@better-auth/oauth-provider 1.7.0-beta.2 → 1.7.0-beta.4

package/dist/{oauth-DJcZ8MMZ.d.mts → oauth-Vt3lTNHX.d.mts}

@@ -1,8 +1,9 @@
-import { _ as Scope, d as OAuthConsent, h as Prompt, i as OAuthClient, p as OAuthOptions, r as GrantType, s as TokenEndpointAuthMethod, t as AuthMethod } from "./oauth-CU79t-eG.mjs";
+import { a as OAuthClient, c as TokenEndpointAuthMethod, f as OAuthConsent, g as Prompt, i as GrantType, m as OAuthOptions, t as AuthMethod, v as Scope } from "./oauth-q7dn10NU.mjs";
 import * as better_call0 from "better-call";
 import * as z from "zod";
 import * as better_auth_plugins0 from "better-auth/plugins";
 import * as jose from "jose";
+import { GenericEndpointContext } from "@better-auth/core";
 import * as better_auth0 from "better-auth";
 
 //#region src/oauth-endpoint.d.ts
@@ -45,6 +46,8 @@ declare module "@better-auth/core" {
 }
 declare const getOAuthProviderState: () => Promise<{
   query?: string;
+  signedQueryIssuedAt?: Date;
+  postLoginClearedForSession?: string;
 } | null>;
 /**
  * oAuth 2.1 provider plugin for Better Auth.
@@ -57,6 +60,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   id: "oauth-provider";
   version: string;
   options: NoInfer<O>;
+  onRequest: (request: Request, ctx: better_auth0.AuthContext) => Promise<{
+    response: Response;
+  } | {
+    request: Request;
+  } | void>;
   init: (ctx: better_auth0.AuthContext) => void;
   hooks: {
     before: {
@@ -95,23 +103,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       issuer: string;
       authorization_endpoint: string;
       token_endpoint: string;
-      registration_endpoint: string;
+      registration_endpoint?: string | undefined;
       scopes_supported?: string[] | undefined;
       response_types_supported: "code"[];
       response_modes_supported: "query"[];
       grant_types_supported: GrantType[];
       token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       service_documentation?: string | undefined;
       ui_locales_supported?: string[] | undefined;
       op_policy_uri?: string | undefined;
       op_tos_uri?: string | undefined;
       revocation_endpoint?: string | undefined;
       revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       introspection_endpoint?: string | undefined;
       introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean | undefined;
       client_id_metadata_document_supported?: boolean | undefined;
@@ -121,23 +129,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       authorization_endpoint: string;
       token_endpoint: string;
       jwks_uri?: string;
-      registration_endpoint: string;
+      registration_endpoint?: string;
       scopes_supported?: string[];
       response_types_supported: "code"[];
       response_modes_supported: "query"[];
       grant_types_supported: GrantType[];
       token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
+      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
       service_documentation?: string;
       ui_locales_supported?: string[];
       op_policy_uri?: string;
       op_tos_uri?: string;
       revocation_endpoint?: string;
       revocation_endpoint_auth_methods_supported?: AuthMethod[];
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
+      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
       introspection_endpoint?: string;
       introspection_endpoint_auth_methods_supported?: AuthMethod[];
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
+      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean;
       client_id_metadata_document_supported?: boolean;
@@ -165,23 +173,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       issuer: string;
       authorization_endpoint: string;
       token_endpoint: string;
-      registration_endpoint: string;
+      registration_endpoint?: string | undefined;
       scopes_supported?: string[] | undefined;
       response_types_supported: "code"[];
       response_modes_supported: "query"[];
       grant_types_supported: GrantType[];
       token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       service_documentation?: string | undefined;
       ui_locales_supported?: string[] | undefined;
       op_policy_uri?: string | undefined;
       op_tos_uri?: string | undefined;
       revocation_endpoint?: string | undefined;
       revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       introspection_endpoint?: string | undefined;
       introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean | undefined;
       client_id_metadata_document_supported?: boolean | undefined;
@@ -203,6 +211,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           S256: "S256";
         }>>>;
         nonce: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         prompt: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
           none: "none";
           consent: "consent";
@@ -213,11 +222,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           "select_account consent": "select_account consent";
         }>>>;
       }, z.core.$strip>;
-      redirectOnError: OAuthRedirectOnError<better_auth0.GenericEndpointContext>;
+      redirectOnError: OAuthRedirectOnError<GenericEndpointContext>;
       errorCodesByField: {
         response_type: {
           invalid: "unsupported_response_type";
         };
+        resource: {
+          invalid: "invalid_target";
+        };
       };
       metadata: {
         openapi: {
@@ -229,6 +241,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format?: undefined;
+              items?: undefined;
             };
             description: string;
           } | {
@@ -238,6 +251,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format?: undefined;
+              items?: undefined;
             };
             description: string;
           } | {
@@ -247,6 +261,19 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format: string;
+              items?: undefined;
+            };
+            description: string;
+          } | {
+            name: string;
+            in: "query";
+            required: false;
+            schema: {
+              type: "array";
+              items: {
+                type: "string";
+              };
+              format?: undefined;
             };
             description: string;
           })[];
@@ -427,7 +454,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         code_verifier: z.ZodOptional<z.ZodString>;
         redirect_uri: z.ZodOptional<z.ZodURL>;
         refresh_token: z.ZodOptional<z.ZodString>;
-        resource: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         scope: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       errorCodesByField: {
@@ -435,6 +462,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           missing: "invalid_request";
           invalid: "unsupported_grant_type";
         };
+        resource: {
+          invalid: "invalid_target";
+        };
       };
       metadata: {
         allowedMediaTypes: string[];
@@ -478,7 +508,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       description: string;
                     };
                     resource: {
-                      type: string;
+                      oneOf: ({
+                        type: string;
+                        description: string;
+                        items?: undefined;
+                      } | {
+                        type: string;
+                        items: {
+                          type: string;
+                        };
+                        description: string;
+                      })[];
                       description: string;
                     };
                     scope: {
@@ -601,10 +641,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       type: string;
                       description: string;
                     };
-                    resource: {
-                      type: string;
-                      description: string;
-                    };
                   };
                   required: string[];
                 };
@@ -1967,6 +2003,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         createdAt: {
           type: "date";
@@ -2067,6 +2104,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         token: {
           type: "string";
           required: true;
+          unique: true;
         };
         clientId: {
           type: "string";
@@ -2075,6 +2113,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         sessionId: {
           type: "string";
@@ -2084,6 +2123,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             field: string;
             onDelete: "set null";
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2092,11 +2132,16 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
           required: false;
         };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
         expiresAt: {
           type: "date";
         };
@@ -2131,6 +2176,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         sessionId: {
           type: "string";
@@ -2140,6 +2186,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             field: string;
             onDelete: "set null";
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2148,11 +2195,16 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
           required: false;
         };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
         refreshId: {
           type: "string";
           required: false;
@@ -2160,6 +2212,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         expiresAt: {
           type: "date";
@@ -2183,6 +2236,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2191,11 +2245,16 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
           required: false;
         };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;

package/dist/{oauth-CU79t-eG.d.mts → oauth-q7dn10NU.d.mts}

@@ -1,4 +1,4 @@
-import { AssertionSigningAlgorithm } from "@better-auth/core/oauth2";
+import { PrivateKeyJwtSigningAlgorithm } from "@better-auth/core/oauth2";
 import { JWSAlgorithms } from "better-auth/plugins";
 import { JWTPayload } from "jose";
 import { InferOptionSchema, Session, User } from "better-auth/types";
@@ -46,6 +46,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       createdAt: {
         type: "date";
@@ -151,6 +152,7 @@ declare const schema: {
       token: {
         type: "string";
         required: true;
+        unique: true;
       };
       clientId: {
         type: "string";
@@ -159,6 +161,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       sessionId: {
         type: "string";
@@ -168,6 +171,7 @@ declare const schema: {
           field: string;
           onDelete: "set null";
         };
+        index: true;
       };
       userId: {
         type: "string";
@@ -176,11 +180,16 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       referenceId: {
         type: "string";
         required: false;
       };
+      resources: {
+        type: "string[]";
+        required: false;
+      };
       expiresAt: {
         type: "date";
       };
@@ -227,6 +236,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       sessionId: {
         type: "string";
@@ -236,6 +246,7 @@ declare const schema: {
           field: string;
           onDelete: "set null";
         };
+        index: true;
       };
       userId: {
         type: "string";
@@ -244,11 +255,16 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       referenceId: {
         type: "string";
         required: false;
       };
+      resources: {
+        type: "string[]";
+        required: false;
+      };
       refreshId: {
         type: "string";
         required: false;
@@ -256,6 +272,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       expiresAt: {
         type: "date";
@@ -279,6 +296,7 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       userId: {
         type: "string";
@@ -287,11 +305,16 @@ declare const schema: {
           model: string;
           field: string;
         };
+        index: true;
       };
       referenceId: {
         type: "string";
         required: false;
       };
+      resources: {
+        type: "string[]";
+        required: false;
+      };
       scopes: {
         type: "string[]";
         required: true;
@@ -822,8 +845,8 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
   customAccessTokenClaims?: (info: {
     /** The user object if token is associated to a user. Null if user doesn't exist. Undefined if user not applicable. */user?: (User & Record<string, unknown>) | null; /** reference of the consent/authorization */
     referenceId?: string; /** Scopes granted for this token */
-    scopes: Scopes; /** The resource requesting. Provided by the token endpoint. */
-    resource?: string; /** oAuthClient metadata */
+    scopes: Scopes; /** The resources requested. */
+    resources?: string[]; /** oAuthClient metadata */
     metadata?: Record<string, any>;
   }) => Awaitable<Record<string, any>>;
   /**
@@ -1096,10 +1119,12 @@ interface OAuthAuthorizationQuery {
    * Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the
    * value of this parameter with a browser cookie.
    *
+   * Recommended for clients, but optional for the authorization server.
+   *
    * Note: Better Auth stores the state in a database instead of a cookie. - This is to minimize
    * the complication with native apps and other clients that may not have access to cookies.
    */
-  state: string;
+  state?: string;
   /**
    * The client ID. Must be the ID of a registered client.
    */
@@ -1179,6 +1204,10 @@ interface OAuthAuthorizationQuery {
    * with the Claim Value being the nonce value sent in the Authentication Request.
    */
   nonce?: string;
+  /**
+   * Resource parameter as specified by [RFC 8707](https://www.rfc-editor.org/rfc/rfc8707.html)
+   */
+  resource?: string | string[];
 }
 /**
  * Stored within the verification.value field
@@ -1192,6 +1221,7 @@ interface VerificationValue {
   query: OAuthAuthorizationQuery;
   sessionId: string;
   userId: string;
+  resource?: string[];
   referenceId?: string;
   authTime?: number;
 }
@@ -1357,13 +1387,17 @@ interface OAuthOpaqueAccessToken<Scopes extends readonly Scope[] = InternallySup
    * Shall match the refreshId.scopes if refreshId is provided.
    */
   scopes: Scopes;
+  /**
+   * Resources allowed for this access token.
+   */
+  resources?: string[];
 }
 /**
  * Refresh Token Database Schema
  */
 interface OAuthRefreshToken<Scopes extends readonly Scope[] = InternallySupportedScopes[]> {
   token: string;
-  sessionId: string;
+  sessionId?: string;
   userId: string;
   referenceId?: string;
   clientId?: string;
@@ -1384,6 +1418,10 @@ interface OAuthRefreshToken<Scopes extends readonly Scope[] = InternallySupporte
    * Considered Immutable once granted.
    */
   scopes: Scopes;
+  /**
+   * Resources allowed for this refresh token
+   */
+  resources?: string[];
 }
 /**
  * Consent Database Schema
@@ -1392,6 +1430,7 @@ type OAuthConsent<Scopes extends readonly Scope[] = InternallySupportedScopes[]>
   id: string;
   clientId: string;
   userId: string;
+  resources?: string[];
   referenceId?: string;
   scopes: Scopes;
   createdAt: Date;
@@ -1445,9 +1484,11 @@ interface AuthServerMetadata {
   /**
    * The URL of the dynamic client registration endpoint.
    *
+   * This field is only present when `allowDynamicClientRegistration` is enabled.
+   *
    * @default `/oauth2/register`
    */
-  registration_endpoint: string;
+  registration_endpoint?: string;
   /**
    * Supported scopes.
    */
@@ -1480,7 +1521,7 @@ interface AuthServerMetadata {
    * token endpoint for the "private_key_jwt" and "client_secret_jwt"
    * authentication methods (see field token_endpoint_auth_methods_supported).
    */
-  token_endpoint_auth_signing_alg_values_supported?: AssertionSigningAlgorithm[];
+  token_endpoint_auth_signing_alg_values_supported?: PrivateKeyJwtSigningAlgorithm[];
   /**
    * URL of a page containing human-readable information
    * that developers might want or need to know when using the
@@ -1526,7 +1567,7 @@ interface AuthServerMetadata {
    * token endpoint for the "private_key_jwt" and "client_secret_jwt"
    * authentication methods (see field revocation_endpoint_auth_methods_supported).
    */
-  revocation_endpoint_auth_signing_alg_values_supported?: AssertionSigningAlgorithm[];
+  revocation_endpoint_auth_signing_alg_values_supported?: PrivateKeyJwtSigningAlgorithm[];
   /**
    * URL of the authorization server's OAuth 2.0
    * introspection endpoint [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662)
@@ -1547,7 +1588,7 @@ interface AuthServerMetadata {
    * the "private_key_jwt" and "client_secret_jwt" authentication methods
    * (see field introspection_endpoint_auth_methods_supported).
    */
-  introspection_endpoint_auth_signing_alg_values_supported?: AssertionSigningAlgorithm[];
+  introspection_endpoint_auth_signing_alg_values_supported?: PrivateKeyJwtSigningAlgorithm[];
   /**
    * Supported code challenge methods.
    *
@@ -1739,4 +1780,4 @@ interface ResourceServerMetadata {
   dpop_bound_access_tokens_required?: boolean;
 }
 //#endregion
-export { Scope as _, OIDCMetadata as a, Awaitable as b, AuthorizePrompt as c, OAuthConsent as d, OAuthOpaqueAccessToken as f, SchemaClient as g, Prompt as h, OAuthClient as i, ClientDiscovery as l, OAuthRefreshToken as m, AuthServerMetadata as n, ResourceServerMetadata as o, OAuthOptions as p, GrantType as r, TokenEndpointAuthMethod as s, AuthMethod as t, OAuthAuthorizationQuery as u, StoreTokenType as v, VerificationValue as y };
+export { SchemaClient as _, OAuthClient as a, VerificationValue as b, TokenEndpointAuthMethod as c, OAuthAuthorizationQuery as d, OAuthConsent as f, Prompt as g, OAuthRefreshToken as h, GrantType as i, AuthorizePrompt as l, OAuthOptions as m, AuthServerMetadata as n, OIDCMetadata as o, OAuthOpaqueAccessToken as p, BearerMethodsSupported as r, ResourceServerMetadata as s, AuthMethod as t, ClientDiscovery as u, Scope as v, Awaitable as x, StoreTokenType as y };