@better-auth/core 1.7.0-rc.1 → 1.7.0-rc.3

package/dist/oauth2/utils.mjs

@@ -16,8 +16,7 @@ function parseScopeField(scope) {
 }
 function getOAuth2Tokens(data) {
 	const getDate = (seconds) => {
-		const now = /* @__PURE__ */ new Date();
-		return new Date(now.getTime() + seconds * 1e3);
+		return new Date((/* @__PURE__ */ new Date()).getTime() + seconds * 1e3);
 	};
 	return {
 		tokenType: data.token_type,
@@ -48,7 +47,7 @@ function applyDefaultAccessTokenExpiry(tokens, accessTokenExpiresIn) {
 function mergeScopes(stored, incoming) {
 	const existing = stored ? stored.split(",").map((scope) => scope.trim()).filter(Boolean) : [];
 	const next = (incoming ?? []).map((scope) => scope.trim()).filter(Boolean);
-	return [...new Set([...existing, ...next])].join(",");
+	return [.../* @__PURE__ */ new Set([...existing, ...next])].join(",");
 }
 /**
 * Return the provider's primary Client ID: the single string, or the entry at

package/dist/oauth2/validate-authorization-code.d.mts

@@ -1,8 +1,8 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
 import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
-import * as jose from "jose";
-
+import "./index.mjs";
 //#region src/oauth2/validate-authorization-code.d.ts
 interface AuthorizationCodeRequestInput {
   code: string;
@@ -20,38 +20,14 @@ interface AuthorizationCodeRequestInput {
 interface ValidateAuthorizationCodeInput extends AuthorizationCodeRequestInput {
   tokenEndpoint: string;
 }
-declare function authorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  tokenEndpointAuth,
-  tokenEndpoint,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: AuthorizationCodeRequestInput): Promise<{
+declare function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, tokenEndpointAuth, tokenEndpoint, deviceId, headers, additionalParams, resource }: AuthorizationCodeRequestInput): Promise<{
   body: URLSearchParams;
   headers: Record<string, string>;
 }>;
-declare function validateAuthorizationCode({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  tokenEndpoint,
-  authentication,
-  tokenEndpointAuth,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: ValidateAuthorizationCodeInput): Promise<OAuth2Tokens>;
+declare function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, tokenEndpointAuth, deviceId, headers, additionalParams, resource }: ValidateAuthorizationCodeInput): Promise<OAuth2Tokens>;
 declare function validateToken(token: string, jwksEndpoint: string, options?: {
   audience?: string | string[];
   issuer?: string | string[];
-}): Promise<jose.JWTVerifyResult<jose.JWTPayload> & jose.ResolvedKey>;
+}): Promise<import("jose").JWTVerifyResult<import("jose").JWTPayload> & import("jose").ResolvedKey>;
 //#endregion
 export { authorizationCodeRequest, validateAuthorizationCode, validateToken };

package/dist/oauth2/verify-id-token.d.mts

@@ -1,5 +1,6 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuthProvider } from "./oauth-provider.mjs";
-
 //#region src/oauth2/verify-id-token.d.ts
 type ProviderWithIdTokenConfig = Pick<OAuthProvider, "idToken" | "options">;
 /**
@@ -22,6 +23,6 @@ declare function supportsIdTokenSignIn(provider: ProviderWithIdTokenConfig): boo
  *
  * @returns `true` only when the token is authentic for the provider.
  */
-declare function verifyProviderIdToken(provider: ProviderWithIdTokenConfig, token: string, nonce?: string): Promise<boolean>;
+declare function verifyProviderIdToken(provider: ProviderWithIdTokenConfig, token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
 //#endregion
 export { supportsIdTokenSignIn, verifyProviderIdToken };

package/dist/oauth2/verify-id-token.mjs

@@ -35,14 +35,14 @@ function supportsIdTokenSignIn(provider) {
 *
 * @returns `true` only when the token is authentic for the provider.
 */
-async function verifyProviderIdToken(provider, token, nonce) {
+async function verifyProviderIdToken(provider, token, nonce, ctx) {
 	const options = provider.options ?? {};
 	if (options.disableIdTokenSignIn) return false;
 	try {
-		if (options.verifyIdToken) return await options.verifyIdToken(token, nonce);
+		if (options.verifyIdToken) return await options.verifyIdToken(token, nonce, ctx);
 		const config = provider.idToken;
 		if (!config) return false;
-		if ("verify" in config) return await config.verify(token, nonce);
+		if ("verify" in config) return await config.verify(token, nonce, ctx);
 		if (token.split(".").length !== 3) return config.allowOpaqueToken === true;
 		const { alg } = decodeProtectedHeader(token);
 		const { payload } = await jwtVerify(token, config.jwks, {

package/dist/oauth2/verify.d.mts

@@ -1,9 +1,10 @@
 import { DpopReplayStore } from "./dpop.mjs";
+import { APIError } from "better-call";
 import { JSONWebKeySet, JWTPayload, JWTVerifyOptions } from "jose";
-
 //#region src/oauth2/verify.d.ts
 type JwksFetchOptions = {
-  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
+  /** Jwks url or promise of a Jwks */
+  jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
   /**
    * Stable object to cache the result of a function `jwksFetch` under,
    * with the same TTL and kid-miss refetch rules as string sources.
@@ -11,9 +12,6 @@ type JwksFetchOptions = {
    */
   jwksCacheKey?: object;
 };
-/**
- * @internal
- */
 interface VerifyAccessTokenRemote {
   /** Full url of the introspect endpoint. Should end with `/oauth2/introspect` */
   introspectUrl: string;
@@ -45,8 +43,13 @@ interface VerifyAccessTokenRemote {
 interface VerifyAccessTokenOptions {
   /** Verify options */
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
-  /** Scopes to additionally verify. Token must include all but not exact. */
-  scopes?: string[];
+  /** Scopes the token must satisfy. */
+  requiredScopes?: readonly string[];
+  /**
+   * Determines whether a required scope is satisfied by the granted scope
+   * set. Defaults to exact set membership.
+   */
+  isScopeSatisfied?: (requiredScope: string, grantedScopes: ReadonlySet<string>) => boolean;
   /** Required to verify access token locally */
   jwksUrl?: string;
   /** If provided, can verify a token remotely */
@@ -87,9 +90,15 @@ declare function requestToResourceInput(request: Request): ResourceRequestInput;
  * Can also be configured for remote verification.
  */
 declare function verifyJwsAccessToken(token: string, opts: JwksFetchOptions & {
-  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+  /** Verify options */
+  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
 }): Promise<JWTPayload>;
 declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWebKeySet>;
+declare function createInsufficientScopeError(requiredScopes: readonly string[], description?: string): APIError;
+/**
+ * Returns whether an error is a typed RFC 6750 insufficient-scope failure.
+ */
+declare function isInsufficientScopeError(error: unknown): error is APIError;
 /**
  * Performs local verification of a bearer access token for your API.
  *
@@ -112,4 +121,4 @@ declare function verifyBearerToken(token: string, opts: VerifyAccessTokenOptions
  */
 declare function verifyAccessTokenRequest(request: ResourceRequestInput, opts: VerifyAccessTokenRequestOptions): Promise<JWTPayload>;
 //#endregion
-export { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRequestOptions, getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };
+export { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRemote, VerifyAccessTokenRequestOptions, createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };

package/dist/oauth2/verify.mjs

@@ -4,7 +4,7 @@ import { createInMemoryDpopReplayStore, enforceDpopBinding, getDpopJktFromPayloa
 import { APIError } from "better-call";
 import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 //#region src/oauth2/verify.ts
-const joseInfrastructureErrorCodes = new Set([
+const joseInfrastructureErrorCodes = /* @__PURE__ */ new Set([
 	errors.JWKSTimeout.code,
 	errors.JWKSInvalid.code,
 	errors.JWKSMultipleMatchingKeys.code
@@ -207,12 +207,73 @@ async function verifyAccessTokenPayload(token, opts) {
 		}
 	}
 	if (!payload) throw new APIError("UNAUTHORIZED", { message: `no token payload` });
-	if (opts.scopes) {
-		const validScopes = new Set(payload.scope?.split(" "));
-		for (const sc of opts.scopes) if (!validScopes.has(sc)) throw new APIError("FORBIDDEN", { message: `invalid scope ${sc}` });
+	const grantedScopes = parseGrantedScopes(payload.scope);
+	if (opts.requiredScopes) {
+		const isScopeSatisfied = opts.isScopeSatisfied ?? ((requiredScope, scopes) => scopes.has(requiredScope));
+		const missingScopes = opts.requiredScopes.filter((scope) => !isScopeSatisfied(scope, grantedScopes));
+		if (missingScopes.length > 0) throw createInsufficientScopeError(missingScopes);
 	}
 	return payload;
 }
+/**
+* Build the RFC 6750 §3.1 insufficient-scope failure: the access token is valid
+* but lacks scopes the operation needs.
+*
+* Resource-server challenge builders turn this into a `403` carrying a
+* `WWW-Authenticate: Bearer error="insufficient_scope"` challenge that names
+* `scopes`, so the client knows what to request when it re-authorizes. Throw it
+* from a route handler to challenge for scopes only that operation needs; a
+* plain `FORBIDDEN` stays a plain `403`, since a permission denial the client
+* cannot fix by re-authorizing must not send the user through consent again.
+*
+* @param requiredScopes - Every scope the operation requires but the token lacks.
+* @param description - RFC 6750 `error_description` text. It must use the
+* printable ASCII character set allowed by the specification.
+*/
+const OAUTH_SCOPE_TOKEN_PATTERN = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+const OAUTH_ERROR_DESCRIPTION_PATTERN = /^[\x20-\x21\x23-\x5b\x5d-\x7e]+$/;
+const insufficientScopeErrors = /* @__PURE__ */ new WeakSet();
+function isOAuthScopeToken(value) {
+	return OAUTH_SCOPE_TOKEN_PATTERN.test(value);
+}
+function validateScopeTokens(scopes, label) {
+	for (const scope of scopes) if (!isOAuthScopeToken(scope)) throw new TypeError(`invalid ${label}: ${JSON.stringify(scope)}`);
+}
+function validateRequiredScopes(opts) {
+	if (opts.requiredScopes) validateScopeTokens(opts.requiredScopes, "required scope");
+}
+function parseGrantedScopes(scope) {
+	if (scope === void 0) return /* @__PURE__ */ new Set();
+	if (typeof scope !== "string" || scope.length === 0 || scope.split(" ").some((token) => !isOAuthScopeToken(token))) throw new APIError("UNAUTHORIZED", {
+		message: "access token scope claim is invalid",
+		error: "invalid_token",
+		error_description: "access token scope claim is invalid"
+	});
+	return new Set(scope.split(" "));
+}
+function createInsufficientScopeError(requiredScopes, description = `access token is missing required scope: ${requiredScopes.join(" ")}`) {
+	if (requiredScopes.length === 0) throw new TypeError("requiredScopes must contain at least one scope");
+	validateScopeTokens(requiredScopes, "required scope");
+	if (typeof description !== "string" || !OAUTH_ERROR_DESCRIPTION_PATTERN.test(description)) throw new TypeError("invalid error_description");
+	const error = new APIError("FORBIDDEN", {
+		message: description,
+		error: "insufficient_scope",
+		error_description: description,
+		scope: [...new Set(requiredScopes)].join(" ")
+	});
+	insufficientScopeErrors.add(error);
+	return error;
+}
+/**
+* Returns whether an error is a typed RFC 6750 insufficient-scope failure.
+*/
+function isInsufficientScopeError(error) {
+	if (!(error instanceof APIError) || !insufficientScopeErrors.has(error) || error.status !== "FORBIDDEN") return false;
+	const body = error.body;
+	if (body?.error !== "insufficient_scope" || typeof body.scope !== "string") return false;
+	const scopes = body.scope.split(" ");
+	return scopes.length > 0 && scopes.every(isOAuthScopeToken);
+}
 function throwDpopUnauthorized(message, error) {
 	throw new APIError("UNAUTHORIZED", error ? {
 		message,
@@ -231,6 +292,7 @@ function throwDpopUnauthorized(message, error) {
 * alone.
 */
 async function verifyBearerToken(token, opts) {
+	validateRequiredScopes(opts);
 	const payload = await verifyAccessTokenPayload(token, opts);
 	if (getDpopJktFromPayload(payload)) throwDpopUnauthorized("DPoP-bound access token requires verifyAccessTokenRequest", "invalid_token");
 	return payload;
@@ -245,6 +307,7 @@ async function verifyBearerToken(token, opts) {
 * scheme, method, URL, DPoP proof, `ath`, and `cnf.jkt` binding.
 */
 async function verifyAccessTokenRequest(request, opts) {
+	validateRequiredScopes(opts);
 	const authorization = parseAccessTokenAuthorization(request.authorizationHeader);
 	if (!authorization?.token) throwDpopUnauthorized("missing authorization header");
 	if (authorization.scheme === "Unknown") throwDpopUnauthorized("authorization scheme must be Bearer or DPoP", "invalid_token");
@@ -267,4 +330,4 @@ async function verifyAccessTokenRequest(request, opts) {
 	return payload;
 }
 //#endregion
-export { getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };
+export { createInsufficientScopeError, getJwks, isInsufficientScopeError, jwksCache, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };

package/dist/social-providers/apple.d.mts

@@ -1,6 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
-import * as jose from "jose";
-
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/apple.d.ts
 interface AppleProfile {
   /**
@@ -69,12 +68,9 @@ interface AppleOptions extends ProviderOptions<AppleProfile> {
 declare const apple: (options: AppleOptions) => {
   id: "apple";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<AppleProfile>) => string;
+  accountIssuer: string;
+  createAuthorizationURL({ state, scopes, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -84,18 +80,14 @@ declare const apple: (options: AppleOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
   idToken: {
-    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    jwks: (header: import("jose").JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
     issuer: string;
     audience: string | string[];
     maxTokenAge: string;
@@ -112,15 +104,8 @@ declare const apple: (options: AppleOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: AppleProfile;
   } | null>;
   options: AppleOptions;
 };

package/dist/social-providers/apple.mjs

@@ -12,6 +12,8 @@ const apple = (options) => {
 	return {
 		id: "apple",
 		name: "Apple",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: "https://appleid.apple.com",
 		async createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client ID and client secret are required for Apple. Make sure to provide them in the options.");
@@ -71,7 +73,6 @@ const apple = (options) => {
 			const userMap = await options.mapProfileToUser?.(enrichedProfile);
 			return {
 				user: {
-					id: profile.sub,
 					name: enrichedProfile.name,
 					emailVerified,
 					email: profile.email,

package/dist/social-providers/atlassian.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/atlassian.d.ts
 interface AtlassianProfile {
   account_type?: string | undefined;
@@ -21,13 +22,8 @@ interface AtlassianOptions extends ProviderOptions<AtlassianProfile> {
 declare const atlassian: (options: AtlassianOptions) => {
   id: "atlassian";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<AtlassianProfile>) => string;
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -37,11 +33,7 @@ declare const atlassian: (options: AtlassianOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -58,15 +50,22 @@ declare const atlassian: (options: AtlassianOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: AtlassianProfile;
+  } | {
     user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
+      id?: never;
+      name: string;
+      email: string | null;
+      image: string;
       emailVerified: boolean;
-      [key: string]: any;
     };
-    data: any;
+    data: {
+      account_id: string;
+      name: string;
+      email?: string | undefined;
+      picture?: string | undefined;
+    };
   } | null>;
   options: AtlassianOptions;
 };

package/dist/social-providers/atlassian.mjs

@@ -10,6 +10,7 @@ const atlassian = (options) => {
 	return {
 		id: "atlassian",
 		name: "Atlassian",
+		accountSubject: ({ profile }) => profile.account_id,
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			if (!options.clientId || !options.clientSecret) {
 				logger.error("Client Id and Secret are required for Atlassian");
@@ -62,7 +63,6 @@ const atlassian = (options) => {
 				const userMap = await options.mapProfileToUser?.(profile);
 				return {
 					user: {
-						id: profile.account_id,
 						name: profile.name,
 						email: profile.email,
 						image: profile.picture,

package/dist/social-providers/cognito.d.mts

@@ -1,6 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
-import * as jose from "jose";
-
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/cognito.d.ts
 interface CognitoProfile {
   sub: string;
@@ -49,13 +48,9 @@ interface CognitoOptions extends ProviderOptions<CognitoProfile> {
 declare const cognito: (options: CognitoOptions) => {
   id: "cognito";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<CognitoProfile>) => string;
+  accountIssuer: string;
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -65,11 +60,7 @@ declare const cognito: (options: CognitoOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -77,7 +68,7 @@ declare const cognito: (options: CognitoOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   idToken: {
-    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    jwks: (header: import("jose").JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
     issuer: string;
     audience: string | string[];
     maxTokenAge: string;
@@ -92,15 +83,35 @@ declare const cognito: (options: CognitoOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: CognitoProfile;
+  } | {
     user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
+      id?: never;
+      name: string;
+      email: string | null;
+      image: string;
       emailVerified: boolean;
-      [key: string]: any;
     };
-    data: any;
+    data: {
+      name: string;
+      sub: string;
+      email: string;
+      email_verified: boolean;
+      given_name?: string | undefined;
+      family_name?: string | undefined;
+      picture?: string | undefined;
+      username?: string | undefined;
+      locale?: string | undefined;
+      phone_number?: string | undefined;
+      phone_number_verified?: boolean | undefined;
+      aud: string | (string & string[]);
+      iss: string;
+      exp: number;
+      iat: number;
+      jti?: string;
+      nbf?: number;
+    };
   } | null>;
   options: CognitoOptions;
 };

package/dist/social-providers/cognito.mjs

@@ -19,6 +19,8 @@ const cognito = (options) => {
 	return {
 		id: "cognito",
 		name: "Cognito",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: `https://cognito-idp.${options.region}.amazonaws.com/${options.userPoolId}`,
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId)) {
 				logger.error("ClientId is required for Amazon Cognito. Make sure to provide them in the options.");
@@ -98,7 +100,6 @@ const cognito = (options) => {
 				const userMap = await options.mapProfileToUser?.(enrichedProfile);
 				return {
 					user: {
-						id: profile.sub,
 						name: enrichedProfile.name,
 						email: profile.email,
 						image: profile.picture,
@@ -116,7 +117,6 @@ const cognito = (options) => {
 					const userMap = await options.mapProfileToUser?.(userInfo);
 					return {
 						user: {
-							id: userInfo.sub,
 							name: userInfo.name || userInfo.given_name || userInfo.username || "",
 							email: userInfo.email,
 							image: userInfo.picture,

package/dist/social-providers/discord.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/discord.d.ts
 interface DiscordProfile extends Record<string, any> {
   /** the user's id (i.e. the numerical snowflake) */
@@ -77,12 +78,8 @@ interface DiscordOptions extends ProviderOptions<DiscordProfile> {
 declare const discord: (options: DiscordOptions) => {
   id: "discord";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<DiscordProfile>) => string;
+  createAuthorizationURL({ state, scopes, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -92,10 +89,7 @@ declare const discord: (options: DiscordOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -112,15 +106,8 @@ declare const discord: (options: DiscordOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: DiscordProfile;
   } | null>;
   options: DiscordOptions;
 };

package/dist/social-providers/discord.mjs

@@ -8,6 +8,7 @@ const discord = (options) => {
 	return {
 		id: "discord",
 		name: "Discord",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["identify", "email"];
 			if (scopes) _scopes.push(...scopes);
@@ -58,7 +59,6 @@ const discord = (options) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.id,
 					name: profile.global_name || profile.username || "",
 					email: profile.email,
 					emailVerified: profile.verified,