@better-auth/oauth-provider 1.7.6 → 1.7.8

package/dist/{authorize-CLuqtSXQ.mjs → authorize-C95F-9E1.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as filterClaimsRequestUserInfoClaims, C as resolveResourcePolicy, D as getSupportedClaims, E as STANDARD_CLAIM_NAMES, M as isValidOidcClaimsRequest, O as canSatisfyEssentialAcrRequest, S as logEnforcePerClientResourcesResolution, T as STANDARD_CLAIMS, _ as assertIdentifierValid, a as invalidateRefreshFamily, b as invalidateResourceCache, c as ResourceUriSchema, d as clientJwksSchema, f as clientRegistrationRequestSchema, g as JWS_ALGORITHMS, h as validateClientCredentialsScopes, j as getRequestedUserInfoClaims, k as claimsRequestParameterSchema, l as SafeUrlSchema, m as normalizeClientCredentialsScopes, o as tokenEndpoint, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as authorizationQuerySchema, v as extractRepeatedResourceFromForm, w as seedResources, x as isAudienceClaimAllowed, y as getResource } from "./introspect-CbYi2MJT.mjs";
-import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-CoqjzHuU.mjs";
+import { A as claimsRequestParameterSchema, C as clientJwksSchema, D as STANDARD_CLAIM_NAMES, E as STANDARD_CLAIMS, M as getRequestedUserInfoClaims, N as isValidOidcClaimsRequest, O as getSupportedClaims, S as authorizationQuerySchema, _ as logStartupSeedFailure, a as invalidateRefreshFamily, b as ResourceUriSchema, c as normalizeClientCredentialsScopes, d as assertIdentifierValid, f as extractRepeatedResourceFromForm, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, j as filterClaimsRequestUserInfoClaims, k as canSatisfyEssentialAcrRequest, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as tokenEndpoint, p as getResource, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as JWS_ALGORITHMS, v as resolveResourcePolicy, w as clientRegistrationRequestSchema, x as SafeUrlSchema, y as seedResourcesOnce } from "./introspect-H3uoUiuS.mjs";
+import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-CGIZS-Da.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-9KCSx144.mjs";
+import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { appendQueryParams } from "@better-auth/core/utils/url";
@@ -16,12 +16,12 @@ import { BetterAuthError } from "@better-auth/core/error";
 import { deleteSessionCookie, parseSetCookieHeader } from "better-auth/cookies";
 import { mergeSchema } from "better-auth/db";
 import { CLIENT_ASSERTION_TYPE, DPOP_SIGNING_ALGORITHMS, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
-import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 import { getJwks, stripAccessTokenAuthorizationScheme } from "better-auth/oauth2";
 import { compactVerify, createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
+import { isNativePrivateUseRedirectUri } from "@better-auth/core/utils/redirect-uri";
 import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
-import { isReverseDomainPrivateUseRedirectUri } from "@better-auth/core/utils/redirect-uri";
+import { encodeDeterministicId } from "@better-auth/core/db/internal";
 //#region src/consent.ts
 async function consentEndpoint(ctx, opts, authorize) {
 	const oauthRequest = await oAuthState.get();
@@ -1172,7 +1172,7 @@ function stripReservedOAuthClientMetadataExtensions(metadata) {
 * @throws APIError UNAUTHORIZED when there is no session or the hook denies the action.
 * @throws APIError BAD_REQUEST when the request carries no headers.
 */
-async function assertClientPrivileges(ctx, session, opts, action) {
+async function assertClientPrivileges(ctx, session, opts, action, clientId) {
 	if (!session) throw new APIError("UNAUTHORIZED");
 	if (!ctx.headers) throw new APIError("BAD_REQUEST");
 	if (action === "configure-client-credentials-scopes" && !opts.clientPrivileges) throw new APIError("UNAUTHORIZED");
@@ -1180,7 +1180,36 @@ async function assertClientPrivileges(ctx, session, opts, action) {
 		headers: ctx.headers,
 		action,
 		session: session.session,
-		user: session.user
+		user: session.user,
+		clientId
+	})) throw new APIError("UNAUTHORIZED");
+}
+//#endregion
+//#region src/oauthResource/privileges.ts
+/**
+* Authorizes a resource action against the configured `resourcePrivileges`
+* hook. Gates every admin resource endpoint and the resource links selected
+* during managed client registration. Mirrors `assertClientPrivileges`:
+* a missing session → 401; a defined `resourcePrivileges` callback that
+* returns falsy → 401 with the original action context preserved.
+*
+* When `resourcePrivileges` is undefined, the gate degrades to "any
+* authenticated session can manage resources" — same forgiving default
+* as `clientPrivileges`. Operators who care about RBAC must define the
+* callback.
+*
+* @internal
+*/
+async function assertResourcePrivileges(ctx, session, opts, action, resourceId) {
+	if (!session) throw new APIError("UNAUTHORIZED");
+	if (!ctx.headers) throw new APIError("BAD_REQUEST");
+	if (!opts.resourcePrivileges) return;
+	if (!await opts.resourcePrivileges({
+		headers: ctx.headers,
+		action,
+		session: session.session,
+		user: session.user,
+		resourceId
 	})) throw new APIError("UNAUTHORIZED");
 }
 //#endregion
@@ -1426,7 +1455,7 @@ async function consumeClientAssertion(ctx, opts, params) {
 		error: "invalid_client"
 	});
 	const jtiDigest = await createHash("SHA-256").digest(new TextEncoder().encode(`${namespace}:${payload.jti}`));
-	const jtiId = base64Url.encode(new Uint8Array(jtiDigest).slice(0, 24), { padding: false });
+	const jtiId = encodeDeterministicId(new Uint8Array(jtiDigest).slice(0, 24), ctx.context.options);
 	try {
 		await ctx.context.adapter.create({
 			model: "oauthClientAssertion",
@@ -1637,14 +1666,31 @@ function applyOAuthClientRegistrationDefaults(client, defaultApplicationType = "
 		response_types: resolveRegistrationResponseTypes(client, grantTypes)
 	};
 }
-const FORBIDDEN_NATIVE_REDIRECT_SCHEMES = new Set([
-	"file:",
-	"ftp:",
-	"mailto:",
-	"javascript:",
-	"data:",
-	"vbscript:"
-]);
+function isCustomSchemeWithHost(redirectUri) {
+	const url = new URL(redirectUri);
+	return url.protocol !== "http:" && url.protocol !== "https:" && url.host !== "";
+}
+function isNonHttpRedirectUri(redirectUri) {
+	try {
+		const protocol = new URL(redirectUri).protocol;
+		return protocol !== "http:" && protocol !== "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Server-owned default for dynamic registrations that omit `application_type`.
+* `"infer"` classifies as native when any redirect URI uses a non-http(s)
+* scheme, because a web client can never register one. Every URI is then
+* validated against the native rules. A sent `application_type` is never
+* overridden because `applyOAuthClientRegistrationDefaults` only fills the
+* absent field.
+*/
+function resolveDynamicRegistrationDefaultApplicationType(opts, client) {
+	const configured = opts.clientRegistrationDefaultApplicationType ?? "web";
+	if (configured !== "infer") return configured;
+	return (client.redirect_uris ?? []).some(isNonHttpRedirectUri) ? "native" : "web";
+}
 function invalidRedirectUri(description) {
 	throw new APIError("BAD_REQUEST", {
 		error: "invalid_redirect_uri",
@@ -1661,13 +1707,15 @@ function getRawHttpHostname(redirectUri) {
 	}
 	return (hostAndPort.split(":")[0] ?? "").toLowerCase();
 }
-async function resolveClientRegistrationResources(ctx, opts, requestedResources) {
-	const defaultResources = opts.clientRegistrationDefaultResources ?? [];
-	const allowedResources = new Set([...defaultResources, ...opts.clientRegistrationAllowedResources ?? []]);
+function assertDynamicRegistrationResourcesAllowed(opts, requestedResources) {
+	const allowedResources = new Set([...opts.clientRegistrationDefaultResources ?? [], ...opts.clientRegistrationAllowedResources ?? []]);
 	for (const identifier of requestedResources) if (!allowedResources.has(identifier)) throw new APIError("BAD_REQUEST", {
 		error: "invalid_target",
 		error_description: `requested resource ${identifier} is not allowed for client registration`
 	});
+}
+async function resolveClientRegistrationResources(ctx, opts, requestedResources) {
+	const defaultResources = opts.clientRegistrationDefaultResources ?? [];
 	const resources = [...new Set([...defaultResources, ...requestedResources])];
 	for (const identifier of resources) {
 		const row = await getResource(ctx, opts, identifier);
@@ -1708,7 +1756,7 @@ function validateClientRedirectUri(redirectUri, applicationType) {
 		if (!isAllowedNativeHttpLoopback) invalidRedirectUri(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${redirectUri}`);
 		return;
 	}
-	if (FORBIDDEN_NATIVE_REDIRECT_SCHEMES.has(url.protocol) || !isReverseDomainPrivateUseRedirectUri(url)) invalidRedirectUri(`native private-use redirect URI schemes must be well-formed reverse-domain names, omit the naming authority, and must not use a reserved scheme: ${redirectUri}`);
+	if (!isNativePrivateUseRedirectUri(url)) invalidRedirectUri(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${redirectUri}`);
 }
 function assertValidRegistrationJwks(jwks) {
 	const result = validatePublicClientJwks(jwks);
@@ -1754,7 +1802,7 @@ async function registerEndpoint(ctx, opts) {
 }
 async function checkOAuthClient(client, opts, settings) {
 	const isClientMetadataDocument = settings?.registrationSource === "clientMetadataDocument";
-	const clientWithDefaults = applyOAuthClientRegistrationDefaults(client, isClientMetadataDocument ? null : "web");
+	const clientWithDefaults = applyOAuthClientRegistrationDefaults(client, isClientMetadataDocument ? null : settings?.registrationSource === "dynamic" ? resolveDynamicRegistrationDefaultApplicationType(opts, client) : "web");
 	const tokenEndpointAuthMethod = clientWithDefaults.token_endpoint_auth_method ?? "client_secret_basic";
 	if (!new Set(getSupportedAuthMethods(opts, { includeNone: true })).has(tokenEndpointAuthMethod)) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
@@ -1803,6 +1851,10 @@ async function checkOAuthClient(client, opts, settings) {
 			error: "invalid_client_metadata",
 			error_description: "pairwise subject_type requires server pairwiseSecret configuration"
 		});
+		if (clientWithDefaults.subject_type === "pairwise" && clientWithDefaults.redirect_uris?.some(isCustomSchemeWithHost)) throw new APIError("BAD_REQUEST", {
+			error: "invalid_client_metadata",
+			error_description: "pairwise clients cannot use custom-scheme redirect URIs that include a host"
+		});
 		if (clientWithDefaults.subject_type === "pairwise" && clientWithDefaults.redirect_uris && clientWithDefaults.redirect_uris.length > 1) {
 			if (new Set(clientWithDefaults.redirect_uris.map((uri) => new URL(uri).host)).size > 1) throw new APIError("BAD_REQUEST", {
 				error: "invalid_client_metadata",
@@ -1914,10 +1966,11 @@ function isClientRegistrationCollision(error) {
 * boundary.
 */
 async function persistOAuthClientRegistration(ctx, opts, input) {
-	const body = applyOAuthClientRegistrationDefaults(input.registrationSource === "dynamic" && !input.metadata.scope ? {
+	const registrationMetadata = input.registrationSource === "dynamic" && !input.metadata.scope ? {
 		...input.metadata,
 		scope: (opts.clientRegistrationDefaultScopes ?? opts.scopes)?.join(" ")
-	} : input.metadata, input.registrationSource === "clientMetadataDocument" ? null : "web");
+	} : input.metadata;
+	const body = applyOAuthClientRegistrationDefaults(registrationMetadata, input.registrationSource === "clientMetadataDocument" ? null : input.registrationSource === "dynamic" ? resolveDynamicRegistrationDefaultApplicationType(opts, registrationMetadata) : "web");
 	const isPublic = body.token_endpoint_auth_method === "none";
 	const isPrivateKeyJwt = body.token_endpoint_auth_method === "private_key_jwt";
 	const isExtensionAuthMethod = isExtensionTokenEndpointAuthMethod(opts, body.token_endpoint_auth_method);
@@ -1954,7 +2007,9 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 	schema.clientCredentialsScopes = input.registrationSource === "clientMetadataDocument" ? input.existingClient?.clientCredentialsScopes ?? [] : input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
 	schema.clientDiscoveryId = input.registrationSource === "clientMetadataDocument" ? input.clientDiscoveryId : null;
 	if (input.registrationSource === "clientMetadataDocument" && body.application_type === void 0) schema.applicationType = null;
-	const resources = await resolveClientRegistrationResources(ctx, opts, input.registrationSource === "dynamic" ? input.requestedResources ?? [] : []);
+	const requestedResources = input.registrationSource === "clientMetadataDocument" ? [] : input.requestedResources ?? [];
+	if (input.registrationSource === "dynamic") assertDynamicRegistrationResourcesAllowed(opts, requestedResources);
+	const resources = await resolveClientRegistrationResources(ctx, opts, requestedResources);
 	const clientModel = opts.schema?.oauthClient?.modelName ?? "oauthClient";
 	const clientResourceModel = opts.schema?.oauthClientResource?.modelName ?? "oauthClientResource";
 	const existingClient = input.registrationSource === "clientMetadataDocument" ? input.existingClient : void 0;
@@ -2175,12 +2230,15 @@ async function createOAuthClientEndpoint(ctx, opts, settings) {
 	const clientCredentialsScopes = settings?.admin ? normalizeClientCredentialsScopes(rawClientCredentialsScopes ?? []) : [];
 	validateClientCredentialsScopes(clientCredentialsScopes, resolveRegistrationGrantTypes(metadata), metadata.token_endpoint_auth_method, opts);
 	if (clientCredentialsScopes.length > 0) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes");
+	const requestedResources = settings?.admin ? metadata.resources : void 0;
+	for (const identifier of new Set(requestedResources ?? [])) await assertResourcePrivileges(ctx, session, opts, "link", identifier);
 	const registrationInput = {
 		metadata,
 		registrationSource: "managed",
 		userId: referenceId ? void 0 : session.session.userId,
 		referenceId,
-		clientCredentialsScopes
+		clientCredentialsScopes,
+		...requestedResources ? { requestedResources } : {}
 	};
 	const responseBody = settings?.admin ? await createOAuthClientAdministrativeRegistration(ctx, opts, registrationInput) : await createOAuthClientRegistration(ctx, opts, registrationInput);
 	ctx.setStatus(201);
@@ -2280,7 +2338,7 @@ function schemaToOAuth(input) {
 //#region src/oauthClient/endpoints.ts
 async function getClientEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "read");
+	await assertClientPrivileges(ctx, session, opts, "read", ctx.query.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const client = await getClient(ctx, opts, ctx.query.client_id);
 	if (!client) throw new APIError("NOT_FOUND", {
@@ -2357,7 +2415,7 @@ async function getClientsEndpoint(ctx, opts) {
 }
 async function deleteClientEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "delete");
+	await assertClientPrivileges(ctx, session, opts, "delete", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
 	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
@@ -2384,7 +2442,7 @@ async function deleteClientEndpoint(ctx, opts) {
 }
 async function updateClientEndpoint(ctx, opts, settings) {
 	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "update");
+	await assertClientPrivileges(ctx, session, opts, "update", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
 	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
@@ -2400,7 +2458,7 @@ async function updateClientEndpoint(ctx, opts, settings) {
 	const ownsClient = client.userId ? client.userId === session.user.id : client.referenceId && opts.clientReference ? client.referenceId === await opts.clientReference(session) : false;
 	const isCrossOwnerScopeConfiguration = !ownsClient && settings?.admin && rawClientCredentialsScopes !== void 0 && Object.keys(updates).length === 0;
 	if (!ownsClient && !isCrossOwnerScopeConfiguration) throw new APIError("UNAUTHORIZED");
-	if (isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes");
+	if (isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes", clientId);
 	if (Object.keys(updates).length === 0 && rawClientCredentialsScopes === void 0) {
 		const res = schemaToOAuth(client);
 		res.client_secret = void 0;
@@ -2415,7 +2473,7 @@ async function updateClientEndpoint(ctx, opts, settings) {
 	const clientCredentialsScopes = rawClientCredentialsScopes === void 0 ? void 0 : normalizeClientCredentialsScopes(rawClientCredentialsScopes);
 	if (clientCredentialsScopes !== void 0) {
 		validateClientCredentialsScopes(clientCredentialsScopes, finalGrantTypes, finalTokenEndpointAuthMethod, opts);
-		if (clientCredentialsScopes.length > 0 && !isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes");
+		if (clientCredentialsScopes.length > 0 && !isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes", clientId);
 	}
 	await checkOAuthClient({
 		...schemaToOAuth(client),
@@ -2455,7 +2513,7 @@ async function updateClientEndpoint(ctx, opts, settings) {
 }
 async function rotateClientSecretEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "rotate");
+	await assertClientPrivileges(ctx, session, opts, "rotate", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
 	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
@@ -2525,6 +2583,7 @@ const adminCreateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/creat
 		jwks_uri: z.string().optional(),
 		grant_types: grantTypesSchema.optional(),
 		client_credentials_scopes: z.array(z.string().trim().min(1)).optional(),
+		resources: z.array(ResourceUriSchema).optional(),
 		response_types: z.array(z.enum(["code"])).optional(),
 		client_secret_expires_at: z.union([z.string(), z.number()]).optional().default(0),
 		skip_consent: z.boolean().optional(),
@@ -2889,6 +2948,7 @@ const adminUpdateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/updat
 			client_secret_expires_at: z.union([z.string(), z.number()]).optional(),
 			skip_consent: z.boolean().optional(),
 			enable_end_session: z.boolean().optional(),
+			disabled: z.boolean().optional(),
 			dpop_bound_access_tokens: z.boolean().optional(),
 			metadata: z.record(z.string(), z.unknown()).optional()
 		})
@@ -3085,30 +3145,6 @@ const deleteOAuthConsent = (opts) => createAuthEndpoint("/oauth2/delete-consent"
 });
 //#endregion
 //#region src/oauthResource/endpoints.ts
-/**
-* Gate every admin resource endpoint. Mirrors `assertClientPrivileges`:
-* a missing session → 401; a defined `resourcePrivileges` callback that
-* returns falsy → 401 with the original action context preserved.
-*
-* When `resourcePrivileges` is undefined, the gate degrades to "any
-* authenticated session can manage resources" — same forgiving default
-* as `clientPrivileges`. Operators who care about RBAC must define the
-* callback.
-*
-* @internal
-*/
-async function assertResourcePrivileges(ctx, session, opts, action, resourceId) {
-	if (!session) throw new APIError("UNAUTHORIZED");
-	if (!ctx.headers) throw new APIError("BAD_REQUEST");
-	if (!opts.resourcePrivileges) return;
-	if (!await opts.resourcePrivileges({
-		headers: ctx.headers,
-		action,
-		session: session.session,
-		user: session.user,
-		resourceId
-	})) throw new APIError("UNAUTHORIZED");
-}
 const resourceModel = (opts) => opts.schema?.oauthResource?.modelName ?? "oauthResource";
 const linkModel = (opts) => opts.schema?.oauthClientResource?.modelName ?? "oauthClientResource";
 const clientModel = (opts) => opts.schema?.oauthClient?.modelName ?? "oauthClient";
@@ -4404,7 +4440,7 @@ const oauthProvider = (options) => {
 		onRequest: handleIssuerMetadataRequest,
 		init: async (ctx) => {
 			if (ctx.options.secondaryStorage && ctx.options.session?.storeSessionInDatabase !== true) throw new BetterAuthError("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");
-			await seedResources(ctx, opts);
+			await seedResourcesOnce(ctx, opts).catch((error) => logStartupSeedFailure(ctx, error));
 			logEnforcePerClientResourcesResolution(opts);
 			if (!opts.disableJwtPlugin) {
 				const jwtPluginOptions = getJwtPlugin(ctx)?.options;
@@ -5445,11 +5481,19 @@ function findRegisteredRedirectUri(registered, requested) {
 		return stripLoopbackRedirectPort(url) === requestedWithoutPort;
 	});
 }
+/** Keep URI syntax and credential checks outside the custom trust decision. */
+function isSafeCustomRedirectUri(uri) {
+	if (!SafeUrlSchema.safeParse(uri).success) return false;
+	const parsed = new URL(uri);
+	return parsed.username.length === 0 && parsed.password.length === 0;
+}
 /**
 * Loads the client, verifies it's enabled, and returns the requested
-* redirect_uri when it matches a registered entry. Returns null whenever the
-* RP cannot be safely reached, so callers can fall back to the server error
-* page (avoiding open-redirect risk on validation failures).
+* redirect_uri when it matches a registered entry (or is accepted by the
+* custom `validateRedirectUri` option, mirroring the authorize endpoint's
+* validation). Returns null whenever the RP cannot be safely reached, so
+* callers can fall back to the server error page (avoiding open-redirect
+* risk on validation failures).
 */
 async function resolveTrustedRedirectUri(ctx, opts, clientId, redirectUri) {
 	if (!clientId || !redirectUri) return null;
@@ -5460,7 +5504,17 @@ async function resolveTrustedRedirectUri(ctx, opts, clientId, redirectUri) {
 		return null;
 	}
 	if (!client || client.disabled) return null;
-	return findRegisteredRedirectUri(client.redirectUris, redirectUri) ? redirectUri : null;
+	const registeredUris = client.redirectUris ?? [];
+	const matched = findRegisteredRedirectUri(registeredUris, redirectUri);
+	if (opts.validateRedirectUri) {
+		if (!isSafeCustomRedirectUri(redirectUri)) return null;
+		try {
+			return await opts.validateRedirectUri(redirectUri, registeredUris, Boolean(matched)) ? redirectUri : null;
+		} catch {
+			return null;
+		}
+	}
+	return matched ? redirectUri : null;
 }
 /**
 * `redirectOnError` callback for `/oauth2/authorize`. Per RFC 6749 §4.1.2.1,
@@ -5552,7 +5606,18 @@ async function authorizeEndpoint(ctx, opts, settings) {
 	if (!client) return handleRedirect(ctx, getErrorURL(ctx, "invalid_client", "client_id is required"));
 	if (client.disabled) return handleRedirect(ctx, getErrorURL(ctx, "client_disabled", "client is disabled"));
 	if (!clientAllowsGrant(client, "authorization_code")) return handleRedirect(ctx, getErrorURL(ctx, "unauthorized_client", "client is not authorized to use the authorization_code grant"));
-	if (!findRegisteredRedirectUri(client.redirectUris, query.redirect_uri) || !query.redirect_uri) return handleRedirect(ctx, getErrorURL(ctx, "invalid_redirect", "invalid redirect uri"));
+	const registeredUris = client.redirectUris ?? [];
+	let isValidRedirectUri = false;
+	if (query.redirect_uri) {
+		const defaultResult = Boolean(findRegisteredRedirectUri(registeredUris, query.redirect_uri));
+		if (opts.validateRedirectUri && isSafeCustomRedirectUri(query.redirect_uri)) try {
+			isValidRedirectUri = await opts.validateRedirectUri(query.redirect_uri, registeredUris, defaultResult);
+		} catch {
+			isValidRedirectUri = false;
+		}
+		else if (!opts.validateRedirectUri) isValidRedirectUri = defaultResult;
+	}
+	if (!isValidRedirectUri) return handleRedirect(ctx, getErrorURL(ctx, "invalid_redirect", "invalid redirect uri"));
 	let requestedScopes = query.scope?.split(" ").filter((s) => s);
 	if (requestedScopes) {
 		const validScopes = new Set(client.scopes ?? opts.scopes);

package/dist/client-resource.d.mts

@@ -1,4 +1,4 @@
-import { c as ResourceServerMetadata } from "./oauth-1Ud-hvZY.mjs";
+import { c as ResourceServerMetadata } from "./oauth-C_RnL2nt.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-CoqjzHuU.mjs";
-import { t as PACKAGE_VERSION } from "./version-9KCSx144.mjs";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-CGIZS-Da.mjs";
+import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-CJ85_W0W.mjs";
+import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-pKAoqtlo.mjs";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-9KCSx144.mjs";
+import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index.d.mts

@@ -1,10 +1,9 @@
-import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-1Ud-hvZY.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-CJ85_W0W.mjs";
+import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-C_RnL2nt.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-pKAoqtlo.mjs";
 import { APIError } from "better-call";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";
 import * as _$better_auth0 from "better-auth";
-
 //#region src/extensions.d.ts
 /**
  * Registers an {@link OAuthProviderExtension} with the OAuth Provider plugin
@@ -160,6 +159,14 @@ declare function createResourceServerChallenge(error: unknown, resource: string
  */
 declare function getOAuthProviderApi(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, grantType?: GrantType): OAuthProviderApi;
 //#endregion
+//#region src/utils/index.d.ts
+/**
+ * Verify the signature and expiration of an OAuth query issued by this provider.
+ * Use the provider's current auth secret on the server before displaying a
+ * consent page. A valid signature does not replace client or session checks.
+ */
+declare function verifyOAuthQueryParams(oauth_query: string, secret: string): Promise<boolean>;
+//#endregion
 //#region src/utils/client-assertion.d.ts
 /**
  * Enforces the assertion-hygiene claims every client-assertion authentication
@@ -193,4 +200,4 @@ declare function consumeClientAssertion(ctx: GenericEndpointContext, opts: OAuth
   expectedAudience: string;
 }): Promise<void>;
 //#endregion
-export { ActiveAccessTokenPayload, AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, ClientDiscovery, ClientMetadataResourceFetch, ClientRegistrationRequest, Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, GrantType, InitialAccessTokenAuthorization, OAuthAuthenticatedClient, OAuthAuthorizationQuery, OAuthClaimExtensionInput, type OAuthClient, OAuthClientAdministrativeResponse, OAuthClientAuthenticationInput, OAuthClientAuthenticationRequest, OAuthClientAuthenticationResult, OAuthClientAuthenticationStrategy, type OAuthClientMetadata, OAuthClientRegistrationResponse, OAuthClientResource, OAuthConsent, type OAuthDeviceAuthorizationOptions, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, OAuthExtensionGrantHandler, OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, OAuthMetadataExtensionInput, OAuthOpaqueAccessToken, OAuthOptions, OAuthProviderApi, OAuthProviderExtension, type OAuthRedirectOnError, OAuthRefreshToken, OAuthResource, OAuthResourceInput, OAuthTokenIssueParams, OAuthTokenResponse, OAuthUserInfoExtensionInput, OIDCMetadata, Prompt, type ResourceServerMetadata, ResourceUriSchema, SchemaClient, Scope, StoreTokenType, StoredAuthorizationQuery, TokenEndpointAuthMethod, TokenType, VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+export { ActiveAccessTokenPayload, AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, ClientDiscovery, ClientMetadataResourceFetch, ClientRegistrationRequest, Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, GrantType, InitialAccessTokenAuthorization, OAuthAuthenticatedClient, OAuthAuthorizationQuery, OAuthClaimExtensionInput, type OAuthClient, OAuthClientAdministrativeResponse, OAuthClientAuthenticationInput, OAuthClientAuthenticationRequest, OAuthClientAuthenticationResult, OAuthClientAuthenticationStrategy, type OAuthClientMetadata, OAuthClientRegistrationResponse, OAuthClientResource, OAuthConsent, type OAuthDeviceAuthorizationOptions, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, OAuthExtensionGrantHandler, OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, OAuthMetadataExtensionInput, OAuthOpaqueAccessToken, OAuthOptions, OAuthProviderApi, OAuthProviderExtension, type OAuthRedirectOnError, OAuthRefreshToken, OAuthResource, OAuthResourceInput, OAuthTokenIssueParams, OAuthTokenResponse, OAuthUserInfoExtensionInput, OIDCMetadata, Prompt, type ResourceServerMetadata, ResourceUriSchema, SchemaClient, Scope, StoreTokenType, StoredAuthorizationQuery, TokenEndpointAuthMethod, TokenType, VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata, verifyOAuthQueryParams };

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { C as resolveResourcePolicy, c as ResourceUriSchema, i as getOAuthProviderApi, p as oauthClientMetadataSchema, v as extractRepeatedResourceFromForm } from "./introspect-CbYi2MJT.mjs";
-import { D as validateClientScopes, N as extendOAuthProvider, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-CoqjzHuU.mjs";
-import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-CLuqtSXQ.mjs";
+import { T as oauthClientMetadataSchema, b as ResourceUriSchema, f as extractRepeatedResourceFromForm, i as getOAuthProviderApi, v as resolveResourcePolicy } from "./introspect-H3uoUiuS.mjs";
+import { D as validateClientScopes, N as extendOAuthProvider, O as verifyOAuthQueryParams, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-CGIZS-Da.mjs";
+import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-C95F-9E1.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-auth/api";
 import * as z from "zod";
@@ -228,4 +228,4 @@ function oauthDeviceAuthorization(options = {}) {
 	};
 }
 //#endregion
-export { DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, ResourceUriSchema, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+export { DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, ResourceUriSchema, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata, verifyOAuthQueryParams };

package/dist/internal.d.mts

@@ -1,4 +1,4 @@
-import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-1Ud-hvZY.mjs";
+import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-C_RnL2nt.mjs";
 import { JSONWebKeySet } from "jose";
 import { GenericEndpointContext } from "@better-auth/core";
 

package/dist/internal.mjs

@@ -1,2 +1,2 @@
-import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-CLuqtSXQ.mjs";
+import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-C95F-9E1.mjs";
 export { isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };