@better-auth/core 1.7.0-beta.4 → 1.7.0-beta.6

package/dist/social-providers/github.mjs

@@ -1,24 +1,24 @@
 import { logger } from "../env/logger.mjs";
+import { resolveRequestedScopes } from "../oauth2/scopes.mjs";
 import { getOAuth2Tokens } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { authorizationCodeRequest } from "../oauth2/validate-authorization-code.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/github.ts
+const GITHUB_DEFAULT_SCOPES = ["read:user", "user:email"];
 const github = (options) => {
 	const tokenEndpoint = "https://github.com/login/oauth/access_token";
 	return {
 		id: "github",
 		name: "GitHub",
+		callbackPath: "/callback/github",
 		createAuthorizationURL({ state, scopes, loginHint, codeVerifier, redirectURI, additionalParams }) {
-			const _scopes = options.disableDefaultScope ? [] : ["read:user", "user:email"];
-			if (options.scope) _scopes.push(...options.scope);
-			if (scopes) _scopes.push(...scopes);
 			return createAuthorizationURL({
 				id: "github",
 				options,
 				authorizationEndpoint: "https://github.com/login/oauth/authorize",
-				scopes: _scopes,
+				scopes: resolveRequestedScopes(options, GITHUB_DEFAULT_SCOPES, scopes),
 				state,
 				codeVerifier,
 				redirectURI,

package/dist/social-providers/gitlab.d.mts

@@ -52,6 +52,7 @@ interface GitlabOptions extends ProviderOptions<GitlabProfile> {
 declare const gitlab: (options: GitlabOptions) => {
   id: "gitlab";
   name: string;
+  callbackPath: string;
   createAuthorizationURL: ({
     state,
     scopes,
@@ -67,7 +68,10 @@ declare const gitlab: (options: GitlabOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
-  }) => Promise<URL>;
+  }) => Promise<{
+    url: URL;
+    requestedScopes: string[];
+  }>;
   validateAuthorizationCode: ({
     code,
     redirectURI,

package/dist/social-providers/gitlab.mjs

@@ -1,3 +1,4 @@
+import { resolveRequestedScopes } from "../oauth2/scopes.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
@@ -14,21 +15,20 @@ const issuerToEndpoints = (issuer) => {
 		userinfoEndpoint: cleanDoubleSlashes(`${baseUrl}/api/v4/user`)
 	};
 };
+const GITLAB_DEFAULT_SCOPES = ["read_user"];
 const gitlab = (options) => {
 	const { authorizationEndpoint, tokenEndpoint, userinfoEndpoint } = issuerToEndpoints(options.issuer);
 	const issuerId = "gitlab";
 	return {
 		id: issuerId,
 		name: "Gitlab",
-		createAuthorizationURL: async ({ state, scopes, codeVerifier, loginHint, redirectURI, additionalParams }) => {
-			const _scopes = options.disableDefaultScope ? [] : ["read_user"];
-			if (options.scope) _scopes.push(...options.scope);
-			if (scopes) _scopes.push(...scopes);
-			return await createAuthorizationURL({
+		callbackPath: "/callback/gitlab",
+		createAuthorizationURL: ({ state, scopes, codeVerifier, loginHint, redirectURI, additionalParams }) => {
+			return createAuthorizationURL({
 				id: issuerId,
 				options,
 				authorizationEndpoint,
-				scopes: _scopes,
+				scopes: resolveRequestedScopes(options, GITLAB_DEFAULT_SCOPES, scopes),
 				state,
 				redirectURI,
 				codeVerifier,

package/dist/social-providers/google.d.mts

@@ -1,4 +1,6 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import * as jose from "jose";
+
 //#region src/social-providers/google.d.ts
 interface GoogleProfile {
   aud: string;
@@ -37,13 +39,28 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    */
   display?: ("page" | "popup" | "touch" | "wap") | undefined;
   /**
-   * The hosted domain of the user
+   * The hosted domain (Google Workspace) the user must belong to.
+   *
+   * This is sent to Google as the `hd` authorization hint and, when set, is
+   * also enforced against the `hd` claim of the returned id token/profile.
+   * Sign-in is rejected when the claim is missing or does not match, so this
+   * can be used to restrict sign-in to a Workspace domain.
    */
   hd?: string | undefined;
+  /**
+   * Enable incremental authorization via Google's `include_granted_scopes`
+   * parameter. When enabled, Google reports the user's full granted scope set
+   * in the token response.
+   *
+   * @default true
+   */
+  includeGrantedScopes?: boolean | undefined;
 }
 declare const google: (options: GoogleOptions) => {
   id: "google";
   name: string;
+  callbackPath: string;
+  grantAuthority: "full-grant" | "projection";
   createAuthorizationURL({
     state,
     scopes,
@@ -60,7 +77,10 @@ declare const google: (options: GoogleOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
-  }): Promise<URL>;
+  }): Promise<{
+    url: URL;
+    requestedScopes: string[];
+  }>;
   validateAuthorizationCode: ({
     code,
     codeVerifier,
@@ -72,7 +92,13 @@ declare const google: (options: GoogleOptions) => {
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  idToken: {
+    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    issuer: string[];
+    audience: string | string[];
+    maxTokenAge: string;
+    verifyClaims: ((claims: Record<string, unknown>) => boolean) | undefined;
+  };
   getUserInfo(token: OAuth2Tokens & {
     user?: {
       name?: {

package/dist/social-providers/google.mjs

@@ -1,34 +1,35 @@
 import { APIError, BetterAuthError } from "../error/index.mjs";
 import { logger } from "../env/logger.mjs";
+import { resolveRequestedScopes } from "../oauth2/scopes.mjs";
 import { getPrimaryClientId } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
-import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+import { decodeJwt, importJWK } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/google.ts
+const GOOGLE_DEFAULT_SCOPES = [
+	"email",
+	"profile",
+	"openid"
+];
 const google = (options) => {
 	return {
 		id: "google",
 		name: "Google",
+		callbackPath: "/callback/google",
+		grantAuthority: options.includeGrantedScopes !== false ? "full-grant" : "projection",
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, display, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client Id and Client Secret is required for Google. Make sure to provide them in the options.");
 				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
 			}
 			if (!codeVerifier) throw new BetterAuthError("codeVerifier is required for Google");
-			const _scopes = options.disableDefaultScope ? [] : [
-				"email",
-				"profile",
-				"openid"
-			];
-			if (options.scope) _scopes.push(...options.scope);
-			if (scopes) _scopes.push(...scopes);
-			return await createAuthorizationURL({
+			return createAuthorizationURL({
 				id: "google",
 				options,
 				authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
-				scopes: _scopes,
+				scopes: resolveRequestedScopes(options, GOOGLE_DEFAULT_SCOPES, scopes),
 				state,
 				codeVerifier,
 				redirectURI,
@@ -37,9 +38,9 @@ const google = (options) => {
 				display: display || options.display,
 				loginHint,
 				hd: options.hd,
-				additionalParams: {
-					include_granted_scopes: "true",
-					...additionalParams ?? {}
+				additionalParams: options.includeGrantedScopes === false ? { ...additionalParams ?? {} } : {
+					...additionalParams ?? {},
+					include_granted_scopes: "true"
 				}
 			});
 		},
@@ -63,28 +64,21 @@ const google = (options) => {
 				tokenEndpoint: "https://oauth2.googleapis.com/token"
 			});
 		},
-		async verifyIdToken(token, nonce) {
-			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
-			try {
-				const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
-				if (!kid || !jwtAlg) return false;
-				const { payload: jwtClaims } = await jwtVerify(token, await getGooglePublicKey(kid), {
-					algorithms: [jwtAlg],
-					issuer: ["https://accounts.google.com", "accounts.google.com"],
-					audience: options.clientId,
-					maxTokenAge: "1h"
-				});
-				if (nonce && jwtClaims.nonce !== nonce) return false;
-				return true;
-			} catch {
-				return false;
-			}
+		idToken: {
+			jwks: (header) => getGooglePublicKey(header.kid),
+			issuer: ["https://accounts.google.com", "accounts.google.com"],
+			audience: options.clientId,
+			maxTokenAge: "1h",
+			verifyClaims: options.hd ? (claims) => claims.hd === options.hd : void 0
 		},
 		async getUserInfo(token) {
 			if (options.getUserInfo) return options.getUserInfo(token);
 			if (!token.idToken) return null;
 			const user = decodeJwt(token.idToken);
+			if (options.hd && user.hd !== options.hd) {
+				logger.error(`Google sign-in rejected: id token hosted domain (hd) "${user.hd ?? "<missing>"}" does not match the configured "hd" option "${options.hd}".`);
+				return null;
+			}
 			const userMap = await options.mapProfileToUser?.(user);
 			return {
 				user: {

package/dist/social-providers/huggingface.d.mts

@@ -34,6 +34,7 @@ interface HuggingFaceOptions extends ProviderOptions<HuggingFaceProfile> {
 declare const huggingface: (options: HuggingFaceOptions) => {
   id: "huggingface";
   name: string;
+  callbackPath: string;
   createAuthorizationURL({
     state,
     scopes,
@@ -48,7 +49,10 @@ declare const huggingface: (options: HuggingFaceOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
-  }): Promise<URL>;
+  }): Promise<{
+    url: URL;
+    requestedScopes: string[];
+  }>;
   validateAuthorizationCode: ({
     code,
     codeVerifier,

package/dist/social-providers/huggingface.mjs

@@ -1,26 +1,26 @@
+import { resolveRequestedScopes } from "../oauth2/scopes.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/huggingface.ts
+const HUGGINGFACE_DEFAULT_SCOPES = [
+	"openid",
+	"profile",
+	"email"
+];
 const huggingface = (options) => {
 	const tokenEndpoint = "https://huggingface.co/oauth/token";
 	return {
 		id: "huggingface",
 		name: "Hugging Face",
+		callbackPath: "/callback/huggingface",
 		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
-			const _scopes = options.disableDefaultScope ? [] : [
-				"openid",
-				"profile",
-				"email"
-			];
-			if (options.scope) _scopes.push(...options.scope);
-			if (scopes) _scopes.push(...scopes);
 			return createAuthorizationURL({
 				id: "huggingface",
 				options,
 				authorizationEndpoint: "https://huggingface.co/oauth/authorize",
-				scopes: _scopes,
+				scopes: resolveRequestedScopes(options, HUGGINGFACE_DEFAULT_SCOPES, scopes),
 				state,
 				codeVerifier,
 				redirectURI,