@depup/better-auth__core 1.6.23-depup.2

package/src/social-providers/discord.ts

@@ -0,0 +1,170 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import { refreshAccessToken, validateAuthorizationCode } from "../oauth2";
+export interface DiscordProfile extends Record<string, any> {
+	/** the user's id (i.e. the numerical snowflake) */
+	id: string;
+	/** the user's username, not unique across the platform */
+	username: string;
+	/** the user's Discord-tag */
+	discriminator: string;
+	/** the user's display name, if it is set  */
+	global_name: string | null;
+	/**
+	 * the user's avatar hash:
+	 * https://discord.com/developers/docs/reference#image-formatting
+	 */
+	avatar: string | null;
+	/** whether the user belongs to an OAuth2 application */
+	bot?: boolean | undefined;
+	/**
+	 * whether the user is an Official Discord System user (part of the urgent
+	 * message system)
+	 */
+	system?: boolean | undefined;
+	/** whether the user has two factor enabled on their account */
+	mfa_enabled: boolean;
+	/**
+	 * the user's banner hash:
+	 * https://discord.com/developers/docs/reference#image-formatting
+	 */
+	banner: string | null;
+
+	/** the user's banner color encoded as an integer representation of hexadecimal color code */
+	accent_color: number | null;
+
+	/**
+	 * the user's chosen language option:
+	 * https://discord.com/developers/docs/reference#locales
+	 */
+	locale: string;
+	/** whether the email on this account has been verified */
+	verified: boolean;
+	/** the user's email */
+	email?: string | null;
+	/**
+	 * the flags on a user's account:
+	 * https://discord.com/developers/docs/resources/user#user-object-user-flags
+	 */
+	flags: number;
+	/**
+	 * the type of Nitro subscription on a user's account:
+	 * https://discord.com/developers/docs/resources/user#user-object-premium-types
+	 */
+	premium_type: number;
+	/**
+	 * the public flags on a user's account:
+	 * https://discord.com/developers/docs/resources/user#user-object-user-flags
+	 */
+	public_flags: number;
+	/** undocumented field; corresponds to the user's custom nickname */
+	display_name: string | null;
+	/**
+	 * undocumented field; corresponds to the Discord feature where you can e.g.
+	 * put your avatar inside of an ice cube
+	 */
+	avatar_decoration: string | null;
+	/**
+	 * undocumented field; corresponds to the premium feature where you can
+	 * select a custom banner color
+	 */
+	banner_color: string | null;
+	/** undocumented field; the CDN URL of their profile picture */
+	image_url: string;
+}
+
+export interface DiscordOptions extends ProviderOptions<DiscordProfile> {
+	clientId: string;
+	prompt?: ("none" | "consent") | undefined;
+	permissions?: number | undefined;
+}
+
+export const discord = (options: DiscordOptions) => {
+	const tokenEndpoint = "https://discord.com/api/oauth2/token";
+	return {
+		id: "discord",
+		name: "Discord",
+		createAuthorizationURL({ state, scopes, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["identify", "email"];
+			if (scopes) _scopes.push(...scopes);
+			if (options.scope) _scopes.push(...options.scope);
+			const hasBotScope = _scopes.includes("bot");
+			const permissionsParam =
+				hasBotScope && options.permissions !== undefined
+					? `&permissions=${options.permissions}`
+					: "";
+			return new URL(
+				`https://discord.com/api/oauth2/authorize?scope=${_scopes.join(
+					"+",
+				)}&response_type=code&client_id=${
+					options.clientId
+				}&redirect_uri=${encodeURIComponent(
+					options.redirectURI || redirectURI,
+				)}&state=${state}&prompt=${
+					options.prompt || "none"
+				}${permissionsParam}`,
+			);
+		},
+		validateAuthorizationCode: async ({ code, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				redirectURI,
+				options,
+				tokenEndpoint,
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<DiscordProfile>(
+				"https://discord.com/api/users/@me",
+				{
+					headers: {
+						authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+
+			if (error) {
+				return null;
+			}
+			if (profile.avatar === null) {
+				const defaultAvatarNumber =
+					profile.discriminator === "0"
+						? Number(BigInt(profile.id) >> BigInt(22)) % 6
+						: parseInt(profile.discriminator) % 5;
+				profile.image_url = `https://cdn.discordapp.com/embed/avatars/${defaultAvatarNumber}.png`;
+			} else {
+				const format = profile.avatar.startsWith("a_") ? "gif" : "png";
+				profile.image_url = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
+			}
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.id,
+					name: profile.global_name || profile.username || "",
+					email: profile.email,
+					emailVerified: profile.verified,
+					image: profile.image_url,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<DiscordProfile>;
+};

package/src/social-providers/dropbox.ts

@@ -0,0 +1,112 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface DropboxProfile {
+	account_id: string;
+	name: {
+		given_name: string;
+		surname: string;
+		familiar_name: string;
+		display_name: string;
+		abbreviated_name: string;
+	};
+	email: string;
+	email_verified: boolean;
+	profile_photo_url: string;
+}
+
+export interface DropboxOptions extends ProviderOptions<DropboxProfile> {
+	clientId: string;
+	accessType?: ("offline" | "online" | "legacy") | undefined;
+}
+
+export const dropbox = (options: DropboxOptions) => {
+	const tokenEndpoint = "https://api.dropboxapi.com/oauth2/token";
+
+	return {
+		id: "dropbox",
+		name: "Dropbox",
+		createAuthorizationURL: async ({
+			state,
+			scopes,
+			codeVerifier,
+			redirectURI,
+		}) => {
+			const _scopes = options.disableDefaultScope ? [] : ["account_info.read"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			const additionalParams: Record<string, string> = {};
+			if (options.accessType) {
+				additionalParams.token_access_type = options.accessType;
+			}
+			return await createAuthorizationURL({
+				id: "dropbox",
+				options,
+				authorizationEndpoint: "https://www.dropbox.com/oauth2/authorize",
+				scopes: _scopes,
+				state,
+				redirectURI,
+				codeVerifier,
+				additionalParams,
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return await validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint,
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<DropboxProfile>(
+				"https://api.dropboxapi.com/2/users/get_current_account",
+				{
+					method: "POST",
+					headers: {
+						Authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+
+			if (error) {
+				return null;
+			}
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.account_id,
+					name: profile.name?.display_name,
+					email: profile.email,
+					emailVerified: profile.email_verified || false,
+					image: profile.profile_photo_url,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<DropboxProfile>;
+};

package/src/social-providers/facebook.ts

@@ -0,0 +1,288 @@
+import { betterFetch } from "@better-fetch/fetch";
+import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
+import { logger } from "../env";
+import { BetterAuthError } from "../error";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	getPrimaryClientId,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+export interface FacebookProfile {
+	id: string;
+	name: string;
+	email?: string;
+	email_verified?: boolean;
+	picture: {
+		data: {
+			height: number;
+			is_silhouette: boolean;
+			url: string;
+			width: number;
+		};
+	};
+}
+
+interface FacebookDebugTokenData {
+	app_id?: string;
+	is_valid?: boolean;
+	user_id?: string;
+}
+
+/**
+ * Validate an opaque Facebook access token against the configured app.
+ *
+ * Facebook access tokens are not audience-bound at the Graph `/me` endpoint: a
+ * token minted for any Facebook app returns that app's profile. Without this
+ * check, a token issued to an unrelated app could be presented to this
+ * app's direct sign-in path and accepted as proof of identity. We call the
+ * `debug_token` endpoint and require the token to be valid, bound to one of the
+ * configured client ids, and tied to a user.
+ *
+ * @see https://developers.facebook.com/docs/facebook-login/guides/access-tokens/debugging
+ *
+ * @returns the inspected token's `user_id` when the token is valid and bound to
+ * the configured app, otherwise `null`.
+ */
+async function verifyFacebookAccessToken(
+	accessToken: string,
+	options: FacebookOptions,
+): Promise<string | null> {
+	const primaryClientId = getPrimaryClientId(options.clientId);
+	if (!primaryClientId || !options.clientSecret) {
+		return null;
+	}
+	const clientIds = Array.isArray(options.clientId)
+		? options.clientId
+		: [options.clientId];
+	const appAccessToken = `${primaryClientId}|${options.clientSecret}`;
+	const { data, error } = await betterFetch<{ data?: FacebookDebugTokenData }>(
+		"https://graph.facebook.com/debug_token",
+		{
+			query: {
+				input_token: accessToken,
+				access_token: appAccessToken,
+			},
+		},
+	);
+	if (error || !data?.data) {
+		return null;
+	}
+	const { is_valid, app_id, user_id } = data.data;
+	if (is_valid !== true || !app_id || !clientIds.includes(app_id) || !user_id) {
+		return null;
+	}
+	return user_id;
+}
+
+export interface FacebookOptions extends ProviderOptions<FacebookProfile> {
+	clientId: string | string[];
+	/**
+	 * Extend list of fields to retrieve from the Facebook user profile.
+	 *
+	 * @default ["id", "name", "email", "picture"]
+	 */
+	fields?: string[] | undefined;
+
+	/**
+	 * The config id to use when undergoing oauth
+	 */
+	configId?: string | undefined;
+}
+
+export const facebook = (options: FacebookOptions) => {
+	return {
+		id: "facebook",
+		name: "Facebook",
+		async createAuthorizationURL({ state, scopes, redirectURI, loginHint }) {
+			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
+				logger.error(
+					"Client ID and client secret are required for Facebook. Make sure to provide them in the options.",
+				);
+				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+			}
+			const _scopes = options.disableDefaultScope
+				? []
+				: ["email", "public_profile"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			return await createAuthorizationURL({
+				id: "facebook",
+				options,
+				authorizationEndpoint: "https://www.facebook.com/v24.0/dialog/oauth",
+				scopes: _scopes,
+				state,
+				redirectURI,
+				loginHint,
+				additionalParams: options.configId
+					? {
+							config_id: options.configId,
+						}
+					: {},
+			});
+		},
+		validateAuthorizationCode: async ({ code, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				redirectURI,
+				options,
+				tokenEndpoint: "https://graph.facebook.com/v24.0/oauth/access_token",
+			});
+		},
+		async verifyIdToken(token, nonce) {
+			if (options.disableIdTokenSignIn) {
+				return false;
+			}
+
+			if (options.verifyIdToken) {
+				return options.verifyIdToken(token, nonce);
+			}
+
+			/* limited login */
+			// check is limited token
+			if (token.split(".").length === 3) {
+				try {
+					const { payload: jwtClaims } = await jwtVerify(
+						token,
+						createRemoteJWKSet(
+							// https://developers.facebook.com/docs/facebook-login/limited-login/token/#jwks
+							new URL(
+								"https://limited.facebook.com/.well-known/oauth/openid/jwks/",
+							),
+						),
+						{
+							algorithms: ["RS256"],
+							audience: options.clientId,
+							issuer: "https://www.facebook.com",
+						},
+					);
+
+					if (nonce && jwtClaims.nonce !== nonce) {
+						return false;
+					}
+
+					return !!jwtClaims;
+				} catch {
+					return false;
+				}
+			}
+
+			/* access_token */
+			// An opaque access token carries no app binding of its own, so it
+			// must be validated against the configured app before it can be
+			// trusted as proof of identity.
+			return (await verifyFacebookAccessToken(token, options)) !== null;
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint:
+							"https://graph.facebook.com/v24.0/oauth/access_token",
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+
+			if (token.idToken && token.idToken.split(".").length === 3) {
+				const profile = decodeJwt(token.idToken) as {
+					sub: string;
+					email: string;
+					name: string;
+					picture: string;
+				};
+
+				const user = {
+					id: profile.sub,
+					name: profile.name,
+					email: profile.email,
+					picture: {
+						data: {
+							url: profile.picture,
+							height: 100,
+							width: 100,
+							is_silhouette: false,
+						},
+					},
+				};
+
+				// https://developers.facebook.com/docs/facebook-login/limited-login/permissions
+				// Facebook ID token does not include email_verified claim.
+				// We default to false for security consistency.
+				const userMap = await options.mapProfileToUser?.({
+					...user,
+					email_verified: false,
+				});
+
+				return {
+					user: {
+						...user,
+						emailVerified: false,
+						...userMap,
+					},
+					data: profile,
+				};
+			}
+
+			// The profile is fetched with `accessToken`, which is the credential
+			// that actually proves identity here — and a separate request field
+			// from the `idToken`/token validated by `verifyIdToken`. Since an
+			// opaque token is not app-bound at `/me`, validate this exact token
+			// against the configured app before trusting the profile it returns.
+			const accessToken = token.accessToken;
+			if (!accessToken) {
+				return null;
+			}
+			const tokenUserId = await verifyFacebookAccessToken(accessToken, options);
+			if (!tokenUserId) {
+				return null;
+			}
+
+			const fields = [
+				"id",
+				"name",
+				"email",
+				"picture",
+				...(options?.fields || []),
+			];
+			const { data: profile, error } = await betterFetch<FacebookProfile>(
+				"https://graph.facebook.com/me?fields=" + fields.join(","),
+				{
+					auth: {
+						type: "Bearer",
+						token: accessToken,
+					},
+				},
+			);
+			if (error) {
+				return null;
+			}
+			// Bind the validated token to the profile it returned.
+			if (profile.id !== tokenUserId) {
+				return null;
+			}
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.id,
+					name: profile.name,
+					email: profile.email,
+					image: profile.picture.data.url,
+					emailVerified: profile.email_verified ?? false,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<FacebookProfile>;
+};

package/src/social-providers/figma.ts

@@ -0,0 +1,118 @@
+import { betterFetch } from "@better-fetch/fetch";
+import { logger } from "../env";
+import { BetterAuthError } from "../error";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface FigmaProfile {
+	id: string;
+	email: string;
+	handle: string;
+	img_url: string;
+}
+
+export interface FigmaOptions extends ProviderOptions<FigmaProfile> {
+	clientId: string;
+}
+
+export const figma = (options: FigmaOptions) => {
+	const tokenEndpoint = "https://api.figma.com/v1/oauth/token";
+	return {
+		id: "figma",
+		name: "Figma",
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			if (!options.clientId || !options.clientSecret) {
+				logger.error(
+					"Client Id and Client Secret are required for Figma. Make sure to provide them in the options.",
+				);
+				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+			}
+			if (!codeVerifier) {
+				throw new BetterAuthError("codeVerifier is required for Figma");
+			}
+
+			const _scopes = options.disableDefaultScope ? [] : ["current_user:read"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+
+			const url = await createAuthorizationURL({
+				id: "figma",
+				options,
+				authorizationEndpoint: "https://www.figma.com/oauth",
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+			});
+
+			return url;
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint,
+				authentication: "basic",
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+						authentication: "basic",
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+
+			try {
+				const { data: profile } = await betterFetch<FigmaProfile>(
+					"https://api.figma.com/v1/me",
+					{
+						headers: {
+							Authorization: `Bearer ${token.accessToken}`,
+						},
+					},
+				);
+
+				if (!profile) {
+					logger.error("Failed to fetch user from Figma");
+					return null;
+				}
+
+				const userMap = await options.mapProfileToUser?.(profile);
+
+				return {
+					user: {
+						id: profile.id,
+						name: profile.handle,
+						email: profile.email,
+						image: profile.img_url,
+						emailVerified: false,
+						...userMap,
+					},
+					data: profile,
+				};
+			} catch (error) {
+				logger.error("Failed to fetch user info from Figma:", error);
+				return null;
+			}
+		},
+		options,
+	} satisfies OAuthProvider<FigmaProfile>;
+};