@better-auth/oauth-provider 1.7.0-beta.0 → 1.7.0-beta.10

package/dist/{client-assertion-DZqo-L5j.mjs → client-assertion-D-tAYsKC.mjs}

@@ -1,21 +1,14 @@
-import { a as getClient } from "./utils-CIbcUsZ5.mjs";
+import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
+import { a as getClient } from "./utils-DO8lmoDw.mjs";
+import { isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { APIError } from "better-call";
-import { ASSERTION_SIGNING_ALGORITHMS, CLIENT_ASSERTION_TYPE } from "@better-auth/core/oauth2";
+import { CLIENT_ASSERTION_TYPE, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
+import { base64Url } from "@better-auth/utils/base64";
+import { createHash } from "@better-auth/utils/hash";
 import { createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
 //#region src/utils/client-assertion.ts
 var client_assertion_exports = /* @__PURE__ */ __exportAll({
+	consumeClientAssertion: () => consumeClientAssertion,
 	isPrivateHostname: () => isPrivateHostname,
 	verifyClientAssertion: () => verifyClientAssertion
 });
@@ -33,36 +26,24 @@ function setJwksCache(uri, jwks, fetchedAt) {
 		if (oldest !== void 0) jwksCache.delete(oldest);
 	}
 }
-const ALGORITHMS_LIST = [...ASSERTION_SIGNING_ALGORITHMS];
-const pendingAssertionIds = /* @__PURE__ */ new Set();
+const ALGORITHMS_LIST = [...PRIVATE_KEY_JWT_SIGNING_ALGORITHMS];
 /**
-* Block SSRF: reject jwks_uri pointing at private/reserved IP ranges.
-* Only HTTPS with public hostnames is allowed.
+* SSRF gate for user-supplied server-side fetch targets (`jwks_uri`,
+* `backchannel_logout_uri`): returns true when the host is NOT publicly
+* routable. That covers loopback, RFC 1918 private, link-local (including AWS
+* IMDS `169.254.169.254`), shared-address-space (carrier-grade NAT),
+* IPv4-mapped IPv6, 6to4/NAT64/Teredo tunnels, every other RFC 6890
+* special-purpose range, and cloud-metadata FQDNs.
+*
+* Delegates to the audited single source of truth so this check cannot drift
+* into the kind of encoding bypass that bespoke regexes invite. This is a
+* syntactic check only: it does not resolve DNS, so a public name that
+* resolves to a private address at fetch time is not caught here.
 */
-function isPrivateIpv4(hostname) {
-	const parts = hostname.split(".");
-	if (parts.length !== 4 || parts.some((p) => !/^\d{1,3}$/.test(p))) return false;
-	const octets = parts.map(Number);
-	const a = octets[0];
-	const b = octets[1];
-	return a === 10 || a === 0 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a === 127;
-}
 function isPrivateHostname(hostname) {
-	const lower = hostname.toLowerCase();
-	const host = lower.startsWith("[") && lower.endsWith("]") ? lower.slice(1, -1) : lower;
-	if (host === "localhost" || host === "::1") return true;
-	if (isPrivateIpv4(host)) return true;
-	if (host.includes(":")) {
-		const v4MappedMatch = host.match(/^(?:0{0,4}:){0,4}:?(?:0{0,4}:)?ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
-		if (v4MappedMatch && isPrivateIpv4(v4MappedMatch[1])) return true;
-		const isLinkLocal = host.startsWith("fe8") || host.startsWith("fe9") || host.startsWith("fea") || host.startsWith("feb");
-		const isUniqueLocal = host.startsWith("fc") || host.startsWith("fd");
-		if (isLinkLocal || isUniqueLocal) return true;
-	}
-	if (host === "metadata.google.internal") return true;
-	return false;
+	return !isPublicRoutableHost(hostname);
 }
-function validateJwksUri(ctx, jwksUri) {
+function validateJwksUri(ctx, jwksUri, clientIdUrlOrigin) {
 	const parsed = new URL(jwksUri);
 	if (parsed.protocol !== "https:") throw new APIError("BAD_REQUEST", {
 		error_description: "jwks_uri must use HTTPS",
@@ -72,11 +53,20 @@ function validateJwksUri(ctx, jwksUri) {
 		error_description: "jwks_uri must not point to a private or reserved address",
 		error: "invalid_client"
 	});
+	if (clientIdUrlOrigin && parsed.origin === clientIdUrlOrigin) return;
 	if (!ctx.context.isTrustedOrigin(parsed.href)) throw new APIError("BAD_REQUEST", {
 		error_description: "client jwks_uri is not trusted",
 		error: "invalid_client"
 	});
 }
+function urlClientIdOrigin(clientId) {
+	if (!clientId.startsWith("https://") && !clientId.startsWith("http://")) return;
+	try {
+		return new URL(clientId).origin;
+	} catch {
+		return;
+	}
+}
 async function fetchJwksFromUri(jwksUri) {
 	const controller = new AbortController();
 	const timeout = setTimeout(() => controller.abort(), JWKS_FETCH_TIMEOUT_MS);
@@ -100,7 +90,7 @@ async function fetchClientJwks(ctx, client) {
 		error_description: "client has no JWKS configured",
 		error: "invalid_client"
 	});
-	validateJwksUri(ctx, client.jwksUri);
+	validateJwksUri(ctx, client.jwksUri, urlClientIdOrigin(client.clientId));
 	const now = Date.now();
 	const cached = jwksCache.get(client.jwksUri);
 	if (cached && now - cached.fetchedAt < JWKS_CACHE_TTL_MS) return cached.jwks;
@@ -132,6 +122,84 @@ async function refetchClientJwks(client) {
 	}
 }
 /**
+* Enforces the assertion-hygiene claims every client-assertion authentication
+* method must check, independent of how the signature is verified or where the
+* verification keys come from:
+* - `aud` MUST include `expectedAudience` (RFC 7523 §3 rule 3),
+* - `exp` MUST be present, unexpired, and at most `assertionMaxLifetime`
+*   seconds away (RFC 7523 §3 rule 4),
+* - `iat`, when present, MUST be within `assertionMaxLifetime`,
+* - `jti` MUST be present and single-use; this consumes a replay tombstone keyed
+*   by `` `${namespace}:${jti}` ``, inserted under the adapter's primary key so a
+*   replay across workers fails atomically.
+*
+* A custom {@link OAuthClientAuthenticationStrategy} should call this after
+* verifying the assertion signature, so an extension method inherits the same
+* replay, lifetime, and audience guarantees as the built-in `private_key_jwt`
+* path, which calls it too.
+*
+* @param params.namespace Scopes the replay tombstone to the method and client,
+*   e.g. `` `${method}:${clientId}` ``, so the same `jti` can recur across
+*   distinct methods or clients but never within one.
+*/
+async function consumeClientAssertion(ctx, opts, params) {
+	const { namespace, payload, expectedAudience } = params;
+	if (!(Array.isArray(payload.aud) ? payload.aud : payload.aud != null ? [payload.aud] : []).includes(expectedAudience)) throw new APIError("BAD_REQUEST", {
+		error_description: "client assertion aud does not match the endpoint",
+		error: "invalid_client"
+	});
+	const maxLifetime = opts.assertionMaxLifetime ?? 300;
+	const now = Math.floor(Date.now() / 1e3);
+	if (typeof payload.exp !== "number") throw new APIError("BAD_REQUEST", {
+		error_description: "client assertion must include exp claim",
+		error: "invalid_client"
+	});
+	if (payload.exp <= now) throw new APIError("BAD_REQUEST", {
+		error_description: "client assertion has expired",
+		error: "invalid_client"
+	});
+	if (payload.exp - now > maxLifetime) throw new APIError("BAD_REQUEST", {
+		error_description: `client assertion exp is too far in the future (max ${maxLifetime}s)`,
+		error: "invalid_client"
+	});
+	if (typeof payload.iat === "number" && now - payload.iat > maxLifetime) throw new APIError("BAD_REQUEST", {
+		error_description: `client assertion iat is too far in the past (max ${maxLifetime}s)`,
+		error: "invalid_client"
+	});
+	if (typeof payload.jti !== "string" || payload.jti.length === 0) throw new APIError("BAD_REQUEST", {
+		error_description: "client assertion must include jti claim",
+		error: "invalid_client"
+	});
+	const jtiDigest = await createHash("SHA-256").digest(new TextEncoder().encode(`${namespace}:${payload.jti}`));
+	const jtiId = base64Url.encode(new Uint8Array(jtiDigest).slice(0, 24), { padding: false });
+	try {
+		await ctx.context.adapter.create({
+			model: "oauthClientAssertion",
+			data: {
+				id: jtiId,
+				expiresAt: /* @__PURE__ */ new Date(payload.exp * 1e3)
+			},
+			forceAllowId: true
+		});
+	} catch (createErr) {
+		let alreadyUsed = false;
+		try {
+			alreadyUsed = Boolean(await ctx.context.adapter.findOne({
+				model: "oauthClientAssertion",
+				where: [{
+					field: "id",
+					value: jtiId
+				}]
+			}));
+		} catch {}
+		if (alreadyUsed) throw new APIError("BAD_REQUEST", {
+			error_description: "client assertion jti has already been used",
+			error: "invalid_client"
+		});
+		throw createErr;
+	}
+}
+/**
 * Verifies a client assertion JWT for `private_key_jwt` authentication.
 *
 * Validates: signature, iss=client_id, sub=client_id, aud=token_endpoint,
@@ -151,7 +219,7 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 			error: "invalid_client"
 		});
 	}
-	if (!header.alg || !ASSERTION_SIGNING_ALGORITHMS.includes(header.alg)) throw new APIError("BAD_REQUEST", {
+	if (!header.alg || !ALGORITHMS_LIST.includes(header.alg)) throw new APIError("BAD_REQUEST", {
 		error_description: `unsupported assertion signing algorithm: ${header.alg}`,
 		error: "invalid_client"
 	});
@@ -188,7 +256,6 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 	});
 	const jwks = await fetchClientJwks(ctx, client);
 	const audience = expectedAudience ?? `${ctx.context.baseURL}/oauth2/token`;
-	const maxLifetime = opts.assertionMaxLifetime ?? 300;
 	const verifyOpts = {
 		issuer: clientId,
 		subject: clientId,
@@ -218,55 +285,12 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 			error: "invalid_client"
 		});
 	}
-	const now = Math.floor(Date.now() / 1e3);
-	if (typeof payload.exp !== "number") throw new APIError("BAD_REQUEST", {
-		error_description: "client assertion must include exp claim",
-		error: "invalid_client"
+	await consumeClientAssertion(ctx, opts, {
+		namespace: `private_key_jwt:${clientId}`,
+		payload,
+		expectedAudience: audience
 	});
-	if (payload.exp - now > maxLifetime) throw new APIError("BAD_REQUEST", {
-		error_description: `client assertion exp is too far in the future (max ${maxLifetime}s)`,
-		error: "invalid_client"
-	});
-	if (typeof payload.iat === "number" && now - payload.iat > maxLifetime) throw new APIError("BAD_REQUEST", {
-		error_description: `client assertion iat is too far in the past (max ${maxLifetime}s)`,
-		error: "invalid_client"
-	});
-	if (!payload.jti) throw new APIError("BAD_REQUEST", {
-		error_description: "client assertion must include jti claim",
-		error: "invalid_client"
-	});
-	const jtiIdentifier = `private_key_jwt:${clientId}:${payload.jti}`;
-	if (pendingAssertionIds.has(jtiIdentifier)) throw new APIError("BAD_REQUEST", {
-		error_description: "client assertion jti has already been used",
-		error: "invalid_client"
-	});
-	pendingAssertionIds.add(jtiIdentifier);
-	try {
-		if (await ctx.context.internalAdapter.findVerificationValue(jtiIdentifier)) throw new APIError("BAD_REQUEST", {
-			error_description: "client assertion jti has already been used",
-			error: "invalid_client"
-		});
-		const jtiExpiry = /* @__PURE__ */ new Date(payload.exp * 1e3);
-		try {
-			await ctx.context.internalAdapter.createVerificationValue({
-				identifier: jtiIdentifier,
-				value: clientId,
-				expiresAt: jtiExpiry
-			});
-		} catch (createErr) {
-			if (await ctx.context.internalAdapter.findVerificationValue(jtiIdentifier)) throw new APIError("BAD_REQUEST", {
-				error_description: "client assertion jti has already been used",
-				error: "invalid_client"
-			});
-			throw createErr;
-		}
-	} finally {
-		pendingAssertionIds.delete(jtiIdentifier);
-	}
-	return {
-		clientId,
-		client
-	};
+	return { clientId };
 }
 //#endregion
-export { isPrivateHostname as n, client_assertion_exports as t };
+export { consumeClientAssertion as n, isPrivateHostname as r, client_assertion_exports as t };

package/dist/client-resource.d.mts

@@ -1,9 +1,17 @@
-import { a as ResourceServerMetadata } from "./oauth-C8aTlaAC.mjs";
+import { c as ResourceServerMetadata } from "./oauth-ScTJEcFV.mjs";
+import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
-import { Auth } from "better-auth/types";
+import { BetterAuthOptions } from "better-auth/types";
 
 //#region src/client-resource.d.ts
-declare const oauthProviderResourceClient: <T extends Auth | undefined>(auth?: T) => {
+type ResourceClientAuth = {
+  options: {
+    baseURL?: BetterAuthOptions["baseURL"];
+    basePath?: BetterAuthOptions["basePath"];
+  };
+  $context: Promise<unknown>;
+};
+declare const oauthProviderResourceClient: <T extends ResourceClientAuth | undefined = undefined>(auth?: T) => {
   id: "oauth-provider-resource-client";
   version: string;
   getActions(): {
@@ -15,7 +23,14 @@ declare const oauthProviderResourceClient: <T extends Auth | undefined>(auth?: T
      *
      * The optional auth parameter can fill known values automatically.
      */
-    verifyAccessToken: VerifyAccessTokenOutput<T>;
+    verifyBearerToken: VerifyAccessTokenOutput<T>;
+    /**
+     * Performs verification of a protected-resource request. Use this for
+     * new resource-server integrations so sender-constrained DPoP access
+     * tokens are enforced with the request method, URL, Authorization
+     * scheme, DPoP proof, `ath`, and `cnf.jkt` binding.
+     */
+    verifyAccessTokenRequest: VerifyAccessTokenRequestOutput<T>;
     /**
      * An authorization server does not typically publish
      * the `/.well-known/oauth-protected-resource` themselves.
@@ -42,8 +57,23 @@ interface VerifyAccessTokenRemote {
    * is also still active.
    */
   force?: boolean;
+  /**
+   * Accept introspection responses that omit the `aud` claim even when a
+   * required `audience` is configured in `verifyOptions`.
+   *
+   * By default verification fails closed: if you configure an `audience` and
+   * the introspection response has no `aud` (or a mismatching one), the token
+   * is rejected. Some authorization servers legitimately omit `aud` from
+   * introspection responses (it is OPTIONAL per RFC 7662 §2.2); only enable
+   * this if you trust the issuer to bind the token to this resource through
+   * another mechanism, as it skips the audience check in that case.
+   *
+   * @default false
+   */
+  allowMissingAudience?: boolean;
 }
-type VerifyAccessTokenOutput<T> = T extends Auth ? (token: string | undefined, opts?: VerifyAccessTokenAuthOpts) => Promise<JWTPayload> : (token: string | undefined, opts: VerifyAccessTokenNoAuthOpts) => Promise<JWTPayload>;
+type VerifyAccessTokenOutput<T> = T extends undefined ? (token: string | undefined, opts: VerifyAccessTokenNoAuthOpts) => Promise<JWTPayload> : (token: string | undefined, opts?: VerifyAccessTokenAuthOpts) => Promise<JWTPayload>;
+type VerifyAccessTokenRequestOutput<T> = T extends undefined ? (request: Request | ResourceRequestInput, opts: VerifyAccessTokenRequestNoAuthOpts) => Promise<JWTPayload> : (request: Request | ResourceRequestInput, opts?: VerifyAccessTokenRequestAuthOpts) => Promise<JWTPayload>;
 type VerifyAccessTokenAuthOpts = {
   verifyOptions?: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience">>;
   scopes?: string[];
@@ -51,6 +81,9 @@ type VerifyAccessTokenAuthOpts = {
   remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
+type VerifyAccessTokenRequestAuthOpts = VerifyAccessTokenAuthOpts & {
+  dpop?: VerifyAccessTokenRequestOptions["dpop"];
+};
 type VerifyAccessTokenNoAuthOpts = {
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
   scopes?: string[];
@@ -64,12 +97,15 @@ type VerifyAccessTokenNoAuthOpts = {
   remoteVerify: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
-type ProtectedResourceMetadataOutput<T> = T extends Auth ? (overrides?: Partial<ResourceServerMetadata>, opts?: {
+type VerifyAccessTokenRequestNoAuthOpts = VerifyAccessTokenNoAuthOpts & {
+  dpop?: VerifyAccessTokenRequestOptions["dpop"];
+};
+type ProtectedResourceMetadataOutput<T> = T extends undefined ? (overrides: ResourceServerMetadata, opts?: {
   silenceWarnings?: {
     oidcScopes?: boolean;
   };
   externalScopes?: string[];
-}) => Promise<ResourceServerMetadata> : (overrides: ResourceServerMetadata, opts?: {
+}) => Promise<ResourceServerMetadata> : (overrides?: Partial<ResourceServerMetadata>, opts?: {
   silenceWarnings?: {
     oidcScopes?: boolean;
   };

package/dist/client-resource.mjs

@@ -1,10 +1,10 @@
-import { t as handleMcpErrors } from "./mcp-CYnz-MXn.mjs";
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-CIbcUsZ5.mjs";
-import { t as PACKAGE_VERSION } from "./version-BGWhjYBb.mjs";
-import { verifyAccessToken } from "better-auth/oauth2";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-DO8lmoDw.mjs";
+import { t as PACKAGE_VERSION } from "./version-a5HhJg8A.mjs";
+import { t as raiseResourceServerChallenge } from "./resource-challenge-B-cqv4ur.mjs";
 import { APIError } from "better-call";
 import { logger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
+import { DPOP_SIGNING_ALGORITHMS, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken } from "better-auth/oauth2";
 //#region src/client-resource.ts
 const oauthProviderResourceClient = (auth) => {
 	let oauthProviderPlugin;
@@ -22,36 +22,55 @@ const oauthProviderResourceClient = (auth) => {
 		return (await getJwtPluginOptions())?.jwt?.issuer ?? authServerBaseUrl;
 	};
 	const authServerBasePath = auth?.options.basePath;
+	const resolveVerifyAccessTokenOptions = async (opts) => {
+		const jwtPluginOptions = await getJwtPluginOptions();
+		const audience = opts?.verifyOptions?.audience ?? authServerBaseUrl;
+		const issuer = opts?.verifyOptions?.issuer ?? jwtPluginOptions?.jwt?.issuer ?? authServerBaseUrl;
+		if (!audience) throw Error("please define opts.verifyOptions.audience");
+		if (!issuer) throw Error("please define opts.verifyOptions.issuer");
+		const jwksUrl = opts?.jwksUrl ?? jwtPluginOptions?.jwks?.remoteUrl ?? (authServerBaseUrl ? `${authServerBaseUrl + (authServerBasePath ?? "")}${jwtPluginOptions?.jwks?.jwksPath ?? "/jwks"}` : void 0);
+		const introspectUrl = opts?.remoteVerify?.introspectUrl ?? (authServerBaseUrl ? `${authServerBaseUrl}${authServerBasePath ?? ""}/oauth2/introspect` : void 0);
+		return {
+			...opts,
+			jwksUrl,
+			verifyOptions: {
+				...opts?.verifyOptions,
+				audience,
+				issuer
+			},
+			remoteVerify: opts?.remoteVerify && introspectUrl ? {
+				...opts.remoteVerify,
+				introspectUrl
+			} : void 0
+		};
+	};
+	const toResourceRequestInput = (request) => typeof request.headers?.get === "function" ? requestToResourceInput(request) : request;
 	return {
 		id: "oauth-provider-resource-client",
 		version: PACKAGE_VERSION,
 		getActions() {
 			return {
-				verifyAccessToken: (async (token, opts) => {
-					const jwtPluginOptions = await getJwtPluginOptions();
-					const audience = opts?.verifyOptions?.audience ?? authServerBaseUrl;
-					const issuer = opts?.verifyOptions?.issuer ?? jwtPluginOptions?.jwt?.issuer ?? authServerBaseUrl;
-					if (!audience) throw Error("please define opts.verifyOptions.audience");
-					if (!issuer) throw Error("please define opts.verifyOptions.issuer");
-					const jwksUrl = opts?.jwksUrl ?? jwtPluginOptions?.jwks?.remoteUrl ?? (authServerBaseUrl ? `${authServerBaseUrl + (authServerBasePath ?? "")}${jwtPluginOptions?.jwks?.jwksPath ?? "/jwks"}` : void 0);
-					const introspectUrl = opts?.remoteVerify?.introspectUrl ?? (authServerBaseUrl ? `${authServerBaseUrl}${authServerBasePath ?? ""}/oauth2/introspect` : void 0);
+				verifyBearerToken: (async (token, opts) => {
+					const verifyOptions = await resolveVerifyAccessTokenOptions(opts);
 					try {
 						if (!token?.length) throw new APIError("UNAUTHORIZED", { message: "missing authorization header" });
-						return await verifyAccessToken(token, {
-							...opts,
-							jwksUrl,
-							verifyOptions: {
-								...opts?.verifyOptions,
-								audience,
-								issuer
-							},
-							remoteVerify: opts?.remoteVerify && introspectUrl ? {
-								...opts.remoteVerify,
-								introspectUrl
-							} : void 0
+						return await verifyBearerToken(token, verifyOptions);
+					} catch (error) {
+						raiseResourceServerChallenge(error, verifyOptions.verifyOptions.audience, {
+							resourceMetadataMappings: opts?.resourceMetadataMappings,
+							dpopSigningAlgorithms: DPOP_SIGNING_ALGORITHMS
 						});
+					}
+				}),
+				verifyAccessTokenRequest: (async (request, opts) => {
+					const verifyOptions = await resolveVerifyAccessTokenOptions(opts);
+					try {
+						return await verifyAccessTokenRequest(toResourceRequestInput(request), verifyOptions);
 					} catch (error) {
-						throw handleMcpErrors(error, audience, { resourceMetadataMappings: opts?.resourceMetadataMappings });
+						raiseResourceServerChallenge(error, verifyOptions.verifyOptions.audience, {
+							resourceMetadataMappings: opts?.resourceMetadataMappings,
+							dpopSigningAlgorithms: opts?.dpop?.signingAlgorithms ?? DPOP_SIGNING_ALGORITHMS
+						});
 					}
 				}),
 				getProtectedResourceMetadata: (async (overrides, opts) => {
@@ -78,6 +97,7 @@ const oauthProviderResourceClient = (auth) => {
 					return {
 						resource,
 						authorization_servers: authorizationServer ? [authorizationServer] : void 0,
+						dpop_signing_alg_values_supported: [...oauthProviderOptions?.dpop?.signingAlgorithms ?? DPOP_SIGNING_ALGORITHMS],
 						...overrides
 					};
 				})

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { n as oauthProvider } from "./oauth-Dh4YXCXY.mjs";
+import { r as oauthProvider } from "./oauth-BrNRbP2A.mjs";
 import * as _better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,17 +1,7 @@
-import { t as PACKAGE_VERSION } from "./version-BGWhjYBb.mjs";
+import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
+import { t as PACKAGE_VERSION } from "./version-a5HhJg8A.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 //#region src/client.ts
-function parseSignedQuery(search) {
-	const params = new URLSearchParams(search);
-	if (params.has("sig")) {
-		const signedParams = new URLSearchParams();
-		for (const [key, value] of params.entries()) {
-			signedParams.append(key, value);
-			if (key === "sig") break;
-		}
-		return signedParams.toString();
-	}
-}
 const oauthProviderClient = () => {
 	return {
 		id: "oauth-provider-client",
@@ -26,7 +16,7 @@ const oauthProviderClient = () => {
 				if (body?.oauth_query) return;
 				if (typeof window !== "undefined" && window?.location?.search && !(ctx.method === "GET" || ctx.method === "DELETE")) ctx.body = JSON.stringify({
 					...body,
-					oauth_query: parseSignedQuery(window.location.search)
+					oauth_query: buildSignedOAuthQuery(window.location.search)
 				});
 			} }
 		}],