@better-auth/core 1.7.0-beta.0 → 1.7.0-beta.10

package/dist/social-providers/github.mjs

@@ -2,7 +2,7 @@ import { logger } from "../env/logger.mjs";
 import { getOAuth2Tokens } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
-import { createAuthorizationCodeRequest } from "../oauth2/validate-authorization-code.mjs";
+import { authorizationCodeRequest } from "../oauth2/validate-authorization-code.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/github.ts
 const github = (options) => {
@@ -10,7 +10,7 @@ const github = (options) => {
 	return {
 		id: "github",
 		name: "GitHub",
-		createAuthorizationURL({ state, scopes, loginHint, codeVerifier, redirectURI }) {
+		createAuthorizationURL({ state, scopes, loginHint, codeVerifier, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["read:user", "user:email"];
 			if (options.scope) _scopes.push(...options.scope);
 			if (scopes) _scopes.push(...scopes);
@@ -23,11 +23,12 @@ const github = (options) => {
 				codeVerifier,
 				redirectURI,
 				loginHint,
-				prompt: options.prompt
+				prompt: options.prompt,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
-			const { body, headers: requestHeaders } = createAuthorizationCodeRequest({
+			const { body, headers: requestHeaders } = await authorizationCodeRequest({
 				code,
 				codeVerifier,
 				redirectURI,

package/dist/social-providers/gitlab.d.mts

@@ -57,7 +57,8 @@ declare const gitlab: (options: GitlabOptions) => {
     scopes,
     codeVerifier,
     loginHint,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -65,6 +66,8 @@ declare const gitlab: (options: GitlabOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }) => Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -78,6 +81,7 @@ declare const gitlab: (options: GitlabOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/gitlab.mjs

@@ -20,7 +20,7 @@ const gitlab = (options) => {
 	return {
 		id: issuerId,
 		name: "Gitlab",
-		createAuthorizationURL: async ({ state, scopes, codeVerifier, loginHint, redirectURI }) => {
+		createAuthorizationURL: async ({ state, scopes, codeVerifier, loginHint, redirectURI, additionalParams }) => {
 			const _scopes = options.disableDefaultScope ? [] : ["read_user"];
 			if (options.scope) _scopes.push(...options.scope);
 			if (scopes) _scopes.push(...scopes);
@@ -32,7 +32,8 @@ const gitlab = (options) => {
 				state,
 				redirectURI,
 				codeVerifier,
-				loginHint
+				loginHint,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI, codeVerifier }) => {

package/dist/social-providers/google.d.mts

@@ -1,4 +1,7 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import * as jose from "jose";
+import { JWTPayload } from "jose";
+
 //#region src/social-providers/google.d.ts
 interface GoogleProfile {
   aud: string;
@@ -27,7 +30,7 @@ interface GoogleProfile {
   sub: string;
 }
 interface GoogleOptions extends ProviderOptions<GoogleProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The access type to use for the authorization code request
    */
@@ -37,10 +40,45 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    */
   display?: ("page" | "popup" | "touch" | "wap") | undefined;
   /**
-   * The hosted domain of the user
+   * The hosted domain (Google Workspace) the user must belong to.
+   *
+   * This is sent to Google as the `hd` authorization hint and, when set, is
+   * also enforced against the `hd` claim of the returned id token/profile.
+   * Set `hd: "*"` to require any Workspace hosted-domain claim. Sign-in is
+   * rejected when the claim is missing or does not satisfy this restriction.
    */
   hd?: string | undefined;
+  /**
+   * Whether to send `include_granted_scopes=true` to Google's authorization
+   * endpoint, which lets new access tokens cover scopes from prior grants
+   * in addition to the ones requested for this flow. Set to `false` when
+   * each OAuth flow should request only its own scopes.
+   *
+   * Defaults to `true`.
+   *
+   * @see https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth
+   */
+  includeGrantedScopes?: boolean | undefined;
+}
+interface VerifyGoogleIdTokenOptions {
+  token: string;
+  audience: string | string[];
+  nonce?: string | undefined;
 }
+/**
+ * Verifies a Google ID token against Google's issuer, audience, signature,
+ * expiry, and maximum token age.
+ */
+declare const verifyGoogleIdToken: ({
+  token,
+  audience,
+  nonce
+}: VerifyGoogleIdTokenOptions) => Promise<JWTPayload | null>;
+/**
+ * Checks whether Google's verified `hd` claim satisfies the configured hosted
+ * domain restriction. `hd: "*"` accepts any Google Workspace hosted domain.
+ */
+declare const isGoogleHostedDomainAllowed: (configuredHostedDomain: string | undefined, tokenHostedDomain: unknown) => boolean;
 declare const google: (options: GoogleOptions) => {
   id: "google";
   name: string;
@@ -50,7 +88,8 @@ declare const google: (options: GoogleOptions) => {
     codeVerifier,
     redirectURI,
     loginHint,
-    display
+    display,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -58,6 +97,8 @@ declare const google: (options: GoogleOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -70,8 +111,15 @@ declare const google: (options: GoogleOptions) => {
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  idToken: {
+    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    issuer: string[];
+    audience: string | string[];
+    maxTokenAge: string;
+    verifyClaims: ((claims: Record<string, unknown>) => boolean) | undefined;
+  };
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;
@@ -94,4 +142,4 @@ declare const google: (options: GoogleOptions) => {
 };
 declare const getGooglePublicKey: (kid: string) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
 //#endregion
-export { GoogleOptions, GoogleProfile, getGooglePublicKey, google };
+export { GoogleOptions, GoogleProfile, VerifyGoogleIdTokenOptions, getGooglePublicKey, google, isGoogleHostedDomainAllowed, verifyGoogleIdToken };

package/dist/social-providers/google.mjs

@@ -1,17 +1,60 @@
-import { logger } from "../env/logger.mjs";
 import { APIError, BetterAuthError } from "../error/index.mjs";
+import { logger } from "../env/logger.mjs";
+import { getPrimaryClientId } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
 import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/google.ts
+const GOOGLE_ID_TOKEN_MAX_AGE = "1h";
+const GOOGLE_ID_TOKEN_ALGORITHM = "RS256";
+const GOOGLE_ID_TOKEN_ALGORITHMS = [GOOGLE_ID_TOKEN_ALGORITHM];
+function isGoogleIdTokenAlgorithm(algorithm) {
+	return GOOGLE_ID_TOKEN_ALGORITHMS.includes(algorithm);
+}
+/**
+* Verifies a Google ID token against Google's issuer, audience, signature,
+* expiry, and maximum token age.
+*/
+const verifyGoogleIdToken = async ({ token, audience, nonce }) => {
+	try {
+		const { kid, alg } = decodeProtectedHeader(token);
+		if (!isGoogleIdTokenAlgorithm(alg)) return null;
+		const publicKeys = await getGooglePublicKeys(kid);
+		for (const publicKey of publicKeys) try {
+			const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
+				algorithms: GOOGLE_ID_TOKEN_ALGORITHMS,
+				issuer: ["https://accounts.google.com", "accounts.google.com"],
+				audience,
+				maxTokenAge: GOOGLE_ID_TOKEN_MAX_AGE
+			});
+			if (nonce && jwtClaims.nonce !== nonce) return null;
+			return jwtClaims;
+		} catch {
+			continue;
+		}
+		return null;
+	} catch {
+		return null;
+	}
+};
+/**
+* Checks whether Google's verified `hd` claim satisfies the configured hosted
+* domain restriction. `hd: "*"` accepts any Google Workspace hosted domain.
+*/
+const isGoogleHostedDomainAllowed = (configuredHostedDomain, tokenHostedDomain) => {
+	if (!configuredHostedDomain) return true;
+	if (typeof tokenHostedDomain !== "string" || !tokenHostedDomain) return false;
+	if (configuredHostedDomain === "*") return true;
+	return tokenHostedDomain === configuredHostedDomain;
+};
 const google = (options) => {
 	return {
 		id: "google",
 		name: "Google",
-		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, display }) {
-			if (!options.clientId || !options.clientSecret) {
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, display, additionalParams }) {
+			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client Id and Client Secret is required for Google. Make sure to provide them in the options.");
 				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
 			}
@@ -36,7 +79,10 @@ const google = (options) => {
 				display: display || options.display,
 				loginHint,
 				hd: options.hd,
-				additionalParams: { include_granted_scopes: "true" }
+				additionalParams: {
+					...options.includeGrantedScopes === false ? {} : { include_granted_scopes: "true" },
+					...additionalParams ?? {}
+				}
 			});
 		},
 		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
@@ -59,28 +105,21 @@ const google = (options) => {
 				tokenEndpoint: "https://oauth2.googleapis.com/token"
 			});
 		},
-		async verifyIdToken(token, nonce) {
-			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
-			try {
-				const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
-				if (!kid || !jwtAlg) return false;
-				const { payload: jwtClaims } = await jwtVerify(token, await getGooglePublicKey(kid), {
-					algorithms: [jwtAlg],
-					issuer: ["https://accounts.google.com", "accounts.google.com"],
-					audience: options.clientId,
-					maxTokenAge: "1h"
-				});
-				if (nonce && jwtClaims.nonce !== nonce) return false;
-				return true;
-			} catch {
-				return false;
-			}
+		idToken: {
+			jwks: (header) => getGooglePublicKey(header.kid),
+			issuer: ["https://accounts.google.com", "accounts.google.com"],
+			audience: options.clientId,
+			maxTokenAge: GOOGLE_ID_TOKEN_MAX_AGE,
+			verifyClaims: options.hd ? (claims) => isGoogleHostedDomainAllowed(options.hd, claims.hd) : void 0
 		},
 		async getUserInfo(token) {
 			if (options.getUserInfo) return options.getUserInfo(token);
 			if (!token.idToken) return null;
 			const user = decodeJwt(token.idToken);
+			if (!isGoogleHostedDomainAllowed(options.hd, user.hd)) {
+				logger.error(`Google sign-in rejected: id token hosted domain (hd) "${user.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${options.hd}".`);
+				return null;
+			}
 			const userMap = await options.mapProfileToUser?.(user);
 			return {
 				user: {
@@ -98,11 +137,16 @@ const google = (options) => {
 	};
 };
 const getGooglePublicKey = async (kid) => {
+	const [publicKey] = await getGooglePublicKeys(kid);
+	if (!publicKey) throw new Error(`JWK with kid ${kid} not found`);
+	return publicKey;
+};
+const getGooglePublicKeys = async (kid) => {
 	const { data } = await betterFetch("https://www.googleapis.com/oauth2/v3/certs");
 	if (!data?.keys) throw new APIError("BAD_REQUEST", { message: "Keys not found" });
-	const jwk = data.keys.find((key) => key.kid === kid);
-	if (!jwk) throw new Error(`JWK with kid ${kid} not found`);
-	return await importJWK(jwk, jwk.alg);
+	const jwks = kid ? data.keys.filter((key) => key.kid === kid) : data.keys;
+	if (!jwks.length) throw new Error(`JWK with kid ${kid} not found`);
+	return Promise.all(jwks.map((jwk) => importJWK(jwk, GOOGLE_ID_TOKEN_ALGORITHM)));
 };
 //#endregion
-export { getGooglePublicKey, google };
+export { getGooglePublicKey, google, isGoogleHostedDomainAllowed, verifyGoogleIdToken };

package/dist/social-providers/huggingface.d.mts

@@ -38,7 +38,8 @@ declare const huggingface: (options: HuggingFaceOptions) => {
     state,
     scopes,
     codeVerifier,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -46,6 +47,8 @@ declare const huggingface: (options: HuggingFaceOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -59,6 +62,7 @@ declare const huggingface: (options: HuggingFaceOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/huggingface.mjs

@@ -8,7 +8,7 @@ const huggingface = (options) => {
 	return {
 		id: "huggingface",
 		name: "Hugging Face",
-		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"openid",
 				"profile",
@@ -23,7 +23,8 @@ const huggingface = (options) => {
 				scopes: _scopes,
 				state,
 				codeVerifier,
-				redirectURI
+				redirectURI,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {