fix(auth): sync account cookies with session cache

[salasebas]

Summary

• Renew valid account cookies whenever a session cookie cache is written.
• Expire DB-bound account cookies that belong to another session user, including chunk cleanup, while preserving mismatched cookies in secondary-only/stateless setups.
• Centralize the pinned upstream storage-capability split and apply it to session-cache defaults and account-route selection.
• Preserve any account cookie already written by the current response so a fresh OAuth cookie is never downgraded by stale request state.

Upstream evidence

Compared only with Better Auth v1.6.23 at commit 9dfceee14021fc15a2fb93023f39635f25b0b5ba:

• packages/better-auth/src/cookies/index.ts renews or expires account_data after session-cache writes and skips synchronization when the response already has a pending account cookie.
• packages/better-auth/src/context/store-capabilities.ts treats database or secondary storage as a server session store, but only a database as a server account store.
• packages/better-auth/src/api/routes/account.ts applies session-user binding only when a database exists.
• Pinned cookie/account tests cover user switching, stale-cookie expiry, and stateless mismatches.

PR #124 coordination

PR #124 owns the built-in social callback changes in routes/social.rb and social_test.rb. This PR does not touch those files. Its pending-cookie guard is the compatibility boundary that preserves the fresh account cookie written by that social flow.

Checks

• Focused cookies: 36 runs, 129 assertions, 0 failures
• Focused account routes: 42 runs, 156 assertions, 0 failures
• Focused configuration: 29 runs, 135 assertions, 0 failures
• Full core: 1,549 runs, 9,442 assertions, 0 failures
• Full StandardRB: passed
• git diff --check: passed
• Fresh blind diff-only pinned-upstream review: Approve

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
better-auth	Ignored		Aug 20, 2026 10:16pm