@better-auth/core 1.7.0-beta.1 → 1.7.0-beta.10

package/dist/instrumentation/pure.index.d.mts

@@ -0,0 +1,7 @@
+import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID } from "./attributes.mjs";
+
+//#region src/instrumentation/pure.index.d.ts
+declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => T): T;
+declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => Promise<T>): Promise<T>;
+//#endregion
+export { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, withSpan };

package/dist/instrumentation/pure.index.mjs

@@ -0,0 +1,7 @@
+import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID } from "./attributes.mjs";
+//#region src/instrumentation/pure.index.ts
+function withSpan(_name, _attributes, fn) {
+	return fn();
+}
+//#endregion
+export { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, withSpan };

package/dist/instrumentation/tracer.mjs

@@ -1,7 +1,8 @@
 import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
-import { SpanStatusCode, trace } from "@opentelemetry/api";
+import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
-const tracer = trace.getTracer("better-auth", "1.7.0-beta.1");
+const INSTRUMENTATION_SCOPE = "better-auth";
+const INSTRUMENTATION_VERSION = "1.7.0-beta.10";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be
@@ -15,6 +16,7 @@ function isRedirectError(err) {
 	return false;
 }
 function endSpanWithError(span, err) {
+	const { SpanStatusCode } = getOpenTelemetryAPI();
 	if (isRedirectError(err)) {
 		span.setAttribute(ATTR_HTTP_RESPONSE_STATUS_CODE, err.statusCode);
 		span.setStatus({ code: SpanStatusCode.OK });
@@ -28,7 +30,8 @@ function endSpanWithError(span, err) {
 	span.end();
 }
 function withSpan(name, attributes, fn) {
-	return tracer.startActiveSpan(name, { attributes }, (span) => {
+	const { trace } = getOpenTelemetryAPI();
+	return trace.getTracer(INSTRUMENTATION_SCOPE, INSTRUMENTATION_VERSION).startActiveSpan(name, { attributes }, (span) => {
 		try {
 			const result = fn();
 			if (result instanceof Promise) return result.then((value) => {

package/dist/oauth2/authorization-params.d.mts

@@ -0,0 +1,12 @@
+import * as z from "zod";
+
+//#region src/oauth2/authorization-params.d.ts
+/**
+ * Zod schema for the `additionalParams` field on social sign-in and
+ * account-linking request bodies. Rejects any key reserved by the
+ * authorization-URL builder (see `RESERVED_AUTHORIZATION_PARAMS`), so
+ * a caller cannot overwrite `state`, PKCE, `redirect_uri`, etc.
+ */
+declare const additionalAuthorizationParamsSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+//#endregion
+export { additionalAuthorizationParamsSchema };

package/dist/oauth2/authorization-params.mjs

@@ -0,0 +1,12 @@
+import { RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET } from "./create-authorization-url.mjs";
+import * as z from "zod";
+//#region src/oauth2/authorization-params.ts
+/**
+* Zod schema for the `additionalParams` field on social sign-in and
+* account-linking request bodies. Rejects any key reserved by the
+* authorization-URL builder (see `RESERVED_AUTHORIZATION_PARAMS`), so
+* a caller cannot overwrite `state`, PKCE, `redirect_uri`, etc.
+*/
+const additionalAuthorizationParamsSchema = z.record(z.string(), z.string()).refine((value) => !Object.keys(value).some((key) => RESERVED_AUTHORIZATION_PARAMS_SET.has(key)), { message: `additionalParams cannot include reserved OAuth parameters: ${RESERVED_AUTHORIZATION_PARAMS.join(", ")}` }).meta({ description: "Extra query parameters to append to the provider authorization URL (e.g. Cognito identity_provider, Google hd)." }).optional();
+//#endregion
+export { additionalAuthorizationParamsSchema };

package/dist/oauth2/basic-credentials.d.mts

@@ -0,0 +1,30 @@
+//#region src/oauth2/basic-credentials.d.ts
+/**
+ * Encodes an OAuth client id and secret as an HTTP Basic credential string.
+ *
+ * Follows RFC 6749 §2.3.1: both values are `application/x-www-form-urlencoded`
+ * prior to base64 encoding. The returned string is the full value of the
+ * `Authorization` header, including the `Basic ` prefix.
+ */
+declare function encodeBasicCredentials(clientId: string, clientSecret: string): string;
+/**
+ * Decodes an `Authorization: Basic …` header value into its OAuth client id
+ * and secret.
+ *
+ * Scheme matching is case-insensitive and tolerates one or more spaces
+ * between the scheme and credentials per RFC 7235 §2.1. The base64 payload
+ * is split on the first `:` only, so secrets containing colons round-trip
+ * correctly. Each half is form-url-decoded per RFC 6749 §2.3.1, accepting
+ * both `+` and `%20` as space. Per the URL Living Standard, invalid
+ * percent-escapes pass through as-is; downstream client lookup will fail
+ * with `invalid_client` for malformed credentials.
+ *
+ * Throws when the header is not a Basic credential, when the base64 payload
+ * contains no `:`, or when either half is empty.
+ */
+declare function decodeBasicCredentials(authorization: string): {
+  clientId: string;
+  clientSecret: string;
+};
+//#endregion
+export { decodeBasicCredentials, encodeBasicCredentials };

package/dist/oauth2/basic-credentials.mjs

@@ -0,0 +1,64 @@
+import { base64 } from "@better-auth/utils/base64";
+//#region src/oauth2/basic-credentials.ts
+const BASIC_AUTHORIZATION_PATTERN = /^Basic +(.*)$/i;
+/**
+* Encodes a value using `application/x-www-form-urlencoded` per the URL
+* Living Standard. Differs from `encodeURIComponent` in two ways: it escapes
+* `!`, `'`, `(`, and `)`, and it represents space as `+` rather than `%20`.
+* `*` is left unescaped, matching the URL Standard's percent-encode set.
+*/
+function formUrlEncode(value) {
+	return new URLSearchParams({ v: value }).toString().slice(2);
+}
+/**
+* Inverse of `formUrlEncode`: decodes a single `application/x-www-form-urlencoded`
+* value, handling both `+` and `%20` as space.
+*/
+function formUrlDecode(value) {
+	const decoded = new URLSearchParams(`v=${value}`).get("v");
+	if (decoded === null) throw new Error("form-url-encoded value could not be decoded");
+	return decoded;
+}
+/**
+* Encodes an OAuth client id and secret as an HTTP Basic credential string.
+*
+* Follows RFC 6749 §2.3.1: both values are `application/x-www-form-urlencoded`
+* prior to base64 encoding. The returned string is the full value of the
+* `Authorization` header, including the `Basic ` prefix.
+*/
+function encodeBasicCredentials(clientId, clientSecret) {
+	const payload = `${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`;
+	return `Basic ${base64.encode(payload)}`;
+}
+/**
+* Decodes an `Authorization: Basic …` header value into its OAuth client id
+* and secret.
+*
+* Scheme matching is case-insensitive and tolerates one or more spaces
+* between the scheme and credentials per RFC 7235 §2.1. The base64 payload
+* is split on the first `:` only, so secrets containing colons round-trip
+* correctly. Each half is form-url-decoded per RFC 6749 §2.3.1, accepting
+* both `+` and `%20` as space. Per the URL Living Standard, invalid
+* percent-escapes pass through as-is; downstream client lookup will fail
+* with `invalid_client` for malformed credentials.
+*
+* Throws when the header is not a Basic credential, when the base64 payload
+* contains no `:`, or when either half is empty.
+*/
+function decodeBasicCredentials(authorization) {
+	const match = authorization.match(BASIC_AUTHORIZATION_PATTERN);
+	if (!match) throw new Error("Authorization header is not a Basic credential");
+	const encoded = match[1] ?? "";
+	const decoded = new TextDecoder().decode(base64.decode(encoded));
+	const separatorIndex = decoded.indexOf(":");
+	if (separatorIndex === -1) throw new Error("Basic credential is missing the client id/secret separator");
+	const rawClientId = decoded.slice(0, separatorIndex);
+	const rawClientSecret = decoded.slice(separatorIndex + 1);
+	if (!rawClientId || !rawClientSecret) throw new Error("Basic credential client id and secret must both be non-empty");
+	return {
+		clientId: formUrlDecode(rawClientId),
+		clientSecret: formUrlDecode(rawClientSecret)
+	};
+}
+//#endregion
+export { decodeBasicCredentials, encodeBasicCredentials };

package/dist/oauth2/client-assertion.d.mts

@@ -1,11 +1,17 @@
+import { Awaitable } from "../types/helper.mjs";
 //#region src/oauth2/client-assertion.d.ts
 /** Asymmetric signing algorithms compatible with private_key_jwt (RFC 7523). */
-declare const ASSERTION_SIGNING_ALGORITHMS: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"];
-type AssertionSigningAlgorithm = (typeof ASSERTION_SIGNING_ALGORITHMS)[number];
+declare const PRIVATE_KEY_JWT_SIGNING_ALGORITHMS: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"];
+type PrivateKeyJwtSigningAlgorithm = (typeof PRIVATE_KEY_JWT_SIGNING_ALGORITHMS)[number];
 declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-interface ClientAssertionConfig {
-  /** Pre-signed JWT assertion string. If provided, signing is skipped. */
-  assertion?: string;
+type ClientAssertionGrantType = "authorization_code" | "refresh_token" | "client_credentials";
+interface ClientAssertionContext {
+  clientId: string;
+  tokenEndpoint: string;
+  grantType: ClientAssertionGrantType;
+}
+type ClientAssertionGetter = (context: ClientAssertionContext) => Awaitable<string>;
+interface PrivateKeyJwtClientAssertionGetterOptions {
   /** Private key in JWK format for signing. */
   privateKeyJwk?: JsonWebKey;
   /** Private key in PKCS#8 PEM format for signing. */
@@ -13,19 +19,23 @@ interface ClientAssertionConfig {
   /** Key ID to include in the JWT header. */
   kid?: string;
   /** Asymmetric signing algorithm. Symmetric algorithms (HS256) and "none" are not allowed. @default "RS256" */
-  algorithm?: AssertionSigningAlgorithm;
-  /** Token endpoint URL (used as the JWT `aud` claim). */
-  tokenEndpoint?: string;
+  algorithm?: PrivateKeyJwtSigningAlgorithm;
   /** Assertion lifetime in seconds. @default 120 */
   expiresIn?: number;
 }
 /**
  * Signs an RFC 7523 client assertion JWT for `private_key_jwt` authentication.
  *
- * The JWT contains: iss=clientId, sub=clientId, aud=tokenEndpoint,
- * exp=now+120s, jti=unique, iat=now.
+ * The JWT contains these claims:
+ *
+ * - iss=clientId
+ * - sub=clientId
+ * - aud=tokenEndpoint
+ * - exp=now + 120s
+ * - jti=unique
+ * - iat=now
  */
-declare function signClientAssertion({
+declare function signPrivateKeyJwtClientAssertion({
   clientId,
   tokenEndpoint,
   privateKeyJwk,
@@ -39,21 +49,27 @@ declare function signClientAssertion({
   privateKeyJwk?: JsonWebKey;
   privateKeyPem?: string;
   kid?: string;
-  algorithm?: AssertionSigningAlgorithm;
+  algorithm?: PrivateKeyJwtSigningAlgorithm;
   expiresIn?: number;
 }): Promise<string>;
 /**
- * Resolves a ClientAssertionConfig into `client_assertion` + `client_assertion_type`
- * params for injection into a token request body.
+ * Creates a client assertion getter for `private_key_jwt` authentication.
+ *
+ * Validates options eagerly (key material, supported algorithm, JWK alg
+ * agreement) so misconfiguration surfaces at construction rather than on the
+ * first token request. The returned function signs a fresh RFC 7523 JWT
+ * assertion for every token endpoint request.
  */
-declare function resolveAssertionParams({
-  clientAssertion,
-  clientId,
-  tokenEndpoint
+declare function createPrivateKeyJwtClientAssertionGetter(options: PrivateKeyJwtClientAssertionGetterOptions): ClientAssertionGetter;
+/**
+ * Resolves a client assertion getter into `client_assertion` + `client_assertion_type` params for injection into a token request body.
+ */
+declare function resolveClientAssertionParams({
+  getClientAssertion,
+  context
 }: {
-  clientAssertion: ClientAssertionConfig;
-  clientId: string;
-  tokenEndpoint?: string;
+  getClientAssertion: ClientAssertionGetter;
+  context: ClientAssertionContext;
 }): Promise<Record<string, string>>;
 //#endregion
-export { ASSERTION_SIGNING_ALGORITHMS, AssertionSigningAlgorithm, CLIENT_ASSERTION_TYPE, ClientAssertionConfig, resolveAssertionParams, signClientAssertion };
+export { CLIENT_ASSERTION_TYPE, ClientAssertionContext, ClientAssertionGetter, ClientAssertionGrantType, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, PrivateKeyJwtClientAssertionGetterOptions, PrivateKeyJwtSigningAlgorithm, createPrivateKeyJwtClientAssertionGetter, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion };

package/dist/oauth2/client-assertion.mjs

@@ -1,7 +1,7 @@
 import { SignJWT, importJWK, importPKCS8 } from "jose";
 //#region src/oauth2/client-assertion.ts
 /** Asymmetric signing algorithms compatible with private_key_jwt (RFC 7523). */
-const ASSERTION_SIGNING_ALGORITHMS = [
+const PRIVATE_KEY_JWT_SIGNING_ALGORITHMS = [
 	"RS256",
 	"RS384",
 	"RS512",
@@ -13,20 +13,46 @@ const ASSERTION_SIGNING_ALGORITHMS = [
 	"ES512",
 	"EdDSA"
 ];
+function assertSupportedPrivateKeyJwtAlgorithm(candidate) {
+	if (!PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.includes(candidate)) throw new Error(`Unsupported private_key_jwt signing algorithm: ${candidate}. Use one of ${PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.join(", ")}.`);
+}
+/**
+* Validates `private_key_jwt` options eagerly and returns the algorithm to
+* use for signing.
+*
+* Asserts that key material is configured, that any explicit `algorithm` is
+* supported, that any JWK-embedded `alg` is supported, and that the two
+* agree when both are set.
+*/
+function resolveValidPrivateKeyJwtOptions(options) {
+	if (!options.privateKeyJwk && !options.privateKeyPem) throw new Error("private_key_jwt requires either privateKeyJwk or privateKeyPem");
+	if (options.algorithm) assertSupportedPrivateKeyJwtAlgorithm(options.algorithm);
+	const jwkAlg = options.privateKeyJwk?.alg;
+	if (typeof jwkAlg === "string") assertSupportedPrivateKeyJwtAlgorithm(jwkAlg);
+	if (options.algorithm && typeof jwkAlg === "string" && options.algorithm !== jwkAlg) throw new Error(`JWK alg "${jwkAlg}" does not match configured algorithm "${options.algorithm}". Remove the JWK alg field, or pass an algorithm that matches the JWK.`);
+	return options.algorithm ?? (typeof jwkAlg === "string" ? jwkAlg : "RS256");
+}
 const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
 /**
 * Signs an RFC 7523 client assertion JWT for `private_key_jwt` authentication.
 *
-* The JWT contains: iss=clientId, sub=clientId, aud=tokenEndpoint,
-* exp=now+120s, jti=unique, iat=now.
+* The JWT contains these claims:
+*
+* - iss=clientId
+* - sub=clientId
+* - aud=tokenEndpoint
+* - exp=now + 120s
+* - jti=unique
+* - iat=now
 */
-async function signClientAssertion({ clientId, tokenEndpoint, privateKeyJwk, privateKeyPem, kid, algorithm, expiresIn = 120 }) {
+async function signPrivateKeyJwtClientAssertion({ clientId, tokenEndpoint, privateKeyJwk, privateKeyPem, kid, algorithm, expiresIn = 120 }) {
+	const resolvedAlg = resolveValidPrivateKeyJwtOptions({
+		privateKeyJwk,
+		privateKeyPem,
+		algorithm
+	});
 	const resolvedKid = kid ?? privateKeyJwk?.kid;
-	const resolvedAlg = algorithm ?? privateKeyJwk?.alg ?? "RS256";
-	let key;
-	if (privateKeyJwk) key = await importJWK(privateKeyJwk, resolvedAlg);
-	else if (privateKeyPem) key = await importPKCS8(privateKeyPem, resolvedAlg);
-	else throw new Error("private_key_jwt requires either privateKeyJwk or privateKeyPem");
+	const key = privateKeyJwk ? await importJWK(privateKeyJwk, resolvedAlg) : await importPKCS8(privateKeyPem, resolvedAlg);
 	const now = Math.floor(Date.now() / 1e3);
 	const jti = crypto.randomUUID();
 	const header = {
@@ -37,28 +63,37 @@ async function signClientAssertion({ clientId, tokenEndpoint, privateKeyJwk, pri
 	return new SignJWT({}).setProtectedHeader(header).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setIssuedAt(now).setExpirationTime(now + expiresIn).setJti(jti).sign(key);
 }
 /**
-* Resolves a ClientAssertionConfig into `client_assertion` + `client_assertion_type`
-* params for injection into a token request body.
+* Creates a client assertion getter for `private_key_jwt` authentication.
+*
+* Validates options eagerly (key material, supported algorithm, JWK alg
+* agreement) so misconfiguration surfaces at construction rather than on the
+* first token request. The returned function signs a fresh RFC 7523 JWT
+* assertion for every token endpoint request.
+*/
+function createPrivateKeyJwtClientAssertionGetter(options) {
+	resolveValidPrivateKeyJwtOptions({
+		privateKeyJwk: options.privateKeyJwk,
+		privateKeyPem: options.privateKeyPem,
+		algorithm: options.algorithm
+	});
+	return ({ clientId, tokenEndpoint }) => signPrivateKeyJwtClientAssertion({
+		clientId,
+		tokenEndpoint,
+		privateKeyJwk: options.privateKeyJwk,
+		privateKeyPem: options.privateKeyPem,
+		kid: options.kid,
+		algorithm: options.algorithm,
+		expiresIn: options.expiresIn
+	});
+}
+/**
+* Resolves a client assertion getter into `client_assertion` + `client_assertion_type` params for injection into a token request body.
 */
-async function resolveAssertionParams({ clientAssertion, clientId, tokenEndpoint }) {
-	let assertion = clientAssertion.assertion;
-	if (!assertion) {
-		const audEndpoint = tokenEndpoint ?? clientAssertion.tokenEndpoint;
-		if (!audEndpoint) throw new Error("private_key_jwt requires a tokenEndpoint for the JWT audience claim");
-		assertion = await signClientAssertion({
-			clientId,
-			tokenEndpoint: audEndpoint,
-			privateKeyJwk: clientAssertion.privateKeyJwk,
-			privateKeyPem: clientAssertion.privateKeyPem,
-			kid: clientAssertion.kid,
-			algorithm: clientAssertion.algorithm,
-			expiresIn: clientAssertion.expiresIn
-		});
-	}
+async function resolveClientAssertionParams({ getClientAssertion, context }) {
 	return {
-		client_assertion: assertion,
+		client_assertion: await getClientAssertion(context),
 		client_assertion_type: CLIENT_ASSERTION_TYPE
 	};
 }
 //#endregion
-export { ASSERTION_SIGNING_ALGORITHMS, CLIENT_ASSERTION_TYPE, resolveAssertionParams, signClientAssertion };
+export { CLIENT_ASSERTION_TYPE, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, createPrivateKeyJwtClientAssertionGetter, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion };

package/dist/oauth2/client-credentials-token.d.mts

@@ -1,59 +1,38 @@
-import { ClientAssertionConfig } from "./client-assertion.mjs";
 import { AwaitableFunction } from "../types/helper.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
+import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
 
 //#region src/oauth2/client-credentials-token.d.ts
-declare function clientCredentialsTokenRequest({
-  options,
-  scope,
-  authentication,
-  clientAssertion,
-  tokenEndpoint,
-  resource
-}: {
+interface ClientCredentialsTokenRequestInput {
   options: AwaitableFunction<ProviderOptions>;
   scope?: string | undefined;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  clientAssertion?: ClientAssertionConfig | undefined; /** Token endpoint URL. Used as the JWT `aud` claim when signing assertions. */
+  authentication?: TokenEndpointSecretAuthentication | undefined;
+  tokenEndpointAuth?: TokenEndpointAuth | undefined;
   tokenEndpoint?: string | undefined;
   resource?: (string | string[]) | undefined;
-}): Promise<{
-  body: URLSearchParams;
-  headers: Record<string, any>;
-}>;
-/**
- * @deprecated use async'd clientCredentialsTokenRequest instead
- */
-declare function createClientCredentialsTokenRequest({
+}
+interface ClientCredentialsTokenInput extends ClientCredentialsTokenRequestInput {
+  tokenEndpoint: string;
+  scope: string;
+}
+declare function clientCredentialsTokenRequest({
   options,
   scope,
   authentication,
-  resource,
-  extraParams
-}: {
-  options: ProviderOptions;
-  scope?: string | undefined;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  resource?: (string | string[]) | undefined;
-  extraParams?: Record<string, string> | undefined;
-}): {
+  tokenEndpointAuth,
+  tokenEndpoint,
+  resource
+}: ClientCredentialsTokenRequestInput): Promise<{
   body: URLSearchParams;
-  headers: Record<string, any>;
-};
+  headers: Record<string, string>;
+}>;
 declare function clientCredentialsToken({
   options,
   tokenEndpoint,
   scope,
   authentication,
-  clientAssertion,
+  tokenEndpointAuth,
   resource
-}: {
-  options: AwaitableFunction<ProviderOptions>;
-  tokenEndpoint: string;
-  scope: string;
-  authentication?: ("basic" | "post" | "private_key_jwt") | undefined;
-  clientAssertion?: ClientAssertionConfig | undefined;
-  resource?: (string | string[]) | undefined;
-}): Promise<OAuth2Tokens>;
+}: ClientCredentialsTokenInput): Promise<OAuth2Tokens>;
 //#endregion
-export { clientCredentialsToken, clientCredentialsTokenRequest, createClientCredentialsTokenRequest };
+export { clientCredentialsToken, clientCredentialsTokenRequest };

package/dist/oauth2/client-credentials-token.mjs

@@ -1,30 +1,25 @@
-import { resolveAssertionParams } from "./client-assertion.mjs";
-import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
+import { applyTokenEndpointAuth } from "./token-endpoint-auth.mjs";
 //#region src/oauth2/client-credentials-token.ts
-async function clientCredentialsTokenRequest({ options, scope, authentication, clientAssertion, tokenEndpoint, resource }) {
+async function clientCredentialsTokenRequest({ options, scope, authentication, tokenEndpointAuth, tokenEndpoint, resource }) {
 	options = typeof options === "function" ? await options() : options;
-	let extraParams;
-	if (authentication === "private_key_jwt") {
-		if (!clientAssertion) throw new Error("private_key_jwt authentication requires a clientAssertion configuration");
-		extraParams = await resolveAssertionParams({
-			clientAssertion,
-			clientId: Array.isArray(options.clientId) ? options.clientId[0] : options.clientId,
-			tokenEndpoint
-		});
-	}
-	return createClientCredentialsTokenRequest({
+	const request = buildClientCredentialsTokenRequest({
 		options,
 		scope,
-		authentication,
-		resource,
-		extraParams
+		resource
 	});
+	await applyTokenEndpointAuth({
+		body: request.body,
+		headers: request.headers,
+		options,
+		tokenEndpoint: tokenEndpoint ?? "",
+		grantType: "client_credentials",
+		tokenEndpointAuth,
+		authentication
+	});
+	return request;
 }
-/**
-* @deprecated use async'd clientCredentialsTokenRequest instead
-*/
-function createClientCredentialsTokenRequest({ options, scope, authentication, resource, extraParams }) {
+function buildClientCredentialsTokenRequest({ options, scope, resource, extraParams }) {
 	const body = new URLSearchParams();
 	const headers = {
 		"content-type": "application/x-www-form-urlencoded",
@@ -34,12 +29,6 @@ function createClientCredentialsTokenRequest({ options, scope, authentication, r
 	scope && body.set("scope", scope);
 	if (resource) if (typeof resource === "string") body.append("resource", resource);
 	else for (const _resource of resource) body.append("resource", _resource);
-	const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
-	if (authentication === "basic") headers["authorization"] = `Basic ${base64.encode(`${primaryClientId}:${options.clientSecret ?? ""}`)}`;
-	else {
-		body.set("client_id", primaryClientId);
-		if (authentication !== "private_key_jwt" && options.clientSecret) body.set("client_secret", options.clientSecret);
-	}
 	if (extraParams) {
 		for (const [key, value] of Object.entries(extraParams)) if (!body.has(key)) body.append(key, value);
 	}
@@ -48,16 +37,16 @@ function createClientCredentialsTokenRequest({ options, scope, authentication, r
 		headers
 	};
 }
-async function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, clientAssertion, resource }) {
+async function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, tokenEndpointAuth, resource }) {
 	const { body, headers } = await clientCredentialsTokenRequest({
 		options,
 		scope,
 		authentication,
-		clientAssertion,
+		tokenEndpointAuth,
 		tokenEndpoint,
 		resource
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers
@@ -75,4 +64,4 @@ async function clientCredentialsToken({ options, tokenEndpoint, scope, authentic
 	return tokens;
 }
 //#endregion
-export { clientCredentialsToken, clientCredentialsTokenRequest, createClientCredentialsTokenRequest };
+export { clientCredentialsToken, clientCredentialsTokenRequest };

package/dist/oauth2/create-authorization-url.d.mts

@@ -1,6 +1,14 @@
 import { AwaitableFunction } from "../types/helper.mjs";
 import { ProviderOptions } from "./oauth-provider.mjs";
 //#region src/oauth2/create-authorization-url.d.ts
+/**
+ * Query-parameter names that are populated by the framework as part of the
+ * authorization request and must not be overridden by caller-supplied
+ * `additionalParams`. Overriding `state`, PKCE, or `redirect_uri` would
+ * break the callback correlation and session pinning guarantees.
+ */
+declare const RESERVED_AUTHORIZATION_PARAMS: readonly ["state", "client_id", "redirect_uri", "response_type", "code_challenge", "code_challenge_method", "nonce", "scope"];
+declare const RESERVED_AUTHORIZATION_PARAMS_SET: ReadonlySet<string>;
 declare function createAuthorizationURL({
   id,
   options,
@@ -16,6 +24,7 @@ declare function createAuthorizationURL({
   responseType,
   display,
   loginHint,
+  nonce,
   hd,
   responseMode,
   additionalParams,
@@ -35,10 +44,11 @@ declare function createAuthorizationURL({
   responseType?: string | undefined;
   display?: string | undefined;
   loginHint?: string | undefined;
+  nonce?: string | undefined;
   hd?: string | undefined;
   responseMode?: string | undefined;
   additionalParams?: Record<string, string> | undefined;
   scopeJoiner?: string | undefined;
 }): Promise<URL>;
 //#endregion
-export { createAuthorizationURL };
+export { RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, createAuthorizationURL };

package/dist/oauth2/create-authorization-url.mjs

@@ -1,17 +1,36 @@
-import { generateCodeChallenge } from "./utils.mjs";
+import { generateCodeChallenge, getPrimaryClientId } from "./utils.mjs";
 //#region src/oauth2/create-authorization-url.ts
-async function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, hd, responseMode, additionalParams, scopeJoiner }) {
+/**
+* Query-parameter names that are populated by the framework as part of the
+* authorization request and must not be overridden by caller-supplied
+* `additionalParams`. Overriding `state`, PKCE, or `redirect_uri` would
+* break the callback correlation and session pinning guarantees.
+*/
+const RESERVED_AUTHORIZATION_PARAMS = [
+	"state",
+	"client_id",
+	"redirect_uri",
+	"response_type",
+	"code_challenge",
+	"code_challenge_method",
+	"nonce",
+	"scope"
+];
+const RESERVED_AUTHORIZATION_PARAMS_SET = new Set(RESERVED_AUTHORIZATION_PARAMS);
+async function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, nonce, hd, responseMode, additionalParams, scopeJoiner }) {
 	options = typeof options === "function" ? await options() : options;
 	const url = new URL(options.authorizationEndpoint || authorizationEndpoint);
 	url.searchParams.set("response_type", responseType || "code");
-	const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+	const primaryClientId = getPrimaryClientId(options.clientId);
+	if (!primaryClientId) throw new Error("OAuth provider requires clientId");
 	url.searchParams.set("client_id", primaryClientId);
 	url.searchParams.set("state", state);
-	if (scopes) url.searchParams.set("scope", scopes.join(scopeJoiner || " "));
+	if (scopes?.length) url.searchParams.set("scope", scopes.join(scopeJoiner || " "));
 	url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
 	duration && url.searchParams.set("duration", duration);
 	display && url.searchParams.set("display", display);
 	loginHint && url.searchParams.set("login_hint", loginHint);
+	nonce && url.searchParams.set("nonce", nonce);
 	prompt && url.searchParams.set("prompt", prompt);
 	hd && url.searchParams.set("hd", hd);
 	accessType && url.searchParams.set("access_type", accessType);
@@ -32,10 +51,11 @@ async function createAuthorizationURL({ id, options, authorizationEndpoint, stat
 			...claimsObj
 		} }));
 	}
-	if (additionalParams) Object.entries(additionalParams).forEach(([key, value]) => {
+	if (additionalParams) for (const [key, value] of Object.entries(additionalParams)) {
+		if (RESERVED_AUTHORIZATION_PARAMS_SET.has(key)) continue;
 		url.searchParams.set(key, value);
-	});
+	}
 	return url;
 }
 //#endregion
-export { createAuthorizationURL };
+export { RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, createAuthorizationURL };