@aotter/mantle-cloudflare 0.1.0-alpha.6 → 0.1.0-alpha.8

package/dist/auth/createAuth.js

@@ -1,12 +1,16 @@
 import { betterAuth } from "better-auth";
-import { applyDefaultAccessTokenExpiry, refreshAccessToken, validateAuthorizationCode, verifyJwsAccessToken, } from "better-auth/oauth2";
+import { createDpopReplayStore, enforceDpopBinding, isDpopBindingError, parseAccessTokenAuthorization, verifyJwsAccessToken, } from "better-auth/oauth2";
 import { admin, emailOTP, jwt, magicLink } from "better-auth/plugins";
 import { createAccessControl } from "better-auth/plugins/access";
 import { defaultStatements } from "better-auth/plugins/admin/access";
 import { genericOAuth, } from "better-auth/plugins/generic-oauth";
 import { splitSetCookieHeader } from "better-auth/cookies";
 import { oauthProvider } from "@better-auth/oauth-provider";
+import { mcp } from "@better-auth/mcp";
+import { cimd } from "@better-auth/cimd";
+import { decodeMemberCursor, encodeMemberCursor } from "@aotter/mantle-admin";
 import { STAFF_ROLES } from "@aotter/mantle-spec";
+export { decodeMemberCursor, encodeMemberCursor };
 export { STAFF_ROLES };
 /**
  * Set lookup for "is this role string a staff role?" — handlers/MCP
@@ -31,6 +35,14 @@ function normalizeAuthBasePath(basePath) {
     }
     return trimmed;
 }
+function normalizeAuthErrorURL(errorURL, baseURL) {
+    const base = new URL(baseURL);
+    const resolved = new URL(errorURL ?? "/", base);
+    if (resolved.origin !== base.origin) {
+        throw new Error("createAuth: errorURL must be same-origin with baseURL.");
+    }
+    return `${resolved.pathname}${resolved.search}`;
+}
 /** @internal Exported for regression tests. */
 export function normalizeAuthResponseCookies(response) {
     const setCookie = response.headers.get("set-cookie");
@@ -156,14 +168,9 @@ export function buildGenericOAuthProviders(methods) {
         }
         out.push({
             providerId: method.providerId,
-            ...(method.displayName ? { displayName: method.displayName } : {}),
             clientId: method.clientId,
             ...(method.clientSecret ? { clientSecret: method.clientSecret } : {}),
             ...(method.discoveryUrl ? { discoveryUrl: method.discoveryUrl } : {}),
-            ...(method.issuer ? { issuer: method.issuer } : {}),
-            ...(method.requireIssuerValidation !== undefined
-                ? { requireIssuerValidation: method.requireIssuerValidation }
-                : {}),
             ...(method.authorizationUrl ? { authorizationUrl: method.authorizationUrl } : {}),
             ...(method.tokenUrl ? { tokenUrl: method.tokenUrl } : {}),
             ...(method.userInfoUrl ? { userInfoUrl: method.userInfoUrl } : {}),
@@ -180,6 +187,7 @@ export function buildGenericOAuthProviders(methods) {
                     resource: method.resource,
                     authorizationUrlParams: { resource: method.resource },
                     tokenUrlParams: { resource: method.resource },
+                    refreshTokenParams: { resource: method.resource },
                 }
                 : {}),
         });
@@ -296,15 +304,11 @@ export function shouldPromoteToOwner(rule, user) {
 export function guardGithubLoginProfile(user, context, methods) {
     if (!("githubLogin" in user))
         return undefined;
-    const providerId = context?.path === "/callback/:id"
-        ? context.params?.id
-        : context?.path === "/oauth2/callback/:providerId"
-            ? context.params?.providerId
-            : null;
+    const providerId = context?.path === "/callback/:id" ? context.params?.id : null;
     const trusted = typeof providerId === "string" && methods.some((method) => method.kind === "social"
         ? context?.path === "/callback/:id" && method.provider === "github" && providerId === "github"
         : method.kind === "oauth" &&
-            context?.path === "/oauth2/callback/:providerId" &&
+            context?.path === "/callback/:id" &&
             method.providerId === providerId &&
             Boolean(method.mapProfileToUser));
     return trusted ? undefined : { data: { githubLogin: null } };
@@ -348,107 +352,20 @@ export function buildTrustedOriginsFor(methods, configured = []) {
 function methodsRequireSameSiteNone(methods) {
     return methods.some((m) => m.kind === "social" && m.provider === "apple");
 }
-/**
- * Better Auth 1.6.x declares generic-OAuth URL parameter options but
- * its provider implementation does not replay them across every token
- * lifecycle step. Patch only resource-configured generic providers at
- * the provider boundary, using Better Auth's public OAuth helpers.
- */
-/** @internal exported for lifecycle regression tests. */
-export function buildOAuthResourceLifecyclePlugin(methods) {
-    const configured = new Map(methods
-        .filter((method) => method.kind === "oauth" && typeof method.resource === "string")
-        .map((method) => [method.providerId, method]));
-    if (configured.size === 0)
-        return null;
-    return {
-        id: "mantle-oauth-resource-lifecycle",
-        init(ctx) {
-            const tokenEndpoints = new Map();
-            const resolveTokenEndpoint = (method) => {
-                if (method.tokenUrl)
-                    return Promise.resolve(method.tokenUrl);
-                const existing = tokenEndpoints.get(method.providerId);
-                if (existing)
-                    return existing;
-                const pending = (async () => {
-                    if (!method.discoveryUrl) {
-                        throw new Error(`OAuth provider '${method.providerId}' has no token endpoint.`);
-                    }
-                    const response = await fetch(method.discoveryUrl, {
-                        headers: { accept: "application/json" },
-                        redirect: "error",
-                    });
-                    if (!response.ok) {
-                        throw new Error(`OAuth discovery for '${method.providerId}' returned ${response.status}.`);
-                    }
-                    const discovery = (await response.json());
-                    if (typeof discovery.token_endpoint !== "string") {
-                        throw new Error(`OAuth discovery for '${method.providerId}' omitted token_endpoint.`);
-                    }
-                    return discovery.token_endpoint;
-                })();
-                tokenEndpoints.set(method.providerId, pending);
-                return pending;
-            };
-            return {
-                context: {
-                    socialProviders: ctx.socialProviders.map((provider) => {
-                        const method = configured.get(provider.id);
-                        if (!method?.resource)
-                            return provider;
-                        const createAuthorizationURL = provider.createAuthorizationURL.bind(provider);
-                        return {
-                            ...provider,
-                            async createAuthorizationURL(data) {
-                                const url = await createAuthorizationURL(data);
-                                url.searchParams.set("resource", method.resource);
-                                return url;
-                            },
-                            async validateAuthorizationCode(data) {
-                                const tokens = await validateAuthorizationCode({
-                                    code: data.code,
-                                    codeVerifier: data.codeVerifier,
-                                    redirectURI: data.redirectURI,
-                                    options: {
-                                        clientId: method.clientId,
-                                        clientSecret: method.clientSecret,
-                                        redirectURI: method.redirectURI,
-                                    },
-                                    tokenEndpoint: await resolveTokenEndpoint(method),
-                                    authentication: method.authentication,
-                                    resource: method.resource,
-                                });
-                                return applyDefaultAccessTokenExpiry(tokens, undefined);
-                            },
-                            async refreshAccessToken(refreshTokenValue) {
-                                const tokens = await refreshAccessToken({
-                                    refreshToken: refreshTokenValue,
-                                    options: {
-                                        clientId: method.clientId,
-                                        clientSecret: method.clientSecret,
-                                    },
-                                    tokenEndpoint: await resolveTokenEndpoint(method),
-                                    authentication: method.authentication,
-                                    extraParams: { resource: method.resource },
-                                });
-                                return applyDefaultAccessTokenExpiry(tokens, undefined);
-                            },
-                        };
-                    }),
-                },
-            };
-        },
-    };
-}
 /** @internal exported for provider-option mapping tests. */
 export function buildOAuthProviderOptions(config) {
     return {
         loginPage: config.loginPage,
         consentPage: config.consentPage,
         ...(config.scopes ? { scopes: [...config.scopes] } : {}),
-        ...(config.validAudiences
-            ? { validAudiences: [...config.validAudiences] }
+        ...(config.resources
+            ? { resources: [...config.resources] }
+            : {}),
+        ...(config.mcpResource
+            ? {
+                clientRegistrationClientSecretExpiration: "90d",
+                allowPublicClientPrelogin: true,
+            }
             : {}),
         ...(config.allowDynamicClientRegistration !== undefined
             ? { allowDynamicClientRegistration: config.allowDynamicClientRegistration }
@@ -492,7 +409,9 @@ function buildAuth(config) {
     const bootstrap = config.bootstrapOwner;
     const emailOtpMethod = pickSingleton(config.methods, "email-otp");
     const magicLinkMethod = pickSingleton(config.methods, "magic-link");
-    const resourceLifecyclePlugin = buildOAuthResourceLifecyclePlugin(config.methods);
+    const providerOptions = config.oauthProvider
+        ? buildOAuthProviderOptions(config.oauthProvider)
+        : null;
     // Rate limit: Better Auth's per-route limits gate on
     // `process.env.NODE_ENV === "production"`, which is unset on
     // Cloudflare Workers — leaving the limits silently off. When any
@@ -525,17 +444,33 @@ function buildAuth(config) {
         ...(genericOAuthProviders.length > 0
             ? [
                 genericOAuth({
-                    config: genericOAuthProviders.map(({ displayName: _displayName, ...provider }) => provider),
+                    config: genericOAuthProviders,
                 }),
             ]
             : []),
-        ...(resourceLifecyclePlugin ? [resourceLifecyclePlugin] : []),
         ...(emailOtpMethod ? [buildEmailOTPPlugin(emailOtpMethod)] : []),
         ...(magicLinkMethod ? [buildMagicLinkPlugin(magicLinkMethod)] : []),
-        ...(config.oauthProvider
+        ...(config.oauthProvider && providerOptions
             ? [
                 jwt(),
-                oauthProvider(buildOAuthProviderOptions(config.oauthProvider)),
+                config.oauthProvider.mcpResource
+                    ? mcp({
+                        ...providerOptions,
+                        resource: config.oauthProvider.mcpResource,
+                    })
+                    : oauthProvider(providerOptions),
+                ...(config.oauthProvider.mcpResource
+                    ? [
+                        cimd({
+                            // Cloudflare's `global_fetch_strictly_public` flag is the
+                            // runtime network boundary: resolution and connection stay
+                            // on the public Internet. Better Auth owns timeout, limits,
+                            // validation, caching, and redirect rejection above it.
+                            fetchClientMetadataResource: (input, init) => fetch(input, { ...init, redirect: "error" }),
+                            metadataProfile: "mcp-2026-07-28",
+                        }),
+                    ]
+                    : []),
             ]
             : []),
     ];
@@ -620,6 +555,7 @@ function buildAuth(config) {
         secret: config.secret,
         baseURL: config.baseURL,
         basePath: normalizeAuthBasePath(config.basePath),
+        onAPIError: { errorURL: normalizeAuthErrorURL(config.errorURL, config.baseURL) },
         socialProviders,
         user: userConfig,
         ...(rateLimit ? { rateLimit } : {}),
@@ -629,47 +565,63 @@ function buildAuth(config) {
         databaseHooks,
     });
 }
-const MEMBER_CURSOR_PREFIX = "m:";
-/** @internal Exported for endpoint and regression-test validation. */
-export function encodeMemberCursor(createdAt, id) {
-    return `${MEMBER_CURSOR_PREFIX}${encodeURIComponent(JSON.stringify([createdAt, id]))}`;
-}
-/** @internal Exported for endpoint and regression-test validation. */
-export function decodeMemberCursor(cursor) {
-    if (!cursor.startsWith(MEMBER_CURSOR_PREFIX))
-        return null;
-    try {
-        const value = JSON.parse(decodeURIComponent(cursor.slice(MEMBER_CURSOR_PREFIX.length)));
-        return Array.isArray(value) && value.length === 2 &&
-            typeof value[0] === "string" && !Number.isNaN(Date.parse(value[0])) &&
-            typeof value[1] === "string" && value[1]
-            ? [value[0], value[1]]
-            : null;
-    }
-    catch {
-        return null;
-    }
-}
 const SETUP_INCOMPLETE_AUTHS = new WeakSet();
 /** True only for the fail-closed facade returned by createSetupIncompleteAuth. */
 export function isSetupIncompleteAuth(auth) {
     return SETUP_INCOMPLETE_AUTHS.has(auth);
 }
+const LEGACY_DCR_TTL_MS = 90 * 24 * 60 * 60 * 1_000;
+const LEGACY_DCR_CLEANUP_INTERVAL_MS = 60 * 60 * 1_000;
 export function createAuth(config) {
     const auth = buildAuth(config);
     const basePath = normalizeAuthBasePath(config.basePath);
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const api = auth.api;
     const localJwksCacheKey = {};
+    let dpopReplayStore = null;
+    const getDpopReplayStore = async () => {
+        if (dpopReplayStore)
+            return dpopReplayStore;
+        const context = await auth.$context;
+        dpopReplayStore = createDpopReplayStore(context.internalAdapter);
+        return dpopReplayStore;
+    };
     const verifyAccessToken = config.oauthProvider
         ? async (token, audience) => {
             const context = await auth.$context;
             return verifyOAuthJwtWithLocalJwks(token, audience, context.baseURL, async () => api.getJwks(), localJwksCacheKey);
         }
         : null;
+    let nextDcrCleanupAt = 0;
+    const pruneExpiredDynamicClients = async () => {
+        const now = Date.now();
+        if (!config.oauthProvider?.mcpResource || now < nextDcrCleanupAt)
+            return;
+        // Set before awaiting so concurrent OAuth requests do not fan out writes.
+        nextDcrCleanupAt = now + LEGACY_DCR_CLEANUP_INTERVAL_MS;
+        try {
+            await config.database
+                .prepare("DELETE FROM oauthClient WHERE clientDiscoveryId IS NULL AND userId IS NULL AND referenceId IS NULL AND createdAt < ?")
+                .bind(new Date(now - LEGACY_DCR_TTL_MS).toISOString())
+                .run();
+        }
+        catch (error) {
+            // Cleanup is bounded storage hygiene, not an authorization decision.
+            console.error("[better-auth] legacy DCR cleanup failed", error);
+        }
+    };
     return {
         basePath,
-        handler: async (request) => normalizeAuthResponseCookies(await auth.handler(request)),
+        ...(config.oauthProvider?.mcpResource
+            ? { mcpResource: config.oauthProvider.mcpResource }
+            : {}),
+        handler: async (request) => {
+            const pathname = new URL(request.url).pathname;
+            if (pathname.startsWith(`${basePath}/oauth2/`)) {
+                await pruneExpiredDynamicClients();
+            }
+            return normalizeAuthResponseCookies(await auth.handler(request));
+        },
         getSession: (request) => api.getSession({ headers: request.headers }).then((r) => r ?? null),
         getUserRole: async (userId) => {
             const row = await config.database
@@ -700,9 +652,76 @@ export function createAuth(config) {
                 createdAt,
             };
         },
-        getProviderAccessToken: (request, providerId) => getProviderAccessTokenForRequest(api, request, providerId),
+        getProviderAccessToken: async (request, providerId) => {
+            const session = await api.getSession({ headers: request.headers });
+            const userId = session?.user?.id;
+            const account = userId
+                ? await config.database
+                    .prepare("SELECT id FROM account WHERE userId = ? AND providerId = ? LIMIT 1")
+                    .bind(userId, providerId)
+                    .first()
+                : null;
+            if (!account) {
+                throw new Error(`getProviderAccessToken: provider '${providerId}' is not linked to the current user.`);
+            }
+            return getProviderAccessTokenForRequest(api, request, account.id, providerId);
+        },
         verifyOAuthAccessToken: async (tokenOrRequest, options) => {
-            return verifyOAuthJwt(tokenOrRequest, options, verifyAccessToken);
+            return verifyOAuthJwt(tokenOrRequest, options, verifyAccessToken, getDpopReplayStore);
+        },
+        getOAuthConsentRequest: async (request) => {
+            if (!config.oauthProvider)
+                return null;
+            const url = new URL(request.url);
+            const clientId = url.searchParams.get("client_id");
+            if (!clientId || !url.search)
+                return null;
+            const oauthQuery = url.search.slice(1);
+            const client = await api.getOAuthClientPublicPrelogin({
+                headers: request.headers,
+                body: { client_id: clientId, oauth_query: oauthQuery },
+            });
+            const redirectUri = url.searchParams.get("redirect_uri") ??
+                (Array.isArray(client?.redirect_uris) &&
+                    typeof client.redirect_uris[0] === "string"
+                    ? client.redirect_uris[0]
+                    : "");
+            return {
+                clientName: typeof client?.client_name === "string"
+                    ? client.client_name
+                    : clientId,
+                redirectUri,
+                scopes: (url.searchParams.get("scope") ?? "")
+                    .split(/\s+/u)
+                    .filter(Boolean),
+                oauthQuery,
+            };
+        },
+        completeOAuthConsent: async (request, accept) => {
+            if (!config.oauthProvider) {
+                throw new Error("completeOAuthConsent: oauthProvider is not configured.");
+            }
+            const form = await request.formData();
+            const oauthQuery = form.get("oauth_query");
+            if (typeof oauthQuery !== "string" || oauthQuery.length === 0) {
+                throw new Error("completeOAuthConsent: oauth_query is missing.");
+            }
+            const headers = new Headers(request.headers);
+            headers.set("content-type", "application/json");
+            headers.delete("content-length");
+            const response = await auth.handler(new Request(new URL(`${basePath}/oauth2/consent`, request.url), {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ accept, oauth_query: oauthQuery }),
+            }));
+            if (!response.ok) {
+                throw new Error(`completeOAuthConsent: Better Auth returned ${response.status}.`);
+            }
+            const result = await response.json();
+            if (!result || typeof result.url !== "string") {
+                throw new Error("completeOAuthConsent: Better Auth omitted the redirect URL.");
+            }
+            return result.url;
         },
         methods: config.methods.map((m) => {
             switch (m.kind) {
@@ -861,7 +880,7 @@ export function createAuth(config) {
                         : {}),
                     ...(input.grantTypes ? { grant_types: [...input.grantTypes] } : {}),
                     ...(input.responseTypes ? { response_types: [...input.responseTypes] } : {}),
-                    ...(input.type ? { type: input.type } : {}),
+                    ...(input.applicationType ? { application_type: input.applicationType } : {}),
                     ...(input.skipConsent !== undefined ? { skip_consent: input.skipConsent } : {}),
                     ...(input.enableEndSession !== undefined
                         ? { enable_end_session: input.enableEndSession }
@@ -900,6 +919,10 @@ export function createSetupIncompleteAuth(options = {}) {
             status: 401,
             reason: "invalid-token",
         }),
+        getOAuthConsentRequest: async () => null,
+        completeOAuthConsent: async () => {
+            throw new Error(message);
+        },
         methods: [],
         listLinkedAccounts: async () => [],
         unlinkAccount: async () => false,
@@ -917,21 +940,12 @@ export function createSetupIncompleteAuth(options = {}) {
     SETUP_INCOMPLETE_AUTHS.add(auth);
     return auth;
 }
-function bearerTokenFrom(tokenOrRequest) {
-    if (typeof tokenOrRequest === "string")
-        return tokenOrRequest.trim() || null;
-    const header = tokenOrRequest.headers.get("authorization");
-    if (!header)
-        return null;
-    const match = /^Bearer ([^\s]+)$/i.exec(header);
-    return match?.[1] ?? null;
-}
 /** @internal exported to pin the session-bound Better Auth request and
  *  secret-minimizing response mapping. */
-export async function getProviderAccessTokenForRequest(api, request, providerId) {
+export async function getProviderAccessTokenForRequest(api, request, accountId, providerId) {
     const value = (await api.getAccessToken({
         headers: request.headers,
-        body: { providerId },
+        body: { accountId },
     }));
     if (typeof value?.accessToken !== "string") {
         throw new Error(`getProviderAccessToken: provider '${providerId}' returned no access token.`);
@@ -964,8 +978,10 @@ export function verifyOAuthJwtWithLocalJwks(token, audience, issuer, jwksFetch,
 }
 /** @internal exported to pin the stable facade's normalization and
  *  401/403 contract independently of Better Auth network/JWKS I/O. */
-export async function verifyOAuthJwt(tokenOrRequest, options, verify) {
-    const token = bearerTokenFrom(tokenOrRequest);
+export async function verifyOAuthJwt(tokenOrRequest, options, verify, getDpopReplayStore) {
+    const request = typeof tokenOrRequest === "string" ? null : tokenOrRequest;
+    const authorization = parseAccessTokenAuthorization(request?.headers.get("authorization") ?? `Bearer ${tokenOrRequest}`);
+    const token = authorization?.token;
     // JWT compact serialization has exactly three non-empty parts.
     // Reject opaque tokens before any network/JWKS work.
     if (!verify ||
@@ -976,6 +992,16 @@ export async function verifyOAuthJwt(tokenOrRequest, options, verify) {
     }
     try {
         const claims = await verify(token, options.audience);
+        await enforceDpopBinding({
+            payload: claims,
+            authorization,
+            proofJwt: request?.headers.get("dpop"),
+            method: request?.method ?? "GET",
+            url: request?.url ?? options.audience,
+            ...(request && authorization.scheme === "DPoP" && getDpopReplayStore
+                ? { replayStore: await getDpopReplayStore() }
+                : {}),
+        });
         if (typeof claims["sub"] !== "string" || claims["sub"].length === 0) {
             return { ok: false, status: 401, reason: "invalid-token" };
         }
@@ -997,7 +1023,10 @@ export async function verifyOAuthJwt(tokenOrRequest, options, verify) {
             scopes,
         };
     }
-    catch {
+    catch (error) {
+        if (isDpopBindingError(error)) {
+            return { ok: false, status: 401, reason: "invalid-dpop-proof" };
+        }
         return { ok: false, status: 401, reason: "invalid-token" };
     }
 }
@@ -1009,7 +1038,7 @@ export function mapRegisteredOAuthClient(value) {
     }
     return {
         clientId: row.client_id,
-        ...(row.client_secret && row.public !== true && row.token_endpoint_auth_method !== "none"
+        ...(row.client_secret && row.token_endpoint_auth_method !== "none"
             ? { clientSecret: row.client_secret }
             : {}),
         redirectUris: row.redirect_uris,
@@ -1019,8 +1048,7 @@ export function mapRegisteredOAuthClient(value) {
         ...(row.token_endpoint_auth_method
             ? { tokenEndpointAuthMethod: row.token_endpoint_auth_method }
             : {}),
-        ...(row.type ? { type: row.type } : {}),
-        ...(row.public !== undefined ? { public: row.public } : {}),
+        ...(row.application_type ? { applicationType: row.application_type } : {}),
     };
 }
 /** Random 32-char alphanumeric id, shaped like Better Auth's own user