@better-auth-ui/core 1.6.30 → 1.6.32

package/src/plugins/device-authorization/device-authorization-plugin.ts

@@ -0,0 +1,65 @@
+import { createAuthPlugin } from "../../lib/create-auth-plugin"
+// Side-effect import so this file participates in declaration merging on the
+// same module instance that external consumers reach via `@better-auth-ui/core`.
+import type {} from "../../lib/view-paths"
+import {
+  type DeviceAuthorizationLocalization,
+  deviceAuthorizationLocalization
+} from "./device-authorization-localization"
+
+declare module "../../lib/view-paths" {
+  /** Widens `AuthViewPaths` with the device-authorization path when this plugin is imported. */
+  interface AuthViewPaths {
+    /** @default "device" */
+    deviceAuthorization?: string
+  }
+}
+
+export type DeviceAuthorizationPluginOptions = {
+  /**
+   * Override the plugin's default localization strings.
+   * @remarks `DeviceAuthorizationLocalization`
+   */
+  localization?: Partial<DeviceAuthorizationLocalization>
+  /**
+   * URL segment for the device-authorization view.
+   * @remarks `string`
+   * @default "device"
+   */
+  path?: string
+  /**
+   * Number of characters rendered by the device-code input.
+   *
+   * Keep this in sync with Better Auth's `deviceAuthorization({ userCodeLength })`
+   * server option.
+   *
+   * @default 8
+   */
+  userCodeLength?: number
+}
+
+const DEFAULT_USER_CODE_LENGTH = 8
+
+function resolveUserCodeLength(value?: number) {
+  if (value === undefined || !Number.isFinite(value)) {
+    return DEFAULT_USER_CODE_LENGTH
+  }
+
+  return Math.max(1, Math.floor(value))
+}
+
+export const deviceAuthorizationPlugin = createAuthPlugin(
+  "deviceAuthorization",
+  (options: DeviceAuthorizationPluginOptions = {}) => ({
+    localization: {
+      ...deviceAuthorizationLocalization,
+      ...options.localization
+    },
+    userCodeLength: resolveUserCodeLength(options.userCodeLength),
+    viewPaths: {
+      auth: {
+        deviceAuthorization: options.path ?? "device"
+      }
+    }
+  })
+)

package/src/plugins/oauth-provider/oauth-provider-localization.ts

@@ -0,0 +1,27 @@
+export const oauthProviderLocalization = {
+  /** @remarks `"Authorize {{client}}"` */
+  authorize: "Authorize {{client}}",
+  /** @remarks `"{{client}} wants to access your account."` */
+  authorizationDescription: "{{client}} wants to access your account.",
+  /** @remarks `"This will allow {{client}} to:"` */
+  requestedPermissions: "This will allow {{client}} to:",
+  /** @remarks `"Signed in as"` */
+  signedInAs: "Signed in as",
+  /** @remarks `"Allow"` */
+  allow: "Allow",
+  /** @remarks `"Cancel"` */
+  cancel: "Cancel",
+  /** @remarks `"Privacy policy"` */
+  privacyPolicy: "Privacy policy",
+  /** @remarks `"Terms of service"` */
+  termsOfService: "Terms of service",
+  /** @remarks `"Invalid authorization request"` */
+  invalidRequest: "Invalid authorization request",
+  /** @remarks `"This authorization request is missing required information or is no longer valid."` */
+  invalidRequestDescription:
+    "This authorization request is missing required information or is no longer valid.",
+  /** @remarks `"Application"` */
+  application: "Application"
+}
+
+export type OAuthProviderLocalization = typeof oauthProviderLocalization

package/src/plugins/oauth-provider/oauth-provider-mutation-keys.ts

@@ -0,0 +1,12 @@
+/**
+ * Mutation keys contributed by the OAuth provider plugin.
+ *
+ * All keys live under the shared `["auth"]` namespace so global auth
+ * mutation observers handle errors consistently.
+ */
+export const oauthProviderMutationKeys = {
+  /** Prefix matching every OAuth provider mutation. */
+  all: ["auth", "oauthProvider"] as const,
+  /** Key for accepting or denying an OAuth authorization request. */
+  consent: ["auth", "oauthProvider", "consent"] as const
+} as const

package/src/plugins/oauth-provider/oauth-provider-plugin.ts

@@ -0,0 +1,132 @@
+import { createAuthPlugin } from "../../lib/create-auth-plugin"
+// Side-effect import so this file participates in declaration merging on the
+// same module instance that external consumers reach via `@better-auth-ui/core`.
+import type {} from "../../lib/view-paths"
+import {
+  type OAuthProviderLocalization,
+  oauthProviderLocalization
+} from "./oauth-provider-localization"
+
+declare module "../../lib/view-paths" {
+  /** Widens `AuthViewPaths` with the OAuth consent path when this plugin is imported. */
+  interface AuthViewPaths {
+    /** @default "consent" */
+    oauthConsent?: string
+  }
+}
+
+export type OAuthScopeMetadata = {
+  /** Short permission label displayed to the user. */
+  label: string
+  /** Optional explanation of the data or access represented by the scope. */
+  description?: string
+}
+
+export type OAuthScopeMetadataMap = Record<string, OAuthScopeMetadata>
+
+export const oauthProviderScopeMetadata: OAuthScopeMetadataMap = {
+  openid: {
+    label: "Verify your identity",
+    description: "Access your unique account identifier."
+  },
+  profile: {
+    label: "View your profile",
+    description: "View your name and profile picture."
+  },
+  email: {
+    label: "View your email address",
+    description: "View your email address and whether it is verified."
+  },
+  offline_access: {
+    label: "Maintain access",
+    description:
+      "Access your data when you are not actively using the application."
+  }
+}
+
+export type OAuthAuthorizationRequest = {
+  clientId?: string
+  scopes: string[]
+}
+
+/**
+ * Keep client-controlled links and images on browser-safe web protocols.
+ */
+export function sanitizeOAuthClientUrl(
+  value: string | null | undefined
+): string | undefined {
+  if (!value) return undefined
+
+  try {
+    const url = new URL(value)
+
+    return url.protocol === "https:" || url.protocol === "http:"
+      ? url.href
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Read the display-safe parts of Better Auth's signed authorization query.
+ *
+ * The complete query string must remain in the browser URL so
+ * `oauthProviderClient()` can forward and verify it during consent.
+ */
+export function parseOAuthAuthorizationRequest(
+  search: string
+): OAuthAuthorizationRequest {
+  const params = new URLSearchParams(search)
+  const clientId = params.get("client_id")?.trim() || undefined
+  const scopes = Array.from(
+    new Set(
+      (params.get("scope") ?? "")
+        .split(/\s+/)
+        .map((scope) => scope.trim())
+        .filter(Boolean)
+    )
+  )
+
+  return { clientId, scopes }
+}
+
+export type OAuthProviderPluginOptions = {
+  /**
+   * Override the plugin's default localization strings.
+   * @remarks `OAuthProviderLocalization`
+   */
+  localization?: Partial<OAuthProviderLocalization>
+  /**
+   * URL segment for the OAuth consent view.
+   * @remarks `string`
+   * @default "consent"
+   */
+  path?: string
+  /**
+   * Labels and descriptions for custom OAuth scopes.
+   *
+   * Entries override the built-in metadata for `openid`, `profile`, `email`,
+   * and `offline_access`. Unknown scopes remain visible using their raw value.
+   */
+  scopeMetadata?: OAuthScopeMetadataMap
+}
+
+export const oauthProviderPlugin = createAuthPlugin(
+  "oauthProvider",
+  (options: OAuthProviderPluginOptions = {}) => ({
+    localization: {
+      ...oauthProviderLocalization,
+      ...options.localization
+    },
+    scopeMetadata: {
+      ...oauthProviderScopeMetadata,
+      ...options.scopeMetadata
+    },
+    viewPaths: {
+      auth: {
+        oauthConsent: options.path ?? "consent"
+      }
+    }
+  })
+)

package/src/plugins/oauth-provider/oauth-provider-query-keys.ts

@@ -0,0 +1,10 @@
+/** Query keys contributed by the OAuth provider plugin. */
+export const oauthProviderQueryKeys = {
+  /** Prefix matching every OAuth provider query. */
+  all: ["auth", "oauthProvider"] as const,
+  /** Prefix for public OAuth client metadata queries. */
+  publicClients: ["auth", "oauthProvider", "publicClient"] as const,
+  /** Key for the public metadata of a specific OAuth client. */
+  publicClient: (clientId: string | undefined) =>
+    [...oauthProviderQueryKeys.publicClients, clientId ?? null] as const
+} as const

package/src/plugins.ts

@@ -1,3 +1,6 @@
+export * from "./plugins/admin/admin-localization"
+export * from "./plugins/admin/admin-mutation-keys"
+export * from "./plugins/admin/admin-plugin"
 export * from "./plugins/api-key/api-key-localization"
 export * from "./plugins/api-key/api-key-mutation-keys"
 export * from "./plugins/api-key/api-key-plugin"
@@ -5,6 +8,9 @@ export * from "./plugins/api-key/api-key-query-keys"
 export * from "./plugins/delete-user/delete-user-localization"
 export * from "./plugins/delete-user/delete-user-mutation-keys"
 export * from "./plugins/delete-user/delete-user-plugin"
+export * from "./plugins/device-authorization/device-authorization-localization"
+export * from "./plugins/device-authorization/device-authorization-mutation-keys"
+export * from "./plugins/device-authorization/device-authorization-plugin"
 export * from "./plugins/last-login-method/last-login-method-localization"
 export * from "./plugins/last-login-method/last-login-method-plugin"
 export * from "./plugins/magic-link/magic-link-localization"
@@ -14,6 +20,10 @@ export * from "./plugins/multi-session/multi-session-localization"
 export * from "./plugins/multi-session/multi-session-mutation-keys"
 export * from "./plugins/multi-session/multi-session-plugin"
 export * from "./plugins/multi-session/multi-session-query-keys"
+export * from "./plugins/oauth-provider/oauth-provider-localization"
+export * from "./plugins/oauth-provider/oauth-provider-mutation-keys"
+export * from "./plugins/oauth-provider/oauth-provider-plugin"
+export * from "./plugins/oauth-provider/oauth-provider-query-keys"
 export * from "./plugins/organization/organization-localization"
 export * from "./plugins/organization/organization-mutation-keys"
 export * from "./plugins/organization/organization-plugin"