@better-auth/oauth-provider 1.7.0-beta.1 → 1.7.0-beta.3

package/dist/{oauth-B_qonG53.d.mts → oauth-BxP4Iupj.d.mts}

@@ -1,10 +1,40 @@
-import { _ as Scope, d as OAuthConsent, h as Prompt, i as OAuthClient, p as OAuthOptions, r as GrantType, s as TokenEndpointAuthMethod, t as AuthMethod } from "./oauth-CU79t-eG.mjs";
+import { a as OAuthClient, c as TokenEndpointAuthMethod, f as OAuthConsent, g as Prompt, i as GrantType, m as OAuthOptions, t as AuthMethod, v as Scope } from "./oauth-Ds-ejTJY.mjs";
 import * as better_call0 from "better-call";
 import * as z from "zod";
 import * as better_auth_plugins0 from "better-auth/plugins";
 import * as jose from "jose";
 import * as better_auth0 from "better-auth";
 
+//#region src/oauth-endpoint.d.ts
+/**
+ * Canonical OAuth 2.0 / OpenID Connect error codes. The union is the single
+ * vocabulary for every error-emitting surface in this plugin: token, authorize,
+ * revoke, introspect, register, userinfo, logout, consent, and the redirect
+ * error channel. Entries are grouped by source RFC so the declaration doubles
+ * as a specification map.
+ *
+ * The trailing `(string & {})` keeps the type open for product-specific codes
+ * (e.g. `"invalid_verification"`, `"invalid_user"`) while preserving editor
+ * autocomplete for the listed standard codes. Prefer a standard code whenever
+ * one applies; fall back to a custom string only for states no RFC covers.
+ */
+type OAuthErrorCode = "invalid_request" | "invalid_client" | "invalid_grant" | "unauthorized_client" | "unsupported_grant_type" | "unsupported_response_type" | "invalid_scope" | "access_denied" | "server_error" | "temporarily_unavailable" | "invalid_token" | "unsupported_token_type" | "invalid_redirect_uri" | "invalid_client_metadata" | "invalid_software_statement" | "unapproved_software_statement" | "invalid_target" | "invalid_request_object" | "login_required" | "consent_required" | "interaction_required" | "account_selection_required" | "invalid_request_uri" | "request_not_supported" | "request_uri_not_supported" | "registration_not_supported" | (string & {});
+type OAuthFieldErrorCodeMap = {
+  missing?: OAuthErrorCode;
+  invalid?: OAuthErrorCode;
+};
+type OAuthFieldErrorCode = OAuthErrorCode | OAuthFieldErrorCodeMap;
+interface OAuthEndpointErrorResult {
+  error: OAuthErrorCode;
+  error_description: string;
+}
+interface OAuthEndpointRedirectContext<Ctx = unknown> {
+  error: OAuthErrorCode;
+  error_description: string;
+  ctx: Ctx;
+}
+type OAuthRedirectOnError<Ctx = any> = (result: OAuthEndpointRedirectContext<Ctx>) => unknown;
+//#endregion
 //#region src/oauth.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -15,6 +45,8 @@ declare module "@better-auth/core" {
 }
 declare const getOAuthProviderState: () => Promise<{
   query?: string;
+  signedQueryIssuedAt?: Date;
+  postLoginClearedForSession?: string;
 } | null>;
 /**
  * oAuth 2.1 provider plugin for Better Auth.
@@ -160,20 +192,20 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     oauth2Authorize: better_call0.StrictEndpoint<"/oauth2/authorize", {
       method: "GET";
       query: z.ZodObject<{
-        response_type: z.ZodOptional<z.ZodEnum<{
+        response_type: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
           code: "code";
-        }>>;
+        }>>>;
         client_id: z.ZodString;
         redirect_uri: z.ZodOptional<z.ZodURL>;
         scope: z.ZodOptional<z.ZodString>;
         state: z.ZodOptional<z.ZodString>;
         request_uri: z.ZodOptional<z.ZodString>;
         code_challenge: z.ZodOptional<z.ZodString>;
-        code_challenge_method: z.ZodOptional<z.ZodEnum<{
+        code_challenge_method: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
           S256: "S256";
-        }>>;
+        }>>>;
         nonce: z.ZodOptional<z.ZodString>;
-        prompt: z.ZodOptional<z.ZodEnum<{
+        prompt: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
           none: "none";
           consent: "consent";
           login: "login";
@@ -181,8 +213,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           select_account: "select_account";
           "login consent": "login consent";
           "select_account consent": "select_account consent";
-        }>>;
+        }>>>;
       }, z.core.$strip>;
+      redirectOnError: OAuthRedirectOnError<better_auth0.GenericEndpointContext>;
+      errorCodesByField: {
+        response_type: {
+          invalid: "unsupported_response_type";
+        };
+      };
       metadata: {
         openapi: {
           description: string;
@@ -378,11 +416,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     oauth2Token: better_call0.StrictEndpoint<"/oauth2/token", {
       method: "POST";
       body: z.ZodObject<{
-        grant_type: z.ZodEnum<{
+        grant_type: z.ZodPipe<z.ZodString, z.ZodEnum<{
           authorization_code: "authorization_code";
           client_credentials: "client_credentials";
           refresh_token: "refresh_token";
-        }>;
+        }>>;
         client_id: z.ZodOptional<z.ZodString>;
         client_secret: z.ZodOptional<z.ZodString>;
         client_assertion: z.ZodOptional<z.ZodString>;
@@ -394,6 +432,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         resource: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
+      errorCodesByField: {
+        grant_type: {
+          missing: "invalid_request";
+          invalid: "unsupported_grant_type";
+        };
+      };
       metadata: {
         allowedMediaTypes: string[];
         openapi: {
@@ -530,10 +574,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         client_assertion: z.ZodOptional<z.ZodString>;
         client_assertion_type: z.ZodOptional<z.ZodString>;
         token: z.ZodString;
-        token_type_hint: z.ZodOptional<z.ZodEnum<{
-          refresh_token: "refresh_token";
-          access_token: "access_token";
-        }>>;
+        token_type_hint: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {
         allowedMediaTypes: string[];
@@ -560,7 +601,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                     };
                     token_type_hint: {
                       type: string;
-                      enum: string[];
                       description: string;
                     };
                     resource: {
@@ -669,10 +709,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         client_assertion: z.ZodOptional<z.ZodString>;
         client_assertion_type: z.ZodOptional<z.ZodString>;
         token: z.ZodString;
-        token_type_hint: z.ZodOptional<z.ZodEnum<{
-          refresh_token: "refresh_token";
-          access_token: "access_token";
-        }>>;
+        token_type_hint: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {
         allowedMediaTypes: string[];
@@ -699,7 +736,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                     };
                     token_type_hint: {
                       type: string;
-                      enum: string[];
                       description: string;
                     };
                   };
@@ -951,6 +987,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         }>>;
         skip_consent: z.ZodOptional<z.ZodNever>;
       }, z.core.$strip>;
+      errorCodesByField: {
+        redirect_uris: "invalid_redirect_uri";
+        post_logout_redirect_uris: "invalid_redirect_uri";
+        software_statement: "invalid_software_statement";
+      };
+      defaultError: "invalid_client_metadata";
       metadata: {
         openapi: {
           description: string;
@@ -1927,6 +1969,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         createdAt: {
           type: "date";
@@ -2035,6 +2078,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         sessionId: {
           type: "string";
@@ -2044,6 +2088,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             field: string;
             onDelete: "set null";
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2052,6 +2097,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
@@ -2091,6 +2137,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         sessionId: {
           type: "string";
@@ -2100,6 +2147,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             field: string;
             onDelete: "set null";
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2108,6 +2156,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
@@ -2120,6 +2169,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         expiresAt: {
           type: "date";
@@ -2143,6 +2193,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2151,6 +2202,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
@@ -2196,4 +2248,4 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   })[];
 };
 //#endregion
-export { oauthProvider as n, getOAuthProviderState as t };
+export { OAuthErrorCode as a, OAuthRedirectOnError as c, OAuthEndpointRedirectContext as i, oauthProvider as n, OAuthFieldErrorCode as o, OAuthEndpointErrorResult as r, OAuthFieldErrorCodeMap as s, getOAuthProviderState as t };

package/dist/{oauth-CU79t-eG.d.mts → oauth-Ds-ejTJY.d.mts}

@@ -46,6 +46,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       createdAt: {
         type: "date";
@@ -159,6 +160,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       sessionId: {
         type: "string";
@@ -168,6 +170,7 @@ declare const schema: {
           field: string;
           onDelete: "set null";
         };
+        index: true;
       };
       userId: {
         type: "string";
@@ -176,6 +179,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       referenceId: {
         type: "string";
@@ -227,6 +231,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       sessionId: {
         type: "string";
@@ -236,6 +241,7 @@ declare const schema: {
           field: string;
           onDelete: "set null";
         };
+        index: true;
       };
       userId: {
         type: "string";
@@ -244,6 +250,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       referenceId: {
         type: "string";
@@ -256,6 +263,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       expiresAt: {
         type: "date";
@@ -279,6 +287,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       userId: {
         type: "string";
@@ -287,6 +296,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       referenceId: {
         type: "string";
@@ -1096,10 +1106,12 @@ interface OAuthAuthorizationQuery {
    * Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the
    * value of this parameter with a browser cookie.
    *
+   * Recommended for clients, but optional for the authorization server.
+   *
    * Note: Better Auth stores the state in a database instead of a cookie. - This is to minimize
    * the complication with native apps and other clients that may not have access to cookies.
    */
-  state: string;
+  state?: string;
   /**
    * The client ID. Must be the ID of a registered client.
    */
@@ -1363,7 +1375,7 @@ interface OAuthOpaqueAccessToken<Scopes extends readonly Scope[] = InternallySup
  */
 interface OAuthRefreshToken<Scopes extends readonly Scope[] = InternallySupportedScopes[]> {
   token: string;
-  sessionId: string;
+  sessionId?: string;
   userId: string;
   referenceId?: string;
   clientId?: string;
@@ -1739,4 +1751,4 @@ interface ResourceServerMetadata {
   dpop_bound_access_tokens_required?: boolean;
 }
 //#endregion
-export { Scope as _, OIDCMetadata as a, Awaitable as b, AuthorizePrompt as c, OAuthConsent as d, OAuthOpaqueAccessToken as f, SchemaClient as g, Prompt as h, OAuthClient as i, ClientDiscovery as l, OAuthRefreshToken as m, AuthServerMetadata as n, ResourceServerMetadata as o, OAuthOptions as p, GrantType as r, TokenEndpointAuthMethod as s, AuthMethod as t, OAuthAuthorizationQuery as u, StoreTokenType as v, VerificationValue as y };
+export { SchemaClient as _, OAuthClient as a, VerificationValue as b, TokenEndpointAuthMethod as c, OAuthAuthorizationQuery as d, OAuthConsent as f, Prompt as g, OAuthRefreshToken as h, GrantType as i, AuthorizePrompt as l, OAuthOptions as m, AuthServerMetadata as n, OIDCMetadata as o, OAuthOpaqueAccessToken as p, BearerMethodsSupported as r, ResourceServerMetadata as s, AuthMethod as t, ClientDiscovery as u, Scope as v, Awaitable as x, StoreTokenType as y };

package/dist/{utils-Cx_XnD9i.mjs → utils-_Jr_enAe.mjs}

@@ -324,7 +324,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 			error_description: "client_assertion cannot be combined with client_secret or Basic auth",
 			error: "invalid_client"
 		});
-		const { verifyClientAssertion: verify } = await import("./client-assertion-CderPEmR.mjs").then((n) => n.t);
+		const { verifyClientAssertion: verify } = await import("./client-assertion-BYtMWGCE.mjs").then((n) => n.t);
 		const result = await verify(ctx, opts, body.client_assertion, body.client_assertion_type, body.client_id, expectedAudience);
 		return {
 			method: "private_key_jwt",
@@ -404,20 +404,24 @@ function searchParamsToQuery(params) {
 	}
 	return result;
 }
-/**
-* Deletes a prompt value
-*
-* @param ctx
-* @param prompt - the prompt value to delete
-*/
-function deleteFromPrompt(query, prompt) {
-	const prompts = query.get("prompt")?.split(" ");
+const signedQueryIssuedAtParam = "ba_iat";
+const postLoginClearedParam = "ba_pl";
+function getSignedQueryIssuedAt(oauthQuery) {
+	const raw = new URLSearchParams(oauthQuery).get(signedQueryIssuedAtParam);
+	if (!raw) return null;
+	const issuedAt = Number(raw);
+	if (!Number.isFinite(issuedAt) || issuedAt <= 0) return null;
+	return new Date(issuedAt);
+}
+function removePromptFromQuery(query, prompt) {
+	const nextQuery = new URLSearchParams(query);
+	const prompts = nextQuery.get("prompt")?.split(" ");
 	const foundPrompt = prompts?.findIndex((v) => v === prompt) ?? -1;
 	if (foundPrompt >= 0) {
 		prompts?.splice(foundPrompt, 1);
-		prompts?.length ? query.set("prompt", prompts.join(" ")) : query.delete("prompt");
+		prompts?.length ? nextQuery.set("prompt", prompts.join(" ")) : nextQuery.delete("prompt");
 	}
-	return searchParamsToQuery(query);
+	return nextQuery;
 }
 var PKCERequirementErrors = /* @__PURE__ */ function(PKCERequirementErrors) {
 	PKCERequirementErrors["PUBLIC_CLIENT"] = "pkce is required for public clients";
@@ -446,4 +450,4 @@ function isPKCERequired(client, requestedScopes) {
 	return false;
 }
 //#endregion
-export { storeClientSecret as _, getClient as a, validateClientCredentials as b, getStoredToken as c, normalizeTimestampValue as d, parseClientMetadata as f, searchParamsToQuery as g, resolveSubjectIdentifier as h, extractClientCredentials as i, isPKCERequired as l, resolveSessionAuthTime as m, deleteFromPrompt as n, getJwtPlugin as o, parsePrompt as p, destructureCredentials as r, getOAuthProviderPlugin as s, decryptStoredClientSecret as t, mergeDiscoveryMetadata as u, storeToken as v, verifyOAuthQueryParams as x, toClientDiscoveryArray as y };
+export { validateClientCredentials as C, toClientDiscoveryArray as S, resolveSubjectIdentifier as _, getJwtPlugin as a, storeClientSecret as b, getStoredToken as c, normalizeTimestampValue as d, parseClientMetadata as f, resolveSessionAuthTime as g, removePromptFromQuery as h, getClient as i, isPKCERequired as l, postLoginClearedParam as m, destructureCredentials as n, getOAuthProviderPlugin as o, parsePrompt as p, extractClientCredentials as r, getSignedQueryIssuedAt as s, decryptStoredClientSecret as t, mergeDiscoveryMetadata as u, searchParamsToQuery as v, verifyOAuthQueryParams as w, storeToken as x, signedQueryIssuedAtParam as y };

package/dist/{version-DIwdpXrQ.mjs → version-CG1YnCiF.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.1";
+const PACKAGE_VERSION = "1.7.0-beta.3";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.0-beta.1",
+  "version": "1.7.0-beta.3",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -64,15 +64,15 @@
     "@modelcontextprotocol/sdk": "^1.27.1",
     "listhen": "^1.9.0",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.1",
-    "better-auth": "1.7.0-beta.1"
+    "@better-auth/core": "1.7.0-beta.3",
+    "better-auth": "1.7.0-beta.3"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.0",
     "@better-fetch/fetch": "1.1.21",
     "better-call": "1.3.5",
-    "@better-auth/core": "^1.7.0-beta.1",
-    "better-auth": "^1.7.0-beta.1"
+    "@better-auth/core": "^1.7.0-beta.3",
+    "better-auth": "^1.7.0-beta.3"
   },
   "scripts": {
     "build": "tsdown",