@better-auth/electron 1.7.0-beta.1 → 1.7.0-beta.10

package/dist/{client-D6xRwPM0.d.mts → client-D5QKMJbp.d.mts}

@@ -35,13 +35,6 @@ interface ElectronOptions extends ElectronSharedOptions {
    * @default "better-auth"
    */
   cookiePrefix?: string | undefined;
-  /**
-   * Override the origin for Electron API routes.
-   * Enable this if you're facing cors origin issues with Electron API routes.
-   *
-   * @default false
-   */
-  disableOriginOverride?: boolean | undefined;
 }
 //#endregion
 //#region src/preload.d.ts
@@ -248,6 +241,7 @@ declare const requestAuthOptionsSchema: z.ZodObject<{
   disableRedirect: z.ZodOptional<z.ZodBoolean>;
   scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
+  additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
   additionalData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }, z.core.$strip>;
 type ElectronRequestAuthOptions = z.infer<typeof requestAuthOptionsSchema>;
@@ -323,11 +317,6 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
       mode?: RequestMode | undefined;
       cache?: RequestCache | undefined;
       credentials?: RequestCredentials | undefined;
-      headers?: (HeadersInit & (HeadersInit | {
-        accept: "application/json" | "text/plain" | "application/octet-stream";
-        "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-        authorization: "Bearer" | "Basic";
-      })) | undefined;
       integrity?: string | undefined;
       keepalive?: boolean | undefined;
       method?: string | undefined;
@@ -361,6 +350,12 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
         prefix: string | (() => string | undefined) | undefined;
         value: string | (() => string | undefined) | undefined;
       }) | undefined;
+      headers?: {} | {
+        [x: string]: string | undefined;
+        accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+        "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "multipart/form-data" | "application/octet-stream") | undefined;
+        authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+      } | undefined;
       body?: any;
       query?: any;
       params?: any;
@@ -378,11 +373,6 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
         mode?: RequestMode | undefined;
         cache?: RequestCache | undefined;
         credentials?: RequestCredentials | undefined;
-        headers?: (HeadersInit & (HeadersInit | {
-          accept: "application/json" | "text/plain" | "application/octet-stream";
-          "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-          authorization: "Bearer" | "Basic";
-        })) | undefined;
         integrity?: string | undefined;
         keepalive?: boolean | undefined;
         method?: string | undefined;
@@ -416,6 +406,12 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
           prefix: string | (() => string | undefined) | undefined;
           value: string | (() => string | undefined) | undefined;
         }) | undefined;
+        headers?: {} | {
+          [x: string]: string | undefined;
+          accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+          "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "multipart/form-data" | "application/octet-stream") | undefined;
+          authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+        } | undefined;
         body?: any;
         query?: any;
         params?: any;

package/dist/client.d.mts

@@ -1,2 +1,2 @@
-import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-D6xRwPM0.mjs";
+import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-D5QKMJbp.mjs";
 export { ElectronAuthenticateOptions, ElectronClientOptions, ElectronProxyClientOptions, ElectronRequestAuthOptions, ElectronSharedClientOptions, ElectronSharedOptions, ExposedBridges, FetchUserImageResult, SetupRendererConfig, Storage, authenticate, electronClient, fetchUserImage, handleDeepLink, kElectron, normalizeUserOutput, requestAuth, setupRenderer };

package/dist/client.mjs

@@ -1,16 +1,17 @@
-import { t as PACKAGE_VERSION } from "./version-C22JHwcK.mjs";
+import { t as PACKAGE_VERSION } from "./version-C-W6yUfI.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";
 import { APIError as APIError$1, getBaseURL, isDevelopment, isTest, safeJSONParse } from "better-auth";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
-import { Buffer } from "node:buffer";
-import { createHash } from "@better-auth/utils/hash";
 import { signInSocial } from "better-auth/api";
-import { parseSetCookieHeader } from "better-auth/cookies";
+import { cookieNameRegex, parseSetCookieHeader } from "better-auth/cookies";
+import { generateCodeChallenge } from "better-auth/oauth2";
+import { Buffer } from "node:buffer";
 import electron, { shell } from "electron";
 import { isDevelopment as isDevelopment$1 } from "@better-auth/core/env";
+import { isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { resolve } from "node:path";
 //#region src/user.ts
 const { net } = electron;
@@ -37,7 +38,7 @@ async function fetchUserImage(baseURL, url, options) {
 			parsed = new URL(relative, base);
 		}
 		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
-		if (!isDevelopment$1() && isLocalOrigin(parsed)) return null;
+		if (!isDevelopment$1() && !isPublicRoutableHost(parsed.hostname)) return null;
 		resolvedUrl = parsed.href;
 	} catch {
 		return null;
@@ -116,25 +117,6 @@ async function decodeDataImageUrl(url, options) {
 		return null;
 	}
 }
-function isLocalOrigin(parsed) {
-	const hostname = parsed.hostname.toLowerCase();
-	if (hostname === "localhost") return true;
-	const m = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-	if (m) {
-		const a = Number(m[1]);
-		const b = Number(m[2]);
-		if (a === 127) return true;
-		if (a === 10) return true;
-		if (a === 172 && b >= 16 && b <= 31) return true;
-		if (a === 192 && b === 168) return true;
-		if (a === 169 && b === 254) return true;
-		return false;
-	}
-	const h = hostname.replace(/^\[|\]$/g, "");
-	if (h === "::1" || /^(0:){7}1$/.test(h) || h === "0:0:0:0:0:0:0:1") return true;
-	if (/^fe[89ab][0-9a-f]/i.test(h)) return true;
-	return false;
-}
 function detectImageType(bytes) {
 	if (bytes.length < 12) return null;
 	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71 && bytes[4] === 13 && bytes[5] === 10 && bytes[6] === 26 && bytes[7] === 10) return "image/png";
@@ -168,8 +150,8 @@ async function requestAuth(clientOptions, options, cfg) {
 	if (!isProcessType("browser")) throw new BetterAuthError("`requestAuth` can only be called in the main process");
 	const { randomBytes } = await import("node:crypto");
 	const state = generateRandomString(16, "A-Z", "a-z", "0-9");
-	const codeVerifier = base64Url.encode(randomBytes(32));
-	const codeChallenge = base64Url.encode(await createHash("SHA-256").digest(codeVerifier));
+	const codeVerifier = base64Url.encode(randomBytes(32), { padding: false });
+	const codeChallenge = await generateCodeChallenge(codeVerifier);
 	(globalThis[kElectron] ??= /* @__PURE__ */ new Map()).set(state, codeVerifier);
 	let url = null;
 	if (cfg?.provider) {
@@ -186,7 +168,6 @@ async function requestAuth(clientOptions, options, cfg) {
 	} else url = new URL(options.signInURL);
 	url.searchParams.set("client_id", options.clientID || "electron");
 	url.searchParams.set("code_challenge", codeChallenge);
-	url.searchParams.set("code_challenge_method", "S256");
 	url.searchParams.set("state", state);
 	await shell.openExternal(url.toString(), { activate: true });
 }
@@ -492,10 +473,13 @@ function getCookie(cookie) {
 	try {
 		parsed = JSON.parse(cookie);
 	} catch (_e) {}
-	return Object.entries(parsed).reduce((acc, [key, value]) => {
-		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) return acc;
-		return `${acc}; ${key}=${value.value}`;
-	}, "");
+	const pairs = [];
+	for (const [key, value] of Object.entries(parsed)) {
+		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) continue;
+		if (!cookieNameRegex.test(key)) continue;
+		pairs.push(`${key}=${encodeURIComponent(value.value)}`);
+	}
+	return pairs.join("; ");
 }
 /**
 * Compare if session cookies have actually changed by comparing their values.
@@ -594,6 +578,16 @@ const electronClient = (options) => {
 	const cookieName = `${opts.storagePrefix}.cookie`;
 	const localCacheName = `${opts.storagePrefix}.local_cache`;
 	const { getDecrypted, setEncrypted } = storageAdapter(opts.storage, new Set([cookieName, localCacheName]));
+	const clearSessionCache = () => {
+		setEncrypted(cookieName, "{}");
+		store?.atoms.session?.set({
+			...store.atoms.session.get(),
+			data: null,
+			error: null,
+			isPending: false
+		});
+		setEncrypted(localCacheName, "{}");
+	};
 	if ((isDevelopment() || isTest()) && /^(?!\.)(?!.*\.\.)(?!.*\.$)[^.]+\.[^.]+$/.test(scheme)) console.warn("The provided scheme does not follow the reverse domain name notation. For example: `app.example.com` -> `com.example.app`.");
 	return {
 		id: "electron",
@@ -607,22 +601,13 @@ const electronClient = (options) => {
 				options ||= {};
 				options.credentials = "omit";
 				options.headers = {
+					origin: `${scheme}:/`,
 					...options.headers,
 					cookie,
 					"user-agent": app.userAgentFallback,
-					"electron-origin": `${scheme}:/`,
 					"x-skip-oauth-proxy": "true"
 				};
-				if (url.endsWith("/sign-out")) {
-					setEncrypted(cookieName, "{}");
-					store?.atoms.session?.set({
-						...store.atoms.session.get(),
-						data: null,
-						error: null,
-						isPending: false
-					});
-					setEncrypted(localCacheName, "{}");
-				}
+				if (url.endsWith("/sign-out")) clearSessionCache();
 				return {
 					url,
 					options
@@ -645,6 +630,7 @@ const electronClient = (options) => {
 						const data = context.data;
 						setEncrypted(localCacheName, JSON.stringify(data));
 					}
+					if (context.request.url.toString().includes("/sign-out")) clearSessionCache();
 				},
 				onError: async (context) => {
 					webContents.getFocusedWebContents()?.send(`${getChannelPrefixWithDelimiter(opts.channelPrefix)}error`, {

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-D6xRwPM0.mjs";
+import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-D5QKMJbp.mjs";
 import * as better_auth0 from "better-auth";
 import * as z from "zod";
 import * as _better_auth_core0 from "@better-auth/core";
@@ -16,9 +16,6 @@ declare module "@better-auth/core" {
 declare const electron: (options?: ElectronOptions | undefined) => {
   id: "electron";
   version: string;
-  onRequest(request: Request, _ctx: better_auth0.AuthContext): Promise<{
-    request: Request;
-  } | undefined>;
   hooks: {
     after: ({
       matcher: (ctx: HookEndpointContext) => boolean;
@@ -205,7 +202,6 @@ declare const electron: (options?: ElectronOptions | undefined) => {
         provider: z.ZodString;
         state: z.ZodString;
         code_challenge: z.ZodString;
-        code_challenge_method: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {
         scope: "http";
@@ -255,7 +251,6 @@ declare const electron: (options?: ElectronOptions | undefined) => {
         client_id: z.ZodString;
         state: z.ZodString;
         code_challenge: z.ZodString;
-        code_challenge_method: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       body: z.ZodObject<{
         callbackURL: z.ZodOptional<z.ZodString>;
@@ -325,7 +320,6 @@ declare const electron: (options?: ElectronOptions | undefined) => {
     codeExpiresIn: number;
     redirectCookieExpiresIn: number;
     cookiePrefix: string;
-    disableOriginOverride?: boolean | undefined;
     clientID: string;
   };
   $ERROR_CODES: {

package/dist/index.mjs

@@ -1,18 +1,16 @@
-import { t as PACKAGE_VERSION } from "./version-C22JHwcK.mjs";
+import { t as PACKAGE_VERSION } from "./version-C-W6yUfI.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";
 import { defineErrorCodes, safeJSONParse } from "better-auth";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
-import { Buffer } from "node:buffer";
-import { timingSafeEqual } from "node:crypto";
 import { safeJSONParse as safeJSONParse$1 } from "@better-auth/core/utils/json";
-import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
 import { createAuthEndpoint, sessionMiddleware } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
 import { parseUserOutput } from "better-auth/db";
+import { generateCodeChallenge } from "better-auth/oauth2";
 //#region src/error-codes.ts
 const ELECTRON_ERROR_CODES = defineErrorCodes({
 	INVALID_CLIENT_ID: "Invalid client ID",
@@ -55,18 +53,13 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 		}
 	}
 }, async (ctx) => {
-	const token = await ctx.context.internalAdapter.findVerificationValue(`electron:${ctx.body.token}`);
-	if (!token || token.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
+	const token = await ctx.context.internalAdapter.consumeVerificationValue(`electron:${ctx.body.token}`);
+	if (!token) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	const tokenRecord = safeJSONParse$1(token.value);
 	if (!tokenRecord) throw APIError.from("INTERNAL_SERVER_ERROR", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	if (tokenRecord.state !== ctx.body.state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.STATE_MISMATCH);
 	if (!tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_CODE_CHALLENGE);
-	if (tokenRecord.codeChallengeMethod === "s256") {
-		const codeChallenge = Buffer.from(base64Url.decode(tokenRecord.codeChallenge));
-		const codeVerifier = Buffer.from(await createHash("SHA-256").digest(ctx.body.code_verifier));
-		if (codeChallenge.length !== codeVerifier.length || !timingSafeEqual(codeChallenge, codeVerifier)) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	} else if (tokenRecord.codeChallenge !== ctx.body.code_verifier) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	await ctx.context.internalAdapter.deleteVerificationByIdentifier(`electron:${ctx.body.token}`);
+	if (await generateCodeChallenge(ctx.body.code_verifier) !== tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
 	const user = await ctx.context.internalAdapter.findUserById(tokenRecord.userId);
 	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const session = await ctx.context.internalAdapter.createSession(user.id);
@@ -83,8 +76,7 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 const electronInitOAuthProxyQuerySchema = z.object({
 	provider: z.string().nonempty(),
 	state: z.string(),
-	code_challenge: z.string(),
-	code_challenge_method: z.string().optional()
+	code_challenge: z.string()
 });
 const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oauth-proxy", {
 	method: "GET",
@@ -122,7 +114,6 @@ const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oaut
 	const searchParams = new URLSearchParams();
 	searchParams.set("client_id", opts.clientID || "electron");
 	searchParams.set("code_challenge", ctx.query.code_challenge);
-	searchParams.set("code_challenge_method", ctx.query.code_challenge_method || "plain");
 	searchParams.set("state", ctx.query.state);
 	const res = await betterFetch(`/sign-in/social?${searchParams.toString()}`, {
 		baseURL: ctx.context.baseURL,
@@ -145,8 +136,7 @@ const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oaut
 const electronTransferUserQuerySchema = z.object({
 	client_id: z.string(),
 	state: z.string(),
-	code_challenge: z.string(),
-	code_challenge_method: z.string().optional()
+	code_challenge: z.string()
 });
 const electronTransferUserBodySchema = z.object({ callbackURL: z.string().optional() });
 const electronTransferUser = (_opts, { handleTransfer }) => createAuthEndpoint("/electron/transfer-user", {
@@ -201,7 +191,7 @@ const electron = (options) => {
 		return !!(ctx.path?.startsWith("/sign-in") || ctx.path?.startsWith("/sign-up") || ctx.path?.startsWith("/callback") || ctx.path?.startsWith("/magic-link/verify") || ctx.path?.startsWith("/email-otp/verify-email") || ctx.path?.startsWith("/verify-email") || ctx.path?.startsWith("/one-tap/callback") || ctx.path?.startsWith("/passkey/verify-authentication") || ctx.path?.startsWith("/phone-number/verify"));
 	};
 	const handleTransfer = async (ctx, payload) => {
-		const { client_id, state, code_challenge, code_challenge_method = "plain" } = payload;
+		const { client_id, state, code_challenge } = payload;
 		const userId = ctx.context.session?.user.id || ctx.context.newSession?.user.id;
 		if (!userId || client_id !== opts.clientID) return null;
 		if (!state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_STATE);
@@ -215,7 +205,6 @@ const electron = (options) => {
 			value: JSON.stringify({
 				userId,
 				codeChallenge: code_challenge,
-				codeChallengeMethod: code_challenge_method.toLowerCase(),
 				state
 			}),
 			expiresAt
@@ -234,14 +223,6 @@ const electron = (options) => {
 	return {
 		id: "electron",
 		version: PACKAGE_VERSION,
-		async onRequest(request, _ctx) {
-			if (opts.disableOriginOverride || request.headers.get("origin")) return;
-			const electronOrigin = request.headers.get("electron-origin");
-			if (!electronOrigin) return;
-			const req = request.clone();
-			req.headers.set("origin", electronOrigin);
-			return { request: req };
-		},
 		hooks: { after: [{
 			matcher: (ctx) => !hookMatcher(ctx),
 			handler: createAuthMiddleware(async (ctx) => {
@@ -256,7 +237,6 @@ const electron = (options) => {
 				const querySchema = z.object({
 					client_id: z.string(),
 					code_challenge: z.string().nonempty(),
-					code_challenge_method: z.string().optional().default("plain"),
 					state: z.string().nonempty()
 				});
 				const cookie = ctx.context.createAuthCookie("transfer_token", { maxAge: opts.codeExpiresIn });