@better-auth/infra 0.2.3 → 0.2.5

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import * as _$better_auth0 from "better-auth";
-import { Account, AuthContext, BetterAuthPlugin, GenericEndpointContext, HookEndpointContext, Session, User } from "better-auth";
+import { Account, AuthContext, BetterAuthPlugin, GenericEndpointContext, Session, User } from "better-auth";
 import * as _$jose from "jose";
 import * as zod from "zod";
 import z$1 from "zod";
@@ -170,9 +170,6 @@ interface SecurityEvent {
 }
 type SecurityEventType = "unknown_device" | "credential_stuffing" | "impossible_travel" | "geo_blocked" | "bot_blocked" | "suspicious_ip_detected" | "velocity_exceeded" | "free_trial_abuse" | "compromised_password" | "stale_account_reactivation";
 //#endregion
-//#region src/validation/matchers.d.ts
-type Matcher = (context: HookEndpointContext) => boolean;
-//#endregion
 //#region src/sentinel/sentinel.d.ts
 declare const sentinel: (options?: SentinelOptions) => {
   id: "sentinel";
@@ -249,7 +246,7 @@ declare const sentinel: (options?: SentinelOptions) => {
   };
   hooks: {
     before: ({
-      matcher: Matcher;
+      matcher: (context: _$better_auth0.HookEndpointContext) => boolean;
       handler: (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         context: {
           method: "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
@@ -421,7 +418,7 @@ declare const sentinel: (options?: SentinelOptions) => {
         };
       } | undefined>;
     } | {
-      matcher: Matcher;
+      matcher: (context: _$better_auth0.HookEndpointContext) => boolean;
       handler: (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>;
     })[];
     after: {
@@ -729,7 +726,7 @@ interface DashIdRow {
   id: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@better-auth+scim@1.6.1+f10cf570321458be/node_modules/@better-auth/scim/dist/index.d.mts
+//#region ../../node_modules/.bun/@better-auth+scim@1.6.4+f772dc2362714ab9/node_modules/@better-auth/scim/dist/index.d.mts
 //#region src/types.d.ts
 interface SCIMProvider {
   id: string;

package/dist/index.mjs

@@ -1398,7 +1398,7 @@ function createSecurityClient(apiUrl, apiKey, options, onSecurityEvent) {
 }
 //#endregion
 //#region src/validation/matchers.ts
-const paths = [
+const all = new Set([
 	"/sign-up/email",
 	"/email-otp/verify-email",
 	"/sign-in/email-otp",
@@ -1413,9 +1413,7 @@ const paths = [
 	"/request-password-reset",
 	"/send-verification-email",
 	"/change-email"
-];
-const all = new Set(paths);
-new Set(paths.slice(1, 12));
+]);
 /**
 * Path is one of `[
 *   '/sign-up/email',
@@ -1687,7 +1685,6 @@ function createEmailHooks(options = {}) {
 		emailValidationOptions: emailConfig
 	}) : void 0, onDisposableEmail)] : []] };
 }
-createEmailHooks();
 //#endregion
 //#region src/validation/phone.ts
 /**
@@ -2757,10 +2754,76 @@ const jwtValidateMiddleware = (options) => createAuthMiddleware(async (ctx) => {
 });
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.3";
+const PLUGIN_VERSION = "0.2.5";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
+const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
+	"accessToken",
+	"apiKey",
+	"apiSecret",
+	"authorization",
+	"authToken",
+	"bearerToken",
+	"clientSecret",
+	"consumerSecret",
+	"encPrivateKey",
+	"encPrivateKeyPass",
+	"encryptionKey",
+	"encryptionSecret",
+	"idToken",
+	"password",
+	"privateKey",
+	"privateKeyPass",
+	"refreshToken",
+	"secret",
+	"secretKey",
+	"signingSecret",
+	"stripeWebhookSecret",
+	"webhookSecret"
+])].map((k) => k.toLowerCase()));
+/**
+* Case-insensitive suffixes for unknown plugin options
+* Matching is more permissive to account for unknown plugin options
+*/
+const SENSITIVE_KEY_SUFFIXES_LOWER = [
+	"secret",
+	"password",
+	"passphrase",
+	"privatekey",
+	"keypass",
+	"apikey",
+	"token",
+	"signingkey",
+	"credentials",
+	"authheader"
+];
+const REDACTED_SIMPLE_STRING = "[REDACTED]";
+function snakeCaseToCamelCase(key) {
+	return key.replace(/_([a-zA-Z])/g, (_, ch) => ch.toUpperCase());
+}
+function keyVariantsForMatching(key) {
+	const trimmed = key.replace(/^[\s._-]+/, "");
+	if (!trimmed) return [key];
+	const out = new Set([key, trimmed]);
+	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
+	return [...out];
+}
+function shouldRedactSensitiveStringKey(key) {
+	const variants = keyVariantsForMatching(key);
+	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
+	const forms = new Set([compactLower]);
+	for (const raw of variants) {
+		forms.add(raw);
+		forms.add(raw.toLowerCase());
+	}
+	for (const form of forms) {
+		const fl = form.toLowerCase();
+		if (EXACT_SENSITIVE_STRING_KEYS_LOWER.has(fl)) return true;
+		for (const suffix of SENSITIVE_KEY_SUFFIXES_LOWER) if (fl.endsWith(suffix)) return true;
+	}
+	return false;
+}
 function isPlainSerializable(value) {
 	if (value === null || typeof value !== "object") return true;
 	if (Array.isArray(value)) return true;
@@ -2769,22 +2832,28 @@ function isPlainSerializable(value) {
 	if (constructor && constructor.name !== "Object" && constructor.name !== "Array") return false;
 	return true;
 }
-function sanitizePluginOptions(pluginId, options, visiting = /* @__PURE__ */ new WeakSet()) {
-	if (options === null || options === void 0) return options;
-	if (typeof options === "function") return void 0;
-	if (typeof options !== "object") return options;
-	const obj = options;
+/**
+* Sanitize any plain JSON-like subtree from Better Auth options
+*/
+function sanitizeConfig(value, visiting, excludeKeys) {
+	if (value === null || value === void 0) return value;
+	if (typeof value === "function") return void 0;
+	if (typeof value !== "object") return value;
+	const obj = value;
 	if (visiting.has(obj)) return void 0;
 	visiting.add(obj);
 	try {
-		const excludeKeys = PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId];
-		if (Array.isArray(options)) return options.map((item) => sanitizePluginOptions(pluginId, item, visiting)).filter((item) => item !== void 0);
+		if (Array.isArray(value)) return value.map((item) => sanitizeConfig(item, visiting, excludeKeys)).filter((item) => item !== void 0);
 		const result = {};
-		for (const [key, value] of Object.entries(options)) {
+		for (const [key, val] of Object.entries(value)) {
 			if (excludeKeys?.has(key)) continue;
-			if (typeof value === "function") continue;
-			if (value !== null && typeof value === "object" && !isPlainSerializable(value)) continue;
-			const sanitized = sanitizePluginOptions(pluginId, value, visiting);
+			if (typeof val === "function") continue;
+			if (typeof val === "string" && shouldRedactSensitiveStringKey(key)) {
+				result[key] = REDACTED_SIMPLE_STRING;
+				continue;
+			}
+			if (val !== null && typeof val === "object" && !isPlainSerializable(val)) continue;
+			const sanitized = sanitizeConfig(val, visiting, excludeKeys);
 			if (sanitized !== void 0) result[key] = sanitized;
 		}
 		return result;
@@ -2792,6 +2861,9 @@ function sanitizePluginOptions(pluginId, options, visiting = /* @__PURE__ */ new
 		visiting.delete(obj);
 	}
 }
+function sanitizePluginOptions(pluginId, options) {
+	return sanitizeConfig(options, /* @__PURE__ */ new WeakSet(), PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId]);
+}
 function estimateEntropy(str) {
 	const unique = new Set(str).size;
 	if (unique === 0) return 0;
@@ -2807,7 +2879,7 @@ const getConfig = (options) => {
 		return {
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
-			emailAndPassword: ctx.context.options.emailAndPassword,
+			emailAndPassword: sanitizeConfig(ctx.context.options.emailAndPassword, /* @__PURE__ */ new WeakSet(), void 0),
 			plugins: ctx.context.options.plugins?.map((plugin) => {
 				const base = {
 					id: plugin.id,
@@ -5424,11 +5496,14 @@ function getSSOPlugin(ctx) {
 const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
 const RSA_SHA1 = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
 const SHA1 = "http://www.w3.org/2000/09/xmldsig#sha1";
+/** @public */
 const DEPRECATED_SIGNATURE_ALGORITHMS = [RSA_SHA1];
+/** @public */
 const DEPRECATED_DIGEST_ALGORITHMS = [SHA1];
 function validateSAMLMetadataSize(metadataXml, maxSize = DEFAULT_MAX_SAML_METADATA_SIZE) {
 	if (new TextEncoder().encode(metadataXml).byteLength > maxSize) throw new Error(`IdP metadata exceeds maximum allowed size (${Math.round(maxSize / 1024)}KB)`);
 }
+/** @public */
 function extractAlgorithmsFromSAMLMetadata(metadataXml) {
 	const signatureAlgorithms = [];
 	const digestAlgorithms = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -68,9 +68,9 @@
     "@types/node": "catalog:",
     "better-auth": "catalog:",
     "expo-crypto": "^14.0.2",
-    "happy-dom": "^20.8.9",
-    "msw": "^2.13.0",
-    "tsdown": "^0.21.8",
+    "happy-dom": "^20.9.0",
+    "msw": "^2.13.3",
+    "tsdown": "^0.21.9",
     "typescript": "catalog:",
     "zod": "catalog:"
   },
@@ -92,6 +92,9 @@
     "expo-device": ">=6.0.0"
   },
   "peerDependenciesMeta": {
+    "react-native": {
+      "optional": true
+    },
     "@react-native-async-storage/async-storage": {
       "optional": true
     },