@better-auth-ui/core 1.6.30 → 1.6.31

package/dist/{create-auth-plugin-DcxR23rZ.js → create-auth-plugin-D4wsYnHD.js}

@@ -143,6 +143,7 @@ function o(e, t) {
 //#region src/lib/view-paths.ts
 var s = {
 	auth: {
+		redirect: "redirect",
 		signIn: "sign-in",
 		signUp: "sign-up",
 		forgotPassword: "forgot-password",

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from './config';
 export * from './lib/auth-mutation-keys';
 export * from './lib/auth-plugin';
 export * from './lib/auth-query-keys';
+export * from './lib/auth-redirect';
 export * from './lib/base-paths';
 export * from './lib/create-auth-plugin';
 export * from './lib/deep-partial';

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as e, c as t, i as n, l as r, n as i, o as a, r as o, s, t as c } from "./create-auth-plugin-DcxR23rZ.js";
+import { a as e, c as t, i as n, l as r, n as i, o as a, r as o, s, t as c } from "./create-auth-plugin-D4wsYnHD.js";
 //#region src/config/additional-fields-config.ts
 function l(e, t) {
 	if (e.type === "boolean") return t === "on" || t === "true";
@@ -59,7 +59,38 @@ var d = {
 	revokeSession: ["auth", "revokeSession"],
 	unlinkAccount: ["auth", "unlinkAccount"],
 	updateUser: ["auth", "updateUser"]
-}, f = {
+}, f = /^https?:\/\//i;
+function p(e) {
+	for (let t of e) {
+		let e = t.codePointAt(0);
+		if (t === "\\" || e === void 0 || e <= 31 || e === 127) return !0;
+	}
+	return !1;
+}
+function m(e, t) {
+	if (!e || p(e)) return "/";
+	let n = e.trim();
+	if (!n || n.startsWith("//") || !n.startsWith("/") && !f.test(n)) return "/";
+	try {
+		let e = new URL(t), r = new URL(n, e);
+		return r.origin !== e.origin || r.username || r.password ? "/" : `${r.pathname}${r.search}${r.hash}`;
+	} catch {
+		return "/";
+	}
+}
+function h(e, t, n) {
+	let r = m(e.searchParams.get("redirectTo"), e.origin), i = new URL(r, e.origin).pathname === e.pathname ? "/" : r;
+	if (t) return {
+		type: "redirect",
+		to: i
+	};
+	let a = new URL(n, e.origin);
+	return a.searchParams.set("redirectTo", `${e.pathname}${e.search}${e.hash}`), {
+		type: "signIn",
+		to: `${a.pathname}${a.search}${a.hash}`
+	};
+}
+var g = {
 	version: "2.0",
 	providers: [
 		{
@@ -1476,26 +1507,26 @@ var d = {
 		domains: 223,
 		generated: "2025-12-09T10:38:50.000Z"
 	}
-}, p;
-function m() {
-	if (p) return p;
-	p = /* @__PURE__ */ new Map();
-	let { providers: e } = f;
-	for (let t of e) if (t.loginUrl) for (let e of t.domains ?? []) p.set(e.toLowerCase(), {
+}, _;
+function v() {
+	if (_) return _;
+	_ = /* @__PURE__ */ new Map();
+	let { providers: e } = g;
+	for (let t of e) if (t.loginUrl) for (let e of t.domains ?? []) _.set(e.toLowerCase(), {
 		companyProvider: t.companyProvider,
 		loginUrl: t.loginUrl
 	});
-	return p;
+	return _;
 }
-function h(e) {
+function y(e) {
 	let t = e.lastIndexOf("@");
 	if (t === -1) return null;
 	let n = e.slice(t + 1).trim().toLowerCase();
-	return n ? m().get(n) ?? null : null;
+	return n ? v().get(n) ?? null : null;
 }
 //#endregion
 //#region src/lib/provider-names.ts
-var g = {
+var b = {
 	apple: "Apple",
 	atlassian: "Atlassian",
 	cognito: "Cognito",
@@ -1532,8 +1563,8 @@ var g = {
 	wechat: "WeChat",
 	zoom: "Zoom"
 };
-function _(e) {
-	return g[e] || e.charAt(0).toUpperCase() + e.slice(1);
+function x(e) {
+	return b[e] || e.charAt(0).toUpperCase() + e.slice(1);
 }
 //#endregion
-export { d as authMutationKeys, i as authQueryKeys, r as basePaths, c as createAuthPlugin, e as deepmerge, o as defaultAuthConfig, a as fileToBase64, h as getEmailProviderLink, _ as getProviderName, t as localization, l as parseAdditionalFieldValue, g as providerNames, s as resizeAvatar, u as resolveInputType, n as viewPaths };
+export { d as authMutationKeys, i as authQueryKeys, r as basePaths, c as createAuthPlugin, e as deepmerge, o as defaultAuthConfig, a as fileToBase64, h as getAuthRedirectAction, y as getEmailProviderLink, x as getProviderName, m as getSafeRedirectTo, t as localization, l as parseAdditionalFieldValue, b as providerNames, s as resizeAvatar, u as resolveInputType, n as viewPaths };

package/dist/lib/auth-mutation-keys.d.ts

@@ -19,10 +19,11 @@
  * package the mutation options factory came from.
  *
  * Plugin-specific mutation keys live alongside their plugin (e.g.
- * `apiKeyMutationKeys`, `organizationMutationKeys`, `passkeyMutationKeys`,
- * `magicLinkMutationKeys`, `multiSessionMutationKeys`, `usernameMutationKeys`,
- * `deleteUserMutationKeys`). Plugin-contributed sign-in strategies stay
- * under the shared `["auth", "signIn", ...]` namespace so
+ * `apiKeyMutationKeys`, `deviceAuthorizationMutationKeys`,
+ * `organizationMutationKeys`, `passkeyMutationKeys`, `magicLinkMutationKeys`,
+ * `multiSessionMutationKeys`, `usernameMutationKeys`, `deleteUserMutationKeys`).
+ * Plugin-contributed sign-in strategies stay under the shared
+ * `["auth", "signIn", ...]` namespace so
  * `useIsMutating({ mutationKey: authMutationKeys.signIn.all })` still
  * matches them.
  *

package/dist/lib/auth-redirect.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Normalize a redirect target to a same-origin path.
+ *
+ * Root-relative paths and same-origin HTTP(S) URLs are accepted. Invalid,
+ * cross-origin, protocol-relative, and non-HTTP targets fall back to `/`.
+ *
+ * @param redirectTo - Requested redirect target
+ * @param origin - Origin used to validate and normalize the target
+ * @returns A same-origin path including its query string and hash
+ */
+export declare function getSafeRedirectTo(redirectTo: string | null | undefined, origin: string): string;
+export type AuthRedirectAction = {
+    type: "redirect";
+    to: string;
+} | {
+    type: "signIn";
+    to: string;
+};
+/**
+ * Resolve the next action for the authenticated redirect view.
+ *
+ * Signed-in users continue to the validated target. Signed-out users are sent
+ * to sign in with the current redirect-view URL preserved, allowing the view
+ * to perform a full-page redirect after authentication.
+ *
+ * @param currentURL - Current redirect-view URL
+ * @param authenticated - Whether the current user has a session
+ * @param signInPath - Same-origin path to the sign-in view
+ * @returns The redirect or sign-in action to perform
+ */
+export declare function getAuthRedirectAction(currentURL: URL, authenticated: boolean, signInPath: string): AuthRedirectAction;

package/dist/lib/view-paths.d.ts

@@ -2,6 +2,11 @@
  * View path segments for authentication routes.
  */
 export interface AuthViewPaths {
+    /**
+     * Path segment for the authenticated redirect view
+     * @default "redirect"
+     */
+    redirect: string;
     /**
      * Path segment for the sign-in view
      * @default "sign-in"

package/dist/plugins/device-authorization/device-authorization-localization.d.ts

@@ -0,0 +1,33 @@
+export declare const deviceAuthorizationLocalization: {
+    /** @remarks `"Device Authorization"` */
+    deviceAuthorization: string;
+    /** @remarks `"Enter the code displayed on your device."` */
+    deviceAuthorizationDescription: string;
+    /** @remarks `"Device code"` */
+    deviceCode: string;
+    /** @remarks `"The code is invalid or has expired."` */
+    invalidDeviceCode: string;
+    /** @remarks `"Continue"` */
+    continue: string;
+    /** @remarks `"Approve Device"` */
+    approveDevice: string;
+    /** @remarks `"A device is requesting access to your account."` */
+    approveDeviceDescription: string;
+    /** @remarks `"Signed in as"` */
+    signedInAs: string;
+    /** @remarks `"Approve"` */
+    approve: string;
+    /** @remarks `"Deny"` */
+    deny: string;
+    /** @remarks `"Device Approved"` */
+    deviceApproved: string;
+    /** @remarks `"The device can now access your account. You can return to it and continue."` */
+    deviceApprovedDescription: string;
+    /** @remarks `"Device Denied"` */
+    deviceDenied: string;
+    /** @remarks `"The device was not granted access to your account."` */
+    deviceDeniedDescription: string;
+    /** @remarks `"Return to application"` */
+    returnToApplication: string;
+};
+export type DeviceAuthorizationLocalization = typeof deviceAuthorizationLocalization;

package/dist/plugins/device-authorization/device-authorization-mutation-keys.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Mutation keys contributed by the device-authorization plugin.
+ *
+ * All keys live under the shared `["auth"]` namespace so global auth
+ * mutation observers handle errors consistently.
+ */
+export declare const deviceAuthorizationMutationKeys: {
+    /** Prefix matching every device-authorization mutation. */
+    readonly all: readonly ["auth", "deviceAuthorization"];
+    /** Key for verifying and claiming a user code. */
+    readonly verify: readonly ["auth", "deviceAuthorization", "verify"];
+    /** Key for approving a pending device request. */
+    readonly approve: readonly ["auth", "deviceAuthorization", "approve"];
+    /** Key for denying a pending device request. */
+    readonly deny: readonly ["auth", "deviceAuthorization", "deny"];
+};

package/dist/plugins/device-authorization/device-authorization-plugin.d.ts

@@ -0,0 +1,59 @@
+import { DeviceAuthorizationLocalization } from './device-authorization-localization';
+declare module "../../lib/view-paths" {
+    /** Widens `AuthViewPaths` with the device-authorization path when this plugin is imported. */
+    interface AuthViewPaths {
+        /** @default "device" */
+        deviceAuthorization?: string;
+    }
+}
+export type DeviceAuthorizationPluginOptions = {
+    /**
+     * Override the plugin's default localization strings.
+     * @remarks `DeviceAuthorizationLocalization`
+     */
+    localization?: Partial<DeviceAuthorizationLocalization>;
+    /**
+     * URL segment for the device-authorization view.
+     * @remarks `string`
+     * @default "device"
+     */
+    path?: string;
+    /**
+     * Number of characters rendered by the device-code input.
+     *
+     * Keep this in sync with Better Auth's `deviceAuthorization({ userCodeLength })`
+     * server option.
+     *
+     * @default 8
+     */
+    userCodeLength?: number;
+};
+export declare const deviceAuthorizationPlugin: ((options?: DeviceAuthorizationPluginOptions | undefined) => {
+    localization: {
+        deviceAuthorization: string;
+        deviceAuthorizationDescription: string;
+        deviceCode: string;
+        invalidDeviceCode: string;
+        continue: string;
+        approveDevice: string;
+        approveDeviceDescription: string;
+        signedInAs: string;
+        approve: string;
+        deny: string;
+        deviceApproved: string;
+        deviceApprovedDescription: string;
+        deviceDenied: string;
+        deviceDeniedDescription: string;
+        returnToApplication: string;
+    };
+    userCodeLength: number;
+    viewPaths: {
+        auth: {
+            deviceAuthorization: string;
+        };
+    };
+} & {
+    id: "deviceAuthorization";
+}) & {
+    id: "deviceAuthorization";
+};

package/dist/plugins.d.ts

@@ -5,6 +5,9 @@ export * from './plugins/api-key/api-key-query-keys';
 export * from './plugins/delete-user/delete-user-localization';
 export * from './plugins/delete-user/delete-user-mutation-keys';
 export * from './plugins/delete-user/delete-user-plugin';
+export * from './plugins/device-authorization/device-authorization-localization';
+export * from './plugins/device-authorization/device-authorization-mutation-keys';
+export * from './plugins/device-authorization/device-authorization-plugin';
 export * from './plugins/last-login-method/last-login-method-localization';
 export * from './plugins/last-login-method/last-login-method-plugin';
 export * from './plugins/magic-link/magic-link-localization';

package/dist/plugins.js

@@ -1,4 +1,4 @@
-import { n as e, r as t, t as n } from "./create-auth-plugin-DcxR23rZ.js";
+import { n as e, r as t, t as n } from "./create-auth-plugin-D4wsYnHD.js";
 //#region src/plugins/api-key/api-key-localization.ts
 var r = {
 	apiKey: "API key",
@@ -46,35 +46,79 @@ var r = {
 	},
 	sendDeleteAccountVerification: e.sendDeleteAccountVerification ?? !1
 })), u = {
+	deviceAuthorization: "Device Authorization",
+	deviceAuthorizationDescription: "Enter the code displayed on your device.",
+	deviceCode: "Device code",
+	invalidDeviceCode: "The code is invalid or has expired.",
+	continue: "Continue",
+	approveDevice: "Approve Device",
+	approveDeviceDescription: "A device is requesting access to your account.",
+	signedInAs: "Signed in as",
+	approve: "Approve",
+	deny: "Deny",
+	deviceApproved: "Device Approved",
+	deviceApprovedDescription: "The device can now access your account. You can return to it and continue.",
+	deviceDenied: "Device Denied",
+	deviceDeniedDescription: "The device was not granted access to your account.",
+	returnToApplication: "Return to application"
+}, d = {
+	all: ["auth", "deviceAuthorization"],
+	verify: [
+		"auth",
+		"deviceAuthorization",
+		"verify"
+	],
+	approve: [
+		"auth",
+		"deviceAuthorization",
+		"approve"
+	],
+	deny: [
+		"auth",
+		"deviceAuthorization",
+		"deny"
+	]
+}, f = 8;
+function p(e) {
+	return e === void 0 || !Number.isFinite(e) ? f : Math.max(1, Math.floor(e));
+}
+var m = n("deviceAuthorization", (e = {}) => ({
+	localization: {
+		...u,
+		...e.localization
+	},
+	userCodeLength: p(e.userCodeLength),
+	viewPaths: { auth: { deviceAuthorization: e.path ?? "device" } }
+})), h = {
 	lastUsed: "Last used",
 	lastUsedShort: "Last"
-}, d = n("lastLoginMethod", (e = {}) => ({ localization: {
-	...u,
+}, g = n("lastLoginMethod", (e = {}) => ({ localization: {
+	...h,
 	...e.localization
-} })), f = {
+} })), _ = {
 	magicLink: "Magic Link",
 	sendMagicLink: "Send Magic Link",
 	magicLinkSent: "Check your email for the magic link",
 	magicLinkSentTo: "We sent a magic link to {{email}}"
-}, p = { signIn: [
+}, v = { signIn: [
 	"auth",
 	"signIn",
 	"magicLink"
-] }, m = n("magicLink", (e = {}) => ({
+] }, y = n("magicLink", (e = {}) => ({
 	localization: {
-		...f,
+		..._,
 		...e.localization
 	},
 	viewPaths: { auth: {
 		magicLink: e.path ?? "magic-link",
 		magicLinkSent: e.sentPath ?? "magic-link-sent"
 	} }
-})), h = {
+})), b = {
 	switchAccount: "Switch Account",
 	addAccount: "Add Account",
 	manageAccounts: "Manage accounts",
 	manageAccountsDescription: "Manage your accounts for secure access."
-}, g = {
+}, x = {
 	all: ["auth", "multiSession"],
 	revoke: [
 		"auth",
@@ -86,14 +130,14 @@ var r = {
 		"multiSession",
 		"setActive"
 	]
-}, _ = n("multiSession", (e = {}) => ({ localization: {
-	...h,
+}, S = n("multiSession", (e = {}) => ({ localization: {
+	...b,
 	...e.localization
-} })), v = {
+} })), C = {
 	all: (t) => [...e.user(t), "multiSession"],
-	lists: (e) => [...v.all(e), "list"],
-	list: (e, t) => [...v.lists(e), t ?? null]
-}, y = {
+	lists: (e) => [...C.all(e), "list"],
+	list: (e, t) => [...C.lists(e), t ?? null]
+}, w = {
 	accept: "Accept",
 	accepted: "Accepted",
 	actions: "Actions",
@@ -150,7 +194,7 @@ var r = {
 	status: "Status",
 	uploadLogo: "Upload logo",
 	userInvitationsEmptyDescription: "Invitations to join an organization will show up here."
-}, b = {
+}, T = {
 	all: ["auth", "organization"],
 	create: [
 		"auth",
@@ -212,9 +256,9 @@ var r = {
 		"organization",
 		"checkSlug"
 	]
-}, x = n("organization", (e = {}) => {
+}, E = n("organization", (e = {}) => {
 	let n = {
-		...y,
+		...w,
 		...e.localization
 	};
 	return {
@@ -242,38 +286,38 @@ var r = {
 			}
 		}
 	};
-}), S = {
+}), D = {
 	all: (t) => [...e.user(t), "organization"],
-	lists: (e) => [...S.all(e), "list"],
-	list: (e, t) => [...S.lists(e), t ?? null],
-	fullDetails: (e) => [...S.all(e), "fullDetails"],
-	fullDetail: (e, t) => [...S.fullDetails(e), t ?? null],
-	activeOrganizations: (e) => [...S.all(e), "active"],
-	activeOrganization: (e, t) => [...S.activeOrganizations(e), t ?? null],
+	lists: (e) => [...D.all(e), "list"],
+	list: (e, t) => [...D.lists(e), t ?? null],
+	fullDetails: (e) => [...D.all(e), "fullDetails"],
+	fullDetail: (e, t) => [...D.fullDetails(e), t ?? null],
+	activeOrganizations: (e) => [...D.all(e), "active"],
+	activeOrganization: (e, t) => [...D.activeOrganizations(e), t ?? null],
 	members: {
-		all: (e) => [...S.all(e), "members"],
-		lists: (e) => [...S.members.all(e), "list"],
-		list: (e, t) => [...S.members.lists(e), t ?? null]
+		all: (e) => [...D.all(e), "members"],
+		lists: (e) => [...D.members.all(e), "list"],
+		list: (e, t) => [...D.members.lists(e), t ?? null]
 	},
 	invitations: {
-		all: (e) => [...S.all(e), "invitations"],
-		lists: (e) => [...S.invitations.all(e), "list"],
-		list: (e, t) => [...S.invitations.lists(e), t ?? null]
+		all: (e) => [...D.all(e), "invitations"],
+		lists: (e) => [...D.invitations.all(e), "list"],
+		list: (e, t) => [...D.invitations.lists(e), t ?? null]
 	},
 	userInvitations: {
-		all: (e) => [...S.all(e), "userInvitations"],
-		lists: (e) => [...S.userInvitations.all(e), "list"],
-		list: (e, t) => [...S.userInvitations.lists(e), t ?? null]
+		all: (e) => [...D.all(e), "userInvitations"],
+		lists: (e) => [...D.userInvitations.all(e), "list"],
+		list: (e, t) => [...D.userInvitations.lists(e), t ?? null]
 	},
 	permissions: {
-		all: (e) => [...S.all(e), "permissions"],
+		all: (e) => [...D.all(e), "permissions"],
 		has: (e, t) => [
-			...S.permissions.all(e),
+			...D.permissions.all(e),
 			"has",
 			t ?? null
 		]
 	}
-}, C = {
+}, O = {
 	passkey: "Passkey",
 	addPasskey: "Add passkey",
 	deletePasskey: "Delete passkey {{name}}",
@@ -283,7 +327,7 @@ var r = {
 	passkeysDescription: "Create a passkey to securely access your account.",
 	noPasskeys: "No passkeys",
 	name: "Name"
-}, w = {
+}, k = {
 	signIn: [
 		"auth",
 		"signIn",
@@ -299,22 +343,22 @@ var r = {
 		"passkey",
 		"deletePasskey"
 	]
-}, T = n("passkey", (e = {}) => ({ localization: {
-	...C,
+}, A = n("passkey", (e = {}) => ({ localization: {
+	...O,
 	...e.localization
-} })), E = {
+} })), j = {
 	all: (t) => [...e.user(t), "passkey"],
-	lists: (e) => [...E.all(e), "list"],
-	list: (e, t) => [...E.lists(e), t ?? null]
-}, D = {
+	lists: (e) => [...j.all(e), "list"],
+	list: (e, t) => [...j.lists(e), t ?? null]
+}, M = {
 	appearance: "Appearance",
 	theme: "Theme",
 	system: "System",
 	light: "Light",
 	dark: "Dark"
-}, O = n("theme", (e) => ({
+}, N = n("theme", (e) => ({
 	localization: {
-		...D,
+		...M,
 		...e.localization
 	},
 	theme: e.theme ?? "system",
@@ -324,7 +368,7 @@ var r = {
 		"light",
 		"dark"
 	]
-})), k = {
+})), P = {
 	username: "Username",
 	usernamePlaceholder: "Username",
 	usernameOrEmailPlaceholder: "Username or email",
@@ -332,16 +376,16 @@ var r = {
 	usernameTaken: "Username is already taken. Please try another.",
 	displayUsername: "Display Username",
 	displayUsernamePlaceholder: "Display Username"
-}, A = {
+}, F = {
 	signIn: [
 		"auth",
 		"signIn",
 		"username"
 	],
 	isUsernameAvailable: ["auth", "isUsernameAvailable"]
-}, j = n("username", (e = {}) => {
+}, I = n("username", (e = {}) => {
 	let t = e.minUsernameLength ?? 3, n = e.maxUsernameLength ?? 30, r = {
-		...k,
+		...P,
 		...e.localization
 	};
 	return {
@@ -369,4 +413,4 @@ var r = {
 	};
 });
 //#endregion
-export { r as apiKeyLocalization, i as apiKeyMutationKeys, a as apiKeyPlugin, o as apiKeyQueryKeys, s as deleteUserLocalization, c as deleteUserMutationKeys, l as deleteUserPlugin, u as lastLoginMethodLocalization, d as lastLoginMethodPlugin, f as magicLinkLocalization, p as magicLinkMutationKeys, m as magicLinkPlugin, h as multiSessionLocalization, g as multiSessionMutationKeys, _ as multiSessionPlugin, v as multiSessionQueryKeys, y as organizationLocalization, b as organizationMutationKeys, x as organizationPlugin, S as organizationQueryKeys, C as passkeyLocalization, w as passkeyMutationKeys, T as passkeyPlugin, E as passkeyQueryKeys, D as themeLocalization, O as themePlugin, k as usernameLocalization, A as usernameMutationKeys, j as usernamePlugin };
+export { r as apiKeyLocalization, i as apiKeyMutationKeys, a as apiKeyPlugin, o as apiKeyQueryKeys, s as deleteUserLocalization, c as deleteUserMutationKeys, l as deleteUserPlugin, u as deviceAuthorizationLocalization, d as deviceAuthorizationMutationKeys, m as deviceAuthorizationPlugin, h as lastLoginMethodLocalization, g as lastLoginMethodPlugin, _ as magicLinkLocalization, v as magicLinkMutationKeys, y as magicLinkPlugin, b as multiSessionLocalization, x as multiSessionMutationKeys, S as multiSessionPlugin, C as multiSessionQueryKeys, w as organizationLocalization, T as organizationMutationKeys, E as organizationPlugin, D as organizationQueryKeys, O as passkeyLocalization, k as passkeyMutationKeys, A as passkeyPlugin, j as passkeyQueryKeys, M as themeLocalization, N as themePlugin, P as usernameLocalization, F as usernameMutationKeys, I as usernamePlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth-ui/core",
-  "version": "1.6.30",
+  "version": "1.6.31",
   "type": "module",
   "scripts": {
     "build": "vite build",

package/src/index.ts

@@ -2,6 +2,7 @@ export * from "./config"
 export * from "./lib/auth-mutation-keys"
 export * from "./lib/auth-plugin"
 export * from "./lib/auth-query-keys"
+export * from "./lib/auth-redirect"
 export * from "./lib/base-paths"
 export * from "./lib/create-auth-plugin"
 export * from "./lib/deep-partial"

package/src/lib/auth-mutation-keys.ts

@@ -19,10 +19,11 @@
  * package the mutation options factory came from.
  *
  * Plugin-specific mutation keys live alongside their plugin (e.g.
- * `apiKeyMutationKeys`, `organizationMutationKeys`, `passkeyMutationKeys`,
- * `magicLinkMutationKeys`, `multiSessionMutationKeys`, `usernameMutationKeys`,
- * `deleteUserMutationKeys`). Plugin-contributed sign-in strategies stay
- * under the shared `["auth", "signIn", ...]` namespace so
+ * `apiKeyMutationKeys`, `deviceAuthorizationMutationKeys`,
+ * `organizationMutationKeys`, `passkeyMutationKeys`, `magicLinkMutationKeys`,
+ * `multiSessionMutationKeys`, `usernameMutationKeys`, `deleteUserMutationKeys`).
+ * Plugin-contributed sign-in strategies stay under the shared
+ * `["auth", "signIn", ...]` namespace so
  * `useIsMutating({ mutationKey: authMutationKeys.signIn.all })` still
  * matches them.
  *

package/src/lib/auth-redirect.ts

@@ -0,0 +1,105 @@
+const ABSOLUTE_HTTP_URL = /^https?:\/\//i
+
+function hasUnsafeRedirectCharacters(value: string): boolean {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0)
+    if (
+      character === "\\" ||
+      codePoint === undefined ||
+      codePoint <= 31 ||
+      codePoint === 127
+    ) {
+      return true
+    }
+  }
+
+  return false
+}
+
+/**
+ * Normalize a redirect target to a same-origin path.
+ *
+ * Root-relative paths and same-origin HTTP(S) URLs are accepted. Invalid,
+ * cross-origin, protocol-relative, and non-HTTP targets fall back to `/`.
+ *
+ * @param redirectTo - Requested redirect target
+ * @param origin - Origin used to validate and normalize the target
+ * @returns A same-origin path including its query string and hash
+ */
+export function getSafeRedirectTo(
+  redirectTo: string | null | undefined,
+  origin: string
+): string {
+  if (!redirectTo || hasUnsafeRedirectCharacters(redirectTo)) return "/"
+
+  const target = redirectTo.trim()
+  if (
+    !target ||
+    target.startsWith("//") ||
+    (!target.startsWith("/") && !ABSOLUTE_HTTP_URL.test(target))
+  ) {
+    return "/"
+  }
+
+  try {
+    const baseURL = new URL(origin)
+    const targetURL = new URL(target, baseURL)
+
+    if (
+      targetURL.origin !== baseURL.origin ||
+      targetURL.username ||
+      targetURL.password
+    ) {
+      return "/"
+    }
+
+    return `${targetURL.pathname}${targetURL.search}${targetURL.hash}`
+  } catch {
+    return "/"
+  }
+}
+
+export type AuthRedirectAction =
+  | { type: "redirect"; to: string }
+  | { type: "signIn"; to: string }
+
+/**
+ * Resolve the next action for the authenticated redirect view.
+ *
+ * Signed-in users continue to the validated target. Signed-out users are sent
+ * to sign in with the current redirect-view URL preserved, allowing the view
+ * to perform a full-page redirect after authentication.
+ *
+ * @param currentURL - Current redirect-view URL
+ * @param authenticated - Whether the current user has a session
+ * @param signInPath - Same-origin path to the sign-in view
+ * @returns The redirect or sign-in action to perform
+ */
+export function getAuthRedirectAction(
+  currentURL: URL,
+  authenticated: boolean,
+  signInPath: string
+): AuthRedirectAction {
+  const requestedTarget = getSafeRedirectTo(
+    currentURL.searchParams.get("redirectTo"),
+    currentURL.origin
+  )
+  const targetURL = new URL(requestedTarget, currentURL.origin)
+  const redirectTo =
+    targetURL.pathname === currentURL.pathname ? "/" : requestedTarget
+
+  if (authenticated) {
+    return { type: "redirect", to: redirectTo }
+  }
+
+  const signInURL = new URL(signInPath, currentURL.origin)
+  signInURL.searchParams.set(
+    "redirectTo",
+    `${currentURL.pathname}${currentURL.search}${currentURL.hash}`
+  )
+
+  return {
+    type: "signIn",
+    to: `${signInURL.pathname}${signInURL.search}${signInURL.hash}`
+  }
+}

package/src/lib/view-paths.ts

@@ -2,6 +2,11 @@
  * View path segments for authentication routes.
  */
 export interface AuthViewPaths {
+  /**
+   * Path segment for the authenticated redirect view
+   * @default "redirect"
+   */
+  redirect: string
   /**
    * Path segment for the sign-in view
    * @default "sign-in"
@@ -67,6 +72,7 @@ export type ViewPaths = {
 
 export const viewPaths: ViewPaths = {
   auth: {
+    redirect: "redirect",
     signIn: "sign-in",
     signUp: "sign-up",
     forgotPassword: "forgot-password",

package/src/plugins/device-authorization/device-authorization-localization.ts

@@ -0,0 +1,36 @@
+export const deviceAuthorizationLocalization = {
+  /** @remarks `"Device Authorization"` */
+  deviceAuthorization: "Device Authorization",
+  /** @remarks `"Enter the code displayed on your device."` */
+  deviceAuthorizationDescription: "Enter the code displayed on your device.",
+  /** @remarks `"Device code"` */
+  deviceCode: "Device code",
+  /** @remarks `"The code is invalid or has expired."` */
+  invalidDeviceCode: "The code is invalid or has expired.",
+  /** @remarks `"Continue"` */
+  continue: "Continue",
+  /** @remarks `"Approve Device"` */
+  approveDevice: "Approve Device",
+  /** @remarks `"A device is requesting access to your account."` */
+  approveDeviceDescription: "A device is requesting access to your account.",
+  /** @remarks `"Signed in as"` */
+  signedInAs: "Signed in as",
+  /** @remarks `"Approve"` */
+  approve: "Approve",
+  /** @remarks `"Deny"` */
+  deny: "Deny",
+  /** @remarks `"Device Approved"` */
+  deviceApproved: "Device Approved",
+  /** @remarks `"The device can now access your account. You can return to it and continue."` */
+  deviceApprovedDescription:
+    "The device can now access your account. You can return to it and continue.",
+  /** @remarks `"Device Denied"` */
+  deviceDenied: "Device Denied",
+  /** @remarks `"The device was not granted access to your account."` */
+  deviceDeniedDescription: "The device was not granted access to your account.",
+  /** @remarks `"Return to application"` */
+  returnToApplication: "Return to application"
+}
+
+export type DeviceAuthorizationLocalization =
+  typeof deviceAuthorizationLocalization

package/src/plugins/device-authorization/device-authorization-mutation-keys.ts

@@ -0,0 +1,16 @@
+/**
+ * Mutation keys contributed by the device-authorization plugin.
+ *
+ * All keys live under the shared `["auth"]` namespace so global auth
+ * mutation observers handle errors consistently.
+ */
+export const deviceAuthorizationMutationKeys = {
+  /** Prefix matching every device-authorization mutation. */
+  all: ["auth", "deviceAuthorization"] as const,
+  /** Key for verifying and claiming a user code. */
+  verify: ["auth", "deviceAuthorization", "verify"] as const,
+  /** Key for approving a pending device request. */
+  approve: ["auth", "deviceAuthorization", "approve"] as const,
+  /** Key for denying a pending device request. */
+  deny: ["auth", "deviceAuthorization", "deny"] as const
+} as const

package/src/plugins/device-authorization/device-authorization-plugin.ts

@@ -0,0 +1,65 @@
+import { createAuthPlugin } from "../../lib/create-auth-plugin"
+// Side-effect import so this file participates in declaration merging on the
+// same module instance that external consumers reach via `@better-auth-ui/core`.
+import type {} from "../../lib/view-paths"
+import {
+  type DeviceAuthorizationLocalization,
+  deviceAuthorizationLocalization
+} from "./device-authorization-localization"
+
+declare module "../../lib/view-paths" {
+  /** Widens `AuthViewPaths` with the device-authorization path when this plugin is imported. */
+  interface AuthViewPaths {
+    /** @default "device" */
+    deviceAuthorization?: string
+  }
+}
+
+export type DeviceAuthorizationPluginOptions = {
+  /**
+   * Override the plugin's default localization strings.
+   * @remarks `DeviceAuthorizationLocalization`
+   */
+  localization?: Partial<DeviceAuthorizationLocalization>
+  /**
+   * URL segment for the device-authorization view.
+   * @remarks `string`
+   * @default "device"
+   */
+  path?: string
+  /**
+   * Number of characters rendered by the device-code input.
+   *
+   * Keep this in sync with Better Auth's `deviceAuthorization({ userCodeLength })`
+   * server option.
+   *
+   * @default 8
+   */
+  userCodeLength?: number
+}
+
+const DEFAULT_USER_CODE_LENGTH = 8
+
+function resolveUserCodeLength(value?: number) {
+  if (value === undefined || !Number.isFinite(value)) {
+    return DEFAULT_USER_CODE_LENGTH
+  }
+
+  return Math.max(1, Math.floor(value))
+}
+
+export const deviceAuthorizationPlugin = createAuthPlugin(
+  "deviceAuthorization",
+  (options: DeviceAuthorizationPluginOptions = {}) => ({
+    localization: {
+      ...deviceAuthorizationLocalization,
+      ...options.localization
+    },
+    userCodeLength: resolveUserCodeLength(options.userCodeLength),
+    viewPaths: {
+      auth: {
+        deviceAuthorization: options.path ?? "device"
+      }
+    }
+  })
+)

package/src/plugins.ts

@@ -5,6 +5,9 @@ export * from "./plugins/api-key/api-key-query-keys"
 export * from "./plugins/delete-user/delete-user-localization"
 export * from "./plugins/delete-user/delete-user-mutation-keys"
 export * from "./plugins/delete-user/delete-user-plugin"
+export * from "./plugins/device-authorization/device-authorization-localization"
+export * from "./plugins/device-authorization/device-authorization-mutation-keys"
+export * from "./plugins/device-authorization/device-authorization-plugin"
 export * from "./plugins/last-login-method/last-login-method-localization"
 export * from "./plugins/last-login-method/last-login-method-plugin"
 export * from "./plugins/magic-link/magic-link-localization"