@depup/better-auth__core 1.6.23-depup.2

package/src/social-providers/vk.ts

@@ -0,0 +1,125 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface VkProfile {
+	user: {
+		user_id: string;
+		first_name: string;
+		last_name: string;
+		email?: string | undefined;
+		phone?: number | undefined;
+		avatar?: string | undefined;
+		sex?: number | undefined;
+		verified?: boolean | undefined;
+		birthday: string;
+	};
+}
+
+export interface VkOption extends ProviderOptions {
+	clientId: string;
+	scheme?: ("light" | "dark") | undefined;
+}
+
+export const vk = (options: VkOption) => {
+	const tokenEndpoint = "https://id.vk.com/oauth2/auth";
+	return {
+		id: "vk",
+		name: "VK",
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["email", "phone"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			const authorizationEndpoint = "https://id.vk.com/authorize";
+
+			return createAuthorizationURL({
+				id: "vk",
+				options,
+				authorizationEndpoint,
+				scopes: _scopes,
+				state,
+				redirectURI,
+				codeVerifier,
+			});
+		},
+		validateAuthorizationCode: async ({
+			code,
+			codeVerifier,
+			redirectURI,
+			deviceId,
+		}) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI: options.redirectURI || redirectURI,
+				options,
+				deviceId,
+				tokenEndpoint,
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(data) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(data);
+			}
+			if (!data.accessToken) {
+				return null;
+			}
+			const formBody = new URLSearchParams({
+				access_token: data.accessToken,
+				client_id: options.clientId,
+			}).toString();
+			const { data: profile, error } = await betterFetch<VkProfile>(
+				"https://id.vk.com/oauth2/user_info",
+				{
+					method: "POST",
+					headers: {
+						"Content-Type": "application/x-www-form-urlencoded",
+					},
+					body: formBody,
+				},
+			);
+			if (error) {
+				return null;
+			}
+
+			const userMap = await options.mapProfileToUser?.(profile);
+			if (!profile.user.email && !userMap?.email) {
+				return null;
+			}
+
+			return {
+				user: {
+					id: profile.user.user_id,
+					first_name: profile.user.first_name,
+					last_name: profile.user.last_name,
+					email: profile.user.email,
+					image: profile.user.avatar,
+					emailVerified: false,
+					birthday: profile.user.birthday,
+					sex: profile.user.sex,
+					name: `${profile.user.first_name} ${profile.user.last_name}`,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<VkProfile>;
+};

package/src/social-providers/wechat.ts

@@ -0,0 +1,220 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuth2Tokens, OAuthProvider, ProviderOptions } from "../oauth2";
+
+/**
+ * WeChat user profile information
+ * @see https://developers.weixin.qq.com/doc/oplatform/en/Website_App/WeChat_Login/Wechat_Login.html
+ */
+export interface WeChatProfile extends Record<string, any> {
+	/**
+	 * User's unique OpenID
+	 */
+	openid: string;
+	/**
+	 * User's nickname
+	 */
+	nickname: string;
+	/**
+	 * User's avatar image URL
+	 */
+	headimgurl: string;
+	/**
+	 * User's privileges
+	 */
+	privilege: string[];
+	/**
+	 * User's UnionID (unique across the developer's various applications)
+	 */
+	unionid?: string;
+	/** @note Email is currently unsupported by WeChat */
+	email?: string;
+}
+
+export interface WeChatOptions extends ProviderOptions<WeChatProfile> {
+	/**
+	 * WeChat App ID
+	 */
+	clientId: string;
+	/**
+	 * WeChat App Secret
+	 */
+	clientSecret: string;
+	/**
+	 * Platform type for WeChat login
+	 * - Currently only supports "WebsiteApp" for WeChat Website Application (网站应用)
+	 * @default "WebsiteApp"
+	 */
+	platformType?: "WebsiteApp";
+
+	/**
+	 * UI language for the WeChat login page
+	 * cn for Simplified Chinese, en for English
+	 * @default "cn" if left undefined
+	 */
+	lang?: "cn" | "en";
+}
+
+export const wechat = (options: WeChatOptions) => {
+	return {
+		id: "wechat",
+		name: "WeChat",
+		createAuthorizationURL({ state, scopes, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["snsapi_login"];
+			options.scope && _scopes.push(...options.scope);
+			scopes && _scopes.push(...scopes);
+
+			// WeChat uses non-standard OAuth2 parameters (appid instead of client_id)
+			// and requires a fragment (#wechat_redirect), so we construct the URL manually.
+			const url = new URL("https://open.weixin.qq.com/connect/qrconnect");
+			url.searchParams.set("scope", _scopes.join(","));
+			url.searchParams.set("response_type", "code");
+			url.searchParams.set("appid", options.clientId);
+			url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+			url.searchParams.set("state", state);
+			url.searchParams.set("lang", options.lang || "cn");
+			url.hash = "wechat_redirect";
+
+			return url;
+		},
+
+		// WeChat uses non-standard token exchange (appid/secret instead of
+		// client_id/client_secret, GET instead of POST), so shared helpers
+		// like validateAuthorizationCode/getOAuth2Tokens cannot be used directly.
+		validateAuthorizationCode: async ({ code }) => {
+			const params = new URLSearchParams({
+				appid: options.clientId,
+				secret: options.clientSecret,
+				code: code,
+				grant_type: "authorization_code",
+			});
+
+			const { data: tokenData, error } = await betterFetch<{
+				access_token: string;
+				expires_in: number;
+				refresh_token: string;
+				openid: string;
+				scope: string;
+				unionid?: string;
+				errcode?: number;
+				errmsg?: string;
+			}>(
+				"https://api.weixin.qq.com/sns/oauth2/access_token?" +
+					params.toString(),
+				{
+					method: "GET",
+				},
+			);
+
+			if (error || !tokenData || tokenData.errcode) {
+				throw new Error(
+					`Failed to validate authorization code: ${tokenData?.errmsg || error?.message || "Unknown error"}`,
+				);
+			}
+
+			return {
+				tokenType: "Bearer" as const,
+				accessToken: tokenData.access_token,
+				refreshToken: tokenData.refresh_token,
+				accessTokenExpiresAt: new Date(
+					Date.now() + tokenData.expires_in * 1000,
+				),
+				scopes: tokenData.scope.split(","),
+				// WeChat requires openid for the userinfo endpoint, which is
+				// returned alongside the access token.
+				openid: tokenData.openid,
+				unionid: tokenData.unionid,
+			};
+		},
+
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					const params = new URLSearchParams({
+						appid: options.clientId,
+						grant_type: "refresh_token",
+						refresh_token: refreshToken,
+					});
+
+					const { data: tokenData, error } = await betterFetch<{
+						access_token: string;
+						expires_in: number;
+						refresh_token: string;
+						openid: string;
+						scope: string;
+						errcode?: number;
+						errmsg?: string;
+					}>(
+						"https://api.weixin.qq.com/sns/oauth2/refresh_token?" +
+							params.toString(),
+						{
+							method: "GET",
+						},
+					);
+
+					if (error || !tokenData || tokenData.errcode) {
+						throw new Error(
+							`Failed to refresh access token: ${tokenData?.errmsg || error?.message || "Unknown error"}`,
+						);
+					}
+
+					return {
+						tokenType: "Bearer" as const,
+						accessToken: tokenData.access_token,
+						refreshToken: tokenData.refresh_token,
+						accessTokenExpiresAt: new Date(
+							Date.now() + tokenData.expires_in * 1000,
+						),
+						scopes: tokenData.scope.split(","),
+					};
+				},
+
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+
+			const openid = (token as OAuth2Tokens & { openid?: string }).openid;
+
+			if (!openid) {
+				return null;
+			}
+
+			const params = new URLSearchParams({
+				access_token: token.accessToken || "",
+				openid: openid,
+				lang: "zh_CN",
+			});
+
+			const { data: profile, error } = await betterFetch<
+				WeChatProfile & { errcode?: number; errmsg?: string }
+			>("https://api.weixin.qq.com/sns/userinfo?" + params.toString(), {
+				method: "GET",
+			});
+
+			if (error || !profile || profile.errcode) {
+				return null;
+			}
+
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.unionid || profile.openid || openid,
+					name: profile.nickname,
+					// WeChat does not return an email, and the OAuth callback rejects a
+					// missing one, so the default sign-in would always fail. Synthesize a
+					// stable, non-routable placeholder (RFC 2606 `.invalid`) keyed to the
+					// user's WeChat id, left unverified. Applications that collect a real
+					// email override it via `mapProfileToUser`.
+					email:
+						profile.email ||
+						`${profile.unionid || profile.openid || openid}@wechat.invalid`,
+					image: profile.headimgurl,
+					emailVerified: false,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<WeChatProfile, WeChatOptions>;
+};

package/src/social-providers/zoom.ts

@@ -0,0 +1,230 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	generateCodeChallenge,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export type LoginType =
+	| 0 /** Facebook OAuth */
+	| 1 /** Google OAuth */
+	| 24 /** Apple OAuth */
+	| 27 /** Microsoft OAuth */
+	| 97 /** Mobile device */
+	| 98 /** RingCentral OAuth */
+	| 99 /** API user */
+	| 100 /** Zoom Work email */
+	| 101; /** Single Sign-On (SSO) */
+
+export type AccountStatus = "pending" | "active" | "inactive";
+
+export type PronounOption =
+	| 1 /** Ask the user every time */
+	| 2 /** Always display */
+	| 3; /** Do not display */
+
+export interface PhoneNumber {
+	/** The country code of the phone number (Example: "+1") */
+	code: string;
+
+	/** The country of the phone number (Example: "US") */
+	country: string;
+
+	/** The label for the phone number (Example: "Mobile") */
+	label: string;
+
+	/** The phone number itself (Example: "800000000") */
+	number: string;
+
+	/** Whether the phone number has been verified (Example: true) */
+	verified: boolean;
+}
+
+/**
+ * See the full documentation below:
+ * https://developers.zoom.us/docs/api/users/#tag/users/GET/users/{userId}
+ */
+export interface ZoomProfile extends Record<string, any> {
+	/* cspell:disable-next-line */
+	/** The user's account ID (Example: "q6gBJVO5TzexKYTb_I2rpg") */
+	account_id: string;
+	/** The user's account number (Example: 10009239) */
+	account_number: number;
+	/** The user's cluster (Example: "us04") */
+	cluster: string;
+	/** The user's CMS ID. Only enabled for Kaltura integration (Example: "KDcuGIm1QgePTO8WbOqwIQ") */
+	cms_user_id: string;
+	/** The user's cost center (Example: "cost center") */
+	cost_center: string;
+	/** User create time (Example: "2018-10-31T04:32:37Z") */
+	created_at: string;
+	/** Department (Example: "Developers") */
+	dept: string;
+	/** User's display name (Example: "Jill Chill") */
+	display_name: string;
+	/** User's email address (Example: "jchill@example.com") */
+	email: string;
+	/** User's first name (Example: "Jill") */
+	first_name: string;
+	/* cspell:disable-next-line */
+	/** IDs of the web groups that the user belongs to (Example: ["RSMaSp8sTEGK0_oamiA2_w"]) */
+	group_ids: string[];
+	/* cspell:disable-next-line */
+	/** User ID (Example: "zJKyaiAyTNC-MWjiWC18KQ") */
+	id: string;
+	/* cspell:disable-next-line */
+	/** IM IDs of the groups that the user belongs to (Example: ["t-_-d56CSWG-7BF15LLrOw"]) */
+	im_group_ids: string[];
+	/** The user's JID (Example: "jchill@example.com") */
+	jid: string;
+	/** The user's job title (Example: "API Developer") */
+	job_title: string;
+	/** Default language for the Zoom Web Portal (Example: "en-US") */
+	language: string;
+	/** User last login client version (Example: "5.9.6.4993(mac)") */
+	last_client_version: string;
+	/** User last login time (Example: "2021-05-05T20:40:30Z") */
+	last_login_time: string;
+	/** User's last name (Example: "Chill") */
+	last_name: string;
+	/** The time zone of the user (Example: "Asia/Shanghai") */
+	timezone: string;
+	/** User's location (Example: "Paris") */
+	location: string;
+	/** The user's login method (Example: 101) */
+	login_types: LoginType[];
+	/** User's personal meeting URL (Example: "example.com") */
+	personal_meeting_url: string;
+	/** The URL for user's profile picture (Example: "example.com") */
+	pic_url: string;
+	/** Personal Meeting ID (PMI) (Example: 3542471135) */
+	pmi: number;
+	/** Unique identifier of the user's assigned role (Example: "0") */
+	role_id: string;
+	/** User's role name (Example: "Admin") */
+	role_name: string;
+	/** Status of user's account (Example: "pending") */
+	status: AccountStatus;
+	/** Use the personal meeting ID (PMI) for instant meetings (Example: false) */
+	use_pmi: boolean;
+	/** The time and date when the user was created (Example: "2018-10-31T04:32:37Z") */
+	user_created_at: string;
+	/** Displays whether user is verified or not (Example: 1) */
+	verified: number;
+	/** The user's Zoom Workplace plan option (Example: 64) */
+	zoom_one_type: number;
+	/** The user's company (Example: "Jill") */
+	company?: string | undefined;
+	/* cspell:disable-next-line */
+	/** Custom attributes that have been assigned to the user (Example: [{ "key": "cbf_cywdkexrtqc73f97gd4w6g", "name": "A1", "value": "1" }]) */
+	custom_attributes?:
+		| { key: string; name: string; value: string }[]
+		| undefined;
+	/* cspell:disable-next-line */
+	/** The employee's unique ID. This field only returns when SAML single sign-on (SSO) is enabled. The `login_type` value is `101` (SSO) (Example: "HqDyI037Qjili1kNsSIrIg") */
+	employee_unique_id?: string | undefined;
+	/** The manager for the user (Example: "thill@example.com") */
+	manager?: string | undefined;
+	/** The phone number's ISO country code (Example: "+1") */
+	phone_numbers?: PhoneNumber[] | undefined;
+	/** The user's plan type (Example: "1") */
+	plan_united_type?: string | undefined;
+	/** The user's pronouns (Example: "3123") */
+	pronouns?: string | undefined;
+	/** The user's display pronouns setting (Example: 1) */
+	pronouns_option?: PronounOption | undefined;
+	/** Personal meeting room URL, if the user has one (Example: "example.com") */
+	vanity_url?: string | undefined;
+}
+
+export interface ZoomOptions extends ProviderOptions<ZoomProfile> {
+	clientId: string;
+	pkce?: boolean | undefined;
+}
+
+export const zoom = (userOptions: ZoomOptions) => {
+	const options = {
+		pkce: true,
+		...userOptions,
+	};
+
+	return {
+		id: "zoom",
+		name: "Zoom",
+		createAuthorizationURL: async ({ state, redirectURI, codeVerifier }) => {
+			const params = new URLSearchParams({
+				response_type: "code",
+				redirect_uri: options.redirectURI ? options.redirectURI : redirectURI,
+				client_id: options.clientId,
+				state,
+			});
+
+			if (options.pkce) {
+				const codeChallenge = await generateCodeChallenge(codeVerifier);
+				params.set("code_challenge_method", "S256");
+				params.set("code_challenge", codeChallenge);
+			}
+
+			const url = new URL("https://zoom.us/oauth/authorize");
+			url.search = params.toString();
+
+			return url;
+		},
+		validateAuthorizationCode: async ({ code, redirectURI, codeVerifier }) => {
+			return validateAuthorizationCode({
+				code,
+				redirectURI: options.redirectURI || redirectURI,
+				codeVerifier,
+				options,
+				tokenEndpoint: "https://zoom.us/oauth/token",
+				authentication: "post",
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) =>
+					refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint: "https://zoom.us/oauth/token",
+					}),
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<ZoomProfile>(
+				"https://api.zoom.us/v2/users/me",
+				{
+					headers: {
+						authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+
+			if (error) {
+				return null;
+			}
+
+			const userMap = await options.mapProfileToUser?.(profile);
+
+			return {
+				user: {
+					id: profile.id,
+					name: profile.display_name,
+					image: profile.pic_url,
+					email: profile.email,
+					emailVerified: Boolean(profile.verified),
+					...userMap,
+				},
+				data: {
+					...profile,
+				},
+			};
+		},
+	} satisfies OAuthProvider<ZoomProfile>;
+};