@better-auth/infra 0.2.9 → 0.2.10

package/dist/client.mjs

@@ -1,6 +1,6 @@
 import "./constants-CvriWQVc.mjs";
 import { n as createKV } from "./fetch-DiAhoiKA.mjs";
-import { a as generateRequestId, c as hash, i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as identify, r as encodePoWSolution, t as createPowRetryTimeout } from "./pow-retry-BTL4g3RP.mjs";
+import { a as resolveSentinelClientIdentifyUrl, i as solvePoWChallenge, l as hash, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout, u as dashClient } from "./pow-retry-D2RRftJr.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {
@@ -422,11 +422,13 @@ async function waitForIdentify(timeoutMs) {
 }
 //#endregion
 //#region src/sentinel/client.ts
-const DEFAULT_IDENTIFY_URL = "https://kv.better-auth.com";
 const sentinelClient = (options) => {
 	const autoSolve = options?.autoSolveChallenge !== false;
 	const $kv = createKV({
-		kvUrl: options?.identifyUrl ?? env.BETTER_AUTH_KV_URL ?? DEFAULT_IDENTIFY_URL,
+		kvUrl: resolveSentinelClientIdentifyUrl({
+			identifyUrl: options?.identifyUrl,
+			envKvUrl: env.BETTER_AUTH_KV_URL
+		}),
 		kvTimeout: options?.kvTimeout
 	});
 	if (typeof window !== "undefined") {

package/dist/index.d.mts

@@ -770,7 +770,7 @@ interface DashIdRow {
   id: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@better-auth+scim@1.6.9+dd812cddb6773b08/node_modules/@better-auth/scim/dist/index.d.mts
+//#region ../../node_modules/.bun/@better-auth+scim@1.6.11+89e630460ed02574/node_modules/@better-auth/scim/dist/index.d.mts
 //#region src/types.d.ts
 interface SCIMProvider {
   id: string;

package/dist/index.mjs

@@ -2794,7 +2794,7 @@ const jwtValidateMiddleware = (options) => {
 };
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.9";
+const PLUGIN_VERSION = "0.2.10";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3825,6 +3825,23 @@ const checkUserExists = (options) => {
 	});
 };
 //#endregion
+//#region src/routes/organizations/roles.ts
+const DEFAULT_ORG_MEMBER_ROLES = [
+	"member",
+	"admin",
+	"owner"
+];
+function getOrganizationRoleKeys(orgOptions) {
+	const roles = orgOptions?.roles;
+	if (roles && typeof roles === "object" && Object.keys(roles).length > 0) return Object.keys(roles);
+	return [...DEFAULT_ORG_MEMBER_ROLES];
+}
+const organizationMemberRoleInputSchema = z$1.string().trim().min(1, "Role is required").max(64, "Role is too long").regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Role must start with a letter and contain only letters, numbers, hyphens, and underscores");
+function validateOrganizationMemberRole(ctx, role, orgOptions) {
+	const allowedRoles = getOrganizationRoleKeys(orgOptions);
+	if (!allowedRoles.includes(role)) throw ctx.error("BAD_REQUEST", { message: `Invalid role. Allowed roles: ${allowedRoles.join(", ")}` });
+}
+//#endregion
 //#region src/routes/organizations/invitations.ts
 const listOrganizationInvitations = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/invitations", {
@@ -3873,7 +3890,7 @@ const inviteMember = (options) => {
 		method: "POST",
 		body: z$1.object({
 			email: z$1.string(),
-			role: z$1.string(),
+			role: organizationMemberRoleInputSchema,
 			invitedBy: z$1.string()
 		}),
 		use: [jwtMiddleware(options, z$1.object({
@@ -3883,6 +3900,7 @@ const inviteMember = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const organizationPlugin = requireOrganizationPlugin(ctx);
+		validateOrganizationMemberRole(ctx, ctx.body.role, organizationPlugin.options);
 		if (!organizationPlugin.options?.sendInvitationEmail) throw ctx.error("BAD_REQUEST", { message: "Invitation email is not enabled" });
 		const invitedBy = await ctx.context.adapter.findOne({
 			model: "user",
@@ -4132,11 +4150,12 @@ const addMember = (options) => {
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
 		body: z$1.object({
 			userId: z$1.string(),
-			role: z$1.string()
+			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
+		validateOrganizationMemberRole(ctx, ctx.body.role, orgOptions);
 		const organization = await ctx.context.adapter.findOne({
 			model: "organization",
 			where: [{
@@ -4265,11 +4284,12 @@ const updateMemberRole = (options) => {
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
 		body: z$1.object({
 			memberId: z$1.string(),
-			role: z$1.string()
+			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
+		validateOrganizationMemberRole(ctx, ctx.body.role, orgOptions);
 		const existingMember = await ctx.context.adapter.findOne({
 			model: "member",
 			where: [{
@@ -5658,13 +5678,13 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 	});
 });
 //#endregion
-//#region src/validation/ssrf.ts
+//#region ../utils/dist/ip.mjs
 /**
 * SSRF (Server-Side Request Forgery) Protection
 *
-* Validates URLs before server-side fetches to block requests to private/reserved
-* networks. Covers IPv4 private ranges, IPv6 private ranges, and IPv4-mapped IPv6
-* bypass vectors.
+* IP and URL utilities to validate hostnames and URLs before server-side fetches.
+* Blocks requests to private/reserved networks. Covers IPv4 private ranges,
+* IPv6 private ranges, and IPv4-mapped IPv6 bypass vectors.
 */
 function isPrivateIPv4(a, b) {
 	if (a === 10) return true;
@@ -5673,6 +5693,24 @@ function isPrivateIPv4(a, b) {
 	if (a === 127) return true;
 	if (a === 169 && b === 254) return true;
 	if (a === 0) return true;
+	if (a === 100 && b >= 64 && b <= 127) return true;
+	return false;
+}
+/**
+* Loopback, RFC1918, link-local, CGNAT, ULA, documentation, NAT64 well-known,
+* IPv4-mapped private, unspecified, and multicast (RFC 4291 section 2.7).
+*/
+function ipv6GroupsAreNonPublic(groups) {
+	if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1) return true;
+	if (groups.every((g) => g === 0)) return true;
+	if ((groups[0] & 65472) === 65152) return true;
+	if ((groups[0] & 65024) === 64512) return true;
+	if ((groups[0] & 65280) === 65280) return true;
+	if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
+	if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 65535 && groups[5] === 0) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
+	if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((g) => g === 0)) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
+	if (groups[0] === 8193 && groups[1] === 3512) return true;
+	if (groups[0] === 256 && groups.slice(1, 4).every((g) => g === 0)) return true;
 	return false;
 }
 function parseIPv6(addr) {
@@ -5694,36 +5732,174 @@ function parseIPv6(addr) {
 	if (left.length !== 8) return null;
 	return left;
 }
+/** Returns true if the hostname resolves to a private/reserved IP or is a local hostname. */
 function isPrivateHost(hostname) {
 	if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".internal")) return true;
 	const bare = hostname.replace(/^\[|\]$/g, "");
 	const v4parts = bare.split(".").map(Number);
 	if (v4parts.length === 4 && v4parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) return isPrivateIPv4(v4parts[0], v4parts[1]);
 	const groups = parseIPv6(bare);
-	if (groups && groups.length === 8) {
-		if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1) return true;
-		if (groups.every((g) => g === 0)) return true;
-		if ((groups[0] & 65472) === 65152) return true;
-		if ((groups[0] & 65024) === 64512) return true;
-		if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-		if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 65535 && groups[5] === 0) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-		if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((g) => g === 0)) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-		if (groups[0] === 8193 && groups[1] === 3512) return true;
-		if (groups[0] === 256 && groups.slice(1, 4).every((g) => g === 0)) return true;
-	}
+	if (groups && groups.length === 8) return ipv6GroupsAreNonPublic(groups);
 	return false;
 }
-function parseAndValidateUrl(url) {
+//#endregion
+//#region ../utils/dist/url.mjs
+/**
+* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
+*/
+const HTTP_PROTOCOLS = ["http:", "https:"];
+function isAllowedProtocol(protocol, allowedProtocols) {
+	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
+}
+function toAllowedOriginSet(allowedOrigins) {
+	const set = /* @__PURE__ */ new Set();
+	for (const raw of allowedOrigins) try {
+		const parsed = new URL(raw.trim());
+		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
+	} catch {}
+	return set;
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!allowedOrigins.length) return false;
+	return toAllowedOriginSet(allowedOrigins).has(origin);
+}
+async function resolveHostnameAddresses(hostname) {
+	try {
+		const dns = await import("node:dns").catch((e) => {
+			console.warn("Failed to load node:dns for DNS resolution", e);
+			return null;
+		});
+		if (!dns?.promises?.resolve) return null;
+		return await dns.promises.resolve(hostname);
+	} catch {
+		return null;
+	}
+}
+function validateUrlSync(rawUrl, options = {}) {
+	const trimmed = rawUrl.trim();
+	let parsed;
+	try {
+		parsed = new URL(trimmed);
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid_url",
+			url: trimmed
+		};
+	}
+	if (!isAllowedProtocol(parsed.protocol, options.allowedProtocols)) return {
+		ok: false,
+		reason: "disallowed_protocol",
+		url: trimmed,
+		protocol: parsed.protocol
+	};
+	if (parsed.username !== "" || parsed.password !== "") return {
+		ok: false,
+		reason: "embedded_credentials",
+		url: trimmed
+	};
+	if (isPrivateHost(parsed.hostname)) return {
+		ok: false,
+		reason: "private_host",
+		url: trimmed
+	};
+	if (options.allowedOrigins?.length) {
+		if (!isAllowedOrigin(parsed.origin, options.allowedOrigins)) return {
+			ok: false,
+			reason: "disallowed_origin",
+			url: trimmed,
+			hostname: parsed.hostname,
+			origin: parsed.origin
+		};
+	}
+	return {
+		ok: true,
+		url: parsed
+	};
+}
+/** SSRF checks with DNS resolution when available. */
+async function validateUrl(rawUrl, options = {}) {
+	const sync = validateUrlSync(rawUrl, options);
+	if (!sync.ok) return sync;
+	if (options.dns === false) return sync;
+	const addresses = await resolveHostnameAddresses(sync.url.hostname);
+	if (addresses) {
+		for (const addr of addresses) if (isPrivateHost(addr)) return {
+			ok: false,
+			reason: "private_dns",
+			url: sync.url.href,
+			hostname: sync.url.hostname,
+			address: addr
+		};
+	}
+	return sync;
+}
+function safeResolveUrl(raw, baseURL) {
+	const trim = raw.trim();
+	if (!trim) return null;
+	if (trim.startsWith("//") || trim.includes("\\")) return null;
+	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
 	try {
-		const parsed = new URL(url);
-		if (!["http:", "https:"].includes(parsed.protocol)) return null;
-		if (isPrivateHost(parsed.hostname)) return null;
-		return parsed;
+		if (trim.startsWith("/")) return new URL(trim, baseURL);
+		return new URL(trim);
 	} catch {
 		return null;
 	}
 }
 //#endregion
+//#region src/validation/ssrf.ts
+/**
+* SSRF protection for dash plugin outbound fetches.
+*
+* Uses @infra/utils at build time; tsdown bundles it into published dist so
+* consumers do not install the private workspace package.
+*/
+const REDIRECT_STATUSES = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+const MAX_REDIRECTS = 10;
+var SsrfBlockedError = class extends Error {
+	name = "SsrfBlockedError";
+};
+function isSsrfBlockedError(error) {
+	return error instanceof SsrfBlockedError;
+}
+/** Validates URL hostname literals and resolved DNS addresses. */
+async function parseAndValidateUrl(url) {
+	const result = await validateUrl(url);
+	return result.ok ? result.url : null;
+}
+/**
+* Fetch with SSRF checks on the initial URL and every redirect target.
+*/
+async function $outbound(url, options = {}) {
+	const { timeout, signal: callerSignal, ...fetchInit } = options;
+	let currentUrl = url;
+	for (let hop = 0;; hop++) {
+		const validated = await parseAndValidateUrl(currentUrl);
+		if (!validated) throw new SsrfBlockedError("Invalid or blocked URL");
+		const signals = [];
+		if (callerSignal) signals.push(callerSignal);
+		if (timeout !== void 0 && timeout > 0) signals.push(AbortSignal.timeout(timeout));
+		const response = await fetch(validated.href, {
+			...fetchInit,
+			redirect: "manual",
+			signal: signals.length === 0 ? void 0 : signals.length === 1 ? signals[0] : AbortSignal.any(signals)
+		});
+		if (!REDIRECT_STATUSES.has(response.status)) return response;
+		if (hop >= MAX_REDIRECTS) throw new SsrfBlockedError("Too many redirects");
+		await response.body?.cancel().catch(() => {});
+		const location = response.headers.get("location");
+		const next = location ? safeResolveUrl(location, validated.href) : null;
+		if (!next) throw new SsrfBlockedError("Invalid redirect location");
+		currentUrl = next.href;
+	}
+}
+//#endregion
 //#region src/routes/plugin-session.ts
 /**
 * Builds an in-memory session context for calling plugin endpoints
@@ -5836,13 +6012,19 @@ const oidcConfigSchema = z$1.object({
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 	let idpMetadataXml = samlConfig.idpMetadata?.metadata;
 	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) {
-		const validatedMetadataUrl = parseAndValidateUrl(samlConfig.idpMetadata.metadataUrl);
+		const validatedMetadataUrl = await parseAndValidateUrl(samlConfig.idpMetadata.metadataUrl);
 		if (!validatedMetadataUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
 		try {
-			const metadataResponse = await fetch(validatedMetadataUrl.toString());
+			const metadataResponse = await $outbound(validatedMetadataUrl.href, {
+				method: "GET",
+				headers: { Accept: "application/xml, text/xml" },
+				timeout: 15e3
+			});
 			if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
 			idpMetadataXml = await metadataResponse.text();
 		} catch (e) {
+			if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
+			if (e instanceof APIError$1) throw e;
 			ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
 			throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
 		}

package/dist/native.mjs

@@ -1,6 +1,6 @@
 import "./constants-CvriWQVc.mjs";
 import { n as createKV } from "./fetch-DiAhoiKA.mjs";
-import { i as solvePoWChallenge, l as dashClient, n as decodePoWChallenge, o as identify, r as encodePoWSolution, s as bytesToHex, t as createPowRetryTimeout } from "./pow-retry-BTL4g3RP.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as bytesToHex, i as solvePoWChallenge, n as decodePoWChallenge, r as encodePoWSolution, s as identify, t as createPowRetryTimeout, u as dashClient } from "./pow-retry-D2RRftJr.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts
@@ -190,7 +190,6 @@ async function getOrCreateVisitorId(storage) {
 }
 //#endregion
 //#region src/sentinel/native/client.ts
-const DEFAULT_IDENTIFY_URL = "https://kv.better-auth.com";
 function scheduleIdentify(send) {
 	const run = () => {
 		try {
@@ -213,7 +212,10 @@ const sentinelNativeClient = (options) => {
 	const autoSolve = options?.autoSolveChallenge !== false;
 	const runtime = createNativeFingerprintRuntime({
 		$kv: createKV({
-			kvUrl: options?.identifyUrl ?? env.BETTER_AUTH_KV_URL ?? DEFAULT_IDENTIFY_URL,
+			kvUrl: resolveSentinelClientIdentifyUrl({
+				identifyUrl: options?.identifyUrl,
+				envKvUrl: env.BETTER_AUTH_KV_URL
+			}),
 			kvTimeout: options?.kvTimeout
 		}),
 		getOrCreateVisitorId: () => getOrCreateVisitorId(options?.storage)

package/dist/{pow-retry-BTL4g3RP.mjs → pow-retry-D2RRftJr.mjs}

@@ -72,6 +72,39 @@ async function identify($kv, payload) {
 	});
 }
 //#endregion
+//#region src/sentinel/identify-url.ts
+const DEFAULT_IDENTIFY_URL = "https://kv.better-auth.com";
+function normalizeIdentifyUrl(url) {
+	return url.replace(/\/$/, "");
+}
+/** True when the URL targets project-scoped ingestion, e.g. .../projects/{orgId}. */
+function isProjectScopedIdentifyUrl(url) {
+	return /\/projects\/[^/]+$/.test(normalizeIdentifyUrl(url));
+}
+const DEFAULT_GLOBAL_INGESTION_WARNING = "[Sentinel] Default global identify ingestion is active but not recommended. Get your ingestion url from your project settings page (e.g. https://kv.better-auth.com/projects/{id}) and configure sentinelClient({ identifyUrl }) with it.";
+const CONFIGURED_GLOBAL_INGESTION_WARNING = "[Sentinel] Global identify ingestion is configured but not recommended. Get your ingestion url from your project settings page (e.g. https://kv.better-auth.com/projects/{id}) and configure sentinelClient({ identifyUrl }) with it.";
+function warnOnGlobalIdentifyIngestion(url, message) {
+	if (isProjectScopedIdentifyUrl(url)) return;
+	console.warn(message);
+}
+function resolveSentinelClientIdentifyUrl(options) {
+	const explicit = options?.identifyUrl?.trim();
+	if (explicit) {
+		const url = normalizeIdentifyUrl(explicit);
+		warnOnGlobalIdentifyIngestion(url, CONFIGURED_GLOBAL_INGESTION_WARNING);
+		return url;
+	}
+	const fromEnv = options?.envKvUrl?.trim();
+	if (fromEnv) {
+		const url = normalizeIdentifyUrl(fromEnv);
+		warnOnGlobalIdentifyIngestion(url, CONFIGURED_GLOBAL_INGESTION_WARNING);
+		return url;
+	}
+	const url = DEFAULT_IDENTIFY_URL;
+	warnOnGlobalIdentifyIngestion(url, DEFAULT_GLOBAL_INGESTION_WARNING);
+	return url;
+}
+//#endregion
 //#region src/sentinel/pow.ts
 function hasLeadingZeroBits(hash, bits) {
 	const fullHexChars = Math.floor(bits / 4);
@@ -148,4 +181,4 @@ function createPowRetryTimeout(timeoutMs) {
 	};
 }
 //#endregion
-export { generateRequestId as a, hash as c, solvePoWChallenge as i, dashClient as l, decodePoWChallenge as n, identify as o, encodePoWSolution as r, bytesToHex as s, createPowRetryTimeout as t };
+export { resolveSentinelClientIdentifyUrl as a, bytesToHex as c, solvePoWChallenge as i, hash as l, decodePoWChallenge as n, generateRequestId as o, encodePoWSolution as r, identify as s, createPowRetryTimeout as t, dashClient as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -61,24 +61,25 @@
   },
   "homepage": "https://better-auth.com",
   "devDependencies": {
-    "@better-auth/scim": "catalog:",
-    "@better-auth/sso": "catalog:",
-    "@infra/mocks": "workspace:*",
-    "@types/bun": "catalog:",
-    "@types/node": "catalog:",
-    "better-auth": "catalog:",
+    "@better-auth/scim": "1.6.11",
+    "@better-auth/sso": "1.6.11",
+    "@infra/mocks": "0.0.0",
+    "@infra/utils": "0.0.0",
+    "@types/bun": "latest",
+    "@types/node": "^24.12.0",
+    "better-auth": "1.6.11",
     "expo-crypto": "^14.0.2",
     "happy-dom": "^20.9.0",
-    "msw": "catalog:",
+    "msw": "^2.14.6",
     "tsdown": "^0.22.0",
-    "typescript": "catalog:",
-    "zod": "catalog:"
+    "typescript": "^5.9.2",
+    "zod": "^4.3.6"
   },
   "dependencies": {
-    "@better-fetch/fetch": "catalog:",
-    "better-call": "catalog:",
+    "@better-fetch/fetch": "^1.1.21",
+    "better-call": "^1.3.2",
     "jose": "^6.1.0",
-    "libphonenumber-js": "^1.13.1"
+    "libphonenumber-js": "^1.13.2"
   },
   "peerDependencies": {
     "better-auth": ">=1.4.0",