@better-auth/oauth-provider 1.7.0-beta.2 → 1.7.0-beta.4

package/dist/{utils-Cx_XnD9i.mjs → utils-DKBWQ8fe.mjs}

@@ -1,7 +1,8 @@
 import { APIError } from "better-call";
+import { decodeBasicCredentials } from "@better-auth/core/oauth2";
 import { constantTimeEqual, makeSignature, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { BetterAuthError } from "@better-auth/core/error";
-import { base64, base64Url } from "@better-auth/utils/base64";
+import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 //#region src/utils/index.ts
 var TTLCache = class {
@@ -74,6 +75,47 @@ function resolveSessionAuthTime(value) {
 	if (!nested || typeof nested !== "object") return;
 	return normalizeTimestampValue(nested.createdAt) ?? normalizeTimestampValue(nested.created_at);
 }
+/**
+* Normalizes OAuth resource values into a non-empty string array.
+*/
+function toResourceList(value) {
+	if (typeof value === "string") return [value];
+	if (!value?.length) return void 0;
+	return value;
+}
+/**
+* Normalizes audience values for JWT claims.
+*/
+function toAudienceClaim(audience) {
+	if (typeof audience === "string") return audience;
+	if (!audience?.length) return void 0;
+	return audience.length === 1 ? audience.at(0) : audience;
+}
+/**
+* Checks the resource parameter, if provided,
+* and returns either a valid audience or a tagged validation error.
+*/
+async function checkResource(ctx, opts, resource, scopes) {
+	const normalizedResource = toResourceList(resource);
+	const audience = normalizedResource ? [...normalizedResource] : void 0;
+	if (audience) {
+		const hasOpenId = scopes.includes("openid");
+		const baseUrl = ctx.context.baseURL;
+		const userInfoEndpoint = `${baseUrl}/oauth2/userinfo`;
+		if (hasOpenId && !audience.includes(userInfoEndpoint)) audience.push(userInfoEndpoint);
+		const filteredValidAudiences = opts.validAudiences?.filter((aud) => aud.length);
+		const validAudiences = new Set(filteredValidAudiences?.length ? filteredValidAudiences : [baseUrl]);
+		if (hasOpenId) validAudiences.add(userInfoEndpoint);
+		for (const aud of audience) if (!validAudiences.has(aud)) return {
+			success: false,
+			error: "invalid_resource"
+		};
+	}
+	return {
+		success: true,
+		audience: toAudienceClaim(audience)
+	};
+}
 const cachedTrustedClients = new TTLCache();
 async function verifyOAuthQueryParams(oauth_query, secret) {
 	const queryParams = new URLSearchParams(oauth_query);
@@ -228,23 +270,20 @@ async function getStoredToken(storageMethod = "hashed", token, type) {
 *
 * @internal
 */
+const BASIC_SCHEME_PREFIX = /^Basic +/i;
 function basicToClientCredentials(authorization) {
-	if (authorization.startsWith("Basic ")) {
-		const encoded = authorization.replace("Basic ", "");
-		const decoded = new TextDecoder().decode(base64.decode(encoded));
-		if (!decoded.includes(":")) throw new APIError("BAD_REQUEST", {
-			error_description: "invalid authorization header format",
-			error: "invalid_client"
-		});
-		const [id, secret] = decoded.split(":", 2);
-		if (!id || !secret) throw new APIError("BAD_REQUEST", {
+	if (!BASIC_SCHEME_PREFIX.test(authorization)) return;
+	try {
+		const { clientId, clientSecret } = decodeBasicCredentials(authorization);
+		return {
+			client_id: clientId,
+			client_secret: clientSecret
+		};
+	} catch {
+		throw new APIError("BAD_REQUEST", {
 			error_description: "invalid authorization header format",
 			error: "invalid_client"
 		});
-		return {
-			client_id: id,
-			client_secret: secret
-		};
 	}
 }
 /**
@@ -324,7 +363,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 			error_description: "client_assertion cannot be combined with client_secret or Basic auth",
 			error: "invalid_client"
 		});
-		const { verifyClientAssertion: verify } = await import("./client-assertion-CderPEmR.mjs").then((n) => n.t);
+		const { verifyClientAssertion: verify } = await import("./client-assertion-DLMKVgoj.mjs").then((n) => n.t);
 		const result = await verify(ctx, opts, body.client_assertion, body.client_assertion_type, body.client_id, expectedAudience);
 		return {
 			method: "private_key_jwt",
@@ -404,20 +443,24 @@ function searchParamsToQuery(params) {
 	}
 	return result;
 }
-/**
-* Deletes a prompt value
-*
-* @param ctx
-* @param prompt - the prompt value to delete
-*/
-function deleteFromPrompt(query, prompt) {
-	const prompts = query.get("prompt")?.split(" ");
+const signedQueryIssuedAtParam = "ba_iat";
+const postLoginClearedParam = "ba_pl";
+function getSignedQueryIssuedAt(oauthQuery) {
+	const raw = new URLSearchParams(oauthQuery).get(signedQueryIssuedAtParam);
+	if (!raw) return null;
+	const issuedAt = Number(raw);
+	if (!Number.isFinite(issuedAt) || issuedAt <= 0) return null;
+	return new Date(issuedAt);
+}
+function removePromptFromQuery(query, prompt) {
+	const nextQuery = new URLSearchParams(query);
+	const prompts = nextQuery.get("prompt")?.split(" ");
 	const foundPrompt = prompts?.findIndex((v) => v === prompt) ?? -1;
 	if (foundPrompt >= 0) {
 		prompts?.splice(foundPrompt, 1);
-		prompts?.length ? query.set("prompt", prompts.join(" ")) : query.delete("prompt");
+		prompts?.length ? nextQuery.set("prompt", prompts.join(" ")) : nextQuery.delete("prompt");
 	}
-	return searchParamsToQuery(query);
+	return nextQuery;
 }
 var PKCERequirementErrors = /* @__PURE__ */ function(PKCERequirementErrors) {
 	PKCERequirementErrors["PUBLIC_CLIENT"] = "pkce is required for public clients";
@@ -446,4 +489,4 @@ function isPKCERequired(client, requestedScopes) {
 	return false;
 }
 //#endregion
-export { storeClientSecret as _, getClient as a, validateClientCredentials as b, getStoredToken as c, normalizeTimestampValue as d, parseClientMetadata as f, searchParamsToQuery as g, resolveSubjectIdentifier as h, extractClientCredentials as i, isPKCERequired as l, resolveSessionAuthTime as m, deleteFromPrompt as n, getJwtPlugin as o, parsePrompt as p, destructureCredentials as r, getOAuthProviderPlugin as s, decryptStoredClientSecret as t, mergeDiscoveryMetadata as u, storeToken as v, verifyOAuthQueryParams as x, toClientDiscoveryArray as y };
+export { toAudienceClaim as C, verifyOAuthQueryParams as D, validateClientCredentials as E, storeToken as S, toResourceList as T, resolveSessionAuthTime as _, getClient as a, signedQueryIssuedAtParam as b, getSignedQueryIssuedAt as c, mergeDiscoveryMetadata as d, normalizeTimestampValue as f, removePromptFromQuery as g, postLoginClearedParam as h, extractClientCredentials as i, getStoredToken as l, parsePrompt as m, decryptStoredClientSecret as n, getJwtPlugin as o, parseClientMetadata as p, destructureCredentials as r, getOAuthProviderPlugin as s, checkResource as t, isPKCERequired as u, resolveSubjectIdentifier as v, toClientDiscoveryArray as w, storeClientSecret as x, searchParamsToQuery as y };

package/dist/{version-CZxZ64qJ.mjs → version-nFnRm-a3.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.2";
+const PACKAGE_VERSION = "1.7.0-beta.4";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.0-beta.2",
+  "version": "1.7.0-beta.4",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -64,15 +64,15 @@
     "@modelcontextprotocol/sdk": "^1.27.1",
     "listhen": "^1.9.0",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.2",
-    "better-auth": "1.7.0-beta.2"
+    "@better-auth/core": "1.7.0-beta.4",
+    "better-auth": "1.7.0-beta.4"
   },
   "peerDependencies": {
-    "@better-auth/utils": "0.4.0",
+    "@better-auth/utils": "0.4.1",
     "@better-fetch/fetch": "1.1.21",
     "better-call": "1.3.5",
-    "@better-auth/core": "^1.7.0-beta.2",
-    "better-auth": "^1.7.0-beta.2"
+    "@better-auth/core": "^1.7.0-beta.4",
+    "better-auth": "^1.7.0-beta.4"
   },
   "scripts": {
     "build": "tsdown",