@depup/better-auth__core 1.6.23-depup.2

package/src/social-providers/github.ts

@@ -0,0 +1,184 @@
+import { betterFetch } from "@better-fetch/fetch";
+import { logger } from "../env";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	getOAuth2Tokens,
+	refreshAccessToken,
+} from "../oauth2";
+import { createAuthorizationCodeRequest } from "../oauth2/validate-authorization-code";
+
+export interface GithubProfile {
+	login: string;
+	id: string;
+	node_id: string;
+	avatar_url: string;
+	gravatar_id: string;
+	url: string;
+	html_url: string;
+	followers_url: string;
+	following_url: string;
+	gists_url: string;
+	starred_url: string;
+	subscriptions_url: string;
+	organizations_url: string;
+	repos_url: string;
+	events_url: string;
+	received_events_url: string;
+	type: string;
+	site_admin: boolean;
+	name: string;
+	company: string;
+	blog: string;
+	location: string;
+	email: string | null;
+	hireable: boolean;
+	bio: string;
+	twitter_username: string;
+	public_repos: string;
+	public_gists: string;
+	followers: string;
+	following: string;
+	created_at: string;
+	updated_at: string;
+	private_gists: string;
+	total_private_repos: string;
+	owned_private_repos: string;
+	disk_usage: string;
+	collaborators: string;
+	two_factor_authentication: boolean;
+	plan: {
+		name: string;
+		space: string;
+		private_repos: string;
+		collaborators: string;
+	};
+}
+
+export interface GithubOptions extends ProviderOptions<GithubProfile> {
+	clientId: string;
+}
+export const github = (options: GithubOptions) => {
+	const tokenEndpoint = "https://github.com/login/oauth/access_token";
+	return {
+		id: "github",
+		name: "GitHub",
+		createAuthorizationURL({
+			state,
+			scopes,
+			loginHint,
+			codeVerifier,
+			redirectURI,
+		}) {
+			const _scopes = options.disableDefaultScope
+				? []
+				: ["read:user", "user:email"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			return createAuthorizationURL({
+				id: "github",
+				options,
+				authorizationEndpoint: "https://github.com/login/oauth/authorize",
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+				loginHint,
+				prompt: options.prompt,
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			const { body, headers: requestHeaders } = createAuthorizationCodeRequest({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+			});
+
+			const { data, error } = await betterFetch<
+				| { access_token: string; token_type: string; scope: string }
+				| { error: string; error_description?: string; error_uri?: string }
+			>(tokenEndpoint, {
+				method: "POST",
+				body: body,
+				headers: requestHeaders,
+			});
+
+			if (error) {
+				logger.error("GitHub OAuth token exchange failed:", error);
+				return null;
+			}
+
+			if ("error" in data) {
+				logger.error("GitHub OAuth token exchange failed:", data);
+				return null;
+			}
+
+			return getOAuth2Tokens(data);
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<GithubProfile>(
+				"https://api.github.com/user",
+				{
+					headers: {
+						"User-Agent": "better-auth",
+						authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+			if (error) {
+				return null;
+			}
+			const { data: emails } = await betterFetch<
+				{
+					email: string;
+					primary: boolean;
+					verified: boolean;
+					visibility: "public" | "private";
+				}[]
+			>("https://api.github.com/user/emails", {
+				headers: {
+					Authorization: `Bearer ${token.accessToken}`,
+					"User-Agent": "better-auth",
+				},
+			});
+
+			if (!profile.email && emails) {
+				profile.email = (emails.find((e) => e.primary) ?? emails[0])
+					?.email as string;
+			}
+			const emailVerified =
+				emails?.find((e) => e.email === profile.email)?.verified ?? false;
+
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.id,
+					name: profile.name || profile.login || "",
+					email: profile.email,
+					image: profile.avatar_url,
+					emailVerified,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<GithubProfile>;
+};

package/src/social-providers/gitlab.ts

@@ -0,0 +1,155 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface GitlabProfile extends Record<string, any> {
+	id: number;
+	username: string;
+	email: string;
+	name: string;
+	state: string;
+	avatar_url: string;
+	web_url: string;
+	created_at: string;
+	bio: string;
+	location?: string | undefined;
+	public_email: string;
+	skype: string;
+	linkedin: string;
+	twitter: string;
+	website_url: string;
+	organization: string;
+	job_title: string;
+	pronouns: string;
+	bot: boolean;
+	work_information?: string | undefined;
+	followers: number;
+	following: number;
+	local_time: string;
+	last_sign_in_at: string;
+	confirmed_at: string;
+	theme_id: number;
+	last_activity_on: string;
+	color_scheme_id: number;
+	projects_limit: number;
+	current_sign_in_at: string;
+	identities: Array<{
+		provider: string;
+		extern_uid: string;
+	}>;
+	can_create_group: boolean;
+	can_create_project: boolean;
+	two_factor_enabled: boolean;
+	external: boolean;
+	private_profile: boolean;
+	commit_email: string;
+	shared_runners_minutes_limit: number;
+	extra_shared_runners_minutes_limit: number;
+	email_verified?: boolean | undefined;
+}
+
+export interface GitlabOptions extends ProviderOptions<GitlabProfile> {
+	clientId: string;
+	issuer?: string | undefined;
+}
+
+const cleanDoubleSlashes = (input: string = "") => {
+	return input
+		.split("://")
+		.map((str) => str.replace(/\/{2,}/g, "/"))
+		.join("://");
+};
+
+const issuerToEndpoints = (issuer?: string | undefined) => {
+	const baseUrl = issuer || "https://gitlab.com";
+	return {
+		authorizationEndpoint: cleanDoubleSlashes(`${baseUrl}/oauth/authorize`),
+		tokenEndpoint: cleanDoubleSlashes(`${baseUrl}/oauth/token`),
+		userinfoEndpoint: cleanDoubleSlashes(`${baseUrl}/api/v4/user`),
+	};
+};
+
+export const gitlab = (options: GitlabOptions) => {
+	const { authorizationEndpoint, tokenEndpoint, userinfoEndpoint } =
+		issuerToEndpoints(options.issuer);
+	const issuerId = "gitlab";
+	const issuerName = "Gitlab";
+	return {
+		id: issuerId,
+		name: issuerName,
+		createAuthorizationURL: async ({
+			state,
+			scopes,
+			codeVerifier,
+			loginHint,
+			redirectURI,
+		}) => {
+			const _scopes = options.disableDefaultScope ? [] : ["read_user"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			return await createAuthorizationURL({
+				id: issuerId,
+				options,
+				authorizationEndpoint,
+				scopes: _scopes,
+				state,
+				redirectURI,
+				codeVerifier,
+				loginHint,
+			});
+		},
+		validateAuthorizationCode: async ({ code, redirectURI, codeVerifier }) => {
+			return validateAuthorizationCode({
+				code,
+				redirectURI,
+				options,
+				codeVerifier,
+				tokenEndpoint,
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint: tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<GitlabProfile>(
+				userinfoEndpoint,
+				{ headers: { authorization: `Bearer ${token.accessToken}` } },
+			);
+			if (error || profile.state !== "active" || profile.locked) {
+				return null;
+			}
+			const userMap = await options.mapProfileToUser?.(profile);
+			// GitLab may provide email_verified claim, but it's not guaranteed.
+			// We check for it first, then default to false for security consistency.
+			return {
+				user: {
+					id: profile.id,
+					name: profile.name ?? profile.username ?? "",
+					email: profile.email,
+					image: profile.avatar_url,
+					emailVerified: profile.email_verified ?? false,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<GitlabProfile>;
+};

package/src/social-providers/google.ts

@@ -0,0 +1,263 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { JWTPayload } from "jose";
+import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+import { logger } from "../env";
+import { APIError, BetterAuthError } from "../error";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	getPrimaryClientId,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface GoogleProfile {
+	aud: string;
+	azp: string;
+	email: string;
+	email_verified: boolean;
+	exp: number;
+	/**
+	 * The family name of the user, or last name in most
+	 * Western languages.
+	 */
+	family_name: string;
+	/**
+	 * The given name of the user, or first name in most
+	 * Western languages.
+	 */
+	given_name: string;
+	hd?: string | undefined;
+	iat: number;
+	iss: string;
+	jti?: string | undefined;
+	locale?: string | undefined;
+	name: string;
+	nbf?: number | undefined;
+	picture: string;
+	sub: string;
+}
+
+export interface GoogleOptions extends ProviderOptions<GoogleProfile> {
+	clientId: string | string[];
+	/**
+	 * The access type to use for the authorization code request
+	 */
+	accessType?: ("offline" | "online") | undefined;
+	/**
+	 * The display mode to use for the authorization code request
+	 */
+	display?: ("page" | "popup" | "touch" | "wap") | undefined;
+	/**
+	 * The hosted domain (Google Workspace) the user must belong to.
+	 *
+	 * This is sent to Google as the `hd` authorization hint and, when set, is
+	 * also enforced against the `hd` claim of the returned id token/profile.
+	 * Set `hd: "*"` to require any Workspace hosted-domain claim. Sign-in is
+	 * rejected when the claim is missing or does not satisfy this restriction.
+	 */
+	hd?: string | undefined;
+}
+
+const GOOGLE_ID_TOKEN_MAX_AGE = "1h";
+
+export interface VerifyGoogleIdTokenOptions {
+	token: string;
+	audience: string | string[];
+	nonce?: string | undefined;
+}
+
+/**
+ * Verifies a Google ID token against Google's issuer, audience, signature,
+ * expiry, and maximum token age.
+ */
+export const verifyGoogleIdToken = async ({
+	token,
+	audience,
+	nonce,
+}: VerifyGoogleIdTokenOptions): Promise<JWTPayload | null> => {
+	try {
+		const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
+		if (!kid || !jwtAlg) return null;
+
+		const publicKey = await getGooglePublicKey(kid);
+		const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
+			algorithms: [jwtAlg],
+			issuer: ["https://accounts.google.com", "accounts.google.com"],
+			audience,
+			maxTokenAge: GOOGLE_ID_TOKEN_MAX_AGE,
+		});
+
+		if (nonce && jwtClaims.nonce !== nonce) {
+			return null;
+		}
+
+		return jwtClaims;
+	} catch {
+		return null;
+	}
+};
+
+/**
+ * Checks whether Google's verified `hd` claim satisfies the configured hosted
+ * domain restriction. `hd: "*"` accepts any Google Workspace hosted domain.
+ */
+export const isGoogleHostedDomainAllowed = (
+	configuredHostedDomain: string | undefined,
+	tokenHostedDomain: unknown,
+) => {
+	if (!configuredHostedDomain) return true;
+	if (typeof tokenHostedDomain !== "string" || !tokenHostedDomain) {
+		return false;
+	}
+	if (configuredHostedDomain === "*") return true;
+	return tokenHostedDomain === configuredHostedDomain;
+};
+
+export const google = (options: GoogleOptions) => {
+	return {
+		id: "google",
+		name: "Google",
+		async createAuthorizationURL({
+			state,
+			scopes,
+			codeVerifier,
+			redirectURI,
+			loginHint,
+			display,
+		}) {
+			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
+				logger.error(
+					"Client Id and Client Secret is required for Google. Make sure to provide them in the options.",
+				);
+				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+			}
+			if (!codeVerifier) {
+				throw new BetterAuthError("codeVerifier is required for Google");
+			}
+			const _scopes = options.disableDefaultScope
+				? []
+				: ["email", "profile", "openid"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			const url = await createAuthorizationURL({
+				id: "google",
+				options,
+				authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+				prompt: options.prompt,
+				accessType: options.accessType,
+				display: display || options.display,
+				loginHint,
+				hd: options.hd,
+				additionalParams: {
+					include_granted_scopes: "true",
+				},
+			});
+			return url;
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint: "https://oauth2.googleapis.com/token",
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint: "https://oauth2.googleapis.com/token",
+					});
+				},
+		async verifyIdToken(token, nonce) {
+			if (options.disableIdTokenSignIn) {
+				return false;
+			}
+			if (options.verifyIdToken) {
+				return options.verifyIdToken(token, nonce);
+			}
+
+			const jwtClaims = await verifyGoogleIdToken({
+				token,
+				audience: options.clientId,
+				nonce,
+			});
+			if (!jwtClaims) {
+				return false;
+			}
+
+			return isGoogleHostedDomainAllowed(options.hd, jwtClaims.hd);
+		},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			if (!token.idToken) {
+				return null;
+			}
+			const user = decodeJwt(token.idToken) as GoogleProfile;
+			// Enforce the configured hosted domain on the callback profile path.
+			// The authorization-time `hd` value is only a UI hint; the verified
+			// token/profile claim is the authoritative Workspace signal.
+			if (!isGoogleHostedDomainAllowed(options.hd, user.hd)) {
+				logger.error(
+					`Google sign-in rejected: id token hosted domain (hd) "${
+						user.hd ?? "<missing>"
+					}" does not satisfy the configured "hd" option "${options.hd}".`,
+				);
+				return null;
+			}
+			const userMap = await options.mapProfileToUser?.(user);
+			return {
+				user: {
+					id: user.sub,
+					name: user.name,
+					email: user.email,
+					image: user.picture,
+					emailVerified: user.email_verified,
+					...userMap,
+				},
+				data: user,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<GoogleProfile>;
+};
+
+export const getGooglePublicKey = async (kid: string) => {
+	const { data } = await betterFetch<{
+		keys: Array<{
+			kid: string;
+			alg: string;
+			kty: string;
+			use: string;
+			n: string;
+			e: string;
+		}>;
+	}>("https://www.googleapis.com/oauth2/v3/certs");
+
+	if (!data?.keys) {
+		throw new APIError("BAD_REQUEST", {
+			message: "Keys not found",
+		});
+	}
+
+	const jwk = data.keys.find((key) => key.kid === kid);
+	if (!jwk) {
+		throw new Error(`JWK with kid ${kid} not found`);
+	}
+
+	return await importJWK(jwk, jwk.alg);
+};

package/src/social-providers/huggingface.ts

@@ -0,0 +1,119 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface HuggingFaceProfile {
+	sub: string;
+	name: string;
+	preferred_username: string;
+	profile: string;
+	picture: string;
+	website?: string | undefined;
+	email?: string | undefined;
+	email_verified?: boolean | undefined;
+	isPro: boolean;
+	canPay?: boolean | undefined;
+	orgs?:
+		| {
+				sub: string;
+				name: string;
+				picture: string;
+				preferred_username: string;
+				isEnterprise: boolean | "plus";
+				canPay?: boolean;
+				roleInOrg?: "admin" | "write" | "contributor" | "read";
+				pendingSSO?: boolean;
+				missingMFA?: boolean;
+				resourceGroups?: {
+					sub: string;
+					name: string;
+					role: "admin" | "write" | "contributor" | "read";
+				}[];
+		  }
+		| undefined;
+}
+
+export interface HuggingFaceOptions
+	extends ProviderOptions<HuggingFaceProfile> {
+	clientId: string;
+}
+
+export const huggingface = (options: HuggingFaceOptions) => {
+	const tokenEndpoint = "https://huggingface.co/oauth/token";
+	return {
+		id: "huggingface",
+		name: "Hugging Face",
+		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			const _scopes = options.disableDefaultScope
+				? []
+				: ["openid", "profile", "email"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			return createAuthorizationURL({
+				id: "huggingface",
+				options,
+				authorizationEndpoint: "https://huggingface.co/oauth/authorize",
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint,
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<HuggingFaceProfile>(
+				"https://huggingface.co/oauth/userinfo",
+				{
+					method: "GET",
+					headers: {
+						Authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+			if (error) {
+				return null;
+			}
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.sub,
+					name: profile.name || profile.preferred_username || "",
+					email: profile.email,
+					image: profile.picture,
+					emailVerified: profile.email_verified ?? false,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<HuggingFaceProfile>;
+};