@better-auth/oauth-provider 1.7.8 → 1.7.9

package/dist/{authorize-C95F-9E1.mjs → authorize-D8r6mvZx.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as claimsRequestParameterSchema, C as clientJwksSchema, D as STANDARD_CLAIM_NAMES, E as STANDARD_CLAIMS, M as getRequestedUserInfoClaims, N as isValidOidcClaimsRequest, O as getSupportedClaims, S as authorizationQuerySchema, _ as logStartupSeedFailure, a as invalidateRefreshFamily, b as ResourceUriSchema, c as normalizeClientCredentialsScopes, d as assertIdentifierValid, f as extractRepeatedResourceFromForm, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, j as filterClaimsRequestUserInfoClaims, k as canSatisfyEssentialAcrRequest, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as tokenEndpoint, p as getResource, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as JWS_ALGORITHMS, v as resolveResourcePolicy, w as clientRegistrationRequestSchema, x as SafeUrlSchema, y as seedResourcesOnce } from "./introspect-H3uoUiuS.mjs";
-import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-CGIZS-Da.mjs";
+import { A as claimsRequestParameterSchema, C as clientJwksSchema, D as STANDARD_CLAIM_NAMES, E as STANDARD_CLAIMS, M as getRequestedUserInfoClaims, N as isValidOidcClaimsRequest, O as getSupportedClaims, S as authorizationQuerySchema, _ as logStartupSeedFailure, a as invalidateRefreshFamily, b as ResourceUriSchema, c as normalizeClientCredentialsScopes, d as assertIdentifierValid, f as extractRepeatedResourceFromForm, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, j as filterClaimsRequestUserInfoClaims, k as canSatisfyEssentialAcrRequest, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as tokenEndpoint, p as getResource, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as JWS_ALGORITHMS, v as resolveResourcePolicy, w as clientRegistrationRequestSchema, x as SafeUrlSchema, y as seedResourcesOnce } from "./introspect-7WCMPe5Z.mjs";
+import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-DKU5wblX.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
+import { t as PACKAGE_VERSION } from "./version-DVUrz-nv.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { appendQueryParams } from "@better-auth/core/utils/url";
@@ -175,7 +175,10 @@ async function postLogin(ctx, authorize) {
 	ctx.headers?.set("accept", "application/json");
 	ctx.query = searchParamsToQuery(query);
 	const session = await getSessionFromCtx(ctx);
-	return await authorize(ctx, { postLogin: state?.postLoginClearedForSession !== void 0 && state.postLoginClearedForSession === session?.session.id });
+	return await authorize(ctx, {
+		postLogin: state?.postLoginClearedForSession !== void 0 && state.postLoginClearedForSession === session?.session.id,
+		isPostLoginContinuation: true
+	});
 }
 //#endregion
 //#region src/logout.ts
@@ -4593,7 +4596,7 @@ const oauthProvider = (options) => {
 				body: z.object({
 					selected: z.boolean().optional().meta({ description: "Confirms an account has been selected and authorization can proceed." }),
 					created: z.boolean().optional().meta({ description: "Confirms an account was registered" }),
-					postLogin: z.boolean().optional().meta({ description: "Confirms organization and/or team selection." }),
+					postLogin: z.boolean().optional().meta({ description: "Resumes after the post login page. postLogin.shouldRedirect runs again with isContinuation: true." }),
 					oauth_query: z.string().optional().meta({ description: "The redirected page's query parameters" })
 				}),
 				use: [sessionMiddleware],
@@ -5701,7 +5704,8 @@ async function authorizeEndpoint(ctx, opts, settings) {
 			headers: request.headers,
 			user: session.user,
 			session: session.session,
-			scopes: requestedScopes
+			scopes: requestedScopes,
+			isContinuation: settings?.isPostLoginContinuation ?? false
 		})) {
 			if (promptNone) return redirectWithPromptNoneError(ctx, opts, query, "interaction_required", "End-User interaction is required");
 			return redirectWithPromptCode(ctx, opts, "post_login");

package/dist/client-resource.d.mts

@@ -1,4 +1,4 @@
-import { c as ResourceServerMetadata } from "./oauth-C_RnL2nt.mjs";
+import { c as ResourceServerMetadata } from "./oauth-DAMtT2vg.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-CGIZS-Da.mjs";
-import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-DKU5wblX.mjs";
+import { t as PACKAGE_VERSION } from "./version-DVUrz-nv.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-pKAoqtlo.mjs";
+import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-BWgg8X-A.mjs";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
+import { t as PACKAGE_VERSION } from "./version-DVUrz-nv.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-C_RnL2nt.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-pKAoqtlo.mjs";
+import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-DAMtT2vg.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-BWgg8X-A.mjs";
 import { APIError } from "better-call";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { T as oauthClientMetadataSchema, b as ResourceUriSchema, f as extractRepeatedResourceFromForm, i as getOAuthProviderApi, v as resolveResourcePolicy } from "./introspect-H3uoUiuS.mjs";
-import { D as validateClientScopes, N as extendOAuthProvider, O as verifyOAuthQueryParams, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-CGIZS-Da.mjs";
-import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-C95F-9E1.mjs";
+import { T as oauthClientMetadataSchema, b as ResourceUriSchema, f as extractRepeatedResourceFromForm, i as getOAuthProviderApi, v as resolveResourcePolicy } from "./introspect-7WCMPe5Z.mjs";
+import { D as validateClientScopes, N as extendOAuthProvider, O as verifyOAuthQueryParams, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-DKU5wblX.mjs";
+import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-D8r6mvZx.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-auth/api";
 import * as z from "zod";

package/dist/internal.d.mts

@@ -1,4 +1,4 @@
-import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-C_RnL2nt.mjs";
+import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-DAMtT2vg.mjs";
 import { JSONWebKeySet } from "jose";
 import { GenericEndpointContext } from "@better-auth/core";
 

package/dist/internal.mjs

@@ -1,2 +1,2 @@
-import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-C95F-9E1.mjs";
+import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-D8r6mvZx.mjs";
 export { isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };

package/dist/{introspect-H3uoUiuS.mjs → introspect-7WCMPe5Z.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-CGIZS-Da.mjs";
+import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-DKU5wblX.mjs";
 import { APIError } from "better-auth/api";
 import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";
@@ -1083,8 +1083,15 @@ function logEnforcePerClientResourcesResolution(opts) {
 function getDpopProofJwt(ctx) {
 	return ctx.headers?.get("dpop") ?? void 0;
 }
+/**
+* The endpoint's public URL, built from `baseURL`, which clients use as the
+* DPoP `htu`. Not `request.url`: proxies and dev servers can rewrite its host.
+*/
 function getEndpointUrl(ctx, path) {
-	return ctx.request?.url ?? `${ctx.context.baseURL}${path}`;
+	const { baseURL } = ctx.context;
+	let end = baseURL.length;
+	while (end > 0 && baseURL[end - 1] === "/") end--;
+	return `${baseURL.slice(0, end)}${path}`;
 }
 //#endregion
 //#region src/oauthClient/client-credentials.ts
@@ -1638,7 +1645,7 @@ async function resolveDpopTokenBinding(ctx, opts, params) {
 		return { jkt: (await verifyDpopProof({
 			proofJwt: dpopProofJwt,
 			method: "POST",
-			url: getEndpointUrl(ctx, "/oauth2/token"),
+			url: getEndpointUrl(ctx, ctx.path ?? "/oauth2/token"),
 			expectedJkt,
 			proofMaxAgeSeconds: opts.dpop?.proofMaxAgeSeconds,
 			signingAlgorithms: opts.dpop?.signingAlgorithms,

package/dist/{oauth-pKAoqtlo.d.mts → oauth-BWgg8X-A.d.mts}

@@ -1,4 +1,4 @@
-import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-C_RnL2nt.mjs";
+import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-DAMtT2vg.mjs";
 import * as _$better_call0 from "better-call";
 import * as z from "zod";
 import * as _$jose from "jose";

package/dist/{oauth-C_RnL2nt.d.mts → oauth-DAMtT2vg.d.mts}

@@ -1642,7 +1642,8 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
      * For example, allow selection of an organization or team.
      *
      * Upon selection of a specific account, use `/oauth2/continue`
-     * with `postLogin: true` to continue the login flow.
+     * with `postLogin: true` to continue the login flow. The continue
+     * request runs `shouldRedirect` again with `isContinuation: true`.
      *
      * @returns
      * - `true`: account is not selected and needs selection
@@ -1653,6 +1654,12 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
       user: User & Record<string, unknown>;
       session: Session & Record<string, unknown>;
       scopes: Scopes;
+      /**
+       * `true` when the user returns from `page` through `/oauth2/continue`.
+       * The client chooses to send that request, so it does not prove a
+       * selection was made: validate the session before returning `false`.
+       */
+      isContinuation: boolean;
     }) => Awaitable<boolean>;
   };
   /**

package/dist/{utils-CGIZS-Da.mjs → utils-DKU5wblX.mjs}

@@ -712,7 +712,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-C95F-9E1.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-D8r6mvZx.mjs").then((n) => n.o);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",

package/dist/{version-BPS0os17.mjs → version-DVUrz-nv.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.8";
+const PACKAGE_VERSION = "1.7.9";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.8",
+  "version": "1.7.9",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.8",
-    "@better-auth/memory-adapter": "1.7.8",
-    "better-auth": "1.7.8"
+    "@better-auth/core": "1.7.9",
+    "@better-auth/memory-adapter": "1.7.9",
+    "better-auth": "1.7.9"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
     "better-call": "1.4.2",
-    "@better-auth/core": "^1.7.8",
-    "better-auth": "^1.7.8"
+    "@better-auth/core": "^1.7.9",
+    "better-auth": "^1.7.9"
   },
   "scripts": {
     "build": "tsdown",