@depup/better-auth__core 1.6.23-depup.2

package/src/types/plugin-client.ts

@@ -0,0 +1,143 @@
+import type {
+	BetterFetch,
+	BetterFetchOption,
+	BetterFetchPlugin,
+} from "@better-fetch/fetch";
+import type { Atom, WritableAtom } from "nanostores";
+import type { LiteralString } from "./helper";
+import type { BetterAuthOptions } from "./init-options";
+
+type InferableServerPlugin = {
+	id?: LiteralString | undefined;
+	endpoints?: Record<string, unknown> | undefined;
+	schema?: Record<string, { fields: Record<string, unknown> }> | undefined;
+	$ERROR_CODES?:
+		| Record<
+				string,
+				{
+					readonly code: string;
+					message: string;
+				}
+		  >
+		| undefined;
+};
+
+export interface ClientStore {
+	notify: (signal: string) => void;
+	listen: (signal: string, listener: () => void) => void;
+	atoms: Record<string, WritableAtom<any>>;
+}
+
+export type ClientAtomListener = {
+	matcher: (path: string) => boolean;
+	signal: "$sessionSignal" | Omit<string, "$sessionSignal">;
+	callback?: (path: string) => void;
+};
+
+/**
+ * Better-Fetch options but with additional options for the auth-client.
+ */
+export type ClientFetchOption<
+	Body = any,
+	Query extends Record<string, any> = any,
+	Params extends Record<string, any> | Array<string> | undefined = any,
+	Res = any,
+> = BetterFetchOption<Body, Query, Params, Res> & {
+	/**
+	 * Certain endpoints, upon successful response, will trigger atom signals and thus rerendering all hooks related to that atom.
+	 *
+	 * This option is useful when you want to skip hook rerenders.
+	 */
+	disableSignal?: boolean | undefined;
+};
+
+export interface RevalidateOptions {
+	/**
+	 * A time interval (in seconds) after which the session will be re-fetched.
+	 * If set to `0` (default), the session is not polled.
+	 *
+	 * This helps prevent session expiry during idle periods by periodically
+	 * refreshing the session.
+	 *
+	 * @default 0
+	 */
+	refetchInterval?: number | undefined;
+	/**
+	 * Automatically refetch the session when the user switches back to the window/tab.
+	 * This option activates this behavior if set to `true` (default).
+	 *
+	 * Prevents expired sessions when users switch tabs and come back later.
+	 *
+	 * @default true
+	 */
+	refetchOnWindowFocus?: boolean | undefined;
+	/**
+	 * Set to `false` to stop polling when the device has no internet access
+	 * (determined by `navigator.onLine`).
+	 *
+	 * @default false
+	 * @see https://developer.mozilla.org/en-US/docs/Web/API/NavigatorOnLine/onLine
+	 */
+	refetchWhenOffline?: boolean | undefined;
+}
+
+export interface BetterAuthClientOptions {
+	fetchOptions?: ClientFetchOption | undefined;
+	plugins?: BetterAuthClientPlugin[] | undefined;
+	baseURL?: string | undefined;
+	basePath?: string | undefined;
+	disableDefaultFetchPlugins?: boolean | undefined;
+	$InferAuth?: BetterAuthOptions | undefined;
+	sessionOptions?: RevalidateOptions | undefined;
+}
+
+export interface BetterAuthClientPlugin {
+	id: LiteralString;
+	version?: string | undefined;
+	/**
+	 * only used for type inference. don't pass the
+	 * actual plugin
+	 */
+	$InferServerPlugin?: InferableServerPlugin | undefined;
+	/**
+	 * Custom actions
+	 */
+	getActions?: (
+		$fetch: BetterFetch,
+		$store: ClientStore,
+		/**
+		 * better-auth client options
+		 */
+		options: BetterAuthClientOptions | undefined,
+	) => Record<string, any>;
+	/**
+	 * State atoms that'll be resolved by each framework
+	 * auth store.
+	 */
+	getAtoms?: (($fetch: BetterFetch) => Record<string, Atom<any>>) | undefined;
+	/**
+	 * specify path methods for server plugin inferred
+	 * endpoints to force a specific method.
+	 */
+	pathMethods?: Record<string, "POST" | "GET"> | undefined;
+	/**
+	 * Better fetch plugins
+	 */
+	fetchPlugins?: BetterFetchPlugin[] | undefined;
+	/**
+	 * a list of recaller based on a matcher function.
+	 * The signal name needs to match a signal in this
+	 * plugin or any plugin the user might have added.
+	 */
+	atomListeners?: ClientAtomListener[] | undefined;
+	/**
+	 * The error codes returned by the plugin
+	 */
+	$ERROR_CODES?: Record<
+		string,
+		{
+			code: string;
+			message: string;
+		}
+	>;
+}

package/src/types/plugin.ts

@@ -0,0 +1,163 @@
+import type {
+	Endpoint,
+	EndpointContext,
+	InputContext,
+	Middleware,
+} from "better-call";
+import type { Migration } from "kysely";
+import type { AuthMiddleware } from "../api";
+import type { BetterAuthPluginDBSchema } from "../db";
+import type { RawError } from "../utils/error-codes";
+import type { AuthContext } from "./context";
+import type { Awaitable, LiteralString } from "./helper";
+import type { BetterAuthOptions } from "./init-options";
+
+type DeepPartial<T> = T extends Function
+	? T
+	: T extends object
+		? { [K in keyof T]?: DeepPartial<T[K]> }
+		: T;
+
+export type HookEndpointContext = Partial<
+	EndpointContext<string, any> & Omit<InputContext<string, any>, "method">
+> & {
+	path?: string;
+	context: AuthContext & {
+		returned?: unknown | undefined;
+		responseHeaders?: Headers | undefined;
+	};
+	headers?: Headers | undefined;
+};
+
+export type BetterAuthPluginErrorCodePart = {
+	/**
+	 * The error codes returned by the plugin
+	 */
+	$ERROR_CODES?: Record<string, RawError>;
+};
+
+export type BetterAuthPlugin = BetterAuthPluginErrorCodePart & {
+	id: LiteralString;
+	version?: string | undefined;
+	/**
+	 * The init function is called when the plugin is initialized.
+	 * You can return a new context or modify the existing context.
+	 */
+	init?:
+		| ((ctx: AuthContext) =>
+				| Awaitable<{
+						context?: DeepPartial<Omit<AuthContext, "options">> &
+							Record<string, unknown>;
+						options?: Partial<BetterAuthOptions>;
+				  }>
+				| void
+				| Promise<void>)
+		| undefined;
+	endpoints?:
+		| {
+				[key: string]: Endpoint;
+		  }
+		| undefined;
+	middlewares?:
+		| {
+				path: string;
+				middleware: Middleware;
+		  }[]
+		| undefined;
+	onRequest?:
+		| ((
+				request: Request,
+				ctx: AuthContext,
+		  ) => Promise<
+				| {
+						response: Response;
+				  }
+				| {
+						request: Request;
+				  }
+				| void
+		  >)
+		| undefined;
+	onResponse?:
+		| ((
+				response: Response,
+				ctx: AuthContext,
+		  ) => Promise<{
+				response: Response;
+		  } | void>)
+		| undefined;
+	hooks?:
+		| {
+				before?: {
+					matcher: (context: HookEndpointContext) => boolean;
+					handler: AuthMiddleware;
+				}[];
+				after?: {
+					matcher: (context: HookEndpointContext) => boolean;
+					handler: AuthMiddleware;
+				}[];
+		  }
+		| undefined;
+	/**
+	 * Schema the plugin needs
+	 *
+	 * This will also be used to migrate the database. If the fields are dynamic from the plugins
+	 * configuration each time the configuration is changed a new migration will be created.
+	 *
+	 * NOTE: If you want to create migrations manually using
+	 * migrations option or any other way you
+	 * can disable migration per table basis.
+	 *
+	 * @example
+	 * ```ts
+	 * schema: {
+	 * 	user: {
+	 * 		fields: {
+	 * 			email: {
+	 * 				 type: "string",
+	 * 			},
+	 * 			emailVerified: {
+	 * 				type: "boolean",
+	 * 				defaultValue: false,
+	 * 			},
+	 * 		},
+	 * 	}
+	 * } as AuthPluginSchema
+	 * ```
+	 */
+	schema?: BetterAuthPluginDBSchema | undefined;
+	/**
+	 * The migrations of the plugin. If you define schema that will automatically create
+	 * migrations for you.
+	 *
+	 * ⚠️ Only uses this if you dont't want to use the schema option and you disabled migrations for
+	 * the tables.
+	 */
+	migrations?: Record<string, Migration> | undefined;
+	/**
+	 * The options of the plugin
+	 */
+	options?: Record<string, any> | undefined;
+	/**
+	 * types to be inferred
+	 */
+	$Infer?: Record<string, any> | undefined;
+	/**
+	 * The rate limit rules to apply to specific paths.
+	 */
+	rateLimit?:
+		| {
+				window: number;
+				max: number;
+				pathMatcher: (path: string) => boolean;
+		  }[]
+		| undefined;
+	/**
+	 * All database operations that are performed by the plugin
+	 *
+	 * This will override the default database operations
+	 */
+	adapter?: {
+		[key: string]: (...args: any[]) => Awaitable<any>;
+	};
+};

package/src/types/secret.ts

@@ -0,0 +1,8 @@
+export interface SecretConfig {
+	/** Map of version number → secret value */
+	keys: Map<number, string>;
+	/** Version to use for new encryption (first entry in secrets array) */
+	currentVersion: number;
+	/** Legacy secret for bare-hex fallback (from BETTER_AUTH_SECRET) */
+	legacySecret?: string;
+}

package/src/utils/async.ts

@@ -0,0 +1,53 @@
+import type { Awaitable } from "../types/helper";
+
+export interface MapConcurrentOptions {
+	/**
+	 * Max in-flight mappers. Non-integer values are floored, then clamped
+	 * to the range `[1, items.length]`. `NaN` falls back to 1.
+	 */
+	concurrency: number;
+	/**
+	 * Rejects with `signal.reason` when aborted. In-flight mappers keep
+	 * running but their results are not returned.
+	 */
+	signal?: AbortSignal;
+}
+
+/**
+ * Run an async mapper over items with bounded concurrency.
+ * Preserves input order in the result. Fails fast on the first rejection.
+ */
+export async function mapConcurrent<T, R>(
+	items: readonly T[],
+	fn: (item: T, index: number) => Awaitable<R>,
+	options: MapConcurrentOptions,
+): Promise<R[]> {
+	const n = items.length;
+	if (n === 0) return [];
+
+	const { signal } = options;
+	if (signal?.aborted) throw signal.reason;
+
+	const raw = Math.floor(options.concurrency);
+	const width = Math.min(n, raw >= 1 ? raw : 1);
+
+	const results = new Array<R>(n);
+	let idx = 0;
+	let failed = false;
+
+	const worker = async (): Promise<void> => {
+		while (!failed && idx < n) {
+			if (signal?.aborted) throw signal.reason;
+			const i = idx++;
+			try {
+				results[i] = await fn(items[i] as T, i);
+			} catch (error) {
+				failed = true;
+				throw error;
+			}
+		}
+	};
+
+	await Promise.all(Array.from({ length: width }, worker));
+	return results;
+}

package/src/utils/db.ts

@@ -0,0 +1,20 @@
+import type { DBFieldAttribute } from "../db";
+
+/**
+ * Filters output data by removing fields with the `returned: false` attribute.
+ * This ensures sensitive fields are not exposed in API responses.
+ */
+export function filterOutputFields<T extends Record<string, unknown> | null>(
+	data: T,
+	additionalFields: Record<string, DBFieldAttribute> | undefined,
+): T {
+	if (!data || !additionalFields) {
+		return data;
+	}
+	const returnFiltered = Object.entries(additionalFields)
+		.filter(([, { returned }]) => returned === false)
+		.map(([key]) => key);
+	return Object.entries(structuredClone(data))
+		.filter(([key]) => !returnFiltered.includes(key))
+		.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {} as T);
+}

package/src/utils/deprecate.ts

@@ -0,0 +1,21 @@
+import type { InternalLogger } from "../env";
+
+/**
+ * Wraps a function to log a deprecation warning at once.
+ */
+export function deprecate<T extends (...args: any[]) => any>(
+	fn: T,
+	message: string,
+	logger?: InternalLogger,
+): T {
+	let warned = false;
+
+	return function (this: any, ...args: Parameters<T>): ReturnType<T> {
+		if (!warned) {
+			const warn = logger?.warn ?? console.warn;
+			warn(`[Deprecation] ${message}`);
+			warned = true;
+		}
+		return fn.apply(this, args);
+	} as T;
+}

package/src/utils/error-codes.ts

@@ -0,0 +1,68 @@
+type UpperLetter =
+	| "A"
+	| "B"
+	| "C"
+	| "D"
+	| "E"
+	| "F"
+	| "G"
+	| "H"
+	| "I"
+	| "J"
+	| "K"
+	| "L"
+	| "M"
+	| "N"
+	| "O"
+	| "P"
+	| "Q"
+	| "R"
+	| "S"
+	| "T"
+	| "U"
+	| "V"
+	| "W"
+	| "X"
+	| "Y"
+	| "Z";
+type SpecialCharacter = "_";
+
+type IsValidUpperSnakeCase<S extends string> = S extends `${infer F}${infer R}`
+	? F extends UpperLetter | SpecialCharacter
+		? IsValidUpperSnakeCase<R>
+		: false
+	: true;
+
+type InvalidKeyError<K extends string> =
+	`Invalid error code key: "${K}" - must only contain uppercase letters (A-Z) and underscores (_)`;
+
+type ValidateErrorCodes<T> = {
+	[K in keyof T]: K extends string
+		? IsValidUpperSnakeCase<K> extends false
+			? InvalidKeyError<K>
+			: T[K]
+		: T[K];
+};
+
+export type RawError<K extends string = string> = {
+	readonly code: K;
+	message: string;
+};
+
+export function defineErrorCodes<
+	const T extends Record<string, string>,
+	R extends {
+		[K in keyof T & string]: RawError<K>;
+	},
+>(codes: ValidateErrorCodes<T>): R {
+	return Object.fromEntries(
+		Object.entries(codes).map(([key, value]) => [
+			key,
+			{
+				code: key,
+				message: value,
+				toString: () => key,
+			},
+		]),
+	) as any;
+}

package/src/utils/fetch-metadata.ts

@@ -0,0 +1,3 @@
+export function isBrowserFetchRequest(headers?: Headers | null): boolean {
+	return headers?.get("sec-fetch-mode") === "cors";
+}