@better-auth/oauth-provider 1.7.9 → 1.8.0-beta.0

package/dist/{utils-DKU5wblX.mjs → utils-BMNe8Sg2.mjs}

@@ -6,6 +6,146 @@ import { BetterAuthError } from "@better-auth/core/error";
 import { CLIENT_ASSERTION_TYPE, decodeBasicCredentials } from "@better-auth/core/oauth2";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
+//#region src/client-metadata.ts
+const OAUTH_CLIENT_RECORD_FIELD_NAMES = Object.freeze(Object.keys({
+	clientId: true,
+	clientSecret: true,
+	clientDiscoveryId: true,
+	disabled: true,
+	scopes: true,
+	clientCredentialsScopes: true,
+	userId: true,
+	createdAt: true,
+	updatedAt: true,
+	expiresAt: true,
+	name: true,
+	uri: true,
+	icon: true,
+	contacts: true,
+	tos: true,
+	policy: true,
+	softwareId: true,
+	softwareVersion: true,
+	softwareStatement: true,
+	redirectUris: true,
+	postLogoutRedirectUris: true,
+	backchannelLogoutUri: true,
+	backchannelLogoutSessionRequired: true,
+	frontchannelLogoutUri: true,
+	frontchannelLogoutSessionRequired: true,
+	tokenEndpointAuthMethod: true,
+	grantTypes: true,
+	responseTypes: true,
+	applicationType: true,
+	jwks: true,
+	jwksUri: true,
+	requirePKCE: true,
+	dpopBoundAccessTokens: true,
+	skipConsent: true,
+	enableEndSession: true,
+	subjectType: true,
+	sectorIdentifier: true,
+	referenceId: true,
+	metadata: true
+}));
+/**
+* Canonical wire fields emitted by schemaToOAuth. They are mapped explicitly
+* and therefore must never also survive inside the opaque metadata envelope.
+*/
+const OAUTH_CLIENT_WIRE_FIELD_NAMES = [
+	"client_id",
+	"client_secret",
+	"client_secret_expires_at",
+	"scope",
+	"user_id",
+	"client_id_issued_at",
+	"client_name",
+	"client_uri",
+	"logo_uri",
+	"contacts",
+	"tos_uri",
+	"policy_uri",
+	"jwks",
+	"jwks_uri",
+	"software_id",
+	"software_version",
+	"software_statement",
+	"redirect_uris",
+	"post_logout_redirect_uris",
+	"backchannel_logout_uri",
+	"backchannel_logout_session_required",
+	"frontchannel_logout_uri",
+	"frontchannel_logout_session_required",
+	"token_endpoint_auth_method",
+	"grant_types",
+	"response_types",
+	"application_type",
+	"disabled",
+	"skip_consent",
+	"enable_end_session",
+	"require_pkce",
+	"dpop_bound_access_tokens",
+	"subject_type",
+	"reference_id"
+];
+const OPAQUE_METADATA_RESERVED_FIELDS = new Set([
+	...OAUTH_CLIENT_RECORD_FIELD_NAMES,
+	...OAUTH_CLIENT_WIRE_FIELD_NAMES,
+	"public",
+	"type",
+	"resources",
+	"client_credentials_scopes"
+]);
+const CIMD_FORBIDDEN_SERVER_FIELD_NAMES = new Set([
+	"disabled",
+	"client_secret",
+	"client_secret_expires_at",
+	"client_id_issued_at",
+	"skip_consent",
+	"enable_end_session",
+	"require_pkce",
+	"reference_id",
+	"user_id",
+	"resources",
+	"clientSecret",
+	"clientDiscoveryId",
+	"sectorIdentifier",
+	"skipConsent",
+	"enableEndSession",
+	"requirePKCE",
+	"referenceId",
+	"userId",
+	"clientId",
+	"applicationType",
+	"tokenEndpointAuthMethod",
+	"redirectUris",
+	"postLogoutRedirectUris",
+	"grantTypes",
+	"responseTypes",
+	"scopes",
+	"expiresAt",
+	"createdAt",
+	"updatedAt",
+	"softwareId",
+	"softwareVersion",
+	"softwareStatement",
+	"backchannelLogoutUri",
+	"backchannelLogoutSessionRequired",
+	"jwksUri",
+	"dpopBoundAccessTokens",
+	"subjectType"
+]);
+function isForbiddenCimdClientMetadataField(field) {
+	return CIMD_FORBIDDEN_SERVER_FIELD_NAMES.has(field);
+}
+function isReservedOAuthClientMetadataField(field) {
+	return OPAQUE_METADATA_RESERVED_FIELDS.has(field);
+}
+function stripReservedOAuthClientMetadataExtensions(metadata) {
+	if (!metadata) return void 0;
+	return Object.fromEntries(Object.entries(metadata).filter(([field]) => !OPAQUE_METADATA_RESERVED_FIELDS.has(field)));
+}
+//#endregion
 //#region src/extensions.ts
 const DEFAULT_GRANT_TYPES = [
 	"authorization_code",
@@ -70,11 +210,16 @@ function collectExtensionKeys(extension) {
 	}
 	const clientDiscoveryIds = (extension.clientDiscovery ? Array.isArray(extension.clientDiscovery) ? extension.clientDiscovery : [extension.clientDiscovery] : []).map((discovery) => discovery.id);
 	for (const clientDiscoveryId of clientDiscoveryIds) assertNonEmptyExtensionValue("client discovery id", clientDiscoveryId);
+	for (const field of extension.clientMetadata?.fields ?? []) {
+		assertNonEmptyExtensionValue("client metadata field", field);
+		if (isReservedOAuthClientMetadataField(field)) throw new BetterAuthError(`OAuth Provider extension client metadata field is reserved: ${field}`);
+	}
 	return {
 		grantTypes,
 		authMethods,
 		assertionTypes,
-		clientDiscoveryIds
+		clientDiscoveryIds,
+		interactionRequestParameters: Object.keys(extension.interactionRequests ?? {})
 	};
 }
 function assertNoDuplicateAcrossExtensions(label, values) {
@@ -97,6 +242,7 @@ function validateOAuthProviderExtensions(extensions) {
 	assertNoDuplicateAcrossExtensions("token_endpoint_auth_method", keys.flatMap((k) => k.authMethods));
 	assertNoDuplicateAcrossExtensions("client_assertion_type", keys.flatMap((k) => k.assertionTypes));
 	assertNoDuplicateAcrossExtensions("client discovery id", keys.flatMap((k) => k.clientDiscoveryIds));
+	assertNoDuplicateAcrossExtensions("interaction request parameter", keys.flatMap((k) => k.interactionRequestParameters));
 }
 function getOAuthProviderExtensions(opts) {
 	return opts.extensions ?? [];
@@ -153,6 +299,23 @@ function getExtensionGrantTypes(opts) {
 function getSupportedGrantTypes(opts) {
 	return Array.from(new Set([...opts.grantTypes ?? DEFAULT_GRANT_TYPES, ...getExtensionGrantTypes(opts)]));
 }
+/**
+* Finds the interaction request a query identifies, such as a device approval
+* keyed by `user_code`. Authorization requests, which carry `response_type` or
+* a pushed `request_uri`, never match.
+*/
+function getExtensionInteractionRequest(opts, query) {
+	const parameters = query;
+	if (parameters.response_type !== void 0 || parameters.request_uri !== void 0) return;
+	for (const extension of getOAuthProviderExtensions(opts)) for (const [parameter, handler] of Object.entries(extension.interactionRequests ?? {})) {
+		const value = parameters[parameter];
+		if (typeof value === "string" && value) return {
+			parameter,
+			handler,
+			value
+		};
+	}
+}
 function getExtensionGrantHandler(opts, grantType) {
 	for (const extension of getOAuthProviderExtensions(opts)) {
 		const handler = extension.grants?.[grantType];
@@ -230,6 +393,29 @@ function collectExtensionIdTokenClaims(opts, input) {
 function collectExtensionUserInfoClaims(opts, input) {
 	return collectClaims(opts, (extension) => extension.claims?.userInfo?.(input));
 }
+/** Whether any extension declares client metadata fields or a validator. */
+function hasExtensionClientMetadata(opts) {
+	return getOAuthProviderExtensions(opts).some((extension) => extension.clientMetadata);
+}
+/** Registration fields that extensions define, stored in the client's `metadata`. */
+function getExtensionClientMetadataFields(opts) {
+	return new Set(getOAuthProviderExtensions(opts).flatMap((extension) => extension.clientMetadata?.fields ?? []));
+}
+/**
+* Runs every extension's client metadata validator, in registration order.
+* Extensions read their fields from `metadata` only, so `metadata` and
+* declared fields are removed from the client they receive; a metadata
+* document carries declared fields at its top level.
+*/
+async function validateExtensionClientMetadata(opts, client, metadata) {
+	const { metadata: _metadata, ...coreClient } = client;
+	const extensionFields = getExtensionClientMetadataFields(opts);
+	const input = {
+		client: Object.fromEntries(Object.entries(coreClient).filter(([field]) => !extensionFields.has(field))),
+		metadata: stripReservedOAuthClientMetadataExtensions(metadata) ?? {}
+	};
+	for (const extension of getOAuthProviderExtensions(opts)) await extension.clientMetadata?.validate?.(input);
+}
 /**
 * Whether any registered extension contributes UserInfo claims. Lets the
 * UserInfo endpoint skip loading the client when nothing needs it.
@@ -371,6 +557,16 @@ async function verifyOAuthQueryParams(oauth_query, secret) {
 	return sigs.length === 1 && !!sig && constantTimeEqual(sig, verifySig) && /* @__PURE__ */ new Date(exp * 1e3) >= /* @__PURE__ */ new Date();
 }
 /**
+* Rejects changes to a client listed in `cachedTrustedClients`. Cached trusted
+* clients are immutable through the client management endpoints.
+*/
+function assertNotTrustedClient(opts, clientId) {
+	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client",
+		error_description: "trusted clients must be updated manually"
+	});
+}
+/**
 * Get a client by ID, checking trusted clients first, then database
 */
 async function getClient(ctx, options, clientId) {
@@ -531,6 +727,53 @@ function throwInvalidAuthenticationRequest(errorDescription) {
 	});
 }
 /**
+* Re-reads a request's raw `application/x-www-form-urlencoded` body, keeping
+* every value of a repeated key. better-call's form-body parser keeps only the
+* last one, so `resource=https://a&resource=https://b` reaches the handler as
+* `{ resource: "https://b" }`. Query strings are unaffected: the router keeps
+* repeated query keys as arrays.
+*
+* Returns `undefined` for other media types or an unreadable or empty body.
+* The endpoint MUST set `cloneRequest: true`, because the body stream is read
+* a second time.
+*
+* @internal
+*/
+async function readFormParams(request) {
+	if (!(request.headers.get("content-type")?.toLowerCase() ?? "").includes("application/x-www-form-urlencoded")) return;
+	let text;
+	try {
+		text = await request.clone().text();
+	} catch {
+		return;
+	}
+	return text ? new URLSearchParams(text) : void 0;
+}
+/**
+* Applies RFC 6749 §3.2 to a form body the parser collapsed to one value per
+* key: a parameter sent without a value counts as omitted, and a parameter
+* sent more than once is rejected with `invalid_request`. A name in
+* `repeatable`, such as RFC 8707 `resource`, keeps every value as an array
+* when it repeats. A value a `before` hook replaced is left as the hook set it.
+*
+* @internal
+*/
+function applyFormParams(params, body, repeatable = []) {
+	const merged = { ...body };
+	for (const name of new Set(params.keys())) {
+		const raw = params.getAll(name);
+		const values = raw.filter(Boolean);
+		if (values.length > 1 && !repeatable.includes(name)) throw new APIError("BAD_REQUEST", {
+			error: "invalid_request",
+			error_description: `${name} must not be repeated`
+		});
+		if (merged[name] !== raw.at(-1)) continue;
+		if (values.length === 0) delete merged[name];
+		else merged[name] = values.length === 1 ? values[0] : values;
+	}
+	return merged;
+}
+/**
 * Normalizes client identification and authentication parameters while
 * enforcing RFC 6749 §2.3 and RFC 8628 §3.1 cardinality. Empty values are
 * omitted. Client identification remains separate from authentication-method
@@ -609,6 +852,37 @@ function clientAllowsGrant(client, grantType) {
 	return allowedGrants.includes(grantType);
 }
 /**
+* Throws an OAuth error response (RFC 6749 §5.2).
+*
+* @internal
+*/
+function tokenError(status, error, errorDescription) {
+	throw new APIError(status, {
+		error,
+		error_description: errorDescription
+	});
+}
+/**
+* Splits a space-delimited OAuth `scope` value (RFC 6749 §3.3).
+*
+* @internal
+*/
+function parseScopes(scope) {
+	const normalized = scope?.trim();
+	return normalized ? normalized.split(/\s+/) : [];
+}
+/**
+* Whether a stored consent covers every requested scope and resource. Shared by
+* authorization and grants that need prior consent, so the coverage rule cannot
+* drift between them. Each caller still chooses which consent rows to check.
+*
+* @internal
+*/
+function consentCovers(consent, scopes, resources) {
+	const consentedResources = consent.resources ?? [];
+	return scopes.every((scope) => consent.scopes.includes(scope)) && resources.every((resource) => consentedResources.includes(resource));
+}
+/**
 * Validates requested scopes against a registered client's allowed scopes.
 *
 * @internal
@@ -640,7 +914,7 @@ function throwInvalidClient(errorDescription, authentication) {
 */
 async function validateClientCredentials(ctx, options, clientId, clientSecret, scopes, preVerified, grantType, authMethod) {
 	const client = await getClient(ctx, options, clientId);
-	if (!client) throwInvalidClient("missing client", { method: authMethod });
+	if (!client) throwInvalidClient("client not found", { method: authMethod });
 	if (client.disabled) throwInvalidClient("client is disabled", { method: authMethod });
 	const registeredAuthMethod = client.tokenEndpointAuthMethod ?? "client_secret_basic";
 	if (authMethod && registeredAuthMethod !== authMethod) throwInvalidClient(`client registered for ${registeredAuthMethod} cannot use ${authMethod}`, { method: authMethod });
@@ -712,7 +986,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-D8r6mvZx.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-92EtLsBi.mjs").then((n) => n.s);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",
@@ -761,12 +1035,31 @@ function parsePrompt(prompt) {
 	return new Set(set);
 }
 /**
-* Extracts the sector identifier (hostname) from a client's first redirect URI.
+* Derives the pairwise sector to store for a client.
+*
+* Only an `https` host identifies who controls a redirect URI, so clients
+* whose redirect URIs are all `https` share the sector of that host. Any app
+* can register a custom scheme, and any local process can listen on a
+* loopback port, so every other client gets a sector of its own. `/` cannot
+* appear in a URL host, so a client sector never equals a host sector.
+*
+* @see https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
+* @internal
+*/
+function deriveSectorIdentifier(clientId, redirectUris) {
+	const urls = (redirectUris ?? []).map((uri) => new URL(uri));
+	const first = urls[0];
+	return first && urls.every((url) => url.protocol === "https:") ? first.host : `client/${clientId}`;
+}
+/**
+* Returns the client's stored pairwise sector, or for a client created before
+* sectors were stored, the host of its first redirect URI.
 *
 * @see https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
 * @internal
 */
 function getSectorIdentifier(client) {
+	if (client.sectorIdentifier) return client.sectorIdentifier;
 	const uri = client.redirectUris?.[0];
 	if (!uri) throw new BetterAuthError("Client has no redirect URIs for sector identifier");
 	return new URL(uri).host;
@@ -791,6 +1084,51 @@ async function resolveSubjectIdentifier(userId, client, opts) {
 	return userId;
 }
 /**
+* Resolves `postLogin.consentReferenceId`, treating an empty value as no reference.
+*
+* @internal
+*/
+async function getConsentReferenceId(opts, context) {
+	return await opts.postLogin?.consentReferenceId?.(context) || void 0;
+}
+/**
+* Finds the consent stored for exactly this reference. Without a reference,
+* only consent stored without one (missing, null, or empty) matches.
+*
+* @internal
+*/
+async function findConsent(ctx, clientId, userId, referenceId) {
+	const where = [{
+		field: "clientId",
+		value: clientId
+	}, {
+		field: "userId",
+		value: userId
+	}];
+	if (referenceId) return ctx.context.adapter.findOne({
+		model: "oauthConsent",
+		where: [...where, {
+			field: "referenceId",
+			value: referenceId
+		}]
+	});
+	const pageSize = 100;
+	for (let offset = 0;; offset += pageSize) {
+		const consents = await ctx.context.adapter.findMany({
+			model: "oauthConsent",
+			where,
+			limit: pageSize,
+			offset,
+			sortBy: {
+				field: "id",
+				direction: "asc"
+			}
+		});
+		const consent = consents.find((row) => !row.referenceId);
+		if (consent || consents.length < pageSize) return consent ?? null;
+	}
+}
+/**
 * Converts URLSearchParams to a plain object, preserving
 * multi-valued keys as arrays instead of discarding duplicates.
 */
@@ -849,4 +1187,4 @@ function isPKCERequired(client, request) {
 	return false;
 }
 //#endregion
-export { collectExtensionAccessTokenClaims as A, validateOAuthProviderExtensions as B, storeToken as C, validateClientScopes as D, validateClientCredentials as E, getExtensionGrantHandler as F, getSupportedAuthMethods as I, getSupportedGrantTypes as L, collectExtensionUserInfoClaims as M, extendOAuthProvider as N, verifyOAuthQueryParams as O, getClientDiscoveries as P, hasUserInfoClaimExtension as R, storeClientSecret as S, toResourceList as T, removeMaxAgeFromQuery as _, getClient as a, resolveSubjectIdentifier as b, getStoredToken as c, mergeDiscoveryMetadata as d, normalizeClientAuthenticationParameters as f, parsePrompt as g, parseClientMetadata as h, extractClientCredentials as i, collectExtensionIdTokenClaims as j, applyOAuthProviderMetadataExtensions as k, isPKCERequired as l, parseBearerToken as m, decryptStoredClientSecret as n, getJwtPlugin as o, normalizeTimestampValue as p, destructureCredentials as r, getOAuthProviderPlugin as s, clientAllowsGrant as t, isSessionFreshForSignedQuery as u, removePromptFromQuery as v, toAudienceClaim as w, searchParamsToQuery as x, resolveSessionAuthTime as y, isExtensionTokenEndpointAuthMethod as z };
+export { validateOAuthProviderExtensions as $, storeClientSecret as A, collectExtensionIdTokenClaims as B, parseScopes as C, resolveSessionAuthTime as D, removePromptFromQuery as E, validateClientCredentials as F, getExtensionGrantHandler as G, extendOAuthProvider as H, validateClientScopes as I, getSupportedGrantTypes as J, getExtensionInteractionRequest as K, verifyOAuthQueryParams as L, toAudienceClaim as M, toResourceList as N, resolveSubjectIdentifier as O, tokenError as P, validateExtensionClientMetadata as Q, applyOAuthProviderMetadataExtensions as R, parsePrompt as S, removeMaxAgeFromQuery as T, getClientDiscoveries as U, collectExtensionUserInfoClaims as V, getExtensionClientMetadataFields as W, hasUserInfoClaimExtension as X, hasExtensionClientMetadata as Y, isExtensionTokenEndpointAuthMethod as Z, mergeDiscoveryMetadata as _, decryptStoredClientSecret as a, parseBearerToken as b, extractClientCredentials as c, getConsentReferenceId as d, isForbiddenCimdClientMetadataField as et, getJwtPlugin as f, isSessionFreshForSignedQuery as g, isPKCERequired as h, consentCovers as i, storeToken as j, searchParamsToQuery as k, findConsent as l, getStoredToken as m, assertNotTrustedClient as n, deriveSectorIdentifier as o, getOAuthProviderPlugin as p, getSupportedAuthMethods as q, clientAllowsGrant as r, destructureCredentials as s, applyFormParams as t, stripReservedOAuthClientMetadataExtensions as tt, getClient as u, normalizeClientAuthenticationParameters as v, readFormParams as w, parseClientMetadata as x, normalizeTimestampValue as y, collectExtensionAccessTokenClaims as z };

package/dist/{version-DVUrz-nv.mjs → version-DeABnmP9.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.9";
+const PACKAGE_VERSION = "1.8.0-beta.0";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.9",
+  "version": "1.8.0-beta.0",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.9",
-    "@better-auth/memory-adapter": "1.7.9",
-    "better-auth": "1.7.9"
+    "@better-auth/core": "1.8.0-beta.0",
+    "@better-auth/memory-adapter": "1.8.0-beta.0",
+    "better-auth": "1.8.0-beta.0"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
     "better-call": "1.4.2",
-    "@better-auth/core": "^1.7.9",
-    "better-auth": "^1.7.9"
+    "@better-auth/core": "^1.8.0-beta.0",
+    "better-auth": "^1.8.0-beta.0"
   },
   "scripts": {
     "build": "tsdown",