@better-auth/oauth-provider 1.7.9 → 1.8.0-beta.0

package/dist/{oauth-BWgg8X-A.d.mts → oauth-mdkaIwmm.d.mts}

@@ -1,8 +1,10 @@
-import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-DAMtT2vg.mjs";
+import { D as OAuthClientRegistrationResponse, F as OAuthMetadataExtensionInput, J as Scope, K as Prompt, L as OAuthOptions, P as OAuthInteractionRequestHandler, V as OAuthResource, W as OAuthTokenResponse, a as GrantType, j as OAuthExtensionGrantHandlerInput, k as OAuthConsent, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, tt as clientRegistrationRequestSchema, u as TokenType, x as OAuthClientAdministrativeResponse } from "./oauth-BlEuA8oD.mjs";
 import * as _$better_call0 from "better-call";
+import { EndpointContext, EndpointOptions, StrictEndpoint } from "better-call";
 import * as z from "zod";
-import * as _$jose from "jose";
 import * as _$better_auth_plugins0 from "better-auth/plugins";
+import * as _$jose from "jose";
+import { JSONWebKeySet } from "jose";
 import { DeviceAuthorizationGrant, DeviceAuthorizationPluginOptions } from "better-auth/plugins/device-authorization";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";
 import * as _$better_auth0 from "better-auth";
@@ -23,7 +25,7 @@ declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_
  * polling and atomic-consumption state machine for this handler.
  */
 declare function exchangeOAuthDeviceCode(input: OAuthExtensionGrantHandlerInput): Promise<OAuthTokenResponse>;
-declare function buildOAuthDeviceGrant(): {
+declare function buildOAuthDeviceGrant(verificationUri: string | undefined): {
   requestSchemaFields: {
     client_secret: z.ZodOptional<z.ZodString>;
     client_assertion: z.ZodOptional<z.ZodString>;
@@ -72,6 +74,22 @@ declare function buildOAuthDeviceGrant(): {
       type: "string";
       required: false;
     };
+    referenceId: {
+      type: "string";
+      required: false;
+    };
+    authTime: {
+      type: "date";
+      required: false;
+    };
+    acr: {
+      type: "string";
+      required: false;
+    };
+    amr: {
+      type: "string[]";
+      required: false;
+    };
   };
   grants: {
     "urn:ietf:params:oauth:grant-type:device_code": typeof exchangeOAuthDeviceCode;
@@ -83,7 +101,7 @@ declare function buildOAuthDeviceGrant(): {
     ctx,
     request
   }: {
-    ctx: _$better_auth0.GenericEndpointContext;
+    ctx: GenericEndpointContext;
     request: _$better_auth_plugins0.DeviceAuthorizationRequest & {
       client_secret?: string | undefined;
       client_assertion?: string | undefined;
@@ -97,28 +115,16 @@ declare function buildOAuthDeviceGrant(): {
       resources: string[] | null;
     };
   } | undefined>;
-  assertSessionRedemption: ({
-    deviceCode
+  assertStandaloneUse: ({
+    deviceCode,
+    use
   }: {
-    ctx: _$better_auth0.GenericEndpointContext;
+    ctx: GenericEndpointContext;
     deviceCode: Record<string, unknown>;
+    use: "redeem" | "approve";
   }) => void;
-  getVerificationContext: (deviceCode: Record<string, unknown>) => {
-    resource: string | string[] | undefined;
-  } | undefined;
-  verificationOpenAPIProperties: {
-    resource: {
-      oneOf: ({
-        type: string;
-        items?: undefined;
-      } | {
-        type: string;
-        items: {
-          type: string;
-        };
-      })[];
-      description: string;
-    };
+  interactionRequests: {
+    user_code: OAuthInteractionRequestHandler;
   };
 };
 type OAuthDeviceGrant = ReturnType<typeof buildOAuthDeviceGrant>;
@@ -335,10 +341,10 @@ declare function oauthDeviceAuthorization(options?: OAuthDeviceAuthorizationOpti
       error: z.ZodObject<{
         error: z.ZodEnum<{
           invalid_request: "invalid_request";
-          authorization_pending: "authorization_pending";
-          slow_down: "slow_down";
           expired_token: "expired_token";
           access_denied: "access_denied";
+          authorization_pending: "authorization_pending";
+          slow_down: "slow_down";
           invalid_grant: "invalid_grant";
         }>;
         error_description: z.ZodString;
@@ -442,13 +448,11 @@ declare function oauthDeviceAuthorization(options?: OAuthDeviceAuthorizationOpti
         };
       };
     }, {
-      user_code: string;
-      status: string;
       client_id?: string | undefined;
       scope?: string | undefined;
-    } & Partial<{
-      resource: string | string[] | undefined;
-    }>>;
+      user_code: string;
+      status: string;
+    }>;
     deviceApprove: _$better_call0.StrictEndpoint<"/device/approve", {
       method: "POST";
       body: z.ZodObject<{
@@ -459,7 +463,6 @@ declare function oauthDeviceAuthorization(options?: OAuthDeviceAuthorizationOpti
           invalid_request: "invalid_request";
           expired_token: "expired_token";
           access_denied: "access_denied";
-          device_code_already_processed: "device_code_already_processed";
           unauthorized: "unauthorized";
         }>;
         error_description: z.ZodString;
@@ -554,7 +557,7 @@ declare function oauthDeviceAuthorization(options?: OAuthDeviceAuthorizationOpti
   options: {
     grant: DeviceAuthorizationGrant<Readonly<{
       [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-    }>, Record<string, unknown>> | undefined;
+    }>> | undefined;
     expiresIn: _$better_auth_plugins0.TimeString;
     interval: _$better_auth_plugins0.TimeString;
     deviceCodeLength: number;
@@ -612,6 +615,63 @@ interface OAuthEndpointRedirectContext<Ctx = unknown> {
   ctx: Ctx;
 }
 type OAuthRedirectOnError<Ctx = unknown, Result = unknown> = (result: OAuthEndpointRedirectContext<Ctx>) => Result | Promise<Result>;
+type ValidationErrorHookArgs = {
+  message: string;
+  issues: readonly z.core.$ZodIssue[];
+};
+type ValidationErrorHook = (args: ValidationErrorHookArgs) => unknown;
+interface OAuthEndpointExtras<Ctx = EndpointContext<string, EndpointOptions, AuthContext>> {
+  /**
+   * Invoked when validation fails. Presence switches delivery from a JSON
+   * `APIError` envelope to this callback, which receives the request
+   * context so it can compute an RP redirect URL from already-parsed query
+   * params.
+   */
+  redirectOnError?: OAuthRedirectOnError<Ctx>;
+  /**
+   * Forwarded to `better-call` and awaited before the RFC envelope is
+   * synthesized, so callers can observe or transform issues.
+   */
+  onValidationError?: ValidationErrorHook;
+  /**
+   * First-path-segment → RFC code mapping. Nested failures like
+   * `jwks.keys[0].n` collapse to `jwks`; lift a nested schema to a
+   * top-level field when per-sub-field codes are required.
+   */
+  errorCodesByField?: Record<string, OAuthFieldErrorCode>;
+  /**
+   * RFC code returned when no `errorCodesByField` entry matches or the failure is
+   * structurally malformed (wrong type, duplicated params, bad format).
+   * @default "invalid_request"
+   */
+  defaultError?: OAuthErrorCode;
+  /**
+   * Re-reads the raw form before validation, because the form parser keeps
+   * only the last value of a repeated key. Empty values count as omitted and
+   * repeated parameters return `invalid_request` (RFC 6749 §3.2), except the
+   * names in `repeatable`, which become arrays. Enables `cloneRequest`.
+   */
+  formParams?: {
+    repeatable?: readonly string[];
+  };
+}
+/**
+ * Wraps `createAuthEndpoint` so zod schemas stay the single source of truth
+ * for body/query shape while validation failures serialize as the RFC 6749
+ * §5.2 error envelope `{ error, error_description }`.
+ *
+ * A failing issue is routed by its first path segment via `errorCodesByField`:
+ * - missing required (`invalid_type` + "received undefined") → `.missing`
+ * - unsupported value (`invalid_value`) or a value a refinement rejected
+ *   (`custom`, also inside a union branch) → `.invalid`
+ * - anything else (wrong type, duplicated params, bad format) → `defaultError`
+ *
+ * For enum fields that need to distinguish missing from unsupported, compose
+ * as `z.string().pipe(z.enum([...]))` so duplicated params fail the outer
+ * `z.string()` as `invalid_type` instead of masquerading as an unsupported
+ * enum value.
+ */
+declare function createOAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(path: Path, options: Options & OAuthEndpointExtras<EndpointContext<Path, Options, AuthContext>>, handler: (ctx: EndpointContext<Path, Options, AuthContext>) => Promise<R>): StrictEndpoint<Path, Options, R>;
 //#endregion
 //#region src/authorize.d.ts
 type OAuthRedirectResult = {
@@ -623,6 +683,27 @@ type OAuthRedirectResult = {
  */
 declare function getIssuer(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>): string;
 //#endregion
+//#region src/client-jwks.d.ts
+/** A client's inline public JWK Set, as registration and key rotation accept it. */
+type ClientJwks = NonNullable<OAuthClient["jwks"]>;
+type PublicClientJwksValidationResult = {
+  valid: true;
+  jwks: JSONWebKeySet;
+} | {
+  valid: false;
+  error: "jwks must be an RFC 7517 JWK Set object with a non-empty keys array" | "jwks must contain only public asymmetric keys" | "jwks keys must be supported public JWKs with required key parameters" | "jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve";
+};
+/**
+ * Validates an OAuth client's public asymmetric JWK set.
+ *
+ * This boundary accepts only the RFC 7517 `{ keys: [...] }` representation.
+ * It performs no I/O and returns the validated set for downstream JOSE
+ * verification.
+ *
+ * @internal
+ */
+declare function validatePublicClientJwks(input: unknown): PublicClientJwksValidationResult;
+//#endregion
 //#region src/oauth.d.ts
 /**
  * Default scopes advertised and accepted when a configuration sets none. Shared
@@ -770,6 +851,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       backchannel_logout_supported?: boolean | undefined;
       backchannel_logout_session_supported?: boolean | undefined;
       dpop_signing_alg_values_supported?: _$better_auth_plugins0.JWSAlgorithms[] | undefined;
+      frontchannel_logout_supported?: boolean | undefined;
+      frontchannel_logout_session_supported?: boolean | undefined;
       id_token_signing_alg_values_supported: _$better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
     }>;
     oauth2Authorize: _$better_call0.StrictEndpoint<"/oauth2/authorize", {
@@ -791,17 +874,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
               items?: undefined;
             };
             description: string;
-          } | {
-            name: string;
-            in: "query";
-            required: true;
-            schema: {
-              type: "string";
-              format?: undefined;
-              minimum?: undefined;
-              items?: undefined;
-            };
-            description: string;
           } | {
             name: string;
             in: "query";
@@ -996,7 +1068,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }, OAuthRedirectResult>;
     oauth2Token: _$better_call0.StrictEndpoint<"/oauth2/token", {
       method: "POST";
-      cloneRequest: true;
+      formParams: {
+        repeatable: string[];
+      };
       body: z.ZodObject<{
         grant_type: z.ZodString;
         client_id: z.ZodOptional<z.ZodString>;
@@ -1168,7 +1242,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }>;
     oauth2Introspect: _$better_call0.StrictEndpoint<"/oauth2/introspect", {
       method: "POST";
-      cloneRequest: true;
+      formParams: {};
       body: z.ZodObject<{
         client_id: z.ZodOptional<z.ZodString>;
         client_secret: z.ZodOptional<z.ZodString>;
@@ -1301,7 +1375,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }, _$jose.JWTPayload>;
     oauth2Revoke: _$better_call0.StrictEndpoint<"/oauth2/revoke", {
       method: "POST";
-      cloneRequest: true;
+      formParams: {};
       body: z.ZodObject<{
         client_id: z.ZodOptional<z.ZodString>;
         client_secret: z.ZodOptional<z.ZodString>;
@@ -1380,7 +1454,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, null | undefined>;
+    }, null>;
     oauth2UserInfo: _$better_call0.StrictEndpoint<"/oauth2/userinfo", {
       method: ("GET" | "POST")[];
       body: z.ZodOptional<z.ZodObject<{
@@ -1547,6 +1621,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                 "text/html": {
                   schema: {
                     type: "string";
+                    description: string;
                   };
                 };
               };
@@ -1568,42 +1643,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }, Response | OAuthRedirectResult | null>;
     registerOAuthClient: _$better_call0.StrictEndpoint<"/oauth2/register", {
       method: "POST";
-      body: z.ZodObject<{
-        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-        scope: z.ZodOptional<z.ZodString>;
-        client_name: z.ZodOptional<z.ZodString>;
-        client_uri: z.ZodOptional<z.ZodString>;
-        logo_uri: z.ZodOptional<z.ZodString>;
-        contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        tos_uri: z.ZodOptional<z.ZodString>;
-        policy_uri: z.ZodOptional<z.ZodString>;
-        software_id: z.ZodOptional<z.ZodString>;
-        software_version: z.ZodOptional<z.ZodString>;
-        software_statement: z.ZodOptional<z.ZodString>;
-        post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
-        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
-        jwks: z.ZodOptional<z.ZodObject<{
-          keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        }, z.core.$strip>>;
-        jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-          code: "code";
-        }>>>;
-        application_type: z.ZodOptional<z.ZodEnum<{
-          web: "web";
-          native: "native";
-        }>>;
-        subject_type: z.ZodOptional<z.ZodEnum<{
-          public: "public";
-          pairwise: "pairwise";
-        }>>;
-        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
-        resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        skip_consent: z.ZodOptional<z.ZodNever>;
-      }, z.core.$strip>;
+      body: typeof clientRegistrationRequestSchema;
       errorCodesByField: {
         redirect_uris: "invalid_redirect_uri";
         post_logout_redirect_uris: "invalid_redirect_uri";
@@ -1711,6 +1751,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                         type: string;
                         description: string;
                       };
+                      frontchannel_logout_uri: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      frontchannel_logout_session_required: {
+                        type: string;
+                        description: string;
+                      };
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
@@ -1774,6 +1823,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
         backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+        frontchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
         token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         application_type: z.ZodOptional<z.ZodEnum<{
           web: "web";
@@ -1988,6 +2039,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
         backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+        frontchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
         token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         application_type: z.ZodOptional<z.ZodEnum<{
           web: "web";
@@ -2267,8 +2320,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           software_version: z.ZodOptional<z.ZodString>;
           software_statement: z.ZodOptional<z.ZodString>;
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-          backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+          backchannel_logout_uri: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
           backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+          frontchannel_logout_uri: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+          frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
           application_type: z.ZodOptional<z.ZodEnum<{
             web: "web";
             native: "native";
@@ -2333,8 +2388,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           software_version: z.ZodOptional<z.ZodString>;
           software_statement: z.ZodOptional<z.ZodString>;
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-          backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+          backchannel_logout_uri: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
           backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+          frontchannel_logout_uri: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+          frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
           application_type: z.ZodOptional<z.ZodEnum<{
             web: "web";
             native: "native";
@@ -2386,6 +2443,30 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
+    rotateClientKeys: _$better_call0.StrictEndpoint<"/oauth2/client/rotate-keys", {
+      method: "POST";
+      body: z.ZodObject<{
+        client_assertion: z.ZodString;
+        client_assertion_type: z.ZodString;
+        jwks: z.ZodObject<{
+          keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>;
+      }, z.core.$strip>;
+      errorCodesByField: {
+        client_assertion: "invalid_client";
+        client_assertion_type: "invalid_client";
+        jwks: "invalid_client_metadata";
+      };
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          description: string;
+        };
+      };
+    }, {
+      client_id: string;
+      jwks: ClientJwks;
+    }>;
     deleteOAuthClient: _$better_call0.StrictEndpoint<"/oauth2/delete-client", {
       method: "POST";
       use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
@@ -2677,6 +2758,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "string";
           required: false;
         };
+        sectorIdentifier: {
+          type: "string";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: false;
@@ -2755,6 +2840,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "boolean";
           required: false;
         };
+        frontchannelLogoutUri: {
+          type: "string";
+          required: false;
+        };
+        frontchannelLogoutSessionRequired: {
+          type: "boolean";
+          required: false;
+        };
         tokenEndpointAuthMethod: {
           type: "string";
           required: false;
@@ -2978,6 +3071,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "date";
           required: false;
         };
+        acr: {
+          type: "string";
+          required: false;
+        };
+        amr: {
+          type: "string[]";
+          required: false;
+        };
         confirmation: {
           type: "json";
           required: false;
@@ -3144,6 +3245,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     pathMatcher: (path: string) => path is "/oauth2/register";
     window: number;
     max: number;
+  } | {
+    pathMatcher: (path: string) => path is "/oauth2/client/rotate-keys";
+    window: number;
+    max: number;
   } | {
     pathMatcher: (path: string) => path is "/oauth2/userinfo";
     window: number;
@@ -3151,4 +3256,4 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   })[];
 };
 //#endregion
-export { OAuthEndpointErrorResult as a, OAuthFieldErrorCode as c, DEVICE_CODE_GRANT_TYPE as d, OAuthDeviceAuthorizationOptions as f, getIssuer as i, OAuthFieldErrorCodeMap as l, getOAuthProviderState as n, OAuthEndpointRedirectContext as o, oauthDeviceAuthorization as p, oauthProvider as r, OAuthErrorCode as s, DEFAULT_OAUTH_SCOPES as t, OAuthRedirectOnError as u };
+export { validatePublicClientJwks as a, OAuthEndpointRedirectContext as c, OAuthFieldErrorCodeMap as d, OAuthRedirectOnError as f, oauthDeviceAuthorization as g, OAuthDeviceAuthorizationOptions as h, PublicClientJwksValidationResult as i, OAuthErrorCode as l, DEVICE_CODE_GRANT_TYPE as m, getOAuthProviderState as n, getIssuer as o, createOAuthEndpoint as p, oauthProvider as r, OAuthEndpointErrorResult as s, DEFAULT_OAUTH_SCOPES as t, OAuthFieldErrorCode as u };