fix(auth): upgrade Better Auth to 1.7.2

Author: romanbsd

.env.example

@@ -53,7 +53,7 @@ GOOGLE_CLIENT_SECRET=""
 # MICROSOFT_CLIENT_SECRET=""
 
 # Optional. Enables Slack account linking on Settings > Connections.
-# Add APP_URL + /api/auth/oauth2/callback/slack as the Slack OAuth redirect URL.
+# Add API_URL + /api/auth/callback/slack as the Slack OAuth redirect URL.
 # SLACK_CLIENT_ID=""
 # SLACK_CLIENT_SECRET=""
 

apps/agent/test/slack-membership.integration.spec.ts

@@ -24,6 +24,7 @@ async function connect() {
 		where: { id: ACCOUNT_ID },
 		create: {
 			id: ACCOUNT_ID,
+			issuer: "local:oauth:slack",
 			accountId: "T-JOIN-SPEC",
 			providerId: "slack",
 			userId: USER_ID,

apps/agent/test/slack-people.integration.spec.ts

@@ -27,6 +27,7 @@ async function connect() {
 		where: { id: ACCOUNT_ID },
 		create: {
 			id: ACCOUNT_ID,
+			issuer: "local:oauth:slack",
 			accountId: "T-SPEC",
 			providerId: "slack",
 			userId: USER_ID,

apps/api/package.json

@@ -38,7 +38,7 @@
 		"@thallesp/nestjs-better-auth": "^2.7.0",
 		"@trpc/server": "^11.18.0",
 		"@vercel/blob": "^2.6.1",
-		"better-auth": "^1.6.25",
+		"better-auth": "^1.7.2",
 		"cache-manager": "^7.2.9",
 		"class-transformer": "^0.5.1",
 		"class-validator": "^0.15.1",

apps/api/src/mailbox/mailbox-token.service.ts

@@ -72,8 +72,17 @@ export class MailboxTokenService {
 		source: SyncSource,
 	): Promise<TokenResult> {
 		const providerId = PROVIDER_FOR_SOURCE[source];
-
-		if (!(await this.isConnected(userId, source))) {
+		const account = await this.db.account.findFirst({
+			where: { userId, providerId },
+			select: { id: true, scope: true },
+		});
+		if (!account) {
+			return {
+				outcome: "needs-reconnect",
+				reason: `${label(providerId)} has no connected account.`,
+			};
+		}
+		if (!parseScopes(account.scope).has(SCOPE_FOR_SOURCE[source])) {
 			return {
 				outcome: "not-connected",
 				reason: `The ${source} scope has not been granted.`,
@@ -82,7 +91,7 @@ export class MailboxTokenService {
 
 		try {
 			const { accessToken } = await auth.api.getAccessToken({
-				body: { providerId, userId },
+				body: { accountId: account.id, userId },
 			});
 
 			if (!accessToken) {

apps/api/test/mailbox-purge.spec.ts

@@ -290,6 +290,7 @@ describe("disconnecting Microsoft", () => {
 		await db.account.create({
 			data: {
 				id: `ms-${suffix}`,
+				issuer: `https://login.microsoftonline.com/${suffix}/v2.0`,
 				accountId: `ms-account-${suffix}`,
 				providerId: MICROSOFT_PROVIDER_ID,
 				userId: outlookRep,
@@ -349,6 +350,7 @@ describe("disconnecting Google", () => {
 		await db.account.create({
 			data: {
 				id: `goog-${suffix}`,
+				issuer: "https://accounts.google.com",
 				accountId: `goog-account-${suffix}`,
 				providerId: GOOGLE_PROVIDER_ID,
 				userId: gmailRep,

apps/app/app/(app)/[slug]/settings/connections/slack/slack-connect-button.tsx

@@ -30,8 +30,8 @@ const CONNECT_ERRORS = new Map([
 
 async function startSlackOAuth(slug: string) {
 	try {
-		const { error } = await authClient.oauth2.link({
-			providerId: "slack",
+		const { error } = await authClient.linkSocial({
+			provider: "slack",
 			callbackURL: `${window.location.origin}/${slug}/settings/connections/slack/people`,
 			errorCallbackURL: `${window.location.origin}/${slug}/settings/connections/slack?provider=slack`,
 		});

apps/app/package.json

@@ -26,7 +26,7 @@
 		"@trpc/server": "^11.18.0",
 		"@trpc/tanstack-react-query": "^11.18.0",
 		"api": "workspace:*",
-		"better-auth": "^1.6.25",
+		"better-auth": "^1.7.2",
 		"eve": "^0.29.4",
 		"next": "16.3.0",
 		"next-themes": "^0.4.6",

bun.lock

@@ -45,17 +45,22 @@ undo it.
 Connecting is the same decision as disconnecting, because `replaceSlackConnection`
 deletes every other Slack account row: a second person connecting *replaces* the
 workspace's Slack, and every deployed agent then reads from and posts to whichever
-Slack they installed. Hiding the button is not enough — `authClient.oauth2.link`
-is one POST.
+Slack they installed. Hiding the button is not enough. `authClient.linkSocial`
+sends one POST.
 
 `slackConnectGuard` (`packages/auth/src/slack-connect.ts`) is Better Auth's
 `hooks.before`, and it asks the same `canManageConnections` the API does. It
-covers all three doors: `/oauth2/link`, `/sign-in/oauth2` (Slack is a connection,
-never a sign-in method, and that endpoint needs no session) and
-`/oauth2/callback/slack`. The callback is the one that matters — refusing there
-happens **before the code is exchanged**, so a refused attempt writes no
+guards Slack account-linking starts through `/link-social`. Public Slack sign-in
+starts through `/sign-in/social` remain available to Better Auth. The guard also
+reads the server-generated OAuth state before `/callback/slack`. It guards the
+callback only when that state identifies an account-linking transaction. A
+normal Slack sign-in callback remains available to Better Auth. The callback
+check happens before Better Auth exchanges the code. A refused link writes no
 `SlackWorkspaceGrant` user token and deletes no bot token. Google and Microsoft
-sign in on different paths and never reach the guard.
+callbacks never reach the Slack guard.
+
+Existing Slack applications must replace `/api/auth/oauth2/callback/slack` with
+`/api/auth/callback/slack` before this upgrade reaches production.
 
 A workspace with no owner and no admin lets any member connect. There is nobody
 left to ask, and a fresh install must not be locked out of its first connection.