "1.7.0-rc.2", - "@better-auth/oauth-provider": "1.7.0-rc.2", + "@better-auth/core": "^1.7.1", + "@better-auth/oauth-provider": "^1.7.1", "@better-auth/scim": "1.7.0-rc.1", - "@better-auth/sso": "1.7.0-rc.2", + "@better-auth/sso": "^1.7.1", "@noble/hashes": "^2.3.0", "@objectstack/core": "workspace:*", "@objectstack/platform-objects": "workspace:*", "@objectstack/rest": "workspace:*", "@objectstack/spec": "workspace:*", "@objectstack/types": "workspace:*", - "better-auth": "1.7.0-rc.2", + "better-auth": "^1.7.1", "jose": "^6.2.8" }, "devDependencies": { diff --git a/packages/plugins/plugin-auth/src/account-issuer-parity.test.ts b/packages/plugins/plugin-auth/src/account-issuer-parity.test.ts index bf14392cb8..fa3dba8366 100644 --- a/packages/plugins/plugin-auth/src/account-issuer-parity.test.ts +++ b/packages/plugins/plugin-auth/src/account-issuer-parity.test.ts @@ -10,7 +10,7 @@ import { backfillAccountIssuer, oauthIssuerFor } from './backfill-account-issuer /** * Account-issuer parity gate. * - * better-auth 1.7 keys every account on `(issuer, providerAccountId)`, and the + * better-auth 1.7 keys every account on `(issuer, accountId)`, and the * issuer is the PROVIDER's to declare: `resolveOAuthAccountKey` takes * `provider.accountIssuer` when there is one and synthesizes * `local:oauth:` only when there is not. A boot-time backfill that stamps a diff --git a/packages/plugins/plugin-auth/src/admin-user-endpoints.ts b/packages/plugins/plugin-auth/src/admin-user-endpoints.ts index ea2606241c..9deca3bc3e 100644 --- a/packages/plugins/plugin-auth/src/admin-user-endpoints.ts +++ b/packages/plugins/plugin-auth/src/admin-user-endpoints.ts @@ -62,13 +62,17 @@ export interface AuthContextLike { userId: string; providerId: string; /** - * better-auth 1.7 keys accounts on (issuer, providerAccountId) and - * requires both. A local password account carries the synthetic issuer + * better-auth 1.7 keys accounts on (issuer, accountId) and requires + * both. A local password account carries the synthetic issuer * better-auth mints for itself, `local:credential` — write anything else * and the row exists but no sign-in ever finds it. + * + * `accountId` is the STABLE 1.7 spelling. `1.7.0-rc.2` briefly called it + * `providerAccountId` and stable 1.7.0 renamed it back (#3002); the + * rc.2 spelling here would have created accounts with no account id. */ issuer: string; - providerAccountId: string; + accountId: string; password: string; }): Promise; }; @@ -579,7 +583,7 @@ export async function runAdminSetUserPassword( userId, providerId: 'credential', issuer: CREDENTIAL_ISSUER, - providerAccountId: userId, + accountId: userId, password: hashed, }); } diff --git a/packages/plugins/plugin-auth/src/auth-manager.test.ts b/packages/plugins/plugin-auth/src/auth-manager.test.ts index abc904fb1c..29873b7a3d 100644 --- a/packages/plugins/plugin-auth/src/auth-manager.test.ts +++ b/packages/plugins/plugin-auth/src/auth-manager.test.ts @@ -311,10 +311,11 @@ describe('AuthManager', () => { expect(capturedConfig.account.fields).toEqual(expect.objectContaining({ userId: 'user_id', providerId: 'provider_id', - // 1.7 identity key: (issuer, providerAccountId), the latter renamed - // from `accountId` but still living in the `account_id` column. + // 1.7 identity key: (issuer, accountId). The id field kept the + // `account_id` column across the rc.2 `providerAccountId` detour and + // the stable 1.7 rename back (#3002). issuer: 'issuer', - providerAccountId: 'account_id', + accountId: 'account_id', accessToken: 'access_token', refreshToken: 'refresh_token', idToken: 'id_token', diff --git a/packages/plugins/plugin-auth/src/auth-plugin.ts b/packages/plugins/plugin-auth/src/auth-plugin.ts index 2bc04d506d..ad03e27e64 100644 --- a/packages/plugins/plugin-auth/src/auth-plugin.ts +++ b/packages/plugins/plugin-auth/src/auth-plugin.ts @@ -843,7 +843,7 @@ export class AuthPlugin implements Plugin { await this.maybeSeedDevAdmin(ctx); }); - // better-auth 1.7 resolves every account by (issuer, providerAccountId). + // better-auth 1.7 resolves every account by (issuer, accountId). // Rows written before the upgrade have no issuer and are therefore // invisible to sign-in, so stamp them once at boot. Idempotent: a database // whose rows already carry the right issuer costs one empty query. diff --git a/packages/plugins/plugin-auth/src/auth-route-ledger.ts b/packages/plugins/plugin-auth/src/auth-route-ledger.ts index e68203570a..a7d5117d9c 100644 --- a/packages/plugins/plugin-auth/src/auth-route-ledger.ts +++ b/packages/plugins/plugin-auth/src/auth-route-ledger.ts @@ -314,6 +314,13 @@ export const BETTER_AUTH_MOUNTED_SURFACE: readonly string[] = [ 'POST /api/v1/auth/oauth2/create-client', 'POST /api/v1/auth/oauth2/delete-client', 'POST /api/v1/auth/oauth2/delete-consent', + // RP-initiated logout, POST form (OIDC RP-Initiated Logout §3). Added by the + // stable 1.7 line (#3002) as the POST counterpart of the already-mounted + // `GET /api/v1/auth/oauth2/end-session`, plus its confirmation step. Same + // handler and same gating as the GET — the confirm step is what stops a + // cross-site GET from silently ending a session. + 'POST /api/v1/auth/oauth2/end-session', + 'POST /api/v1/auth/oauth2/end-session/confirm', 'POST /api/v1/auth/oauth2/introspect', 'POST /api/v1/auth/oauth2/public-client-prelogin', 'POST /api/v1/auth/oauth2/register', diff --git a/packages/plugins/plugin-auth/src/auth-schema-config.ts b/packages/plugins/plugin-auth/src/auth-schema-config.ts index ac7f92fe28..651ff04b52 100644 --- a/packages/plugins/plugin-auth/src/auth-schema-config.ts +++ b/packages/plugins/plugin-auth/src/auth-schema-config.ts @@ -88,7 +88,7 @@ export const AUTH_SESSION_CONFIG = { * | userId | user_id | * | providerId | provider_id | * | issuer | issuer | - * | providerAccountId | account_id | + * | accountId | account_id | * | accessToken | access_token | * | refreshToken | refresh_token | * | idToken | id_token | @@ -97,19 +97,30 @@ export const AUTH_SESSION_CONFIG = { * | createdAt | created_at | * | updatedAt | updated_at | * - * better-auth 1.7.0-rc.2 restructured account identity: the field formerly - * called `accountId` is now `providerAccountId`, and a new REQUIRED `issuer` - * names the authority that vouched for that id. Every account lookup keys on - * (issuer, providerAccountId) — `findAccountByKey` / `findAccountOwnerByKey` + * better-auth 1.7 restructured account identity by adding a REQUIRED `issuer` + * naming the authority that vouched for the account id. Every account lookup + * keys on (issuer, accountId) — `findAccountByKey` / `findAccountOwnerByKey` * filter on `issuer` — so an unmapped or unstamped `issuer` means sign-in * finds no account at all. * - * `providerAccountId` keeps the existing `account_id` column: same value, - * renamed upstream, so no data moves. `issuer` is a new column, stamped on - * legacy rows by backfillAccountIssuer() at boot (see backfill-account-issuer.ts) - * with the synthetic issuers better-auth mints itself: `local:credential` for - * password accounts and `local:oauth:` for OAuth providers that - * carry no issuer of their own. + * ⚠️ THE FIELD NAME FLIP-FLOPPED ACROSS THE 1.7 PRE-RELEASES, so read it off + * the installed version, never off memory. `1.7.0-rc.2` renamed `accountId` → + * `providerAccountId`; **stable `1.7.0`/`1.7.1` renamed it BACK to + * `accountId`** while keeping `issuer`. Measured on the installed 1.7.1: + * `getAuthTables({}).account.fields` is + * `issuer, accountId, providerId, userId, …` — no `providerAccountId` at all. + * Carrying the rc.2 spelling into the stable line left `accountId` unmapped, + * so the adapter asked for a column named `accountId` and every sign-up + * answered 500 `Unknown field 'accountId' on object 'sys_account'` (#3002). + * `better-auth-schema-parity.test.ts` is the gate that catches exactly this. + * + * `accountId` keeps the existing `account_id` column: same value throughout + * the rename round-trip, so no data ever moved. `issuer` is a new column, + * stamped on legacy rows by backfillAccountIssuer() at boot (see + * backfill-account-issuer.ts) with the synthetic issuers better-auth mints + * itself: `local:credential` for password accounts and + * `local:oauth:` for OAuth providers that carry no issuer of + * their own. */ export const AUTH_ACCOUNT_CONFIG = { modelName: SystemObjectName.ACCOUNT, // 'sys_account' @@ -117,7 +128,7 @@ export const AUTH_ACCOUNT_CONFIG = { userId: 'user_id', providerId: 'provider_id', issuer: 'issuer', - providerAccountId: 'account_id', + accountId: 'account_id', accessToken: 'access_token', refreshToken: 'refresh_token', idToken: 'id_token', @@ -430,6 +441,9 @@ export const AUTH_PHONE_NUMBER_USER_FIELDS = { * |:---------------------------|:--------------------------------| * | clientId | client_id | * | clientSecret | client_secret | + * | clientDiscoveryId | client_discovery_id | + * | clientCredentialsScopes | client_credentials_scopes | + * | applicationType | type | * | skipConsent | skip_consent | * | enableEndSession | enable_end_session | * | subjectType | subject_type | @@ -450,12 +464,31 @@ export const AUTH_PHONE_NUMBER_USER_FIELDS = { * | backchannelLogoutUri | backchannel_logout_uri | * | backchannelLogoutSessionRequired | backchannel_logout_session_required | * | dpopBoundAccessTokens | dpop_bound_access_tokens | + * + * The last three rows arrived with the stable 1.7 line (#3002), and two of + * them are new columns rather than renames: + * + * - `applicationType` is the OIDC `application_type` and is the stable + * spelling of the field `1.7.0-rc.2` called `type` — it maps onto the + * EXISTING `type` column, so no data moves and the column keeps its + * meaning. Left unmapped it resolves to a column named `applicationType`, + * which `sys_oauth_application` does not have. + * - `clientDiscoveryId` and `clientCredentialsScopes` are genuinely new + * upstream fields; both are declared on `sys_oauth_application`. + * + * `oauth-provider-schema-parity.test.ts` is the gate: it resolves every model + * field the way the adapter does (`field.fieldName ?? key`) and fails when the + * resolved column is not declared. A camelCase name in its failure output + * means the mapping is missing, not just the column. */ export const AUTH_OAUTH_CLIENT_SCHEMA = { modelName: SystemObjectName.OAUTH_APPLICATION, // 'sys_oauth_application' fields: { clientId: 'client_id', clientSecret: 'client_secret', + clientDiscoveryId: 'client_discovery_id', + clientCredentialsScopes: 'client_credentials_scopes', + applicationType: 'type', skipConsent: 'skip_consent', enableEndSession: 'enable_end_session', subjectType: 'subject_type', diff --git a/packages/plugins/plugin-auth/src/backfill-account-issuer.ts b/packages/plugins/plugin-auth/src/backfill-account-issuer.ts index a2bdb15c2a..2e853657fe 100644 --- a/packages/plugins/plugin-auth/src/backfill-account-issuer.ts +++ b/packages/plugins/plugin-auth/src/backfill-account-issuer.ts @@ -6,10 +6,9 @@ import { createLocalAccountIssuer, createOAuthAccountIssuer } from '@better-auth * backfillAccountIssuer — stamp `sys_account.issuer` on rows written before * better-auth 1.7. * - * 1.7 restructured account identity: what used to be `account.accountId` is now - * `account.providerAccountId`, and every account carries a REQUIRED `issuer` + * 1.7 restructured account identity: every account carries a REQUIRED `issuer` * naming the authority that vouched for that id. Sign-in resolves accounts with - * `findAccountByKey({ issuer, providerAccountId })`, so a row whose `issuer` is + * `findAccountByKey({ issuer, accountId })`, so a row whose `issuer` is * NULL is invisible to better-auth — the user's password or social link simply * stops resolving. This helper closes that gap at boot, once, in place. * diff --git a/packages/plugins/plugin-auth/src/objectql-adapter.test.ts b/packages/plugins/plugin-auth/src/objectql-adapter.test.ts index 9e47f42510..b9187b0e85 100644 --- a/packages/plugins/plugin-auth/src/objectql-adapter.test.ts +++ b/packages/plugins/plugin-auth/src/objectql-adapter.test.ts @@ -86,15 +86,17 @@ describe('AUTH_*_CONFIG schema mappings', () => { }); }); - // better-auth 1.7 renamed `accountId` → `providerAccountId` and added the - // required `issuer`. Lookups key on (issuer, providerAccountId), so a - // missing mapping here reads as "no such account" on every sign-in. + // better-auth 1.7 added the required `issuer`. Lookups key on + // (issuer, accountId), so a missing mapping here reads as "no such account" + // on every sign-in. The id field's NAME flip-flopped mid pre-release — + // `1.7.0-rc.2` called it `providerAccountId`, stable 1.7 calls it + // `accountId` again (#3002) — which is why it is pinned here. it('should map account camelCase fields to snake_case', () => { expect(AUTH_ACCOUNT_CONFIG.fields).toEqual({ userId: 'user_id', providerId: 'provider_id', issuer: 'issuer', - providerAccountId: 'account_id', + accountId: 'account_id', accessToken: 'access_token', refreshToken: 'refresh_token', idToken: 'id_token', diff --git a/packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts b/packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts index 697a96e68e..909dc0d7f9 100644 --- a/packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts +++ b/packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts @@ -23,7 +23,7 @@ // ## The non-obvious half this file pins // // A password hash is not enough. better-auth 1.7 keys account identity on -// `(issuer, providerAccountId)`, so a credential row whose `issuer` is not the +// `(issuer, accountId)`, so a credential row whose `issuer` is not the // local credential issuer is invisible to `findAccountByKey` — sign-in then // fails `INVALID_EMAIL_OR_PASSWORD` behind a "User not found" warn that points // at the `sys_user` row, which is fine, instead of at the account, which is not. diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ae5e22fb13..d12007ecd8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,17 +10,17 @@ overrides: tar@>=2.0.0 <8.0.0: ^7.5.11 form-data@<5.0.0: '>=4.0.6' undici@>=7.23.0 <8.0.0: ^7.29.0 - better-auth@<1.7.0-rc.2: 1.7.0-rc.2 - '@better-auth/core@<1.7.0-rc.2': 1.7.0-rc.2 + better-auth@<2.0.0: ^1.7.1 + '@better-auth/core@<2.0.0': ^1.7.1 '@better-auth/scim@<1.7.0-rc.1': 1.7.0-rc.1 - '@better-auth/oauth-provider@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/sso@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/drizzle-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/kysely-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/memory-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/mongo-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/prisma-adapter@<1.7.0-rc.2': 1.7.0-rc.2 - '@better-auth/telemetry@<1.7.0-rc.2': 1.7.0-rc.2 + '@better-auth/oauth-provider@<2.0.0': ^1.7.1 + '@better-auth/sso@<2.0.0': ^1.7.1 + '@better-auth/drizzle-adapter@<2.0.0': ^1.7.1 + '@better-auth/kysely-adapter@<2.0.0': ^1.7.1 + '@better-auth/memory-adapter@<2.0.0': ^1.7.1 + '@better-auth/mongo-adapter@<2.0.0': ^1.7.1 + '@better-auth/prisma-adapter@<2.0.0': ^1.7.1 + '@better-auth/telemetry@<2.0.0': ^1.7.1 uuid@<12.0.0: ^11.1.1 postcss@<9.0.0: ^8.5.10 cookie@<0.8.0: ^0.7.0 @@ -930,7 +930,7 @@ importers: version: link:../../types knex: specifier: ^3.3.0 - version: 3.3.0(better-sqlite3@13.0.3) + version: 3.3.0(better-sqlite3@13.0.3)(mysql2@3.23.1(@types/node@26.2.0))(pg@8.22.0)(tedious@18.6.2) mysql2: specifier: ^3.0.0 version: 3.23.1(@types/node@26.2.0) @@ -974,7 +974,7 @@ importers: version: link:../../spec knex: specifier: ^3.3.0 - version: 3.3.0(better-sqlite3@13.0.3) + version: 3.3.0(better-sqlite3@13.0.3)(mysql2@3.23.1(@types/node@26.2.0))(pg@8.22.0)(tedious@18.6.2) nanoid: specifier: ^6.0.1 version: 6.0.1 @@ -1479,17 +1479,17 @@ importers: packages/plugins/plugin-auth: dependencies: '@better-auth/core': - specifier: 1.7.0-rc.2 - version: 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + specifier: ^1.7.1 + version: 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/oauth-provider': - specifier: 1.7.0-rc.2 - version: 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3)) + specifier: ^1.7.1 + version: 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3)) '@better-auth/scim': specifier: 1.7.0-rc.1 - version: 1.7.0-rc.1(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3)) + version: 1.7.0-rc.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3)) '@better-auth/sso': - specifier: 1.7.0-rc.2 - version: 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3)) + specifier: ^1.7.1 + version: 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3)) '@noble/hashes': specifier: ^2.3.0 version: 2.3.0 @@ -1509,8 +1509,8 @@ importers: specifier: workspace:* version: link:../../types better-auth: - specifier: 1.7.0-rc.2 - version: 1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10) + specifier: ^1.7.1 + version: 1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10) jose: specifier: ^6.2.8 version: 6.2.8 @@ -2958,14 +2958,14 @@ packages: resolution: {integrity: sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==} engines: {node: '>=18'} - '@better-auth/core@1.7.0-rc.2': - resolution: {integrity: sha512-NreNGg68j4qUVVYTcC1DtvRTwSJdCavH5igrMyTO5ghZxnzL4G539uRIzOZmJ64MLzOyOwzWH+JHqpVaj0ZRxw==} + '@better-auth/core@1.7.1': + resolution: {integrity: sha512-eZ9lqcnVLMZ3QtUByRo4VZqkB1ESyRddd9NfWjBdDPgh+jcwLScoIUAqhtHLR8zaSUJZah8OLGlkzObyPdUH7A==} peerDependencies: '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 '@cloudflare/workers-types': '>=4' '@opentelemetry/api': ^1.9.0 - better-call: 1.3.7 + better-call: 1.4.0 jose: ^6.1.0 kysely: ^0.28.5 || ^0.29.0 nanostores: ^1.0.1 @@ -2975,55 +2975,55 @@ packages: '@opentelemetry/api': optional: true - '@better-auth/drizzle-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-o6HCC8PCyvg1/BQaNWvJM7kO8svXWvuM++APj7ah+iEfFWcp0yklNQWLijDLu+PAaoKHwNMgDpmclDruirHdPA==} + '@better-auth/drizzle-adapter@1.7.1': + resolution: {integrity: sha512-qlqNyg5V9bXHSP68/vtlsiZayhR4hgvEGiS/E3SIj8bCpWWFGmyQkxJbQCqpBmC7vT30wE/kNtJMHIgnV3rkiw==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0 peerDependenciesMeta: drizzle-orm: optional: true - '@better-auth/kysely-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-g65JeOOseffsqHJXOM0/+SdPvojXzFPejVEFKuUatkdfXcw/l0zEiEkH38Ag5SWFaqfvog/wRPY/MK8PC/ODvg==} + '@better-auth/kysely-adapter@1.7.1': + resolution: {integrity: sha512-yWCpE1cZpMUj37nD6JFDK+GDR8zS37L5WI73il3qbU9TXtWsxUQKc/5c3IHsHizWQsmcQI8uv2pAFKxsRDa+AQ==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 kysely: ^0.28.17 || ^0.29.0 peerDependenciesMeta: kysely: optional: true - '@better-auth/memory-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-ACP69pbSDnIYYcx/KEtRXpFmte6q0Adh3028pRP5aDydkmbcCc7cFiwnRMQuI/MY7aBfW0wefEbcEwOse61Hcg==} + '@better-auth/memory-adapter@1.7.1': + resolution: {integrity: sha512-6NX1yv88DeqdoG7owYFqKwlrDGaIPhsC52JUGrUgeGVKyOq8a/6hHlHsqG1C2FwT23SHQiKVYCEAG9N6aH5OvQ==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 - '@better-auth/mongo-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-/QeC23KheruIamhu4XIqtPLcvupoDXmSpPB9QvmVqQcb5oVjAILJo6kIbZtq/JYbaHjrIO7mpdH6404hyv7weg==} + '@better-auth/mongo-adapter@1.7.1': + resolution: {integrity: sha512-9ILTcNqhG37QK//qR4UhYLyKzNqq6w6zVTf5KX6xkiTjNcV7Oh1yS31lkIJEVTqRNcy9AoV6FZMW6Bbsm8IMDA==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 mongodb: ^6.0.0 || ^7.0.0 peerDependenciesMeta: mongodb: optional: true - '@better-auth/oauth-provider@1.7.0-rc.2': - resolution: {integrity: sha512-fc3jCYwS/PaQyErOPqIUplqK456zhrmNWGnJPhDEF68merXBQN1OodUTzicZ3skFDpAv6MY3m5vk4D1Gz3R/oA==} + '@better-auth/oauth-provider@1.7.1': + resolution: {integrity: sha512-VWIw7ti6rodlbbdSbn0mts/TZcBWUj6YaoIpREmv70eoGmWTa6MPWEbGuUdADQe3Vy4YqysIbmQA6qgRqfLTaw==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - better-auth: ^1.7.0-rc.2 - better-call: 1.3.7 + better-auth: ^1.7.1 + better-call: 1.4.0 - '@better-auth/prisma-adapter@1.7.0-rc.2': - resolution: {integrity: sha512-OFRJbg44ha2zD5lpXIKfoGBEwPe58YBhwIgKlfRuHpsZSpknaXOTvFIH2da8q8SK5L5mjYQ9vSsnX0oOf8gNDA==} + '@better-auth/prisma-adapter@1.7.1': + resolution: {integrity: sha512-ZiUcafQ85InAofcUjyGgCPjKLfQjXr9SvDmMjuFUW8oEbreA6C6GaFAEA77VuV2doZUQlzvQQ4gCoTmS28W92A==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 prisma: ^5.0.0 || ^6.0.0 || ^7.0.0 @@ -3036,30 +3036,33 @@ packages: '@better-auth/scim@1.7.0-rc.1': resolution: {integrity: sha512-pcnliU2eewYq2SF4cRDn1XvQ2I7+WhufoDv5lx9yH7fmrfsU6mYQpZX3mu2Fj/AFCHauCI7Ld617pnz5+yTtOw==} peerDependencies: - '@better-auth/core': 1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 - better-auth: 1.7.0-rc.2 + better-auth: ^1.7.1 better-call: 1.3.7 - '@better-auth/sso@1.7.0-rc.2': - resolution: {integrity: sha512-vn+WjTNMYWKX/jrrSCekv8Aia7uuhBlFcgUcwJpbSxCvD67uyNhN0W48ob+NKKY2vlT4nrDVESP2csxUXyUmtw==} + '@better-auth/sso@1.7.1': + resolution: {integrity: sha512-fkGNMO8W5uNJSHAlvSe4Gxm1NVTQT4JFS7JpCNIxUAl5UyskE1yFXc2NH0KjcvSbR1RfgrqUgUevOjOjcSUKcg==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - better-auth: ^1.7.0-rc.2 - better-call: 1.3.7 + better-auth: ^1.7.1 + better-call: 1.4.0 - '@better-auth/telemetry@1.7.0-rc.2': - resolution: {integrity: sha512-sSZ+/FkG/axBjXVeF01LT+NQjT23TLwRwpdkcI8FJBWINNUCYhuxgdi05dv70MeX8iocfMhKxQ4EPgvt/eW/kQ==} + '@better-auth/telemetry@1.7.1': + resolution: {integrity: sha512-kLKjMfFlTbyt49DGeI9okHAsn0MtBZcMoQYKaEdgR0H3BHzqqyzePcQz/hxAmRgjB4p/6inise3zJwhX0sgXrQ==} peerDependencies: - '@better-auth/core': ^1.7.0-rc.2 + '@better-auth/core': ^1.7.1 '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 '@better-auth/utils@0.4.2': resolution: {integrity: sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==} + '@better-auth/utils@0.5.0': + resolution: {integrity: sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA==} + '@better-fetch/fetch@1.3.1': resolution: {integrity: sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==} @@ -4026,10 +4029,6 @@ packages: cpu: [x64] os: [win32] - '@noble/ciphers@2.2.0': - resolution: {integrity: sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA==} - engines: {node: '>= 20.19.0'} - '@noble/ciphers@2.3.0': resolution: {integrity: sha512-Clu/xdfgVTf9o7ngLOURaxePwR0j8sjclKEtVij10/jGulwFsPWCvvRgG/XjUVf8Nei+jLG6uwyXzUTGY1DQrw==} engines: {node: '>= 20.19.0'} @@ -5214,6 +5213,10 @@ packages: engines: {node: '>=10.0.0'} deprecated: this version has critical issues, please update to the latest version + '@xmldom/xmldom@0.9.11': + resolution: {integrity: sha512-tW8bcK3hsG0/uqSnNz6TK4BkcuZSezoU7DlnYssILmZDktPnSHHuDJJFM0AJv+13gz2r0iGdrj6qqKeUnxXEDg==} + engines: {node: '>=14.6'} + '@yuku-analyzer/binding-android-arm64@0.8.7': resolution: {integrity: sha512-pzJ++UMCZEV4s6SP3Ryvj+snWP8s7aTXFkSXRyeBF4RSALftPzfqYssHdGOmOH2QnRAtyOhhg64tdjeSGJvYRg==} cpu: [arm64] @@ -5465,8 +5468,8 @@ packages: engines: {node: '>=6.0.0'} hasBin: true - better-auth@1.7.0-rc.2: - resolution: {integrity: sha512-5KZrqbAsoQA8q1edmufaoF/CBbMjGb/BoPqyMTzXFyDeXNhk8pXO2xJkiDDeZcSGtyhUKXiDnD7hxh4sJVgYZw==} + better-auth@1.7.1: + resolution: {integrity: sha512-g8WlTQijxXWJjPVZfFu1+EJg9cwwHrKDmIkcYMzx8CzYA+tDxl6NI7qQbKkbgw5UtHILsT5VH+RMzFzwnVJqAg==} peerDependencies: '@lynx-js/react': '*' '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0 @@ -5475,7 +5478,7 @@ packages: '@tanstack/solid-start': ^1.0.0 better-sqlite3: ^12.0.0 drizzle-kit: '>=0.31.4 || >=1.0.0-beta.1' - drizzle-orm: ^0.45.2 + drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0 mongodb: ^6.0.0 || ^7.0.0 mysql2: ^3.0.0 next: ^14.0.0 || ^15.0.0 || ^16.0.0 @@ -5527,8 +5530,8 @@ packages: vue: optional: true - better-call@1.3.7: - resolution: {integrity: sha512-Al51/hjp2SSp6CRTa3F2ptcx4yQVS1xWKoY6jcVXqNYOap6mHFP2jUBn5EwIL4iIed1/Sq4hlQ+Umm6EflZG+w==} + better-call@1.4.0: + resolution: {integrity: sha512-bBKOT4vv1kZLDgxVePdilk/Jwkn+dtRRsmi3DzHcDP+WnswyVl6dR59l2HEeP/0cB+bDoopASAesWDPIdd/zZA==} peerDependencies: zod: ^4.0.0 peerDependenciesMeta: @@ -8281,8 +8284,8 @@ packages: engines: {node: '>=18.0.0', npm: '>=8.0.0'} hasBin: true - rou3@0.7.12: - resolution: {integrity: sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==} + rou3@0.9.2: + resolution: {integrity: sha512-3SOzvaAg8rkHrXtRjpCvCvbyO5to9oOO27Z/XqHEYXfMRVSw/qMIVdmaOk9W2lcRLtR6dlqTjo9hDeJk70QBYQ==} roughjs@4.6.6: resolution: {integrity: sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ==} @@ -9481,13 +9484,13 @@ snapshots: '@bcoe/v8-coverage@1.0.2': {} - '@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0)': + '@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0)': dependencies: '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 '@opentelemetry/semantic-conventions': 1.43.0 '@standard-schema/spec': 1.1.0 - better-call: 1.3.7(zod@4.4.3) + better-call: 1.4.0(zod@4.4.3) jose: 6.2.8 kysely: 0.29.4 nanostores: 1.4.0 @@ -9496,69 +9499,70 @@ snapshots: '@cloudflare/workers-types': 4.20260520.1 '@opentelemetry/api': 1.9.1 - '@better-auth/drizzle-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': + '@better-auth/drizzle-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 - '@better-auth/kysely-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(kysely@0.29.4)': + '@better-auth/kysely-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(kysely@0.29.4)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 optionalDependencies: kysely: 0.29.4 - '@better-auth/memory-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': + '@better-auth/memory-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 - '@better-auth/mongo-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(mongodb@7.5.0(socks@2.8.9))': + '@better-auth/mongo-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(mongodb@7.5.0(socks@2.8.9))': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 optionalDependencies: mongodb: 7.5.0(socks@2.8.9) - '@better-auth/oauth-provider@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3))': + '@better-auth/oauth-provider@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3))': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - better-auth: 1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10) - better-call: 1.3.7(zod@4.4.3) + better-auth: 1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10) + better-call: 1.4.0(zod@4.4.3) jose: 6.2.8 zod: 4.4.3 - '@better-auth/prisma-adapter@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': + '@better-auth/prisma-adapter@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 - '@better-auth/scim@1.7.0-rc.1(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3))': + '@better-auth/scim@1.7.0-rc.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3))': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 - better-auth: 1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10) - better-call: 1.3.7(zod@4.4.3) + better-auth: 1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10) + better-call: 1.4.0(zod@4.4.3) zod: 4.4.3 - '@better-auth/sso@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.3.7(zod@4.4.3))': + '@better-auth/sso@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10))(better-call@1.4.0(zod@4.4.3))': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - better-auth: 1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10) - better-call: 1.3.7(zod@4.4.3) + '@xmldom/xmldom': 0.9.11 + better-auth: 1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10) + better-call: 1.4.0(zod@4.4.3) fast-xml-parser: 5.10.1 jose: 6.2.8 samlify: 2.13.1 tldts: 7.4.9 zod: 4.4.3 - '@better-auth/telemetry@1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)': + '@better-auth/telemetry@1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)': dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 @@ -9566,6 +9570,10 @@ snapshots: dependencies: '@noble/hashes': 2.3.0 + '@better-auth/utils@0.5.0': + dependencies: + '@noble/hashes': 2.3.0 + '@better-fetch/fetch@1.3.1': {} '@braintree/sanitize-url@7.1.2': {} @@ -10375,8 +10383,6 @@ snapshots: '@next/swc-win32-x64-msvc@16.3.1': optional: true - '@noble/ciphers@2.2.0': {} - '@noble/ciphers@2.3.0': {} '@noble/hashes@2.3.0': {} @@ -11525,6 +11531,8 @@ snapshots: '@xmldom/xmldom@0.8.13': {} + '@xmldom/xmldom@0.9.11': {} + '@yuku-analyzer/binding-android-arm64@0.8.7': optional: true @@ -11734,20 +11742,20 @@ snapshots: baseline-browser-mapping@2.11.14: {} - better-auth@1.7.0-rc.2(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10): + better-auth@1.7.1(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.11.1)(mongodb@7.5.0(socks@2.8.9))(mysql2@3.23.3(@types/node@26.2.0))(next@16.3.1(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@26.2.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(svelte@5.56.9(@typescript-eslint/types@8.67.0))(vitest@4.1.10): dependencies: - '@better-auth/core': 1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) - '@better-auth/drizzle-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) - '@better-auth/kysely-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(kysely@0.29.4) - '@better-auth/memory-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) - '@better-auth/mongo-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(mongodb@7.5.0(socks@2.8.9)) - '@better-auth/prisma-adapter': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) - '@better-auth/telemetry': 1.7.0-rc.2(@better-auth/core@1.7.0-rc.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1) + '@better-auth/core': 1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0) + '@better-auth/drizzle-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) + '@better-auth/kysely-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(kysely@0.29.4) + '@better-auth/memory-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) + '@better-auth/mongo-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(mongodb@7.5.0(socks@2.8.9)) + '@better-auth/prisma-adapter': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2) + '@better-auth/telemetry': 1.7.1(@better-auth/core@1.7.1(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@cloudflare/workers-types@4.20260520.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.8)(kysely@0.29.4)(nanostores@1.4.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1) '@better-auth/utils': 0.4.2 '@better-fetch/fetch': 1.3.1 - '@noble/ciphers': 2.2.0 + '@noble/ciphers': 2.3.0 '@noble/hashes': 2.3.0 - better-call: 1.3.7(zod@4.4.3) + better-call: 1.4.0(zod@4.4.3) defu: 6.1.7 jose: 6.2.8 kysely: 0.29.4 @@ -11767,11 +11775,11 @@ snapshots: - '@cloudflare/workers-types' - '@opentelemetry/api' - better-call@1.3.7(zod@4.4.3): + better-call@1.4.0(zod@4.4.3): dependencies: - '@better-auth/utils': 0.4.2 + '@better-auth/utils': 0.5.0 '@better-fetch/fetch': 1.3.1 - rou3: 0.7.12 + rou3: 0.9.2 set-cookie-parser: 3.1.2 optionalDependencies: zod: 4.4.3 @@ -13379,7 +13387,7 @@ snapshots: khroma@2.1.0: {} - knex@3.3.0(better-sqlite3@13.0.3): + knex@3.3.0(better-sqlite3@13.0.3)(mysql2@3.23.1(@types/node@26.2.0))(pg@8.22.0)(tedious@18.6.2): dependencies: colorette: 2.0.19 commander: 10.0.1 @@ -13397,6 +13405,9 @@ snapshots: tildify: 2.0.0 optionalDependencies: better-sqlite3: 13.0.3 + mysql2: 3.23.1(@types/node@26.2.0) + pg: 8.22.0 + tedious: 18.6.2 transitivePeerDependencies: - supports-color @@ -14908,7 +14919,7 @@ snapshots: '@rollup/rollup-win32-x64-msvc': 4.62.2 fsevents: 2.3.3 - rou3@0.7.12: {} + rou3@0.9.2: {} roughjs@4.6.6: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index d56d7c9832..fe34a04edd 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -40,9 +40,12 @@ onlyBuiltDependencies: # because that is where semver's compatibility break actually falls. # `scripts/check-override-consistency.mjs` reports (never fails on) any entry # that drifts back into the old shape. Two carve-outs deliberately keep it: -# the better-auth pre-release family (a compat pin, not an OSV floor — it is -# retired wholesale when 1.7.0 stable ships) and the three zero-consumer pins -# awaiting a #5835-style ruling (@tootallnate/once, react-router, @sveltejs/kit). +# `@better-auth/scim` alone — the rest of the better-auth family was retired to +# the stable `^1.7.1` line with major-boundary bounds when 1.7.0 shipped (#3002), +# and scim's bound MUST stay at the pinned rc, because a `<2.0.0` bound would +# rewrite the stable release DOWN onto the rc it is deliberately held at (#3653) +# — and the three zero-consumer pins awaiting a #5835-style ruling +# (@tootallnate/once, react-router, @sveltejs/kit). # - esbuild: GHSA-gv7w-rqvm-qjhr (high). tsup/tsx/vite pulled 0.27.7 / 0.28.0 # (< 0.28.1); force the patched line everywhere. # - form-data: GHSA-hmw2-7cc7-3qxx (high) — CRLF injection via unescaped @@ -77,36 +80,52 @@ onlyBuiltDependencies: # 8.9.0 is a different major and stays outside, unaffected. Kept as # defense-in-depth on the same reasoning as form-data above. # - @better-auth/scim: GHSA-j8v8-g9cx-5qf4 (high) — account/provider -# takeover. The advisory is patched only in >=1.7.0-beta.4 — there is NO -# stable patched release yet (npm `latest` is still on the 1.6.x line), so -# a pre-release pin is what clears the CI audit gate; revert to a stable -# `^1.7.x` line the moment one ships. -# Held at 1.7.0-rc.1 while the rest of the family moves to rc.2: rc.2 is a -# ground-up rewrite of this plugin — the `scimProvider` model and its -# generate-token endpoint are gone, replaced by code-defined connections -# plus six new models (scimUser, scimGroup, scimGroupMember, scimSubject, -# scimConnectionBinding, scimIdentityTombstone). Adopting it means new -# platform objects, retiring `sys_scim_provider`, and a new way for a -# tenant to register a connection — a feature migration (ADR-0071), not a -# version bump. rc.1's peer range accepts rc.2 core, and it still carries -# the advisory fix. +# takeover, patched only in >=1.7.0-beta.4. THE ONLY MEMBER OF THE FAMILY +# STILL ON A PRE-RELEASE, and deliberately so. +# Stable 1.7.0/1.7.1 have now shipped, and measured against the published +# 1.7.1 tarball they ship the rc.2 REWRITE, not the rc.1 shape: no +# `scimProvider` model and no generate-token endpoint (0 occurrences in +# `dist/index.mjs`), replaced by code-defined connections plus six new +# models (scimUser, scimGroup, scimGroupMember, scimSubject, +# scimConnectionBinding, scimIdentityTombstone — all six present). So +# moving this pin is still the ADR-0071 feature migration tracked by #3653 +# (new platform objects, retiring `sys_scim_provider`, a new way for a +# tenant to register a connection) — NOT the version bump #3002 did for the +# rest of the family. Holding here stays security-clean: rc.1 is above the +# >=1.7.0-beta.4 fix floor, and rc.1's peer ranges (`better-auth` and +# `@better-auth/core` at `^1.7.0-rc.1`) are satisfied by the stable 1.7.1 +# the family now resolves to. +# KNOWN SKEW while this hold lasts: scim rc.1 peers `better-call@1.3.7` +# while better-auth 1.7.1 depends on `better-call@1.4.0`, so the tree +# carries two copies. Measured green on the plugin-auth suite; it retires +# with #3653. +# `scripts/check-prerelease-pin-watch.mjs` keeps watching this pin (it is +# now the only entry on its watch list) so #3653 has a producer. # - @better-auth/oauth-provider: GHSA-p2fr-6hmx-4528 — same better-auth # monorepo and same situation as @better-auth/scim above. The fix first -# ships in the 1.7.0 pre-release line. Pin to 1.7.0-rc.2. The 1.7 -# oauth-provider is exercised on the sign-in path and imports symbols -# (e.g. CLIENT_ASSERTION_TYPE) that only exist in @better-auth/core 1.7.x, -# so the ENTIRE better-auth family must move to 1.7.0-rc.2 together — -# mixing a 1.7 plugin with 1.6.x core throws "Cannot set properties of -# undefined (setting 'modelName')" during better-auth init and 500s every -# auth endpoint at runtime, and mixing rc.2 with rc.1 is the same class of -# hazard. The full family is pinned below; revert all of them to a stable -# `^1.7.x` line the moment one ships. +# shipped in the 1.7.0 pre-release line; it is now in stable 1.7.x, and +# #3002 moved this pin (and the whole family bar scim) off `1.7.0-rc.2` +# onto `^1.7.1` — npm `latest` for every family member is 1.7.1, verified +# by `npm view dist-tags`. The 1.7 oauth-provider is exercised on the +# sign-in path and imports symbols (e.g. CLIENT_ASSERTION_TYPE) that only +# exist in @better-auth/core 1.7.x, so the ENTIRE family must stay on ONE +# line — mixing a 1.7 plugin with 1.6.x core throws "Cannot set properties +# of undefined (setting 'modelName')" during better-auth init and 500s +# every auth endpoint at runtime. That is now cheap to hold: `better-auth` +# itself declares EXACT dependencies on the rest of the family +# (`@better-auth/core`, the five adapters, telemetry all at 1.7.1), so one +# stable range on the root drags the family with it. +# The pins are kept rather than dropped because two of them +# (oauth-provider, scim) are OSV floors: a transitive reintroduction must +# land on the patched line, and dropping a security pin is its own +# decision, not a rider on a version bump (same reasoning as form-data / +# undici above). # IMPORTANT: these overrides do NOT ship with published packages — a # downstream `npx create-objectstack` install resolves plugin-auth's own -# declared ranges. plugin-auth therefore pins the same exact 1.7.0-rc.2 in -# its dependencies (a `^1.6.23` range there resolved to the broken 1.6.23 -# mix and 500'd every fresh 15.1.0 project). Keep both in sync — CI -# enforces this via scripts/check-override-consistency.mjs. +# declared ranges. plugin-auth therefore declares the same `^1.7.1` in its +# dependencies (a `^1.6.23` range there resolved to the broken 1.6.23 mix +# and 500'd every fresh 15.1.0 project). Keep both in sync — CI enforces +# this via scripts/check-override-consistency.mjs. # - uuid: GHSA-w5hq-g745-h8pq (high) — pulled 8.3.2 transitively; the fix # first lands in 11.1.1. Pin to the ^11.1.1 LTS line (uuid `legacy-11` # dist-tag) rather than the latest major to keep the jump conservative. @@ -132,20 +151,24 @@ overrides: 'form-data@<5.0.0': '>=4.0.6' 'undici@>=7.23.0 <8.0.0': '^7.29.0' # better-auth family — kept on one line (see @better-auth/oauth-provider note). - 'better-auth@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/core@<1.7.0-rc.2': '1.7.0-rc.2' - # scim is deliberately held one pre-release BEHIND the rest of the family — - # see the @better-auth/scim note above. Do not "align" it without doing the - # connection/credential migration first. + # Off the 1.7.0-rc.2 prerelease and onto the stable line (#3002). Bounds sit + # at the MAJOR boundary, so a future advisory lift moves only the target. + 'better-auth@<2.0.0': '^1.7.1' + '@better-auth/core@<2.0.0': '^1.7.1' + # scim is deliberately held on the 1.7.0-rc.1 PRE-RELEASE, one line behind the + # rest of the family — see the @better-auth/scim note above. Stable 1.7.x + # ships the rc.2 rewrite, so adopting it is the ADR-0071 migration (#3653), + # not this bump. Its bound stays AT the rc on purpose: a major-boundary bound + # here would rewrite the stable release down onto the rc. '@better-auth/scim@<1.7.0-rc.1': '1.7.0-rc.1' - '@better-auth/oauth-provider@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/sso@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/drizzle-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/kysely-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/memory-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/mongo-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/prisma-adapter@<1.7.0-rc.2': '1.7.0-rc.2' - '@better-auth/telemetry@<1.7.0-rc.2': '1.7.0-rc.2' + '@better-auth/oauth-provider@<2.0.0': '^1.7.1' + '@better-auth/sso@<2.0.0': '^1.7.1' + '@better-auth/drizzle-adapter@<2.0.0': '^1.7.1' + '@better-auth/kysely-adapter@<2.0.0': '^1.7.1' + '@better-auth/memory-adapter@<2.0.0': '^1.7.1' + '@better-auth/mongo-adapter@<2.0.0': '^1.7.1' + '@better-auth/prisma-adapter@<2.0.0': '^1.7.1' + '@better-auth/telemetry@<2.0.0': '^1.7.1' 'uuid@<12.0.0': '^11.1.1' 'postcss@<9.0.0': '^8.5.10' 'cookie@<0.8.0': '^0.7.0' diff --git a/scripts/check-prerelease-pin-watch.mjs b/scripts/check-prerelease-pin-watch.mjs index 7eed77c9ec..c314890857 100644 --- a/scripts/check-prerelease-pin-watch.mjs +++ b/scripts/check-prerelease-pin-watch.mjs @@ -18,9 +18,12 @@ // // revert to a stable `^1.7.x` line the moment one ships. // -// Two issues are gated on exactly that event — #3002 (revert the family to a -// stable `^1.7.x`) and #3653 (the SCIM migration, which #3653 explicitly defers -// until `@better-auth/scim` ships a non-rc release). Neither had a PRODUCER: +// Two issues were gated on exactly that event — #3002 (revert the family to a +// stable `^1.7.x`, done: the family is on `^1.7.1` and only `@better-auth/scim` +// is still pinned to a prerelease) and #3653 (the SCIM migration, which #3653 +// explicitly defers until `@better-auth/scim` ships a non-rc release — it has, +// and it ships the rc.2 rewrite, so #3653 is now the live card). Neither had a +// PRODUCER: // nothing anywhere watched npm, so redeeming the promise depended on somebody // remembering to look. That is the repo's standard `declared != enforced` shape, // applied to a promise in a comment — and every extra day on a prerelease is @@ -28,7 +31,7 @@ // commitment. // // This is the producer. It is a WATCHER, not a fixer: it never edits a pin. Its -// entire job is to make the trigger condition of #3002 / #3653 arrive as an +// entire job is to make the trigger condition of those cards arrive as an // automatic signal within a day of the release, instead of as a memory. // // THE WATCH LIST IS DERIVED, NOT DECLARED @@ -60,7 +63,7 @@ // Two shapes of hit are reported apart, because the remedy differs: // // in-line a stable release inside the pinned line (`1.7.x`) — the exact -// trigger #3002 / #3653 wrote down. Mechanical: move the pin. +// trigger those cards wrote down. Mechanical: move the pin. // later a stable release only in a HIGHER line (`1.8.0`+) while the // pinned line never stabilized. Also gets us off the prerelease, // but crossing a minor is a decision, not a bump. Reported as its @@ -75,7 +78,7 @@ // thing it was built to replace: // // 0 WAITING every watched pin was read; no stable release yet. Quiet. -// 1 AVAILABLE a stable release exists. Loud; names #3002 / #3653. +// 1 AVAILABLE a stable release exists. Loud; names the follow-up card. // 2 UNKNOWN at least one registry read failed; no hit among the rest. // // Exit 2 is deliberately NOT exit 1. Unlike `check:objectui-pin-fresh` — a @@ -137,19 +140,24 @@ const FOLLOW_UPS = [ // stable release triggers a migration rather than a bump — rc.2 replaced the // whole SCIM model set, so #3653 defers the work to the stable release. match: /^@better-auth\/scim$/, - issues: ['#3002', '#3653'], + issues: ['#3653'], note: 'SCIM is a MIGRATION, not a bump (#3653): rc.2 replaced the model set and moved ' + - 'connections from runtime rows to boot config. Do the migration against the STABLE ' + - 'models — do not "align" this pin with the family first.', + 'connections from runtime rows to boot config, and the STABLE 1.7 releases ship that ' + + 'same rewrite (measured on the 1.7.1 tarball: no scimProvider model, no generate-token ' + + 'endpoint, all six new models present). Do the migration against the stable models — ' + + 'do not "align" this pin with the family first. #3002 moved the REST of the family to ' + + 'stable ^1.7.1 and left this pin behind deliberately, so #3653 is the only card left.', }, { match: /^(better-auth|@better-auth\/.+)$/, - issues: ['#3002'], + issues: ['#3653'], note: 'The family moves together (mixing a 1.7 plugin with 1.6 core throws during init and ' + - "500s every auth endpoint). #3002 carries the action list; plugin-auth's own exact " + - 'declarations must move in the same PR — `check:override-consistency` holds them to it.', + "500s every auth endpoint). plugin-auth's own declarations must move in the SAME PR — " + + '`check:override-consistency` holds them to it. The family is on stable `^1.7.1` since ' + + '#3002, so a family member showing up here again means a NEW prerelease pin was added; ' + + 'read the pin\'s own comment in pnpm-workspace.yaml for why, and file a card for it.', }, ]; @@ -606,14 +614,13 @@ function selfTest() { watch.find((w) => w.name === 'better-auth')?.base === '1.7.0', ); check( - 'scim carries BOTH follow-up issues (#3002 and #3653)', - ['#3002', '#3653'].every((i) => - watch.find((w) => w.name === '@better-auth/scim').followUp.issues.includes(i), - ), + 'scim carries the migration card (#3653) and names it a MIGRATION', + watch.find((w) => w.name === '@better-auth/scim').followUp.issues.join() === '#3653' && + watch.find((w) => w.name === '@better-auth/scim').followUp.note.includes('MIGRATION'), ); check( - 'the rest of the family carries #3002', - watch.find((w) => w.name === 'better-auth').followUp.issues.join() === '#3002', + 'the rest of the family carries a follow-up card too', + watch.find((w) => w.name === 'better-auth').followUp.issues.join() === '#3653', ); check( 'a prerelease pin with no declared follow-up is watched anyway (unmapped is legal)', @@ -686,7 +693,7 @@ function selfTest() { // --- 5. the reports say what they must ---------------------------------- const hitText = render(evaluate([judge(entry, { versions: ['1.7.0'], distTags: {} })])); - check('the AVAILABLE report names #3002', hitText.includes('#3002'), hitText); + check('the AVAILABLE report names its follow-up card', hitText.includes('#3653'), hitText); check( 'the AVAILABLE report names the remedy (revert to ^1.7.x)', hitText.includes('^1.7.x'), @@ -792,7 +799,7 @@ function selfTest() { check('CLI exits 1 when a stable release exists', hitRun.code === 1, `code ${hitRun.code}`); check( 'the hit run emits ::error:: naming the follow-up issue', - hitRun.out.includes('::error::') && hitRun.out.includes('#3002'), + hitRun.out.includes('::error::') && hitRun.out.includes('#3653'), hitRun.out, ); @@ -843,7 +850,7 @@ function selfTest() { 'JSON carries the verdict, the per-package rows and the issue list', parsed.verdict === 'available' && parsed.packages.length === 3 && - parsed.issues.join(',') === '#3002,#3653', + parsed.issues.join(',') === '#3653', jsonRun.stdout, ); check( diff --git a/scripts/check-type-check-coverage.mjs b/scripts/check-type-check-coverage.mjs index 268a79f2c9..2e75ee9278 100644 --- a/scripts/check-type-check-coverage.mjs +++ b/scripts/check-type-check-coverage.mjs @@ -729,7 +729,7 @@ const TEST_DEBT = { + '(#5278 option A).', }, '@objectstack/plugin-auth': { - errors: 111, + errors: 110, note: 'TS2493 x42 (tuple index out of range), TS18048 x24, TS2740 x19, TS2322 x11, TS2532 x9, ' + 'TS2339 x8, TS2741 x8. Lowered 131 -> 111 at b16dcb45 (#7888); the intermediate 108 in this PR\'s ' + 'first commit was measured at b5e09b21 and was already stale when the merge queue built it -- the '