@better-auth-ui/core 1.6.31 → 1.6.32

package/dist/plugins/admin/admin-localization.d.ts

@@ -0,0 +1,5 @@
+export declare const adminLocalization: {
+    /** @remarks `"Stop impersonating"` */
+    stopImpersonating: string;
+};
+export type AdminLocalization = typeof adminLocalization;

package/dist/plugins/admin/admin-mutation-keys.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Mutation keys contributed by the admin plugin.
+ */
+export declare const adminMutationKeys: {
+    /** Root key for every admin mutation. */
+    readonly all: readonly ["auth", "admin"];
+    /** Key for `admin.stopImpersonating`. */
+    readonly stopImpersonating: readonly ["auth", "admin", "stopImpersonating"];
+};

package/dist/plugins/admin/admin-plugin.d.ts

@@ -0,0 +1,32 @@
+import { AdminLocalization } from './admin-localization';
+export type AdminPluginOptions = {
+    /**
+     * Override the plugin's default localization strings.
+     * @remarks `AdminLocalization`
+     */
+    localization?: Partial<AdminLocalization>;
+};
+export type ImpersonatingSession = {
+    session: {
+        impersonatedBy: string;
+    };
+};
+/**
+ * Check whether a Better Auth session belongs to an impersonated user.
+ */
+export declare function isImpersonatingSession(session: unknown): session is ImpersonatingSession;
+/**
+ * Adds UI integrations for Better Auth's admin plugin.
+ *
+ * Pair this UI plugin with Better Auth's `admin()` server plugin and
+ * `adminClient()` client plugin.
+ */
+export declare const adminPlugin: ((options?: AdminPluginOptions | undefined) => {
+    localization: {
+        stopImpersonating: string;
+    };
+} & {
+    id: "admin";
+}) & {
+    id: "admin";
+};

package/dist/plugins/oauth-provider/oauth-provider-localization.d.ts

@@ -0,0 +1,25 @@
+export declare const oauthProviderLocalization: {
+    /** @remarks `"Authorize {{client}}"` */
+    authorize: string;
+    /** @remarks `"{{client}} wants to access your account."` */
+    authorizationDescription: string;
+    /** @remarks `"This will allow {{client}} to:"` */
+    requestedPermissions: string;
+    /** @remarks `"Signed in as"` */
+    signedInAs: string;
+    /** @remarks `"Allow"` */
+    allow: string;
+    /** @remarks `"Cancel"` */
+    cancel: string;
+    /** @remarks `"Privacy policy"` */
+    privacyPolicy: string;
+    /** @remarks `"Terms of service"` */
+    termsOfService: string;
+    /** @remarks `"Invalid authorization request"` */
+    invalidRequest: string;
+    /** @remarks `"This authorization request is missing required information or is no longer valid."` */
+    invalidRequestDescription: string;
+    /** @remarks `"Application"` */
+    application: string;
+};
+export type OAuthProviderLocalization = typeof oauthProviderLocalization;

package/dist/plugins/oauth-provider/oauth-provider-mutation-keys.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Mutation keys contributed by the OAuth provider plugin.
+ *
+ * All keys live under the shared `["auth"]` namespace so global auth
+ * mutation observers handle errors consistently.
+ */
+export declare const oauthProviderMutationKeys: {
+    /** Prefix matching every OAuth provider mutation. */
+    readonly all: readonly ["auth", "oauthProvider"];
+    /** Key for accepting or denying an OAuth authorization request. */
+    readonly consent: readonly ["auth", "oauthProvider", "consent"];
+};

package/dist/plugins/oauth-provider/oauth-provider-plugin.d.ts

@@ -0,0 +1,78 @@
+import { OAuthProviderLocalization } from './oauth-provider-localization';
+declare module "../../lib/view-paths" {
+    /** Widens `AuthViewPaths` with the OAuth consent path when this plugin is imported. */
+    interface AuthViewPaths {
+        /** @default "consent" */
+        oauthConsent?: string;
+    }
+}
+export type OAuthScopeMetadata = {
+    /** Short permission label displayed to the user. */
+    label: string;
+    /** Optional explanation of the data or access represented by the scope. */
+    description?: string;
+};
+export type OAuthScopeMetadataMap = Record<string, OAuthScopeMetadata>;
+export declare const oauthProviderScopeMetadata: OAuthScopeMetadataMap;
+export type OAuthAuthorizationRequest = {
+    clientId?: string;
+    scopes: string[];
+};
+/**
+ * Keep client-controlled links and images on browser-safe web protocols.
+ */
+export declare function sanitizeOAuthClientUrl(value: string | null | undefined): string | undefined;
+/**
+ * Read the display-safe parts of Better Auth's signed authorization query.
+ *
+ * The complete query string must remain in the browser URL so
+ * `oauthProviderClient()` can forward and verify it during consent.
+ */
+export declare function parseOAuthAuthorizationRequest(search: string): OAuthAuthorizationRequest;
+export type OAuthProviderPluginOptions = {
+    /**
+     * Override the plugin's default localization strings.
+     * @remarks `OAuthProviderLocalization`
+     */
+    localization?: Partial<OAuthProviderLocalization>;
+    /**
+     * URL segment for the OAuth consent view.
+     * @remarks `string`
+     * @default "consent"
+     */
+    path?: string;
+    /**
+     * Labels and descriptions for custom OAuth scopes.
+     *
+     * Entries override the built-in metadata for `openid`, `profile`, `email`,
+     * and `offline_access`. Unknown scopes remain visible using their raw value.
+     */
+    scopeMetadata?: OAuthScopeMetadataMap;
+};
+export declare const oauthProviderPlugin: ((options?: OAuthProviderPluginOptions | undefined) => {
+    localization: {
+        authorize: string;
+        authorizationDescription: string;
+        requestedPermissions: string;
+        signedInAs: string;
+        allow: string;
+        cancel: string;
+        privacyPolicy: string;
+        termsOfService: string;
+        invalidRequest: string;
+        invalidRequestDescription: string;
+        application: string;
+    };
+    scopeMetadata: {
+        [x: string]: OAuthScopeMetadata;
+    };
+    viewPaths: {
+        auth: {
+            oauthConsent: string;
+        };
+    };
+} & {
+    id: "oauthProvider";
+}) & {
+    id: "oauthProvider";
+};

package/dist/plugins/oauth-provider/oauth-provider-query-keys.d.ts

@@ -0,0 +1,9 @@
+/** Query keys contributed by the OAuth provider plugin. */
+export declare const oauthProviderQueryKeys: {
+    /** Prefix matching every OAuth provider query. */
+    readonly all: readonly ["auth", "oauthProvider"];
+    /** Prefix for public OAuth client metadata queries. */
+    readonly publicClients: readonly ["auth", "oauthProvider", "publicClient"];
+    /** Key for the public metadata of a specific OAuth client. */
+    readonly publicClient: (clientId: string | undefined) => readonly ["auth", "oauthProvider", "publicClient", string | null];
+};

package/dist/plugins.d.ts

@@ -1,3 +1,6 @@
+export * from './plugins/admin/admin-localization';
+export * from './plugins/admin/admin-mutation-keys';
+export * from './plugins/admin/admin-plugin';
 export * from './plugins/api-key/api-key-localization';
 export * from './plugins/api-key/api-key-mutation-keys';
 export * from './plugins/api-key/api-key-plugin';
@@ -17,6 +20,10 @@ export * from './plugins/multi-session/multi-session-localization';
 export * from './plugins/multi-session/multi-session-mutation-keys';
 export * from './plugins/multi-session/multi-session-plugin';
 export * from './plugins/multi-session/multi-session-query-keys';
+export * from './plugins/oauth-provider/oauth-provider-localization';
+export * from './plugins/oauth-provider/oauth-provider-mutation-keys';
+export * from './plugins/oauth-provider/oauth-provider-plugin';
+export * from './plugins/oauth-provider/oauth-provider-query-keys';
 export * from './plugins/organization/organization-localization';
 export * from './plugins/organization/organization-mutation-keys';
 export * from './plugins/organization/organization-plugin';

package/dist/plugins.js

@@ -1,6 +1,22 @@
 import { n as e, r as t, t as n } from "./create-auth-plugin-D4wsYnHD.js";
-//#region src/plugins/api-key/api-key-localization.ts
-var r = {
+//#region src/plugins/admin/admin-localization.ts
+var r = { stopImpersonating: "Stop impersonating" }, i = {
+	all: ["auth", "admin"],
+	stopImpersonating: [
+		"auth",
+		"admin",
+		"stopImpersonating"
+	]
+};
+//#endregion
+//#region src/plugins/admin/admin-plugin.ts
+function a(e) {
+	return !e || typeof e != "object" || !("session" in e) || !e.session || typeof e.session != "object" || !("impersonatedBy" in e.session) ? !1 : typeof e.session.impersonatedBy == "string" && e.session.impersonatedBy.length > 0;
+}
+var o = n("admin", (e = {}) => ({ localization: {
+	...r,
+	...e.localization
+} })), s = {
 	apiKey: "API key",
 	apiKeys: "API keys",
 	apiKeysDescription: "Create an API key for programmatic access to your account.",
@@ -12,7 +28,7 @@ var r = {
 	deleteApiKey: "Delete API key",
 	deleteApiKeyWarning: "This action cannot be undone. Any service using this API key will stop working immediately.",
 	dismissNewKey: "I've saved my key"
-}, i = {
+}, c = {
 	all: ["auth", "apiKey"],
 	create: [
 		"auth",
@@ -24,28 +40,28 @@ var r = {
 		"apiKey",
 		"delete"
 	]
-}, a = n("apiKey", (e = {}) => ({
+}, l = n("apiKey", (e = {}) => ({
 	localization: {
-		...r,
+		...s,
 		...e.localization
 	},
 	organization: e.organization ?? !1
-})), o = {
+})), u = {
 	all: (t) => [...e.user(t), "apiKey"],
-	lists: (e) => [...o.all(e), "list"],
-	list: (e, t) => [...o.lists(e), t ?? null]
-}, s = {
+	lists: (e) => [...u.all(e), "list"],
+	list: (e, t) => [...u.lists(e), t ?? null]
+}, d = {
 	deleteAccount: "Delete account",
 	deleteAccountDescription: "Permanently remove your account and all associated data. This cannot be undone.",
 	deleteUserVerificationSent: "Check your email to confirm account deletion.",
 	deleteUserSuccess: "Your account has been deleted."
-}, c = { deleteUser: ["auth", "deleteUser"] }, l = n("deleteUser", (e = {}) => ({
+}, f = { deleteUser: ["auth", "deleteUser"] }, p = n("deleteUser", (e = {}) => ({
 	localization: {
-		...s,
+		...d,
 		...e.localization
 	},
 	sendDeleteAccountVerification: e.sendDeleteAccountVerification ?? !1
-})), u = {
+})), m = {
 	deviceAuthorization: "Device Authorization",
 	deviceAuthorizationDescription: "Enter the code displayed on your device.",
 	deviceCode: "Device code",
@@ -61,7 +77,7 @@ var r = {
 	deviceDenied: "Device Denied",
 	deviceDeniedDescription: "The device was not granted access to your account.",
 	returnToApplication: "Return to application"
-}, d = {
+}, h = {
 	all: ["auth", "deviceAuthorization"],
 	verify: [
 		"auth",
@@ -78,47 +94,47 @@ var r = {
 		"deviceAuthorization",
 		"deny"
 	]
-}, f = 8;
-function p(e) {
-	return e === void 0 || !Number.isFinite(e) ? f : Math.max(1, Math.floor(e));
+}, g = 8;
+function _(e) {
+	return e === void 0 || !Number.isFinite(e) ? g : Math.max(1, Math.floor(e));
 }
-var m = n("deviceAuthorization", (e = {}) => ({
+var v = n("deviceAuthorization", (e = {}) => ({
 	localization: {
-		...u,
+		...m,
 		...e.localization
 	},
-	userCodeLength: p(e.userCodeLength),
+	userCodeLength: _(e.userCodeLength),
 	viewPaths: { auth: { deviceAuthorization: e.path ?? "device" } }
-})), h = {
+})), y = {
 	lastUsed: "Last used",
 	lastUsedShort: "Last"
-}, g = n("lastLoginMethod", (e = {}) => ({ localization: {
-	...h,
+}, b = n("lastLoginMethod", (e = {}) => ({ localization: {
+	...y,
 	...e.localization
-} })), _ = {
+} })), x = {
 	magicLink: "Magic Link",
 	sendMagicLink: "Send Magic Link",
 	magicLinkSent: "Check your email for the magic link",
 	magicLinkSentTo: "We sent a magic link to {{email}}"
-}, v = { signIn: [
+}, S = { signIn: [
 	"auth",
 	"signIn",
 	"magicLink"
-] }, y = n("magicLink", (e = {}) => ({
+] }, C = n("magicLink", (e = {}) => ({
 	localization: {
-		..._,
+		...x,
 		...e.localization
 	},
 	viewPaths: { auth: {
 		magicLink: e.path ?? "magic-link",
 		magicLinkSent: e.sentPath ?? "magic-link-sent"
 	} }
-})), b = {
+})), w = {
 	switchAccount: "Switch Account",
 	addAccount: "Add Account",
 	manageAccounts: "Manage accounts",
 	manageAccountsDescription: "Manage your accounts for secure access."
-}, x = {
+}, T = {
 	all: ["auth", "multiSession"],
 	revoke: [
 		"auth",
@@ -130,14 +146,84 @@ var m = n("deviceAuthorization", (e = {}) => ({
 		"multiSession",
 		"setActive"
 	]
-}, S = n("multiSession", (e = {}) => ({ localization: {
-	...b,
+}, E = n("multiSession", (e = {}) => ({ localization: {
+	...w,
 	...e.localization
-} })), C = {
+} })), D = {
 	all: (t) => [...e.user(t), "multiSession"],
-	lists: (e) => [...C.all(e), "list"],
-	list: (e, t) => [...C.lists(e), t ?? null]
-}, w = {
+	lists: (e) => [...D.all(e), "list"],
+	list: (e, t) => [...D.lists(e), t ?? null]
+}, O = {
+	authorize: "Authorize {{client}}",
+	authorizationDescription: "{{client}} wants to access your account.",
+	requestedPermissions: "This will allow {{client}} to:",
+	signedInAs: "Signed in as",
+	allow: "Allow",
+	cancel: "Cancel",
+	privacyPolicy: "Privacy policy",
+	termsOfService: "Terms of service",
+	invalidRequest: "Invalid authorization request",
+	invalidRequestDescription: "This authorization request is missing required information or is no longer valid.",
+	application: "Application"
+}, k = {
+	all: ["auth", "oauthProvider"],
+	consent: [
+		"auth",
+		"oauthProvider",
+		"consent"
+	]
+}, A = {
+	openid: {
+		label: "Verify your identity",
+		description: "Access your unique account identifier."
+	},
+	profile: {
+		label: "View your profile",
+		description: "View your name and profile picture."
+	},
+	email: {
+		label: "View your email address",
+		description: "View your email address and whether it is verified."
+	},
+	offline_access: {
+		label: "Maintain access",
+		description: "Access your data when you are not actively using the application."
+	}
+};
+function j(e) {
+	if (e) try {
+		let t = new URL(e);
+		return t.protocol === "https:" || t.protocol === "http:" ? t.href : void 0;
+	} catch {
+		return;
+	}
+}
+function M(e) {
+	let t = new URLSearchParams(e);
+	return {
+		clientId: t.get("client_id")?.trim() || void 0,
+		scopes: Array.from(new Set((t.get("scope") ?? "").split(/\s+/).map((e) => e.trim()).filter(Boolean)))
+	};
+}
+var N = n("oauthProvider", (e = {}) => ({
+	localization: {
+		...O,
+		...e.localization
+	},
+	scopeMetadata: {
+		...A,
+		...e.scopeMetadata
+	},
+	viewPaths: { auth: { oauthConsent: e.path ?? "consent" } }
+})), P = {
+	all: ["auth", "oauthProvider"],
+	publicClients: [
+		"auth",
+		"oauthProvider",
+		"publicClient"
+	],
+	publicClient: (e) => [...P.publicClients, e ?? null]
+}, F = {
 	accept: "Accept",
 	accepted: "Accepted",
 	actions: "Actions",
@@ -194,7 +280,7 @@ var m = n("deviceAuthorization", (e = {}) => ({
 	status: "Status",
 	uploadLogo: "Upload logo",
 	userInvitationsEmptyDescription: "Invitations to join an organization will show up here."
-}, T = {
+}, I = {
 	all: ["auth", "organization"],
 	create: [
 		"auth",
@@ -256,9 +342,9 @@ var m = n("deviceAuthorization", (e = {}) => ({
 		"organization",
 		"checkSlug"
 	]
-}, E = n("organization", (e = {}) => {
+}, L = n("organization", (e = {}) => {
 	let n = {
-		...w,
+		...F,
 		...e.localization
 	};
 	return {
@@ -286,38 +372,38 @@ var m = n("deviceAuthorization", (e = {}) => ({
 			}
 		}
 	};
-}), D = {
+}), R = {
 	all: (t) => [...e.user(t), "organization"],
-	lists: (e) => [...D.all(e), "list"],
-	list: (e, t) => [...D.lists(e), t ?? null],
-	fullDetails: (e) => [...D.all(e), "fullDetails"],
-	fullDetail: (e, t) => [...D.fullDetails(e), t ?? null],
-	activeOrganizations: (e) => [...D.all(e), "active"],
-	activeOrganization: (e, t) => [...D.activeOrganizations(e), t ?? null],
+	lists: (e) => [...R.all(e), "list"],
+	list: (e, t) => [...R.lists(e), t ?? null],
+	fullDetails: (e) => [...R.all(e), "fullDetails"],
+	fullDetail: (e, t) => [...R.fullDetails(e), t ?? null],
+	activeOrganizations: (e) => [...R.all(e), "active"],
+	activeOrganization: (e, t) => [...R.activeOrganizations(e), t ?? null],
 	members: {
-		all: (e) => [...D.all(e), "members"],
-		lists: (e) => [...D.members.all(e), "list"],
-		list: (e, t) => [...D.members.lists(e), t ?? null]
+		all: (e) => [...R.all(e), "members"],
+		lists: (e) => [...R.members.all(e), "list"],
+		list: (e, t) => [...R.members.lists(e), t ?? null]
 	},
 	invitations: {
-		all: (e) => [...D.all(e), "invitations"],
-		lists: (e) => [...D.invitations.all(e), "list"],
-		list: (e, t) => [...D.invitations.lists(e), t ?? null]
+		all: (e) => [...R.all(e), "invitations"],
+		lists: (e) => [...R.invitations.all(e), "list"],
+		list: (e, t) => [...R.invitations.lists(e), t ?? null]
 	},
 	userInvitations: {
-		all: (e) => [...D.all(e), "userInvitations"],
-		lists: (e) => [...D.userInvitations.all(e), "list"],
-		list: (e, t) => [...D.userInvitations.lists(e), t ?? null]
+		all: (e) => [...R.all(e), "userInvitations"],
+		lists: (e) => [...R.userInvitations.all(e), "list"],
+		list: (e, t) => [...R.userInvitations.lists(e), t ?? null]
 	},
 	permissions: {
-		all: (e) => [...D.all(e), "permissions"],
+		all: (e) => [...R.all(e), "permissions"],
 		has: (e, t) => [
-			...D.permissions.all(e),
+			...R.permissions.all(e),
 			"has",
 			t ?? null
 		]
 	}
-}, O = {
+}, z = {
 	passkey: "Passkey",
 	addPasskey: "Add passkey",
 	deletePasskey: "Delete passkey {{name}}",
@@ -327,7 +413,7 @@ var m = n("deviceAuthorization", (e = {}) => ({
 	passkeysDescription: "Create a passkey to securely access your account.",
 	noPasskeys: "No passkeys",
 	name: "Name"
-}, k = {
+}, B = {
 	signIn: [
 		"auth",
 		"signIn",
@@ -343,22 +429,22 @@ var m = n("deviceAuthorization", (e = {}) => ({
 		"passkey",
 		"deletePasskey"
 	]
-}, A = n("passkey", (e = {}) => ({ localization: {
-	...O,
+}, V = n("passkey", (e = {}) => ({ localization: {
+	...z,
 	...e.localization
-} })), j = {
+} })), H = {
 	all: (t) => [...e.user(t), "passkey"],
-	lists: (e) => [...j.all(e), "list"],
-	list: (e, t) => [...j.lists(e), t ?? null]
-}, M = {
+	lists: (e) => [...H.all(e), "list"],
+	list: (e, t) => [...H.lists(e), t ?? null]
+}, U = {
 	appearance: "Appearance",
 	theme: "Theme",
 	system: "System",
 	light: "Light",
 	dark: "Dark"
-}, N = n("theme", (e) => ({
+}, W = n("theme", (e) => ({
 	localization: {
-		...M,
+		...U,
 		...e.localization
 	},
 	theme: e.theme ?? "system",
@@ -368,7 +454,7 @@ var m = n("deviceAuthorization", (e = {}) => ({
 		"light",
 		"dark"
 	]
-})), P = {
+})), G = {
 	username: "Username",
 	usernamePlaceholder: "Username",
 	usernameOrEmailPlaceholder: "Username or email",
@@ -376,16 +462,16 @@ var m = n("deviceAuthorization", (e = {}) => ({
 	usernameTaken: "Username is already taken. Please try another.",
 	displayUsername: "Display Username",
 	displayUsernamePlaceholder: "Display Username"
-}, F = {
+}, K = {
 	signIn: [
 		"auth",
 		"signIn",
 		"username"
 	],
 	isUsernameAvailable: ["auth", "isUsernameAvailable"]
-}, I = n("username", (e = {}) => {
+}, q = n("username", (e = {}) => {
 	let t = e.minUsernameLength ?? 3, n = e.maxUsernameLength ?? 30, r = {
-		...P,
+		...G,
 		...e.localization
 	};
 	return {
@@ -413,4 +499,4 @@ var m = n("deviceAuthorization", (e = {}) => ({
 	};
 });
 //#endregion
-export { r as apiKeyLocalization, i as apiKeyMutationKeys, a as apiKeyPlugin, o as apiKeyQueryKeys, s as deleteUserLocalization, c as deleteUserMutationKeys, l as deleteUserPlugin, u as deviceAuthorizationLocalization, d as deviceAuthorizationMutationKeys, m as deviceAuthorizationPlugin, h as lastLoginMethodLocalization, g as lastLoginMethodPlugin, _ as magicLinkLocalization, v as magicLinkMutationKeys, y as magicLinkPlugin, b as multiSessionLocalization, x as multiSessionMutationKeys, S as multiSessionPlugin, C as multiSessionQueryKeys, w as organizationLocalization, T as organizationMutationKeys, E as organizationPlugin, D as organizationQueryKeys, O as passkeyLocalization, k as passkeyMutationKeys, A as passkeyPlugin, j as passkeyQueryKeys, M as themeLocalization, N as themePlugin, P as usernameLocalization, F as usernameMutationKeys, I as usernamePlugin };
+export { r as adminLocalization, i as adminMutationKeys, o as adminPlugin, s as apiKeyLocalization, c as apiKeyMutationKeys, l as apiKeyPlugin, u as apiKeyQueryKeys, d as deleteUserLocalization, f as deleteUserMutationKeys, p as deleteUserPlugin, m as deviceAuthorizationLocalization, h as deviceAuthorizationMutationKeys, v as deviceAuthorizationPlugin, a as isImpersonatingSession, y as lastLoginMethodLocalization, b as lastLoginMethodPlugin, x as magicLinkLocalization, S as magicLinkMutationKeys, C as magicLinkPlugin, w as multiSessionLocalization, T as multiSessionMutationKeys, E as multiSessionPlugin, D as multiSessionQueryKeys, O as oauthProviderLocalization, k as oauthProviderMutationKeys, N as oauthProviderPlugin, P as oauthProviderQueryKeys, A as oauthProviderScopeMetadata, F as organizationLocalization, I as organizationMutationKeys, L as organizationPlugin, R as organizationQueryKeys, M as parseOAuthAuthorizationRequest, z as passkeyLocalization, B as passkeyMutationKeys, V as passkeyPlugin, H as passkeyQueryKeys, j as sanitizeOAuthClientUrl, U as themeLocalization, W as themePlugin, G as usernameLocalization, K as usernameMutationKeys, q as usernamePlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth-ui/core",
-  "version": "1.6.31",
+  "version": "1.6.32",
   "type": "module",
   "scripts": {
     "build": "vite build",

package/src/plugins/admin/admin-localization.ts

@@ -0,0 +1,6 @@
+export const adminLocalization = {
+  /** @remarks `"Stop impersonating"` */
+  stopImpersonating: "Stop impersonating"
+}
+
+export type AdminLocalization = typeof adminLocalization

package/src/plugins/admin/admin-mutation-keys.ts

@@ -0,0 +1,9 @@
+/**
+ * Mutation keys contributed by the admin plugin.
+ */
+export const adminMutationKeys = {
+  /** Root key for every admin mutation. */
+  all: ["auth", "admin"] as const,
+  /** Key for `admin.stopImpersonating`. */
+  stopImpersonating: ["auth", "admin", "stopImpersonating"] as const
+} as const

package/src/plugins/admin/admin-plugin.ts

@@ -0,0 +1,52 @@
+import { createAuthPlugin } from "../../lib/create-auth-plugin"
+import { type AdminLocalization, adminLocalization } from "./admin-localization"
+
+export type AdminPluginOptions = {
+  /**
+   * Override the plugin's default localization strings.
+   * @remarks `AdminLocalization`
+   */
+  localization?: Partial<AdminLocalization>
+}
+
+export type ImpersonatingSession = {
+  session: {
+    impersonatedBy: string
+  }
+}
+
+/**
+ * Check whether a Better Auth session belongs to an impersonated user.
+ */
+export function isImpersonatingSession(
+  session: unknown
+): session is ImpersonatingSession {
+  if (
+    !session ||
+    typeof session !== "object" ||
+    !("session" in session) ||
+    !session.session ||
+    typeof session.session !== "object" ||
+    !("impersonatedBy" in session.session)
+  ) {
+    return false
+  }
+
+  return (
+    typeof session.session.impersonatedBy === "string" &&
+    session.session.impersonatedBy.length > 0
+  )
+}
+
+/**
+ * Adds UI integrations for Better Auth's admin plugin.
+ *
+ * Pair this UI plugin with Better Auth's `admin()` server plugin and
+ * `adminClient()` client plugin.
+ */
+export const adminPlugin = createAuthPlugin(
+  "admin",
+  (options: AdminPluginOptions = {}) => ({
+    localization: { ...adminLocalization, ...options.localization }
+  })
+)

package/src/plugins/oauth-provider/oauth-provider-localization.ts

@@ -0,0 +1,27 @@
+export const oauthProviderLocalization = {
+  /** @remarks `"Authorize {{client}}"` */
+  authorize: "Authorize {{client}}",
+  /** @remarks `"{{client}} wants to access your account."` */
+  authorizationDescription: "{{client}} wants to access your account.",
+  /** @remarks `"This will allow {{client}} to:"` */
+  requestedPermissions: "This will allow {{client}} to:",
+  /** @remarks `"Signed in as"` */
+  signedInAs: "Signed in as",
+  /** @remarks `"Allow"` */
+  allow: "Allow",
+  /** @remarks `"Cancel"` */
+  cancel: "Cancel",
+  /** @remarks `"Privacy policy"` */
+  privacyPolicy: "Privacy policy",
+  /** @remarks `"Terms of service"` */
+  termsOfService: "Terms of service",
+  /** @remarks `"Invalid authorization request"` */
+  invalidRequest: "Invalid authorization request",
+  /** @remarks `"This authorization request is missing required information or is no longer valid."` */
+  invalidRequestDescription:
+    "This authorization request is missing required information or is no longer valid.",
+  /** @remarks `"Application"` */
+  application: "Application"
+}
+
+export type OAuthProviderLocalization = typeof oauthProviderLocalization

package/src/plugins/oauth-provider/oauth-provider-mutation-keys.ts

@@ -0,0 +1,12 @@
+/**
+ * Mutation keys contributed by the OAuth provider plugin.
+ *
+ * All keys live under the shared `["auth"]` namespace so global auth
+ * mutation observers handle errors consistently.
+ */
+export const oauthProviderMutationKeys = {
+  /** Prefix matching every OAuth provider mutation. */
+  all: ["auth", "oauthProvider"] as const,
+  /** Key for accepting or denying an OAuth authorization request. */
+  consent: ["auth", "oauthProvider", "consent"] as const
+} as const

package/src/plugins/oauth-provider/oauth-provider-plugin.ts

@@ -0,0 +1,132 @@
+import { createAuthPlugin } from "../../lib/create-auth-plugin"
+// Side-effect import so this file participates in declaration merging on the
+// same module instance that external consumers reach via `@better-auth-ui/core`.
+import type {} from "../../lib/view-paths"
+import {
+  type OAuthProviderLocalization,
+  oauthProviderLocalization
+} from "./oauth-provider-localization"
+
+declare module "../../lib/view-paths" {
+  /** Widens `AuthViewPaths` with the OAuth consent path when this plugin is imported. */
+  interface AuthViewPaths {
+    /** @default "consent" */
+    oauthConsent?: string
+  }
+}
+
+export type OAuthScopeMetadata = {
+  /** Short permission label displayed to the user. */
+  label: string
+  /** Optional explanation of the data or access represented by the scope. */
+  description?: string
+}
+
+export type OAuthScopeMetadataMap = Record<string, OAuthScopeMetadata>
+
+export const oauthProviderScopeMetadata: OAuthScopeMetadataMap = {
+  openid: {
+    label: "Verify your identity",
+    description: "Access your unique account identifier."
+  },
+  profile: {
+    label: "View your profile",
+    description: "View your name and profile picture."
+  },
+  email: {
+    label: "View your email address",
+    description: "View your email address and whether it is verified."
+  },
+  offline_access: {
+    label: "Maintain access",
+    description:
+      "Access your data when you are not actively using the application."
+  }
+}
+
+export type OAuthAuthorizationRequest = {
+  clientId?: string
+  scopes: string[]
+}
+
+/**
+ * Keep client-controlled links and images on browser-safe web protocols.
+ */
+export function sanitizeOAuthClientUrl(
+  value: string | null | undefined
+): string | undefined {
+  if (!value) return undefined
+
+  try {
+    const url = new URL(value)
+
+    return url.protocol === "https:" || url.protocol === "http:"
+      ? url.href
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Read the display-safe parts of Better Auth's signed authorization query.
+ *
+ * The complete query string must remain in the browser URL so
+ * `oauthProviderClient()` can forward and verify it during consent.
+ */
+export function parseOAuthAuthorizationRequest(
+  search: string
+): OAuthAuthorizationRequest {
+  const params = new URLSearchParams(search)
+  const clientId = params.get("client_id")?.trim() || undefined
+  const scopes = Array.from(
+    new Set(
+      (params.get("scope") ?? "")
+        .split(/\s+/)
+        .map((scope) => scope.trim())
+        .filter(Boolean)
+    )
+  )
+
+  return { clientId, scopes }
+}
+
+export type OAuthProviderPluginOptions = {
+  /**
+   * Override the plugin's default localization strings.
+   * @remarks `OAuthProviderLocalization`
+   */
+  localization?: Partial<OAuthProviderLocalization>
+  /**
+   * URL segment for the OAuth consent view.
+   * @remarks `string`
+   * @default "consent"
+   */
+  path?: string
+  /**
+   * Labels and descriptions for custom OAuth scopes.
+   *
+   * Entries override the built-in metadata for `openid`, `profile`, `email`,
+   * and `offline_access`. Unknown scopes remain visible using their raw value.
+   */
+  scopeMetadata?: OAuthScopeMetadataMap
+}
+
+export const oauthProviderPlugin = createAuthPlugin(
+  "oauthProvider",
+  (options: OAuthProviderPluginOptions = {}) => ({
+    localization: {
+      ...oauthProviderLocalization,
+      ...options.localization
+    },
+    scopeMetadata: {
+      ...oauthProviderScopeMetadata,
+      ...options.scopeMetadata
+    },
+    viewPaths: {
+      auth: {
+        oauthConsent: options.path ?? "consent"
+      }
+    }
+  })
+)

package/src/plugins/oauth-provider/oauth-provider-query-keys.ts

@@ -0,0 +1,10 @@
+/** Query keys contributed by the OAuth provider plugin. */
+export const oauthProviderQueryKeys = {
+  /** Prefix matching every OAuth provider query. */
+  all: ["auth", "oauthProvider"] as const,
+  /** Prefix for public OAuth client metadata queries. */
+  publicClients: ["auth", "oauthProvider", "publicClient"] as const,
+  /** Key for the public metadata of a specific OAuth client. */
+  publicClient: (clientId: string | undefined) =>
+    [...oauthProviderQueryKeys.publicClients, clientId ?? null] as const
+} as const

package/src/plugins.ts

@@ -1,3 +1,6 @@
+export * from "./plugins/admin/admin-localization"
+export * from "./plugins/admin/admin-mutation-keys"
+export * from "./plugins/admin/admin-plugin"
 export * from "./plugins/api-key/api-key-localization"
 export * from "./plugins/api-key/api-key-mutation-keys"
 export * from "./plugins/api-key/api-key-plugin"
@@ -17,6 +20,10 @@ export * from "./plugins/multi-session/multi-session-localization"
 export * from "./plugins/multi-session/multi-session-mutation-keys"
 export * from "./plugins/multi-session/multi-session-plugin"
 export * from "./plugins/multi-session/multi-session-query-keys"
+export * from "./plugins/oauth-provider/oauth-provider-localization"
+export * from "./plugins/oauth-provider/oauth-provider-mutation-keys"
+export * from "./plugins/oauth-provider/oauth-provider-plugin"
+export * from "./plugins/oauth-provider/oauth-provider-query-keys"
 export * from "./plugins/organization/organization-localization"
 export * from "./plugins/organization/organization-mutation-keys"
 export * from "./plugins/organization/organization-plugin"