@better-auth/infra 0.1.11 → 0.1.12

package/dist/index.mjs

@@ -815,7 +815,10 @@ const getOrganizationTriggerInfo = (user) => {
 const initTrackEvents = (options) => {
 	const $fetch = createFetch({
 		baseURL: options.apiUrl,
-		headers: { "x-api-key": options.apiKey }
+		headers: {
+			"user-agent": "better-auth",
+			"x-api-key": options.apiKey
+		}
 	});
 	const trackEvent = (data) => {
 		const track = async () => {
@@ -2678,13 +2681,16 @@ function isRecentlyIssued(payload) {
 }
 const jwtMiddleware = (options, schema, getJWT) => createAuthMiddleware(async (ctx) => {
 	const jwsFromHeader = getJWT ? await getJWT(ctx) : ctx.headers?.get("Authorization")?.split(" ")[1];
-	if (!jwsFromHeader) throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	if (!jwsFromHeader) {
+		ctx.context.logger.warn("[Dash] JWT is missing from header");
+		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	}
 	const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(options.apiUrl), { maxTokenAge: "5m" }).catch((e) => {
-		ctx.context.logger.error("[Dash] JWT verification failed:", e);
+		ctx.context.logger.warn("[Dash] JWT verification failed:", e);
 		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 	});
 	if (!isRecentlyIssued(payload)) {
-		if (!(await betterFetch("/api/auth/check-jti", {
+		const { error, data } = await betterFetch("/api/auth/check-jti", {
 			baseURL: options.apiUrl,
 			method: "POST",
 			headers: { "x-api-key": options.apiKey },
@@ -2692,18 +2698,52 @@ const jwtMiddleware = (options, schema, getJWT) => createAuthMiddleware(async (c
 				jti: payload.jti,
 				expiresAt: payload.exp
 			}
-		})).data?.valid) throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		});
+		if (error || !data?.valid) {
+			ctx.context.logger.warn("[Dash] JTI check failed with error", error, data?.valid);
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
 	}
 	const apiKeyHash = payload.apiKeyHash;
-	if (typeof apiKeyHash !== "string" || !options.apiKey) throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
-	if (apiKeyHash !== await hash(options.apiKey)) throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	if (typeof apiKeyHash !== "string" || !options.apiKey) {
+		ctx.context.logger.warn("[Dash] API key hash is missing or invalid", {
+			apiKeyHash,
+			apiKey: options.apiKey ? "present" : "missing"
+		});
+		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	}
+	const expectedHash = await hash(options.apiKey);
+	if (apiKeyHash !== expectedHash) {
+		ctx.context.logger.warn("[Dash] API key hash is invalid", apiKeyHash, expectedHash);
+		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	}
 	if (schema) {
 		const parsed = schema.safeParse(payload);
-		if (!parsed.success) throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		if (!parsed.success) {
+			ctx.context.logger.warn("[Dash] JWT payload is invalid", parsed.error);
+			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+		}
 		return { payload: parsed.data };
 	}
 	return { payload };
 });
+/**
+* Lightweight JWT middleware for /dash/validate. Verifies JWT signature and
+* apiKeyHash only—no JTI check. Used during onboarding when the org doesn't
+* exist yet.
+*/
+const jwtValidateMiddleware = (options) => createAuthMiddleware(async (ctx) => {
+	const jwsFromHeader = ctx.headers?.get("Authorization")?.split(" ")[1];
+	if (!jwsFromHeader) throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(options.apiUrl), { maxTokenAge: "5m" }).catch((e) => {
+		ctx.context.logger.error("[Dash] JWT verification failed:", e);
+		throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	});
+	const apiKeyHash = payload.apiKeyHash;
+	if (typeof apiKeyHash !== "string" || !options.apiKey) throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	if (apiKeyHash !== await hash(options.apiKey)) throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
+	return { payload };
+});
 
 //#endregion
 //#region src/routes/config.ts
@@ -7419,6 +7459,20 @@ const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-back
 	return { backupCodes: newBackupCodes };
 });
 
+//#endregion
+//#region src/routes/validate.ts
+/**
+* Lightweight endpoint to verify API key ownership during onboarding
+*/
+const getValidate = (options) => {
+	return createAuthEndpoint("/dash/validate", {
+		method: "GET",
+		use: [jwtValidateMiddleware(options)]
+	}, async () => {
+		return { valid: true };
+	});
+};
+
 //#endregion
 //#region src/pow.ts
 /** Default difficulty in bits (18 = ~500ms solve time) */
@@ -7922,6 +7976,7 @@ const dash = (options) => {
 		},
 		endpoints: {
 			getDashConfig: getConfig(opts),
+			getDashValidate: getValidate(opts),
 			getDashUsers: getUsers(opts),
 			exportDashUsers: exportUsers(opts),
 			getOnlineUsersCount: getOnlineUsersCount(opts),

package/package.json

@@ -1,12 +1,19 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
   "module": "dist/index.mjs",
   "types": "dist/index.d.mts",
   "sideEffects": false,
+  "scripts": {
+    "build": "tsdown ",
+    "dev": "tsdown --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "test:watch": "bun test --watch"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.mts",
@@ -49,11 +56,11 @@
   "homepage": "https://better-auth.com",
   "devDependencies": {
     "@types/bun": "latest",
-    "@types/node": "^24.12.0",
+    "@types/node": "catalog:",
     "better-auth": "beta",
     "@better-auth/scim": "beta",
     "tsdown": "^0.19.0-beta.2",
-    "typescript": "^5.9.2",
+    "typescript": "catalog:",
     "zod": "beta"
   },
   "dependencies": {
@@ -67,12 +74,5 @@
     "zod": ">=4.1.12",
     "@better-auth/core": ">=1.4.0",
     "@better-auth/sso": ">=1.4.0"
-  },
-  "scripts": {
-    "build": "tsdown ",
-    "dev": "tsdown --watch",
-    "typecheck": "tsc --noEmit",
-    "test": "bun test",
-    "test:watch": "bun test --watch"
   }
-}
+}