@better-auth/oauth-provider 1.7.0-rc.1 → 1.7.0-rc.2

package/dist/{client-assertion-D-tAYsKC.mjs → client-assertion-C-Cg0dCs.mjs}

@@ -1,11 +1,22 @@
-import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { a as getClient } from "./utils-DO8lmoDw.mjs";
+import { o as getClient } from "./resource-challenge-2qgK1B-a.mjs";
 import { isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { APIError } from "better-call";
 import { CLIENT_ASSERTION_TYPE, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 import { createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
 //#region src/utils/client-assertion.ts
 var client_assertion_exports = /* @__PURE__ */ __exportAll({
 	consumeClientAssertion: () => consumeClientAssertion,
@@ -293,4 +304,4 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 	return { clientId };
 }
 //#endregion
-export { consumeClientAssertion as n, isPrivateHostname as r, client_assertion_exports as t };
+export { __exportAll as i, consumeClientAssertion as n, isPrivateHostname as r, client_assertion_exports as t };

package/dist/client-resource.d.mts

@@ -1,14 +1,10 @@
-import { c as ResourceServerMetadata } from "./oauth-ScTJEcFV.mjs";
+import { c as ResourceServerMetadata } from "./oauth-CSzjH7fO.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";
-
 //#region src/client-resource.d.ts
 type ResourceClientAuth = {
-  options: {
-    baseURL?: BetterAuthOptions["baseURL"];
-    basePath?: BetterAuthOptions["basePath"];
-  };
+  options: BetterAuthOptions;
   $context: Promise<unknown>;
 };
 declare const oauthProviderResourceClient: <T extends ResourceClientAuth | undefined = undefined>(auth?: T) => {
@@ -78,7 +74,8 @@ type VerifyAccessTokenAuthOpts = {
   verifyOptions?: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience">>;
   scopes?: string[];
   jwksUrl?: string;
-  remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify?: VerifyAccessTokenRemote;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
 type VerifyAccessTokenRequestAuthOpts = VerifyAccessTokenAuthOpts & {
@@ -88,13 +85,15 @@ type VerifyAccessTokenNoAuthOpts = {
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
   scopes?: string[];
   jwksUrl: string;
-  remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify?: VerifyAccessTokenRemote;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 } | {
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
   scopes?: string[];
   jwksUrl?: string;
-  remoteVerify: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify: VerifyAccessTokenRemote;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
 type VerifyAccessTokenRequestNoAuthOpts = VerifyAccessTokenNoAuthOpts & {

package/dist/client-resource.mjs

@@ -1,6 +1,5 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-DO8lmoDw.mjs";
-import { t as PACKAGE_VERSION } from "./version--aseHtsu.mjs";
-import { t as raiseResourceServerChallenge } from "./resource-challenge-B-cqv4ur.mjs";
+import { c as getOAuthProviderPlugin, s as getJwtPlugin, t as raiseResourceServerChallenge } from "./resource-challenge-2qgK1B-a.mjs";
+import { t as PACKAGE_VERSION } from "./version-C0y8aPv-.mjs";
 import { APIError } from "better-call";
 import { logger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
@@ -50,6 +49,14 @@ const oauthProviderResourceClient = (auth) => {
 		version: PACKAGE_VERSION,
 		getActions() {
 			return {
+				/**
+				* Performs verification of an access token for your APIs. Can perform
+				* local verification using `jwksUrl` by default. Can also be configured
+				* for remote introspection using `remoteVerify` if a confidential client
+				* is set up for this API.
+				*
+				* The optional auth parameter can fill known values automatically.
+				*/
 				verifyBearerToken: (async (token, opts) => {
 					const verifyOptions = await resolveVerifyAccessTokenOptions(opts);
 					try {
@@ -62,6 +69,12 @@ const oauthProviderResourceClient = (auth) => {
 						});
 					}
 				}),
+				/**
+				* Performs verification of a protected-resource request. Use this for
+				* new resource-server integrations so sender-constrained DPoP access
+				* tokens are enforced with the request method, URL, Authorization
+				* scheme, DPoP proof, `ath`, and `cnf.jkt` binding.
+				*/
 				verifyAccessTokenRequest: (async (request, opts) => {
 					const verifyOptions = await resolveVerifyAccessTokenOptions(opts);
 					try {
@@ -73,13 +86,23 @@ const oauthProviderResourceClient = (auth) => {
 						});
 					}
 				}),
+				/**
+				* An authorization server does not typically publish
+				* the `/.well-known/oauth-protected-resource` themselves.
+				* Thus, we provide a client-only endpoint to help set up
+				* your protected resource metadata.
+				*
+				* The optional auth parameter can fill known values automatically.
+				*
+				* @see https://datatracker.ietf.org/doc/html/rfc8414#section-2
+				*/
 				getProtectedResourceMetadata: (async (overrides, opts) => {
 					const resource = overrides?.resource ?? authServerBaseUrl;
 					const oauthProviderOptions = (await getOauthProviderPlugin())?.options;
 					if (!resource) throw Error("missing required resource");
 					if (oauthProviderOptions?.scopes && opts?.externalScopes && (overrides?.authorization_servers?.length ?? 0) <= 1) throw new BetterAuthError("external scopes should not be provided with one authorization server");
 					if (overrides?.scopes_supported) {
-						const allValidScopes = new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
+						const allValidScopes = /* @__PURE__ */ new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
 						for (const sc of overrides.scopes_supported) {
 							if (sc === "openid") throw new BetterAuthError("Only the Auth Server should utilize the openid scope");
 							if ([

package/dist/client.d.mts

@@ -1,6 +1,4 @@
-import { r as oauthProvider } from "./oauth-BrNRbP2A.mjs";
-import * as _better_fetch_fetch0 from "@better-fetch/fetch";
-
+import { r as oauthProvider } from "./oauth-DdSU0qF6.mjs";
 //#region src/client.d.ts
 declare const oauthProviderClient: () => {
   id: "oauth-provider-client";
@@ -10,7 +8,7 @@ declare const oauthProviderClient: () => {
     name: string;
     description: string;
     hooks: {
-      onRequest<T extends Record<string, any>>(ctx: _better_fetch_fetch0.RequestContext<T>): Promise<void>;
+      onRequest<T extends Record<string, any>>(ctx: import("@better-fetch/fetch").RequestContext<T>): Promise<void>;
     };
   }[];
   $InferServerPlugin: ReturnType<typeof oauthProvider>;

package/dist/client.mjs

@@ -1,5 +1,4 @@
-import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version--aseHtsu.mjs";
+import { n as buildSignedOAuthQuery, t as PACKAGE_VERSION } from "./version-C0y8aPv-.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 //#region src/client.ts
 const oauthProviderClient = () => {

package/dist/index.d.mts

@@ -1,10 +1,8 @@
-import { A as OAuthProviderExtension, B as StoreTokenType, C as OAuthConsent, D as OAuthOpaqueAccessToken, E as OAuthMetadataExtensionInput, F as OAuthTokenResponse, H as VerificationValue, I as OAuthUserInfoExtensionInput, L as Prompt, M as OAuthResource, N as OAuthResourceInput, O as OAuthOptions, P as OAuthTokenIssueParams, R as SchemaClient, S as OAuthClientResource, T as OAuthExtensionGrantHandlerInput, U as ClientRegistrationRequest, V as StoredAuthorizationQuery, W as ResourceUriSchema, _ as OAuthClaimExtensionInput, a as GrantType, b as OAuthClientAuthenticationResult, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthorizationQuery, h as OAuthAuthenticatedClient, i as Confirmation, j as OAuthRefreshToken, k as OAuthProviderApi, l as TokenEndpointAuthMethod, m as InitialAccessTokenAuthorization, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClientAuthenticationInput, w as OAuthExtensionGrantHandler, x as OAuthClientAuthenticationStrategy, y as OAuthClientAuthenticationRequest, z as Scope } from "./oauth-ScTJEcFV.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-BrNRbP2A.mjs";
+import { A as OAuthProviderExtension, B as StoreTokenType, C as OAuthConsent, D as OAuthOpaqueAccessToken, E as OAuthMetadataExtensionInput, F as OAuthTokenResponse, H as VerificationValue, I as OAuthUserInfoExtensionInput, L as Prompt, M as OAuthResource, N as OAuthResourceInput, O as OAuthOptions, P as OAuthTokenIssueParams, R as SchemaClient, S as OAuthClientResource, T as OAuthExtensionGrantHandlerInput, U as ClientRegistrationRequest, V as StoredAuthorizationQuery, W as ResourceUriSchema, _ as OAuthClaimExtensionInput, a as GrantType, b as OAuthClientAuthenticationResult, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthorizationQuery, h as OAuthAuthenticatedClient, i as Confirmation, j as OAuthRefreshToken, k as OAuthProviderApi, l as TokenEndpointAuthMethod, m as InitialAccessTokenAuthorization, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClientAuthenticationInput, w as OAuthExtensionGrantHandler, x as OAuthClientAuthenticationStrategy, y as OAuthClientAuthenticationRequest, z as Scope } from "./oauth-CSzjH7fO.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-DdSU0qF6.mjs";
 import { getSessionFromCtx } from "better-auth/api";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";
-import * as better_auth0 from "better-auth";
-
 //#region src/extensions.d.ts
 /**
  * Registers an {@link OAuthProviderExtension} with the OAuth Provider plugin
@@ -67,17 +65,17 @@ declare function oidcServerMetadata(ctx: GenericEndpointContext, opts: OAuthOpti
   response_modes_supported: "query"[];
   grant_types_supported: GrantType[];
   token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  token_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
   service_documentation?: string | undefined;
   ui_locales_supported?: string[] | undefined;
   op_policy_uri?: string | undefined;
   op_tos_uri?: string | undefined;
   revocation_endpoint?: string | undefined;
   revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  revocation_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
   introspection_endpoint?: string | undefined;
   introspection_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  introspection_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
   code_challenge_methods_supported: "S256"[];
   authorization_response_iss_parameter_supported?: boolean | undefined;
   client_id_metadata_document_supported?: boolean | undefined;
@@ -144,8 +142,11 @@ declare function oauthToSchema(input: OAuthClient): SchemaClient<Scope[]>;
  * @internal
  */
 declare function raiseResourceServerChallenge(error: unknown, resource: string | string[], opts?: {
-  /** Maps non-URL (urn, client) resources to their resource_metadata URL. */resourceMetadataMappings?: Record<string, string>; /** DPoP JWS algorithms to advertise in RFC 9449 challenges. */
-  dpopSigningAlgorithms?: readonly string[]; /** Space-delimited scopes to advertise in RFC 6750 bearer challenges. */
+  /** Maps non-URL (urn, client) resources to their resource_metadata URL. */
+  resourceMetadataMappings?: Record<string, string>;
+  /** DPoP JWS algorithms to advertise in RFC 9449 challenges. */
+  dpopSigningAlgorithms?: readonly string[];
+  /** Space-delimited scopes to advertise in RFC 6750 bearer challenges. */
   scope?: string;
 }): never;
 //#endregion
@@ -194,4 +195,4 @@ declare function consumeClientAssertion(ctx: GenericEndpointContext, opts: OAuth
   expectedAudience: string;
 }): Promise<void>;
 //#endregion
-export { ActiveAccessTokenPayload, AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, ClientDiscovery, ClientRegistrationRequest, Confirmation, DEFAULT_OAUTH_SCOPES, GrantType, InitialAccessTokenAuthorization, OAuthAuthenticatedClient, OAuthAuthorizationQuery, OAuthClaimExtensionInput, type OAuthClient, OAuthClientAuthenticationInput, OAuthClientAuthenticationRequest, OAuthClientAuthenticationResult, OAuthClientAuthenticationStrategy, OAuthClientResource, OAuthConsent, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, OAuthExtensionGrantHandler, OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, OAuthMetadataExtensionInput, OAuthOpaqueAccessToken, OAuthOptions, OAuthProviderApi, OAuthProviderExtension, type OAuthRedirectOnError, OAuthRefreshToken, OAuthResource, OAuthResourceInput, OAuthTokenIssueParams, OAuthTokenResponse, OAuthUserInfoExtensionInput, OIDCMetadata, Prompt, type ResourceServerMetadata, ResourceUriSchema, SchemaClient, Scope, StoreTokenType, StoredAuthorizationQuery, TokenEndpointAuthMethod, TokenType, VerificationValue, authServerMetadata, checkOAuthClient, consumeClientAssertion, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oauthToSchema, oidcServerMetadata, raiseResourceServerChallenge };
+export { type ActiveAccessTokenPayload, type AuthMethod, type AuthServerMetadata, type AuthorizePrompt, type BearerMethodsSupported, type ClientDiscovery, type ClientRegistrationRequest, type Confirmation, DEFAULT_OAUTH_SCOPES, type GrantType, type InitialAccessTokenAuthorization, type OAuthAuthenticatedClient, type OAuthAuthorizationQuery, type OAuthClaimExtensionInput, type OAuthClient, type OAuthClientAuthenticationInput, type OAuthClientAuthenticationRequest, type OAuthClientAuthenticationResult, type OAuthClientAuthenticationStrategy, type OAuthClientResource, type OAuthConsent, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, type OAuthExtensionGrantHandler, type OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, type OAuthMetadataExtensionInput, type OAuthOpaqueAccessToken, type OAuthOptions, type OAuthProviderApi, type OAuthProviderExtension, type OAuthRedirectOnError, type OAuthRefreshToken, type OAuthResource, type OAuthResourceInput, type OAuthTokenIssueParams, type OAuthTokenResponse, type OAuthUserInfoExtensionInput, type OIDCMetadata, type Prompt, type ResourceServerMetadata, ResourceUriSchema, type SchemaClient, type Scope, type StoreTokenType, type StoredAuthorizationQuery, type TokenEndpointAuthMethod, type TokenType, type VerificationValue, authServerMetadata, checkOAuthClient, consumeClientAssertion, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oauthToSchema, oidcServerMetadata, raiseResourceServerChallenge };