@hammadj/better-auth 1.5.0-beta.10

package/dist/plugins/generic-oauth/providers/hubspot.mjs

@@ -0,0 +1,60 @@
+import { betterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/generic-oauth/providers/hubspot.ts
+/**
+* HubSpot OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, hubspot } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         hubspot({
+*           clientId: process.env.HUBSPOT_CLIENT_ID,
+*           clientSecret: process.env.HUBSPOT_CLIENT_SECRET,
+*           scopes: ["oauth", "contacts"],
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function hubspot(options) {
+	const defaultScopes = ["oauth"];
+	const getUserInfo = async (tokens) => {
+		const { data: profile, error } = await betterFetch(`https://api.hubapi.com/oauth/v1/access-tokens/${tokens.accessToken}`, { headers: { "Content-Type": "application/json" } });
+		if (error || !profile) return null;
+		const id = profile.user_id ?? profile.signed_access_token?.userId;
+		if (!id) return null;
+		return {
+			id,
+			name: profile.user,
+			email: profile.user,
+			image: void 0,
+			emailVerified: false
+		};
+	};
+	return {
+		providerId: "hubspot",
+		authorizationUrl: "https://app.hubspot.com/oauth/authorize",
+		tokenUrl: "https://api.hubapi.com/oauth/v1/token",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		authentication: "post",
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+
+//#endregion
+export { hubspot };
+//# sourceMappingURL=hubspot.mjs.map

package/dist/plugins/generic-oauth/providers/hubspot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"hubspot.mjs","names":[],"sources":["../../../../src/plugins/generic-oauth/providers/hubspot.ts"],"sourcesContent":["import type { OAuth2Tokens, OAuth2UserInfo } from \"@better-auth/core/oauth2\";\nimport { betterFetch } from \"@better-fetch/fetch\";\nimport type { BaseOAuthProviderOptions, GenericOAuthConfig } from \"../index\";\n\nexport interface HubSpotOptions extends BaseOAuthProviderOptions {\n\t/**\n\t * OAuth scopes to request.\n\t * @default [\"oauth\"]\n\t */\n\tscopes?: string[];\n}\n\n/**\n * HubSpot access token information response.\n * Based on: https://legacydocs.hubspot.com/docs/methods/oauth2/get-access-token-information\n *\n * The API may return additional fields, but we only use the fields needed for user identification.\n */\ninterface HubSpotProfile extends Record<string, any> {\n\tuser: string;\n\tuser_id: string;\n\thub_domain: string;\n\thub_id: string;\n\tsigned_access_token?: {\n\t\tuserId?: string;\n\t\t[key: string]: any;\n\t};\n}\n\n/**\n * HubSpot OAuth provider helper\n *\n * @example\n * ```ts\n * import { genericOAuth, hubspot } from \"better-auth/plugins/generic-oauth\";\n *\n * export const auth = betterAuth({\n *   plugins: [\n *     genericOAuth({\n *       config: [\n *         hubspot({\n *           clientId: process.env.HUBSPOT_CLIENT_ID,\n *           clientSecret: process.env.HUBSPOT_CLIENT_SECRET,\n *           scopes: [\"oauth\", \"contacts\"],\n *         }),\n *       ],\n *     }),\n *   ],\n * });\n * ```\n */\nexport function hubspot(options: HubSpotOptions): GenericOAuthConfig {\n\tconst defaultScopes = [\"oauth\"];\n\n\tconst getUserInfo = async (\n\t\ttokens: OAuth2Tokens,\n\t): Promise<OAuth2UserInfo | null> => {\n\t\tconst tokenInfoUrl = `https://api.hubapi.com/oauth/v1/access-tokens/${tokens.accessToken}`;\n\n\t\tconst { data: profile, error } = await betterFetch<HubSpotProfile>(\n\t\t\ttokenInfoUrl,\n\t\t\t{\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\n\t\tif (error || !profile) {\n\t\t\treturn null;\n\t\t}\n\n\t\t// Note: HubSpot's OAuth API only returns the email address in the 'user' field.\n\t\t// It does NOT provide a display name or profile picture. This is a known limitation.\n\t\t// See: https://community.hubspot.com/t5/APIs-Integrations/Profile-photo-is-not-retrieved-with-User-API/m-p/325521\n\t\tconst id = profile.user_id ?? profile.signed_access_token?.userId;\n\n\t\tif (!id) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn {\n\t\t\tid,\n\t\t\tname: profile.user,\n\t\t\temail: profile.user,\n\t\t\timage: undefined,\n\t\t\temailVerified: false,\n\t\t};\n\t};\n\n\treturn {\n\t\tproviderId: \"hubspot\",\n\t\tauthorizationUrl: \"https://app.hubspot.com/oauth/authorize\",\n\t\ttokenUrl: \"https://api.hubapi.com/oauth/v1/token\",\n\t\tclientId: options.clientId,\n\t\tclientSecret: options.clientSecret,\n\t\tscopes: options.scopes ?? defaultScopes,\n\t\tredirectURI: options.redirectURI,\n\t\tauthentication: \"post\",\n\t\tpkce: options.pkce,\n\t\tdisableImplicitSignUp: options.disableImplicitSignUp,\n\t\tdisableSignUp: options.disableSignUp,\n\t\toverrideUserInfo: options.overrideUserInfo,\n\t\tgetUserInfo,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,QAAQ,SAA6C;CACpE,MAAM,gBAAgB,CAAC,QAAQ;CAE/B,MAAM,cAAc,OACnB,WACoC;EAGpC,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,YAFlB,iDAAiD,OAAO,eAI5E,EACC,SAAS,EACR,gBAAgB,oBAChB,EACD,CACD;AAED,MAAI,SAAS,CAAC,QACb,QAAO;EAMR,MAAM,KAAK,QAAQ,WAAW,QAAQ,qBAAqB;AAE3D,MAAI,CAAC,GACJ,QAAO;AAGR,SAAO;GACN;GACA,MAAM,QAAQ;GACd,OAAO,QAAQ;GACf,OAAO;GACP,eAAe;GACf;;AAGF,QAAO;EACN,YAAY;EACZ,kBAAkB;EAClB,UAAU;EACV,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,QAAQ,QAAQ,UAAU;EAC1B,aAAa,QAAQ;EACrB,gBAAgB;EAChB,MAAM,QAAQ;EACd,uBAAuB,QAAQ;EAC/B,eAAe,QAAQ;EACvB,kBAAkB,QAAQ;EAC1B;EACA"}

package/dist/plugins/generic-oauth/providers/index.d.mts

@@ -0,0 +1,9 @@
+import { Auth0Options, auth0 } from "./auth0.mjs";
+import { GumroadOptions, gumroad } from "./gumroad.mjs";
+import { HubSpotOptions, hubspot } from "./hubspot.mjs";
+import { KeycloakOptions, keycloak } from "./keycloak.mjs";
+import { LineOptions, line } from "./line.mjs";
+import { MicrosoftEntraIdOptions, microsoftEntraId } from "./microsoft-entra-id.mjs";
+import { OktaOptions, okta } from "./okta.mjs";
+import { PatreonOptions, patreon } from "./patreon.mjs";
+import { SlackOptions, slack } from "./slack.mjs";

package/dist/plugins/generic-oauth/providers/index.mjs

@@ -0,0 +1,11 @@
+import { auth0 } from "./auth0.mjs";
+import { gumroad } from "./gumroad.mjs";
+import { hubspot } from "./hubspot.mjs";
+import { keycloak } from "./keycloak.mjs";
+import { line } from "./line.mjs";
+import { microsoftEntraId } from "./microsoft-entra-id.mjs";
+import { okta } from "./okta.mjs";
+import { patreon } from "./patreon.mjs";
+import { slack } from "./slack.mjs";
+
+export {  };

package/dist/plugins/generic-oauth/providers/keycloak.d.mts

@@ -0,0 +1,37 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/keycloak.d.ts
+interface KeycloakOptions extends BaseOAuthProviderOptions {
+  /**
+   * Keycloak issuer URL (includes realm, e.g., https://my-domain/realms/MyRealm)
+   * This will be used to construct the discovery URL.
+   */
+  issuer: string;
+}
+/**
+ * Keycloak OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, keycloak } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         keycloak({
+ *           clientId: process.env.KEYCLOAK_CLIENT_ID,
+ *           clientSecret: process.env.KEYCLOAK_CLIENT_SECRET,
+ *           issuer: process.env.KEYCLOAK_ISSUER,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function keycloak(options: KeycloakOptions): GenericOAuthConfig;
+//#endregion
+export { KeycloakOptions, keycloak };
+//# sourceMappingURL=keycloak.d.mts.map

package/dist/plugins/generic-oauth/providers/keycloak.mjs

@@ -0,0 +1,62 @@
+import { betterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/generic-oauth/providers/keycloak.ts
+/**
+* Keycloak OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, keycloak } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         keycloak({
+*           clientId: process.env.KEYCLOAK_CLIENT_ID,
+*           clientSecret: process.env.KEYCLOAK_CLIENT_SECRET,
+*           issuer: process.env.KEYCLOAK_ISSUER,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function keycloak(options) {
+	const defaultScopes = [
+		"openid",
+		"profile",
+		"email"
+	];
+	const issuer = options.issuer.replace(/\/$/, "");
+	const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+	const getUserInfo = async (tokens) => {
+		const { data: profile, error } = await betterFetch(`${issuer}/protocol/openid-connect/userinfo`, { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+		if (error || !profile) return null;
+		return {
+			id: profile.sub,
+			name: profile.name ?? profile.preferred_username ?? void 0,
+			email: profile.email ?? void 0,
+			image: profile.picture,
+			emailVerified: profile.email_verified ?? false
+		};
+	};
+	return {
+		providerId: "keycloak",
+		discoveryUrl,
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+
+//#endregion
+export { keycloak };
+//# sourceMappingURL=keycloak.mjs.map

package/dist/plugins/generic-oauth/providers/keycloak.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak.mjs","names":[],"sources":["../../../../src/plugins/generic-oauth/providers/keycloak.ts"],"sourcesContent":["import type { OAuth2Tokens, OAuth2UserInfo } from \"@better-auth/core/oauth2\";\nimport { betterFetch } from \"@better-fetch/fetch\";\nimport type { BaseOAuthProviderOptions, GenericOAuthConfig } from \"../index\";\n\nexport interface KeycloakOptions extends BaseOAuthProviderOptions {\n\t/**\n\t * Keycloak issuer URL (includes realm, e.g., https://my-domain/realms/MyRealm)\n\t * This will be used to construct the discovery URL.\n\t */\n\tissuer: string;\n}\n\ninterface KeycloakProfile {\n\tsub: string;\n\tname?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tpicture?: string;\n\tpreferred_username?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n}\n\n/**\n * Keycloak OAuth provider helper\n *\n * @example\n * ```ts\n * import { genericOAuth, keycloak } from \"better-auth/plugins/generic-oauth\";\n *\n * export const auth = betterAuth({\n *   plugins: [\n *     genericOAuth({\n *       config: [\n *         keycloak({\n *           clientId: process.env.KEYCLOAK_CLIENT_ID,\n *           clientSecret: process.env.KEYCLOAK_CLIENT_SECRET,\n *           issuer: process.env.KEYCLOAK_ISSUER,\n *         }),\n *       ],\n *     }),\n *   ],\n * });\n * ```\n */\nexport function keycloak(options: KeycloakOptions): GenericOAuthConfig {\n\tconst defaultScopes = [\"openid\", \"profile\", \"email\"];\n\n\t// Ensure issuer ends without trailing slash for proper discovery URL construction\n\tconst issuer = options.issuer.replace(/\\/$/, \"\");\n\tconst discoveryUrl = `${issuer}/.well-known/openid-configuration`;\n\n\tconst getUserInfo = async (\n\t\ttokens: OAuth2Tokens,\n\t): Promise<OAuth2UserInfo | null> => {\n\t\t// Construct userinfo URL from issuer\n\t\tconst userInfoUrl = `${issuer}/protocol/openid-connect/userinfo`;\n\n\t\tconst { data: profile, error } = await betterFetch<KeycloakProfile>(\n\t\t\tuserInfoUrl,\n\t\t\t{\n\t\t\t\theaders: {\n\t\t\t\t\tAuthorization: `Bearer ${tokens.accessToken}`,\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\n\t\tif (error || !profile) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn {\n\t\t\tid: profile.sub,\n\t\t\tname: profile.name ?? profile.preferred_username ?? undefined,\n\t\t\temail: profile.email ?? undefined,\n\t\t\timage: profile.picture,\n\t\t\t// Keycloak provides email_verified per OIDC standard, but availability depends on configuration.\n\t\t\t// We default to false when not provided or not configured.\n\t\t\temailVerified: profile.email_verified ?? false,\n\t\t};\n\t};\n\n\treturn {\n\t\tproviderId: \"keycloak\",\n\t\tdiscoveryUrl,\n\t\tclientId: options.clientId,\n\t\tclientSecret: options.clientSecret,\n\t\tscopes: options.scopes ?? defaultScopes,\n\t\tredirectURI: options.redirectURI,\n\t\tpkce: options.pkce,\n\t\tdisableImplicitSignUp: options.disableImplicitSignUp,\n\t\tdisableSignUp: options.disableSignUp,\n\t\toverrideUserInfo: options.overrideUserInfo,\n\t\tgetUserInfo,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,SAAS,SAA8C;CACtE,MAAM,gBAAgB;EAAC;EAAU;EAAW;EAAQ;CAGpD,MAAM,SAAS,QAAQ,OAAO,QAAQ,OAAO,GAAG;CAChD,MAAM,eAAe,GAAG,OAAO;CAE/B,MAAM,cAAc,OACnB,WACoC;EAIpC,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,YAFnB,GAAG,OAAO,oCAI7B,EACC,SAAS,EACR,eAAe,UAAU,OAAO,eAChC,EACD,CACD;AAED,MAAI,SAAS,CAAC,QACb,QAAO;AAGR,SAAO;GACN,IAAI,QAAQ;GACZ,MAAM,QAAQ,QAAQ,QAAQ,sBAAsB;GACpD,OAAO,QAAQ,SAAS;GACxB,OAAO,QAAQ;GAGf,eAAe,QAAQ,kBAAkB;GACzC;;AAGF,QAAO;EACN,YAAY;EACZ;EACA,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,QAAQ,QAAQ,UAAU;EAC1B,aAAa,QAAQ;EACrB,MAAM,QAAQ;EACd,uBAAuB,QAAQ;EAC/B,eAAe,QAAQ;EACvB,kBAAkB,QAAQ;EAC1B;EACA"}

package/dist/plugins/generic-oauth/providers/line.d.mts

@@ -0,0 +1,55 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/line.d.ts
+interface LineOptions extends BaseOAuthProviderOptions {
+  /**
+   * Unique provider identifier for this LINE channel.
+   * Use different providerIds for different countries/channels (e.g., "line-jp", "line-th", "line-tw").
+   * @default "line"
+   */
+  providerId?: string;
+}
+/**
+ * LINE OAuth provider helper
+ *
+ * LINE requires separate channels for different countries (Japan, Thailand, Taiwan, etc.).
+ * Each channel has its own clientId and clientSecret. To support multiple countries,
+ * call this function multiple times with different providerIds and credentials.
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, line } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         // Japan channel
+ *         line({
+ *           providerId: "line-jp",
+ *           clientId: process.env.LINE_JP_CLIENT_ID,
+ *           clientSecret: process.env.LINE_JP_CLIENT_SECRET,
+ *         }),
+ *         // Thailand channel
+ *         line({
+ *           providerId: "line-th",
+ *           clientId: process.env.LINE_TH_CLIENT_ID,
+ *           clientSecret: process.env.LINE_TH_CLIENT_SECRET,
+ *         }),
+ *         // Taiwan channel
+ *         line({
+ *           providerId: "line-tw",
+ *           clientId: process.env.LINE_TW_CLIENT_ID,
+ *           clientSecret: process.env.LINE_TW_CLIENT_SECRET,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function line(options: LineOptions): GenericOAuthConfig;
+//#endregion
+export { LineOptions, line };
+//# sourceMappingURL=line.d.mts.map

package/dist/plugins/generic-oauth/providers/line.mjs

@@ -0,0 +1,91 @@
+import { decodeJwt } from "jose";
+import { betterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/generic-oauth/providers/line.ts
+/**
+* LINE OAuth provider helper
+*
+* LINE requires separate channels for different countries (Japan, Thailand, Taiwan, etc.).
+* Each channel has its own clientId and clientSecret. To support multiple countries,
+* call this function multiple times with different providerIds and credentials.
+*
+* @example
+* ```ts
+* import { genericOAuth, line } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         // Japan channel
+*         line({
+*           providerId: "line-jp",
+*           clientId: process.env.LINE_JP_CLIENT_ID,
+*           clientSecret: process.env.LINE_JP_CLIENT_SECRET,
+*         }),
+*         // Thailand channel
+*         line({
+*           providerId: "line-th",
+*           clientId: process.env.LINE_TH_CLIENT_ID,
+*           clientSecret: process.env.LINE_TH_CLIENT_SECRET,
+*         }),
+*         // Taiwan channel
+*         line({
+*           providerId: "line-tw",
+*           clientId: process.env.LINE_TW_CLIENT_ID,
+*           clientSecret: process.env.LINE_TW_CLIENT_SECRET,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function line(options) {
+	const defaultScopes = [
+		"openid",
+		"profile",
+		"email"
+	];
+	const authorizationUrl = "https://access.line.me/oauth2/v2.1/authorize";
+	const tokenUrl = "https://api.line.me/oauth2/v2.1/token";
+	const userInfoUrl = "https://api.line.me/oauth2/v2.1/userinfo";
+	const getUserInfo = async (tokens) => {
+		let profile = null;
+		if (tokens.idToken) try {
+			profile = decodeJwt(tokens.idToken);
+		} catch {}
+		if (!profile) {
+			const { data, error } = await betterFetch(userInfoUrl, { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+			if (error || !data) return null;
+			profile = data;
+		}
+		if (!profile) return null;
+		return {
+			id: profile.sub,
+			name: profile.name,
+			email: profile.email,
+			image: profile.picture,
+			emailVerified: false
+		};
+	};
+	return {
+		providerId: options.providerId ?? "line",
+		authorizationUrl,
+		tokenUrl,
+		userInfoUrl,
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+
+//#endregion
+export { line };
+//# sourceMappingURL=line.mjs.map

package/dist/plugins/generic-oauth/providers/line.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"line.mjs","names":[],"sources":["../../../../src/plugins/generic-oauth/providers/line.ts"],"sourcesContent":["import type { OAuth2Tokens, OAuth2UserInfo } from \"@better-auth/core/oauth2\";\nimport { betterFetch } from \"@better-fetch/fetch\";\nimport { decodeJwt } from \"jose\";\nimport type { BaseOAuthProviderOptions, GenericOAuthConfig } from \"../index\";\n\nexport interface LineOptions extends BaseOAuthProviderOptions {\n\t/**\n\t * Unique provider identifier for this LINE channel.\n\t * Use different providerIds for different countries/channels (e.g., \"line-jp\", \"line-th\", \"line-tw\").\n\t * @default \"line\"\n\t */\n\tproviderId?: string;\n}\n\ninterface LineIdTokenPayload {\n\tiss: string;\n\tsub: string;\n\taud: string;\n\texp: number;\n\tiat: number;\n\tname?: string;\n\tpicture?: string;\n\temail?: string;\n\tamr?: string[];\n\tnonce?: string;\n}\n\ninterface LineUserInfo {\n\tsub: string;\n\tname?: string;\n\tpicture?: string;\n\temail?: string;\n}\n\n/**\n * LINE OAuth provider helper\n *\n * LINE requires separate channels for different countries (Japan, Thailand, Taiwan, etc.).\n * Each channel has its own clientId and clientSecret. To support multiple countries,\n * call this function multiple times with different providerIds and credentials.\n *\n * @example\n * ```ts\n * import { genericOAuth, line } from \"better-auth/plugins/generic-oauth\";\n *\n * export const auth = betterAuth({\n *   plugins: [\n *     genericOAuth({\n *       config: [\n *         // Japan channel\n *         line({\n *           providerId: \"line-jp\",\n *           clientId: process.env.LINE_JP_CLIENT_ID,\n *           clientSecret: process.env.LINE_JP_CLIENT_SECRET,\n *         }),\n *         // Thailand channel\n *         line({\n *           providerId: \"line-th\",\n *           clientId: process.env.LINE_TH_CLIENT_ID,\n *           clientSecret: process.env.LINE_TH_CLIENT_SECRET,\n *         }),\n *         // Taiwan channel\n *         line({\n *           providerId: \"line-tw\",\n *           clientId: process.env.LINE_TW_CLIENT_ID,\n *           clientSecret: process.env.LINE_TW_CLIENT_SECRET,\n *         }),\n *       ],\n *     }),\n *   ],\n * });\n * ```\n */\nexport function line(options: LineOptions): GenericOAuthConfig {\n\tconst defaultScopes = [\"openid\", \"profile\", \"email\"];\n\tconst authorizationUrl = \"https://access.line.me/oauth2/v2.1/authorize\";\n\tconst tokenUrl = \"https://api.line.me/oauth2/v2.1/token\";\n\tconst userInfoUrl = \"https://api.line.me/oauth2/v2.1/userinfo\";\n\n\tconst getUserInfo = async (\n\t\ttokens: OAuth2Tokens,\n\t): Promise<OAuth2UserInfo | null> => {\n\t\tlet profile: LineUserInfo | LineIdTokenPayload | null = null;\n\n\t\tif (tokens.idToken) {\n\t\t\ttry {\n\t\t\t\tprofile = decodeJwt(tokens.idToken) as LineIdTokenPayload;\n\t\t\t} catch {\n\t\t\t\t// If ID token decoding fails, fall back to UserInfo endpoint\n\t\t\t}\n\t\t}\n\n\t\tif (!profile) {\n\t\t\tconst { data, error } = await betterFetch<LineUserInfo>(userInfoUrl, {\n\t\t\t\theaders: {\n\t\t\t\t\tAuthorization: `Bearer ${tokens.accessToken}`,\n\t\t\t\t},\n\t\t\t});\n\n\t\t\tif (error || !data) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tprofile = data;\n\t\t}\n\n\t\tif (!profile) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn {\n\t\t\tid: profile.sub,\n\t\t\tname: profile.name,\n\t\t\temail: profile.email,\n\t\t\timage: profile.picture,\n\t\t\temailVerified: false,\n\t\t};\n\t};\n\n\treturn {\n\t\tproviderId: options.providerId ?? \"line\",\n\t\tauthorizationUrl,\n\t\ttokenUrl,\n\t\tuserInfoUrl,\n\t\tclientId: options.clientId,\n\t\tclientSecret: options.clientSecret,\n\t\tscopes: options.scopes ?? defaultScopes,\n\t\tredirectURI: options.redirectURI,\n\t\tpkce: options.pkce,\n\t\tdisableImplicitSignUp: options.disableImplicitSignUp,\n\t\tdisableSignUp: options.disableSignUp,\n\t\toverrideUserInfo: options.overrideUserInfo,\n\t\tgetUserInfo,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,SAAgB,KAAK,SAA0C;CAC9D,MAAM,gBAAgB;EAAC;EAAU;EAAW;EAAQ;CACpD,MAAM,mBAAmB;CACzB,MAAM,WAAW;CACjB,MAAM,cAAc;CAEpB,MAAM,cAAc,OACnB,WACoC;EACpC,IAAI,UAAoD;AAExD,MAAI,OAAO,QACV,KAAI;AACH,aAAU,UAAU,OAAO,QAAQ;UAC5B;AAKT,MAAI,CAAC,SAAS;GACb,MAAM,EAAE,MAAM,UAAU,MAAM,YAA0B,aAAa,EACpE,SAAS,EACR,eAAe,UAAU,OAAO,eAChC,EACD,CAAC;AAEF,OAAI,SAAS,CAAC,KACb,QAAO;AAGR,aAAU;;AAGX,MAAI,CAAC,QACJ,QAAO;AAGR,SAAO;GACN,IAAI,QAAQ;GACZ,MAAM,QAAQ;GACd,OAAO,QAAQ;GACf,OAAO,QAAQ;GACf,eAAe;GACf;;AAGF,QAAO;EACN,YAAY,QAAQ,cAAc;EAClC;EACA;EACA;EACA,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,QAAQ,QAAQ,UAAU;EAC1B,aAAa,QAAQ;EACrB,MAAM,QAAQ;EACd,uBAAuB,QAAQ;EAC/B,eAAe,QAAQ;EACvB,kBAAkB,QAAQ;EAC1B;EACA"}

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.d.mts

@@ -0,0 +1,37 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/microsoft-entra-id.d.ts
+interface MicrosoftEntraIdOptions extends BaseOAuthProviderOptions {
+  /**
+   * Microsoft Entra ID tenant ID.
+   * Can be a GUID, "common", "organizations", or "consumers"
+   */
+  tenantId: string;
+}
+/**
+ * Microsoft Entra ID (Azure AD) OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, microsoftEntraId } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         microsoftEntraId({
+ *           clientId: process.env.MS_APP_ID,
+ *           clientSecret: process.env.MS_CLIENT_SECRET,
+ *           tenantId: process.env.MS_TENANT_ID,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function microsoftEntraId(options: MicrosoftEntraIdOptions): GenericOAuthConfig;
+//#endregion
+export { MicrosoftEntraIdOptions, microsoftEntraId };
+//# sourceMappingURL=microsoft-entra-id.d.mts.map

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.mjs

@@ -0,0 +1,66 @@
+import { betterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/generic-oauth/providers/microsoft-entra-id.ts
+/**
+* Microsoft Entra ID (Azure AD) OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, microsoftEntraId } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         microsoftEntraId({
+*           clientId: process.env.MS_APP_ID,
+*           clientSecret: process.env.MS_CLIENT_SECRET,
+*           tenantId: process.env.MS_TENANT_ID,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function microsoftEntraId(options) {
+	const defaultScopes = [
+		"openid",
+		"profile",
+		"email"
+	];
+	const tenantId = options.tenantId;
+	const authorizationUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`;
+	const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
+	const userInfoUrl = "https://graph.microsoft.com/oidc/userinfo";
+	const getUserInfo = async (tokens) => {
+		const { data: profile, error } = await betterFetch(userInfoUrl, { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+		if (error || !profile) return null;
+		return {
+			id: profile.sub,
+			name: profile.name ?? (`${profile.given_name ?? ""} ${profile.family_name ?? ""}`.trim() || void 0),
+			email: profile.email ?? profile.preferred_username ?? void 0,
+			image: profile.picture,
+			emailVerified: profile.email_verified ?? false
+		};
+	};
+	return {
+		providerId: "microsoft-entra-id",
+		authorizationUrl,
+		tokenUrl,
+		userInfoUrl,
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+
+//#endregion
+export { microsoftEntraId };
+//# sourceMappingURL=microsoft-entra-id.mjs.map

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft-entra-id.mjs","names":[],"sources":["../../../../src/plugins/generic-oauth/providers/microsoft-entra-id.ts"],"sourcesContent":["import type { OAuth2Tokens, OAuth2UserInfo } from \"@better-auth/core/oauth2\";\nimport { betterFetch } from \"@better-fetch/fetch\";\nimport type { BaseOAuthProviderOptions, GenericOAuthConfig } from \"../index\";\n\nexport interface MicrosoftEntraIdOptions extends BaseOAuthProviderOptions {\n\t/**\n\t * Microsoft Entra ID tenant ID.\n\t * Can be a GUID, \"common\", \"organizations\", or \"consumers\"\n\t */\n\ttenantId: string;\n}\n\ninterface MicrosoftEntraIdProfile {\n\tsub: string;\n\tname?: string;\n\temail?: string;\n\tpreferred_username?: string;\n\tpicture?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n\temail_verified?: boolean;\n}\n\n/**\n * Microsoft Entra ID (Azure AD) OAuth provider helper\n *\n * @example\n * ```ts\n * import { genericOAuth, microsoftEntraId } from \"better-auth/plugins/generic-oauth\";\n *\n * export const auth = betterAuth({\n *   plugins: [\n *     genericOAuth({\n *       config: [\n *         microsoftEntraId({\n *           clientId: process.env.MS_APP_ID,\n *           clientSecret: process.env.MS_CLIENT_SECRET,\n *           tenantId: process.env.MS_TENANT_ID,\n *         }),\n *       ],\n *     }),\n *   ],\n * });\n * ```\n */\nexport function microsoftEntraId(\n\toptions: MicrosoftEntraIdOptions,\n): GenericOAuthConfig {\n\tconst defaultScopes = [\"openid\", \"profile\", \"email\"];\n\n\tconst tenantId = options.tenantId;\n\tconst authorizationUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`;\n\tconst tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n\tconst userInfoUrl = \"https://graph.microsoft.com/oidc/userinfo\";\n\n\tconst getUserInfo = async (\n\t\ttokens: OAuth2Tokens,\n\t): Promise<OAuth2UserInfo | null> => {\n\t\tconst { data: profile, error } = await betterFetch<MicrosoftEntraIdProfile>(\n\t\t\tuserInfoUrl,\n\t\t\t{\n\t\t\t\theaders: {\n\t\t\t\t\tAuthorization: `Bearer ${tokens.accessToken}`,\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\n\t\tif (error || !profile) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn {\n\t\t\tid: profile.sub,\n\t\t\tname:\n\t\t\t\tprofile.name ??\n\t\t\t\t(`${profile.given_name ?? \"\"} ${profile.family_name ?? \"\"}`.trim() ||\n\t\t\t\t\tundefined),\n\t\t\temail: profile.email ?? profile.preferred_username ?? undefined,\n\t\t\timage: profile.picture,\n\t\t\t// Note: Microsoft Entra ID does NOT include email_verified claim by default.\n\t\t\t// It must be configured as an optional claim in the app registration.\n\t\t\t// We default to false when not provided\n\t\t\t// The built-in provider hardcodes this to true, assuming Microsoft accounts are verified.\n\t\t\temailVerified: profile.email_verified ?? false,\n\t\t};\n\t};\n\n\treturn {\n\t\tproviderId: \"microsoft-entra-id\",\n\t\tauthorizationUrl,\n\t\ttokenUrl,\n\t\tuserInfoUrl,\n\t\tclientId: options.clientId,\n\t\tclientSecret: options.clientSecret,\n\t\tscopes: options.scopes ?? defaultScopes,\n\t\tredirectURI: options.redirectURI,\n\t\tpkce: options.pkce,\n\t\tdisableImplicitSignUp: options.disableImplicitSignUp,\n\t\tdisableSignUp: options.disableSignUp,\n\t\toverrideUserInfo: options.overrideUserInfo,\n\t\tgetUserInfo,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,iBACf,SACqB;CACrB,MAAM,gBAAgB;EAAC;EAAU;EAAW;EAAQ;CAEpD,MAAM,WAAW,QAAQ;CACzB,MAAM,mBAAmB,qCAAqC,SAAS;CACvE,MAAM,WAAW,qCAAqC,SAAS;CAC/D,MAAM,cAAc;CAEpB,MAAM,cAAc,OACnB,WACoC;EACpC,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,YACtC,aACA,EACC,SAAS,EACR,eAAe,UAAU,OAAO,eAChC,EACD,CACD;AAED,MAAI,SAAS,CAAC,QACb,QAAO;AAGR,SAAO;GACN,IAAI,QAAQ;GACZ,MACC,QAAQ,SACP,GAAG,QAAQ,cAAc,GAAG,GAAG,QAAQ,eAAe,KAAK,MAAM,IACjE;GACF,OAAO,QAAQ,SAAS,QAAQ,sBAAsB;GACtD,OAAO,QAAQ;GAKf,eAAe,QAAQ,kBAAkB;GACzC;;AAGF,QAAO;EACN,YAAY;EACZ;EACA;EACA;EACA,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,QAAQ,QAAQ,UAAU;EAC1B,aAAa,QAAQ;EACrB,MAAM,QAAQ;EACd,uBAAuB,QAAQ;EAC/B,eAAe,QAAQ;EACvB,kBAAkB,QAAQ;EAC1B;EACA"}

package/dist/plugins/generic-oauth/providers/okta.d.mts

@@ -0,0 +1,37 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/okta.d.ts
+interface OktaOptions extends BaseOAuthProviderOptions {
+  /**
+   * Okta issuer URL (e.g., https://dev-xxxxx.okta.com/oauth2/default)
+   * This will be used to construct the discovery URL.
+   */
+  issuer: string;
+}
+/**
+ * Okta OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, okta } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         okta({
+ *           clientId: process.env.OKTA_CLIENT_ID,
+ *           clientSecret: process.env.OKTA_CLIENT_SECRET,
+ *           issuer: process.env.OKTA_ISSUER,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function okta(options: OktaOptions): GenericOAuthConfig;
+//#endregion
+export { OktaOptions, okta };
+//# sourceMappingURL=okta.d.mts.map

package/dist/plugins/generic-oauth/providers/okta.mjs

@@ -0,0 +1,62 @@
+import { betterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/generic-oauth/providers/okta.ts
+/**
+* Okta OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, okta } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         okta({
+*           clientId: process.env.OKTA_CLIENT_ID,
+*           clientSecret: process.env.OKTA_CLIENT_SECRET,
+*           issuer: process.env.OKTA_ISSUER,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function okta(options) {
+	const defaultScopes = [
+		"openid",
+		"profile",
+		"email"
+	];
+	const issuer = options.issuer.replace(/\/$/, "");
+	const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+	const getUserInfo = async (tokens) => {
+		const { data: profile, error } = await betterFetch(`${issuer}/oauth2/v1/userinfo`, { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+		if (error || !profile) return null;
+		return {
+			id: profile.sub,
+			name: profile.name ?? profile.preferred_username ?? void 0,
+			email: profile.email ?? void 0,
+			image: profile.picture,
+			emailVerified: profile.email_verified ?? false
+		};
+	};
+	return {
+		providerId: "okta",
+		discoveryUrl,
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+
+//#endregion
+export { okta };
+//# sourceMappingURL=okta.mjs.map

package/dist/plugins/generic-oauth/providers/okta.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"okta.mjs","names":[],"sources":["../../../../src/plugins/generic-oauth/providers/okta.ts"],"sourcesContent":["import type { OAuth2Tokens, OAuth2UserInfo } from \"@better-auth/core/oauth2\";\nimport { betterFetch } from \"@better-fetch/fetch\";\nimport type { BaseOAuthProviderOptions, GenericOAuthConfig } from \"../index\";\n\nexport interface OktaOptions extends BaseOAuthProviderOptions {\n\t/**\n\t * Okta issuer URL (e.g., https://dev-xxxxx.okta.com/oauth2/default)\n\t * This will be used to construct the discovery URL.\n\t */\n\tissuer: string;\n}\n\ninterface OktaProfile {\n\tsub: string;\n\tname?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tpicture?: string;\n\tpreferred_username?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n}\n\n/**\n * Okta OAuth provider helper\n *\n * @example\n * ```ts\n * import { genericOAuth, okta } from \"better-auth/plugins/generic-oauth\";\n *\n * export const auth = betterAuth({\n *   plugins: [\n *     genericOAuth({\n *       config: [\n *         okta({\n *           clientId: process.env.OKTA_CLIENT_ID,\n *           clientSecret: process.env.OKTA_CLIENT_SECRET,\n *           issuer: process.env.OKTA_ISSUER,\n *         }),\n *       ],\n *     }),\n *   ],\n * });\n * ```\n */\nexport function okta(options: OktaOptions): GenericOAuthConfig {\n\tconst defaultScopes = [\"openid\", \"profile\", \"email\"];\n\n\t// Ensure issuer ends without trailing slash for proper discovery URL construction\n\tconst issuer = options.issuer.replace(/\\/$/, \"\");\n\tconst discoveryUrl = `${issuer}/.well-known/openid-configuration`;\n\n\tconst getUserInfo = async (\n\t\ttokens: OAuth2Tokens,\n\t): Promise<OAuth2UserInfo | null> => {\n\t\tconst userInfoUrl = `${issuer}/oauth2/v1/userinfo`;\n\n\t\tconst { data: profile, error } = await betterFetch<OktaProfile>(\n\t\t\tuserInfoUrl,\n\t\t\t{\n\t\t\t\theaders: {\n\t\t\t\t\tAuthorization: `Bearer ${tokens.accessToken}`,\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\n\t\tif (error || !profile) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn {\n\t\t\tid: profile.sub,\n\t\t\tname: profile.name ?? profile.preferred_username ?? undefined,\n\t\t\temail: profile.email ?? undefined,\n\t\t\timage: profile.picture,\n\t\t\temailVerified: profile.email_verified ?? false,\n\t\t};\n\t};\n\n\treturn {\n\t\tproviderId: \"okta\",\n\t\tdiscoveryUrl,\n\t\tclientId: options.clientId,\n\t\tclientSecret: options.clientSecret,\n\t\tscopes: options.scopes ?? defaultScopes,\n\t\tredirectURI: options.redirectURI,\n\t\tpkce: options.pkce,\n\t\tdisableImplicitSignUp: options.disableImplicitSignUp,\n\t\tdisableSignUp: options.disableSignUp,\n\t\toverrideUserInfo: options.overrideUserInfo,\n\t\tgetUserInfo,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,KAAK,SAA0C;CAC9D,MAAM,gBAAgB;EAAC;EAAU;EAAW;EAAQ;CAGpD,MAAM,SAAS,QAAQ,OAAO,QAAQ,OAAO,GAAG;CAChD,MAAM,eAAe,GAAG,OAAO;CAE/B,MAAM,cAAc,OACnB,WACoC;EAGpC,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,YAFnB,GAAG,OAAO,sBAI7B,EACC,SAAS,EACR,eAAe,UAAU,OAAO,eAChC,EACD,CACD;AAED,MAAI,SAAS,CAAC,QACb,QAAO;AAGR,SAAO;GACN,IAAI,QAAQ;GACZ,MAAM,QAAQ,QAAQ,QAAQ,sBAAsB;GACpD,OAAO,QAAQ,SAAS;GACxB,OAAO,QAAQ;GACf,eAAe,QAAQ,kBAAkB;GACzC;;AAGF,QAAO;EACN,YAAY;EACZ;EACA,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,QAAQ,QAAQ,UAAU;EAC1B,aAAa,QAAQ;EACrB,MAAM,QAAQ;EACd,uBAAuB,QAAQ;EAC/B,eAAe,QAAQ;EACvB,kBAAkB,QAAQ;EAC1B;EACA"}

package/dist/plugins/generic-oauth/providers/patreon.d.mts

@@ -0,0 +1,30 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/patreon.d.ts
+interface PatreonOptions extends BaseOAuthProviderOptions {}
+/**
+ * Patreon OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, patreon } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         patreon({
+ *           clientId: process.env.PATREON_CLIENT_ID,
+ *           clientSecret: process.env.PATREON_CLIENT_SECRET,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function patreon(options: PatreonOptions): GenericOAuthConfig;
+//#endregion
+export { PatreonOptions, patreon };
+//# sourceMappingURL=patreon.d.mts.map