@depup/better-auth__core 1.6.23-depup.2

package/src/social-providers/notion.ts

@@ -0,0 +1,108 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface NotionProfile {
+	object: "user";
+	id: string;
+	type: "person" | "bot";
+	name?: string | undefined;
+	avatar_url?: string | undefined;
+	person?:
+		| {
+				email?: string;
+		  }
+		| undefined;
+}
+
+export interface NotionOptions extends ProviderOptions<NotionProfile> {
+	clientId: string;
+}
+
+export const notion = (options: NotionOptions) => {
+	const tokenEndpoint = "https://api.notion.com/v1/oauth/token";
+	return {
+		id: "notion",
+		name: "Notion",
+		createAuthorizationURL({ state, scopes, loginHint, redirectURI }) {
+			const _scopes: string[] = options.disableDefaultScope ? [] : [];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			return createAuthorizationURL({
+				id: "notion",
+				options,
+				authorizationEndpoint: "https://api.notion.com/v1/oauth/authorize",
+				scopes: _scopes,
+				state,
+				redirectURI,
+				loginHint,
+				additionalParams: {
+					owner: "user",
+				},
+			});
+		},
+		validateAuthorizationCode: async ({ code, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				redirectURI,
+				options,
+				tokenEndpoint,
+				authentication: "basic",
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<{
+				bot: {
+					owner: {
+						user: NotionProfile;
+					};
+				};
+			}>("https://api.notion.com/v1/users/me", {
+				headers: {
+					Authorization: `Bearer ${token.accessToken}`,
+					"Notion-Version": "2022-06-28",
+				},
+			});
+			if (error || !profile) {
+				return null;
+			}
+			const userProfile = profile.bot?.owner?.user;
+			if (!userProfile) {
+				return null;
+			}
+			const userMap = await options.mapProfileToUser?.(userProfile);
+			return {
+				user: {
+					id: userProfile.id,
+					name: userProfile.name || "",
+					email: userProfile.person?.email || null,
+					image: userProfile.avatar_url,
+					emailVerified: false,
+					...userMap,
+				},
+				data: userProfile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<NotionProfile>;
+};

package/src/social-providers/paybin.ts

@@ -0,0 +1,118 @@
+import { decodeJwt } from "jose";
+import { logger } from "../env";
+import { BetterAuthError } from "../error";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface PaybinProfile {
+	sub: string;
+	email: string;
+	email_verified?: boolean | undefined;
+	name?: string | undefined;
+	preferred_username?: string | undefined;
+	picture?: string | undefined;
+	given_name?: string | undefined;
+	family_name?: string | undefined;
+}
+
+export interface PaybinOptions extends ProviderOptions<PaybinProfile> {
+	clientId: string;
+	/**
+	 * The issuer URL of your Paybin OAuth server
+	 * @default "https://idp.paybin.io"
+	 */
+	issuer?: string | undefined;
+}
+
+export const paybin = (options: PaybinOptions) => {
+	const issuer = options.issuer || "https://idp.paybin.io";
+	const authorizationEndpoint = `${issuer}/oauth2/authorize`;
+	const tokenEndpoint = `${issuer}/oauth2/token`;
+
+	return {
+		id: "paybin",
+		name: "Paybin",
+		async createAuthorizationURL({
+			state,
+			scopes,
+			codeVerifier,
+			redirectURI,
+			loginHint,
+		}) {
+			if (!options.clientId || !options.clientSecret) {
+				logger.error(
+					"Client Id and Client Secret is required for Paybin. Make sure to provide them in the options.",
+				);
+				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+			}
+			if (!codeVerifier) {
+				throw new BetterAuthError("codeVerifier is required for Paybin");
+			}
+			const _scopes = options.disableDefaultScope
+				? []
+				: ["openid", "email", "profile"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			const url = await createAuthorizationURL({
+				id: "paybin",
+				options,
+				authorizationEndpoint,
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+				prompt: options.prompt,
+				loginHint,
+			});
+			return url;
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint,
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			if (!token.idToken) {
+				return null;
+			}
+			const user = decodeJwt(token.idToken) as PaybinProfile;
+			const userMap = await options.mapProfileToUser?.(user);
+			return {
+				user: {
+					id: user.sub,
+					name: user.name || user.preferred_username || "",
+					email: user.email,
+					image: user.picture,
+					emailVerified: user.email_verified || false,
+					...userMap,
+				},
+				data: user,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<PaybinProfile>;
+};

package/src/social-providers/paypal.ts

@@ -0,0 +1,371 @@
+import { base64 } from "@better-auth/utils/base64";
+import { betterFetch } from "@better-fetch/fetch";
+import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+import { logger } from "../env";
+import { APIError, BetterAuthError } from "../error";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import { createAuthorizationURL } from "../oauth2";
+
+/**
+ * ID token signing algorithms advertised by PayPal's OpenID configuration.
+ * Anything outside this allowlist is rejected so each token is only ever
+ * verified with the algorithm it was issued for.
+ *
+ * @see https://www.paypal.com/.well-known/openid-configuration
+ */
+const PAYPAL_ID_TOKEN_ALGORITHMS = ["RS256", "HS256"] as const;
+
+export interface PayPalProfile {
+	sub?: string | undefined;
+	user_id: string;
+	name: string;
+	given_name: string;
+	family_name: string;
+	middle_name?: string | undefined;
+	picture?: string | undefined;
+	email: string;
+	email_verified: boolean;
+	gender?: string | undefined;
+	birthdate?: string | undefined;
+	zoneinfo?: string | undefined;
+	locale?: string | undefined;
+	phone_number?: string | undefined;
+	address?:
+		| {
+				street_address?: string;
+				locality?: string;
+				region?: string;
+				postal_code?: string;
+				country?: string;
+		  }
+		| undefined;
+	verified_account?: boolean | undefined;
+	account_type?: string | undefined;
+	age_range?: string | undefined;
+	payer_id?: string | undefined;
+}
+
+export interface PayPalTokenResponse {
+	scope?: string | undefined;
+	access_token: string;
+	refresh_token?: string | undefined;
+	token_type: "Bearer";
+	id_token?: string | undefined;
+	expires_in: number;
+	nonce?: string | undefined;
+}
+
+export interface PayPalOptions extends ProviderOptions<PayPalProfile> {
+	clientId: string;
+	/**
+	 * PayPal environment - 'sandbox' for testing, 'live' for production
+	 * @default 'sandbox'
+	 */
+	environment?: ("sandbox" | "live") | undefined;
+	/**
+	 * Whether to request shipping address information
+	 * @default false
+	 */
+	requestShippingAddress?: boolean | undefined;
+}
+
+export const paypal = (options: PayPalOptions) => {
+	const environment = options.environment || "sandbox";
+	const isSandbox = environment === "sandbox";
+
+	const authorizationEndpoint = isSandbox
+		? "https://www.sandbox.paypal.com/signin/authorize"
+		: "https://www.paypal.com/signin/authorize";
+
+	const tokenEndpoint = isSandbox
+		? "https://api-m.sandbox.paypal.com/v1/oauth2/token"
+		: "https://api-m.paypal.com/v1/oauth2/token";
+
+	const userInfoEndpoint = isSandbox
+		? "https://api-m.sandbox.paypal.com/v1/identity/oauth2/userinfo"
+		: "https://api-m.paypal.com/v1/identity/oauth2/userinfo";
+
+	/**
+	 * Issuer and JWKS endpoints used to cryptographically verify ID tokens.
+	 *
+	 * @see https://www.paypal.com/.well-known/openid-configuration
+	 */
+	const issuer = isSandbox
+		? "https://www.sandbox.paypal.com"
+		: "https://www.paypal.com";
+
+	const jwksEndpoint = isSandbox
+		? "https://api.sandbox.paypal.com/v1/oauth2/certs"
+		: "https://api.paypal.com/v1/oauth2/certs";
+
+	return {
+		id: "paypal",
+		name: "PayPal",
+		async createAuthorizationURL({ state, codeVerifier, redirectURI }) {
+			if (!options.clientId || !options.clientSecret) {
+				logger.error(
+					"Client Id and Client Secret is required for PayPal. Make sure to provide them in the options.",
+				);
+				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+			}
+
+			/**
+			 * Log in with PayPal doesn't use traditional OAuth2 scopes
+			 * Instead, permissions are configured in the PayPal Developer Dashboard
+			 * We don't pass any scopes to avoid "invalid scope" errors
+			 **/
+
+			const _scopes: string[] = [];
+
+			const url = await createAuthorizationURL({
+				id: "paypal",
+				options,
+				authorizationEndpoint,
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+				prompt: options.prompt,
+			});
+			return url;
+		},
+
+		validateAuthorizationCode: async ({ code, redirectURI }) => {
+			/**
+			 * PayPal requires Basic Auth for token exchange
+			 **/
+
+			const credentials = base64.encode(
+				`${options.clientId}:${options.clientSecret}`,
+			);
+
+			try {
+				const response = await betterFetch(tokenEndpoint, {
+					method: "POST",
+					headers: {
+						Authorization: `Basic ${credentials}`,
+						Accept: "application/json",
+						"Accept-Language": "en_US",
+						"Content-Type": "application/x-www-form-urlencoded",
+					},
+					body: new URLSearchParams({
+						grant_type: "authorization_code",
+						code: code,
+						redirect_uri: redirectURI,
+					}).toString(),
+				});
+
+				if (!response.data) {
+					throw new BetterAuthError("FAILED_TO_GET_ACCESS_TOKEN");
+				}
+
+				const data = response.data as PayPalTokenResponse;
+
+				const result = {
+					accessToken: data.access_token,
+					refreshToken: data.refresh_token,
+					accessTokenExpiresAt: data.expires_in
+						? new Date(Date.now() + data.expires_in * 1000)
+						: undefined,
+					idToken: data.id_token,
+				};
+
+				return result;
+			} catch (error) {
+				logger.error("PayPal token exchange failed:", error);
+				throw new BetterAuthError("FAILED_TO_GET_ACCESS_TOKEN");
+			}
+		},
+
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					const credentials = base64.encode(
+						`${options.clientId}:${options.clientSecret}`,
+					);
+
+					try {
+						const response = await betterFetch(tokenEndpoint, {
+							method: "POST",
+							headers: {
+								Authorization: `Basic ${credentials}`,
+								Accept: "application/json",
+								"Accept-Language": "en_US",
+								"Content-Type": "application/x-www-form-urlencoded",
+							},
+							body: new URLSearchParams({
+								grant_type: "refresh_token",
+								refresh_token: refreshToken,
+							}).toString(),
+						});
+
+						if (!response.data) {
+							throw new BetterAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");
+						}
+
+						const data = response.data as any;
+						return {
+							accessToken: data.access_token,
+							refreshToken: data.refresh_token,
+							accessTokenExpiresAt: data.expires_in
+								? new Date(Date.now() + data.expires_in * 1000)
+								: undefined,
+						};
+					} catch (error) {
+						logger.error("PayPal token refresh failed:", error);
+						throw new BetterAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");
+					}
+				},
+
+		async verifyIdToken(token, nonce) {
+			if (options.disableIdTokenSignIn) {
+				return false;
+			}
+			if (options.verifyIdToken) {
+				return options.verifyIdToken(token, nonce);
+			}
+
+			// Cryptographically verify the ID token. Decoding alone is not enough:
+			// the signature, issuer, audience and expiration must all be checked
+			// before the token's claims can be relied on as proof of identity.
+			// See https://www.paypal.com/.well-known/openid-configuration
+
+			try {
+				const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
+				if (!jwtAlg) return false;
+				if (
+					!PAYPAL_ID_TOKEN_ALGORITHMS.includes(
+						jwtAlg as (typeof PAYPAL_ID_TOKEN_ALGORITHMS)[number],
+					)
+				) {
+					return false;
+				}
+
+				// PayPal can sign ID tokens either asymmetrically (RS256, verified
+				// against the published JWKS) or symmetrically (HS256, verified with
+				// the client secret). Selecting the key by algorithm keeps the two
+				// paths separate so each algorithm is only verified with its
+				// corresponding key type.
+				const key =
+					jwtAlg === "HS256"
+						? new TextEncoder().encode(options.clientSecret)
+						: kid
+							? await getPayPalPublicKey(kid, jwksEndpoint)
+							: undefined;
+				if (!key) return false;
+
+				const { payload: jwtClaims } = await jwtVerify(token, key, {
+					algorithms: [jwtAlg],
+					issuer,
+					audience: options.clientId,
+					maxTokenAge: "1h",
+				});
+
+				if (nonce && jwtClaims.nonce !== nonce) {
+					return false;
+				}
+
+				return true;
+			} catch (error) {
+				logger.error("Failed to verify PayPal ID token:", error);
+				return false;
+			}
+		},
+
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+
+			if (!token.accessToken) {
+				logger.error("Access token is required to fetch PayPal user info");
+				return null;
+			}
+
+			try {
+				const response = await betterFetch<PayPalProfile>(
+					`${userInfoEndpoint}?schema=paypalv1.1`,
+					{
+						headers: {
+							Authorization: `Bearer ${token.accessToken}`,
+							Accept: "application/json",
+						},
+					},
+				);
+
+				if (!response.data) {
+					logger.error("Failed to fetch user info from PayPal");
+					return null;
+				}
+
+				const userInfo = response.data;
+				if (token.idToken) {
+					let idTokenSubject: string | undefined;
+					try {
+						idTokenSubject = decodeJwt(token.idToken).sub;
+					} catch (error) {
+						logger.error("Failed to decode PayPal ID token:", error);
+						return null;
+					}
+
+					// OIDC binds UserInfo to the ID Token with `sub`. Keep `user_id`
+					// as the account id below for existing PayPal account mappings.
+					const userInfoSubject = userInfo.sub ?? userInfo.user_id;
+					if (!idTokenSubject || userInfoSubject !== idTokenSubject) {
+						logger.error(
+							"PayPal user info subject does not match ID token subject",
+						);
+						return null;
+					}
+				}
+
+				const userMap = await options.mapProfileToUser?.(userInfo);
+
+				const result = {
+					user: {
+						id: userInfo.user_id,
+						name: userInfo.name,
+						email: userInfo.email,
+						image: userInfo.picture,
+						emailVerified: userInfo.email_verified,
+						...userMap,
+					},
+					data: userInfo,
+				};
+
+				return result;
+			} catch (error) {
+				logger.error("Failed to fetch user info from PayPal:", error);
+				return null;
+			}
+		},
+
+		options,
+	} satisfies OAuthProvider<PayPalProfile>;
+};
+
+export const getPayPalPublicKey = async (kid: string, jwksUri: string) => {
+	const { data } = await betterFetch<{
+		keys: Array<{
+			kid: string;
+			alg: string;
+			kty: string;
+			use: string;
+			n: string;
+			e: string;
+		}>;
+	}>(jwksUri);
+
+	if (!data?.keys) {
+		throw new APIError("BAD_REQUEST", {
+			message: "Keys not found",
+		});
+	}
+
+	const jwk = data.keys.find((key) => key.kid === kid);
+	if (!jwk) {
+		throw new Error(`JWK with kid ${kid} not found`);
+	}
+
+	return await importJWK(jwk, jwk.alg);
+};

package/src/social-providers/polar.ts

@@ -0,0 +1,111 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface PolarProfile {
+	id: string;
+	email: string;
+	username: string;
+	avatar_url: string;
+	github_username?: string | undefined;
+	account_id?: string | undefined;
+	public_name?: string | undefined;
+	email_verified?: boolean | undefined;
+	profile_settings?:
+		| {
+				profile_settings_enabled?: boolean;
+				profile_settings_public_name?: string;
+				profile_settings_public_avatar?: string;
+				profile_settings_public_bio?: string;
+				profile_settings_public_location?: string;
+				profile_settings_public_website?: string;
+				profile_settings_public_twitter?: string;
+				profile_settings_public_github?: string;
+				profile_settings_public_email?: string;
+		  }
+		| undefined;
+}
+
+export interface PolarOptions extends ProviderOptions<PolarProfile> {}
+
+export const polar = (options: PolarOptions) => {
+	const tokenEndpoint = "https://api.polar.sh/v1/oauth2/token";
+	return {
+		id: "polar",
+		name: "Polar",
+		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			const _scopes = options.disableDefaultScope
+				? []
+				: ["openid", "profile", "email"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			return createAuthorizationURL({
+				id: "polar",
+				options,
+				authorizationEndpoint: "https://polar.sh/oauth2/authorize",
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+				prompt: options.prompt,
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint,
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<PolarProfile>(
+				"https://api.polar.sh/v1/oauth2/userinfo",
+				{
+					headers: {
+						Authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+			if (error) {
+				return null;
+			}
+			const userMap = await options.mapProfileToUser?.(profile);
+			// Polar may provide email_verified claim, but it's not guaranteed.
+			// We check for it first, then default to false for security consistency.
+			return {
+				user: {
+					id: profile.id,
+					name: profile.public_name || profile.username || "",
+					email: profile.email,
+					image: profile.avatar_url,
+					emailVerified: profile.email_verified ?? false,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<PolarProfile>;
+};