@better-auth/oauth-provider 1.7.0-beta.0 → 1.7.0-beta.10

package/dist/index.d.mts

@@ -1,35 +1,92 @@
-import { _ as Awaitable, a as ResourceServerMetadata, c as OAuthConsent, d as OAuthRefreshToken, f as Prompt, g as VerificationValue, h as StoreTokenType, i as OIDCMetadata, l as OAuthOpaqueAccessToken, m as Scope, n as GrantType, o as AuthorizePrompt, p as SchemaClient, r as OAuthClient, s as OAuthAuthorizationQuery, t as AuthServerMetadata, u as OAuthOptions } from "./oauth-C8aTlaAC.mjs";
-import { n as oauthProvider, t as getOAuthProviderState } from "./oauth-Dh4YXCXY.mjs";
-import { verifyAccessToken } from "better-auth/oauth2";
+import { A as OAuthProviderExtension, B as StoreTokenType, C as OAuthConsent, D as OAuthOpaqueAccessToken, E as OAuthMetadataExtensionInput, F as OAuthTokenResponse, H as VerificationValue, I as OAuthUserInfoExtensionInput, L as Prompt, M as OAuthResource, N as OAuthResourceInput, O as OAuthOptions, P as OAuthTokenIssueParams, R as SchemaClient, S as OAuthClientResource, T as OAuthExtensionGrantHandlerInput, U as ClientRegistrationRequest, V as StoredAuthorizationQuery, W as ResourceUriSchema, _ as OAuthClaimExtensionInput, a as GrantType, b as OAuthClientAuthenticationResult, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthorizationQuery, h as OAuthAuthenticatedClient, i as Confirmation, j as OAuthRefreshToken, k as OAuthProviderApi, l as TokenEndpointAuthMethod, m as InitialAccessTokenAuthorization, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClientAuthenticationInput, w as OAuthExtensionGrantHandler, x as OAuthClientAuthenticationStrategy, y as OAuthClientAuthenticationRequest, z as Scope } from "./oauth-ScTJEcFV.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-BrNRbP2A.mjs";
+import { getSessionFromCtx } from "better-auth/api";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
-import { JWTPayload } from "jose";
-import { GenericEndpointContext } from "@better-auth/core";
+import { AuthContext, GenericEndpointContext } from "@better-auth/core";
+import * as better_auth0 from "better-auth";
 
-//#region src/mcp.d.ts
+//#region src/extensions.d.ts
 /**
- * A request middleware handler that checks and responds with
- * a WWW-Authenticate header for unauthenticated responses.
+ * Registers an {@link OAuthProviderExtension} with the OAuth Provider plugin
+ * from a companion plugin's `init()` hook. An extension can add token grants,
+ * assertion-based client authentication methods, additive discovery metadata,
+ * access-token / ID-token / UserInfo claims, and client-id discovery, without
+ * forking provider core.
  *
- * @external
+ * Call this once, at `init()` time. It is idempotent in the same `extension`
+ * object, so re-running a plugin's `init()` (for example when one plugin factory
+ * result is shared across two `betterAuth()` instances) does not register it
+ * twice. It throws if the oauth-provider plugin is not installed, if a grant
+ * type or assertion type is not an absolute URI, if a client authentication
+ * method reuses a built-in name, or if the extension registers a grant type,
+ * auth method, or assertion type that another extension already registered
+ * (contributions must be disjoint).
+ *
+ * @example
+ * ```ts
+ * init(ctx) {
+ *   extendOAuthProvider(ctx, {
+ *     grants: { "urn:example:grant": async ({ provider }) => provider.issueTokens(...) },
+ *   });
+ * }
+ * ```
  */
-declare const mcpHandler: (/** Resource is the same url as the audience */
-
-verifyOptions: Parameters<typeof verifyAccessToken>[1], handler: (req: Request, jwt: JWTPayload) => Awaitable<Response>, opts?: {
-  /** Maps non-url (ie urn, client) resources to resource_metadata */resourceMetadataMappings: Record<string, string>;
-}) => (req: Request) => Promise<Response>;
+declare function extendOAuthProvider(ctx: AuthContext, extension: OAuthProviderExtension): void;
 //#endregion
 //#region src/metadata.d.ts
 declare function authServerMetadata(ctx: GenericEndpointContext, opts?: JwtOptions, overrides?: {
   scopes_supported?: AuthServerMetadata["scopes_supported"];
+  dynamic_client_registration_supported?: boolean;
   public_client_supported?: boolean;
   grant_types_supported?: GrantType[];
+  token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
+  endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
   jwt_disabled?: boolean;
+  dpop_signing_alg_values_supported?: JWSAlgorithms[];
 }): AuthServerMetadata;
+declare function oauthAuthorizationServerMetadata(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>): AuthServerMetadata;
 declare function oidcServerMetadata(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]> & {
   claims?: string[];
-}): Omit<OIDCMetadata, "id_token_signing_alg_values_supported"> & {
+}): {
+  jwks_uri?: string | undefined;
+  userinfo_endpoint: string;
+  acr_values_supported?: string[] | undefined;
+  subject_types_supported: ("public" | "pairwise")[];
+  claims_supported: string[];
+  claims_parameter_supported?: boolean | undefined;
+  end_session_endpoint: string;
+  request_parameter_supported?: boolean | undefined;
+  request_uri_parameter_supported?: boolean | undefined;
+  prompt_values_supported: Prompt[];
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  registration_endpoint?: string | undefined;
+  scopes_supported?: string[] | undefined;
+  response_types_supported: "code"[];
+  response_modes_supported: "query"[];
+  grant_types_supported: GrantType[];
+  token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
+  token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  service_documentation?: string | undefined;
+  ui_locales_supported?: string[] | undefined;
+  op_policy_uri?: string | undefined;
+  op_tos_uri?: string | undefined;
+  revocation_endpoint?: string | undefined;
+  revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
+  revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  introspection_endpoint?: string | undefined;
+  introspection_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
+  introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  code_challenge_methods_supported: "S256"[];
+  authorization_response_iss_parameter_supported?: boolean | undefined;
+  client_id_metadata_document_supported?: boolean | undefined;
+  backchannel_logout_supported?: boolean | undefined;
+  backchannel_logout_session_supported?: boolean | undefined;
+  dpop_signing_alg_values_supported?: JWSAlgorithms[] | undefined;
   id_token_signing_alg_values_supported: JWSAlgorithms[] | ["HS256"];
 };
+declare function metadataResponse(body: unknown, extraHeaders?: HeadersInit): Response;
 /**
  * Provides an exportable `/.well-known/oauth-authorization-server`.
  *
@@ -44,7 +101,7 @@ declare const oauthProviderAuthServerMetadata: <Auth extends {
   };
 }>(auth: Auth, opts?: {
   headers?: HeadersInit;
-}) => (_request: Request) => Promise<Response>;
+}) => (request: Request) => Promise<Response>;
 /**
  * Provides an exportable `/.well-known/openid-configuration`.
  *
@@ -59,6 +116,82 @@ declare const oauthProviderOpenIdConfigMetadata: <Auth extends {
   };
 }>(auth: Auth, opts?: {
   headers?: HeadersInit;
-}) => (_request: Request) => Promise<Response>;
+}) => (request: Request) => Promise<Response>;
+//#endregion
+//#region src/register.d.ts
+declare function checkOAuthClient(client: OAuthClient, opts: OAuthOptions<Scope[]>, settings?: {
+  isRegister?: boolean;
+  ctx?: GenericEndpointContext;
+}): Promise<void>;
+/**
+ * Converts an OAuth 2.0 Dynamic Client Schema to a Database Schema
+ *
+ * @param input
+ * @returns
+ */
+declare function oauthToSchema(input: OAuthClient): SchemaClient<Scope[]>;
+//#endregion
+//#region src/resource-challenge.d.ts
+/**
+ * Raise an OAuth resource-server challenge for a failed access-token request.
+ *
+ * Missing/invalid bearer credentials are reported with RFC 6750 plus the RFC
+ * 9728 `resource_metadata` pointer. DPoP-bound-token failures are reported with
+ * RFC 9449's `DPoP` challenge so clients know which proof algorithms to use.
+ * Non-URL resources (for example a `urn:` or a client id) resolve their
+ * metadata URL through `resourceMetadataMappings`.
+ *
+ * @internal
+ */
+declare function raiseResourceServerChallenge(error: unknown, resource: string | string[], opts?: {
+  /** Maps non-URL (urn, client) resources to their resource_metadata URL. */resourceMetadataMappings?: Record<string, string>; /** DPoP JWS algorithms to advertise in RFC 9449 challenges. */
+  dpopSigningAlgorithms?: readonly string[]; /** Space-delimited scopes to advertise in RFC 6750 bearer challenges. */
+  scope?: string;
+}): never;
+//#endregion
+//#region src/token.d.ts
+/**
+ * Returns the OAuth Provider's server-side capability surface bound to `ctx`.
+ * The token endpoint passes one (pre-bound to the dispatched grant) to each
+ * extension grant handler; a companion plugin's own endpoint calls this directly
+ * with its grant type. `grantType` is bound here, not per issuance, so a handler
+ * cannot mislabel the grant; omit it for capabilities that do not issue tokens
+ * (`getClient`, `validateAccessToken`, `requireActiveAccessToken`), and
+ * `issueTokens` then throws.
+ */
+declare function getOAuthProviderApi(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, grantType?: GrantType): OAuthProviderApi;
+//#endregion
+//#region src/utils/client-assertion.d.ts
+/**
+ * Enforces the assertion-hygiene claims every client-assertion authentication
+ * method must check, independent of how the signature is verified or where the
+ * verification keys come from:
+ * - `aud` MUST include `expectedAudience` (RFC 7523 §3 rule 3),
+ * - `exp` MUST be present, unexpired, and at most `assertionMaxLifetime`
+ *   seconds away (RFC 7523 §3 rule 4),
+ * - `iat`, when present, MUST be within `assertionMaxLifetime`,
+ * - `jti` MUST be present and single-use; this consumes a replay tombstone keyed
+ *   by `` `${namespace}:${jti}` ``, inserted under the adapter's primary key so a
+ *   replay across workers fails atomically.
+ *
+ * A custom {@link OAuthClientAuthenticationStrategy} should call this after
+ * verifying the assertion signature, so an extension method inherits the same
+ * replay, lifetime, and audience guarantees as the built-in `private_key_jwt`
+ * path, which calls it too.
+ *
+ * @param params.namespace Scopes the replay tombstone to the method and client,
+ *   e.g. `` `${method}:${clientId}` ``, so the same `jti` can recur across
+ *   distinct methods or clients but never within one.
+ */
+declare function consumeClientAssertion(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, params: {
+  namespace: string;
+  payload: {
+    aud?: unknown;
+    exp?: unknown;
+    iat?: unknown;
+    jti?: unknown;
+  };
+  expectedAudience: string;
+}): Promise<void>;
 //#endregion
-export { AuthServerMetadata, AuthorizePrompt, OAuthAuthorizationQuery, OAuthClient, OAuthConsent, OAuthOpaqueAccessToken, OAuthOptions, OAuthRefreshToken, OIDCMetadata, Prompt, ResourceServerMetadata, SchemaClient, Scope, StoreTokenType, VerificationValue, authServerMetadata, getOAuthProviderState, mcpHandler, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+export { ActiveAccessTokenPayload, AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, ClientDiscovery, ClientRegistrationRequest, Confirmation, DEFAULT_OAUTH_SCOPES, GrantType, InitialAccessTokenAuthorization, OAuthAuthenticatedClient, OAuthAuthorizationQuery, OAuthClaimExtensionInput, type OAuthClient, OAuthClientAuthenticationInput, OAuthClientAuthenticationRequest, OAuthClientAuthenticationResult, OAuthClientAuthenticationStrategy, OAuthClientResource, OAuthConsent, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, OAuthExtensionGrantHandler, OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, OAuthMetadataExtensionInput, OAuthOpaqueAccessToken, OAuthOptions, OAuthProviderApi, OAuthProviderExtension, type OAuthRedirectOnError, OAuthRefreshToken, OAuthResource, OAuthResourceInput, OAuthTokenIssueParams, OAuthTokenResponse, OAuthUserInfoExtensionInput, OIDCMetadata, Prompt, type ResourceServerMetadata, ResourceUriSchema, SchemaClient, Scope, StoreTokenType, StoredAuthorizationQuery, TokenEndpointAuthMethod, TokenType, VerificationValue, authServerMetadata, checkOAuthClient, consumeClientAssertion, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oauthToSchema, oidcServerMetadata, raiseResourceServerChallenge };