@better-auth/oauth-provider 1.7.0-beta.3 → 1.7.0-beta.4

package/dist/{client-assertion-BYtMWGCE.mjs → client-assertion-DLMKVgoj.mjs}

@@ -1,6 +1,6 @@
-import { i as getClient } from "./utils-_Jr_enAe.mjs";
+import { a as getClient } from "./utils-DKBWQ8fe.mjs";
 import { APIError } from "better-call";
-import { ASSERTION_SIGNING_ALGORITHMS, CLIENT_ASSERTION_TYPE } from "@better-auth/core/oauth2";
+import { CLIENT_ASSERTION_TYPE, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
 import { createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -33,7 +33,7 @@ function setJwksCache(uri, jwks, fetchedAt) {
 		if (oldest !== void 0) jwksCache.delete(oldest);
 	}
 }
-const ALGORITHMS_LIST = [...ASSERTION_SIGNING_ALGORITHMS];
+const ALGORITHMS_LIST = [...PRIVATE_KEY_JWT_SIGNING_ALGORITHMS];
 const pendingAssertionIds = /* @__PURE__ */ new Set();
 /**
 * Block SSRF: reject jwks_uri pointing at private/reserved IP ranges.
@@ -160,7 +160,7 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 			error: "invalid_client"
 		});
 	}
-	if (!header.alg || !ASSERTION_SIGNING_ALGORITHMS.includes(header.alg)) throw new APIError("BAD_REQUEST", {
+	if (!header.alg || !ALGORITHMS_LIST.includes(header.alg)) throw new APIError("BAD_REQUEST", {
 		error_description: `unsupported assertion signing algorithm: ${header.alg}`,
 		error: "invalid_client"
 	});

package/dist/client-resource.d.mts

@@ -1,9 +1,16 @@
-import { s as ResourceServerMetadata } from "./oauth-Ds-ejTJY.mjs";
+import { s as ResourceServerMetadata } from "./oauth-q7dn10NU.mjs";
 import { JWTPayload, JWTVerifyOptions } from "jose";
-import { Auth } from "better-auth/types";
+import { BetterAuthOptions } from "better-auth/types";
 
 //#region src/client-resource.d.ts
-declare const oauthProviderResourceClient: <T extends Auth | undefined>(auth?: T) => {
+type ResourceClientAuth = {
+  options: {
+    baseURL?: BetterAuthOptions["baseURL"];
+    basePath?: BetterAuthOptions["basePath"];
+  };
+  $context: Promise<unknown>;
+};
+declare const oauthProviderResourceClient: <T extends ResourceClientAuth | undefined = undefined>(auth?: T) => {
   id: "oauth-provider-resource-client";
   version: string;
   getActions(): {
@@ -43,7 +50,7 @@ interface VerifyAccessTokenRemote {
    */
   force?: boolean;
 }
-type VerifyAccessTokenOutput<T> = T extends Auth ? (token: string | undefined, opts?: VerifyAccessTokenAuthOpts) => Promise<JWTPayload> : (token: string | undefined, opts: VerifyAccessTokenNoAuthOpts) => Promise<JWTPayload>;
+type VerifyAccessTokenOutput<T> = T extends undefined ? (token: string | undefined, opts: VerifyAccessTokenNoAuthOpts) => Promise<JWTPayload> : (token: string | undefined, opts?: VerifyAccessTokenAuthOpts) => Promise<JWTPayload>;
 type VerifyAccessTokenAuthOpts = {
   verifyOptions?: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience">>;
   scopes?: string[];
@@ -64,12 +71,12 @@ type VerifyAccessTokenNoAuthOpts = {
   remoteVerify: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
-type ProtectedResourceMetadataOutput<T> = T extends Auth ? (overrides?: Partial<ResourceServerMetadata>, opts?: {
+type ProtectedResourceMetadataOutput<T> = T extends undefined ? (overrides: ResourceServerMetadata, opts?: {
   silenceWarnings?: {
     oidcScopes?: boolean;
   };
   externalScopes?: string[];
-}) => Promise<ResourceServerMetadata> : (overrides: ResourceServerMetadata, opts?: {
+}) => Promise<ResourceServerMetadata> : (overrides?: Partial<ResourceServerMetadata>, opts?: {
   silenceWarnings?: {
     oidcScopes?: boolean;
   };

package/dist/client-resource.mjs

@@ -1,6 +1,6 @@
 import { t as handleMcpErrors } from "./mcp-CYnz-MXn.mjs";
-import { a as getJwtPlugin, o as getOAuthProviderPlugin } from "./utils-_Jr_enAe.mjs";
-import { t as PACKAGE_VERSION } from "./version-CG1YnCiF.mjs";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-DKBWQ8fe.mjs";
+import { t as PACKAGE_VERSION } from "./version-nFnRm-a3.mjs";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { APIError } from "better-call";
 import { logger } from "@better-auth/core/env";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { n as oauthProvider } from "./oauth-BxP4Iupj.mjs";
+import { n as oauthProvider } from "./oauth-Vt3lTNHX.mjs";
 import * as _better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CG1YnCiF.mjs";
+import { t as PACKAGE_VERSION } from "./version-nFnRm-a3.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 //#region src/client.ts
 function parseSignedQuery(search) {

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { _ as SchemaClient, a as OAuthClient, b as VerificationValue, c as TokenEndpointAuthMethod, d as OAuthAuthorizationQuery, f as OAuthConsent, g as Prompt, h as OAuthRefreshToken, i as GrantType, l as AuthorizePrompt, m as OAuthOptions, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOpaqueAccessToken, r as BearerMethodsSupported, s as ResourceServerMetadata, t as AuthMethod, u as ClientDiscovery, v as Scope, x as Awaitable, y as StoreTokenType } from "./oauth-Ds-ejTJY.mjs";
-import { a as OAuthErrorCode, c as OAuthRedirectOnError, i as OAuthEndpointRedirectContext, n as oauthProvider, o as OAuthFieldErrorCode, r as OAuthEndpointErrorResult, s as OAuthFieldErrorCodeMap, t as getOAuthProviderState } from "./oauth-BxP4Iupj.mjs";
+import { _ as SchemaClient, a as OAuthClient, b as VerificationValue, c as TokenEndpointAuthMethod, d as OAuthAuthorizationQuery, f as OAuthConsent, g as Prompt, h as OAuthRefreshToken, i as GrantType, l as AuthorizePrompt, m as OAuthOptions, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOpaqueAccessToken, r as BearerMethodsSupported, s as ResourceServerMetadata, t as AuthMethod, u as ClientDiscovery, v as Scope, x as Awaitable, y as StoreTokenType } from "./oauth-q7dn10NU.mjs";
+import { a as OAuthErrorCode, c as OAuthRedirectOnError, i as OAuthEndpointRedirectContext, n as oauthProvider, o as OAuthFieldErrorCode, r as OAuthEndpointErrorResult, s as OAuthFieldErrorCodeMap, t as getOAuthProviderState } from "./oauth-Vt3lTNHX.mjs";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { JWTPayload } from "jose";
@@ -22,6 +22,7 @@ verifyOptions: Parameters<typeof verifyAccessToken>[1], handler: (req: Request,
 //#region src/metadata.d.ts
 declare function authServerMetadata(ctx: GenericEndpointContext, opts?: JwtOptions, overrides?: {
   scopes_supported?: AuthServerMetadata["scopes_supported"];
+  dynamic_client_registration_supported?: boolean;
   public_client_supported?: boolean;
   grant_types_supported?: GrantType[];
   jwt_disabled?: boolean;
@@ -39,23 +40,23 @@ declare function oidcServerMetadata(ctx: GenericEndpointContext, opts: OAuthOpti
   issuer: string;
   authorization_endpoint: string;
   token_endpoint: string;
-  registration_endpoint: string;
+  registration_endpoint?: string | undefined;
   scopes_supported?: string[] | undefined;
   response_types_supported: "code"[];
   response_modes_supported: "query"[];
   grant_types_supported: GrantType[];
   token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+  token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
   service_documentation?: string | undefined;
   ui_locales_supported?: string[] | undefined;
   op_policy_uri?: string | undefined;
   op_tos_uri?: string | undefined;
   revocation_endpoint?: string | undefined;
   revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-  revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+  revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
   introspection_endpoint?: string | undefined;
   introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-  introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+  introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
   code_challenge_methods_supported: "S256"[];
   authorization_response_iss_parameter_supported?: boolean | undefined;
   client_id_metadata_document_supported?: boolean | undefined;