@better-auth/oauth-provider 1.7.1 → 1.7.3

package/dist/{authorize-Crqw4_bR.mjs → authorize-9whjxVLJ.mjs}

@@ -1,10 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as filterClaimsRequestUserInfoClaims, C as resolveResourcePolicy, D as getSupportedClaims, E as STANDARD_CLAIM_NAMES, M as isValidOidcClaimsRequest, O as canSatisfyEssentialAcrRequest, S as logEnforcePerClientResourcesResolution, T as STANDARD_CLAIMS, _ as assertIdentifierValid, a as invalidateRefreshFamily, b as invalidateResourceCache, c as ResourceUriSchema, d as clientJwksSchema, f as clientRegistrationRequestSchema, g as JWS_ALGORITHMS, h as validateClientCredentialsScopes, j as getRequestedUserInfoClaims, k as claimsRequestParameterSchema, l as SafeUrlSchema, m as normalizeClientCredentialsScopes, o as tokenEndpoint, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as authorizationQuerySchema, v as extractRepeatedResourceFromForm, w as seedResources, x as isAudienceClaimAllowed, y as getResource } from "./introspect-6ew7sakf.mjs";
-import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-B77ebneW.mjs";
+import { A as filterClaimsRequestUserInfoClaims, C as resolveResourcePolicy, D as getSupportedClaims, E as STANDARD_CLAIM_NAMES, M as isValidOidcClaimsRequest, O as canSatisfyEssentialAcrRequest, S as logEnforcePerClientResourcesResolution, T as STANDARD_CLAIMS, _ as assertIdentifierValid, a as invalidateRefreshFamily, b as invalidateResourceCache, c as ResourceUriSchema, d as clientJwksSchema, f as clientRegistrationRequestSchema, g as JWS_ALGORITHMS, h as validateClientCredentialsScopes, j as getRequestedUserInfoClaims, k as claimsRequestParameterSchema, l as SafeUrlSchema, m as normalizeClientCredentialsScopes, o as tokenEndpoint, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as authorizationQuerySchema, v as extractRepeatedResourceFromForm, w as seedResources, x as isAudienceClaimAllowed, y as getResource } from "./introspect-CbhhXT0E.mjs";
+import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-oOcdCCVw.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-DWXDeMXU.mjs";
+import { t as PACKAGE_VERSION } from "./version-dywjHxve.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { APIError, NO_STORE_HEADERS, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, dispatchAuthEndpoint, getOAuthState, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { generateRandomString, makeSignature } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";
@@ -1776,7 +1777,12 @@ async function checkOAuthClient(client, opts, settings) {
 	});
 	for (const uri of clientWithDefaults.redirect_uris ?? []) validateClientRedirectUri(uri, applicationType ?? (isClientMetadataDocument ? "native" : "web"));
 	const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
-	for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
+	if (isClientMetadataDocument) {
+		if (!grantTypes.some((grantType) => supportedGrantTypes.has(grantType))) throw new APIError("BAD_REQUEST", {
+			error: "invalid_client_metadata",
+			error_description: `no mutually supported grant_type among ${grantTypes.join(", ")}`
+		});
+	} else for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
 		error_description: `unsupported grant_type ${grantType}`
 	});
@@ -5288,7 +5294,7 @@ function formatErrorURL(url, error, description, state, iss, mode = "query") {
 	state && searchParams.append("state", state);
 	iss && searchParams.append("iss", iss);
 	if (mode === "fragment") return `${url}#${searchParams.toString()}`;
-	return `${url}${url.includes("?") ? "&" : "?"}${searchParams.toString()}`;
+	return appendQueryParams(url, searchParams);
 }
 /**
 * Selects the response mode for an error redirect to the RP. OIDC Core 1.0 §5
@@ -5373,26 +5379,70 @@ function getErrorURL(ctx, error, description) {
 	return formatErrorURL(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, error, description);
 }
 /**
-* Finds the matching entry in a client's registered redirect_uris for a
-* requested redirect_uri. Honors RFC 8252 §7.3 loopback port variance for
-* the full 127.0.0.0/8 range and [::1], matching on scheme+host+path+query
-* and ignoring port. DNS names like "localhost" are excluded per §8.3.
+* Based on the loopback port matching approach in node-oidc-provider.
+*
+* @see https://github.com/panva/node-oidc-provider/blob/ea1456f987de7750b6af8a89a1881e70c70827fe/lib/models/client.js#L36-L76
+*/
+function stripLoopbackRedirectPort(uri) {
+	let parsed;
+	try {
+		parsed = new URL(uri);
+	} catch {
+		return;
+	}
+	const isLoopback = isLoopbackIP(parsed.hostname) || parsed.hostname === "localhost";
+	if (parsed.protocol !== "http:" || !isLoopback) return;
+	const schemeSeparatorIndex = uri.indexOf("://");
+	if (schemeSeparatorIndex < 0) return void 0;
+	const authorityStart = schemeSeparatorIndex + 3;
+	const authorityEndOffset = uri.slice(authorityStart).search(/[/?#]/u);
+	let authorityEnd = uri.length;
+	if (authorityEndOffset >= 0) authorityEnd = authorityStart + authorityEndOffset;
+	const authority = uri.slice(authorityStart, authorityEnd);
+	let portStart;
+	if (authority.startsWith("[")) {
+		const closingBracket = authority.indexOf("]");
+		if (closingBracket < 0) return void 0;
+		if (authority[closingBracket + 1] !== ":") return uri;
+		portStart = closingBracket + 1;
+	} else {
+		portStart = authority.lastIndexOf(":");
+		if (portStart < 0) return uri;
+	}
+	const port = authority.slice(portStart + 1);
+	if (!/^\d*$/u.test(port)) return;
+	const portStartInUri = authorityStart + portStart;
+	return `${uri.slice(0, portStartInUri)}${uri.slice(authorityEnd)}`;
+}
+/**
+* Finds the matching entry in a client's registered redirect URIs.
+*
+* Registration limits loopback redirects to native-compatible HTTP forms.
+* Within that boundary, only the port may vary; every other character must
+* match the registered URI.
+*
+* @see https://www.rfc-editor.org/rfc/rfc9700.html#section-4.1.3
+* @see https://www.rfc-editor.org/rfc/rfc8252.html#section-8.3
 */
 function findRegisteredRedirectUri(registered, requested) {
 	if (!registered || !requested) return void 0;
-	let req;
+	let requestedUrl;
 	try {
-		req = new URL(requested);
-	} catch {}
+		requestedUrl = new URL(requested);
+	} catch {
+		return;
+	}
+	/**
+	* A trailing `#` yields an empty `URL.hash` but still defines a fragment.
+	*/
+	const hasFragment = requested.includes("#");
+	const hasUserinfo = requestedUrl.username.length > 0 || requestedUrl.password.length > 0;
+	if (hasFragment || hasUserinfo) return;
+	const requestedWithoutPort = stripLoopbackRedirectPort(requested);
 	return registered.find((url) => {
 		if (url === requested) return true;
-		if (!req) return false;
-		try {
-			const reg = new URL(url);
-			return isLoopbackIP(reg.hostname) && reg.hostname === req.hostname && reg.pathname === req.pathname && reg.protocol === req.protocol && reg.search === req.search;
-		} catch {
-			return false;
-		}
+		if (!requestedWithoutPort) return false;
+		return stripLoopbackRedirectPort(url) === requestedWithoutPort;
 	});
 }
 /**

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-B77ebneW.mjs";
-import { t as PACKAGE_VERSION } from "./version-DWXDeMXU.mjs";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-oOcdCCVw.mjs";
+import { t as PACKAGE_VERSION } from "./version-dywjHxve.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-DWXDeMXU.mjs";
+import { t as PACKAGE_VERSION } from "./version-dywjHxve.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { C as resolveResourcePolicy, c as ResourceUriSchema, i as getOAuthProviderApi, p as oauthClientMetadataSchema, v as extractRepeatedResourceFromForm } from "./introspect-6ew7sakf.mjs";
-import { D as validateClientScopes, N as extendOAuthProvider, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-B77ebneW.mjs";
-import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-Crqw4_bR.mjs";
+import { C as resolveResourcePolicy, c as ResourceUriSchema, i as getOAuthProviderApi, p as oauthClientMetadataSchema, v as extractRepeatedResourceFromForm } from "./introspect-CbhhXT0E.mjs";
+import { D as validateClientScopes, N as extendOAuthProvider, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-oOcdCCVw.mjs";
+import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-9whjxVLJ.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-auth/api";
 import * as z from "zod";

package/dist/internal.mjs

@@ -1,2 +1,2 @@
-import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-Crqw4_bR.mjs";
+import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-9whjxVLJ.mjs";
 export { isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };

package/dist/{introspect-6ew7sakf.mjs → introspect-CbhhXT0E.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-B77ebneW.mjs";
+import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-oOcdCCVw.mjs";
 import { APIError } from "better-auth/api";
 import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";

package/dist/{utils-B77ebneW.mjs → utils-oOcdCCVw.mjs}

@@ -707,7 +707,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-Crqw4_bR.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-9whjxVLJ.mjs").then((n) => n.o);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",

package/dist/{version-DWXDeMXU.mjs → version-dywjHxve.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.1";
+const PACKAGE_VERSION = "1.7.3";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.1",
+  "version": "1.7.3",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -66,21 +66,21 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "zod": "^4.3.6"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.1",
-    "@better-auth/memory-adapter": "1.7.1",
-    "better-auth": "1.7.1"
+    "@better-auth/core": "1.7.3",
+    "@better-auth/memory-adapter": "1.7.3",
+    "better-auth": "1.7.3"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "better-call": "1.4.0",
-    "better-auth": "^1.7.1",
-    "@better-auth/core": "^1.7.1"
+    "@better-auth/core": "^1.7.3",
+    "better-auth": "^1.7.3"
   },
   "scripts": {
     "build": "tsdown",