@better-auth/oauth-provider 1.7.0-rc.5 → 1.7.0

package/dist/client-resource.d.mts

@@ -1,7 +1,8 @@
-import { c as ResourceServerMetadata } from "./oauth-CjcHkAmR.mjs";
+import { c as ResourceServerMetadata } from "./oauth-1Ud-hvZY.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";
+
 //#region src/client-resource.d.ts
 type ResourceClientAuth = {
   options: BetterAuthOptions;
@@ -75,8 +76,7 @@ type VerifyAccessTokenAuthOpts = {
   requiredScopes?: readonly string[];
   isScopeSatisfied?: VerifyAccessTokenRequestOptions["isScopeSatisfied"];
   jwksUrl?: string;
-  remoteVerify?: VerifyAccessTokenRemote;
-  /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
 type VerifyAccessTokenRequestAuthOpts = VerifyAccessTokenAuthOpts & {
@@ -87,16 +87,14 @@ type VerifyAccessTokenNoAuthOpts = {
   requiredScopes?: readonly string[];
   isScopeSatisfied?: VerifyAccessTokenRequestOptions["isScopeSatisfied"];
   jwksUrl: string;
-  remoteVerify?: VerifyAccessTokenRemote;
-  /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 } | {
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
   requiredScopes?: readonly string[];
   isScopeSatisfied?: VerifyAccessTokenRequestOptions["isScopeSatisfied"];
   jwksUrl?: string;
-  remoteVerify: VerifyAccessTokenRemote;
-  /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
 type VerifyAccessTokenRequestNoAuthOpts = VerifyAccessTokenNoAuthOpts & {

package/dist/client-resource.mjs

@@ -1,6 +1,6 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-jZEA4KQb.mjs";
-import { t as PACKAGE_VERSION } from "./version-CwxXc1Y6.mjs";
-import { t as createResourceServerChallenge } from "./resource-challenge-CiJTlsEh.mjs";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-CCi1maVd.mjs";
+import { t as PACKAGE_VERSION } from "./version-C0TE7qRr.mjs";
+import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";
 import { DPOP_SIGNING_ALGORITHMS, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken } from "better-auth/oauth2";
@@ -106,7 +106,7 @@ const oauthProviderResourceClient = (auth) => {
 					if (!resource) throw Error("missing required resource");
 					if (oauthProviderOptions?.scopes && opts?.externalScopes && (overrides?.authorization_servers?.length ?? 0) <= 1) throw new BetterAuthError("external scopes should not be provided with one authorization server");
 					if (overrides?.scopes_supported) {
-						const allValidScopes = /* @__PURE__ */ new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
+						const allValidScopes = new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
 						for (const sc of overrides.scopes_supported) {
 							if (sc === "openid") throw new BetterAuthError("Only the Auth Server should utilize the openid scope");
 							if (!allValidScopes.has(sc)) throw new BetterAuthError(`Unsupported scope ${sc}. If external, please add to "externalScopes"`);

package/dist/client.d.mts

@@ -1,4 +1,6 @@
-import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-4LGMyr3C.mjs";
+import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-D8xpKR0_.mjs";
+import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
+
 //#region src/client.d.ts
 declare const oauthProviderClient: () => {
   id: "oauth-provider-client";
@@ -8,7 +10,7 @@ declare const oauthProviderClient: () => {
     name: string;
     description: string;
     hooks: {
-      onRequest<T extends Record<string, any>>(ctx: import("@better-fetch/fetch").RequestContext<T>): Promise<void>;
+      onRequest<T extends Record<string, any>>(ctx: _$_better_fetch_fetch0.RequestContext<T>): Promise<void>;
     };
   }[];
   $InferServerPlugin: ReturnType<typeof oauthProvider>;

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { t as buildSignedOAuthQuery } from "./signed-query-BQAwsV_w.mjs";
-import { t as PACKAGE_VERSION } from "./version-CwxXc1Y6.mjs";
+import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
+import { t as PACKAGE_VERSION } from "./version-C0TE7qRr.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index.d.mts

@@ -1,8 +1,10 @@
-import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-CjcHkAmR.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-4LGMyr3C.mjs";
+import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-1Ud-hvZY.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-D8xpKR0_.mjs";
 import { APIError } from "better-call";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";
+import * as _$better_auth0 from "better-auth";
+
 //#region src/extensions.d.ts
 /**
  * Registers an {@link OAuthProviderExtension} with the OAuth Provider plugin
@@ -65,17 +67,17 @@ declare function oidcServerMetadata(ctx: GenericEndpointContext, opts: OAuthOpti
   response_modes_supported: "query"[];
   grant_types_supported: GrantType[];
   token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  token_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+  token_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
   service_documentation?: string | undefined;
   ui_locales_supported?: string[] | undefined;
   op_policy_uri?: string | undefined;
   op_tos_uri?: string | undefined;
   revocation_endpoint?: string | undefined;
   revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  revocation_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+  revocation_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
   introspection_endpoint?: string | undefined;
   introspection_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  introspection_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+  introspection_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
   code_challenge_methods_supported: "S256"[];
   authorization_response_iss_parameter_supported?: boolean | undefined;
   client_id_metadata_document_supported?: boolean | undefined;
@@ -136,9 +138,7 @@ declare const oauthProviderOpenIdConfigMetadata: <Auth extends {
  * @external
  */
 declare function createResourceServerChallenge(error: unknown, resource: string | string[], opts?: {
-  /** Maps non-URL (urn, client) resources to their resource_metadata URL. */
-  resourceMetadataMappings?: Record<string, string>;
-  /** DPoP JWS algorithms to advertise in RFC 9449 challenges. */
+  /** Maps non-URL (urn, client) resources to their resource_metadata URL. */resourceMetadataMappings?: Record<string, string>; /** DPoP JWS algorithms to advertise in RFC 9449 challenges. */
   dpopSigningAlgorithms?: readonly string[];
   /**
    * Scopes to advertise in RFC 6750 bearer challenges,
@@ -193,4 +193,4 @@ declare function consumeClientAssertion(ctx: GenericEndpointContext, opts: OAuth
   expectedAudience: string;
 }): Promise<void>;
 //#endregion
-export { type ActiveAccessTokenPayload, type AuthMethod, type AuthServerMetadata, type AuthorizePrompt, type BearerMethodsSupported, type ClientDiscovery, type ClientMetadataResourceFetch, type ClientRegistrationRequest, type Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, type GrantType, type InitialAccessTokenAuthorization, type OAuthAuthenticatedClient, type OAuthAuthorizationQuery, type OAuthClaimExtensionInput, type OAuthClient, type OAuthClientAdministrativeResponse, type OAuthClientAuthenticationInput, type OAuthClientAuthenticationRequest, type OAuthClientAuthenticationResult, type OAuthClientAuthenticationStrategy, type OAuthClientMetadata, type OAuthClientRegistrationResponse, type OAuthClientResource, type OAuthConsent, type OAuthDeviceAuthorizationOptions, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, type OAuthExtensionGrantHandler, type OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, type OAuthMetadataExtensionInput, type OAuthOpaqueAccessToken, type OAuthOptions, type OAuthProviderApi, type OAuthProviderExtension, type OAuthRedirectOnError, type OAuthRefreshToken, type OAuthResource, type OAuthResourceInput, type OAuthTokenIssueParams, type OAuthTokenResponse, type OAuthUserInfoExtensionInput, type OIDCMetadata, type Prompt, type ResourceServerMetadata, ResourceUriSchema, type SchemaClient, type Scope, type StoreTokenType, type StoredAuthorizationQuery, type TokenEndpointAuthMethod, type TokenType, type VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+export { ActiveAccessTokenPayload, AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, ClientDiscovery, ClientMetadataResourceFetch, ClientRegistrationRequest, Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, GrantType, InitialAccessTokenAuthorization, OAuthAuthenticatedClient, OAuthAuthorizationQuery, OAuthClaimExtensionInput, type OAuthClient, OAuthClientAdministrativeResponse, OAuthClientAuthenticationInput, OAuthClientAuthenticationRequest, OAuthClientAuthenticationResult, OAuthClientAuthenticationStrategy, type OAuthClientMetadata, OAuthClientRegistrationResponse, OAuthClientResource, OAuthConsent, type OAuthDeviceAuthorizationOptions, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, OAuthExtensionGrantHandler, OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, OAuthMetadataExtensionInput, OAuthOpaqueAccessToken, OAuthOptions, OAuthProviderApi, OAuthProviderExtension, type OAuthRedirectOnError, OAuthRefreshToken, OAuthResource, OAuthResourceInput, OAuthTokenIssueParams, OAuthTokenResponse, OAuthUserInfoExtensionInput, OIDCMetadata, Prompt, type ResourceServerMetadata, ResourceUriSchema, SchemaClient, Scope, StoreTokenType, StoredAuthorizationQuery, TokenEndpointAuthMethod, TokenType, VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };