@better-auth/oauth-provider 1.7.10 → 1.8.0-beta.1

package/dist/{utils-DfMNRh3J.mjs → utils-D-CUrvd1.mjs}

@@ -6,7 +6,146 @@ import { BetterAuthError } from "@better-auth/core/error";
 import { CLIENT_ASSERTION_TYPE, decodeBasicCredentials } from "@better-auth/core/oauth2";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
-import { errors } from "jose";
+//#region src/client-metadata.ts
+const OAUTH_CLIENT_RECORD_FIELD_NAMES = Object.freeze(Object.keys({
+	clientId: true,
+	clientSecret: true,
+	clientDiscoveryId: true,
+	disabled: true,
+	scopes: true,
+	clientCredentialsScopes: true,
+	userId: true,
+	createdAt: true,
+	updatedAt: true,
+	expiresAt: true,
+	name: true,
+	uri: true,
+	icon: true,
+	contacts: true,
+	tos: true,
+	policy: true,
+	softwareId: true,
+	softwareVersion: true,
+	softwareStatement: true,
+	redirectUris: true,
+	postLogoutRedirectUris: true,
+	backchannelLogoutUri: true,
+	backchannelLogoutSessionRequired: true,
+	frontchannelLogoutUri: true,
+	frontchannelLogoutSessionRequired: true,
+	tokenEndpointAuthMethod: true,
+	grantTypes: true,
+	responseTypes: true,
+	applicationType: true,
+	jwks: true,
+	jwksUri: true,
+	requirePKCE: true,
+	dpopBoundAccessTokens: true,
+	skipConsent: true,
+	enableEndSession: true,
+	subjectType: true,
+	sectorIdentifier: true,
+	referenceId: true,
+	metadata: true
+}));
+/**
+* Canonical wire fields emitted by schemaToOAuth. They are mapped explicitly
+* and therefore must never also survive inside the opaque metadata envelope.
+*/
+const OAUTH_CLIENT_WIRE_FIELD_NAMES = [
+	"client_id",
+	"client_secret",
+	"client_secret_expires_at",
+	"scope",
+	"user_id",
+	"client_id_issued_at",
+	"client_name",
+	"client_uri",
+	"logo_uri",
+	"contacts",
+	"tos_uri",
+	"policy_uri",
+	"jwks",
+	"jwks_uri",
+	"software_id",
+	"software_version",
+	"software_statement",
+	"redirect_uris",
+	"post_logout_redirect_uris",
+	"backchannel_logout_uri",
+	"backchannel_logout_session_required",
+	"frontchannel_logout_uri",
+	"frontchannel_logout_session_required",
+	"token_endpoint_auth_method",
+	"grant_types",
+	"response_types",
+	"application_type",
+	"disabled",
+	"skip_consent",
+	"enable_end_session",
+	"require_pkce",
+	"dpop_bound_access_tokens",
+	"subject_type",
+	"reference_id"
+];
+const OPAQUE_METADATA_RESERVED_FIELDS = new Set([
+	...OAUTH_CLIENT_RECORD_FIELD_NAMES,
+	...OAUTH_CLIENT_WIRE_FIELD_NAMES,
+	"public",
+	"type",
+	"resources",
+	"client_credentials_scopes"
+]);
+const CIMD_FORBIDDEN_SERVER_FIELD_NAMES = new Set([
+	"disabled",
+	"client_secret",
+	"client_secret_expires_at",
+	"client_id_issued_at",
+	"skip_consent",
+	"enable_end_session",
+	"require_pkce",
+	"reference_id",
+	"user_id",
+	"resources",
+	"clientSecret",
+	"clientDiscoveryId",
+	"sectorIdentifier",
+	"skipConsent",
+	"enableEndSession",
+	"requirePKCE",
+	"referenceId",
+	"userId",
+	"clientId",
+	"applicationType",
+	"tokenEndpointAuthMethod",
+	"redirectUris",
+	"postLogoutRedirectUris",
+	"grantTypes",
+	"responseTypes",
+	"scopes",
+	"expiresAt",
+	"createdAt",
+	"updatedAt",
+	"softwareId",
+	"softwareVersion",
+	"softwareStatement",
+	"backchannelLogoutUri",
+	"backchannelLogoutSessionRequired",
+	"jwksUri",
+	"dpopBoundAccessTokens",
+	"subjectType"
+]);
+function isForbiddenCimdClientMetadataField(field) {
+	return CIMD_FORBIDDEN_SERVER_FIELD_NAMES.has(field);
+}
+function isReservedOAuthClientMetadataField(field) {
+	return OPAQUE_METADATA_RESERVED_FIELDS.has(field);
+}
+function stripReservedOAuthClientMetadataExtensions(metadata) {
+	if (!metadata) return void 0;
+	return Object.fromEntries(Object.entries(metadata).filter(([field]) => !OPAQUE_METADATA_RESERVED_FIELDS.has(field)));
+}
+//#endregion
 //#region src/extensions.ts
 const DEFAULT_GRANT_TYPES = [
 	"authorization_code",
@@ -71,11 +210,16 @@ function collectExtensionKeys(extension) {
 	}
 	const clientDiscoveryIds = (extension.clientDiscovery ? Array.isArray(extension.clientDiscovery) ? extension.clientDiscovery : [extension.clientDiscovery] : []).map((discovery) => discovery.id);
 	for (const clientDiscoveryId of clientDiscoveryIds) assertNonEmptyExtensionValue("client discovery id", clientDiscoveryId);
+	for (const field of extension.clientMetadata?.fields ?? []) {
+		assertNonEmptyExtensionValue("client metadata field", field);
+		if (isReservedOAuthClientMetadataField(field)) throw new BetterAuthError(`OAuth Provider extension client metadata field is reserved: ${field}`);
+	}
 	return {
 		grantTypes,
 		authMethods,
 		assertionTypes,
-		clientDiscoveryIds
+		clientDiscoveryIds,
+		interactionRequestParameters: Object.keys(extension.interactionRequests ?? {})
 	};
 }
 function assertNoDuplicateAcrossExtensions(label, values) {
@@ -98,6 +242,7 @@ function validateOAuthProviderExtensions(extensions) {
 	assertNoDuplicateAcrossExtensions("token_endpoint_auth_method", keys.flatMap((k) => k.authMethods));
 	assertNoDuplicateAcrossExtensions("client_assertion_type", keys.flatMap((k) => k.assertionTypes));
 	assertNoDuplicateAcrossExtensions("client discovery id", keys.flatMap((k) => k.clientDiscoveryIds));
+	assertNoDuplicateAcrossExtensions("interaction request parameter", keys.flatMap((k) => k.interactionRequestParameters));
 }
 function getOAuthProviderExtensions(opts) {
 	return opts.extensions ?? [];
@@ -154,6 +299,23 @@ function getExtensionGrantTypes(opts) {
 function getSupportedGrantTypes(opts) {
 	return Array.from(new Set([...opts.grantTypes ?? DEFAULT_GRANT_TYPES, ...getExtensionGrantTypes(opts)]));
 }
+/**
+* Finds the interaction request a query identifies, such as a device approval
+* keyed by `user_code`. Authorization requests, which carry `response_type` or
+* a pushed `request_uri`, never match.
+*/
+function getExtensionInteractionRequest(opts, query) {
+	const parameters = query;
+	if (parameters.response_type !== void 0 || parameters.request_uri !== void 0) return;
+	for (const extension of getOAuthProviderExtensions(opts)) for (const [parameter, handler] of Object.entries(extension.interactionRequests ?? {})) {
+		const value = parameters[parameter];
+		if (typeof value === "string" && value) return {
+			parameter,
+			handler,
+			value
+		};
+	}
+}
 function getExtensionGrantHandler(opts, grantType) {
 	for (const extension of getOAuthProviderExtensions(opts)) {
 		const handler = extension.grants?.[grantType];
@@ -231,6 +393,29 @@ function collectExtensionIdTokenClaims(opts, input) {
 function collectExtensionUserInfoClaims(opts, input) {
 	return collectClaims(opts, (extension) => extension.claims?.userInfo?.(input));
 }
+/** Whether any extension declares client metadata fields or a validator. */
+function hasExtensionClientMetadata(opts) {
+	return getOAuthProviderExtensions(opts).some((extension) => extension.clientMetadata);
+}
+/** Registration fields that extensions define, stored in the client's `metadata`. */
+function getExtensionClientMetadataFields(opts) {
+	return new Set(getOAuthProviderExtensions(opts).flatMap((extension) => extension.clientMetadata?.fields ?? []));
+}
+/**
+* Runs every extension's client metadata validator, in registration order.
+* Extensions read their fields from `metadata` only, so `metadata` and
+* declared fields are removed from the client they receive; a metadata
+* document carries declared fields at its top level.
+*/
+async function validateExtensionClientMetadata(opts, client, metadata) {
+	const { metadata: _metadata, ...coreClient } = client;
+	const extensionFields = getExtensionClientMetadataFields(opts);
+	const input = {
+		client: Object.fromEntries(Object.entries(coreClient).filter(([field]) => !extensionFields.has(field))),
+		metadata: stripReservedOAuthClientMetadataExtensions(metadata) ?? {}
+	};
+	for (const extension of getOAuthProviderExtensions(opts)) await extension.clientMetadata?.validate?.(input);
+}
 /**
 * Whether any registered extension contributes UserInfo claims. Lets the
 * UserInfo endpoint skip loading the client when nothing needs it.
@@ -295,21 +480,6 @@ const getJwtPlugin = (ctx) => {
 	if (!plugin) throw new BetterAuthError("jwt_config");
 	return plugin;
 };
-const joseInfrastructureErrorCodes = new Set([
-	errors.JWKSTimeout.code,
-	errors.JWKSInvalid.code,
-	errors.JWKSMultipleMatchingKeys.code
-]);
-/**
-* Whether a JWT verification error comes from the token itself (malformed,
-* bad signature, unsupported alg, unknown kid, failed claim checks), as
-* opposed to a key set failure that should still surface as a server error.
-*
-* @internal
-*/
-function isInvalidJwtError(error) {
-	return error instanceof errors.JOSEError && !joseInfrastructureErrorCodes.has(error.code);
-}
 /**
 * Normalizes timestamp-like values returned by adapters.
 *
@@ -557,6 +727,53 @@ function throwInvalidAuthenticationRequest(errorDescription) {
 	});
 }
 /**
+* Re-reads a request's raw `application/x-www-form-urlencoded` body, keeping
+* every value of a repeated key. better-call's form-body parser keeps only the
+* last one, so `resource=https://a&resource=https://b` reaches the handler as
+* `{ resource: "https://b" }`. Query strings are unaffected: the router keeps
+* repeated query keys as arrays.
+*
+* Returns `undefined` for other media types or an unreadable or empty body.
+* The endpoint MUST set `cloneRequest: true`, because the body stream is read
+* a second time.
+*
+* @internal
+*/
+async function readFormParams(request) {
+	if (!(request.headers.get("content-type")?.toLowerCase() ?? "").includes("application/x-www-form-urlencoded")) return;
+	let text;
+	try {
+		text = await request.clone().text();
+	} catch {
+		return;
+	}
+	return text ? new URLSearchParams(text) : void 0;
+}
+/**
+* Applies RFC 6749 §3.2 to a form body the parser collapsed to one value per
+* key: a parameter sent without a value counts as omitted, and a parameter
+* sent more than once is rejected with `invalid_request`. A name in
+* `repeatable`, such as RFC 8707 `resource`, keeps every value as an array
+* when it repeats. A value a `before` hook replaced is left as the hook set it.
+*
+* @internal
+*/
+function applyFormParams(params, body, repeatable = []) {
+	const merged = { ...body };
+	for (const name of new Set(params.keys())) {
+		const raw = params.getAll(name);
+		const values = raw.filter(Boolean);
+		if (values.length > 1 && !repeatable.includes(name)) throw new APIError("BAD_REQUEST", {
+			error: "invalid_request",
+			error_description: `${name} must not be repeated`
+		});
+		if (merged[name] !== raw.at(-1)) continue;
+		if (values.length === 0) delete merged[name];
+		else merged[name] = values.length === 1 ? values[0] : values;
+	}
+	return merged;
+}
+/**
 * Normalizes client identification and authentication parameters while
 * enforcing RFC 6749 §2.3 and RFC 8628 §3.1 cardinality. Empty values are
 * omitted. Client identification remains separate from authentication-method
@@ -635,6 +852,37 @@ function clientAllowsGrant(client, grantType) {
 	return allowedGrants.includes(grantType);
 }
 /**
+* Throws an OAuth error response (RFC 6749 §5.2).
+*
+* @internal
+*/
+function tokenError(status, error, errorDescription) {
+	throw new APIError(status, {
+		error,
+		error_description: errorDescription
+	});
+}
+/**
+* Splits a space-delimited OAuth `scope` value (RFC 6749 §3.3).
+*
+* @internal
+*/
+function parseScopes(scope) {
+	const normalized = scope?.trim();
+	return normalized ? normalized.split(/\s+/) : [];
+}
+/**
+* Whether a stored consent covers every requested scope and resource. Shared by
+* authorization and grants that need prior consent, so the coverage rule cannot
+* drift between them. Each caller still chooses which consent rows to check.
+*
+* @internal
+*/
+function consentCovers(consent, scopes, resources) {
+	const consentedResources = consent.resources ?? [];
+	return scopes.every((scope) => consent.scopes.includes(scope)) && resources.every((resource) => consentedResources.includes(resource));
+}
+/**
 * Validates requested scopes against a registered client's allowed scopes.
 *
 * @internal
@@ -738,7 +986,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-dkOG8GqZ.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-Dg976Ug0.mjs").then((n) => n.s);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",
@@ -787,12 +1035,31 @@ function parsePrompt(prompt) {
 	return new Set(set);
 }
 /**
-* Extracts the sector identifier (hostname) from a client's first redirect URI.
+* Derives the pairwise sector to store for a client.
+*
+* Only an `https` host identifies who controls a redirect URI, so clients
+* whose redirect URIs are all `https` share the sector of that host. Any app
+* can register a custom scheme, and any local process can listen on a
+* loopback port, so every other client gets a sector of its own. `/` cannot
+* appear in a URL host, so a client sector never equals a host sector.
+*
+* @see https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
+* @internal
+*/
+function deriveSectorIdentifier(clientId, redirectUris) {
+	const urls = (redirectUris ?? []).map((uri) => new URL(uri));
+	const first = urls[0];
+	return first && urls.every((url) => url.protocol === "https:") ? first.host : `client/${clientId}`;
+}
+/**
+* Returns the client's stored pairwise sector, or for a client created before
+* sectors were stored, the host of its first redirect URI.
 *
 * @see https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
 * @internal
 */
 function getSectorIdentifier(client) {
+	if (client.sectorIdentifier) return client.sectorIdentifier;
 	const uri = client.redirectUris?.[0];
 	if (!uri) throw new BetterAuthError("Client has no redirect URIs for sector identifier");
 	return new URL(uri).host;
@@ -920,4 +1187,4 @@ function isPKCERequired(client, request) {
 	return false;
 }
 //#endregion
-export { validateClientCredentials as A, getSupportedAuthMethods as B, resolveSessionAuthTime as C, storeToken as D, storeClientSecret as E, collectExtensionIdTokenClaims as F, hasUserInfoClaimExtension as H, collectExtensionUserInfoClaims as I, extendOAuthProvider as L, verifyOAuthQueryParams as M, applyOAuthProviderMetadataExtensions as N, toAudienceClaim as O, collectExtensionAccessTokenClaims as P, getClientDiscoveries as R, removePromptFromQuery as S, searchParamsToQuery as T, isExtensionTokenEndpointAuthMethod as U, getSupportedGrantTypes as V, validateOAuthProviderExtensions as W, normalizeTimestampValue as _, extractClientCredentials as a, parsePrompt as b, getConsentReferenceId as c, getStoredToken as d, isInvalidJwtError as f, normalizeClientAuthenticationParameters as g, mergeDiscoveryMetadata as h, destructureCredentials as i, validateClientScopes as j, toResourceList as k, getJwtPlugin as l, isSessionFreshForSignedQuery as m, clientAllowsGrant as n, findConsent as o, isPKCERequired as p, decryptStoredClientSecret as r, getClient as s, assertNotTrustedClient as t, getOAuthProviderPlugin as u, parseBearerToken as v, resolveSubjectIdentifier as w, removeMaxAgeFromQuery as x, parseClientMetadata as y, getExtensionGrantHandler as z };
+export { validateOAuthProviderExtensions as $, storeClientSecret as A, collectExtensionIdTokenClaims as B, parseScopes as C, resolveSessionAuthTime as D, removePromptFromQuery as E, validateClientCredentials as F, getExtensionGrantHandler as G, extendOAuthProvider as H, validateClientScopes as I, getSupportedGrantTypes as J, getExtensionInteractionRequest as K, verifyOAuthQueryParams as L, toAudienceClaim as M, toResourceList as N, resolveSubjectIdentifier as O, tokenError as P, validateExtensionClientMetadata as Q, applyOAuthProviderMetadataExtensions as R, parsePrompt as S, removeMaxAgeFromQuery as T, getClientDiscoveries as U, collectExtensionUserInfoClaims as V, getExtensionClientMetadataFields as W, hasUserInfoClaimExtension as X, hasExtensionClientMetadata as Y, isExtensionTokenEndpointAuthMethod as Z, mergeDiscoveryMetadata as _, decryptStoredClientSecret as a, parseBearerToken as b, extractClientCredentials as c, getConsentReferenceId as d, isForbiddenCimdClientMetadataField as et, getJwtPlugin as f, isSessionFreshForSignedQuery as g, isPKCERequired as h, consentCovers as i, storeToken as j, searchParamsToQuery as k, findConsent as l, getStoredToken as m, assertNotTrustedClient as n, deriveSectorIdentifier as o, getOAuthProviderPlugin as p, getSupportedAuthMethods as q, clientAllowsGrant as r, destructureCredentials as s, applyFormParams as t, stripReservedOAuthClientMetadataExtensions as tt, getClient as u, normalizeClientAuthenticationParameters as v, readFormParams as w, parseClientMetadata as x, normalizeTimestampValue as y, collectExtensionAccessTokenClaims as z };

package/dist/{version-aKfgWHzo.mjs → version-BwHks7Wg.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.10";
+const PACKAGE_VERSION = "1.8.0-beta.1";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.10",
+  "version": "1.8.0-beta.1",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.10",
-    "@better-auth/memory-adapter": "1.7.10",
-    "better-auth": "1.7.10"
+    "@better-auth/core": "1.8.0-beta.1",
+    "@better-auth/memory-adapter": "1.8.0-beta.1",
+    "better-auth": "1.8.0-beta.1"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
     "better-call": "1.4.2",
-    "@better-auth/core": "^1.7.10",
-    "better-auth": "^1.7.10"
+    "@better-auth/core": "^1.8.0-beta.1",
+    "better-auth": "^1.8.0-beta.1"
   },
   "scripts": {
     "build": "tsdown",

package/dist/client-jwks-DY2QBrsl.d.mts

@@ -1,25 +0,0 @@
-import { o as OAuthClient } from "./oauth-DXiqbRzK.mjs";
-import { JSONWebKeySet } from "jose";
-
-//#region src/client-jwks.d.ts
-/** A client's inline public JWK Set, as registration and key rotation accept it. */
-type ClientJwks = NonNullable<OAuthClient["jwks"]>;
-type PublicClientJwksValidationResult = {
-  valid: true;
-  jwks: JSONWebKeySet;
-} | {
-  valid: false;
-  error: "jwks must be an RFC 7517 JWK Set object with a non-empty keys array" | "jwks must contain only public asymmetric keys" | "jwks keys must be supported public JWKs with required key parameters" | "jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve";
-};
-/**
- * Validates an OAuth client's public asymmetric JWK set.
- *
- * This boundary accepts only the RFC 7517 `{ keys: [...] }` representation.
- * It performs no I/O and returns the validated set for downstream JOSE
- * verification.
- *
- * @internal
- */
-declare function validatePublicClientJwks(input: unknown): PublicClientJwksValidationResult;
-//#endregion
-export { PublicClientJwksValidationResult as n, validatePublicClientJwks as r, ClientJwks as t };