@better-auth/api-key 1.6.12 → 1.6.13

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { n as API_KEY_ERROR_CODES, t as PACKAGE_VERSION } from "./version-D9MWdfX3.mjs";
+import { n as API_KEY_ERROR_CODES, t as PACKAGE_VERSION } from "./version-BGdGIPst.mjs";
 //#region src/client.ts
 const apiKeyClient = () => {
 	return {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { n as API_KEY_ERROR_CODES, t as PACKAGE_VERSION } from "./version-D9MWdfX3.mjs";
+import { n as API_KEY_ERROR_CODES, t as PACKAGE_VERSION } from "./version-BGdGIPst.mjs";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
@@ -1632,10 +1632,17 @@ function isRateLimited(apiKey, opts) {
 }
 //#endregion
 //#region src/routes/verify-api-key.ts
-async function validateApiKey({ hashedKey, ctx, opts, schema, permissions }) {
-	const apiKey = await getApiKey$1(ctx, hashedKey, opts);
+async function validateApiKey({ key, ctx, lookupOpts, configurations, schema, permissions, expectedConfigId, runCustomValidator }) {
+	const apiKey = await getApiKey$1(ctx, lookupOpts.disableKeyHashing ? key : await defaultKeyHasher(key), lookupOpts);
 	if (!apiKey) throw APIError$1.from("UNAUTHORIZED", API_KEY_ERROR_CODES.INVALID_API_KEY);
-	if (apiKey.configId !== (opts.configId ?? "default")) throw APIError$1.from("UNAUTHORIZED", API_KEY_ERROR_CODES.INVALID_API_KEY);
+	if (expectedConfigId !== void 0 && !configIdMatches(apiKey.configId, expectedConfigId)) throw APIError$1.from("UNAUTHORIZED", API_KEY_ERROR_CODES.INVALID_API_KEY);
+	const opts = resolveConfiguration(ctx.context, configurations, apiKey.configId);
+	if (runCustomValidator && opts.customAPIKeyValidator) {
+		if (!await opts.customAPIKeyValidator({
+			ctx,
+			key
+		})) throw APIError$1.from("UNAUTHORIZED", API_KEY_ERROR_CODES.KEY_NOT_FOUND);
+	}
 	if (apiKey.enabled === false) throw APIError$1.from("UNAUTHORIZED", API_KEY_ERROR_CODES.KEY_DISABLED);
 	if (apiKey.expiresAt) {
 		if (Date.now() > new Date(apiKey.expiresAt).getTime()) {
@@ -1765,10 +1772,13 @@ async function validateApiKey({ hashedKey, ctx, opts, schema, permissions }) {
 		newApiKey = await performUpdate();
 		if (!newApiKey) throw APIError$1.from("INTERNAL_SERVER_ERROR", API_KEY_ERROR_CODES.FAILED_TO_UPDATE_API_KEY);
 	}
-	return newApiKey;
+	return {
+		apiKey: newApiKey,
+		opts
+	};
 }
 const verifyApiKeyBodySchema = z.object({
-	configId: z.string().meta({ description: "The configuration ID to use for verification. If not provided, the default configuration will be used." }).optional(),
+	configId: z.string().meta({ description: "Configuration ID to scope verification to. When omitted, the key is validated against its own configuration." }).optional(),
 	key: z.string().meta({ description: "The key to verify" }),
 	permissions: z.record(z.string(), z.array(z.string())).meta({ description: "The permissions to verify." }).optional()
 });
@@ -1779,7 +1789,7 @@ function verifyApiKey({ configurations, schema, deleteAllExpiredApiKeys }) {
 	}, async (ctx) => {
 		const { configId, key } = ctx.body;
 		const lookupOpts = resolveConfiguration(ctx.context, configurations, configId);
-		if (lookupOpts.customAPIKeyValidator) {
+		if (configId !== void 0 && lookupOpts.customAPIKeyValidator) {
 			if (!await lookupOpts.customAPIKeyValidator({
 				ctx,
 				key
@@ -1792,17 +1802,22 @@ function verifyApiKey({ configurations, schema, deleteAllExpiredApiKeys }) {
 				key: null
 			});
 		}
-		const hashed = lookupOpts.disableKeyHashing ? key : await defaultKeyHasher(key);
 		let apiKey = null;
+		let opts;
 		try {
-			apiKey = await validateApiKey({
-				hashedKey: hashed,
+			const result = await validateApiKey({
+				key,
 				permissions: ctx.body.permissions,
 				ctx,
-				opts: lookupOpts,
-				schema
+				lookupOpts,
+				configurations,
+				schema,
+				expectedConfigId: configId,
+				runCustomValidator: configId === void 0
 			});
-			if ((apiKey ? resolveConfiguration(ctx.context, configurations, apiKey.configId) : lookupOpts).deferUpdates) ctx.context.runInBackground(deleteAllExpiredApiKeys(ctx.context).catch((err) => {
+			apiKey = result.apiKey;
+			opts = result.opts;
+			if (opts.deferUpdates) ctx.context.runInBackground(deleteAllExpiredApiKeys(ctx.context).catch((err) => {
 				ctx.context.logger.error("Failed to delete expired API keys:", err);
 			}));
 		} catch (error) {
@@ -1829,7 +1844,6 @@ function verifyApiKey({ configurations, schema, deleteAllExpiredApiKeys }) {
 			key: 1,
 			permissions: void 0
 		};
-		const opts = apiKey ? resolveConfiguration(ctx.context, configurations, apiKey.configId) : lookupOpts;
 		let migratedMetadata = null;
 		if (apiKey) migratedMetadata = await migrateDoubleStringifiedMetadata(ctx, apiKey, opts);
 		returningApiKey.permissions = returningApiKey.permissions ? safeJSONParse(returningApiKey.permissions) : null;
@@ -2158,11 +2172,13 @@ function apiKey(_configurations, _options) {
 						key
 					})) throw APIError.from("FORBIDDEN", API_KEY_ERROR_CODES.INVALID_API_KEY);
 				}
-				const apiKey = await validateApiKey({
-					hashedKey: config.disableKeyHashing ? key : await defaultKeyHasher(key),
+				const { apiKey } = await validateApiKey({
+					key,
 					ctx,
-					opts: config,
-					schema
+					lookupOpts: config,
+					configurations,
+					schema,
+					expectedConfigId: config.configId
 				});
 				const cleanupTask = deleteAllExpiredApiKeys(ctx.context).catch((err) => {
 					ctx.context.logger.error("Failed to delete expired API keys:", err);

package/dist/{version-D9MWdfX3.mjs → version-BGdGIPst.mjs}

@@ -35,6 +35,6 @@ const API_KEY_ERROR_CODES = defineErrorCodes({
 });
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.12";
+const PACKAGE_VERSION = "1.6.13";
 //#endregion
 export { API_KEY_ERROR_CODES as n, PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/api-key",
-  "version": "1.6.12",
+  "version": "1.6.13",
   "description": "API Key plugin for Better Auth.",
   "type": "module",
   "license": "MIT",
@@ -61,14 +61,14 @@
   },
   "devDependencies": {
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.6.12",
-    "better-auth": "1.6.12"
+    "@better-auth/core": "1.6.13",
+    "better-auth": "1.6.13"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.1",
     "better-call": "1.3.5",
-    "@better-auth/core": "^1.6.12",
-    "better-auth": "^1.6.12"
+    "@better-auth/core": "^1.6.13",
+    "better-auth": "^1.6.13"
   },
   "scripts": {
     "build": "tsdown",