@better-auth/electron 1.7.0-beta.0 → 1.7.0-beta.2

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CzfTSPRz.mjs";
+import { t as PACKAGE_VERSION } from "./version-BVHIqaH7.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";
@@ -11,6 +11,7 @@ import { signInSocial } from "better-auth/api";
 import { parseSetCookieHeader } from "better-auth/cookies";
 import electron, { shell } from "electron";
 import { isDevelopment as isDevelopment$1 } from "@better-auth/core/env";
+import { isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { resolve } from "node:path";
 //#region src/user.ts
 const { net } = electron;
@@ -37,7 +38,7 @@ async function fetchUserImage(baseURL, url, options) {
 			parsed = new URL(relative, base);
 		}
 		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
-		if (!isDevelopment$1() && isLocalOrigin(parsed)) return null;
+		if (!isDevelopment$1() && !isPublicRoutableHost(parsed.hostname)) return null;
 		resolvedUrl = parsed.href;
 	} catch {
 		return null;
@@ -116,25 +117,6 @@ async function decodeDataImageUrl(url, options) {
 		return null;
 	}
 }
-function isLocalOrigin(parsed) {
-	const hostname = parsed.hostname.toLowerCase();
-	if (hostname === "localhost") return true;
-	const m = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-	if (m) {
-		const a = Number(m[1]);
-		const b = Number(m[2]);
-		if (a === 127) return true;
-		if (a === 10) return true;
-		if (a === 172 && b >= 16 && b <= 31) return true;
-		if (a === 192 && b === 168) return true;
-		if (a === 169 && b === 254) return true;
-		return false;
-	}
-	const h = hostname.replace(/^\[|\]$/g, "");
-	if (h === "::1" || /^(0:){7}1$/.test(h) || h === "0:0:0:0:0:0:0:1") return true;
-	if (/^fe[89ab][0-9a-f]/i.test(h)) return true;
-	return false;
-}
 function detectImageType(bytes) {
 	if (bytes.length < 12) return null;
 	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71 && bytes[4] === 13 && bytes[5] === 10 && bytes[6] === 26 && bytes[7] === 10) return "image/png";

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CzfTSPRz.mjs";
+import { t as PACKAGE_VERSION } from "./version-BVHIqaH7.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";
@@ -7,7 +7,6 @@ import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
 import { Buffer } from "node:buffer";
 import { timingSafeEqual } from "node:crypto";
-import { SocialProviderListEnum } from "@better-auth/core/social-providers";
 import { safeJSONParse as safeJSONParse$1 } from "@better-auth/core/utils/json";
 import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
@@ -117,8 +116,6 @@ const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oaut
 		}
 	}
 }, async (ctx) => {
-	const isSocialProvider = SocialProviderListEnum.safeParse(ctx.query.provider);
-	if (!isSocialProvider && !ctx.context.getPlugin("generic-oauth")) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PROVIDER_NOT_FOUND);
 	const headers = new Headers(ctx.request?.headers);
 	headers.set("origin", new URL(ctx.context.baseURL).origin);
 	let setCookie = null;
@@ -127,7 +124,7 @@ const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oaut
 	searchParams.set("code_challenge", ctx.query.code_challenge);
 	searchParams.set("code_challenge_method", ctx.query.code_challenge_method || "plain");
 	searchParams.set("state", ctx.query.state);
-	const res = await betterFetch(`${isSocialProvider ? "/sign-in/social" : "/sign-in/oauth2"}?${searchParams.toString()}`, {
+	const res = await betterFetch(`/sign-in/social?${searchParams.toString()}`, {
 		baseURL: ctx.context.baseURL,
 		method: "POST",
 		body: { provider: ctx.query.provider },
@@ -201,7 +198,7 @@ const electron = (options) => {
 		...options || {}
 	};
 	const hookMatcher = (ctx) => {
-		return !!(ctx.path?.startsWith("/sign-in") || ctx.path?.startsWith("/sign-up") || ctx.path?.startsWith("/callback") || ctx.path?.startsWith("/oauth2/callback") || ctx.path?.startsWith("/magic-link/verify") || ctx.path?.startsWith("/email-otp/verify-email") || ctx.path?.startsWith("/verify-email") || ctx.path?.startsWith("/one-tap/callback") || ctx.path?.startsWith("/passkey/verify-authentication") || ctx.path?.startsWith("/phone-number/verify"));
+		return !!(ctx.path?.startsWith("/sign-in") || ctx.path?.startsWith("/sign-up") || ctx.path?.startsWith("/callback") || ctx.path?.startsWith("/magic-link/verify") || ctx.path?.startsWith("/email-otp/verify-email") || ctx.path?.startsWith("/verify-email") || ctx.path?.startsWith("/one-tap/callback") || ctx.path?.startsWith("/passkey/verify-authentication") || ctx.path?.startsWith("/phone-number/verify"));
 	};
 	const handleTransfer = async (ctx, payload) => {
 		const { client_id, state, code_challenge, code_challenge_method = "plain" } = payload;

package/dist/preload.d.mts

@@ -676,6 +676,12 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    * @returns True if the id token is valid, false otherwise
    */
   verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  /**
+   * The expected issuer identifier for this provider (RFC 9207).
+   * When set, the callback handler validates the `iss` query parameter
+   * against this value to prevent authorization server mix-up attacks.
+   */
+  issuer?: string | undefined;
   /**
    * Disable implicit sign up for new users. When set to true for the provider,
    * sign-in need to be called with with requestSignUp as true to create new users.
@@ -861,7 +867,7 @@ interface AppleNonConformUser {
   email: string;
 }
 interface AppleOptions extends ProviderOptions<AppleProfile> {
-  clientId: string;
+  clientId: string | string[];
   appBundleIdentifier?: string | undefined;
   audience?: (string | string[]) | undefined;
 }
@@ -908,7 +914,7 @@ interface CognitoProfile {
   [key: string]: any;
 }
 interface CognitoOptions extends ProviderOptions<CognitoProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The Cognito domain (e.g., "your-app.auth.us-east-1.amazoncognito.com")
    */
@@ -1015,7 +1021,7 @@ interface FacebookProfile {
   };
 }
 interface FacebookOptions extends ProviderOptions<FacebookProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * Extend list of fields to retrieve from the Facebook user profile.
    *
@@ -1198,7 +1204,7 @@ interface MicrosoftEntraIDProfile extends Record<string, any> {
   given_name: string;
 }
 interface MicrosoftOptions extends ProviderOptions<MicrosoftEntraIDProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The tenant ID of the Microsoft account
    * @default "common"
@@ -1249,7 +1255,7 @@ interface GoogleProfile {
   sub: string;
 }
 interface GoogleOptions extends ProviderOptions<GoogleProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The access type to use for the authorization code request
    */

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CzfTSPRz.mjs";
+import { t as PACKAGE_VERSION } from "./version-BVHIqaH7.mjs";
 import { r as parseProtocolScheme } from "./utils-DxDKRT6e.mjs";
 import { parseCookies } from "better-auth/cookies";
 //#region src/proxy.ts

package/dist/{version-CzfTSPRz.mjs → version-BVHIqaH7.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.0";
+const PACKAGE_VERSION = "1.7.0-beta.2";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/electron",
-  "version": "1.7.0-beta.0",
+  "version": "1.7.0-beta.2",
   "description": "Better Auth integration for Electron applications.",
   "type": "module",
   "license": "MIT",
@@ -78,10 +78,10 @@
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "electron": "^38.8.4",
+    "electron": "^41.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.0",
-    "better-auth": "1.7.0-beta.0"
+    "@better-auth/core": "1.7.0-beta.2",
+    "better-auth": "1.7.0-beta.2"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.0",
@@ -89,8 +89,8 @@
     "better-call": "1.3.5",
     "conf": "^15.0.2",
     "electron": ">=36.0.0",
-    "@better-auth/core": "^1.7.0-beta.0",
-    "better-auth": "^1.7.0-beta.0"
+    "@better-auth/core": "^1.7.0-beta.2",
+    "better-auth": "^1.7.0-beta.2"
   },
   "peerDependenciesMeta": {
     "electron": {