@better-auth/core 1.5.0-beta.9 → 1.5.0

package/src/oauth2/refresh-access-token.test.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("@better-fetch/fetch", () => ({
+	betterFetch: vi.fn(),
+}));
+
+import { betterFetch } from "@better-fetch/fetch";
+import { refreshAccessToken } from "./refresh-access-token";
+
+const mockedBetterFetch = vi.mocked(betterFetch);
+
+describe("refreshAccessToken", () => {
+	it("should set accessTokenExpiresAt when expires_in is returned", async () => {
+		const now = Date.now();
+		mockedBetterFetch.mockResolvedValueOnce({
+			data: {
+				access_token: "new-access-token",
+				refresh_token: "new-refresh-token",
+				expires_in: 3600,
+				token_type: "Bearer",
+			},
+			error: null,
+		});
+
+		const tokens = await refreshAccessToken({
+			refreshToken: "old-refresh-token",
+			options: { clientId: "test-client", clientSecret: "test-secret" },
+			tokenEndpoint: "https://example.com/token",
+		});
+
+		expect(tokens.accessToken).toBe("new-access-token");
+		expect(tokens.refreshToken).toBe("new-refresh-token");
+		expect(tokens.accessTokenExpiresAt).toBeInstanceOf(Date);
+		expect(tokens.accessTokenExpiresAt!.getTime()).toBeGreaterThanOrEqual(
+			now + 3600 * 1000 - 1000,
+		);
+		expect(tokens.refreshTokenExpiresAt).toBeUndefined();
+	});
+
+	/**
+	 * @see https://github.com/better-auth/better-auth/issues/7682
+	 */
+	it("should set refreshTokenExpiresAt when refresh_token_expires_in is returned", async () => {
+		const now = Date.now();
+		mockedBetterFetch.mockResolvedValueOnce({
+			data: {
+				access_token: "new-access-token",
+				refresh_token: "new-refresh-token",
+				expires_in: 3600,
+				refresh_token_expires_in: 86400,
+				token_type: "Bearer",
+			},
+			error: null,
+		});
+
+		const tokens = await refreshAccessToken({
+			refreshToken: "old-refresh-token",
+			options: { clientId: "test-client", clientSecret: "test-secret" },
+			tokenEndpoint: "https://example.com/token",
+		});
+
+		expect(tokens.accessToken).toBe("new-access-token");
+		expect(tokens.refreshToken).toBe("new-refresh-token");
+		expect(tokens.accessTokenExpiresAt).toBeInstanceOf(Date);
+		expect(tokens.refreshTokenExpiresAt).toBeInstanceOf(Date);
+		expect(tokens.refreshTokenExpiresAt!.getTime()).toBeGreaterThanOrEqual(
+			now + 86400 * 1000 - 1000,
+		);
+	});
+
+	it("should not set refreshTokenExpiresAt when refresh_token_expires_in is not returned", async () => {
+		mockedBetterFetch.mockResolvedValueOnce({
+			data: {
+				access_token: "new-access-token",
+				refresh_token: "new-refresh-token",
+				expires_in: 3600,
+				token_type: "Bearer",
+			},
+			error: null,
+		});
+
+		const tokens = await refreshAccessToken({
+			refreshToken: "old-refresh-token",
+			options: { clientId: "test-client", clientSecret: "test-secret" },
+			tokenEndpoint: "https://example.com/token",
+		});
+
+		expect(tokens.refreshTokenExpiresAt).toBeUndefined();
+	});
+});

package/src/oauth2/refresh-access-token.ts

@@ -1,7 +1,34 @@
 import { base64 } from "@better-auth/utils/base64";
 import { betterFetch } from "@better-fetch/fetch";
+import type { AwaitableFunction } from "../types";
 import type { OAuth2Tokens, ProviderOptions } from "./oauth-provider";
 
+export async function refreshAccessTokenRequest({
+	refreshToken,
+	options,
+	authentication,
+	extraParams,
+	resource,
+}: {
+	refreshToken: string;
+	options: AwaitableFunction<Partial<ProviderOptions>>;
+	authentication?: ("basic" | "post") | undefined;
+	extraParams?: Record<string, string> | undefined;
+	resource?: (string | string[]) | undefined;
+}) {
+	options = typeof options === "function" ? await options() : options;
+	return createRefreshAccessTokenRequest({
+		refreshToken,
+		options,
+		authentication,
+		extraParams,
+		resource,
+	});
+}
+
+/**
+ * @deprecated use async'd refreshAccessTokenRequest instead
+ */
 export function createRefreshAccessTokenRequest({
 	refreshToken,
 	options,
@@ -10,7 +37,7 @@ export function createRefreshAccessTokenRequest({
 	resource,
 }: {
 	refreshToken: string;
-	options: Partial<ProviderOptions>;
+	options: ProviderOptions;
 	authentication?: ("basic" | "post") | undefined;
 	extraParams?: Record<string, string> | undefined;
 	resource?: (string | string[]) | undefined;
@@ -80,10 +107,8 @@ export async function refreshAccessToken({
 	tokenEndpoint: string;
 	authentication?: ("basic" | "post") | undefined;
 	extraParams?: Record<string, string> | undefined;
-	/** @deprecated always "refresh_token" */
-	grantType?: string | undefined;
 }): Promise<OAuth2Tokens> {
-	const { body, headers } = createRefreshAccessTokenRequest({
+	const { body, headers } = await createRefreshAccessTokenRequest({
 		refreshToken,
 		options,
 		authentication,
@@ -94,6 +119,7 @@ export async function refreshAccessToken({
 		access_token: string;
 		refresh_token?: string | undefined;
 		expires_in?: number | undefined;
+		refresh_token_expires_in?: number | undefined;
 		token_type?: string | undefined;
 		scope?: string | undefined;
 		id_token?: string | undefined;
@@ -120,5 +146,12 @@ export async function refreshAccessToken({
 		);
 	}
 
+	if (data.refresh_token_expires_in) {
+		const now = new Date();
+		tokens.refreshTokenExpiresAt = new Date(
+			now.getTime() + data.refresh_token_expires_in * 1000,
+		);
+	}
+
 	return tokens;
 }

package/src/oauth2/validate-authorization-code.ts

@@ -1,10 +1,48 @@
 import { base64 } from "@better-auth/utils/base64";
 import { betterFetch } from "@better-fetch/fetch";
-import type { JWK } from "jose";
-import { decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import type { AwaitableFunction } from "../types";
 import type { ProviderOptions } from "./index";
 import { getOAuth2Tokens } from "./index";
 
+export async function authorizationCodeRequest({
+	code,
+	codeVerifier,
+	redirectURI,
+	options,
+	authentication,
+	deviceId,
+	headers,
+	additionalParams = {},
+	resource,
+}: {
+	code: string;
+	redirectURI: string;
+	options: AwaitableFunction<Partial<ProviderOptions>>;
+	codeVerifier?: string | undefined;
+	deviceId?: string | undefined;
+	authentication?: ("basic" | "post") | undefined;
+	headers?: Record<string, string> | undefined;
+	additionalParams?: Record<string, string> | undefined;
+	resource?: (string | string[]) | undefined;
+}) {
+	options = typeof options === "function" ? await options() : options;
+	return createAuthorizationCodeRequest({
+		code,
+		codeVerifier,
+		redirectURI,
+		options,
+		authentication,
+		deviceId,
+		headers,
+		additionalParams,
+		resource,
+	});
+}
+
+/**
+ * @deprecated use async'd authorizationCodeRequest instead
+ */
 export function createAuthorizationCodeRequest({
 	code,
 	codeVerifier,
@@ -32,6 +70,7 @@ export function createAuthorizationCodeRequest({
 		accept: "application/json",
 		...headers,
 	};
+
 	body.set("grant_type", "authorization_code");
 	body.set("code", code);
 	codeVerifier && body.set("code_verifier", codeVerifier);
@@ -91,7 +130,7 @@ export async function validateAuthorizationCode({
 }: {
 	code: string;
 	redirectURI: string;
-	options: Partial<ProviderOptions>;
+	options: AwaitableFunction<Partial<ProviderOptions>>;
 	codeVerifier?: string | undefined;
 	deviceId?: string | undefined;
 	tokenEndpoint: string;
@@ -100,7 +139,7 @@ export async function validateAuthorizationCode({
 	additionalParams?: Record<string, string> | undefined;
 	resource?: (string | string[]) | undefined;
 }) {
-	const { body, headers: requestHeaders } = createAuthorizationCodeRequest({
+	const { body, headers: requestHeaders } = await authorizationCodeRequest({
 		code,
 		codeVerifier,
 		redirectURI,
@@ -117,7 +156,6 @@ export async function validateAuthorizationCode({
 		body: body,
 		headers: requestHeaders,
 	});
-
 	if (error) {
 		throw error;
 	}
@@ -125,25 +163,18 @@ export async function validateAuthorizationCode({
 	return tokens;
 }
 
-export async function validateToken(token: string, jwksEndpoint: string) {
-	const { data, error } = await betterFetch<{
-		keys: JWK[];
-	}>(jwksEndpoint, {
-		method: "GET",
-		headers: {
-			accept: "application/json",
-		},
+export async function validateToken(
+	token: string,
+	jwksEndpoint: string,
+	options?: {
+		audience?: string | string[];
+		issuer?: string | string[];
+	},
+) {
+	const jwks = createRemoteJWKSet(new URL(jwksEndpoint));
+	const verified = await jwtVerify(token, jwks, {
+		audience: options?.audience,
+		issuer: options?.issuer,
 	});
-	if (error) {
-		throw error;
-	}
-	const keys = data["keys"];
-	const header = decodeProtectedHeader(token);
-	const key = keys.find((k) => k.kid === header.kid);
-	if (!key) {
-		throw new Error("Key not found");
-	}
-	const cryptoKey = await importJWK(key, header.alg);
-	const verified = await jwtVerify(token, cryptoKey);
 	return verified;
 }

package/src/oauth2/validate-token.test.ts

@@ -1,18 +1,19 @@
+import type { JWK } from "jose";
 import { exportJWK, generateKeyPair, SignJWT } from "jose";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 import { validateToken } from "./validate-authorization-code";
 
-vi.mock("@better-fetch/fetch", () => ({
-	betterFetch: vi.fn(),
-}));
-
-import { betterFetch } from "@better-fetch/fetch";
+describe("validateToken", () => {
+	const originalFetch = globalThis.fetch;
+	const mockedFetch = vi.fn() as unknown as typeof fetch &
+		ReturnType<typeof vi.fn>;
 
-const mockedBetterFetch = vi.mocked(betterFetch);
+	beforeAll(() => {
+		globalThis.fetch = mockedFetch;
+	});
 
-describe("validateToken", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
+	afterAll(() => {
+		globalThis.fetch = originalFetch;
 	});
 
 	async function createTestJWKS(alg: string, crv?: string) {
@@ -24,7 +25,9 @@ describe("validateToken", () => {
 		const privateJWK = await exportJWK(privateKey);
 		const kid = `test-key-${Date.now()}`;
 		publicJWK.kid = kid;
+		publicJWK.alg = alg;
 		privateJWK.kid = kid;
+		privateJWK.alg = alg;
 		return { publicJWK, privateJWK, kid, publicKey, privateKey };
 	}
 
@@ -47,14 +50,19 @@ describe("validateToken", () => {
 			.sign(privateKey);
 	}
 
+	function mockJWKSResponse(...publicJWKs: JWK[]) {
+		mockedFetch.mockResolvedValueOnce(
+			new Response(JSON.stringify({ keys: publicJWKs }), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			}),
+		);
+	}
+
 	it("should verify RS256 signed token", async () => {
 		const { publicJWK, privateKey, kid } = await createTestJWKS("RS256");
 		const token = await createSignedToken(privateKey, "RS256", kid);
-
-		mockedBetterFetch.mockResolvedValueOnce({
-			data: { keys: [publicJWK] },
-			error: null,
-		});
+		mockJWKSResponse(publicJWK);
 
 		const result = await validateToken(
 			token,
@@ -64,20 +72,12 @@ describe("validateToken", () => {
 		expect(result).toBeDefined();
 		expect(result.payload.sub).toBe("user-123");
 		expect(result.payload.email).toBe("test@example.com");
-		expect(mockedBetterFetch).toHaveBeenCalledWith(
-			"https://example.com/.well-known/jwks",
-			expect.objectContaining({ method: "GET" }),
-		);
 	});
 
 	it("should verify ES256 signed token", async () => {
 		const { publicJWK, privateKey, kid } = await createTestJWKS("ES256");
 		const token = await createSignedToken(privateKey, "ES256", kid);
-
-		mockedBetterFetch.mockResolvedValueOnce({
-			data: { keys: [publicJWK] },
-			error: null,
-		});
+		mockJWKSResponse(publicJWK);
 
 		const result = await validateToken(
 			token,
@@ -94,11 +94,7 @@ describe("validateToken", () => {
 			"Ed25519",
 		);
 		const token = await createSignedToken(privateKey, "EdDSA", kid);
-
-		mockedBetterFetch.mockResolvedValueOnce({
-			data: { keys: [publicJWK] },
-			error: null,
-		});
+		mockJWKSResponse(publicJWK);
 
 		const result = await validateToken(
 			token,
@@ -109,19 +105,15 @@ describe("validateToken", () => {
 		expect(result.payload.sub).toBe("user-123");
 	});
 
-	it("should throw 'Key not found' when kid doesn't match", async () => {
+	it("should throw when kid doesn't match any key", async () => {
 		const { publicJWK, privateKey } = await createTestJWKS("RS256");
 		publicJWK.kid = "different-kid";
 		const token = await createSignedToken(privateKey, "RS256", "original-kid");
-
-		mockedBetterFetch.mockResolvedValueOnce({
-			data: { keys: [publicJWK] },
-			error: null,
-		});
+		mockJWKSResponse(publicJWK);
 
 		await expect(
 			validateToken(token, "https://example.com/.well-known/jwks"),
-		).rejects.toThrow("Key not found");
+		).rejects.toThrow();
 	});
 
 	it("should find correct key when multiple keys exist", async () => {
@@ -129,11 +121,7 @@ describe("validateToken", () => {
 		const key2 = await createTestJWKS("RS256");
 		const key3 = await createTestJWKS("ES256");
 		const token = await createSignedToken(key2.privateKey, "RS256", key2.kid);
-
-		mockedBetterFetch.mockResolvedValueOnce({
-			data: { keys: [key1.publicJWK, key2.publicJWK, key3.publicJWK] },
-			error: null,
-		});
+		mockJWKSResponse(key1.publicJWK, key2.publicJWK, key3.publicJWK);
 
 		const result = await validateToken(
 			token,
@@ -147,28 +135,95 @@ describe("validateToken", () => {
 	it("should throw when JWKS returns empty keys array", async () => {
 		const { privateKey, kid } = await createTestJWKS("RS256");
 		const token = await createSignedToken(privateKey, "RS256", kid);
-
-		mockedBetterFetch.mockResolvedValueOnce({
-			data: { keys: [] },
-			error: null,
-		});
+		mockJWKSResponse();
 
 		await expect(
 			validateToken(token, "https://example.com/.well-known/jwks"),
-		).rejects.toThrow("Key not found");
+		).rejects.toThrow();
 	});
 
 	it("should throw when JWKS fetch fails", async () => {
 		const { privateKey, kid } = await createTestJWKS("RS256");
 		const token = await createSignedToken(privateKey, "RS256", kid);
-
-		mockedBetterFetch.mockResolvedValueOnce({
-			data: null,
-			error: { status: 500, statusText: "Internal Server Error" },
-		});
+		mockedFetch.mockResolvedValueOnce(
+			new Response("Internal Server Error", { status: 500 }),
+		);
 
 		await expect(
 			validateToken(token, "https://example.com/.well-known/jwks"),
 		).rejects.toBeDefined();
 	});
+
+	it("should verify token with matching audience", async () => {
+		const { publicJWK, privateKey, kid } = await createTestJWKS("RS256");
+		const token = await createSignedToken(privateKey, "RS256", kid);
+		mockJWKSResponse(publicJWK);
+
+		const result = await validateToken(
+			token,
+			"https://example.com/.well-known/jwks",
+			{ audience: "test-client" },
+		);
+
+		expect(result).toBeDefined();
+		expect(result.payload.aud).toBe("test-client");
+	});
+
+	it("should reject token with mismatched audience", async () => {
+		const { publicJWK, privateKey, kid } = await createTestJWKS("RS256");
+		const token = await createSignedToken(privateKey, "RS256", kid);
+		mockJWKSResponse(publicJWK);
+
+		await expect(
+			validateToken(token, "https://example.com/.well-known/jwks", {
+				audience: "wrong-client",
+			}),
+		).rejects.toThrow();
+	});
+
+	it("should verify token with matching issuer", async () => {
+		const { publicJWK, privateKey, kid } = await createTestJWKS("RS256");
+		const token = await createSignedToken(privateKey, "RS256", kid);
+		mockJWKSResponse(publicJWK);
+
+		const result = await validateToken(
+			token,
+			"https://example.com/.well-known/jwks",
+			{ issuer: "https://example.com" },
+		);
+
+		expect(result).toBeDefined();
+		expect(result.payload.iss).toBe("https://example.com");
+	});
+
+	it("should reject token with mismatched issuer", async () => {
+		const { publicJWK, privateKey, kid } = await createTestJWKS("RS256");
+		const token = await createSignedToken(privateKey, "RS256", kid);
+		mockJWKSResponse(publicJWK);
+
+		await expect(
+			validateToken(token, "https://example.com/.well-known/jwks", {
+				issuer: "https://wrong-issuer.com",
+			}),
+		).rejects.toThrow();
+	});
+
+	it("should verify token with both audience and issuer", async () => {
+		const { publicJWK, privateKey, kid } = await createTestJWKS("RS256");
+		const token = await createSignedToken(privateKey, "RS256", kid);
+		mockJWKSResponse(publicJWK);
+
+		const result = await validateToken(
+			token,
+			"https://example.com/.well-known/jwks",
+			{
+				audience: "test-client",
+				issuer: "https://example.com",
+			},
+		);
+
+		expect(result).toBeDefined();
+		expect(result.payload.aud).toBe("test-client");
+		expect(result.payload.iss).toBe("https://example.com");
+	});
 });

package/src/social-providers/apple.ts

@@ -112,41 +112,41 @@ export const apple = (options: AppleOptions) => {
 			if (options.verifyIdToken) {
 				return options.verifyIdToken(token, nonce);
 			}
-			const decodedHeader = decodeProtectedHeader(token);
-			const { kid, alg: jwtAlg } = decodedHeader;
-			if (!kid || !jwtAlg) return false;
-			const publicKey = await getApplePublicKey(kid);
-			const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
-				algorithms: [jwtAlg],
-				issuer: "https://appleid.apple.com",
-				audience:
-					options.audience && options.audience.length
-						? options.audience
-						: options.appBundleIdentifier
-							? options.appBundleIdentifier
-							: options.clientId,
-				maxTokenAge: "1h",
-			});
-			["email_verified", "is_private_email"].forEach((field) => {
-				if (jwtClaims[field] !== undefined) {
-					jwtClaims[field] = Boolean(jwtClaims[field]);
+			try {
+				const decodedHeader = decodeProtectedHeader(token);
+				const { kid, alg: jwtAlg } = decodedHeader;
+				if (!kid || !jwtAlg) return false;
+				const publicKey = await getApplePublicKey(kid);
+				const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
+					algorithms: [jwtAlg],
+					issuer: "https://appleid.apple.com",
+					audience:
+						options.audience && options.audience.length
+							? options.audience
+							: options.appBundleIdentifier
+								? options.appBundleIdentifier
+								: options.clientId,
+					maxTokenAge: "1h",
+				});
+				["email_verified", "is_private_email"].forEach((field) => {
+					if (jwtClaims[field] !== undefined) {
+						jwtClaims[field] = Boolean(jwtClaims[field]);
+					}
+				});
+				if (nonce && jwtClaims.nonce !== nonce) {
+					return false;
 				}
-			});
-			if (nonce && jwtClaims.nonce !== nonce) {
+				return !!jwtClaims;
+			} catch {
 				return false;
 			}
-			return !!jwtClaims;
 		},
 		refreshAccessToken: options.refreshAccessToken
 			? options.refreshAccessToken
 			: async (refreshToken) => {
 					return refreshAccessToken({
 						refreshToken,
-						options: {
-							clientId: options.clientId,
-							clientKey: options.clientKey,
-							clientSecret: options.clientSecret,
-						},
+						options,
 						tokenEndpoint: "https://appleid.apple.com/auth/token",
 					});
 				},
@@ -162,15 +162,15 @@ export const apple = (options: AppleOptions) => {
 				return null;
 			}
 
-			// TODO: " " masking will be removed when the name field is made optional
+			// TODO: "" masking will be removed when the name field is made optional
 			let name: string;
 			if (token.user?.name) {
 				const firstName = token.user.name.firstName || "";
 				const lastName = token.user.name.lastName || "";
 				const fullName = `${firstName} ${lastName}`.trim();
-				name = fullName || " ";
+				name = fullName;
 			} else {
-				name = profile.name || " ";
+				name = profile.name || "";
 			}
 
 			const emailVerified =

package/src/social-providers/cognito.ts

@@ -178,10 +178,7 @@ export const cognito = (options: CognitoOptions) => {
 						return null;
 					}
 					const name =
-						profile.name ||
-						profile.given_name ||
-						profile.username ||
-						profile.email;
+						profile.name || profile.given_name || profile.username || "";
 					const enrichedProfile = {
 						...profile,
 						name,
@@ -220,7 +217,11 @@ export const cognito = (options: CognitoOptions) => {
 						return {
 							user: {
 								id: userInfo.sub,
-								name: userInfo.name || userInfo.given_name || userInfo.username,
+								name:
+									userInfo.name ||
+									userInfo.given_name ||
+									userInfo.username ||
+									"",
 								email: userInfo.email,
 								image: userInfo.picture,
 								emailVerified: userInfo.email_verified,

package/src/social-providers/facebook.ts

@@ -49,7 +49,7 @@ export const facebook = (options: FacebookOptions) => {
 			return await createAuthorizationURL({
 				id: "facebook",
 				options,
-				authorizationEndpoint: "https://www.facebook.com/v21.0/dialog/oauth",
+				authorizationEndpoint: "https://www.facebook.com/v24.0/dialog/oauth",
 				scopes: _scopes,
 				state,
 				redirectURI,
@@ -66,7 +66,7 @@ export const facebook = (options: FacebookOptions) => {
 				code,
 				redirectURI,
 				options,
-				tokenEndpoint: "https://graph.facebook.com/oauth/access_token",
+				tokenEndpoint: "https://graph.facebook.com/v24.0/oauth/access_token",
 			});
 		},
 		async verifyIdToken(token, nonce) {
@@ -121,7 +121,7 @@ export const facebook = (options: FacebookOptions) => {
 							clientSecret: options.clientSecret,
 						},
 						tokenEndpoint:
-							"https://graph.facebook.com/v18.0/oauth/access_token",
+							"https://graph.facebook.com/v24.0/oauth/access_token",
 					});
 				},
 		async getUserInfo(token) {