@better-auth/oauth-provider 1.6.1 → 1.6.2

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { a as getJwtPlugin, o as getOAuthProviderPlugin, v as handleMcpErrors } from "./utils-sQ4gYeh3.mjs";
-import { t as PACKAGE_VERSION } from "./version-xqVKoocI.mjs";
+import { a as getJwtPlugin, o as getOAuthProviderPlugin, y as handleMcpErrors } from "./utils-B9Pj9EPf.mjs";
+import { t as PACKAGE_VERSION } from "./version-Usf6Oz_M.mjs";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { APIError } from "better-call";
 import { logger } from "@better-auth/core/env";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { n as oauthProvider } from "./oauth-CYgzO8Am.mjs";
+import { n as oauthProvider } from "./oauth-CetEXi_Z.mjs";
 import * as _better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-xqVKoocI.mjs";
+import { t as PACKAGE_VERSION } from "./version-Usf6Oz_M.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 //#region src/client.ts
 function parseSignedQuery(search) {

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { _ as Awaitable, a as ResourceServerMetadata, c as OAuthConsent, d as OAuthRefreshToken, f as Prompt, g as VerificationValue, h as StoreTokenType, i as OIDCMetadata, l as OAuthOpaqueAccessToken, m as Scope, n as GrantType, o as AuthorizePrompt, p as SchemaClient, r as OAuthClient, s as OAuthAuthorizationQuery, t as AuthServerMetadata, u as OAuthOptions } from "./oauth-Cc0nzj5Q.mjs";
-import { n as oauthProvider, t as getOAuthProviderState } from "./oauth-CYgzO8Am.mjs";
+import { n as oauthProvider, t as getOAuthProviderState } from "./oauth-CetEXi_Z.mjs";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { JWTPayload } from "jose";

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { _ as verifyOAuthQueryParams, a as getJwtPlugin, c as isPKCERequired, d as parsePrompt, f as resolveSessionAuthTime, g as validateClientCredentials, h as storeToken, i as getClient, l as normalizeTimestampValue, m as storeClientSecret, n as decryptStoredClientSecret, p as resolveSubjectIdentifier, r as deleteFromPrompt, s as getStoredToken, t as basicToClientCredentials, u as parseClientMetadata, y as mcpHandler } from "./utils-sQ4gYeh3.mjs";
-import { t as PACKAGE_VERSION } from "./version-xqVKoocI.mjs";
+import { _ as validateClientCredentials, a as getJwtPlugin, b as mcpHandler, c as isPKCERequired, d as parsePrompt, f as resolveSessionAuthTime, g as storeToken, h as storeClientSecret, i as getClient, l as normalizeTimestampValue, m as searchParamsToQuery, n as decryptStoredClientSecret, p as resolveSubjectIdentifier, r as deleteFromPrompt, s as getStoredToken, t as basicToClientCredentials, u as parseClientMetadata, v as verifyOAuthQueryParams } from "./utils-B9Pj9EPf.mjs";
+import { t as PACKAGE_VERSION } from "./version-Usf6Oz_M.mjs";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getOAuthState, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { generateCodeChallenge, getJwks, verifyJwsAccessToken } from "better-auth/oauth2";
 import { APIError as APIError$1 } from "better-call";
@@ -145,7 +145,7 @@ async function postLogin(ctx, opts) {
 	});
 	const query = new URLSearchParams(_query);
 	ctx.headers?.set("accept", "application/json");
-	ctx.query = Object.fromEntries(query);
+	ctx.query = searchParamsToQuery(query);
 	const { url } = await authorizeEndpoint(ctx, opts, { postLogin: true });
 	return {
 		redirect: true,
@@ -1172,10 +1172,6 @@ async function checkOAuthClient(client, opts, settings) {
 		error: "invalid_client_metadata",
 		error_description: `pkce is required for registered clients.`
 	});
-	if (settings?.isRegister && client.skip_consent) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "skip_consent cannot be set during dynamic client registration"
-	});
 }
 async function createOAuthClientEndpoint(ctx, opts, settings) {
 	const body = ctx.body;
@@ -3449,7 +3445,7 @@ const oauthProvider = (options) => {
 						"user-agent-based"
 					]).optional(),
 					subject_type: z.enum(["public", "pairwise"]).optional(),
-					skip_consent: z.boolean().optional()
+					skip_consent: z.never({ error: "skip_consent cannot be set during dynamic client registration" }).optional()
 				}),
 				metadata: { openapi: {
 					description: "Register an OAuth2 application",
@@ -3850,7 +3846,11 @@ async function authorizeEndpoint(ctx, opts, settings) {
 }
 function serializeAuthorizationQuery(query) {
 	const params = new URLSearchParams();
-	for (const [key, value] of Object.entries(query)) if (value != null) params.set(key, String(value));
+	for (const [key, value] of Object.entries(query)) {
+		if (value == null) continue;
+		if (Array.isArray(value)) for (const v of value) params.append(key, String(v));
+		else params.set(key, String(value));
+	}
 	return params;
 }
 async function redirectWithAuthorizationCode(ctx, opts, verificationValue) {

package/dist/{oauth-CYgzO8Am.d.mts → oauth-CetEXi_Z.d.mts}

@@ -849,7 +849,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           public: "public";
           pairwise: "pairwise";
         }>>;
-        skip_consent: z.ZodOptional<z.ZodBoolean>;
+        skip_consent: z.ZodOptional<z.ZodNever>;
       }, z.core.$strip>;
       metadata: {
         openapi: {

package/dist/{utils-sQ4gYeh3.mjs → utils-B9Pj9EPf.mjs}

@@ -358,6 +358,18 @@ async function resolveSubjectIdentifier(userId, client, opts) {
 	return userId;
 }
 /**
+* Converts URLSearchParams to a plain object, preserving
+* multi-valued keys as arrays instead of discarding duplicates.
+*/
+function searchParamsToQuery(params) {
+	const result = Object.create(null);
+	for (const key of new Set(params.keys())) {
+		const values = params.getAll(key);
+		result[key] = values.length === 1 ? values[0] : values;
+	}
+	return result;
+}
+/**
 * Deletes a prompt value
 *
 * @param ctx
@@ -370,7 +382,7 @@ function deleteFromPrompt(query, prompt) {
 		prompts?.splice(foundPrompt, 1);
 		prompts?.length ? query.set("prompt", prompts.join(" ")) : query.delete("prompt");
 	}
-	return Object.fromEntries(query);
+	return searchParamsToQuery(query);
 }
 var PKCERequirementErrors = /* @__PURE__ */ function(PKCERequirementErrors) {
 	PKCERequirementErrors["PUBLIC_CLIENT"] = "pkce is required for public clients";
@@ -399,4 +411,4 @@ function isPKCERequired(client, requestedScopes) {
 	return false;
 }
 //#endregion
-export { verifyOAuthQueryParams as _, getJwtPlugin as a, isPKCERequired as c, parsePrompt as d, resolveSessionAuthTime as f, validateClientCredentials as g, storeToken as h, getClient as i, normalizeTimestampValue as l, storeClientSecret as m, decryptStoredClientSecret as n, getOAuthProviderPlugin as o, resolveSubjectIdentifier as p, deleteFromPrompt as r, getStoredToken as s, basicToClientCredentials as t, parseClientMetadata as u, handleMcpErrors as v, mcpHandler as y };
+export { validateClientCredentials as _, getJwtPlugin as a, mcpHandler as b, isPKCERequired as c, parsePrompt as d, resolveSessionAuthTime as f, storeToken as g, storeClientSecret as h, getClient as i, normalizeTimestampValue as l, searchParamsToQuery as m, decryptStoredClientSecret as n, getOAuthProviderPlugin as o, resolveSubjectIdentifier as p, deleteFromPrompt as r, getStoredToken as s, basicToClientCredentials as t, parseClientMetadata as u, verifyOAuthQueryParams as v, handleMcpErrors as y };

package/dist/{version-xqVKoocI.mjs → version-Usf6Oz_M.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.1";
+const PACKAGE_VERSION = "1.6.2";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -64,15 +64,15 @@
     "@modelcontextprotocol/sdk": "^1.27.1",
     "listhen": "^1.9.0",
     "tsdown": "0.21.1",
-    "better-auth": "1.6.1",
-    "@better-auth/core": "1.6.1"
+    "@better-auth/core": "1.6.2",
+    "better-auth": "1.6.2"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.0",
     "@better-fetch/fetch": "1.1.21",
     "better-call": "1.3.5",
-    "@better-auth/core": "^1.6.1",
-    "better-auth": "^1.6.1"
+    "@better-auth/core": "^1.6.2",
+    "better-auth": "^1.6.2"
   },
   "scripts": {
     "build": "tsdown",