fix(auth): complete Better Auth 1.7 migration

Author: Medformatik

apps/api/package.json

@@ -13,7 +13,7 @@
     "db:generate": "drizzle-kit generate",
     "db:push": "drizzle-kit push",
     "db:studio": "drizzle-kit studio",
-    "auth:generate": "npx auth@1.6.25 generate --config ./src/auth.ts --output ./src/db/auth-schema.ts --yes"
+    "auth:generate": "npx auth@1.7.1 generate --config ./src/auth.ts --output ./src/db/auth-schema.ts --yes"
   },
   "keywords": [],
   "author": "",

apps/api/src/auth-oauth-provider.test.ts

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import { getTableColumns } from "drizzle-orm";
+import { getTableConfig } from "drizzle-orm/pg-core";
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 
 const ORIGINAL_SECRET = process.env.BETTER_AUTH_SECRET;
@@ -29,15 +30,29 @@ function policyIdentity(id: string, role: string) {
 
 beforeAll(() => {
   vi.stubEnv("BETTER_AUTH_SECRET", "test-secret-at-least-thirty-two-characters");
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () =>
+      Response.json({
+        issuer: "https://www.openstreetmap.org",
+        authorization_endpoint: "https://www.openstreetmap.org/oauth2/authorize",
+        token_endpoint: "https://www.openstreetmap.org/oauth2/token",
+        userinfo_endpoint: "https://api.openstreetmap.org/api/0.6/user/details.json",
+        jwks_uri: "https://www.openstreetmap.org/oauth2/jwks",
+        id_token_signing_alg_values_supported: ["RS256"],
+      }),
+    ),
+  );
 });
 
 afterAll(() => {
   vi.unstubAllEnvs();
+  vi.unstubAllGlobals();
   if (ORIGINAL_SECRET !== undefined) process.env.BETTER_AUTH_SECRET = ORIGINAL_SECRET;
 });
 
 describe("managed OAuth provider policy", () => {
-  it("pins every runtime Better Auth family to 1.6.26 and the schema CLI to 1.6.25", () => {
+  it("pins every runtime Better Auth package and the schema CLI to 1.7.1", () => {
     const apiManifest = JSON.parse(
       readFileSync(new URL("../package.json", import.meta.url), "utf8"),
     ) as { dependencies: Record<string, string>; scripts: Record<string, string> };
@@ -68,27 +83,42 @@ describe("managed OAuth provider policy", () => {
     const webPackages = ["@better-auth/core", "@better-auth/passkey", "better-auth"];
 
     for (const packageName of apiPackages) {
-      expect(apiManifest.dependencies[packageName]).toBe("1.6.26");
+      expect(apiManifest.dependencies[packageName]).toBe("1.7.1");
       const lockName = packageName.startsWith("@") ? `'${packageName}'` : packageName;
-      expect(apiLock).toContain(`${lockName}:\n        specifier: 1.6.26`);
+      expect(apiLock).toContain(`${lockName}:\n        specifier: 1.7.1`);
     }
     for (const packageName of corePackages) {
-      expect(coreManifest.dependencies[packageName]).toBe("1.6.26");
+      expect(coreManifest.dependencies[packageName]).toBe("1.7.1");
       const lockName = packageName.startsWith("@") ? `'${packageName}'` : packageName;
-      expect(coreLock).toContain(`${lockName}:\n        specifier: 1.6.26`);
+      expect(coreLock).toContain(`${lockName}:\n        specifier: 1.7.1`);
     }
     for (const packageName of webPackages) {
-      expect(webManifest.dependencies[packageName]).toBe("1.6.26");
+      expect(webManifest.dependencies[packageName]).toBe("1.7.1");
       const lockName = packageName.startsWith("@") ? `'${packageName}'` : packageName;
-      expect(webLock).toContain(`${lockName}:\n        specifier: 1.6.26`);
+      expect(webLock).toContain(`${lockName}:\n        specifier: 1.7.1`);
     }
-    expect(apiManifest.scripts["auth:generate"]).toContain("auth@1.6.25 generate");
+    expect(apiManifest.scripts["auth:generate"]).toContain("auth@1.7.1 generate");
     for (const importer of [apiLock, coreLock, webLock]) {
-      expect(importer).not.toContain("@better-auth/core@1.6.25");
-      expect(importer).not.toContain("specifier: ^1.6.25");
+      expect(importer).not.toContain("specifier: 1.6.");
     }
   });
 
+  it("scopes account identity by required issuer and provider account ID", async () => {
+    const { account } = await import("./db/schema");
+    const columns = getTableColumns(account);
+    const config = getTableConfig(account);
+
+    expect(columns.issuer).toMatchObject({ notNull: true });
+    expect(
+      config.indexes.some(
+        (index) =>
+          index.config.unique &&
+          index.config.columns.map((column) => ("name" in column ? column.name : "")).join(",") ===
+            "issuer,account_id",
+      ),
+    ).toBe(true);
+  });
+
   it("exposes every provider table through the application Drizzle schema", async () => {
     const schema = await import("./db/schema");
 
@@ -103,7 +133,7 @@ describe("managed OAuth provider policy", () => {
     );
   });
 
-  it("keeps the exact 1.6.26 two-factor lockout columns emitted by the pinned generator", async () => {
+  it("keeps the generated two-factor lockout columns", async () => {
     const { twoFactor } = await import("./db/schema");
     const columns = getTableColumns(twoFactor);
 
@@ -144,8 +174,7 @@ describe("managed OAuth provider policy", () => {
     expect(managedOAuthProviderOptions).not.toHaveProperty("cachedTrustedClients");
     expect(managedOAuthProviderOptions).not.toHaveProperty("disableJwtPlugin");
     expect(managedOAuthProviderOptions).not.toHaveProperty("storeClientSecret");
-    // Better Auth 1.6's resource-indicator implementation is safe from
-    // cross-audience escalation only with its single default audience.
+    // The provider exposes only its first-party resource configuration.
     expect(managedOAuthProviderOptions).not.toHaveProperty("validAudiences");
     expect(managedOAuthProviderOptions).not.toHaveProperty("customAccessTokenClaims");
   });

apps/api/src/auth.ts

@@ -67,9 +67,9 @@ async function fetchProviderImage(
  * the sync's own guard absorbs that.
  */
 const providerAvatarSync = createProviderAvatarSync({
-  async resolveAccessToken(providerId, userId) {
+  async resolveAccessToken(accountId, userId) {
     try {
-      const result = await auth.api.getAccessToken({ body: { providerId, userId } });
+      const result = await auth.api.getAccessToken({ body: { accountId, userId } });
       return result.accessToken ?? undefined;
     } catch {
       // Revoked, unrefreshable, or undecryptable. The person simply relinks.
@@ -142,14 +142,14 @@ const authOptions = {
     account: {
       create: {
         after: async (account) => {
-          await providerAvatarSync.onAccountCreated(account.providerId, account.userId);
+          await providerAvatarSync.onAccountCreated(account.id, account.providerId, account.userId);
         },
       },
       update: {
         after: async (account) => {
           // Better Auth updates the account on each OAuth sign-in and token
           // refresh; re-read the picture so a changed provider avatar follows.
-          await providerAvatarSync.onAccountUpdated(account.providerId, account.userId);
+          await providerAvatarSync.onAccountUpdated(account.id, account.providerId, account.userId);
         },
       },
     },
@@ -251,6 +251,17 @@ const authOptions = {
         {
           providerId: "openstreetmap",
           discoveryUrl: getOsmConfig().discoveryUrl,
+          // Keep the account namespace and core OAuth endpoints available
+          // when OSM discovery is temporarily unreachable. These values come
+          // from the same deployment-validated OSM origin; profile identity is
+          // still proven by the access token against OSM's user-details API.
+          accountIssuer: new URL(getOsmConfig().webBase).origin,
+          authorizationUrl: getOsmConfig().webUrl("oauth2/authorize"),
+          tokenUrl: getOsmConfig().webUrl("oauth2/token"),
+          // The profile comes from OSM's authenticated user-details endpoint,
+          // not from Better Auth's local user mapping. Pin its immutable OSM
+          // numeric ID explicitly so the 1.7 account subject cannot drift.
+          accountSubject: ({ profile }) => String(profile.id),
           clientId: envString("OSM_CLIENT_ID", ""),
           clientSecret: envString("OSM_CLIENT_SECRET", ""),
           // Ordinary sign-in stays minimal. Contribution write scopes are

apps/api/src/db/auth-schema.ts

@@ -1,5 +1,14 @@
 import { relations } from "drizzle-orm";
-import { boolean, index, integer, jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import {
+  boolean,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+} from "drizzle-orm/pg-core";
 
 export const user = pgTable("user", {
   id: text("id").primaryKey(),
@@ -44,6 +53,7 @@ export const account = pgTable(
   "account",
   {
     id: text("id").primaryKey(),
+    issuer: text("issuer").notNull(),
     accountId: text("account_id").notNull(),
     providerId: text("provider_id").notNull(),
     userId: text("user_id")
@@ -61,7 +71,10 @@ export const account = pgTable(
       .$onUpdate(() => /* @__PURE__ */ new Date())
       .notNull(),
   },
-  (table) => [index("account_userId_idx").on(table.userId)],
+  (table) => [
+    uniqueIndex("account_issuer_accountId_uidx").on(table.issuer, table.accountId),
+    index("account_userId_idx").on(table.userId),
+  ],
 );
 
 export const verification = pgTable(
@@ -128,6 +141,8 @@ export const jwks = pgTable("jwks", {
   privateKey: text("private_key").notNull(),
   createdAt: timestamp("created_at").notNull(),
   expiresAt: timestamp("expires_at"),
+  alg: text("alg"),
+  crv: text("crv"),
 });
 
 export const oauthClient = pgTable(
@@ -136,11 +151,13 @@ export const oauthClient = pgTable(
     id: text("id").primaryKey(),
     clientId: text("client_id").notNull().unique(),
     clientSecret: text("client_secret"),
+    clientDiscoveryId: text("client_discovery_id"),
     disabled: boolean("disabled").default(false),
     skipConsent: boolean("skip_consent"),
     enableEndSession: boolean("enable_end_session"),
     subjectType: text("subject_type"),
     scopes: text("scopes").array(),
+    clientCredentialsScopes: text("client_credentials_scopes").array().default([]),
     userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
     createdAt: timestamp("created_at"),
     updatedAt: timestamp("updated_at"),
@@ -155,18 +172,63 @@ export const oauthClient = pgTable(
     softwareStatement: text("software_statement"),
     redirectUris: text("redirect_uris").array().notNull(),
     postLogoutRedirectUris: text("post_logout_redirect_uris").array(),
+    backchannelLogoutUri: text("backchannel_logout_uri"),
+    backchannelLogoutSessionRequired: boolean("backchannel_logout_session_required"),
     tokenEndpointAuthMethod: text("token_endpoint_auth_method"),
+    applicationType: text("application_type"),
+    jwks: text("jwks"),
+    jwksUri: text("jwks_uri"),
     grantTypes: text("grant_types").array(),
     responseTypes: text("response_types").array(),
-    public: boolean("public"),
-    type: text("type"),
     requirePKCE: boolean("require_pkce"),
+    dpopBoundAccessTokens: boolean("dpop_bound_access_tokens").default(false),
     referenceId: text("reference_id"),
     metadata: jsonb("metadata"),
   },
   (table) => [index("oauthClient_userId_idx").on(table.userId)],
 );
 
+export const oauthResource = pgTable("oauth_resource", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull().unique(),
+  name: text("name").notNull(),
+  accessTokenTtl: integer("access_token_ttl"),
+  refreshTokenTtl: integer("refresh_token_ttl"),
+  signingAlgorithm: text("signing_algorithm"),
+  signingKeyId: text("signing_key_id"),
+  allowedScopes: text("allowed_scopes").array(),
+  customClaims: jsonb("custom_claims"),
+  dpopBoundAccessTokensRequired: boolean("dpop_bound_access_tokens_required").default(false),
+  disabled: boolean("disabled").default(false),
+  createdAt: timestamp("created_at"),
+  updatedAt: timestamp("updated_at"),
+  policyVersion: integer("policy_version").default(1),
+  metadata: jsonb("metadata"),
+});
+
+export const oauthClientResource = pgTable(
+  "oauth_client_resource",
+  {
+    id: text("id").primaryKey(),
+    clientId: text("client_id")
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+    resourceId: text("resource_id")
+      .notNull()
+      .references(() => oauthResource.identifier, { onDelete: "cascade" }),
+    metadata: jsonb("metadata"),
+    createdAt: timestamp("created_at"),
+  },
+  (table) => [
+    uniqueIndex("oauthClientResource_clientId_resourceId_uidx").on(
+      table.clientId,
+      table.resourceId,
+    ),
+    index("oauthClientResource_clientId_idx").on(table.clientId),
+    index("oauthClientResource_resourceId_idx").on(table.resourceId),
+  ],
+);
+
 export const oauthRefreshToken = pgTable(
   "oauth_refresh_token",
   {
@@ -182,16 +244,24 @@ export const oauthRefreshToken = pgTable(
       .notNull()
       .references(() => user.id, { onDelete: "cascade" }),
     referenceId: text("reference_id"),
+    authorizationCodeId: text("authorization_code_id"),
+    resources: text("resources").array(),
+    requestedUserInfoClaims: text("requested_user_info_claims").array(),
     expiresAt: timestamp("expires_at").notNull(),
     createdAt: timestamp("created_at").notNull(),
     revoked: timestamp("revoked"),
+    rotatedAt: timestamp("rotated_at"),
+    rotationReplayResponse: text("rotation_replay_response"),
+    rotationReplayExpiresAt: timestamp("rotation_replay_expires_at"),
     authTime: timestamp("auth_time"),
+    confirmation: jsonb("confirmation"),
     scopes: text("scopes").array().notNull(),
   },
   (table) => [
     index("oauthRefreshToken_clientId_idx").on(table.clientId),
     index("oauthRefreshToken_sessionId_idx").on(table.sessionId),
     index("oauthRefreshToken_userId_idx").on(table.userId),
+    index("oauthRefreshToken_authorizationCodeId_idx").on(table.authorizationCodeId),
   ],
 );
 
@@ -208,17 +278,23 @@ export const oauthAccessToken = pgTable(
     }),
     userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
     referenceId: text("reference_id"),
+    authorizationCodeId: text("authorization_code_id"),
+    resources: text("resources").array(),
+    requestedUserInfoClaims: text("requested_user_info_claims").array(),
     refreshId: text("refresh_id").references(() => oauthRefreshToken.id, {
       onDelete: "cascade",
     }),
     expiresAt: timestamp("expires_at").notNull(),
     createdAt: timestamp("created_at").notNull(),
+    revoked: timestamp("revoked"),
+    confirmation: jsonb("confirmation"),
     scopes: text("scopes").array().notNull(),
   },
   (table) => [
     index("oauthAccessToken_clientId_idx").on(table.clientId),
     index("oauthAccessToken_sessionId_idx").on(table.sessionId),
     index("oauthAccessToken_userId_idx").on(table.userId),
+    index("oauthAccessToken_authorizationCodeId_idx").on(table.authorizationCodeId),
     index("oauthAccessToken_refreshId_idx").on(table.refreshId),
   ],
 );
@@ -232,6 +308,8 @@ export const oauthConsent = pgTable(
       .references(() => oauthClient.clientId, { onDelete: "cascade" }),
     userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
     referenceId: text("reference_id"),
+    resources: text("resources").array(),
+    requestedUserInfoClaims: text("requested_user_info_claims").array(),
     scopes: text("scopes").array().notNull(),
     createdAt: timestamp("created_at").notNull(),
     updatedAt: timestamp("updated_at").notNull(),
@@ -242,6 +320,11 @@ export const oauthConsent = pgTable(
   ],
 );
 
+export const oauthClientAssertion = pgTable("oauth_client_assertion", {
+  id: text("id").primaryKey(),
+  expiresAt: timestamp("expires_at").notNull(),
+});
+
 export const userRelations = relations(user, ({ many }) => ({
   sessions: many(session),
   accounts: many(account),
@@ -288,11 +371,27 @@ export const oauthClientRelations = relations(oauthClient, ({ one, many }) => ({
     fields: [oauthClient.userId],
     references: [user.id],
   }),
+  oauthClientResources: many(oauthClientResource),
   oauthRefreshTokens: many(oauthRefreshToken),
   oauthAccessTokens: many(oauthAccessToken),
   oauthConsents: many(oauthConsent),
 }));
 
+export const oauthResourceRelations = relations(oauthResource, ({ many }) => ({
+  oauthClientResources: many(oauthClientResource),
+}));
+
+export const oauthClientResourceRelations = relations(oauthClientResource, ({ one }) => ({
+  oauthClient: one(oauthClient, {
+    fields: [oauthClientResource.clientId],
+    references: [oauthClient.clientId],
+  }),
+  oauthResource: one(oauthResource, {
+    fields: [oauthClientResource.resourceId],
+    references: [oauthResource.identifier],
+  }),
+}));
+
 export const oauthRefreshTokenRelations = relations(oauthRefreshToken, ({ one, many }) => ({
   oauthClient: one(oauthClient, {
     fields: [oauthRefreshToken.clientId],