🚀 Features
- Sveltekit cookie helper plugin - by @Kinfe123 in #3049 (4e386)
- SSO plugin with OIDC and SAML support - by @Bekacru in #3185 (a6a66)
- Linear social provider - by @JedPattersonn in #2617 (6e291)
- Add encryption for OTPs and other verification information - by @ping-maxwell in #3164 (00d1e)
- Notion provider - by @ephraimduncan in #3068 (0bff4)
- Add
sendOnSignInoption to make sending verification link in sign in route explicit - by @kmate19 in #2422 (991e2) - Add
inferAuthto infer plugin types and more on the client without needing client plugins - by @Bekacru in #3313 (378eb) - Add
rememberMeoption tosignUpEmail- by @aleclarson in #3325 (1c6a1) - Add slack social provider - by @ephraimduncan in #3315 (84348)
- Add an option to encrypt oauth tokens by default - by @Bekacru in #2552 (7d034)
- OnPasswordReset callback - by @Kinfe123 in #2994 (a342b)
- AfterEmailVerification callback - by @Kinfe123 in #3046 (1a159)
- SIWE plugin - by @rokitgg in #2579 (370e8)
- admin:
- anonymous:
- Update generateName to support returning a promise - by @btx-systems in #3259 (57baf)
- api-key:
- docs:
- APIMethod, documents all server & client auth examples - by @ping-maxwell in #2577 (1ed38)
- drizzle:
- email-otp:
- generic-oauth:
- Add support for additional token URL params in generic OAuth - by @CaoMeiYouRen in #3410 (2ac4f)
- magic-link:
- Support errorCallbackURL & newUserCallbackURL - by @ping-maxwell in #3268 (8e4f9)
- oidc:
- Add refresh token support to discovery document and token endpoint - by @tinkerer-shubh in #3373 (6f0f6)
- Support JWKs with JWT plugin - by @NefixEstrada in #2755 (82b69)
- Add support for public clients with PKCE authentication - by @pekastel in #3091 (ff54a)
- oidc-provider:
- organization:
listUserInvitationsadds the ability to list all invitations for a given user - by @ping-maxwell in #3121 (3547c)- AdditionalFields for org, member, invitation & team - by @ping-maxwell in #3447 (93698)
- Multi-team support - by @Bekacru (28c84)
- social-providers:
- sso:
- stripe:
- username:
🐞 Bug Fixes
- Import setCookie from tanstack start core package - by @asterikx in #3284 (b1851)
- Exclude current user from username update checks - by @kylekz in #2612 (0989e)
- Correct way detect facebook limited token jwt - by @reslear in #2877 (ab251)
- Update Discord link to use the correct invite URL in blogs section - by @vagxrth (bda8a)
- Linking accounts for anon users with one tap and passkey - by @Kinfe123 in #3124 (a2029)
- Don't require email for account linking - by @arlyon in #3335 (9c3a1)
- Add
imageoption tosignUpEmailtypes and schema - by @acusti in #3357 (78351) - Implement standard Base64 encoding for HTTP Basic Auth in token refresh and validation - by @naimkhrof in #3388 (7364c)
- Schema generation when using advanced.databse.useNumberId - by @body20002 in #3311 (e02c2)
- Mysql foreign key constraints on generate - by @Kinfe123 in #2828 (15452)
- Zodv4 migration leftover due to conflict - by @Kinfe123 (5508b)
- Sso typecheck - by @Kinfe123 (78e38)
- Global onSuccess callback hook not being called - by @Kinfe123 in #3032 (26391)
- admin:
- Throw an error if user id in
/remove-useris invalid - by @ping-maxwell in #3271 (32d83) - Before create hook was not triggered when creating a user through the admin plugin - by @Kinfe123 in #3418 (adf8b)
- Pass
ctxto user create db hook - by @ping-maxwell in #2521 (65152)
- Throw an error if user id in
- api-key:
- Incorrect rate limit error status code - by @ping-maxwell in #3213 (7c471)
- Incorrect rate limit error status code - by @ping-maxwell in #3213 (b136f)
- Non-expiring API keys (with expiresAt set to null) were being deleted by mistake - by @reslear in #3413 (57c76)
- cli:
- db:
- Add varchar to postgres string mapping and normalize type comparison - by @tinkerer-shubh in #3225 (5ead4)
- drizzle-cli:
- Use serial as PK when
useNumberIdis enabled - by @ismi-abbas in #3228 (12e15) - Use serial as PK when
useNumberIdis enabled - by @ismi-abbas in #3228 (4a5d7)
- Use serial as PK when
- dropbox:
- email-otp:
- Throw USER_NOT_FOUND when sign-up is disabled - by @tinkerer-shubh in #3223 (74311)
- Throw USER_NOT_FOUND when sign-up is disabled - by @tinkerer-shubh in #3223 (d1ae4)
- expo:
- generic-oauth:
- jwt:
- Allow to generate JWKS with other algorithm than the default one - by @LightTab2 in #3219 (f9b19)
- mcp:
- Issue with hardcoded baseURL in withMcpAuth - by @lazakrisz in #2971 (6119d)
- mongodb:
- Honor custom generateId in create - by @tinkerer-shubh in #3178 (379b5)
- next-cookies:
- Don't throw in monorepo workspaces - by @ping-maxwell in #3381 (8bd66)
- oauth:
- Google prompt doesn't allow
+- by @ping-maxwell in #3303 (8e7ee) - Extended oauth2 tokens with
refresh_token_expires_infield - by @0xCodeMaieutics in #3167 (9bf74)
- Google prompt doesn't allow
- oidc-provider:
- Relax offline_access scope validation by removing prompt=consent requirement - by @tinkerer-shubh in #3420 (d1308)
- open-api:
- organization:
- origin-check:
- phone-number:
- social-providers:
- Twitch provider not returning if email is valid - by @Pantotone in #3453 (3cd29)
- sso:
- stripe:
- two-factor:
- Incorrect default OTP period & fix incorrect docs - by @ping-maxwell in #3231 (6beac)
- Incorrect default OTP period & fix incorrect docs - by @ping-maxwell in #3231 (eea77)
- Getting totp uri shouldn't require twoFactor enabled - by @occorune in #2620 (6ef51)
- Otp separator mismatch - by @Kinfe123 in #2989 (c483f)
- Use twoFactorEnabled flag instead of database lookup for OTP validation - by @bairdj in #3302 (26fd7)
- username:
- Add
callbackURLoption tosignInUsername- by @aleclarson in #3324 (63921)
- Add