@better-auth/core 1.7.0-rc.4 → 1.7.0-rc.5

package/dist/api/index.d.mts

@@ -6,7 +6,7 @@ import { AuthContext } from "../types/context.mjs";
 import "../types/index.mjs";
 import { OAuthProvider } from "../oauth2/oauth-provider.mjs";
 import "../oauth2/index.mjs";
-import { EndpointContext, EndpointOptions, StrictEndpoint } from "better-call";
+import { EndpointHandler, EndpointOptions, MiddlewareHandler, StrictEndpoint } from "better-call";
 //#region src/api/index.d.ts
 /**
  * Response headers that forbid any intermediary (proxy, CDN, browser) from
@@ -26,12 +26,9 @@ declare const NO_STORE_HEADERS: {
   readonly "Cache-Control": "no-store";
   readonly Pragma: "no-cache";
 };
-declare const optionsMiddleware: <InputCtx extends import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>>(inputContext: InputCtx) => Promise<AuthContext>;
+declare const optionsMiddleware: import("better-call").Middleware<import("better-call").MiddlewareOptions, <InputCtx extends import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>>(inputContext: InputCtx) => Promise<AuthContext>>;
 declare const createAuthMiddleware: {
-  <Options extends import("better-call").MiddlewareOptions, R>(options: Options, handler: (ctx: import("better-call").MiddlewareContext<Options, {
-    returned?: unknown | undefined;
-    responseHeaders?: Headers | undefined;
-  } & import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
+  <Options extends import("better-call").MiddlewareOptions, R>(options: Options, handler: (ctx: import("better-call").MiddlewareContext<Options, import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
     options: import("@better-auth/core").BetterAuthOptions;
     trustedOrigins: string[];
     trustedProviders: string[];
@@ -157,11 +154,11 @@ declare const createAuthMiddleware: {
     skipCSRFCheck: boolean;
     runInBackground: (promise: Promise<unknown>) => void;
     runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("@better-auth/core").Awaitable<unknown>;
-  }>) => Promise<R>): (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R>;
-  <Options extends import("better-call").MiddlewareOptions, R_1>(handler: (ctx: import("better-call").MiddlewareContext<Options, {
+  } & {
     returned?: unknown | undefined;
     responseHeaders?: Headers | undefined;
-  } & import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
+  }>) => Promise<R>): import("better-call").Middleware<Options, (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R>>;
+  <Options extends import("better-call").MiddlewareOptions, R_1>(handler: (ctx: import("better-call").MiddlewareContext<Options, import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
     options: import("@better-auth/core").BetterAuthOptions;
     trustedOrigins: string[];
     trustedProviders: string[];
@@ -287,37 +284,19 @@ declare const createAuthMiddleware: {
     skipCSRFCheck: boolean;
     runInBackground: (promise: Promise<unknown>) => void;
     runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("@better-auth/core").Awaitable<unknown>;
-  }>) => Promise<R_1>): (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R_1>;
+  } & {
+    returned?: unknown | undefined;
+    responseHeaders?: Headers | undefined;
+  }>) => Promise<R_1>): import("better-call").Middleware<Options, (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R_1>>;
 };
-type EndpointHandler<Path extends string, Options extends EndpointOptions, R> = (context: EndpointContext<Path, Options, AuthContext>) => Promise<R>;
-declare function createAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(path: Path, options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
-declare function createAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
+type AuthEndpointHandler<Path extends string, Options extends EndpointOptions, R> = EndpointHandler<Path, Options, R, AuthContext>;
+type PathlessAuthEndpointHandler<Options extends EndpointOptions, R> = AuthEndpointHandler<string, Options, R>;
+declare function createAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(path: Path, options: Options, handler: AuthEndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
+declare function createAuthEndpoint<InferredPath extends string, Options extends EndpointOptions, R>(options: Options, handler: PathlessAuthEndpointHandler<Options, R>): StrictEndpoint<InferredPath, Options, R>;
 declare namespace createAuthEndpoint {
-  /**
-   * Declare a **server-only** endpoint.
-   *
-   * The endpoint is callable through `auth.api.*` from trusted server code but is
-   * never registered on the HTTP router and never emitted into the OpenAPI
-   * schema. It takes no path because it has no URL to be reached at.
-   *
-   * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
-   * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
-   * keeps the endpoint off the HTTP surface even if a path is later added by
-   * mistake: better-call's router skips an endpoint when its path is missing *or*
-   * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
-   * on path omission alone is invisible and one keystroke away from exposure.
-   *
-   * @example
-   * ```ts
-   * viewBackupCodes: createAuthEndpoint.serverOnly(
-   * 	{ method: "POST", body: schema },
-   * 	async (ctx) => { ... },
-   * )
-   * ```
-   */
-  function serverOnly<Path extends string, Options extends EndpointOptions, R>(options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
+  var serverOnly: <InferredPath extends string, Options extends EndpointOptions, R>(options: Options, handler: PathlessAuthEndpointHandler<Options, R>) => StrictEndpoint<InferredPath, Options, R>;
 }
 type AuthEndpoint<Path extends string, Opts extends EndpointOptions, R> = ReturnType<typeof createAuthEndpoint<Path, Opts, R>>;
-type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;
+type AuthMiddleware = MiddlewareHandler;
 //#endregion
 export { AuthEndpoint, AuthMiddleware, NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };

package/dist/api/index.mjs

@@ -47,30 +47,26 @@ const optionsMiddleware = createMiddleware(async () => {
 const createAuthMiddleware = createMiddleware.create({ use: [optionsMiddleware, createMiddleware(async () => {
 	return {};
 })] });
-const use = [optionsMiddleware];
-function createAuthEndpoint(pathOrOptions, handlerOrOptions, handlerOrNever) {
-	const path = typeof pathOrOptions === "string" ? pathOrOptions : void 0;
-	const options = typeof handlerOrOptions === "object" ? handlerOrOptions : pathOrOptions;
-	const handler = typeof handlerOrOptions === "function" ? handlerOrOptions : handlerOrNever;
+const createEndpointWithAuthContext = createEndpoint.create({ use: [optionsMiddleware] });
+function wrapEndpointHandler(handler, options) {
 	const noStore = options.metadata?.noStore === true;
-	const wrapped = async (ctx) => {
-		if (noStore) for (const [name, value] of Object.entries(NO_STORE_HEADERS)) ctx.setHeader(name, value);
-		const runtimeCtx = ctx;
+	return async (context) => {
+		if (noStore) for (const [name, value] of Object.entries(NO_STORE_HEADERS)) context.setHeader(name, value);
 		try {
-			return await runWithEndpointContext(ctx, () => handler(ctx));
-		} catch (e) {
-			attachResponseHeadersToAPIError(runtimeCtx.responseHeaders, e);
-			throw e;
+			return await runWithEndpointContext(context, () => handler(context));
+		} catch (error) {
+			attachResponseHeadersToAPIError(context.responseHeaders, error);
+			throw error;
 		}
 	};
-	if (path) return createEndpoint(path, {
-		...options,
-		use: [...options?.use || [], ...use]
-	}, wrapped);
-	return createEndpoint({
-		...options,
-		use: [...options?.use || [], ...use]
-	}, wrapped);
+}
+function createAuthEndpoint(...args) {
+	if (args.length === 3) {
+		const [path, options, handler] = args;
+		return createEndpointWithAuthContext(path, options, wrapEndpointHandler(handler, options));
+	}
+	const [options, handler] = args;
+	return createEndpointWithAuthContext(options, wrapEndpointHandler(handler, options));
 }
 /**
 * Set `metadata.SERVER_ONLY` while preserving any existing metadata
@@ -85,11 +81,28 @@ function withServerOnly(options) {
 		}
 	};
 }
-(function(_createAuthEndpoint) {
-	function serverOnly(options, handler) {
-		return createAuthEndpoint(withServerOnly(options), handler);
-	}
-	_createAuthEndpoint.serverOnly = serverOnly;
-})(createAuthEndpoint || (createAuthEndpoint = {}));
+/**
+* Declare a **server-only** endpoint.
+*
+* The endpoint is callable through `auth.api.*` from trusted server code but is
+* never registered on the HTTP router and never emitted into the OpenAPI
+* schema. It takes no path because it has no URL to be reached at.
+*
+* Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
+* Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
+* keeps the endpoint off the HTTP surface even if a path is later added by
+* mistake: better-call's router skips an endpoint when its path is missing *or*
+* when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
+* on path omission alone is invisible and one keystroke away from exposure.
+*
+* @example
+* ```ts
+* viewBackupCodes: createAuthEndpoint.serverOnly(
+* 	{ method: "POST", body: schema },
+* 	async (ctx) => { ... },
+* )
+* ```
+*/
+createAuthEndpoint.serverOnly = (options, handler) => createAuthEndpoint(withServerOnly(options), handler);
 //#endregion
 export { NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };

package/dist/context/global.mjs

@@ -2,7 +2,7 @@
 const symbol = Symbol.for("better-auth:global");
 let bind = null;
 const __context = {};
-const __betterAuthVersion = "1.7.0-rc.4";
+const __betterAuthVersion = "1.7.0-rc.5";
 /**
 * We store context instance in the globalThis.
 *

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.7.0-rc.4";
+const INSTRUMENTATION_VERSION = "1.7.0-rc.5";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.7.0-rc.4",
+  "version": "1.7.0-rc.5",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -166,7 +166,7 @@
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/sdk-trace-base": "^2.10.0",
     "@opentelemetry/sdk-trace-node": "^2.10.0",
-    "better-call": "1.3.7",
+    "better-call": "1.4.0",
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
@@ -177,7 +177,7 @@
     "@better-fetch/fetch": "1.3.1",
     "@cloudflare/workers-types": ">=4",
     "@opentelemetry/api": "^1.9.0",
-    "better-call": "1.3.7",
+    "better-call": "1.4.0",
     "jose": "^6.1.0",
     "kysely": "^0.28.5 || ^0.29.0",
     "nanostores": "^1.0.1"

package/src/api/index.ts

@@ -1,6 +1,7 @@
 import type {
-	EndpointContext,
+	EndpointHandler,
 	EndpointOptions,
+	MiddlewareHandler,
 	StrictEndpoint,
 } from "better-call";
 import {
@@ -75,94 +76,93 @@ export const createAuthMiddleware = createMiddleware.create({
 	],
 });
 
-const use = [optionsMiddleware];
+const createEndpointWithAuthContext = createEndpoint.create({
+	use: [optionsMiddleware],
+});
 
-type EndpointHandler<
+type AuthEndpointHandler<
 	Path extends string,
 	Options extends EndpointOptions,
 	R,
-> = (context: EndpointContext<Path, Options, AuthContext>) => Promise<R>;
+> = EndpointHandler<Path, Options, R, AuthContext>;
 
-export function createAuthEndpoint<
-	Path extends string,
+type PathlessAuthEndpointHandler<
 	Options extends EndpointOptions,
 	R,
->(
-	path: Path,
-	options: Options,
-	handler: EndpointHandler<Path, Options, R>,
-): StrictEndpoint<Path, Options, R>;
+> = AuthEndpointHandler<string, Options, R>;
 
-export function createAuthEndpoint<
+function wrapEndpointHandler<
 	Path extends string,
 	Options extends EndpointOptions,
 	R,
 >(
+	handler: AuthEndpointHandler<Path, Options, R>,
 	options: Options,
-	handler: EndpointHandler<Path, Options, R>,
-): StrictEndpoint<Path, Options, R>;
-
-export function createAuthEndpoint<
-	Path extends string,
-	Opts extends EndpointOptions,
-	R,
->(
-	pathOrOptions: Path | Opts,
-	handlerOrOptions: EndpointHandler<Path, Opts, R> | Opts,
-	handlerOrNever?: any,
-) {
-	const path: Path | undefined =
-		typeof pathOrOptions === "string" ? pathOrOptions : undefined;
-	const options: Opts =
-		typeof handlerOrOptions === "object"
-			? handlerOrOptions
-			: (pathOrOptions as Opts);
-	const handler: EndpointHandler<Path, Opts, R> =
-		typeof handlerOrOptions === "function" ? handlerOrOptions : handlerOrNever;
-
-	// Endpoints that return credentials declare `metadata: { noStore: true }`.
-	// Emit the no-store headers at the boundary, before the handler runs, so they
-	// land on every response the handler produces: a success harvests
-	// `responseHeaders`, and a thrown error carries the same headers through
-	// `attachResponseHeadersToAPIError`. Validation that rejects the request
-	// before the handler runs is not covered (and returns no credentials).
+): AuthEndpointHandler<Path, Options, R> {
 	const noStore =
 		(options as { metadata?: { noStore?: boolean } }).metadata?.noStore ===
 		true;
 
-	// todo: prettify the code, we want to call `runWithEndpointContext` to top level
-	const wrapped: EndpointHandler<Path, Opts, R> = async (ctx) => {
+	return async (context) => {
 		if (noStore) {
 			for (const [name, value] of Object.entries(NO_STORE_HEADERS)) {
-				ctx.setHeader(name, value);
+				context.setHeader(name, value);
 			}
 		}
-		const runtimeCtx = ctx as unknown as { responseHeaders?: Headers };
 		try {
-			return await runWithEndpointContext(ctx as any, () => handler(ctx));
-		} catch (e) {
-			attachResponseHeadersToAPIError(runtimeCtx.responseHeaders, e);
-			throw e;
+			return await runWithEndpointContext(context, () => handler(context));
+		} catch (error) {
+			attachResponseHeadersToAPIError(context.responseHeaders, error);
+			throw error;
 		}
 	};
+}
 
-	if (path) {
-		return createEndpoint(
+export function createAuthEndpoint<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	path: Path,
+	options: Options,
+	handler: AuthEndpointHandler<Path, Options, R>,
+): StrictEndpoint<Path, Options, R>;
+
+export function createAuthEndpoint<
+	InferredPath extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	options: Options,
+	handler: PathlessAuthEndpointHandler<Options, R>,
+): StrictEndpoint<InferredPath, Options, R>;
+
+export function createAuthEndpoint<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	...args:
+		| [
+				path: Path,
+				options: Options,
+				handler: AuthEndpointHandler<Path, Options, R>,
+		  ]
+		| [options: Options, handler: PathlessAuthEndpointHandler<Options, R>]
+) {
+	if (args.length === 3) {
+		const [path, options, handler] = args;
+		return createEndpointWithAuthContext(
 			path,
-			{
-				...options,
-				use: [...(options?.use || []), ...use],
-			},
-			wrapped,
+			options,
+			wrapEndpointHandler(handler, options),
 		);
 	}
 
-	return createEndpoint(
-		{
-			...options,
-			use: [...(options?.use || []), ...use],
-		},
-		wrapped,
+	const [options, handler] = args;
+	return createEndpointWithAuthContext(
+		options,
+		wrapEndpointHandler(handler, options),
 	);
 }
 
@@ -179,44 +179,45 @@ function withServerOnly<Options extends EndpointOptions>(
 	} as Options;
 }
 
-export namespace createAuthEndpoint {
-	/**
-	 * Declare a **server-only** endpoint.
-	 *
-	 * The endpoint is callable through `auth.api.*` from trusted server code but is
-	 * never registered on the HTTP router and never emitted into the OpenAPI
-	 * schema. It takes no path because it has no URL to be reached at.
-	 *
-	 * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
-	 * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
-	 * keeps the endpoint off the HTTP surface even if a path is later added by
-	 * mistake: better-call's router skips an endpoint when its path is missing *or*
-	 * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
-	 * on path omission alone is invisible and one keystroke away from exposure.
-	 *
-	 * @example
-	 * ```ts
-	 * viewBackupCodes: createAuthEndpoint.serverOnly(
-	 * 	{ method: "POST", body: schema },
-	 * 	async (ctx) => { ... },
-	 * )
-	 * ```
-	 */
-	export function serverOnly<
-		Path extends string,
-		Options extends EndpointOptions,
-		R,
-	>(
-		options: Options,
-		handler: EndpointHandler<Path, Options, R>,
-	): StrictEndpoint<Path, Options, R> {
-		return createAuthEndpoint(withServerOnly(options), handler);
-	}
-}
+/**
+ * Declare a **server-only** endpoint.
+ *
+ * The endpoint is callable through `auth.api.*` from trusted server code but is
+ * never registered on the HTTP router and never emitted into the OpenAPI
+ * schema. It takes no path because it has no URL to be reached at.
+ *
+ * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
+ * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
+ * keeps the endpoint off the HTTP surface even if a path is later added by
+ * mistake: better-call's router skips an endpoint when its path is missing *or*
+ * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
+ * on path omission alone is invisible and one keystroke away from exposure.
+ *
+ * @example
+ * ```ts
+ * viewBackupCodes: createAuthEndpoint.serverOnly(
+ * 	{ method: "POST", body: schema },
+ * 	async (ctx) => { ... },
+ * )
+ * ```
+ */
+createAuthEndpoint.serverOnly = <
+	InferredPath extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	options: Options,
+	handler: PathlessAuthEndpointHandler<Options, R>,
+): StrictEndpoint<InferredPath, Options, R> =>
+	createAuthEndpoint<InferredPath, Options, R>(
+		withServerOnly(options),
+		handler,
+	);
 
 export type AuthEndpoint<
 	Path extends string,
 	Opts extends EndpointOptions,
 	R,
 > = ReturnType<typeof createAuthEndpoint<Path, Opts, R>>;
-export type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;
+
+export type AuthMiddleware = MiddlewareHandler;