@better-auth/oauth-provider 1.7.6 → 1.7.8

package/dist/{oauth-1Ud-hvZY.d.mts → oauth-C_RnL2nt.d.mts}

@@ -1091,6 +1091,58 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * ```
    */
   scopes?: Scopes;
+  /**
+   * Validates an OAuth authorization request's redirect URI. Without this
+   * option, the URI must match one registered for the client, except that
+   * a registered native HTTP loopback URI may use a different port.
+   *
+   * The callback runs for every client and also controls whether early
+   * authorization errors may be sent to the requested URI. Returning `true`
+   * accepts the URI even when `defaultResult` is `false`; returning `false`
+   * or throwing rejects it. Client registration is unchanged.
+   *
+   * The preview example assumes only trusted clients can register its
+   * production callback URI.
+   *
+   * @example
+   * ```ts
+   * oauthProvider({
+   *   validateRedirectUri: (uri, registeredUris, defaultResult) => {
+   *     if (defaultResult) return true;
+   *     if (!registeredUris.includes("https://app.example.com/api/auth/callback")) {
+   *       return false;
+   *     }
+   *     if (uri.includes("#")) return false;
+   *     try {
+   *       const url = new URL(uri);
+   *       return (
+   *         url.protocol === "https:" &&
+   *         url.username === "" &&
+   *         url.password === "" &&
+   *         url.hostname.endsWith(".preview.example.com") &&
+   *         url.port === "" &&
+   *         url.pathname === "/api/auth/callback" &&
+   *         url.search === ""
+   *       );
+   *     } catch {
+   *       return false;
+   *     }
+   *   },
+   * })
+   * ```
+   *
+   * Custom acceptance relaxes the exact matching required by RFC 9700 §2.1.
+   * Accept only callback hosts you control. For pairwise subject identifiers,
+   * custom-validated URIs use the sector of the client's first registered URI.
+   *
+   * @see https://www.better-auth.com/docs/plugins/oauth-provider#custom-redirect-uri-validation
+   *
+   * @param redirectUri - The redirect_uri from the authorization request
+   * @param registeredUris - Registered redirect URIs for the client
+   * @param defaultResult - Result of built-in redirect URI matching
+   * @returns `true` to accept the URI, or `false` to reject it
+   */
+  validateRedirectUri?: (redirectUri: string, registeredUris: readonly string[], defaultResult: boolean) => Awaitable<boolean>;
   /**
    * Protected resources the AS issues access tokens for. Promotes the
    * resource model into a first-class persisted entity with per-resource
@@ -1377,6 +1429,27 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @default true
    */
   clientRegistrationRequirePKCE?: boolean;
+  /**
+   * Default `application_type` for dynamic client registrations that omit the
+   * field.
+   *
+   * - `"web"`: the OIDC Registration §2 default. Omitted `application_type` is
+   *   treated as `web`, so custom-scheme redirect URIs are rejected.
+   * - `"native"`: omitted `application_type` is treated as `native`.
+   * - `"infer"`: omitted `application_type` is treated as `native` when any
+   *   `redirect_uris` entry uses a non-http(s) scheme; otherwise `web`. Every
+   *   redirect URI is then validated against the native rules. Lets native MCP
+   *   clients that omit `application_type` (for example Cursor, which also
+   *   registers https and loopback callbacks) register without loosening
+   *   web-client redirect policy.
+   *
+   * An `application_type` the client actually sends is never overridden.
+   * Applies only to dynamic client registration; managed clients and Client ID
+   * Metadata Documents are unaffected.
+   *
+   * @default "web"
+   */
+  clientRegistrationDefaultApplicationType?: "web" | "native" | "infer";
   /**
    * How long a dynamically created confidential client
    * should last for.
@@ -1428,6 +1501,16 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
     action: "create" | "read" | "update" | "delete" | "list" | "rotate" | "configure-client-credentials-scopes";
     user?: User & Record<string, unknown>;
     session?: Session & Record<string, unknown>;
+    /**
+     * The `client_id` from the request, for actions on an existing client.
+     * Absent for `create`, `list`, and scope configuration during creation.
+     * The client may not exist, and this value does not establish ownership.
+     * Client CRUD enforces ownership except when `adminUpdateOAuthClient`
+     * changes only `client_credentials_scopes`: the `update` and
+     * `configure-client-credentials-scopes` decisions can authorize access
+     * to another owner's client.
+     */
+    clientId?: string;
   }) => Awaitable<boolean | undefined>;
   /**
    * Grant types supported by the token endpoint
@@ -1732,7 +1815,7 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
   }) => Awaitable<Record<string, unknown>>;
   /**
    * Overwrite specific /.well-known/openid-configuration
-   * values so they are not available publically.
+   * values so they are not available publicly.
    * This may be important if not all clients need specific scopes.
    */
   advertisedMetadata?: {

package/dist/{oauth-CJ85_W0W.d.mts → oauth-pKAoqtlo.d.mts}

@@ -1,4 +1,4 @@
-import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-1Ud-hvZY.mjs";
+import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-C_RnL2nt.mjs";
 import * as _$better_call0 from "better-call";
 import * as z from "zod";
 import * as _$jose from "jose";
@@ -1785,6 +1785,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         jwks_uri: z.ZodOptional<z.ZodString>;
         grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
         client_credentials_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
         response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
         }>>>;
@@ -2280,6 +2281,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           client_secret_expires_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
           skip_consent: z.ZodOptional<z.ZodBoolean>;
           enable_end_session: z.ZodOptional<z.ZodBoolean>;
+          disabled: z.ZodOptional<z.ZodBoolean>;
           dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
           metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>;

package/dist/{utils-CoqjzHuU.mjs → utils-CGIZS-Da.mjs}

@@ -356,6 +356,11 @@ function getTrustedClientCache(options) {
 	trustedClientCaches.set(options, cache);
 	return cache;
 }
+/**
+* Verify the signature and expiration of an OAuth query issued by this provider.
+* Use the provider's current auth secret on the server before displaying a
+* consent page. A valid signature does not replace client or session checks.
+*/
 async function verifyOAuthQueryParams(oauth_query, secret) {
 	const queryParams = new URLSearchParams(oauth_query);
 	const sig = queryParams.get("sig");
@@ -707,7 +712,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-CLuqtSXQ.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-C95F-9E1.mjs").then((n) => n.o);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",

package/dist/{version-9KCSx144.mjs → version-BPS0os17.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.6";
+const PACKAGE_VERSION = "1.7.8";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.6",
+  "version": "1.7.8",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.6",
-    "@better-auth/memory-adapter": "1.7.6",
-    "better-auth": "1.7.6"
+    "@better-auth/core": "1.7.8",
+    "@better-auth/memory-adapter": "1.7.8",
+    "better-auth": "1.7.8"
   },
   "peerDependencies": {
-    "@better-auth/utils": "0.4.2",
+    "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
-    "better-call": "1.4.0",
-    "@better-auth/core": "^1.7.6",
-    "better-auth": "^1.7.6"
+    "better-call": "1.4.2",
+    "@better-auth/core": "^1.7.8",
+    "better-auth": "^1.7.8"
   },
   "scripts": {
     "build": "tsdown",