@better-auth/oauth-provider 1.7.0-rc.4 → 1.7.0-rc.5

package/dist/{client-assertion-CsbEATZc.mjs → client-assertion-Cy8ZcH7P.mjs}

@@ -1,4 +1,4 @@
-import { N as getClientDiscoveries, a as getClient } from "./utils-GbnW6qPl.mjs";
+import { P as getClientDiscoveries, a as getClient } from "./utils-jZEA4KQb.mjs";
 import { isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { APIError } from "better-call";
 import { CLIENT_ASSERTION_TYPE, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";

package/dist/client-resource.d.mts

@@ -1,4 +1,4 @@
-import { c as ResourceServerMetadata } from "./oauth-Bi2PA_d1.mjs";
+import { c as ResourceServerMetadata } from "./oauth-CjcHkAmR.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";
@@ -103,14 +103,8 @@ type VerifyAccessTokenRequestNoAuthOpts = VerifyAccessTokenNoAuthOpts & {
   dpop?: VerifyAccessTokenRequestOptions["dpop"];
 };
 type ProtectedResourceMetadataOutput<T> = T extends undefined ? (overrides: ResourceServerMetadata, opts?: {
-  silenceWarnings?: {
-    oidcScopes?: boolean;
-  };
   externalScopes?: string[];
 }) => Promise<ResourceServerMetadata> : (overrides?: Partial<ResourceServerMetadata>, opts?: {
-  silenceWarnings?: {
-    oidcScopes?: boolean;
-  };
   externalScopes?: string[];
 }) => Promise<ResourceServerMetadata>;
 //#endregion

package/dist/client-resource.mjs

@@ -1,8 +1,7 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-GbnW6qPl.mjs";
-import { t as PACKAGE_VERSION } from "./version-Do0kTnv7.mjs";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-jZEA4KQb.mjs";
+import { t as PACKAGE_VERSION } from "./version-CwxXc1Y6.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-CiJTlsEh.mjs";
 import { APIError } from "better-call";
-import { logger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { DPOP_SIGNING_ALGORITHMS, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken } from "better-auth/oauth2";
 //#region src/client-resource.ts
@@ -110,14 +109,6 @@ const oauthProviderResourceClient = (auth) => {
 						const allValidScopes = /* @__PURE__ */ new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
 						for (const sc of overrides.scopes_supported) {
 							if (sc === "openid") throw new BetterAuthError("Only the Auth Server should utilize the openid scope");
-							if ([
-								"profile",
-								"email",
-								"phone",
-								"address"
-							].includes(sc)) {
-								if (!opts?.silenceWarnings?.oidcScopes) logger.warn(`"${sc}" is typically restricted for the authorization server, a resource server typically shouldn't handle this scope`);
-							}
 							if (!allValidScopes.has(sc)) throw new BetterAuthError(`Unsupported scope ${sc}. If external, please add to "externalScopes"`);
 						}
 					}

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { r as oauthProvider } from "./oauth-CgWbnA8o.mjs";
+import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-4LGMyr3C.mjs";
 //#region src/client.d.ts
 declare const oauthProviderClient: () => {
   id: "oauth-provider-client";
@@ -13,5 +13,18 @@ declare const oauthProviderClient: () => {
   }[];
   $InferServerPlugin: ReturnType<typeof oauthProvider>;
 };
+/** Client plugin for {@link oauthDeviceAuthorization}. */
+declare const oauthDeviceAuthorizationClient: () => {
+  $InferServerPlugin: ReturnType<typeof oauthDeviceAuthorization>;
+  id: "device-authorization";
+  version: string;
+  pathMethods: {
+    "/device/code": "POST";
+    "/device/token": "POST";
+    "/device": "GET";
+    "/device/approve": "POST";
+    "/device/deny": "POST";
+  };
+};
 //#endregion
-export { oauthProviderClient };
+export { oauthDeviceAuthorizationClient, oauthProviderClient };

package/dist/client.mjs

@@ -1,6 +1,7 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-BQAwsV_w.mjs";
-import { t as PACKAGE_VERSION } from "./version-Do0kTnv7.mjs";
+import { t as PACKAGE_VERSION } from "./version-CwxXc1Y6.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts
 const oauthProviderClient = () => {
 	return {
@@ -23,5 +24,12 @@ const oauthProviderClient = () => {
 		$InferServerPlugin: {}
 	};
 };
+/** Client plugin for {@link oauthDeviceAuthorization}. */
+const oauthDeviceAuthorizationClient = () => {
+	return {
+		...deviceAuthorizationClient(),
+		$InferServerPlugin: {}
+	};
+};
 //#endregion
-export { oauthProviderClient };
+export { oauthDeviceAuthorizationClient, oauthProviderClient };

package/dist/index.d.mts

@@ -1,45 +1,8 @@
-import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-Bi2PA_d1.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-CgWbnA8o.mjs";
+import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-CjcHkAmR.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-4LGMyr3C.mjs";
 import { APIError } from "better-call";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
-import { BetterAuthPlugin } from "better-auth/types";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";
-//#region src/device-code.d.ts
-/**
- * RFC 8628 device authorization grant type. A registered OAuth client polls the
- * token endpoint with this `grant_type` to exchange an approved device code for
- * a first-class OAuth token set.
- */
-declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-/**
- * Bridges the {@link https://datatracker.ietf.org/doc/html/rfc8628 RFC 8628}
- * device authorization grant into the OAuth Provider. Pair it with the
- * `device-authorization` plugin (which owns the `/device/code` request endpoint,
- * the user verification flow, and the `deviceCode` table) and the
- * `oauthProvider` plugin: this registers a `device_code` token grant on
- * `/oauth2/token` that issues real OAuth tokens for a registered OAuth client,
- * and advertises `device_authorization_endpoint` in discovery metadata.
- *
- * First-party device login (the device-authorization plugin's own
- * `/device/token`, which mints a Better Auth session token) keeps working
- * unchanged. To stop a registered OAuth client's device code from being redeemed
- * there for a session token, a `before` hook rejects `/device/token` requests
- * whose `client_id` resolves to a registered OAuth client, directing them to
- * `/oauth2/token`.
- *
- * @example
- * ```ts
- * const auth = betterAuth({
- *   plugins: [
- *     deviceAuthorization(),
- *     oauthProvider({ ...  }),
- *     deviceCodeGrant(),
- *   ],
- * });
- * ```
- */
-declare function deviceCodeGrant(): BetterAuthPlugin;
-//#endregion
 //#region src/extensions.d.ts
 /**
  * Registers an {@link OAuthProviderExtension} with the OAuth Provider plugin
@@ -230,4 +193,4 @@ declare function consumeClientAssertion(ctx: GenericEndpointContext, opts: OAuth
   expectedAudience: string;
 }): Promise<void>;
 //#endregion
-export { type ActiveAccessTokenPayload, type AuthMethod, type AuthServerMetadata, type AuthorizePrompt, type BearerMethodsSupported, type ClientDiscovery, type ClientMetadataResourceFetch, type ClientRegistrationRequest, type Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, type GrantType, type InitialAccessTokenAuthorization, type OAuthAuthenticatedClient, type OAuthAuthorizationQuery, type OAuthClaimExtensionInput, type OAuthClient, type OAuthClientAdministrativeResponse, type OAuthClientAuthenticationInput, type OAuthClientAuthenticationRequest, type OAuthClientAuthenticationResult, type OAuthClientAuthenticationStrategy, type OAuthClientMetadata, type OAuthClientRegistrationResponse, type OAuthClientResource, type OAuthConsent, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, type OAuthExtensionGrantHandler, type OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, type OAuthMetadataExtensionInput, type OAuthOpaqueAccessToken, type OAuthOptions, type OAuthProviderApi, type OAuthProviderExtension, type OAuthRedirectOnError, type OAuthRefreshToken, type OAuthResource, type OAuthResourceInput, type OAuthTokenIssueParams, type OAuthTokenResponse, type OAuthUserInfoExtensionInput, type OIDCMetadata, type Prompt, type ResourceServerMetadata, ResourceUriSchema, type SchemaClient, type Scope, type StoreTokenType, type StoredAuthorizationQuery, type TokenEndpointAuthMethod, type TokenType, type VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, deviceCodeGrant, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+export { type ActiveAccessTokenPayload, type AuthMethod, type AuthServerMetadata, type AuthorizePrompt, type BearerMethodsSupported, type ClientDiscovery, type ClientMetadataResourceFetch, type ClientRegistrationRequest, type Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, type GrantType, type InitialAccessTokenAuthorization, type OAuthAuthenticatedClient, type OAuthAuthorizationQuery, type OAuthClaimExtensionInput, type OAuthClient, type OAuthClientAdministrativeResponse, type OAuthClientAuthenticationInput, type OAuthClientAuthenticationRequest, type OAuthClientAuthenticationResult, type OAuthClientAuthenticationStrategy, type OAuthClientMetadata, type OAuthClientRegistrationResponse, type OAuthClientResource, type OAuthConsent, type OAuthDeviceAuthorizationOptions, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, type OAuthExtensionGrantHandler, type OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, type OAuthMetadataExtensionInput, type OAuthOpaqueAccessToken, type OAuthOptions, type OAuthProviderApi, type OAuthProviderExtension, type OAuthRedirectOnError, type OAuthRefreshToken, type OAuthResource, type OAuthResourceInput, type OAuthTokenIssueParams, type OAuthTokenResponse, type OAuthUserInfoExtensionInput, type OIDCMetadata, type Prompt, type ResourceServerMetadata, ResourceUriSchema, type SchemaClient, type Scope, type StoreTokenType, type StoredAuthorizationQuery, type TokenEndpointAuthMethod, type TokenType, type VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };