@better-auth/core 1.6.27 → 1.6.28
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/index.d.mts +26 -26
- package/dist/async_hooks/index.d.mts +1 -0
- package/dist/async_hooks/pure.index.d.mts +1 -0
- package/dist/context/endpoint-context.d.mts +1 -1
- package/dist/context/global.d.mts +1 -0
- package/dist/context/global.mjs +1 -1
- package/dist/context/request-state.d.mts +1 -0
- package/dist/context/transaction.d.mts +1 -1
- package/dist/db/adapter/factory.d.mts +5 -3
- package/dist/db/adapter/factory.mjs +2 -2
- package/dist/db/adapter/get-default-field-name.d.mts +9 -2
- package/dist/db/adapter/get-default-model-name.d.mts +5 -1
- package/dist/db/adapter/get-field-attributes.d.mts +11 -4
- package/dist/db/adapter/get-field-name.d.mts +9 -2
- package/dist/db/adapter/get-id-field.d.mts +12 -4
- package/dist/db/adapter/get-model-name.d.mts +5 -1
- package/dist/db/adapter/index.d.mts +32 -7
- package/dist/db/adapter/types.d.mts +17 -5
- package/dist/db/adapter/utils.d.mts +1 -0
- package/dist/db/get-tables.d.mts +0 -1
- package/dist/db/plugin.d.mts +2 -1
- package/dist/db/schema/account.d.mts +1 -1
- package/dist/db/schema/rate-limit.d.mts +1 -1
- package/dist/db/schema/session.d.mts +1 -1
- package/dist/db/schema/shared.d.mts +1 -0
- package/dist/db/schema/user.d.mts +1 -1
- package/dist/db/schema/verification.d.mts +1 -1
- package/dist/db/type.d.mts +10 -6
- package/dist/env/logger.d.mts +25 -25
- package/dist/error/codes.d.mts +1 -0
- package/dist/error/index.d.mts +1 -0
- package/dist/index.d.mts +1 -1
- package/dist/instrumentation/attributes.d.mts +1 -0
- package/dist/instrumentation/pure.index.d.mts +1 -0
- package/dist/instrumentation/tracer.mjs +1 -1
- package/dist/oauth2/client-credentials-token.d.mts +20 -4
- package/dist/oauth2/create-authorization-url.d.mts +20 -3
- package/dist/oauth2/oauth-provider.d.mts +0 -1
- package/dist/oauth2/refresh-access-token.d.mts +22 -4
- package/dist/oauth2/reject-redirects.mjs +1 -1
- package/dist/oauth2/utils.d.mts +1 -0
- package/dist/oauth2/validate-authorization-code.d.mts +37 -6
- package/dist/oauth2/verify.d.mts +10 -12
- package/dist/oauth2/verify.mjs +2 -2
- package/dist/social-providers/apple.d.mts +11 -4
- package/dist/social-providers/atlassian.d.mts +11 -3
- package/dist/social-providers/cognito.d.mts +11 -4
- package/dist/social-providers/discord.d.mts +9 -3
- package/dist/social-providers/dropbox.d.mts +11 -3
- package/dist/social-providers/facebook.d.mts +10 -4
- package/dist/social-providers/figma.d.mts +11 -3
- package/dist/social-providers/github.d.mts +12 -3
- package/dist/social-providers/gitlab.d.mts +12 -3
- package/dist/social-providers/google.d.mts +19 -5
- package/dist/social-providers/huggingface.d.mts +11 -3
- package/dist/social-providers/index.d.mts +364 -78
- package/dist/social-providers/kakao.d.mts +9 -3
- package/dist/social-providers/kick.d.mts +11 -3
- package/dist/social-providers/line.d.mts +12 -4
- package/dist/social-providers/linear.d.mts +10 -3
- package/dist/social-providers/linkedin.d.mts +10 -3
- package/dist/social-providers/microsoft-entra-id.d.mts +5 -3
- package/dist/social-providers/microsoft-entra-id.mjs +1 -2
- package/dist/social-providers/naver.d.mts +18 -22
- package/dist/social-providers/notion.d.mts +10 -3
- package/dist/social-providers/paybin.d.mts +12 -3
- package/dist/social-providers/paypal.d.mts +9 -4
- package/dist/social-providers/polar.d.mts +11 -3
- package/dist/social-providers/railway.d.mts +11 -3
- package/dist/social-providers/reddit.d.mts +9 -3
- package/dist/social-providers/roblox.d.mts +9 -3
- package/dist/social-providers/salesforce.d.mts +11 -3
- package/dist/social-providers/slack.d.mts +9 -3
- package/dist/social-providers/spotify.d.mts +11 -3
- package/dist/social-providers/tiktok.d.mts +10 -5
- package/dist/social-providers/twitch.d.mts +9 -3
- package/dist/social-providers/twitter.d.mts +16 -25
- package/dist/social-providers/vercel.d.mts +11 -3
- package/dist/social-providers/vk.d.mts +12 -3
- package/dist/social-providers/wechat.d.mts +8 -3
- package/dist/social-providers/zoom.d.mts +14 -5
- package/dist/types/context.d.mts +1 -2
- package/dist/types/cookie.d.mts +1 -0
- package/dist/types/helper.d.mts +1 -1
- package/dist/types/index.d.mts +1 -1
- package/dist/types/init-options.d.mts +7 -10
- package/dist/types/plugin-client.d.mts +3 -1
- package/dist/types/plugin.d.mts +2 -2
- package/dist/utils/async.d.mts +1 -0
- package/dist/utils/db.d.mts +0 -1
- package/dist/utils/deprecate.d.mts +1 -0
- package/dist/utils/email.d.mts +4 -1
- package/dist/utils/error-codes.d.mts +2 -2
- package/dist/utils/host.d.mts +1 -27
- package/dist/utils/host.mjs +1 -1
- package/dist/utils/ip.d.mts +0 -1
- package/dist/utils/ip.mjs +1 -1
- package/dist/utils/is-api-error.d.mts +1 -0
- package/dist/utils/redirect-uri.d.mts +1 -0
- package/package.json +2 -2
- package/src/db/type.ts +2 -1
package/dist/env/logger.d.mts
CHANGED
|
@@ -1,32 +1,32 @@
|
|
|
1
1
|
//#region src/env/logger.d.ts
|
|
2
2
|
declare const TTY_COLORS: {
|
|
3
|
-
readonly reset: "
|
|
4
|
-
readonly bright: "
|
|
5
|
-
readonly dim: "
|
|
6
|
-
readonly undim: "
|
|
7
|
-
readonly underscore: "
|
|
8
|
-
readonly blink: "
|
|
9
|
-
readonly reverse: "
|
|
10
|
-
readonly hidden: "
|
|
3
|
+
readonly reset: "\u001B[0m";
|
|
4
|
+
readonly bright: "\u001B[1m";
|
|
5
|
+
readonly dim: "\u001B[2m";
|
|
6
|
+
readonly undim: "\u001B[22m";
|
|
7
|
+
readonly underscore: "\u001B[4m";
|
|
8
|
+
readonly blink: "\u001B[5m";
|
|
9
|
+
readonly reverse: "\u001B[7m";
|
|
10
|
+
readonly hidden: "\u001B[8m";
|
|
11
11
|
readonly fg: {
|
|
12
|
-
readonly black: "
|
|
13
|
-
readonly red: "
|
|
14
|
-
readonly green: "
|
|
15
|
-
readonly yellow: "
|
|
16
|
-
readonly blue: "
|
|
17
|
-
readonly magenta: "
|
|
18
|
-
readonly cyan: "
|
|
19
|
-
readonly white: "
|
|
12
|
+
readonly black: "\u001B[30m";
|
|
13
|
+
readonly red: "\u001B[31m";
|
|
14
|
+
readonly green: "\u001B[32m";
|
|
15
|
+
readonly yellow: "\u001B[33m";
|
|
16
|
+
readonly blue: "\u001B[34m";
|
|
17
|
+
readonly magenta: "\u001B[35m";
|
|
18
|
+
readonly cyan: "\u001B[36m";
|
|
19
|
+
readonly white: "\u001B[37m";
|
|
20
20
|
};
|
|
21
21
|
readonly bg: {
|
|
22
|
-
readonly black: "
|
|
23
|
-
readonly red: "
|
|
24
|
-
readonly green: "
|
|
25
|
-
readonly yellow: "
|
|
26
|
-
readonly blue: "
|
|
27
|
-
readonly magenta: "
|
|
28
|
-
readonly cyan: "
|
|
29
|
-
readonly white: "
|
|
22
|
+
readonly black: "\u001B[40m";
|
|
23
|
+
readonly red: "\u001B[41m";
|
|
24
|
+
readonly green: "\u001B[42m";
|
|
25
|
+
readonly yellow: "\u001B[43m";
|
|
26
|
+
readonly blue: "\u001B[44m";
|
|
27
|
+
readonly magenta: "\u001B[45m";
|
|
28
|
+
readonly cyan: "\u001B[46m";
|
|
29
|
+
readonly white: "\u001B[47m";
|
|
30
30
|
};
|
|
31
31
|
};
|
|
32
32
|
type LogLevel = "debug" | "info" | "success" | "warn" | "error";
|
|
@@ -39,7 +39,7 @@ interface Logger {
|
|
|
39
39
|
log?: ((level: Exclude<LogLevel, "success">, message: string, ...args: any[]) => void) | undefined;
|
|
40
40
|
}
|
|
41
41
|
type LogHandlerParams = Parameters<NonNullable<Logger["log"]>> extends [LogLevel, ...infer Rest] ? Rest : never;
|
|
42
|
-
type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void
|
|
42
|
+
type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void } & {
|
|
43
43
|
get level(): LogLevel;
|
|
44
44
|
};
|
|
45
45
|
declare const createLogger: (options?: Logger | undefined) => InternalLogger;
|
package/dist/error/codes.d.mts
CHANGED
package/dist/error/index.d.mts
CHANGED
package/dist/index.d.mts
CHANGED
|
@@ -6,4 +6,4 @@ import { SecretConfig } from "./types/secret.mjs";
|
|
|
6
6
|
import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./types/context.mjs";
|
|
7
7
|
import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./types/plugin-client.mjs";
|
|
8
8
|
import { StandardSchemaV1 } from "./types/index.mjs";
|
|
9
|
-
export
|
|
9
|
+
export { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE } from "@opentelemetry/semantic-conventions";
|
|
2
|
+
|
|
2
3
|
//#region src/instrumentation/attributes.d.ts
|
|
3
4
|
/** Operation identifier (e.g. getSession, signUpWithEmailAndPassword). Uses endpoint operationId when set, otherwise the endpoint key. */
|
|
4
5
|
declare const ATTR_OPERATION_ID: "better_auth.operation_id";
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID } from "./attributes.mjs";
|
|
2
|
+
|
|
2
3
|
//#region src/instrumentation/pure.index.d.ts
|
|
3
4
|
declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => T): T;
|
|
4
5
|
declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => Promise<T>): Promise<T>;
|
|
@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
|
|
|
2
2
|
import { getOpenTelemetryAPI } from "./api.mjs";
|
|
3
3
|
//#region src/instrumentation/tracer.ts
|
|
4
4
|
const INSTRUMENTATION_SCOPE = "better-auth";
|
|
5
|
-
const INSTRUMENTATION_VERSION = "1.6.
|
|
5
|
+
const INSTRUMENTATION_VERSION = "1.6.28";
|
|
6
6
|
/**
|
|
7
7
|
* Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
|
|
8
8
|
* callbacks). These are APIErrors with 3xx status codes and should not be
|
|
@@ -1,8 +1,13 @@
|
|
|
1
1
|
import { AwaitableFunction } from "../types/helper.mjs";
|
|
2
|
-
import "../types/index.mjs";
|
|
3
2
|
import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
|
|
3
|
+
|
|
4
4
|
//#region src/oauth2/client-credentials-token.d.ts
|
|
5
|
-
declare function clientCredentialsTokenRequest({
|
|
5
|
+
declare function clientCredentialsTokenRequest({
|
|
6
|
+
options,
|
|
7
|
+
scope,
|
|
8
|
+
authentication,
|
|
9
|
+
resource
|
|
10
|
+
}: {
|
|
6
11
|
options: AwaitableFunction<ProviderOptions & {
|
|
7
12
|
clientSecret: string;
|
|
8
13
|
}>;
|
|
@@ -16,7 +21,12 @@ declare function clientCredentialsTokenRequest({ options, scope, authentication,
|
|
|
16
21
|
/**
|
|
17
22
|
* @deprecated use async'd clientCredentialsTokenRequest instead
|
|
18
23
|
*/
|
|
19
|
-
declare function createClientCredentialsTokenRequest({
|
|
24
|
+
declare function createClientCredentialsTokenRequest({
|
|
25
|
+
options,
|
|
26
|
+
scope,
|
|
27
|
+
authentication,
|
|
28
|
+
resource
|
|
29
|
+
}: {
|
|
20
30
|
options: ProviderOptions & {
|
|
21
31
|
clientSecret: string;
|
|
22
32
|
};
|
|
@@ -27,7 +37,13 @@ declare function createClientCredentialsTokenRequest({ options, scope, authentic
|
|
|
27
37
|
body: URLSearchParams;
|
|
28
38
|
headers: Record<string, any>;
|
|
29
39
|
};
|
|
30
|
-
declare function clientCredentialsToken({
|
|
40
|
+
declare function clientCredentialsToken({
|
|
41
|
+
options,
|
|
42
|
+
tokenEndpoint,
|
|
43
|
+
scope,
|
|
44
|
+
authentication,
|
|
45
|
+
resource
|
|
46
|
+
}: {
|
|
31
47
|
options: AwaitableFunction<ProviderOptions & {
|
|
32
48
|
clientSecret: string;
|
|
33
49
|
}>;
|
|
@@ -1,9 +1,26 @@
|
|
|
1
1
|
import { AwaitableFunction } from "../types/helper.mjs";
|
|
2
|
-
import "../types/index.mjs";
|
|
3
2
|
import { ProviderOptions } from "./oauth-provider.mjs";
|
|
4
|
-
import "./index.mjs";
|
|
5
3
|
//#region src/oauth2/create-authorization-url.d.ts
|
|
6
|
-
declare function createAuthorizationURL({
|
|
4
|
+
declare function createAuthorizationURL({
|
|
5
|
+
id,
|
|
6
|
+
options,
|
|
7
|
+
authorizationEndpoint,
|
|
8
|
+
state,
|
|
9
|
+
codeVerifier,
|
|
10
|
+
scopes,
|
|
11
|
+
claims,
|
|
12
|
+
redirectURI,
|
|
13
|
+
duration,
|
|
14
|
+
prompt,
|
|
15
|
+
accessType,
|
|
16
|
+
responseType,
|
|
17
|
+
display,
|
|
18
|
+
loginHint,
|
|
19
|
+
hd,
|
|
20
|
+
responseMode,
|
|
21
|
+
additionalParams,
|
|
22
|
+
scopeJoiner
|
|
23
|
+
}: {
|
|
7
24
|
id: string;
|
|
8
25
|
options: AwaitableFunction<ProviderOptions>;
|
|
9
26
|
redirectURI: string;
|
|
@@ -1,8 +1,14 @@
|
|
|
1
1
|
import { AwaitableFunction } from "../types/helper.mjs";
|
|
2
|
-
import "../types/index.mjs";
|
|
3
2
|
import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
|
|
3
|
+
|
|
4
4
|
//#region src/oauth2/refresh-access-token.d.ts
|
|
5
|
-
declare function refreshAccessTokenRequest({
|
|
5
|
+
declare function refreshAccessTokenRequest({
|
|
6
|
+
refreshToken,
|
|
7
|
+
options,
|
|
8
|
+
authentication,
|
|
9
|
+
extraParams,
|
|
10
|
+
resource
|
|
11
|
+
}: {
|
|
6
12
|
refreshToken: string;
|
|
7
13
|
options: AwaitableFunction<Partial<ProviderOptions>>;
|
|
8
14
|
authentication?: ("basic" | "post") | undefined;
|
|
@@ -15,7 +21,13 @@ declare function refreshAccessTokenRequest({ refreshToken, options, authenticati
|
|
|
15
21
|
/**
|
|
16
22
|
* @deprecated use async'd refreshAccessTokenRequest instead
|
|
17
23
|
*/
|
|
18
|
-
declare function createRefreshAccessTokenRequest({
|
|
24
|
+
declare function createRefreshAccessTokenRequest({
|
|
25
|
+
refreshToken,
|
|
26
|
+
options,
|
|
27
|
+
authentication,
|
|
28
|
+
extraParams,
|
|
29
|
+
resource
|
|
30
|
+
}: {
|
|
19
31
|
refreshToken: string;
|
|
20
32
|
options: ProviderOptions;
|
|
21
33
|
authentication?: ("basic" | "post") | undefined;
|
|
@@ -25,7 +37,13 @@ declare function createRefreshAccessTokenRequest({ refreshToken, options, authen
|
|
|
25
37
|
body: URLSearchParams;
|
|
26
38
|
headers: Record<string, any>;
|
|
27
39
|
};
|
|
28
|
-
declare function refreshAccessToken({
|
|
40
|
+
declare function refreshAccessToken({
|
|
41
|
+
refreshToken,
|
|
42
|
+
options,
|
|
43
|
+
tokenEndpoint,
|
|
44
|
+
authentication,
|
|
45
|
+
extraParams
|
|
46
|
+
}: {
|
|
29
47
|
refreshToken: string;
|
|
30
48
|
options: Partial<ProviderOptions>;
|
|
31
49
|
tokenEndpoint: string;
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { BetterAuthError } from "../error/index.mjs";
|
|
2
2
|
import { betterFetch } from "@better-fetch/fetch";
|
|
3
3
|
//#region src/oauth2/reject-redirects.ts
|
|
4
|
-
const HTTP_REDIRECT_STATUSES =
|
|
4
|
+
const HTTP_REDIRECT_STATUSES = new Set([
|
|
5
5
|
301,
|
|
6
6
|
302,
|
|
7
7
|
303,
|
package/dist/oauth2/utils.d.mts
CHANGED
|
@@ -1,9 +1,19 @@
|
|
|
1
1
|
import { AwaitableFunction } from "../types/helper.mjs";
|
|
2
|
-
import "../types/index.mjs";
|
|
3
2
|
import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
|
|
4
|
-
import "
|
|
3
|
+
import * as _$jose from "jose";
|
|
4
|
+
|
|
5
5
|
//#region src/oauth2/validate-authorization-code.d.ts
|
|
6
|
-
declare function authorizationCodeRequest({
|
|
6
|
+
declare function authorizationCodeRequest({
|
|
7
|
+
code,
|
|
8
|
+
codeVerifier,
|
|
9
|
+
redirectURI,
|
|
10
|
+
options,
|
|
11
|
+
authentication,
|
|
12
|
+
deviceId,
|
|
13
|
+
headers,
|
|
14
|
+
additionalParams,
|
|
15
|
+
resource
|
|
16
|
+
}: {
|
|
7
17
|
code: string;
|
|
8
18
|
redirectURI: string;
|
|
9
19
|
options: AwaitableFunction<Partial<ProviderOptions>>;
|
|
@@ -20,7 +30,17 @@ declare function authorizationCodeRequest({ code, codeVerifier, redirectURI, opt
|
|
|
20
30
|
/**
|
|
21
31
|
* @deprecated use async'd authorizationCodeRequest instead
|
|
22
32
|
*/
|
|
23
|
-
declare function createAuthorizationCodeRequest({
|
|
33
|
+
declare function createAuthorizationCodeRequest({
|
|
34
|
+
code,
|
|
35
|
+
codeVerifier,
|
|
36
|
+
redirectURI,
|
|
37
|
+
options,
|
|
38
|
+
authentication,
|
|
39
|
+
deviceId,
|
|
40
|
+
headers,
|
|
41
|
+
additionalParams,
|
|
42
|
+
resource
|
|
43
|
+
}: {
|
|
24
44
|
code: string;
|
|
25
45
|
redirectURI: string;
|
|
26
46
|
options: Partial<ProviderOptions>;
|
|
@@ -34,7 +54,18 @@ declare function createAuthorizationCodeRequest({ code, codeVerifier, redirectUR
|
|
|
34
54
|
body: URLSearchParams;
|
|
35
55
|
headers: Record<string, any>;
|
|
36
56
|
};
|
|
37
|
-
declare function validateAuthorizationCode({
|
|
57
|
+
declare function validateAuthorizationCode({
|
|
58
|
+
code,
|
|
59
|
+
codeVerifier,
|
|
60
|
+
redirectURI,
|
|
61
|
+
options,
|
|
62
|
+
tokenEndpoint,
|
|
63
|
+
authentication,
|
|
64
|
+
deviceId,
|
|
65
|
+
headers,
|
|
66
|
+
additionalParams,
|
|
67
|
+
resource
|
|
68
|
+
}: {
|
|
38
69
|
code: string;
|
|
39
70
|
redirectURI: string;
|
|
40
71
|
options: AwaitableFunction<Partial<ProviderOptions>>;
|
|
@@ -49,6 +80,6 @@ declare function validateAuthorizationCode({ code, codeVerifier, redirectURI, op
|
|
|
49
80
|
declare function validateToken(token: string, jwksEndpoint: string, options?: {
|
|
50
81
|
audience?: string | string[];
|
|
51
82
|
issuer?: string | string[];
|
|
52
|
-
}): Promise<
|
|
83
|
+
}): Promise<_$jose.JWTVerifyResult<_$jose.JWTPayload> & _$jose.ResolvedKey>;
|
|
53
84
|
//#endregion
|
|
54
85
|
export { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken };
|
package/dist/oauth2/verify.d.mts
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
import { JSONWebKeySet, JWTPayload, JWTVerifyOptions } from "jose";
|
|
2
|
+
|
|
2
3
|
//#region src/oauth2/verify.d.ts
|
|
3
4
|
type JwksFetchOptions = {
|
|
4
|
-
/** Jwks url or promise of a Jwks */
|
|
5
|
-
jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
|
|
5
|
+
/** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
|
|
6
6
|
/**
|
|
7
7
|
* Stable object to cache the result of a function `jwksFetch` under,
|
|
8
8
|
* with the same TTL and kid-miss refetch rules as string sources.
|
|
@@ -10,6 +10,9 @@ type JwksFetchOptions = {
|
|
|
10
10
|
*/
|
|
11
11
|
jwksCacheKey?: object;
|
|
12
12
|
};
|
|
13
|
+
/**
|
|
14
|
+
* @internal
|
|
15
|
+
*/
|
|
13
16
|
interface VerifyAccessTokenRemote {
|
|
14
17
|
/** Full url of the introspect endpoint. Should end with `/oauth2/introspect` */
|
|
15
18
|
introspectUrl: string;
|
|
@@ -44,8 +47,7 @@ interface VerifyAccessTokenRemote {
|
|
|
44
47
|
* Can also be configured for remote verification.
|
|
45
48
|
*/
|
|
46
49
|
declare function verifyJwsAccessToken(token: string, opts: JwksFetchOptions & {
|
|
47
|
-
/** Verify options */
|
|
48
|
-
verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
|
|
50
|
+
/** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
|
|
49
51
|
}): Promise<JWTPayload>;
|
|
50
52
|
declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWebKeySet>;
|
|
51
53
|
/**
|
|
@@ -54,14 +56,10 @@ declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWeb
|
|
|
54
56
|
* Can also be configured for remote verification.
|
|
55
57
|
*/
|
|
56
58
|
declare function verifyAccessToken(token: string, opts: {
|
|
57
|
-
/** Verify options */
|
|
58
|
-
|
|
59
|
-
/**
|
|
60
|
-
scopes?: string[];
|
|
61
|
-
/** Required to verify access token locally */
|
|
62
|
-
jwksUrl?: string;
|
|
63
|
-
/** If provided, can verify a token remotely */
|
|
59
|
+
/** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>; /** Scopes to additionally verify. Token must include all but not exact. */
|
|
60
|
+
scopes?: string[]; /** Required to verify access token locally */
|
|
61
|
+
jwksUrl?: string; /** If provided, can verify a token remotely */
|
|
64
62
|
remoteVerify?: VerifyAccessTokenRemote;
|
|
65
63
|
}): Promise<JWTPayload>;
|
|
66
64
|
//#endregion
|
|
67
|
-
export {
|
|
65
|
+
export { getJwks, verifyAccessToken, verifyJwsAccessToken };
|
package/dist/oauth2/verify.mjs
CHANGED
|
@@ -3,7 +3,7 @@ import { fetchRefusingRedirects } from "./reject-redirects.mjs";
|
|
|
3
3
|
import { APIError } from "better-call";
|
|
4
4
|
import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
|
|
5
5
|
//#region src/oauth2/verify.ts
|
|
6
|
-
const joseInfrastructureErrorCodes =
|
|
6
|
+
const joseInfrastructureErrorCodes = new Set([
|
|
7
7
|
errors.JWKSTimeout.code,
|
|
8
8
|
errors.JWKSInvalid.code,
|
|
9
9
|
errors.JWKSMultipleMatchingKeys.code
|
|
@@ -199,4 +199,4 @@ async function verifyAccessToken(token, opts) {
|
|
|
199
199
|
return payload;
|
|
200
200
|
}
|
|
201
201
|
//#endregion
|
|
202
|
-
export { getJwks,
|
|
202
|
+
export { getJwks, verifyAccessToken, verifyJwsAccessToken };
|
|
@@ -1,7 +1,5 @@
|
|
|
1
1
|
import { GenericEndpointContext } from "../types/context.mjs";
|
|
2
|
-
import "../types/index.mjs";
|
|
3
2
|
import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
|
|
4
|
-
import "../oauth2/index.mjs";
|
|
5
3
|
//#region src/social-providers/apple.d.ts
|
|
6
4
|
interface AppleProfile {
|
|
7
5
|
/**
|
|
@@ -70,7 +68,12 @@ interface AppleOptions extends ProviderOptions<AppleProfile> {
|
|
|
70
68
|
declare const apple: (options: AppleOptions) => {
|
|
71
69
|
id: "apple";
|
|
72
70
|
name: string;
|
|
73
|
-
createAuthorizationURL({
|
|
71
|
+
createAuthorizationURL({
|
|
72
|
+
state,
|
|
73
|
+
scopes,
|
|
74
|
+
redirectURI,
|
|
75
|
+
codeVerifier
|
|
76
|
+
}: {
|
|
74
77
|
state: string;
|
|
75
78
|
codeVerifier: string;
|
|
76
79
|
scopes?: string[] | undefined;
|
|
@@ -78,7 +81,11 @@ declare const apple: (options: AppleOptions) => {
|
|
|
78
81
|
display?: string | undefined;
|
|
79
82
|
loginHint?: string | undefined;
|
|
80
83
|
}): Promise<URL>;
|
|
81
|
-
validateAuthorizationCode: ({
|
|
84
|
+
validateAuthorizationCode: ({
|
|
85
|
+
code,
|
|
86
|
+
codeVerifier,
|
|
87
|
+
redirectURI
|
|
88
|
+
}: {
|
|
82
89
|
code: string;
|
|
83
90
|
redirectURI: string;
|
|
84
91
|
codeVerifier?: string | undefined;
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
|
|
2
|
-
import "../oauth2/index.mjs";
|
|
3
2
|
//#region src/social-providers/atlassian.d.ts
|
|
4
3
|
interface AtlassianProfile {
|
|
5
4
|
account_type?: string | undefined;
|
|
@@ -22,7 +21,12 @@ interface AtlassianOptions extends ProviderOptions<AtlassianProfile> {
|
|
|
22
21
|
declare const atlassian: (options: AtlassianOptions) => {
|
|
23
22
|
id: "atlassian";
|
|
24
23
|
name: string;
|
|
25
|
-
createAuthorizationURL({
|
|
24
|
+
createAuthorizationURL({
|
|
25
|
+
state,
|
|
26
|
+
scopes,
|
|
27
|
+
codeVerifier,
|
|
28
|
+
redirectURI
|
|
29
|
+
}: {
|
|
26
30
|
state: string;
|
|
27
31
|
codeVerifier: string;
|
|
28
32
|
scopes?: string[] | undefined;
|
|
@@ -30,7 +34,11 @@ declare const atlassian: (options: AtlassianOptions) => {
|
|
|
30
34
|
display?: string | undefined;
|
|
31
35
|
loginHint?: string | undefined;
|
|
32
36
|
}): Promise<URL>;
|
|
33
|
-
validateAuthorizationCode: ({
|
|
37
|
+
validateAuthorizationCode: ({
|
|
38
|
+
code,
|
|
39
|
+
codeVerifier,
|
|
40
|
+
redirectURI
|
|
41
|
+
}: {
|
|
34
42
|
code: string;
|
|
35
43
|
redirectURI: string;
|
|
36
44
|
codeVerifier?: string | undefined;
|
|
@@ -1,7 +1,5 @@
|
|
|
1
1
|
import { GenericEndpointContext } from "../types/context.mjs";
|
|
2
|
-
import "../types/index.mjs";
|
|
3
2
|
import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
|
|
4
|
-
import "../oauth2/index.mjs";
|
|
5
3
|
//#region src/social-providers/cognito.d.ts
|
|
6
4
|
interface CognitoProfile {
|
|
7
5
|
sub: string;
|
|
@@ -37,7 +35,12 @@ interface CognitoOptions extends ProviderOptions<CognitoProfile> {
|
|
|
37
35
|
declare const cognito: (options: CognitoOptions) => {
|
|
38
36
|
id: "cognito";
|
|
39
37
|
name: string;
|
|
40
|
-
createAuthorizationURL({
|
|
38
|
+
createAuthorizationURL({
|
|
39
|
+
state,
|
|
40
|
+
scopes,
|
|
41
|
+
codeVerifier,
|
|
42
|
+
redirectURI
|
|
43
|
+
}: {
|
|
41
44
|
state: string;
|
|
42
45
|
codeVerifier: string;
|
|
43
46
|
scopes?: string[] | undefined;
|
|
@@ -45,7 +48,11 @@ declare const cognito: (options: CognitoOptions) => {
|
|
|
45
48
|
display?: string | undefined;
|
|
46
49
|
loginHint?: string | undefined;
|
|
47
50
|
}): Promise<URL>;
|
|
48
|
-
validateAuthorizationCode: ({
|
|
51
|
+
validateAuthorizationCode: ({
|
|
52
|
+
code,
|
|
53
|
+
codeVerifier,
|
|
54
|
+
redirectURI
|
|
55
|
+
}: {
|
|
49
56
|
code: string;
|
|
50
57
|
redirectURI: string;
|
|
51
58
|
codeVerifier?: string | undefined;
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
|
|
2
|
-
import "../oauth2/index.mjs";
|
|
3
2
|
//#region src/social-providers/discord.d.ts
|
|
4
3
|
interface DiscordProfile extends Record<string, any> {
|
|
5
4
|
/** the user's id (i.e. the numerical snowflake) */
|
|
@@ -78,7 +77,11 @@ interface DiscordOptions extends ProviderOptions<DiscordProfile> {
|
|
|
78
77
|
declare const discord: (options: DiscordOptions) => {
|
|
79
78
|
id: "discord";
|
|
80
79
|
name: string;
|
|
81
|
-
createAuthorizationURL({
|
|
80
|
+
createAuthorizationURL({
|
|
81
|
+
state,
|
|
82
|
+
scopes,
|
|
83
|
+
redirectURI
|
|
84
|
+
}: {
|
|
82
85
|
state: string;
|
|
83
86
|
codeVerifier: string;
|
|
84
87
|
scopes?: string[] | undefined;
|
|
@@ -86,7 +89,10 @@ declare const discord: (options: DiscordOptions) => {
|
|
|
86
89
|
display?: string | undefined;
|
|
87
90
|
loginHint?: string | undefined;
|
|
88
91
|
}): URL;
|
|
89
|
-
validateAuthorizationCode: ({
|
|
92
|
+
validateAuthorizationCode: ({
|
|
93
|
+
code,
|
|
94
|
+
redirectURI
|
|
95
|
+
}: {
|
|
90
96
|
code: string;
|
|
91
97
|
redirectURI: string;
|
|
92
98
|
codeVerifier?: string | undefined;
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
|
|
2
|
-
import "../oauth2/index.mjs";
|
|
3
2
|
//#region src/social-providers/dropbox.d.ts
|
|
4
3
|
interface DropboxProfile {
|
|
5
4
|
account_id: string;
|
|
@@ -21,7 +20,12 @@ interface DropboxOptions extends ProviderOptions<DropboxProfile> {
|
|
|
21
20
|
declare const dropbox: (options: DropboxOptions) => {
|
|
22
21
|
id: "dropbox";
|
|
23
22
|
name: string;
|
|
24
|
-
createAuthorizationURL: ({
|
|
23
|
+
createAuthorizationURL: ({
|
|
24
|
+
state,
|
|
25
|
+
scopes,
|
|
26
|
+
codeVerifier,
|
|
27
|
+
redirectURI
|
|
28
|
+
}: {
|
|
25
29
|
state: string;
|
|
26
30
|
codeVerifier: string;
|
|
27
31
|
scopes?: string[] | undefined;
|
|
@@ -29,7 +33,11 @@ declare const dropbox: (options: DropboxOptions) => {
|
|
|
29
33
|
display?: string | undefined;
|
|
30
34
|
loginHint?: string | undefined;
|
|
31
35
|
}) => Promise<URL>;
|
|
32
|
-
validateAuthorizationCode: ({
|
|
36
|
+
validateAuthorizationCode: ({
|
|
37
|
+
code,
|
|
38
|
+
codeVerifier,
|
|
39
|
+
redirectURI
|
|
40
|
+
}: {
|
|
33
41
|
code: string;
|
|
34
42
|
redirectURI: string;
|
|
35
43
|
codeVerifier?: string | undefined;
|
|
@@ -1,7 +1,5 @@
|
|
|
1
1
|
import { GenericEndpointContext } from "../types/context.mjs";
|
|
2
|
-
import "../types/index.mjs";
|
|
3
2
|
import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
|
|
4
|
-
import "../oauth2/index.mjs";
|
|
5
3
|
//#region src/social-providers/facebook.d.ts
|
|
6
4
|
interface FacebookProfile {
|
|
7
5
|
id: string;
|
|
@@ -33,7 +31,12 @@ interface FacebookOptions extends ProviderOptions<FacebookProfile> {
|
|
|
33
31
|
declare const facebook: (options: FacebookOptions) => {
|
|
34
32
|
id: "facebook";
|
|
35
33
|
name: string;
|
|
36
|
-
createAuthorizationURL({
|
|
34
|
+
createAuthorizationURL({
|
|
35
|
+
state,
|
|
36
|
+
scopes,
|
|
37
|
+
redirectURI,
|
|
38
|
+
loginHint
|
|
39
|
+
}: {
|
|
37
40
|
state: string;
|
|
38
41
|
codeVerifier: string;
|
|
39
42
|
scopes?: string[] | undefined;
|
|
@@ -41,7 +44,10 @@ declare const facebook: (options: FacebookOptions) => {
|
|
|
41
44
|
display?: string | undefined;
|
|
42
45
|
loginHint?: string | undefined;
|
|
43
46
|
}): Promise<URL>;
|
|
44
|
-
validateAuthorizationCode: ({
|
|
47
|
+
validateAuthorizationCode: ({
|
|
48
|
+
code,
|
|
49
|
+
redirectURI
|
|
50
|
+
}: {
|
|
45
51
|
code: string;
|
|
46
52
|
redirectURI: string;
|
|
47
53
|
codeVerifier?: string | undefined;
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
|
|
2
|
-
import "../oauth2/index.mjs";
|
|
3
2
|
//#region src/social-providers/figma.d.ts
|
|
4
3
|
interface FigmaProfile {
|
|
5
4
|
id: string;
|
|
@@ -13,7 +12,12 @@ interface FigmaOptions extends ProviderOptions<FigmaProfile> {
|
|
|
13
12
|
declare const figma: (options: FigmaOptions) => {
|
|
14
13
|
id: "figma";
|
|
15
14
|
name: string;
|
|
16
|
-
createAuthorizationURL({
|
|
15
|
+
createAuthorizationURL({
|
|
16
|
+
state,
|
|
17
|
+
scopes,
|
|
18
|
+
codeVerifier,
|
|
19
|
+
redirectURI
|
|
20
|
+
}: {
|
|
17
21
|
state: string;
|
|
18
22
|
codeVerifier: string;
|
|
19
23
|
scopes?: string[] | undefined;
|
|
@@ -21,7 +25,11 @@ declare const figma: (options: FigmaOptions) => {
|
|
|
21
25
|
display?: string | undefined;
|
|
22
26
|
loginHint?: string | undefined;
|
|
23
27
|
}): Promise<URL>;
|
|
24
|
-
validateAuthorizationCode: ({
|
|
28
|
+
validateAuthorizationCode: ({
|
|
29
|
+
code,
|
|
30
|
+
codeVerifier,
|
|
31
|
+
redirectURI
|
|
32
|
+
}: {
|
|
25
33
|
code: string;
|
|
26
34
|
redirectURI: string;
|
|
27
35
|
codeVerifier?: string | undefined;
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
|
|
2
|
-
import "../oauth2/index.mjs";
|
|
3
2
|
//#region src/social-providers/github.d.ts
|
|
4
3
|
interface GithubProfile {
|
|
5
4
|
login: string;
|
|
@@ -53,7 +52,13 @@ interface GithubOptions extends ProviderOptions<GithubProfile> {
|
|
|
53
52
|
declare const github: (options: GithubOptions) => {
|
|
54
53
|
id: "github";
|
|
55
54
|
name: string;
|
|
56
|
-
createAuthorizationURL({
|
|
55
|
+
createAuthorizationURL({
|
|
56
|
+
state,
|
|
57
|
+
scopes,
|
|
58
|
+
loginHint,
|
|
59
|
+
codeVerifier,
|
|
60
|
+
redirectURI
|
|
61
|
+
}: {
|
|
57
62
|
state: string;
|
|
58
63
|
codeVerifier: string;
|
|
59
64
|
scopes?: string[] | undefined;
|
|
@@ -61,7 +66,11 @@ declare const github: (options: GithubOptions) => {
|
|
|
61
66
|
display?: string | undefined;
|
|
62
67
|
loginHint?: string | undefined;
|
|
63
68
|
}): Promise<URL>;
|
|
64
|
-
validateAuthorizationCode: ({
|
|
69
|
+
validateAuthorizationCode: ({
|
|
70
|
+
code,
|
|
71
|
+
codeVerifier,
|
|
72
|
+
redirectURI
|
|
73
|
+
}: {
|
|
65
74
|
code: string;
|
|
66
75
|
redirectURI: string;
|
|
67
76
|
codeVerifier?: string | undefined;
|