@better-auth/oauth-provider 1.7.10 → 1.7.12

package/dist/{authorize-dkOG8GqZ.mjs → authorize-D_jy3s-1.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as canSatisfyEssentialAcrRequest, C as authorizationQuerySchema, D as STANDARD_CLAIMS, M as filterClaimsRequestUserInfoClaims, N as getRequestedUserInfoClaims, O as STANDARD_CLAIM_NAMES, P as isValidOidcClaimsRequest, S as SafeUrlSchema, T as clientRegistrationRequestSchema, _ as logEnforcePerClientResourcesResolution, a as invalidateRefreshFamily, b as seedResourcesOnce, c as normalizeClientCredentialsScopes, d as JWS_ALGORITHMS, f as assertIdentifierValid, g as isAudienceClaimAllowed, h as invalidateResourceCache, j as claimsRequestParameterSchema, k as getSupportedClaims, l as validateClientCredentialsScopes, m as getResource, o as tokenEndpoint, p as extractRepeatedResourceFromForm, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as getEndpointUrl, v as logStartupSeedFailure, w as clientJwksSchema, x as ResourceUriSchema, y as resolveResourcePolicy } from "./introspect-BVm_zFQC.mjs";
-import { A as validateClientCredentials, B as getSupportedAuthMethods, D as storeToken, E as storeClientSecret, M as verifyOAuthQueryParams, N as applyOAuthProviderMetadataExtensions, R as getClientDiscoveries, S as removePromptFromQuery, T as searchParamsToQuery, U as isExtensionTokenEndpointAuthMethod, V as getSupportedGrantTypes, W as validateOAuthProviderExtensions, a as extractClientCredentials, b as parsePrompt, c as getConsentReferenceId, d as getStoredToken, f as isInvalidJwtError, h as mergeDiscoveryMetadata, i as destructureCredentials, k as toResourceList, l as getJwtPlugin, m as isSessionFreshForSignedQuery, n as clientAllowsGrant, o as findConsent, p as isPKCERequired, r as decryptStoredClientSecret, s as getClient, t as assertNotTrustedClient, v as parseBearerToken, w as resolveSubjectIdentifier, x as removeMaxAgeFromQuery, y as parseClientMetadata } from "./utils-DfMNRh3J.mjs";
+import { A as canSatisfyEssentialAcrRequest, C as authorizationQuerySchema, D as STANDARD_CLAIMS, M as filterClaimsRequestUserInfoClaims, N as getRequestedUserInfoClaims, O as STANDARD_CLAIM_NAMES, P as isValidOidcClaimsRequest, S as SafeUrlSchema, T as clientRegistrationRequestSchema, _ as logEnforcePerClientResourcesResolution, a as invalidateRefreshFamily, b as seedResourcesOnce, c as normalizeClientCredentialsScopes, d as JWS_ALGORITHMS, f as assertIdentifierValid, g as isAudienceClaimAllowed, h as invalidateResourceCache, j as claimsRequestParameterSchema, k as getSupportedClaims, l as validateClientCredentialsScopes, m as getResource, o as tokenEndpoint, p as extractRepeatedResourceFromForm, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as getEndpointUrl, v as logStartupSeedFailure, w as clientJwksSchema, x as ResourceUriSchema, y as resolveResourcePolicy } from "./introspect-DeWu79D4.mjs";
+import { A as validateClientCredentials, B as getSupportedAuthMethods, D as storeToken, E as storeClientSecret, M as verifyOAuthQueryParams, N as applyOAuthProviderMetadataExtensions, R as getClientDiscoveries, S as removePromptFromQuery, T as searchParamsToQuery, U as isExtensionTokenEndpointAuthMethod, V as getSupportedGrantTypes, W as validateOAuthProviderExtensions, a as extractClientCredentials, b as parsePrompt, c as getConsentReferenceId, d as getStoredToken, f as isInvalidJwtError, h as mergeDiscoveryMetadata, i as destructureCredentials, k as toResourceList, l as getJwtPlugin, m as isSessionFreshForSignedQuery, n as clientAllowsGrant, o as findConsent, p as isPKCERequired, r as decryptStoredClientSecret, s as getClient, t as assertNotTrustedClient, v as parseBearerToken, w as resolveSubjectIdentifier, x as removeMaxAgeFromQuery, y as parseClientMetadata } from "./utils-BfpTo7XY.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-aKfgWHzo.mjs";
+import { t as PACKAGE_VERSION } from "./version-anFUgA6q.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { appendQueryParams } from "@better-auth/core/utils/url";
@@ -2033,7 +2033,7 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 		user_id: owner?.referenceId ? void 0 : owner?.userId,
 		reference_id: owner?.referenceId
 	});
-	schema.clientCredentialsScopes = input.registrationSource === "clientMetadataDocument" ? input.existingClient?.clientCredentialsScopes ?? [] : input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
+	schema.clientCredentialsScopes = input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
 	schema.clientDiscoveryId = input.registrationSource === "clientMetadataDocument" ? input.clientDiscoveryId : null;
 	if (input.registrationSource === "clientMetadataDocument" && body.application_type === void 0) schema.applicationType = null;
 	const requestedResources = input.registrationSource === "clientMetadataDocument" ? [] : input.requestedResources ?? [];
@@ -2048,6 +2048,7 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 		let storedClient;
 		let created = false;
 		if (existingClient) {
+			const { clientCredentialsScopes: _ceiling, disabled: _disabled, skipConsent: _skipConsent, enableEndSession: _enableEndSession, ...refreshed } = schema;
 			const updatedClient = await adapter.update({
 				model: clientModel,
 				where: [{
@@ -2058,10 +2059,7 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 					value: clientDiscoveryId
 				}],
 				update: {
-					...schema,
-					disabled: existingClient.disabled,
-					skipConsent: existingClient.skipConsent,
-					enableEndSession: existingClient.enableEndSession,
+					...refreshed,
 					createdAt: existingClient.createdAt,
 					updatedAt: /* @__PURE__ */ new Date(iat * 1e3)
 				}
@@ -4675,12 +4673,19 @@ const oauthProvider = (options) => {
 						description: "Consent processed successfully",
 						content: { "application/json": { schema: {
 							type: "object",
-							properties: { redirect_uri: {
-								type: "string",
-								format: "uri",
-								description: "The URI to redirect to, either with an authorization code or an error"
-							} },
-							required: ["redirect_uri"]
+							properties: {
+								redirect: {
+									type: "boolean",
+									description: "Always true. Indicates the caller should redirect to `url`.",
+									enum: [true]
+								},
+								url: {
+									type: "string",
+									format: "uri-reference",
+									description: "The absolute or relative URI to redirect to next."
+								}
+							},
+							required: ["redirect", "url"]
 						} } }
 					} }
 				} }
@@ -4699,15 +4704,22 @@ const oauthProvider = (options) => {
 				metadata: { openapi: {
 					description: "Continues OAuth2 authorization flow",
 					responses: { "200": {
-						description: "Consent processed successfully",
+						description: "Authorization flow continued successfully",
 						content: { "application/json": { schema: {
 							type: "object",
-							properties: { redirect_uri: {
-								type: "string",
-								format: "uri",
-								description: "The URI to redirect to, either with an authorization code or an error"
-							} },
-							required: ["redirect_uri"]
+							properties: {
+								redirect: {
+									type: "boolean",
+									description: "Always true. Indicates the caller should redirect to `url`.",
+									enum: [true]
+								},
+								url: {
+									type: "string",
+									format: "uri-reference",
+									description: "The absolute or relative URI to redirect to next."
+								}
+							},
+							required: ["redirect", "url"]
 						} } }
 					} }
 				} }

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { l as getJwtPlugin, u as getOAuthProviderPlugin } from "./utils-DfMNRh3J.mjs";
-import { t as PACKAGE_VERSION } from "./version-aKfgWHzo.mjs";
+import { l as getJwtPlugin, u as getOAuthProviderPlugin } from "./utils-BfpTo7XY.mjs";
+import { t as PACKAGE_VERSION } from "./version-anFUgA6q.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-Cse_eZ6i.mjs";
+import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-ChlxgY8l.mjs";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-aKfgWHzo.mjs";
+import { t as PACKAGE_VERSION } from "./version-anFUgA6q.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-DXiqbRzK.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-Cse_eZ6i.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-ChlxgY8l.mjs";
 import { APIError } from "better-call";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { E as oauthClientMetadataSchema, i as getOAuthProviderApi, p as extractRepeatedResourceFromForm, x as ResourceUriSchema, y as resolveResourcePolicy } from "./introspect-BVm_zFQC.mjs";
-import { L as extendOAuthProvider, M as verifyOAuthQueryParams, O as toAudienceClaim, g as normalizeClientAuthenticationParameters, j as validateClientScopes, k as toResourceList, s as getClient, u as getOAuthProviderPlugin } from "./utils-DfMNRh3J.mjs";
-import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-dkOG8GqZ.mjs";
+import { E as oauthClientMetadataSchema, i as getOAuthProviderApi, p as extractRepeatedResourceFromForm, x as ResourceUriSchema, y as resolveResourcePolicy } from "./introspect-DeWu79D4.mjs";
+import { L as extendOAuthProvider, M as verifyOAuthQueryParams, O as toAudienceClaim, g as normalizeClientAuthenticationParameters, j as validateClientScopes, k as toResourceList, s as getClient, u as getOAuthProviderPlugin } from "./utils-BfpTo7XY.mjs";
+import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-D_jy3s-1.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-auth/api";
 import * as z from "zod";

package/dist/internal.mjs

@@ -1,2 +1,2 @@
-import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-dkOG8GqZ.mjs";
+import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-D_jy3s-1.mjs";
 export { isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };

package/dist/{introspect-BVm_zFQC.mjs → introspect-DeWu79D4.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as validateClientCredentials, C as resolveSessionAuthTime, D as storeToken, F as collectExtensionIdTokenClaims, H as hasUserInfoClaimExtension, I as collectExtensionUserInfoClaims, O as toAudienceClaim, P as collectExtensionAccessTokenClaims, V as getSupportedGrantTypes, _ as normalizeTimestampValue, a as extractClientCredentials, d as getStoredToken, f as isInvalidJwtError, i as destructureCredentials, j as validateClientScopes, k as toResourceList, l as getJwtPlugin, n as clientAllowsGrant, p as isPKCERequired, r as decryptStoredClientSecret, s as getClient, w as resolveSubjectIdentifier, y as parseClientMetadata, z as getExtensionGrantHandler } from "./utils-DfMNRh3J.mjs";
+import { A as validateClientCredentials, C as resolveSessionAuthTime, D as storeToken, F as collectExtensionIdTokenClaims, H as hasUserInfoClaimExtension, I as collectExtensionUserInfoClaims, O as toAudienceClaim, P as collectExtensionAccessTokenClaims, V as getSupportedGrantTypes, _ as normalizeTimestampValue, a as extractClientCredentials, d as getStoredToken, f as isInvalidJwtError, i as destructureCredentials, j as validateClientScopes, k as toResourceList, l as getJwtPlugin, n as clientAllowsGrant, p as isPKCERequired, r as decryptStoredClientSecret, s as getClient, w as resolveSubjectIdentifier, y as parseClientMetadata, z as getExtensionGrantHandler } from "./utils-BfpTo7XY.mjs";
 import { APIError } from "better-auth/api";
 import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";

package/dist/{oauth-Cse_eZ6i.d.mts → oauth-ChlxgY8l.d.mts}

@@ -920,7 +920,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                   schema: {
                     type: "object";
                     properties: {
-                      redirect_uri: {
+                      redirect: {
+                        type: string;
+                        description: string;
+                        enum: boolean[];
+                      };
+                      url: {
                         type: string;
                         format: string;
                         description: string;
@@ -980,7 +985,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                   schema: {
                     type: "object";
                     properties: {
-                      redirect_uri: {
+                      redirect: {
+                        type: string;
+                        description: string;
+                        enum: boolean[];
+                      };
+                      url: {
                         type: string;
                         format: string;
                         description: string;

package/dist/{utils-DfMNRh3J.mjs → utils-BfpTo7XY.mjs}

@@ -738,7 +738,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-dkOG8GqZ.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-D_jy3s-1.mjs").then((n) => n.o);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",

package/dist/{version-aKfgWHzo.mjs → version-anFUgA6q.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.10";
+const PACKAGE_VERSION = "1.7.12";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.10",
+  "version": "1.7.12",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.10",
-    "@better-auth/memory-adapter": "1.7.10",
-    "better-auth": "1.7.10"
+    "@better-auth/core": "1.7.12",
+    "@better-auth/memory-adapter": "1.7.12",
+    "better-auth": "1.7.12"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
-    "better-call": "1.4.2",
-    "@better-auth/core": "^1.7.10",
-    "better-auth": "^1.7.10"
+    "better-call": "1.4.4",
+    "@better-auth/core": "^1.7.12",
+    "better-auth": "^1.7.12"
   },
   "scripts": {
     "build": "tsdown",