@better-auth/passkey 1.5.7-beta.1 → 1.6.0

package/dist/index-DD5Lute1.d.mts

@@ -0,0 +1,811 @@
+import * as _simplewebauthn_server0 from "@simplewebauthn/server";
+import { AuthenticationExtensionsClientInputs, AuthenticationResponseJSON, CredentialDeviceType, RegistrationResponseJSON, VerifiedAuthenticationResponse, VerifiedRegistrationResponse } from "@simplewebauthn/server";
+import * as zod from "zod";
+import * as better_auth0 from "better-auth";
+import { GenericEndpointContext } from "@better-auth/core";
+import { InferOptionSchema } from "better-auth/types";
+import * as better_call0 from "better-call";
+import * as zod_v4_core0 from "zod/v4/core";
+
+//#region src/schema.d.ts
+declare const schema: {
+  passkey: {
+    fields: {
+      name: {
+        type: "string";
+        required: false;
+      };
+      publicKey: {
+        type: "string";
+        required: true;
+      };
+      userId: {
+        type: "string";
+        references: {
+          model: string;
+          field: string;
+        };
+        required: true;
+        index: true;
+      };
+      credentialID: {
+        type: "string";
+        required: true;
+        index: true;
+      };
+      counter: {
+        type: "number";
+        required: true;
+      };
+      deviceType: {
+        type: "string";
+        required: true;
+      };
+      backedUp: {
+        type: "boolean";
+        required: true;
+      };
+      transports: {
+        type: "string";
+        required: false;
+      };
+      createdAt: {
+        type: "date";
+        required: false;
+      };
+      aaguid: {
+        type: "string";
+        required: false;
+      };
+    };
+  };
+};
+//#endregion
+//#region src/types.d.ts
+/**
+ * @internal
+ */
+interface WebAuthnChallengeValue {
+  expectedChallenge: string;
+  userData: {
+    id: string;
+    name?: string | undefined;
+    displayName?: string | undefined;
+  };
+  context?: string | null;
+}
+type Awaitable<T> = T | Promise<T>;
+interface PasskeyRegistrationUser {
+  id: string;
+  name: string;
+  displayName?: string | undefined;
+}
+type PasskeyExtensionsResolver = AuthenticationExtensionsClientInputs | ((args: {
+  ctx: GenericEndpointContext;
+}) => Awaitable<AuthenticationExtensionsClientInputs | undefined>);
+interface PasskeyRegistrationOptions {
+  /**
+   * Require an authenticated session for passkey registration.
+   *
+   * @default true
+   */
+  requireSession?: boolean | undefined;
+  /**
+   * Resolve the user when session is not available.
+   * Required when `requireSession` is false and no session exists.
+   */
+  resolveUser?: ((args: {
+    ctx: GenericEndpointContext;
+    context?: string | null | undefined;
+  }) => Awaitable<PasskeyRegistrationUser>) | undefined;
+  /**
+   * Callback after a successful registration verification.
+   * Useful for user linking or auditing.
+   */
+  afterVerification?: ((args: {
+    ctx: GenericEndpointContext;
+    verification: VerifiedRegistrationResponse;
+    user: PasskeyRegistrationUser;
+    clientData: RegistrationResponseJSON;
+    context?: string | null | undefined;
+  }) => Awaitable<{
+    userId?: string;
+  } | void>) | undefined;
+  /**
+   * Optional WebAuthn extensions to include in registration options.
+   */
+  extensions?: PasskeyExtensionsResolver | undefined;
+}
+interface PasskeyAuthenticationOptions {
+  /**
+   * Optional WebAuthn extensions to include in authentication options.
+   */
+  extensions?: PasskeyExtensionsResolver | undefined;
+  /**
+   * Callback after a successful authentication verification.
+   */
+  afterVerification?: ((args: {
+    ctx: GenericEndpointContext;
+    verification: VerifiedAuthenticationResponse;
+    clientData: AuthenticationResponseJSON;
+  }) => Awaitable<void>) | undefined;
+}
+interface PasskeyOptions {
+  /**
+   * A unique identifier for your website. 'localhost' is okay for
+   * local dev
+   *
+   * @default "localhost"
+   */
+  rpID?: string | undefined;
+  /**
+   * Human-readable title for your website
+   *
+   * @default "Better Auth"
+   */
+  rpName?: string | undefined;
+  /**
+   * The URL at which registrations and authentications should occur.
+   * `http://localhost` and `http://localhost:PORT` are also valid.
+   * Do NOT include any trailing /
+   *
+   * if this isn't provided. The client itself will
+   * pass this value.
+   */
+  origin?: (string | string[] | null) | undefined;
+  /**
+   * Allow customization of the authenticatorSelection options
+   * during passkey registration.
+   */
+  authenticatorSelection?: AuthenticatorSelectionCriteria | undefined;
+  /**
+   * Advanced options
+   */
+  advanced?: {
+    /**
+     * Cookie name for storing WebAuthn challenge ID during authentication flow
+     *
+     * @default "better-auth-passkey"
+     */
+    webAuthnChallengeCookie?: string;
+  } | undefined;
+  /**
+   * Schema for the passkey model
+   */
+  schema?: InferOptionSchema<typeof schema> | undefined;
+  /**
+   * Registration behavior overrides
+   */
+  registration?: PasskeyRegistrationOptions | undefined;
+  /**
+   * Authentication behavior overrides
+   */
+  authentication?: PasskeyAuthenticationOptions | undefined;
+}
+type Passkey = {
+  id: string;
+  name?: string | undefined;
+  publicKey: string;
+  userId: string;
+  credentialID: string;
+  counter: number;
+  deviceType: CredentialDeviceType;
+  backedUp: boolean;
+  transports?: string | undefined;
+  createdAt: Date;
+  aaguid?: string | undefined;
+};
+//#endregion
+//#region src/error-codes.d.ts
+declare const PASSKEY_ERROR_CODES: {
+  CHALLENGE_NOT_FOUND: better_auth0.RawError<"CHALLENGE_NOT_FOUND">;
+  YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: better_auth0.RawError<"YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY">;
+  FAILED_TO_VERIFY_REGISTRATION: better_auth0.RawError<"FAILED_TO_VERIFY_REGISTRATION">;
+  PASSKEY_NOT_FOUND: better_auth0.RawError<"PASSKEY_NOT_FOUND">;
+  AUTHENTICATION_FAILED: better_auth0.RawError<"AUTHENTICATION_FAILED">;
+  UNABLE_TO_CREATE_SESSION: better_auth0.RawError<"UNABLE_TO_CREATE_SESSION">;
+  FAILED_TO_UPDATE_PASSKEY: better_auth0.RawError<"FAILED_TO_UPDATE_PASSKEY">;
+  PREVIOUSLY_REGISTERED: better_auth0.RawError<"PREVIOUSLY_REGISTERED">;
+  REGISTRATION_CANCELLED: better_auth0.RawError<"REGISTRATION_CANCELLED">;
+  AUTH_CANCELLED: better_auth0.RawError<"AUTH_CANCELLED">;
+  UNKNOWN_ERROR: better_auth0.RawError<"UNKNOWN_ERROR">;
+  SESSION_REQUIRED: better_auth0.RawError<"SESSION_REQUIRED">;
+  RESOLVE_USER_REQUIRED: better_auth0.RawError<"RESOLVE_USER_REQUIRED">;
+  RESOLVED_USER_INVALID: better_auth0.RawError<"RESOLVED_USER_INVALID">;
+};
+//#endregion
+//#region src/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    passkey: {
+      creator: typeof passkey;
+    };
+  }
+}
+declare const passkey: (options?: PasskeyOptions | undefined) => {
+  id: "passkey";
+  version: string;
+  endpoints: {
+    generatePasskeyRegistrationOptions: better_call0.StrictEndpoint<"/passkey/generate-register-options", {
+      method: "GET";
+      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[] | undefined;
+      query: zod.ZodOptional<zod.ZodObject<{
+        authenticatorAttachment: zod.ZodOptional<zod.ZodEnum<{
+          platform: "platform";
+          "cross-platform": "cross-platform";
+        }>>;
+        name: zod.ZodOptional<zod.ZodString>;
+        context: zod.ZodOptional<zod.ZodString>;
+      }, zod_v4_core0.$strip>>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              parameters: {
+                query: {
+                  authenticatorAttachment: {
+                    description: string;
+                    required: boolean;
+                  };
+                  name: {
+                    description: string;
+                    required: boolean;
+                  };
+                  context: {
+                    description: string;
+                    required: boolean;
+                  };
+                };
+              };
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      challenge: {
+                        type: string;
+                      };
+                      rp: {
+                        type: string;
+                        properties: {
+                          name: {
+                            type: string;
+                          };
+                          id: {
+                            type: string;
+                          };
+                        };
+                      };
+                      user: {
+                        type: string;
+                        properties: {
+                          id: {
+                            type: string;
+                          };
+                          name: {
+                            type: string;
+                          };
+                          displayName: {
+                            type: string;
+                          };
+                        };
+                      };
+                      pubKeyCredParams: {
+                        type: string;
+                        items: {
+                          type: string;
+                          properties: {
+                            type: {
+                              type: string;
+                            };
+                            alg: {
+                              type: string;
+                            };
+                          };
+                        };
+                      };
+                      timeout: {
+                        type: string;
+                      };
+                      excludeCredentials: {
+                        type: string;
+                        items: {
+                          type: string;
+                          properties: {
+                            id: {
+                              type: string;
+                            };
+                            type: {
+                              type: string;
+                            };
+                            transports: {
+                              type: string;
+                              items: {
+                                type: string;
+                              };
+                            };
+                          };
+                        };
+                      };
+                      authenticatorSelection: {
+                        type: string;
+                        properties: {
+                          authenticatorAttachment: {
+                            type: string;
+                          };
+                          requireResidentKey: {
+                            type: string;
+                          };
+                          userVerification: {
+                            type: string;
+                          };
+                        };
+                      };
+                      attestation: {
+                        type: string;
+                      };
+                      extensions: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, _simplewebauthn_server0.PublicKeyCredentialCreationOptionsJSON>;
+    generatePasskeyAuthenticationOptions: better_call0.StrictEndpoint<"/passkey/generate-authenticate-options", {
+      method: "GET";
+      metadata: {
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      challenge: {
+                        type: string;
+                      };
+                      rp: {
+                        type: string;
+                        properties: {
+                          name: {
+                            type: string;
+                          };
+                          id: {
+                            type: string;
+                          };
+                        };
+                      };
+                      user: {
+                        type: string;
+                        properties: {
+                          id: {
+                            type: string;
+                          };
+                          name: {
+                            type: string;
+                          };
+                          displayName: {
+                            type: string;
+                          };
+                        };
+                      };
+                      timeout: {
+                        type: string;
+                      };
+                      allowCredentials: {
+                        type: string;
+                        items: {
+                          type: string;
+                          properties: {
+                            id: {
+                              type: string;
+                            };
+                            type: {
+                              type: string;
+                            };
+                            transports: {
+                              type: string;
+                              items: {
+                                type: string;
+                              };
+                            };
+                          };
+                        };
+                      };
+                      userVerification: {
+                        type: string;
+                      };
+                      authenticatorSelection: {
+                        type: string;
+                        properties: {
+                          authenticatorAttachment: {
+                            type: string;
+                          };
+                          requireResidentKey: {
+                            type: string;
+                          };
+                          userVerification: {
+                            type: string;
+                          };
+                        };
+                      };
+                      extensions: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, _simplewebauthn_server0.PublicKeyCredentialRequestOptionsJSON>;
+    verifyPasskeyRegistration: better_call0.StrictEndpoint<"/passkey/verify-registration", {
+      method: "POST";
+      body: zod.ZodObject<{
+        response: zod.ZodAny;
+        name: zod.ZodOptional<zod.ZodString>;
+      }, zod_v4_core0.$strip>;
+      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[] | undefined;
+      metadata: {
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    $ref: string;
+                  };
+                };
+              };
+            };
+            400: {
+              description: string;
+            };
+          };
+        };
+      };
+    }, Passkey>;
+    verifyPasskeyAuthentication: better_call0.StrictEndpoint<"/passkey/verify-authentication", {
+      method: "POST";
+      body: zod.ZodObject<{
+        response: zod.ZodRecord<zod.ZodAny, zod.ZodAny>;
+      }, zod_v4_core0.$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      session: {
+                        $ref: string;
+                      };
+                      user: {
+                        $ref: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+        $Infer: {
+          body: {
+            response: _simplewebauthn_server0.AuthenticationResponseJSON;
+          };
+        };
+      };
+    }, {
+      session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+    }>;
+    listPasskeys: better_call0.StrictEndpoint<"/passkey/list-user-passkeys", {
+      method: "GET";
+      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "array";
+                    items: {
+                      $ref: string;
+                      required: string[];
+                    };
+                    description: string;
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, Passkey[]>;
+    deletePasskey: better_call0.StrictEndpoint<"/passkey/delete-passkey", {
+      method: "POST";
+      body: zod.ZodObject<{
+        id: zod.ZodString;
+      }, zod_v4_core0.$strip>;
+      use: (((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>) | ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        verifiedResource: {};
+      }>))[];
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      status: {
+                        type: string;
+                        description: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      status: boolean;
+    }>;
+    updatePasskey: better_call0.StrictEndpoint<"/passkey/update-passkey", {
+      method: "POST";
+      body: zod.ZodObject<{
+        id: zod.ZodString;
+        name: zod.ZodString;
+      }, zod_v4_core0.$strip>;
+      use: (((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>) | ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        verifiedResource: {};
+      }>))[];
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      passkey: {
+                        $ref: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      passkey: Passkey;
+    }>;
+  };
+  schema: {
+    passkey: {
+      fields: {
+        name: {
+          type: "string";
+          required: false;
+        };
+        publicKey: {
+          type: "string";
+          required: true;
+        };
+        userId: {
+          type: "string";
+          references: {
+            model: string;
+            field: string;
+          };
+          required: true;
+          index: true;
+        };
+        credentialID: {
+          type: "string";
+          required: true;
+          index: true;
+        };
+        counter: {
+          type: "number";
+          required: true;
+        };
+        deviceType: {
+          type: "string";
+          required: true;
+        };
+        backedUp: {
+          type: "boolean";
+          required: true;
+        };
+        transports: {
+          type: "string";
+          required: false;
+        };
+        createdAt: {
+          type: "date";
+          required: false;
+        };
+        aaguid: {
+          type: "string";
+          required: false;
+        };
+      };
+    };
+  };
+  $ERROR_CODES: {
+    CHALLENGE_NOT_FOUND: better_auth0.RawError<"CHALLENGE_NOT_FOUND">;
+    YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: better_auth0.RawError<"YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY">;
+    FAILED_TO_VERIFY_REGISTRATION: better_auth0.RawError<"FAILED_TO_VERIFY_REGISTRATION">;
+    PASSKEY_NOT_FOUND: better_auth0.RawError<"PASSKEY_NOT_FOUND">;
+    AUTHENTICATION_FAILED: better_auth0.RawError<"AUTHENTICATION_FAILED">;
+    UNABLE_TO_CREATE_SESSION: better_auth0.RawError<"UNABLE_TO_CREATE_SESSION">;
+    FAILED_TO_UPDATE_PASSKEY: better_auth0.RawError<"FAILED_TO_UPDATE_PASSKEY">;
+    PREVIOUSLY_REGISTERED: better_auth0.RawError<"PREVIOUSLY_REGISTERED">;
+    REGISTRATION_CANCELLED: better_auth0.RawError<"REGISTRATION_CANCELLED">;
+    AUTH_CANCELLED: better_auth0.RawError<"AUTH_CANCELLED">;
+    UNKNOWN_ERROR: better_auth0.RawError<"UNKNOWN_ERROR">;
+    SESSION_REQUIRED: better_auth0.RawError<"SESSION_REQUIRED">;
+    RESOLVE_USER_REQUIRED: better_auth0.RawError<"RESOLVE_USER_REQUIRED">;
+    RESOLVED_USER_INVALID: better_auth0.RawError<"RESOLVED_USER_INVALID">;
+  };
+  options: PasskeyOptions | undefined;
+};
+//#endregion
+export { PasskeyExtensionsResolver as a, PasskeyRegistrationUser as c, PasskeyAuthenticationOptions as i, WebAuthnChallengeValue as l, PASSKEY_ERROR_CODES as n, PasskeyOptions as o, Passkey as r, PasskeyRegistrationOptions as s, passkey as t };