@better-auth/electron 1.7.0-beta.4 → 1.7.0-beta.6

package/dist/{client-DIzl-aw0.d.mts → client-D5QKMJbp.d.mts}

@@ -35,13 +35,6 @@ interface ElectronOptions extends ElectronSharedOptions {
    * @default "better-auth"
    */
   cookiePrefix?: string | undefined;
-  /**
-   * Override the origin for Electron API routes.
-   * Enable this if you're facing cors origin issues with Electron API routes.
-   *
-   * @default false
-   */
-  disableOriginOverride?: boolean | undefined;
 }
 //#endregion
 //#region src/preload.d.ts
@@ -324,11 +317,6 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
       mode?: RequestMode | undefined;
       cache?: RequestCache | undefined;
       credentials?: RequestCredentials | undefined;
-      headers?: (HeadersInit & (HeadersInit | {
-        accept: "application/json" | "text/plain" | "application/octet-stream";
-        "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-        authorization: "Bearer" | "Basic";
-      })) | undefined;
       integrity?: string | undefined;
       keepalive?: boolean | undefined;
       method?: string | undefined;
@@ -362,6 +350,12 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
         prefix: string | (() => string | undefined) | undefined;
         value: string | (() => string | undefined) | undefined;
       }) | undefined;
+      headers?: {} | {
+        [x: string]: string | undefined;
+        accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+        "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "multipart/form-data" | "application/octet-stream") | undefined;
+        authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+      } | undefined;
       body?: any;
       query?: any;
       params?: any;
@@ -379,11 +373,6 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
         mode?: RequestMode | undefined;
         cache?: RequestCache | undefined;
         credentials?: RequestCredentials | undefined;
-        headers?: (HeadersInit & (HeadersInit | {
-          accept: "application/json" | "text/plain" | "application/octet-stream";
-          "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-          authorization: "Bearer" | "Basic";
-        })) | undefined;
         integrity?: string | undefined;
         keepalive?: boolean | undefined;
         method?: string | undefined;
@@ -417,6 +406,12 @@ declare const electronClient: <O extends ElectronClientOptions>(options: O) => {
           prefix: string | (() => string | undefined) | undefined;
           value: string | (() => string | undefined) | undefined;
         }) | undefined;
+        headers?: {} | {
+          [x: string]: string | undefined;
+          accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+          "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "multipart/form-data" | "application/octet-stream") | undefined;
+          authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+        } | undefined;
         body?: any;
         query?: any;
         params?: any;

package/dist/client.d.mts

@@ -1,2 +1,2 @@
-import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-DIzl-aw0.mjs";
+import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-D5QKMJbp.mjs";
 export { ElectronAuthenticateOptions, ElectronClientOptions, ElectronProxyClientOptions, ElectronRequestAuthOptions, ElectronSharedClientOptions, ElectronSharedOptions, ExposedBridges, FetchUserImageResult, SetupRendererConfig, Storage, authenticate, electronClient, fetchUserImage, handleDeepLink, kElectron, normalizeUserOutput, requestAuth, setupRenderer };

package/dist/client.mjs

@@ -1,14 +1,14 @@
-import { t as PACKAGE_VERSION } from "./version-5EiO_U3Z.mjs";
+import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";
 import { APIError as APIError$1, getBaseURL, isDevelopment, isTest, safeJSONParse } from "better-auth";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
-import { Buffer } from "node:buffer";
-import { createHash } from "@better-auth/utils/hash";
 import { signInSocial } from "better-auth/api";
 import { cookieNameRegex, parseSetCookieHeader } from "better-auth/cookies";
+import { generateCodeChallenge } from "better-auth/oauth2";
+import { Buffer } from "node:buffer";
 import electron, { shell } from "electron";
 import { isDevelopment as isDevelopment$1 } from "@better-auth/core/env";
 import { isPublicRoutableHost } from "@better-auth/core/utils/host";
@@ -150,8 +150,8 @@ async function requestAuth(clientOptions, options, cfg) {
 	if (!isProcessType("browser")) throw new BetterAuthError("`requestAuth` can only be called in the main process");
 	const { randomBytes } = await import("node:crypto");
 	const state = generateRandomString(16, "A-Z", "a-z", "0-9");
-	const codeVerifier = base64Url.encode(randomBytes(32));
-	const codeChallenge = base64Url.encode(await createHash("SHA-256").digest(codeVerifier));
+	const codeVerifier = base64Url.encode(randomBytes(32), { padding: false });
+	const codeChallenge = await generateCodeChallenge(codeVerifier);
 	(globalThis[kElectron] ??= /* @__PURE__ */ new Map()).set(state, codeVerifier);
 	let url = null;
 	if (cfg?.provider) {
@@ -168,7 +168,6 @@ async function requestAuth(clientOptions, options, cfg) {
 	} else url = new URL(options.signInURL);
 	url.searchParams.set("client_id", options.clientID || "electron");
 	url.searchParams.set("code_challenge", codeChallenge);
-	url.searchParams.set("code_challenge_method", "S256");
 	url.searchParams.set("state", state);
 	await shell.openExternal(url.toString(), { activate: true });
 }
@@ -579,6 +578,16 @@ const electronClient = (options) => {
 	const cookieName = `${opts.storagePrefix}.cookie`;
 	const localCacheName = `${opts.storagePrefix}.local_cache`;
 	const { getDecrypted, setEncrypted } = storageAdapter(opts.storage, new Set([cookieName, localCacheName]));
+	const clearSessionCache = () => {
+		setEncrypted(cookieName, "{}");
+		store?.atoms.session?.set({
+			...store.atoms.session.get(),
+			data: null,
+			error: null,
+			isPending: false
+		});
+		setEncrypted(localCacheName, "{}");
+	};
 	if ((isDevelopment() || isTest()) && /^(?!\.)(?!.*\.\.)(?!.*\.$)[^.]+\.[^.]+$/.test(scheme)) console.warn("The provided scheme does not follow the reverse domain name notation. For example: `app.example.com` -> `com.example.app`.");
 	return {
 		id: "electron",
@@ -592,22 +601,13 @@ const electronClient = (options) => {
 				options ||= {};
 				options.credentials = "omit";
 				options.headers = {
+					origin: `${scheme}:/`,
 					...options.headers,
 					cookie,
 					"user-agent": app.userAgentFallback,
-					"electron-origin": `${scheme}:/`,
 					"x-skip-oauth-proxy": "true"
 				};
-				if (url.endsWith("/sign-out")) {
-					setEncrypted(cookieName, "{}");
-					store?.atoms.session?.set({
-						...store.atoms.session.get(),
-						data: null,
-						error: null,
-						isPending: false
-					});
-					setEncrypted(localCacheName, "{}");
-				}
+				if (url.endsWith("/sign-out")) clearSessionCache();
 				return {
 					url,
 					options
@@ -630,6 +630,7 @@ const electronClient = (options) => {
 						const data = context.data;
 						setEncrypted(localCacheName, JSON.stringify(data));
 					}
+					if (context.request.url.toString().includes("/sign-out")) clearSessionCache();
 				},
 				onError: async (context) => {
 					webContents.getFocusedWebContents()?.send(`${getChannelPrefixWithDelimiter(opts.channelPrefix)}error`, {

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-DIzl-aw0.mjs";
+import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-D5QKMJbp.mjs";
 import * as better_auth0 from "better-auth";
 import * as z from "zod";
 import * as _better_auth_core0 from "@better-auth/core";
@@ -16,9 +16,6 @@ declare module "@better-auth/core" {
 declare const electron: (options?: ElectronOptions | undefined) => {
   id: "electron";
   version: string;
-  onRequest(request: Request, _ctx: better_auth0.AuthContext): Promise<{
-    request: Request;
-  } | undefined>;
   hooks: {
     after: ({
       matcher: (ctx: HookEndpointContext) => boolean;
@@ -102,7 +99,7 @@ declare const electron: (options?: ElectronOptions | undefined) => {
             image?: string | null | undefined;
           } & Record<string, any>;
         } | null) => void;
-        socialProviders: better_auth0.OAuthProvider[];
+        socialProviders: better_auth0.UpstreamProvider[];
         authCookies: better_auth0.BetterAuthCookies;
         logger: ReturnType<typeof better_auth0.createLogger>;
         rateLimit: {
@@ -205,7 +202,6 @@ declare const electron: (options?: ElectronOptions | undefined) => {
         provider: z.ZodString;
         state: z.ZodString;
         code_challenge: z.ZodString;
-        code_challenge_method: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {
         scope: "http";
@@ -255,7 +251,6 @@ declare const electron: (options?: ElectronOptions | undefined) => {
         client_id: z.ZodString;
         state: z.ZodString;
         code_challenge: z.ZodString;
-        code_challenge_method: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       body: z.ZodObject<{
         callbackURL: z.ZodOptional<z.ZodString>;
@@ -325,7 +320,6 @@ declare const electron: (options?: ElectronOptions | undefined) => {
     codeExpiresIn: number;
     redirectCookieExpiresIn: number;
     cookiePrefix: string;
-    disableOriginOverride?: boolean | undefined;
     clientID: string;
   };
   $ERROR_CODES: {

package/dist/index.mjs

@@ -1,18 +1,16 @@
-import { t as PACKAGE_VERSION } from "./version-5EiO_U3Z.mjs";
+import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";
 import { defineErrorCodes, safeJSONParse } from "better-auth";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
-import { Buffer } from "node:buffer";
-import { timingSafeEqual } from "node:crypto";
 import { safeJSONParse as safeJSONParse$1 } from "@better-auth/core/utils/json";
-import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
 import { createAuthEndpoint, sessionMiddleware } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
 import { parseUserOutput } from "better-auth/db";
+import { generateCodeChallenge } from "better-auth/oauth2";
 //#region src/error-codes.ts
 const ELECTRON_ERROR_CODES = defineErrorCodes({
 	INVALID_CLIENT_ID: "Invalid client ID",
@@ -55,18 +53,13 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 		}
 	}
 }, async (ctx) => {
-	const token = await ctx.context.internalAdapter.findVerificationValue(`electron:${ctx.body.token}`);
-	if (!token || token.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
+	const token = await ctx.context.internalAdapter.consumeVerificationValue(`electron:${ctx.body.token}`);
+	if (!token) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	const tokenRecord = safeJSONParse$1(token.value);
 	if (!tokenRecord) throw APIError.from("INTERNAL_SERVER_ERROR", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	if (tokenRecord.state !== ctx.body.state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.STATE_MISMATCH);
 	if (!tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_CODE_CHALLENGE);
-	if (tokenRecord.codeChallengeMethod === "s256") {
-		const codeChallenge = Buffer.from(base64Url.decode(tokenRecord.codeChallenge));
-		const codeVerifier = Buffer.from(await createHash("SHA-256").digest(ctx.body.code_verifier));
-		if (codeChallenge.length !== codeVerifier.length || !timingSafeEqual(codeChallenge, codeVerifier)) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	} else if (tokenRecord.codeChallenge !== ctx.body.code_verifier) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	await ctx.context.internalAdapter.deleteVerificationByIdentifier(`electron:${ctx.body.token}`);
+	if (await generateCodeChallenge(ctx.body.code_verifier) !== tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
 	const user = await ctx.context.internalAdapter.findUserById(tokenRecord.userId);
 	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const session = await ctx.context.internalAdapter.createSession(user.id);
@@ -83,8 +76,7 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 const electronInitOAuthProxyQuerySchema = z.object({
 	provider: z.string().nonempty(),
 	state: z.string(),
-	code_challenge: z.string(),
-	code_challenge_method: z.string().optional()
+	code_challenge: z.string()
 });
 const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oauth-proxy", {
 	method: "GET",
@@ -122,7 +114,6 @@ const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oaut
 	const searchParams = new URLSearchParams();
 	searchParams.set("client_id", opts.clientID || "electron");
 	searchParams.set("code_challenge", ctx.query.code_challenge);
-	searchParams.set("code_challenge_method", ctx.query.code_challenge_method || "plain");
 	searchParams.set("state", ctx.query.state);
 	const res = await betterFetch(`/sign-in/social?${searchParams.toString()}`, {
 		baseURL: ctx.context.baseURL,
@@ -145,8 +136,7 @@ const electronInitOAuthProxy = (opts) => createAuthEndpoint("/electron/init-oaut
 const electronTransferUserQuerySchema = z.object({
 	client_id: z.string(),
 	state: z.string(),
-	code_challenge: z.string(),
-	code_challenge_method: z.string().optional()
+	code_challenge: z.string()
 });
 const electronTransferUserBodySchema = z.object({ callbackURL: z.string().optional() });
 const electronTransferUser = (_opts, { handleTransfer }) => createAuthEndpoint("/electron/transfer-user", {
@@ -201,7 +191,7 @@ const electron = (options) => {
 		return !!(ctx.path?.startsWith("/sign-in") || ctx.path?.startsWith("/sign-up") || ctx.path?.startsWith("/callback") || ctx.path?.startsWith("/magic-link/verify") || ctx.path?.startsWith("/email-otp/verify-email") || ctx.path?.startsWith("/verify-email") || ctx.path?.startsWith("/one-tap/callback") || ctx.path?.startsWith("/passkey/verify-authentication") || ctx.path?.startsWith("/phone-number/verify"));
 	};
 	const handleTransfer = async (ctx, payload) => {
-		const { client_id, state, code_challenge, code_challenge_method = "plain" } = payload;
+		const { client_id, state, code_challenge } = payload;
 		const userId = ctx.context.session?.user.id || ctx.context.newSession?.user.id;
 		if (!userId || client_id !== opts.clientID) return null;
 		if (!state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_STATE);
@@ -215,7 +205,6 @@ const electron = (options) => {
 			value: JSON.stringify({
 				userId,
 				codeChallenge: code_challenge,
-				codeChallengeMethod: code_challenge_method.toLowerCase(),
 				state
 			}),
 			expiresAt
@@ -234,14 +223,6 @@ const electron = (options) => {
 	return {
 		id: "electron",
 		version: PACKAGE_VERSION,
-		async onRequest(request, _ctx) {
-			if (opts.disableOriginOverride || request.headers.get("origin")) return;
-			const electronOrigin = request.headers.get("electron-origin");
-			if (!electronOrigin) return;
-			const req = request.clone();
-			req.headers.set("origin", electronOrigin);
-			return { request: req };
-		},
 		hooks: { after: [{
 			matcher: (ctx) => !hookMatcher(ctx),
 			handler: createAuthMiddleware(async (ctx) => {
@@ -256,7 +237,6 @@ const electron = (options) => {
 				const querySchema = z.object({
 					client_id: z.string(),
 					code_challenge: z.string().nonempty(),
-					code_challenge_method: z.string().optional().default("plain"),
 					state: z.string().nonempty()
 				});
 				const cookie = ctx.context.createAuthCookie("transfer_token", { maxAge: opts.codeExpiresIn });