GeezerVison

Summary

Moves better-auth, @better-auth/oauth-provider, @better-auth/sso, @better-auth/stripe (and packages/auth) from 1.6.27 to 1.7.12. 1.7.7+ fixes the magic-link, OAuth-proxy, device-authorization and DB rate-limit advisories (not reachable today, but 1.6 gets no fixes). Each 1.7 behavior change Sim depends on is adapted, following the 1.7 upgrade guide.

Dependencies

• @better-auth/core calls z.validate (zod 4.5+); the root override keeps zod at 4.3.6, so every sign-in would throw. Version-pinned patch restores 1.6's safeParse form (documented in patches/README.md)
• Dropped the global @xmldom/xmldom 0.8.15 override: sso 1.7 needs 0.9.12 (onError), while samlify/xml-crypto/mammoth/officeparser/plist keep 0.8.15 (0.9 throws without a MIME type)
• Removed the obsolete oauth-provider 1.6.27 resource patch

Social sign-in

• Microsoft accounts stay keyed by the ID token's sub: 1.7's provider keys by oid, so every existing Microsoft user would miss their account and fall to email linking, which Microsoft passes only for verified domains (account_not_linked)

Integration connectors (generic OAuth lost its /oauth2/* endpoints)

• Registered /api/auth/oauth2/callback/:id URIs are forwarded to core /callback/:id — no provider re-registration
• Client links via linkSocial; custom getToken keeps the registered redirect URI; Google connectors use explicit endpoints instead of discovery; scope rewrites moved into the token exchange; reserved authorize params (scope, nonce) passed as options; pkce: false kept explicit where 1.6 had it off
• Connector callbacks only complete an authenticated link and never sign up/in a user (core doesn't bind state to a provider, so a replayed sign-in state could otherwise sign in whoever owns the email a connector reports)
• Account hooks identify connector callbacks by the account's provider — hook contexts carry the route pattern, so the old path check would have skipped credential creation

MCP OAuth provider

• Dynamic resources stay out of 1.7's static resource model via a signed sim_resource param
• Public clients recognized by token_endpoint_auth_method: none (1.7 dropped public); registration infers app type so loopback/cursor:// callbacks still register; requested scopes are kept; a dpop_jkt is dropped (bearer tokens only, as in 1.6); metadata advertises only what Sim honors; tokens revoked at sign-out are rejected
• Confidential clients keep their Basic credentials on the way to Better Auth: 1.7 refuses a client_secret_basic client whose credentials arrive in the body
• Migration 0448: expand-only columns/tables, so 1.6 and 1.7 pods share the schema during rollout; the live OAuth tables are altered after the embedded COMMIT, one autocommitted statement each, so a token insert (which locks its own table before its FK check reaches oauth_client) cannot deadlock the deploy; runtime schema validation off in the app and the realtime verifier (migrations own the schema)

Enterprise SSO

• Legacy SAML ACS URL forwarded to /sso/saml2/sp/acs/:id (POST and GET), so IdPs need no change; new providers advertise the new URL
• IdP-initiated SAML (app-portal launches) stays allowed; 1.7 turns it off by default
• Registration matches 1.7's strict schemas (no mapping.id; idpMetadata as metadata or entityID) and checks 1.7's sign-in policy on save
• Migration 0449 (data, idempotent): writes entityID for cert-only providers, and clears wantAssertionsSigned where SP metadata never asked for signed assertions — keeping 1.6's accept-any-IdP-signature policy so IdPs that sign only the Response keep working; and drops an audience equal to the IdP's own entity ID (the registration script's old default), since 1.7 checks audience exclusively where 1.6 also accepted the SP entity ID
• POST sign-in/email-otp refused: 1.7 deletes every linked account of an unverified user there

Behavior changes to expect

• In-flight OAuth/SSO/MCP authorizations that span the 1.6→1.7 cutover fail once (state key format changed); retry works
• SSO account ids now always come from OIDC sub / SAML NameID; providers that mapped another id claim re-link by email on their verified domain (new account row, same user)
• OIDC SSO ID tokens are now always verified, so the stored issuer must match iss exactly
• Browser sign-out revokes session-bound MCP access tokens; refresh tokens (offline_access) survive

Type of Change

• Dependency update / security

Testing

• Unit/route tests for every touched area: ~3,000 tests across auth, SSO, OAuth, credentials, credential groups, contracts
• Microsoft sign-in integration: an existing sub-keyed account signs in through the real auth handler with no duplicate link (lands on account_not_linked without the fix)
• Migration 0448 against 8 concurrent token-insert clients on Postgres 17: the previous file deadlocked in 5 of 6 runs (migration failed with 40P01); this one completes 6/6 with no failed inserts, and replays cleanly
• Token route integration covers code exchange + refresh for client_secret_basic and client_secret_post clients (the Basic case fails on the previous code)
• 17 auth-related integration files on disposable Postgres with all migrations (189 tests): token route, provider lifecycle, token family, lifecycle audit, SSO settings/admission/concurrency/primary provider, credential groups, reconnect conflict, credential revocation, shopify. The reconnect test caught the hook-path issue above
• Migration 0449 run twice on fixture rows (cert-only, XML, already-strict, legacy string, bad JSON, non-object, OIDC, audience = IdP issuer / entity ID / SP / custom): correct and idempotent
• drizzle-kit generate clean, check:migrations, biome; full type-check and audits run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)