@better-auth/oauth-provider 1.7.0-beta.3 → 1.7.0-beta.5

package/dist/{oauth-BxP4Iupj.d.mts → oauth-DU6NeviY.d.mts}

@@ -1,8 +1,9 @@
-import { a as OAuthClient, c as TokenEndpointAuthMethod, f as OAuthConsent, g as Prompt, i as GrantType, m as OAuthOptions, t as AuthMethod, v as Scope } from "./oauth-Ds-ejTJY.mjs";
+import { a as OAuthClient, c as TokenEndpointAuthMethod, f as OAuthConsent, g as Prompt, i as GrantType, m as OAuthOptions, t as AuthMethod, v as Scope } from "./oauth-BXrYl5x6.mjs";
 import * as better_call0 from "better-call";
 import * as z from "zod";
 import * as better_auth_plugins0 from "better-auth/plugins";
 import * as jose from "jose";
+import { GenericEndpointContext } from "@better-auth/core";
 import * as better_auth0 from "better-auth";
 
 //#region src/oauth-endpoint.d.ts
@@ -33,7 +34,13 @@ interface OAuthEndpointRedirectContext<Ctx = unknown> {
   error_description: string;
   ctx: Ctx;
 }
-type OAuthRedirectOnError<Ctx = any> = (result: OAuthEndpointRedirectContext<Ctx>) => unknown;
+type OAuthRedirectOnError<Ctx = unknown, Result = unknown> = (result: OAuthEndpointRedirectContext<Ctx>) => Result | Promise<Result>;
+//#endregion
+//#region src/authorize.d.ts
+type OAuthRedirectResult = {
+  redirect: true;
+  url: string;
+};
 //#endregion
 //#region src/oauth.d.ts
 declare module "@better-auth/core" {
@@ -59,7 +66,31 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   id: "oauth-provider";
   version: string;
   options: NoInfer<O>;
-  init: (ctx: better_auth0.AuthContext) => void;
+  onRequest: (request: Request, ctx: better_auth0.AuthContext) => Promise<{
+    response: Response;
+  } | {
+    request: Request;
+  } | void>;
+  init: (ctx: better_auth0.AuthContext) => {
+    options: {
+      databaseHooks: {
+        session: {
+          delete: {
+            before(session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, unknown>, hookCtx: GenericEndpointContext | null): Promise<void>;
+          };
+        };
+      };
+    };
+  };
   hooks: {
     before: {
       matcher(ctx: better_auth0.HookEndpointContext): any;
@@ -67,10 +98,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }[];
     after: {
       matcher(ctx: better_auth0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-        redirect: boolean;
-        url: string;
-      } | undefined>;
+      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<OAuthRedirectResult | undefined>;
     }[];
   };
   endpoints: {
@@ -97,52 +125,56 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       issuer: string;
       authorization_endpoint: string;
       token_endpoint: string;
-      registration_endpoint: string;
+      registration_endpoint?: string | undefined;
       scopes_supported?: string[] | undefined;
       response_types_supported: "code"[];
       response_modes_supported: "query"[];
       grant_types_supported: GrantType[];
       token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       service_documentation?: string | undefined;
       ui_locales_supported?: string[] | undefined;
       op_policy_uri?: string | undefined;
       op_tos_uri?: string | undefined;
       revocation_endpoint?: string | undefined;
       revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       introspection_endpoint?: string | undefined;
       introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean | undefined;
       client_id_metadata_document_supported?: boolean | undefined;
+      backchannel_logout_supported?: boolean | undefined;
+      backchannel_logout_session_supported?: boolean | undefined;
       id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
     } | {
       issuer: string;
       authorization_endpoint: string;
       token_endpoint: string;
       jwks_uri?: string;
-      registration_endpoint: string;
+      registration_endpoint?: string;
       scopes_supported?: string[];
       response_types_supported: "code"[];
       response_modes_supported: "query"[];
       grant_types_supported: GrantType[];
       token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
+      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
       service_documentation?: string;
       ui_locales_supported?: string[];
       op_policy_uri?: string;
       op_tos_uri?: string;
       revocation_endpoint?: string;
       revocation_endpoint_auth_methods_supported?: AuthMethod[];
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
+      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
       introspection_endpoint?: string;
       introspection_endpoint_auth_methods_supported?: AuthMethod[];
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
+      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean;
       client_id_metadata_document_supported?: boolean;
+      backchannel_logout_supported?: boolean;
+      backchannel_logout_session_supported?: boolean;
     }>;
     /**
      * A server-only endpoint that helps provide the
@@ -167,26 +199,28 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       issuer: string;
       authorization_endpoint: string;
       token_endpoint: string;
-      registration_endpoint: string;
+      registration_endpoint?: string | undefined;
       scopes_supported?: string[] | undefined;
       response_types_supported: "code"[];
       response_modes_supported: "query"[];
       grant_types_supported: GrantType[];
       token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       service_documentation?: string | undefined;
       ui_locales_supported?: string[] | undefined;
       op_policy_uri?: string | undefined;
       op_tos_uri?: string | undefined;
       revocation_endpoint?: string | undefined;
       revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       introspection_endpoint?: string | undefined;
       introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean | undefined;
       client_id_metadata_document_supported?: boolean | undefined;
+      backchannel_logout_supported?: boolean | undefined;
+      backchannel_logout_session_supported?: boolean | undefined;
       id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
     }>;
     oauth2Authorize: better_call0.StrictEndpoint<"/oauth2/authorize", {
@@ -195,31 +229,33 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         response_type: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
           code: "code";
         }>>>;
-        client_id: z.ZodString;
+        request_uri: z.ZodOptional<z.ZodString>;
         redirect_uri: z.ZodOptional<z.ZodURL>;
         scope: z.ZodOptional<z.ZodString>;
         state: z.ZodOptional<z.ZodString>;
-        request_uri: z.ZodOptional<z.ZodString>;
+        client_id: z.ZodString;
+        prompt: z.ZodOptional<z.ZodString>;
+        display: z.ZodOptional<z.ZodString>;
+        ui_locales: z.ZodOptional<z.ZodString>;
+        max_age: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+        acr_values: z.ZodOptional<z.ZodString>;
+        login_hint: z.ZodOptional<z.ZodString>;
+        id_token_hint: z.ZodOptional<z.ZodString>;
         code_challenge: z.ZodOptional<z.ZodString>;
         code_challenge_method: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
           S256: "S256";
         }>>>;
         nonce: z.ZodOptional<z.ZodString>;
-        prompt: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
-          none: "none";
-          consent: "consent";
-          login: "login";
-          create: "create";
-          select_account: "select_account";
-          "login consent": "login consent";
-          "select_account consent": "select_account consent";
-        }>>>;
-      }, z.core.$strip>;
-      redirectOnError: OAuthRedirectOnError<better_auth0.GenericEndpointContext>;
+        resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+      }, z.core.$loose>;
+      redirectOnError: OAuthRedirectOnError<GenericEndpointContext, OAuthRedirectResult>;
       errorCodesByField: {
         response_type: {
           invalid: "unsupported_response_type";
         };
+        resource: {
+          invalid: "invalid_target";
+        };
       };
       metadata: {
         openapi: {
@@ -231,6 +267,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format?: undefined;
+              minimum?: undefined;
+              items?: undefined;
             };
             description: string;
           } | {
@@ -240,6 +278,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format?: undefined;
+              minimum?: undefined;
+              items?: undefined;
             };
             description: string;
           } | {
@@ -249,6 +289,32 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format: string;
+              minimum?: undefined;
+              items?: undefined;
+            };
+            description: string;
+          } | {
+            name: string;
+            in: "query";
+            required: false;
+            schema: {
+              type: "integer";
+              minimum: number;
+              format?: undefined;
+              items?: undefined;
+            };
+            description: string;
+          } | {
+            name: string;
+            in: "query";
+            required: false;
+            schema: {
+              type: "array";
+              items: {
+                type: "string";
+              };
+              format?: undefined;
+              minimum?: undefined;
             };
             description: string;
           })[];
@@ -290,10 +356,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    }>;
+    }, OAuthRedirectResult>;
     oauth2Consent: better_call0.StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       body: z.ZodObject<{
@@ -349,7 +412,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
+    }, OAuthRedirectResult | {
       redirect: boolean;
       url: string;
     }>;
@@ -409,10 +472,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    }>;
+    }, OAuthRedirectResult>;
     oauth2Token: better_call0.StrictEndpoint<"/oauth2/token", {
       method: "POST";
       body: z.ZodObject<{
@@ -429,7 +489,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         code_verifier: z.ZodOptional<z.ZodString>;
         redirect_uri: z.ZodOptional<z.ZodURL>;
         refresh_token: z.ZodOptional<z.ZodString>;
-        resource: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         scope: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       errorCodesByField: {
@@ -437,6 +497,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           missing: "invalid_request";
           invalid: "unsupported_grant_type";
         };
+        resource: {
+          invalid: "invalid_target";
+        };
       };
       metadata: {
         allowedMediaTypes: string[];
@@ -480,7 +543,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       description: string;
                     };
                     resource: {
-                      type: string;
+                      oneOf: ({
+                        type: string;
+                        description: string;
+                        items?: undefined;
+                      } | {
+                        type: string;
+                        items: {
+                          type: string;
+                        };
+                        description: string;
+                      })[];
                       description: string;
                     };
                     scope: {
@@ -603,10 +676,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       type: string;
                       description: string;
                     };
-                    resource: {
-                      type: string;
-                      description: string;
-                    };
                   };
                   required: string[];
                 };
@@ -783,7 +852,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       };
     }, null | undefined>;
     oauth2UserInfo: better_call0.StrictEndpoint<"/oauth2/userinfo", {
-      method: "GET";
+      method: ("GET" | "POST")[];
       metadata: {
         openapi: {
           description: string;
@@ -939,10 +1008,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    } | undefined>;
+    }, OAuthRedirectResult | undefined>;
     registerOAuthClient: better_call0.StrictEndpoint<"/oauth2/register", {
       method: "POST";
       body: z.ZodObject<{
@@ -958,6 +1024,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
         token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
           none: "none";
           client_secret_basic: "client_secret_basic";
@@ -1083,6 +1151,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                         };
                         description: string;
                       };
+                      backchannel_logout_uri: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      backchannel_logout_session_required: {
+                        type: string;
+                        description: string;
+                      };
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
@@ -1142,6 +1219,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
         token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
           none: "none";
           client_secret_basic: "client_secret_basic";
@@ -1351,6 +1430,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
         token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
           none: "none";
           client_secret_basic: "client_secret_basic";
@@ -1636,6 +1717,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           software_version: z.ZodOptional<z.ZodString>;
           software_statement: z.ZodOptional<z.ZodString>;
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+          backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+          backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
           grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             authorization_code: "authorization_code";
             client_credentials: "client_credentials";
@@ -1702,6 +1785,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           software_version: z.ZodOptional<z.ZodString>;
           software_statement: z.ZodOptional<z.ZodString>;
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+          backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+          backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
           grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             authorization_code: "authorization_code";
             client_credentials: "client_credentials";
@@ -2023,6 +2108,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "string[]";
           required: false;
         };
+        backchannelLogoutUri: {
+          type: "string";
+          required: false;
+        };
+        backchannelLogoutSessionRequired: {
+          type: "boolean";
+          required: false;
+        };
         tokenEndpointAuthMethod: {
           type: "string";
           required: false;
@@ -2070,6 +2163,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         token: {
           type: "string";
           required: true;
+          unique: true;
         };
         clientId: {
           type: "string";
@@ -2103,6 +2197,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "string";
           required: false;
         };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
         expiresAt: {
           type: "date";
         };
@@ -2162,6 +2260,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "string";
           required: false;
         };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
         refreshId: {
           type: "string";
           required: false;
@@ -2177,6 +2279,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         createdAt: {
           type: "date";
         };
+        revoked: {
+          type: "date";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2208,6 +2314,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "string";
           required: false;
         };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2220,6 +2330,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     };
+    oauthClientAssertion: {
+      modelName: string;
+      fields: {
+        expiresAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
   };
   rateLimit: ({
     pathMatcher: (path: string) => path is "/oauth2/token";

package/dist/{utils-_Jr_enAe.mjs → utils-D2dLqo7f.mjs}

@@ -1,7 +1,8 @@
 import { APIError } from "better-call";
+import { decodeBasicCredentials } from "@better-auth/core/oauth2";
 import { constantTimeEqual, makeSignature, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { BetterAuthError } from "@better-auth/core/error";
-import { base64, base64Url } from "@better-auth/utils/base64";
+import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 //#region src/utils/index.ts
 var TTLCache = class {
@@ -74,6 +75,47 @@ function resolveSessionAuthTime(value) {
 	if (!nested || typeof nested !== "object") return;
 	return normalizeTimestampValue(nested.createdAt) ?? normalizeTimestampValue(nested.created_at);
 }
+/**
+* Normalizes OAuth resource values into a non-empty string array.
+*/
+function toResourceList(value) {
+	if (typeof value === "string") return [value];
+	if (!value?.length) return void 0;
+	return value;
+}
+/**
+* Normalizes audience values for JWT claims.
+*/
+function toAudienceClaim(audience) {
+	if (typeof audience === "string") return audience;
+	if (!audience?.length) return void 0;
+	return audience.length === 1 ? audience.at(0) : audience;
+}
+/**
+* Checks the resource parameter, if provided,
+* and returns either a valid audience or a tagged validation error.
+*/
+async function checkResource(ctx, opts, resource, scopes) {
+	const normalizedResource = toResourceList(resource);
+	const audience = normalizedResource ? [...normalizedResource] : void 0;
+	if (audience) {
+		const hasOpenId = scopes.includes("openid");
+		const baseUrl = ctx.context.baseURL;
+		const userInfoEndpoint = `${baseUrl}/oauth2/userinfo`;
+		if (hasOpenId && !audience.includes(userInfoEndpoint)) audience.push(userInfoEndpoint);
+		const filteredValidAudiences = opts.validAudiences?.filter((aud) => aud.length);
+		const validAudiences = new Set(filteredValidAudiences?.length ? filteredValidAudiences : [baseUrl]);
+		if (hasOpenId) validAudiences.add(userInfoEndpoint);
+		for (const aud of audience) if (!validAudiences.has(aud)) return {
+			success: false,
+			error: "invalid_resource"
+		};
+	}
+	return {
+		success: true,
+		audience: toAudienceClaim(audience)
+	};
+}
 const cachedTrustedClients = new TTLCache();
 async function verifyOAuthQueryParams(oauth_query, secret) {
 	const queryParams = new URLSearchParams(oauth_query);
@@ -228,32 +270,44 @@ async function getStoredToken(storageMethod = "hashed", token, type) {
 *
 * @internal
 */
+const BASIC_SCHEME_PREFIX = /^Basic +/i;
 function basicToClientCredentials(authorization) {
-	if (authorization.startsWith("Basic ")) {
-		const encoded = authorization.replace("Basic ", "");
-		const decoded = new TextDecoder().decode(base64.decode(encoded));
-		if (!decoded.includes(":")) throw new APIError("BAD_REQUEST", {
-			error_description: "invalid authorization header format",
-			error: "invalid_client"
-		});
-		const [id, secret] = decoded.split(":", 2);
-		if (!id || !secret) throw new APIError("BAD_REQUEST", {
+	if (!BASIC_SCHEME_PREFIX.test(authorization)) return;
+	try {
+		const { clientId, clientSecret } = decodeBasicCredentials(authorization);
+		return {
+			client_id: clientId,
+			client_secret: clientSecret
+		};
+	} catch {
+		throw new APIError("BAD_REQUEST", {
 			error_description: "invalid authorization header format",
 			error: "invalid_client"
 		});
-		return {
-			client_id: id,
-			client_secret: secret
-		};
 	}
 }
 /**
+* Whether a client is allowed to use a given grant type.
+*
+* A client's registered `grantTypes` defaults to the documented default
+* `["authorization_code"]` when unset (see client registration). Refresh tokens
+* are only ever issued through the authorization_code flow, so a client allowed
+* to use `authorization_code` is implicitly allowed to use `refresh_token`.
+*
+* @internal
+*/
+function clientAllowsGrant(client, grantType) {
+	const allowedGrants = client.grantTypes && client.grantTypes.length > 0 ? client.grantTypes : ["authorization_code"];
+	if (grantType === "refresh_token" && allowedGrants.includes("authorization_code")) return true;
+	return allowedGrants.includes(grantType);
+}
+/**
 * Validates client credentials failing on mismatches
 * and incorrectly provided information
 *
 * @internal
 */
-async function validateClientCredentials(ctx, options, clientId, clientSecret, scopes, preVerifiedClient) {
+async function validateClientCredentials(ctx, options, clientId, clientSecret, scopes, preVerifiedClient, grantType) {
 	const client = preVerifiedClient ?? await getClient(ctx, options, clientId);
 	if (!client) throw new APIError("BAD_REQUEST", {
 		error_description: "missing client",
@@ -288,6 +342,10 @@ async function validateClientCredentials(ctx, options, clientId, clientSecret, s
 			error: "invalid_scope"
 		});
 	}
+	if (grantType && !clientAllowsGrant(client, grantType)) throw new APIError("BAD_REQUEST", {
+		error_description: `client is not authorized to use grant type ${grantType}`,
+		error: "unauthorized_client"
+	});
 	return client;
 }
 /**
@@ -324,7 +382,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 			error_description: "client_assertion cannot be combined with client_secret or Basic auth",
 			error: "invalid_client"
 		});
-		const { verifyClientAssertion: verify } = await import("./client-assertion-BYtMWGCE.mjs").then((n) => n.t);
+		const { verifyClientAssertion: verify } = await import("./client-assertion-DmT1B6_6.mjs").then((n) => n.t);
 		const result = await verify(ctx, opts, body.client_assertion, body.client_assertion_type, body.client_id, expectedAudience);
 		return {
 			method: "private_key_jwt",
@@ -413,6 +471,12 @@ function getSignedQueryIssuedAt(oauthQuery) {
 	if (!Number.isFinite(issuedAt) || issuedAt <= 0) return null;
 	return new Date(issuedAt);
 }
+function isSessionFreshForSignedQuery(sessionCreatedAt, signedQueryIssuedAt) {
+	if (!signedQueryIssuedAt) return false;
+	const normalized = normalizeTimestampValue(sessionCreatedAt);
+	if (!normalized) return false;
+	return normalized.getTime() >= signedQueryIssuedAt.getTime();
+}
 function removePromptFromQuery(query, prompt) {
 	const nextQuery = new URLSearchParams(query);
 	const prompts = nextQuery.get("prompt")?.split(" ");
@@ -423,6 +487,11 @@ function removePromptFromQuery(query, prompt) {
 	}
 	return nextQuery;
 }
+function removeMaxAgeFromQuery(query) {
+	const nextQuery = new URLSearchParams(query);
+	nextQuery.delete("max_age");
+	return nextQuery;
+}
 var PKCERequirementErrors = /* @__PURE__ */ function(PKCERequirementErrors) {
 	PKCERequirementErrors["PUBLIC_CLIENT"] = "pkce is required for public clients";
 	PKCERequirementErrors["OFFLINE_ACCESS_SCOPE"] = "pkce is required when requesting offline_access scope";
@@ -450,4 +519,4 @@ function isPKCERequired(client, requestedScopes) {
 	return false;
 }
 //#endregion
-export { validateClientCredentials as C, toClientDiscoveryArray as S, resolveSubjectIdentifier as _, getJwtPlugin as a, storeClientSecret as b, getStoredToken as c, normalizeTimestampValue as d, parseClientMetadata as f, resolveSessionAuthTime as g, removePromptFromQuery as h, getClient as i, isPKCERequired as l, postLoginClearedParam as m, destructureCredentials as n, getOAuthProviderPlugin as o, parsePrompt as p, extractClientCredentials as r, getSignedQueryIssuedAt as s, decryptStoredClientSecret as t, mergeDiscoveryMetadata as u, searchParamsToQuery as v, verifyOAuthQueryParams as w, storeToken as x, signedQueryIssuedAtParam as y };
+export { verifyOAuthQueryParams as A, signedQueryIssuedAtParam as C, toClientDiscoveryArray as D, toAudienceClaim as E, toResourceList as O, searchParamsToQuery as S, storeToken as T, postLoginClearedParam as _, extractClientCredentials as a, resolveSessionAuthTime as b, getOAuthProviderPlugin as c, isPKCERequired as d, isSessionFreshForSignedQuery as f, parsePrompt as g, parseClientMetadata as h, destructureCredentials as i, validateClientCredentials as k, getSignedQueryIssuedAt as l, normalizeTimestampValue as m, clientAllowsGrant as n, getClient as o, mergeDiscoveryMetadata as p, decryptStoredClientSecret as r, getJwtPlugin as s, checkResource as t, getStoredToken as u, removeMaxAgeFromQuery as v, storeClientSecret as w, resolveSubjectIdentifier as x, removePromptFromQuery as y };

package/dist/{version-CG1YnCiF.mjs → version-B1ZiRmxj.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.3";
+const PACKAGE_VERSION = "1.7.0-beta.5";
 //#endregion
 export { PACKAGE_VERSION as t };