@better-auth/oauth-provider 1.7.0 → 1.7.2

package/dist/{authorize-BP2_wo6r.mjs → authorize-BmTe2VYG.mjs}

@@ -1,10 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as filterClaimsRequestUserInfoClaims, C as resolveResourcePolicy, D as getSupportedClaims, E as STANDARD_CLAIM_NAMES, M as isValidOidcClaimsRequest, O as canSatisfyEssentialAcrRequest, S as logEnforcePerClientResourcesResolution, T as STANDARD_CLAIMS, _ as assertIdentifierValid, a as invalidateRefreshFamily, b as invalidateResourceCache, c as ResourceUriSchema, d as clientJwksSchema, f as clientRegistrationRequestSchema, g as JWS_ALGORITHMS, h as validateClientCredentialsScopes, j as getRequestedUserInfoClaims, k as claimsRequestParameterSchema, l as SafeUrlSchema, m as normalizeClientCredentialsScopes, o as tokenEndpoint, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as authorizationQuerySchema, v as extractRepeatedResourceFromForm, w as seedResources, x as isAudienceClaimAllowed, y as getResource } from "./introspect-Cs1_yhqH.mjs";
-import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-CCi1maVd.mjs";
+import { A as filterClaimsRequestUserInfoClaims, C as resolveResourcePolicy, D as getSupportedClaims, E as STANDARD_CLAIM_NAMES, M as isValidOidcClaimsRequest, O as canSatisfyEssentialAcrRequest, S as logEnforcePerClientResourcesResolution, T as STANDARD_CLAIMS, _ as assertIdentifierValid, a as invalidateRefreshFamily, b as invalidateResourceCache, c as ResourceUriSchema, d as clientJwksSchema, f as clientRegistrationRequestSchema, g as JWS_ALGORITHMS, h as validateClientCredentialsScopes, j as getRequestedUserInfoClaims, k as claimsRequestParameterSchema, l as SafeUrlSchema, m as normalizeClientCredentialsScopes, o as tokenEndpoint, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as authorizationQuerySchema, v as extractRepeatedResourceFromForm, w as seedResources, x as isAudienceClaimAllowed, y as getResource } from "./introspect-C6P1zrTr.mjs";
+import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-C2yu_zRr.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-C0TE7qRr.mjs";
+import { t as PACKAGE_VERSION } from "./version-CwQT3UEe.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { APIError, NO_STORE_HEADERS, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, dispatchAuthEndpoint, getOAuthState, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { generateRandomString, makeSignature } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";
@@ -1776,7 +1777,12 @@ async function checkOAuthClient(client, opts, settings) {
 	});
 	for (const uri of clientWithDefaults.redirect_uris ?? []) validateClientRedirectUri(uri, applicationType ?? (isClientMetadataDocument ? "native" : "web"));
 	const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
-	for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
+	if (isClientMetadataDocument) {
+		if (!grantTypes.some((grantType) => supportedGrantTypes.has(grantType))) throw new APIError("BAD_REQUEST", {
+			error: "invalid_client_metadata",
+			error_description: `no mutually supported grant_type among ${grantTypes.join(", ")}`
+		});
+	} else for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
 		error_description: `unsupported grant_type ${grantType}`
 	});
@@ -5288,7 +5294,7 @@ function formatErrorURL(url, error, description, state, iss, mode = "query") {
 	state && searchParams.append("state", state);
 	iss && searchParams.append("iss", iss);
 	if (mode === "fragment") return `${url}#${searchParams.toString()}`;
-	return `${url}${url.includes("?") ? "&" : "?"}${searchParams.toString()}`;
+	return appendQueryParams(url, searchParams);
 }
 /**
 * Selects the response mode for an error redirect to the RP. OIDC Core 1.0 §5

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-CCi1maVd.mjs";
-import { t as PACKAGE_VERSION } from "./version-C0TE7qRr.mjs";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-C2yu_zRr.mjs";
+import { t as PACKAGE_VERSION } from "./version-CwQT3UEe.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-C0TE7qRr.mjs";
+import { t as PACKAGE_VERSION } from "./version-CwQT3UEe.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { C as resolveResourcePolicy, c as ResourceUriSchema, i as getOAuthProviderApi, p as oauthClientMetadataSchema, v as extractRepeatedResourceFromForm } from "./introspect-Cs1_yhqH.mjs";
-import { D as validateClientScopes, N as extendOAuthProvider, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-CCi1maVd.mjs";
-import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-BP2_wo6r.mjs";
+import { C as resolveResourcePolicy, c as ResourceUriSchema, i as getOAuthProviderApi, p as oauthClientMetadataSchema, v as extractRepeatedResourceFromForm } from "./introspect-C6P1zrTr.mjs";
+import { D as validateClientScopes, N as extendOAuthProvider, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-C2yu_zRr.mjs";
+import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-BmTe2VYG.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-auth/api";
 import * as z from "zod";

package/dist/internal.mjs

@@ -1,2 +1,2 @@
-import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-BP2_wo6r.mjs";
+import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-BmTe2VYG.mjs";
 export { isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };

package/dist/{introspect-Cs1_yhqH.mjs → introspect-C6P1zrTr.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-CCi1maVd.mjs";
+import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-C2yu_zRr.mjs";
 import { APIError } from "better-auth/api";
 import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";

package/dist/{utils-CCi1maVd.mjs → utils-C2yu_zRr.mjs}

@@ -707,7 +707,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-BP2_wo6r.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-BmTe2VYG.mjs").then((n) => n.o);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",

package/dist/{version-C0TE7qRr.mjs → version-CwQT3UEe.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0";
+const PACKAGE_VERSION = "1.7.2";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.0",
-    "@better-auth/memory-adapter": "1.7.0",
-    "better-auth": "1.7.0"
+    "@better-auth/core": "1.7.2",
+    "@better-auth/memory-adapter": "1.7.2",
+    "better-auth": "1.7.2"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "better-call": "1.4.0",
-    "@better-auth/core": "^1.7.0",
-    "better-auth": "^1.7.0"
+    "@better-auth/core": "^1.7.2",
+    "better-auth": "^1.7.2"
   },
   "scripts": {
     "build": "tsdown",