@hammadj/better-auth 1.5.0-beta.10

package/dist/plugins/oauth-proxy/index.mjs

@@ -0,0 +1,305 @@
+import { getOrigin } from "../../utils/url.mjs";
+import { originCheck } from "../../api/middlewares/origin-check.mjs";
+import { symmetricDecrypt, symmetricEncrypt } from "../../crypto/index.mjs";
+import { parseSetCookieHeader, stripSecureCookiePrefix } from "../../cookies/cookie-utils.mjs";
+import "../../cookies/index.mjs";
+import "../../api/index.mjs";
+import { parseJSON } from "../../client/parser.mjs";
+import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
+import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
+import * as z from "zod";
+
+//#region src/plugins/oauth-proxy/index.ts
+const oAuthProxyQuerySchema = z.object({
+	callbackURL: z.string().meta({ description: "The URL to redirect to after the proxy" }),
+	cookies: z.string().meta({ description: "The cookies to set after the proxy" })
+});
+const oAuthProxy = (opts) => {
+	const maxAge = opts?.maxAge ?? 60;
+	return {
+		id: "oauth-proxy",
+		options: opts,
+		endpoints: { oAuthProxy: createAuthEndpoint("/oauth-proxy-callback", {
+			method: "GET",
+			operationId: "oauthProxyCallback",
+			query: oAuthProxyQuerySchema,
+			use: [originCheck((ctx) => ctx.query.callbackURL)],
+			metadata: { openapi: {
+				operationId: "oauthProxyCallback",
+				description: "OAuth Proxy Callback",
+				parameters: [{
+					in: "query",
+					name: "callbackURL",
+					required: true,
+					description: "The URL to redirect to after the proxy"
+				}, {
+					in: "query",
+					name: "cookies",
+					required: true,
+					description: "The cookies to set after the proxy"
+				}],
+				responses: { 302: {
+					description: "Redirect",
+					headers: { Location: {
+						description: "The URL to redirect to",
+						schema: { type: "string" }
+					} }
+				} }
+			} }
+		}, async (ctx) => {
+			let decryptedPayload = null;
+			try {
+				decryptedPayload = await symmetricDecrypt({
+					key: ctx.context.secret,
+					data: ctx.query.cookies
+				});
+			} catch (e) {
+				ctx.context.logger.error("Failed to decrypt OAuth proxy cookies:", e);
+			}
+			if (!decryptedPayload) {
+				const errorURL = ctx.context.options.onAPIError?.errorURL || `${stripTrailingSlash(ctx.context.options.baseURL)}/api/auth/error`;
+				throw ctx.redirect(`${errorURL}?error=OAuthProxy - Invalid cookies or secret`);
+			}
+			let payload;
+			try {
+				payload = parseJSON(decryptedPayload);
+			} catch (e) {
+				ctx.context.logger.error("Failed to parse OAuth proxy payload:", e);
+				const errorURL = ctx.context.options.onAPIError?.errorURL || `${stripTrailingSlash(ctx.context.options.baseURL)}/api/auth/error`;
+				throw ctx.redirect(`${errorURL}?error=OAuthProxy - Invalid payload format`);
+			}
+			if (!payload.cookies || typeof payload.cookies !== "string" || typeof payload.timestamp !== "number") {
+				ctx.context.logger.error("OAuth proxy payload missing required fields");
+				const errorURL = ctx.context.options.onAPIError?.errorURL || `${stripTrailingSlash(ctx.context.options.baseURL)}/api/auth/error`;
+				throw ctx.redirect(`${errorURL}?error=OAuthProxy - Invalid payload structure`);
+			}
+			const age = (Date.now() - payload.timestamp) / 1e3;
+			if (age > maxAge || age < -10) {
+				ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
+				const errorURL = ctx.context.options.onAPIError?.errorURL || `${stripTrailingSlash(ctx.context.options.baseURL)}/api/auth/error`;
+				throw ctx.redirect(`${errorURL}?error=OAuthProxy - Payload expired or invalid`);
+			}
+			const decryptedCookies = payload.cookies;
+			const isSecureContext = resolveCurrentURL(ctx, opts).protocol === "https:";
+			const parsedCookies = parseSetCookieHeader(decryptedCookies);
+			const processedCookies = Array.from(parsedCookies.entries()).map(([name, attrs]) => {
+				const options = {};
+				if (attrs.path) options.path = attrs.path;
+				if (attrs.expires) options.expires = attrs.expires;
+				if (attrs.samesite) options.sameSite = attrs.samesite;
+				if (attrs.httponly) options.httpOnly = true;
+				if (attrs["max-age"] !== void 0) options.maxAge = attrs["max-age"];
+				if (isSecureContext) options.secure = true;
+				const cookieName = isSecureContext ? name : stripSecureCookiePrefix(name);
+				let cookieValue;
+				try {
+					cookieValue = decodeURIComponent(attrs.value);
+				} catch {
+					cookieValue = attrs.value;
+				}
+				return {
+					name: cookieName,
+					value: cookieValue,
+					options
+				};
+			});
+			for (const cookie of processedCookies) ctx.setCookie(cookie.name, cookie.value, cookie.options);
+			throw ctx.redirect(ctx.query.callbackURL);
+		}) },
+		hooks: {
+			before: [
+				{
+					matcher(context) {
+						return !!(context.path?.startsWith("/sign-in/social") || context.path?.startsWith("/sign-in/oauth2"));
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						if (checkSkipProxy(ctx, opts)) return;
+						const currentURL = resolveCurrentURL(ctx, opts);
+						const productionURL = opts?.productionURL;
+						const originalCallbackURL = ctx.body?.callbackURL || ctx.context.baseURL;
+						if (productionURL) {
+							const productionBaseURL = `${stripTrailingSlash(productionURL)}${ctx.context.options.basePath || "/api/auth"}`;
+							ctx.context.baseURL = productionBaseURL;
+						}
+						const newCallbackURL = `${stripTrailingSlash(currentURL.origin)}${ctx.context.options.basePath || "/api/auth"}/oauth-proxy-callback?callbackURL=${encodeURIComponent(originalCallbackURL)}`;
+						if (!ctx.body) return;
+						ctx.body.callbackURL = newCallbackURL;
+					})
+				},
+				{
+					matcher(context) {
+						return !!(context.path?.startsWith("/callback") || context.path?.startsWith("/oauth2/callback"));
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						const state = ctx.query?.state || ctx.body?.state;
+						if (!state || typeof state !== "string") return;
+						let statePackage;
+						try {
+							statePackage = parseJSON(await symmetricDecrypt({
+								key: ctx.context.secret,
+								data: state
+							}));
+						} catch {
+							return;
+						}
+						if (!statePackage.isOAuthProxy || !statePackage.state || !statePackage.stateCookie) return;
+						let stateCookieValue;
+						try {
+							stateCookieValue = await symmetricDecrypt({
+								key: ctx.context.secret,
+								data: statePackage.stateCookie
+							});
+							parseJSON(stateCookieValue);
+						} catch (e) {
+							ctx.context.logger.error("Failed to decrypt OAuth proxy state cookie:", e);
+							return;
+						}
+						ctx.context._oauthProxySnapshot = {
+							storeStateStrategy: ctx.context.oauthConfig.storeStateStrategy,
+							skipStateCookieCheck: ctx.context.oauthConfig.skipStateCookieCheck,
+							internalAdapter: ctx.context.internalAdapter
+						};
+						const originalAdapter = ctx.context.internalAdapter;
+						const capturedStatePackage = statePackage;
+						ctx.context.oauthConfig.storeStateStrategy = "database";
+						ctx.context.internalAdapter = {
+							...ctx.context.internalAdapter,
+							findVerificationValue: async (identifier) => {
+								if (identifier === capturedStatePackage.state) return {
+									id: `oauth-proxy-${capturedStatePackage.state}`,
+									identifier: capturedStatePackage.state,
+									value: stateCookieValue,
+									createdAt: /* @__PURE__ */ new Date(),
+									updatedAt: /* @__PURE__ */ new Date(),
+									expiresAt: new Date(Date.now() + 600 * 1e3)
+								};
+								return originalAdapter.findVerificationValue(identifier);
+							}
+						};
+						if (ctx.query?.state) ctx.query.state = statePackage.state;
+						if (ctx.body?.state) ctx.body.state = statePackage.state;
+						ctx.context.oauthConfig.skipStateCookieCheck = true;
+					})
+				},
+				{
+					matcher() {
+						return true;
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						if (ctx.path !== "/callback/:id") return;
+						if (ctx.context.oauthConfig.storeStateStrategy === "cookie") return;
+						if (ctx.context._oauthProxySnapshot) return;
+						const state = ctx.query?.state || ctx.body?.state;
+						if (!state) return;
+						const data = await ctx.context.internalAdapter.findVerificationValue(state);
+						if (!data) return;
+						let parsedState;
+						try {
+							parsedState = parseJSON(data.value);
+						} catch {
+							parsedState = void 0;
+						}
+						if (!parsedState?.callbackURL?.includes("/oauth-proxy-callback")) return;
+						ctx.context._oauthProxySnapshot = {
+							storeStateStrategy: ctx.context.oauthConfig.storeStateStrategy,
+							skipStateCookieCheck: ctx.context.oauthConfig.skipStateCookieCheck,
+							internalAdapter: ctx.context.internalAdapter
+						};
+						ctx.context.oauthConfig.skipStateCookieCheck = true;
+					})
+				}
+			],
+			after: [
+				{
+					matcher(context) {
+						return !!(context.path?.startsWith("/sign-in/social") || context.path?.startsWith("/sign-in/oauth2"));
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						if (checkSkipProxy(ctx, opts)) return;
+						if (ctx.context.oauthConfig.storeStateStrategy !== "cookie") return;
+						const signInResponse = ctx.context.returned;
+						if (!signInResponse || typeof signInResponse !== "object" || !("url" in signInResponse)) return;
+						const { url: providerURL } = signInResponse;
+						if (typeof providerURL !== "string") return;
+						const oauthURL = new URL(providerURL);
+						const originalState = oauthURL.searchParams.get("state");
+						if (!originalState) return;
+						const setCookieHeader = ctx.context.responseHeaders?.get("set-cookie");
+						if (!setCookieHeader) return;
+						const stateCookie = ctx.context.createAuthCookie("oauth_state");
+						const stateCookieAttrs = parseSetCookieHeader(setCookieHeader).get(stateCookie.name);
+						if (!stateCookieAttrs?.value) return;
+						const stateCookieValue = stateCookieAttrs.value;
+						try {
+							const statePackage = {
+								state: originalState,
+								stateCookie: stateCookieValue,
+								isOAuthProxy: true
+							};
+							const encryptedPackage = await symmetricEncrypt({
+								key: ctx.context.secret,
+								data: JSON.stringify(statePackage)
+							});
+							oauthURL.searchParams.set("state", encryptedPackage);
+							ctx.context.returned = {
+								...signInResponse,
+								url: oauthURL.toString()
+							};
+						} catch (e) {
+							ctx.context.logger.error("Failed to encrypt OAuth proxy state package:", e);
+						}
+					})
+				},
+				{
+					matcher(context) {
+						return !!(context.path?.startsWith("/callback") || context.path?.startsWith("/oauth2/callback"));
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						const headers = ctx.context.responseHeaders;
+						const location = headers?.get("location");
+						if (!location?.includes("/oauth-proxy-callback?callbackURL") || !location.startsWith("http")) return;
+						const productionOrigin = getOrigin(opts?.productionURL || ctx.context.options.baseURL || ctx.context.baseURL);
+						const locationURL = new URL(location);
+						if (locationURL.origin === productionOrigin) {
+							const newLocation = locationURL.searchParams.get("callbackURL");
+							if (!newLocation) return;
+							ctx.setHeader("location", newLocation);
+							return;
+						}
+						const setCookies = headers?.get("set-cookie");
+						if (!setCookies) return;
+						const payload = {
+							cookies: setCookies,
+							timestamp: Date.now()
+						};
+						const encryptedCookies = await symmetricEncrypt({
+							key: ctx.context.secret,
+							data: JSON.stringify(payload)
+						});
+						const locationWithCookies = `${location}&cookies=${encodeURIComponent(encryptedCookies)}`;
+						ctx.setHeader("location", locationWithCookies);
+					})
+				},
+				{
+					matcher(context) {
+						return !!(context.path?.startsWith("/callback") || context.path?.startsWith("/oauth2/callback"));
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						const contextWithSnapshot = ctx.context;
+						const snapshot = contextWithSnapshot._oauthProxySnapshot;
+						if (snapshot) {
+							ctx.context.oauthConfig.storeStateStrategy = snapshot.storeStateStrategy;
+							ctx.context.oauthConfig.skipStateCookieCheck = snapshot.skipStateCookieCheck;
+							ctx.context.internalAdapter = snapshot.internalAdapter;
+							contextWithSnapshot._oauthProxySnapshot = void 0;
+						}
+					})
+				}
+			]
+		}
+	};
+};
+
+//#endregion
+export { oAuthProxy };
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/oauth-proxy/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/oauth-proxy/index.ts"],"sourcesContent":["import type { BetterAuthPlugin } from \"@better-auth/core\";\nimport {\n\tcreateAuthEndpoint,\n\tcreateAuthMiddleware,\n} from \"@better-auth/core/api\";\nimport type { CookieOptions } from \"better-call\";\nimport * as z from \"zod\";\nimport { originCheck } from \"../../api\";\nimport { parseJSON } from \"../../client/parser\";\nimport { parseSetCookieHeader, stripSecureCookiePrefix } from \"../../cookies\";\nimport { symmetricDecrypt, symmetricEncrypt } from \"../../crypto\";\nimport { getOrigin } from \"../../utils/url\";\nimport type { AuthContextWithSnapshot, OAuthProxyStatePackage } from \"./types\";\nimport { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from \"./utils\";\n\ndeclare module \"@better-auth/core\" {\n\tinterface BetterAuthPluginRegistry<AuthOptions, Options> {\n\t\t\"oauth-proxy\": {\n\t\t\tcreator: typeof oAuthProxy;\n\t\t};\n\t}\n}\n\nexport interface OAuthProxyOptions {\n\t/**\n\t * The current URL of the application.\n\t * The plugin will attempt to infer the current URL from your environment\n\t * by checking the base URL from popular hosting providers,\n\t * from the request URL if invoked by a client,\n\t * or as a fallback, from the `baseURL` in your auth config.\n\t * If the URL is not inferred correctly, you can provide a value here.\"\n\t */\n\tcurrentURL?: string | undefined;\n\t/**\n\t * If a request in a production url it won't be proxied.\n\t *\n\t * default to `BETTER_AUTH_URL`\n\t */\n\tproductionURL?: string | undefined;\n\t/**\n\t * Maximum age in seconds for the encrypted cookies payload.\n\t * Payloads older than this will be rejected to prevent replay attacks.\n\t *\n\t * Keep this value short (e.g., 30-60 seconds) to minimize the window\n\t * for potential replay attacks while still allowing normal OAuth flows.\n\t *\n\t * @default 60 (1 minute)\n\t */\n\tmaxAge?: number | undefined;\n}\n\ninterface EncryptedCookiesPayload {\n\tcookies: string;\n\ttimestamp: number;\n}\n\nconst oAuthProxyQuerySchema = z.object({\n\tcallbackURL: z.string().meta({\n\t\tdescription: \"The URL to redirect to after the proxy\",\n\t}),\n\tcookies: z.string().meta({\n\t\tdescription: \"The cookies to set after the proxy\",\n\t}),\n});\n\nexport const oAuthProxy = <O extends OAuthProxyOptions>(opts?: O) => {\n\tconst maxAge = opts?.maxAge ?? 60; // Default 60 seconds\n\n\treturn {\n\t\tid: \"oauth-proxy\",\n\t\toptions: opts as NoInfer<O>,\n\t\tendpoints: {\n\t\t\toAuthProxy: createAuthEndpoint(\n\t\t\t\t\"/oauth-proxy-callback\",\n\t\t\t\t{\n\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\toperationId: \"oauthProxyCallback\",\n\t\t\t\t\tquery: oAuthProxyQuerySchema,\n\t\t\t\t\tuse: [originCheck((ctx) => ctx.query.callbackURL)],\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\topenapi: {\n\t\t\t\t\t\t\toperationId: \"oauthProxyCallback\",\n\t\t\t\t\t\t\tdescription: \"OAuth Proxy Callback\",\n\t\t\t\t\t\t\tparameters: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\t\t\t\tname: \"callbackURL\",\n\t\t\t\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\t\t\t\tdescription: \"The URL to redirect to after the proxy\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tin: \"query\",\n\t\t\t\t\t\t\t\t\tname: \"cookies\",\n\t\t\t\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\t\t\t\tdescription: \"The cookies to set after the proxy\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\t302: {\n\t\t\t\t\t\t\t\t\tdescription: \"Redirect\",\n\t\t\t\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t\t\t\tLocation: {\n\t\t\t\t\t\t\t\t\t\t\tdescription: \"The URL to redirect to\",\n\t\t\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tasync (ctx) => {\n\t\t\t\t\tlet decryptedPayload: string | null = null;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tdecryptedPayload = await symmetricDecrypt({\n\t\t\t\t\t\t\tkey: ctx.context.secret,\n\t\t\t\t\t\t\tdata: ctx.query.cookies,\n\t\t\t\t\t\t});\n\t\t\t\t\t} catch (e) {\n\t\t\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\t\t\"Failed to decrypt OAuth proxy cookies:\",\n\t\t\t\t\t\t\te,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\tif (!decryptedPayload) {\n\t\t\t\t\t\tconst errorURL =\n\t\t\t\t\t\t\tctx.context.options.onAPIError?.errorURL ||\n\t\t\t\t\t\t\t`${stripTrailingSlash(ctx.context.options.baseURL)}/api/auth/error`;\n\n\t\t\t\t\t\tthrow ctx.redirect(\n\t\t\t\t\t\t\t`${errorURL}?error=OAuthProxy - Invalid cookies or secret`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\tlet payload: EncryptedCookiesPayload;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tpayload = parseJSON<EncryptedCookiesPayload>(decryptedPayload);\n\t\t\t\t\t} catch (e) {\n\t\t\t\t\t\tctx.context.logger.error(\"Failed to parse OAuth proxy payload:\", e);\n\t\t\t\t\t\tconst errorURL =\n\t\t\t\t\t\t\tctx.context.options.onAPIError?.errorURL ||\n\t\t\t\t\t\t\t`${stripTrailingSlash(ctx.context.options.baseURL)}/api/auth/error`;\n\n\t\t\t\t\t\tthrow ctx.redirect(\n\t\t\t\t\t\t\t`${errorURL}?error=OAuthProxy - Invalid payload format`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tif (\n\t\t\t\t\t\t!payload.cookies ||\n\t\t\t\t\t\ttypeof payload.cookies !== \"string\" ||\n\t\t\t\t\t\ttypeof payload.timestamp !== \"number\"\n\t\t\t\t\t) {\n\t\t\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\t\t\"OAuth proxy payload missing required fields\",\n\t\t\t\t\t\t);\n\t\t\t\t\t\tconst errorURL =\n\t\t\t\t\t\t\tctx.context.options.onAPIError?.errorURL ||\n\t\t\t\t\t\t\t`${stripTrailingSlash(ctx.context.options.baseURL)}/api/auth/error`;\n\n\t\t\t\t\t\tthrow ctx.redirect(\n\t\t\t\t\t\t\t`${errorURL}?error=OAuthProxy - Invalid payload structure`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst now = Date.now();\n\t\t\t\t\tconst age = (now - payload.timestamp) / 1000;\n\n\t\t\t\t\t// Allow up to 10 seconds of future skew for clock differences\n\t\t\t\t\tif (age > maxAge || age < -10) {\n\t\t\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\t\t`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tconst errorURL =\n\t\t\t\t\t\t\tctx.context.options.onAPIError?.errorURL ||\n\t\t\t\t\t\t\t`${stripTrailingSlash(ctx.context.options.baseURL)}/api/auth/error`;\n\n\t\t\t\t\t\tthrow ctx.redirect(\n\t\t\t\t\t\t\t`${errorURL}?error=OAuthProxy - Payload expired or invalid`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst decryptedCookies = payload.cookies;\n\n\t\t\t\t\tconst currentURL = resolveCurrentURL(ctx, opts);\n\t\t\t\t\tconst isSecureContext = currentURL.protocol === \"https:\";\n\n\t\t\t\t\tconst parsedCookies = parseSetCookieHeader(decryptedCookies);\n\t\t\t\t\tconst processedCookies = Array.from(parsedCookies.entries()).map(\n\t\t\t\t\t\t([name, attrs]) => {\n\t\t\t\t\t\t\tconst options: CookieOptions = {};\n\t\t\t\t\t\t\tif (attrs.path) {\n\t\t\t\t\t\t\t\toptions.path = attrs.path;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (attrs.expires) {\n\t\t\t\t\t\t\t\toptions.expires = attrs.expires;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (attrs.samesite) {\n\t\t\t\t\t\t\t\toptions.sameSite = attrs.samesite;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (attrs.httponly) {\n\t\t\t\t\t\t\t\toptions.httpOnly = true;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (attrs[\"max-age\"] !== undefined) {\n\t\t\t\t\t\t\t\toptions.maxAge = attrs[\"max-age\"];\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (isSecureContext) {\n\t\t\t\t\t\t\t\toptions.secure = true;\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t// Remove __Secure- or __Host- prefix for non-HTTPS contexts\n\t\t\t\t\t\t\tconst cookieName = isSecureContext\n\t\t\t\t\t\t\t\t? name\n\t\t\t\t\t\t\t\t: stripSecureCookiePrefix(name);\n\n\t\t\t\t\t\t\t// URI-decoded value because `ctx.setCookie` will URI-encode it again\n\t\t\t\t\t\t\tlet cookieValue: string;\n\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\tcookieValue = decodeURIComponent(attrs.value);\n\t\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\t\tcookieValue = attrs.value;\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tname: cookieName,\n\t\t\t\t\t\t\t\tvalue: cookieValue,\n\t\t\t\t\t\t\t\toptions,\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t},\n\t\t\t\t\t);\n\n\t\t\t\t\tfor (const cookie of processedCookies) {\n\t\t\t\t\t\t// using `ctx.setHeader` overrides previous Set-Cookie headers\n\t\t\t\t\t\t// so use ctx.setCookie helper instead\n\t\t\t\t\t\t// https://github.com/Bekacru/better-call/blob/d27ac20e64b329a4851e97adf864098a9bc2a260/src/context.ts#L217\n\t\t\t\t\t\tctx.setCookie(cookie.name, cookie.value, cookie.options);\n\t\t\t\t\t}\n\t\t\t\t\tthrow ctx.redirect(ctx.query.callbackURL);\n\t\t\t\t},\n\t\t\t),\n\t\t},\n\t\thooks: {\n\t\t\tbefore: [\n\t\t\t\t{\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn !!(\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/sign-in/social\") ||\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/sign-in/oauth2\")\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst skipProxy = checkSkipProxy(ctx, opts);\n\t\t\t\t\t\tif (skipProxy) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst currentURL = resolveCurrentURL(ctx, opts);\n\t\t\t\t\t\tconst productionURL = opts?.productionURL;\n\t\t\t\t\t\tconst originalCallbackURL =\n\t\t\t\t\t\t\tctx.body?.callbackURL || ctx.context.baseURL;\n\n\t\t\t\t\t\t// Override baseURL to production so redirect_uri points to production\n\t\t\t\t\t\t// This ensures OAuth provider callbacks go to the production server\n\t\t\t\t\t\tif (productionURL) {\n\t\t\t\t\t\t\tconst productionBaseURL = `${stripTrailingSlash(productionURL)}${ctx.context.options.basePath || \"/api/auth\"}`;\n\t\t\t\t\t\t\tctx.context.baseURL = productionBaseURL;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Construct proxy callback URL\n\t\t\t\t\t\tconst newCallbackURL = `${stripTrailingSlash(currentURL.origin)}${\n\t\t\t\t\t\t\tctx.context.options.basePath || \"/api/auth\"\n\t\t\t\t\t\t}/oauth-proxy-callback?callbackURL=${encodeURIComponent(\n\t\t\t\t\t\t\toriginalCallbackURL,\n\t\t\t\t\t\t)}`;\n\n\t\t\t\t\t\tif (!ctx.body) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tctx.body.callbackURL = newCallbackURL;\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn !!(\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/callback\") ||\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/oauth2/callback\")\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst state = ctx.query?.state || ctx.body?.state;\n\t\t\t\t\t\tif (!state || typeof state !== \"string\") {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Try to decrypt and parse OAuth proxy state package\n\t\t\t\t\t\tlet statePackage: OAuthProxyStatePackage | undefined;\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tconst decryptedPackage = await symmetricDecrypt({\n\t\t\t\t\t\t\t\tkey: ctx.context.secret,\n\t\t\t\t\t\t\t\tdata: state,\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tstatePackage =\n\t\t\t\t\t\t\t\tparseJSON<OAuthProxyStatePackage>(decryptedPackage);\n\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\t// Not an OAuth proxy state, continue normally\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t!statePackage.isOAuthProxy ||\n\t\t\t\t\t\t\t!statePackage.state ||\n\t\t\t\t\t\t\t!statePackage.stateCookie\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Decrypt the state cookie content\n\t\t\t\t\t\tlet stateCookieValue: string;\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tstateCookieValue = await symmetricDecrypt({\n\t\t\t\t\t\t\t\tkey: ctx.context.secret,\n\t\t\t\t\t\t\t\tdata: statePackage.stateCookie,\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tparseJSON(stateCookieValue);\n\t\t\t\t\t\t} catch (e) {\n\t\t\t\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\t\t\t\"Failed to decrypt OAuth proxy state cookie:\",\n\t\t\t\t\t\t\t\te,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Snapshot original configuration for restoration in after hook\n\t\t\t\t\t\t(ctx.context as AuthContextWithSnapshot)._oauthProxySnapshot = {\n\t\t\t\t\t\t\tstoreStateStrategy: ctx.context.oauthConfig.storeStateStrategy,\n\t\t\t\t\t\t\tskipStateCookieCheck:\n\t\t\t\t\t\t\t\tctx.context.oauthConfig.skipStateCookieCheck,\n\t\t\t\t\t\t\tinternalAdapter: ctx.context.internalAdapter,\n\t\t\t\t\t\t};\n\n\t\t\t\t\t\t// Temporarily switch to database mode and inject verification value\n\t\t\t\t\t\t// This allows the OAuth callback handler to retrieve state data without database\n\t\t\t\t\t\tconst originalAdapter = ctx.context.internalAdapter;\n\t\t\t\t\t\tconst capturedStatePackage = statePackage;\n\t\t\t\t\t\tctx.context.oauthConfig.storeStateStrategy = \"database\";\n\t\t\t\t\t\tctx.context.internalAdapter = {\n\t\t\t\t\t\t\t...ctx.context.internalAdapter,\n\t\t\t\t\t\t\tfindVerificationValue: async (identifier: string) => {\n\t\t\t\t\t\t\t\tif (identifier === capturedStatePackage.state) {\n\t\t\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\t\t\tid: `oauth-proxy-${capturedStatePackage.state}`,\n\t\t\t\t\t\t\t\t\t\tidentifier: capturedStatePackage.state,\n\t\t\t\t\t\t\t\t\t\tvalue: stateCookieValue,\n\t\t\t\t\t\t\t\t\t\tcreatedAt: new Date(),\n\t\t\t\t\t\t\t\t\t\tupdatedAt: new Date(),\n\t\t\t\t\t\t\t\t\t\t// Align expiration time with `generateState` in oauth2\n\t\t\t\t\t\t\t\t\t\texpiresAt: new Date(Date.now() + 10 * 60 * 1000),\n\t\t\t\t\t\t\t\t\t};\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\treturn originalAdapter.findVerificationValue(identifier);\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t};\n\n\t\t\t\t\t\t// Restore original state parameter\n\t\t\t\t\t\tif (ctx.query?.state) {\n\t\t\t\t\t\t\tctx.query.state = statePackage.state;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (ctx.body?.state) {\n\t\t\t\t\t\t\tctx.body.state = statePackage.state;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Enable skipStateCookieCheck for database mode\n\t\t\t\t\t\tctx.context.oauthConfig.skipStateCookieCheck = true;\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tmatcher() {\n\t\t\t\t\t\treturn true;\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tif (ctx.path !== \"/callback/:id\") {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (ctx.context.oauthConfig.storeStateStrategy === \"cookie\") {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Skip if OAuth proxy stateless flow already handled by previous hook\n\t\t\t\t\t\tif ((ctx.context as AuthContextWithSnapshot)._oauthProxySnapshot) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst state = ctx.query?.state || ctx.body?.state;\n\t\t\t\t\t\tif (!state) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst data =\n\t\t\t\t\t\t\tawait ctx.context.internalAdapter.findVerificationValue(state);\n\t\t\t\t\t\tif (!data) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tlet parsedState: { callbackURL?: string } | undefined;\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tparsedState = parseJSON<{ callbackURL?: string }>(data.value);\n\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\tparsedState = undefined;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (!parsedState?.callbackURL?.includes(\"/oauth-proxy-callback\")) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Snapshot original configuration for restoration in after hook\n\t\t\t\t\t\t(ctx.context as AuthContextWithSnapshot)._oauthProxySnapshot = {\n\t\t\t\t\t\t\tstoreStateStrategy: ctx.context.oauthConfig.storeStateStrategy,\n\t\t\t\t\t\t\tskipStateCookieCheck:\n\t\t\t\t\t\t\t\tctx.context.oauthConfig.skipStateCookieCheck,\n\t\t\t\t\t\t\tinternalAdapter: ctx.context.internalAdapter,\n\t\t\t\t\t\t};\n\n\t\t\t\t\t\tctx.context.oauthConfig.skipStateCookieCheck = true;\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t\tafter: [\n\t\t\t\t{\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn !!(\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/sign-in/social\") ||\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/sign-in/oauth2\")\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst skipProxy = checkSkipProxy(ctx, opts);\n\t\t\t\t\t\tif (skipProxy) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Only process in stateless mode\n\t\t\t\t\t\tif (ctx.context.oauthConfig.storeStateStrategy !== \"cookie\") {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Extract OAuth provider URL from sign-in response\n\t\t\t\t\t\tconst signInResponse = ctx.context.returned;\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t!signInResponse ||\n\t\t\t\t\t\t\ttypeof signInResponse !== \"object\" ||\n\t\t\t\t\t\t\t!(\"url\" in signInResponse)\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst { url: providerURL } = signInResponse;\n\t\t\t\t\t\tif (typeof providerURL !== \"string\") {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Parse provider URL and extract state parameter\n\t\t\t\t\t\tconst oauthURL = new URL(providerURL);\n\t\t\t\t\t\tconst originalState = oauthURL.searchParams.get(\"state\");\n\t\t\t\t\t\tif (!originalState) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Extract state cookie from response headers\n\t\t\t\t\t\tconst headers = ctx.context.responseHeaders;\n\t\t\t\t\t\tconst setCookieHeader = headers?.get(\"set-cookie\");\n\t\t\t\t\t\tif (!setCookieHeader) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst stateCookie = ctx.context.createAuthCookie(\"oauth_state\");\n\t\t\t\t\t\tconst parsedStateCookies = parseSetCookieHeader(setCookieHeader);\n\t\t\t\t\t\tconst stateCookieAttrs = parsedStateCookies.get(stateCookie.name);\n\t\t\t\t\t\tif (!stateCookieAttrs?.value) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst stateCookieValue = stateCookieAttrs.value;\n\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t// Create and encrypt state package\n\t\t\t\t\t\t\tconst statePackage: OAuthProxyStatePackage = {\n\t\t\t\t\t\t\t\tstate: originalState,\n\t\t\t\t\t\t\t\tstateCookie: stateCookieValue,\n\t\t\t\t\t\t\t\tisOAuthProxy: true,\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t\tconst encryptedPackage = await symmetricEncrypt({\n\t\t\t\t\t\t\t\tkey: ctx.context.secret,\n\t\t\t\t\t\t\t\tdata: JSON.stringify(statePackage),\n\t\t\t\t\t\t\t});\n\n\t\t\t\t\t\t\t// Replace state parameter with encrypted package\n\t\t\t\t\t\t\toauthURL.searchParams.set(\"state\", encryptedPackage);\n\n\t\t\t\t\t\t\t// Update response with modified URL\n\t\t\t\t\t\t\tctx.context.returned = {\n\t\t\t\t\t\t\t\t...signInResponse,\n\t\t\t\t\t\t\t\turl: oauthURL.toString(),\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t} catch (e) {\n\t\t\t\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\t\t\t\"Failed to encrypt OAuth proxy state package:\",\n\t\t\t\t\t\t\t\te,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t// Continue without proxy\n\t\t\t\t\t\t}\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn !!(\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/callback\") ||\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/oauth2/callback\")\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst headers = ctx.context.responseHeaders;\n\t\t\t\t\t\tconst location = headers?.get(\"location\");\n\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t!location?.includes(\"/oauth-proxy-callback?callbackURL\") ||\n\t\t\t\t\t\t\t!location.startsWith(\"http\")\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst productionURL =\n\t\t\t\t\t\t\topts?.productionURL ||\n\t\t\t\t\t\t\tctx.context.options.baseURL ||\n\t\t\t\t\t\t\tctx.context.baseURL;\n\t\t\t\t\t\tconst productionOrigin = getOrigin(productionURL);\n\n\t\t\t\t\t\tconst locationURL = new URL(location);\n\t\t\t\t\t\tconst locationOrigin = locationURL.origin;\n\n\t\t\t\t\t\t//\n\t\t\t\t\t\t// Same origin: unwrap proxy redirect to original destination\n\t\t\t\t\t\t//\n\t\t\t\t\t\tif (locationOrigin === productionOrigin) {\n\t\t\t\t\t\t\tconst newLocation = locationURL.searchParams.get(\"callbackURL\");\n\t\t\t\t\t\t\tif (!newLocation) {\n\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tctx.setHeader(\"location\", newLocation);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t//\n\t\t\t\t\t\t// Cross-origin: encrypt and forward cookies through proxy\n\t\t\t\t\t\t//\n\t\t\t\t\t\tconst setCookies = headers?.get(\"set-cookie\");\n\t\t\t\t\t\tif (!setCookies) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Create payload with timestamp for replay attack protection\n\t\t\t\t\t\tconst payload: EncryptedCookiesPayload = {\n\t\t\t\t\t\t\tcookies: setCookies,\n\t\t\t\t\t\t\ttimestamp: Date.now(),\n\t\t\t\t\t\t};\n\n\t\t\t\t\t\tconst encryptedCookies = await symmetricEncrypt({\n\t\t\t\t\t\t\tkey: ctx.context.secret,\n\t\t\t\t\t\t\tdata: JSON.stringify(payload),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tconst locationWithCookies = `${location}&cookies=${encodeURIComponent(\n\t\t\t\t\t\t\tencryptedCookies,\n\t\t\t\t\t\t)}`;\n\n\t\t\t\t\t\tctx.setHeader(\"location\", locationWithCookies);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\t// Restore OAuth config after processing callback\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn !!(\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/callback\") ||\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/oauth2/callback\")\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst contextWithSnapshot = ctx.context as AuthContextWithSnapshot;\n\t\t\t\t\t\tconst snapshot = contextWithSnapshot._oauthProxySnapshot;\n\t\t\t\t\t\tif (snapshot) {\n\t\t\t\t\t\t\tctx.context.oauthConfig.storeStateStrategy =\n\t\t\t\t\t\t\t\tsnapshot.storeStateStrategy;\n\t\t\t\t\t\t\tctx.context.oauthConfig.skipStateCookieCheck =\n\t\t\t\t\t\t\t\tsnapshot.skipStateCookieCheck;\n\t\t\t\t\t\t\tctx.context.internalAdapter = snapshot.internalAdapter;\n\n\t\t\t\t\t\t\t// Clear the temporary extended context value\n\t\t\t\t\t\t\tcontextWithSnapshot._oauthProxySnapshot = undefined;\n\t\t\t\t\t\t}\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;;;;;;AAwDA,MAAM,wBAAwB,EAAE,OAAO;CACtC,aAAa,EAAE,QAAQ,CAAC,KAAK,EAC5B,aAAa,0CACb,CAAC;CACF,SAAS,EAAE,QAAQ,CAAC,KAAK,EACxB,aAAa,sCACb,CAAC;CACF,CAAC;AAEF,MAAa,cAA2C,SAAa;CACpE,MAAM,SAAS,MAAM,UAAU;AAE/B,QAAO;EACN,IAAI;EACJ,SAAS;EACT,WAAW,EACV,YAAY,mBACX,yBACA;GACC,QAAQ;GACR,aAAa;GACb,OAAO;GACP,KAAK,CAAC,aAAa,QAAQ,IAAI,MAAM,YAAY,CAAC;GAClD,UAAU,EACT,SAAS;IACR,aAAa;IACb,aAAa;IACb,YAAY,CACX;KACC,IAAI;KACJ,MAAM;KACN,UAAU;KACV,aAAa;KACb,EACD;KACC,IAAI;KACJ,MAAM;KACN,UAAU;KACV,aAAa;KACb,CACD;IACD,WAAW,EACV,KAAK;KACJ,aAAa;KACb,SAAS,EACR,UAAU;MACT,aAAa;MACb,QAAQ,EACP,MAAM,UACN;MACD,EACD;KACD,EACD;IACD,EACD;GACD,EACD,OAAO,QAAQ;GACd,IAAI,mBAAkC;AACtC,OAAI;AACH,uBAAmB,MAAM,iBAAiB;KACzC,KAAK,IAAI,QAAQ;KACjB,MAAM,IAAI,MAAM;KAChB,CAAC;YACM,GAAG;AACX,QAAI,QAAQ,OAAO,MAClB,0CACA,EACA;;AAGF,OAAI,CAAC,kBAAkB;IACtB,MAAM,WACL,IAAI,QAAQ,QAAQ,YAAY,YAChC,GAAG,mBAAmB,IAAI,QAAQ,QAAQ,QAAQ,CAAC;AAEpD,UAAM,IAAI,SACT,GAAG,SAAS,+CACZ;;GAGF,IAAI;AACJ,OAAI;AACH,cAAU,UAAmC,iBAAiB;YACtD,GAAG;AACX,QAAI,QAAQ,OAAO,MAAM,wCAAwC,EAAE;IACnE,MAAM,WACL,IAAI,QAAQ,QAAQ,YAAY,YAChC,GAAG,mBAAmB,IAAI,QAAQ,QAAQ,QAAQ,CAAC;AAEpD,UAAM,IAAI,SACT,GAAG,SAAS,4CACZ;;AAEF,OACC,CAAC,QAAQ,WACT,OAAO,QAAQ,YAAY,YAC3B,OAAO,QAAQ,cAAc,UAC5B;AACD,QAAI,QAAQ,OAAO,MAClB,8CACA;IACD,MAAM,WACL,IAAI,QAAQ,QAAQ,YAAY,YAChC,GAAG,mBAAmB,IAAI,QAAQ,QAAQ,QAAQ,CAAC;AAEpD,UAAM,IAAI,SACT,GAAG,SAAS,+CACZ;;GAIF,MAAM,OADM,KAAK,KAAK,GACH,QAAQ,aAAa;AAGxC,OAAI,MAAM,UAAU,MAAM,KAAK;AAC9B,QAAI,QAAQ,OAAO,MAClB,gDAAgD,IAAI,aAAa,OAAO,IACxE;IACD,MAAM,WACL,IAAI,QAAQ,QAAQ,YAAY,YAChC,GAAG,mBAAmB,IAAI,QAAQ,QAAQ,QAAQ,CAAC;AAEpD,UAAM,IAAI,SACT,GAAG,SAAS,gDACZ;;GAGF,MAAM,mBAAmB,QAAQ;GAGjC,MAAM,kBADa,kBAAkB,KAAK,KAAK,CACZ,aAAa;GAEhD,MAAM,gBAAgB,qBAAqB,iBAAiB;GAC5D,MAAM,mBAAmB,MAAM,KAAK,cAAc,SAAS,CAAC,CAAC,KAC3D,CAAC,MAAM,WAAW;IAClB,MAAM,UAAyB,EAAE;AACjC,QAAI,MAAM,KACT,SAAQ,OAAO,MAAM;AAEtB,QAAI,MAAM,QACT,SAAQ,UAAU,MAAM;AAEzB,QAAI,MAAM,SACT,SAAQ,WAAW,MAAM;AAE1B,QAAI,MAAM,SACT,SAAQ,WAAW;AAEpB,QAAI,MAAM,eAAe,OACxB,SAAQ,SAAS,MAAM;AAExB,QAAI,gBACH,SAAQ,SAAS;IAIlB,MAAM,aAAa,kBAChB,OACA,wBAAwB,KAAK;IAGhC,IAAI;AACJ,QAAI;AACH,mBAAc,mBAAmB,MAAM,MAAM;YACtC;AACP,mBAAc,MAAM;;AAGrB,WAAO;KACN,MAAM;KACN,OAAO;KACP;KACA;KAEF;AAED,QAAK,MAAM,UAAU,iBAIpB,KAAI,UAAU,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ;AAEzD,SAAM,IAAI,SAAS,IAAI,MAAM,YAAY;IAE1C,EACD;EACD,OAAO;GACN,QAAQ;IACP;KACC,QAAQ,SAAS;AAChB,aAAO,CAAC,EACP,QAAQ,MAAM,WAAW,kBAAkB,IAC3C,QAAQ,MAAM,WAAW,kBAAkB;;KAG7C,SAAS,qBAAqB,OAAO,QAAQ;AAE5C,UADkB,eAAe,KAAK,KAAK,CAE1C;MAGD,MAAM,aAAa,kBAAkB,KAAK,KAAK;MAC/C,MAAM,gBAAgB,MAAM;MAC5B,MAAM,sBACL,IAAI,MAAM,eAAe,IAAI,QAAQ;AAItC,UAAI,eAAe;OAClB,MAAM,oBAAoB,GAAG,mBAAmB,cAAc,GAAG,IAAI,QAAQ,QAAQ,YAAY;AACjG,WAAI,QAAQ,UAAU;;MAIvB,MAAM,iBAAiB,GAAG,mBAAmB,WAAW,OAAO,GAC9D,IAAI,QAAQ,QAAQ,YAAY,YAChC,oCAAoC,mBACpC,oBACA;AAED,UAAI,CAAC,IAAI,KACR;AAGD,UAAI,KAAK,cAAc;OACtB;KACF;IACD;KACC,QAAQ,SAAS;AAChB,aAAO,CAAC,EACP,QAAQ,MAAM,WAAW,YAAY,IACrC,QAAQ,MAAM,WAAW,mBAAmB;;KAG9C,SAAS,qBAAqB,OAAO,QAAQ;MAC5C,MAAM,QAAQ,IAAI,OAAO,SAAS,IAAI,MAAM;AAC5C,UAAI,CAAC,SAAS,OAAO,UAAU,SAC9B;MAID,IAAI;AACJ,UAAI;AAKH,sBACC,UALwB,MAAM,iBAAiB;QAC/C,KAAK,IAAI,QAAQ;QACjB,MAAM;QACN,CAAC,CAEkD;cAC7C;AAEP;;AAGD,UACC,CAAC,aAAa,gBACd,CAAC,aAAa,SACd,CAAC,aAAa,YAEd;MAID,IAAI;AACJ,UAAI;AACH,0BAAmB,MAAM,iBAAiB;QACzC,KAAK,IAAI,QAAQ;QACjB,MAAM,aAAa;QACnB,CAAC;AACF,iBAAU,iBAAiB;eACnB,GAAG;AACX,WAAI,QAAQ,OAAO,MAClB,+CACA,EACA;AACD;;AAID,MAAC,IAAI,QAAoC,sBAAsB;OAC9D,oBAAoB,IAAI,QAAQ,YAAY;OAC5C,sBACC,IAAI,QAAQ,YAAY;OACzB,iBAAiB,IAAI,QAAQ;OAC7B;MAID,MAAM,kBAAkB,IAAI,QAAQ;MACpC,MAAM,uBAAuB;AAC7B,UAAI,QAAQ,YAAY,qBAAqB;AAC7C,UAAI,QAAQ,kBAAkB;OAC7B,GAAG,IAAI,QAAQ;OACf,uBAAuB,OAAO,eAAuB;AACpD,YAAI,eAAe,qBAAqB,MACvC,QAAO;SACN,IAAI,eAAe,qBAAqB;SACxC,YAAY,qBAAqB;SACjC,OAAO;SACP,2BAAW,IAAI,MAAM;SACrB,2BAAW,IAAI,MAAM;SAErB,WAAW,IAAI,KAAK,KAAK,KAAK,GAAG,MAAU,IAAK;SAChD;AAEF,eAAO,gBAAgB,sBAAsB,WAAW;;OAEzD;AAGD,UAAI,IAAI,OAAO,MACd,KAAI,MAAM,QAAQ,aAAa;AAEhC,UAAI,IAAI,MAAM,MACb,KAAI,KAAK,QAAQ,aAAa;AAI/B,UAAI,QAAQ,YAAY,uBAAuB;OAC9C;KACF;IACD;KACC,UAAU;AACT,aAAO;;KAER,SAAS,qBAAqB,OAAO,QAAQ;AAC5C,UAAI,IAAI,SAAS,gBAChB;AAED,UAAI,IAAI,QAAQ,YAAY,uBAAuB,SAClD;AAID,UAAK,IAAI,QAAoC,oBAC5C;MAGD,MAAM,QAAQ,IAAI,OAAO,SAAS,IAAI,MAAM;AAC5C,UAAI,CAAC,MACJ;MAED,MAAM,OACL,MAAM,IAAI,QAAQ,gBAAgB,sBAAsB,MAAM;AAC/D,UAAI,CAAC,KACJ;MAGD,IAAI;AACJ,UAAI;AACH,qBAAc,UAAoC,KAAK,MAAM;cACtD;AACP,qBAAc;;AAEf,UAAI,CAAC,aAAa,aAAa,SAAS,wBAAwB,CAC/D;AAID,MAAC,IAAI,QAAoC,sBAAsB;OAC9D,oBAAoB,IAAI,QAAQ,YAAY;OAC5C,sBACC,IAAI,QAAQ,YAAY;OACzB,iBAAiB,IAAI,QAAQ;OAC7B;AAED,UAAI,QAAQ,YAAY,uBAAuB;OAC9C;KACF;IACD;GACD,OAAO;IACN;KACC,QAAQ,SAAS;AAChB,aAAO,CAAC,EACP,QAAQ,MAAM,WAAW,kBAAkB,IAC3C,QAAQ,MAAM,WAAW,kBAAkB;;KAG7C,SAAS,qBAAqB,OAAO,QAAQ;AAE5C,UADkB,eAAe,KAAK,KAAK,CAE1C;AAID,UAAI,IAAI,QAAQ,YAAY,uBAAuB,SAClD;MAID,MAAM,iBAAiB,IAAI,QAAQ;AACnC,UACC,CAAC,kBACD,OAAO,mBAAmB,YAC1B,EAAE,SAAS,gBAEX;MAGD,MAAM,EAAE,KAAK,gBAAgB;AAC7B,UAAI,OAAO,gBAAgB,SAC1B;MAID,MAAM,WAAW,IAAI,IAAI,YAAY;MACrC,MAAM,gBAAgB,SAAS,aAAa,IAAI,QAAQ;AACxD,UAAI,CAAC,cACJ;MAKD,MAAM,kBADU,IAAI,QAAQ,iBACK,IAAI,aAAa;AAClD,UAAI,CAAC,gBACJ;MAGD,MAAM,cAAc,IAAI,QAAQ,iBAAiB,cAAc;MAE/D,MAAM,mBADqB,qBAAqB,gBAAgB,CACpB,IAAI,YAAY,KAAK;AACjE,UAAI,CAAC,kBAAkB,MACtB;MAGD,MAAM,mBAAmB,iBAAiB;AAE1C,UAAI;OAEH,MAAM,eAAuC;QAC5C,OAAO;QACP,aAAa;QACb,cAAc;QACd;OACD,MAAM,mBAAmB,MAAM,iBAAiB;QAC/C,KAAK,IAAI,QAAQ;QACjB,MAAM,KAAK,UAAU,aAAa;QAClC,CAAC;AAGF,gBAAS,aAAa,IAAI,SAAS,iBAAiB;AAGpD,WAAI,QAAQ,WAAW;QACtB,GAAG;QACH,KAAK,SAAS,UAAU;QACxB;eACO,GAAG;AACX,WAAI,QAAQ,OAAO,MAClB,gDACA,EACA;;OAGD;KACF;IACD;KACC,QAAQ,SAAS;AAChB,aAAO,CAAC,EACP,QAAQ,MAAM,WAAW,YAAY,IACrC,QAAQ,MAAM,WAAW,mBAAmB;;KAG9C,SAAS,qBAAqB,OAAO,QAAQ;MAC5C,MAAM,UAAU,IAAI,QAAQ;MAC5B,MAAM,WAAW,SAAS,IAAI,WAAW;AAEzC,UACC,CAAC,UAAU,SAAS,oCAAoC,IACxD,CAAC,SAAS,WAAW,OAAO,CAE5B;MAOD,MAAM,mBAAmB,UAHxB,MAAM,iBACN,IAAI,QAAQ,QAAQ,WACpB,IAAI,QAAQ,QACoC;MAEjD,MAAM,cAAc,IAAI,IAAI,SAAS;AAMrC,UALuB,YAAY,WAKZ,kBAAkB;OACxC,MAAM,cAAc,YAAY,aAAa,IAAI,cAAc;AAC/D,WAAI,CAAC,YACJ;AAED,WAAI,UAAU,YAAY,YAAY;AACtC;;MAMD,MAAM,aAAa,SAAS,IAAI,aAAa;AAC7C,UAAI,CAAC,WACJ;MAID,MAAM,UAAmC;OACxC,SAAS;OACT,WAAW,KAAK,KAAK;OACrB;MAED,MAAM,mBAAmB,MAAM,iBAAiB;OAC/C,KAAK,IAAI,QAAQ;OACjB,MAAM,KAAK,UAAU,QAAQ;OAC7B,CAAC;MACF,MAAM,sBAAsB,GAAG,SAAS,WAAW,mBAClD,iBACA;AAED,UAAI,UAAU,YAAY,oBAAoB;OAE7C;KACF;IACD;KAEC,QAAQ,SAAS;AAChB,aAAO,CAAC,EACP,QAAQ,MAAM,WAAW,YAAY,IACrC,QAAQ,MAAM,WAAW,mBAAmB;;KAG9C,SAAS,qBAAqB,OAAO,QAAQ;MAC5C,MAAM,sBAAsB,IAAI;MAChC,MAAM,WAAW,oBAAoB;AACrC,UAAI,UAAU;AACb,WAAI,QAAQ,YAAY,qBACvB,SAAS;AACV,WAAI,QAAQ,YAAY,uBACvB,SAAS;AACV,WAAI,QAAQ,kBAAkB,SAAS;AAGvC,2BAAoB,sBAAsB;;OAE1C;KACF;IACD;GACD;EACD"}

package/dist/plugins/oauth-proxy/utils.mjs

@@ -0,0 +1,44 @@
+import { getOrigin } from "../../utils/url.mjs";
+import { env } from "@better-auth/core/env";
+
+//#region src/plugins/oauth-proxy/utils.ts
+/**
+* Strip trailing slashes from URL to prevent double slashes
+*/
+function stripTrailingSlash(url) {
+	if (!url) return "";
+	return url.replace(/\/+$/, "");
+}
+/**
+* Get base URL from vendor-specific environment variables
+*/
+function getVendorBaseURL() {
+	const vercel = env.VERCEL_URL ? `https://${env.VERCEL_URL}` : void 0;
+	const netlify = env.NETLIFY_URL;
+	const render = env.RENDER_URL;
+	const aws = env.AWS_LAMBDA_FUNCTION_NAME;
+	const google = env.GOOGLE_CLOUD_FUNCTION_NAME;
+	const azure = env.AZURE_FUNCTION_NAME;
+	return vercel || netlify || render || aws || google || azure;
+}
+/**
+* Resolve the current URL from various sources
+*/
+function resolveCurrentURL(ctx, opts) {
+	return new URL(opts?.currentURL || ctx.request?.url || getVendorBaseURL() || ctx.context.baseURL);
+}
+/**
+* Check if the proxy should be skipped for this request
+*/
+function checkSkipProxy(ctx, opts) {
+	if (ctx.request?.headers.get("x-skip-oauth-proxy")) return true;
+	const productionURL = opts?.productionURL || env.BETTER_AUTH_URL;
+	if (!productionURL) return false;
+	const currentURL = ctx.request?.url || getVendorBaseURL();
+	if (!currentURL) return false;
+	return getOrigin(productionURL) === getOrigin(currentURL);
+}
+
+//#endregion
+export { checkSkipProxy, resolveCurrentURL, stripTrailingSlash };
+//# sourceMappingURL=utils.mjs.map

package/dist/plugins/oauth-proxy/utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.mjs","names":[],"sources":["../../../src/plugins/oauth-proxy/utils.ts"],"sourcesContent":["import { env } from \"@better-auth/core/env\";\nimport type { EndpointContext } from \"better-call\";\nimport { getOrigin } from \"../../utils/url\";\nimport type { OAuthProxyOptions } from \"./index\";\n\n/**\n * Strip trailing slashes from URL to prevent double slashes\n */\nexport function stripTrailingSlash(url: string | undefined): string {\n\tif (!url) return \"\";\n\treturn url.replace(/\\/+$/, \"\");\n}\n\n/**\n * Get base URL from vendor-specific environment variables\n */\nfunction getVendorBaseURL() {\n\tconst vercel = env.VERCEL_URL ? `https://${env.VERCEL_URL}` : undefined;\n\tconst netlify = env.NETLIFY_URL;\n\tconst render = env.RENDER_URL;\n\tconst aws = env.AWS_LAMBDA_FUNCTION_NAME;\n\tconst google = env.GOOGLE_CLOUD_FUNCTION_NAME;\n\tconst azure = env.AZURE_FUNCTION_NAME;\n\n\treturn vercel || netlify || render || aws || google || azure;\n}\n\n/**\n * Resolve the current URL from various sources\n */\nexport function resolveCurrentURL(\n\tctx: EndpointContext<string, any>,\n\topts?: OAuthProxyOptions,\n) {\n\treturn new URL(\n\t\topts?.currentURL ||\n\t\t\tctx.request?.url ||\n\t\t\tgetVendorBaseURL() ||\n\t\t\tctx.context.baseURL,\n\t);\n}\n\n/**\n * Check if the proxy should be skipped for this request\n */\nexport function checkSkipProxy(\n\tctx: EndpointContext<string, any>,\n\topts?: OAuthProxyOptions,\n) {\n\t// If skip proxy header is set, we don't need to proxy\n\tconst skipProxyHeader = ctx.request?.headers.get(\"x-skip-oauth-proxy\");\n\tif (skipProxyHeader) {\n\t\treturn true;\n\t}\n\n\tconst productionURL = opts?.productionURL || env.BETTER_AUTH_URL;\n\tif (!productionURL) {\n\t\treturn false;\n\t}\n\n\tconst currentURL = ctx.request?.url || getVendorBaseURL();\n\tif (!currentURL) {\n\t\treturn false;\n\t}\n\n\tconst productionOrigin = getOrigin(productionURL);\n\tconst currentOrigin = getOrigin(currentURL);\n\n\treturn productionOrigin === currentOrigin;\n}\n"],"mappings":";;;;;;;AAQA,SAAgB,mBAAmB,KAAiC;AACnE,KAAI,CAAC,IAAK,QAAO;AACjB,QAAO,IAAI,QAAQ,QAAQ,GAAG;;;;;AAM/B,SAAS,mBAAmB;CAC3B,MAAM,SAAS,IAAI,aAAa,WAAW,IAAI,eAAe;CAC9D,MAAM,UAAU,IAAI;CACpB,MAAM,SAAS,IAAI;CACnB,MAAM,MAAM,IAAI;CAChB,MAAM,SAAS,IAAI;CACnB,MAAM,QAAQ,IAAI;AAElB,QAAO,UAAU,WAAW,UAAU,OAAO,UAAU;;;;;AAMxD,SAAgB,kBACf,KACA,MACC;AACD,QAAO,IAAI,IACV,MAAM,cACL,IAAI,SAAS,OACb,kBAAkB,IAClB,IAAI,QAAQ,QACb;;;;;AAMF,SAAgB,eACf,KACA,MACC;AAGD,KADwB,IAAI,SAAS,QAAQ,IAAI,qBAAqB,CAErE,QAAO;CAGR,MAAM,gBAAgB,MAAM,iBAAiB,IAAI;AACjD,KAAI,CAAC,cACJ,QAAO;CAGR,MAAM,aAAa,IAAI,SAAS,OAAO,kBAAkB;AACzD,KAAI,CAAC,WACJ,QAAO;AAMR,QAHyB,UAAU,cAAc,KAC3B,UAAU,WAAW"}

package/dist/plugins/oidc-provider/authorize.mjs

@@ -0,0 +1,194 @@
+import { generateRandomString } from "../../crypto/random.mjs";
+import "../../crypto/index.mjs";
+import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import "../../api/index.mjs";
+import { parsePrompt } from "./utils/prompt.mjs";
+import { getClient } from "./index.mjs";
+import { APIError } from "@better-auth/core/error";
+
+//#region src/plugins/oidc-provider/authorize.ts
+function formatErrorURL(url, error, description) {
+	return `${url.includes("?") ? "&" : "?"}error=${error}&error_description=${description}`;
+}
+function getErrorURL(ctx, error, description) {
+	return formatErrorURL(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, error, description);
+}
+async function authorize(ctx, options) {
+	const handleRedirect = (url) => {
+		if (ctx.request?.headers.get("sec-fetch-mode") === "cors") return ctx.json({
+			redirect: true,
+			url
+		});
+		else throw ctx.redirect(url);
+	};
+	const opts = {
+		codeExpiresIn: 600,
+		defaultScope: "openid",
+		...options,
+		scopes: [
+			"openid",
+			"profile",
+			"email",
+			"offline_access",
+			...options?.scopes || []
+		]
+	};
+	if (!ctx.request) throw new APIError("UNAUTHORIZED", {
+		error_description: "request not found",
+		error: "invalid_request"
+	});
+	const session = await getSessionFromCtx(ctx);
+	if (!session) {
+		const query = ctx.query;
+		if (parsePrompt(query.prompt ?? "").has("none") && query.redirect_uri) return handleRedirect(formatErrorURL(query.redirect_uri, "login_required", "Authentication required but prompt is none"));
+		/**
+		* If the user is not logged in, we need to redirect them to the
+		* login page.
+		*/
+		await ctx.setSignedCookie("oidc_login_prompt", JSON.stringify(ctx.query), ctx.context.secret, {
+			maxAge: 600,
+			path: "/",
+			sameSite: "lax"
+		});
+		const queryFromURL = ctx.request.url?.split("?")[1];
+		return handleRedirect(`${options.loginPage}?${queryFromURL}`);
+	}
+	const query = ctx.query;
+	if (!query.client_id) {
+		const errorURL = getErrorURL(ctx, "invalid_client", "client_id is required");
+		throw ctx.redirect(errorURL);
+	}
+	if (!query.response_type) {
+		const errorURL = getErrorURL(ctx, "invalid_request", "response_type is required");
+		throw ctx.redirect(errorURL);
+	}
+	const client = await getClient(ctx.query.client_id, options.trustedClients || []);
+	if (!client) {
+		const errorURL = getErrorURL(ctx, "invalid_client", "client_id is required");
+		throw ctx.redirect(errorURL);
+	}
+	const redirectURI = client.redirectUrls.find((url) => url === ctx.query.redirect_uri);
+	if (!redirectURI || !query.redirect_uri)
+ /**
+	* show UI error here warning the user that the redirect URI is invalid
+	*/
+	throw new APIError("BAD_REQUEST", { message: "Invalid redirect URI" });
+	if (client.disabled) {
+		const errorURL = getErrorURL(ctx, "client_disabled", "client is disabled");
+		throw ctx.redirect(errorURL);
+	}
+	if (query.response_type !== "code") {
+		const errorURL = getErrorURL(ctx, "unsupported_response_type", "unsupported response type");
+		throw ctx.redirect(errorURL);
+	}
+	const requestScope = query.scope?.split(" ").filter((s) => s) || opts.defaultScope?.split(" ") || [];
+	const invalidScopes = requestScope.filter((scope) => {
+		return !opts.scopes.includes(scope);
+	});
+	if (invalidScopes.length) return handleRedirect(formatErrorURL(query.redirect_uri, "invalid_scope", `The following scopes are invalid: ${invalidScopes.join(", ")}`));
+	if ((!query.code_challenge || !query.code_challenge_method) && options.requirePKCE) return handleRedirect(formatErrorURL(query.redirect_uri, "invalid_request", "pkce is required"));
+	if (!query.code_challenge_method) query.code_challenge_method = "plain";
+	if (!["s256", options.allowPlainCodeChallengeMethod ? "plain" : "s256"].includes(query.code_challenge_method?.toLowerCase() || "")) return handleRedirect(formatErrorURL(query.redirect_uri, "invalid_request", "invalid code_challenge method"));
+	const code = generateRandomString(32, "a-z", "A-Z", "0-9");
+	const codeExpiresInMs = opts.codeExpiresIn * 1e3;
+	const expiresAt = new Date(Date.now() + codeExpiresInMs);
+	const skipConsentForTrustedClient = client.skipConsent;
+	const hasAlreadyConsented = await ctx.context.adapter.findOne({
+		model: "oauthConsent",
+		where: [{
+			field: "clientId",
+			value: client.clientId
+		}, {
+			field: "userId",
+			value: session.user.id
+		}]
+	}).then((res) => {
+		if (!res?.consentGiven) return false;
+		const consentedScopes = res.scopes ? res.scopes.split(" ") : [];
+		return requestScope.every((scope) => consentedScopes.includes(scope));
+	});
+	const promptSet = parsePrompt(query.prompt ?? "");
+	if (promptSet.has("none")) {
+		if (!skipConsentForTrustedClient && !hasAlreadyConsented) return handleRedirect(formatErrorURL(query.redirect_uri, "consent_required", "Consent required but prompt is none"));
+	}
+	let requireLogin = promptSet.has("login");
+	if (query.max_age !== void 0) {
+		const maxAge = Number(query.max_age);
+		if (Number.isInteger(maxAge) && maxAge >= 0) {
+			if ((Date.now() - new Date(session.session.createdAt).getTime()) / 1e3 > maxAge) requireLogin = true;
+		}
+	}
+	const requireConsent = !skipConsentForTrustedClient && (!hasAlreadyConsented || promptSet.has("consent"));
+	try {
+		/**
+		* Save the code in the database
+		*/
+		await ctx.context.internalAdapter.createVerificationValue({
+			value: JSON.stringify({
+				clientId: client.clientId,
+				redirectURI: query.redirect_uri,
+				scope: requestScope,
+				userId: session.user.id,
+				authTime: new Date(session.session.createdAt).getTime(),
+				requireConsent,
+				state: requireConsent ? query.state : null,
+				codeChallenge: query.code_challenge,
+				codeChallengeMethod: query.code_challenge_method,
+				nonce: query.nonce
+			}),
+			identifier: code,
+			expiresAt
+		});
+	} catch {
+		return handleRedirect(formatErrorURL(query.redirect_uri, "server_error", "An error occurred while processing the request"));
+	}
+	if (requireLogin) {
+		await ctx.setSignedCookie("oidc_login_prompt", JSON.stringify(ctx.query), ctx.context.secret, {
+			maxAge: 600,
+			path: "/",
+			sameSite: "lax"
+		});
+		await ctx.setSignedCookie("oidc_consent_prompt", code, ctx.context.secret, {
+			maxAge: 600,
+			path: "/",
+			sameSite: "lax"
+		});
+		return handleRedirect(`${options.loginPage}?${new URLSearchParams({
+			client_id: client.clientId,
+			code,
+			state: query.state
+		}).toString()}`);
+	}
+	if (!requireConsent) {
+		const redirectURIWithCode = new URL(redirectURI);
+		redirectURIWithCode.searchParams.set("code", code);
+		redirectURIWithCode.searchParams.set("state", ctx.query.state);
+		return handleRedirect(redirectURIWithCode.toString());
+	}
+	if (options?.consentPage) {
+		await ctx.setSignedCookie("oidc_consent_prompt", code, ctx.context.secret, {
+			maxAge: 600,
+			path: "/",
+			sameSite: "lax"
+		});
+		const urlParams = new URLSearchParams();
+		urlParams.set("consent_code", code);
+		urlParams.set("client_id", client.clientId);
+		urlParams.set("scope", requestScope.join(" "));
+		return handleRedirect(`${options.consentPage}?${urlParams.toString()}`);
+	}
+	const htmlFn = options?.getConsentHTML;
+	if (!htmlFn) throw new APIError("INTERNAL_SERVER_ERROR", { message: "No consent page provided" });
+	return new Response(htmlFn({
+		scopes: requestScope,
+		clientMetadata: client.metadata,
+		clientIcon: client?.icon,
+		clientId: client.clientId,
+		clientName: client.name,
+		code
+	}), { headers: { "content-type": "text/html" } });
+}
+
+//#endregion
+export { authorize };
+//# sourceMappingURL=authorize.mjs.map

package/dist/plugins/oidc-provider/authorize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.mjs","names":[],"sources":["../../../src/plugins/oidc-provider/authorize.ts"],"sourcesContent":["import type { GenericEndpointContext } from \"@better-auth/core\";\nimport { APIError } from \"@better-auth/core/error\";\nimport { getSessionFromCtx } from \"../../api\";\nimport { generateRandomString } from \"../../crypto\";\nimport { getClient } from \"./index\";\nimport type { AuthorizationQuery, OIDCOptions } from \"./types\";\nimport { parsePrompt } from \"./utils/prompt\";\n\nfunction formatErrorURL(url: string, error: string, description: string) {\n\treturn `${\n\t\turl.includes(\"?\") ? \"&\" : \"?\"\n\t}error=${error}&error_description=${description}`;\n}\n\nfunction getErrorURL(\n\tctx: GenericEndpointContext,\n\terror: string,\n\tdescription: string,\n) {\n\tconst baseURL =\n\t\tctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;\n\tconst formattedURL = formatErrorURL(baseURL, error, description);\n\treturn formattedURL;\n}\n\nexport async function authorize(\n\tctx: GenericEndpointContext,\n\toptions: OIDCOptions,\n) {\n\tconst handleRedirect = (url: string) => {\n\t\tconst fromFetch = ctx.request?.headers.get(\"sec-fetch-mode\") === \"cors\";\n\t\tif (fromFetch) {\n\t\t\treturn ctx.json({\n\t\t\t\tredirect: true,\n\t\t\t\turl,\n\t\t\t});\n\t\t} else {\n\t\t\tthrow ctx.redirect(url);\n\t\t}\n\t};\n\n\tconst opts = {\n\t\tcodeExpiresIn: 600,\n\t\tdefaultScope: \"openid\",\n\t\t...options,\n\t\tscopes: [\n\t\t\t\"openid\",\n\t\t\t\"profile\",\n\t\t\t\"email\",\n\t\t\t\"offline_access\",\n\t\t\t...(options?.scopes || []),\n\t\t],\n\t};\n\tif (!ctx.request) {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\terror_description: \"request not found\",\n\t\t\terror: \"invalid_request\",\n\t\t});\n\t}\n\tconst session = await getSessionFromCtx(ctx);\n\tif (!session) {\n\t\t// Handle prompt=none per OIDC spec - must return error instead of redirecting\n\t\tconst query = ctx.query as AuthorizationQuery;\n\t\tconst promptSet = parsePrompt(query.prompt ?? \"\");\n\t\tif (promptSet.has(\"none\") && query.redirect_uri) {\n\t\t\treturn handleRedirect(\n\t\t\t\tformatErrorURL(\n\t\t\t\t\tquery.redirect_uri,\n\t\t\t\t\t\"login_required\",\n\t\t\t\t\t\"Authentication required but prompt is none\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\n\t\t/**\n\t\t * If the user is not logged in, we need to redirect them to the\n\t\t * login page.\n\t\t */\n\t\tawait ctx.setSignedCookie(\n\t\t\t\"oidc_login_prompt\",\n\t\t\tJSON.stringify(ctx.query),\n\t\t\tctx.context.secret,\n\t\t\t{\n\t\t\t\tmaxAge: 600,\n\t\t\t\tpath: \"/\",\n\t\t\t\tsameSite: \"lax\",\n\t\t\t},\n\t\t);\n\t\tconst queryFromURL = ctx.request.url?.split(\"?\")[1]!;\n\t\treturn handleRedirect(`${options.loginPage}?${queryFromURL}`);\n\t}\n\n\tconst query = ctx.query as AuthorizationQuery;\n\tif (!query.client_id) {\n\t\tconst errorURL = getErrorURL(\n\t\t\tctx,\n\t\t\t\"invalid_client\",\n\t\t\t\"client_id is required\",\n\t\t);\n\t\tthrow ctx.redirect(errorURL);\n\t}\n\n\tif (!query.response_type) {\n\t\tconst errorURL = getErrorURL(\n\t\t\tctx,\n\t\t\t\"invalid_request\",\n\t\t\t\"response_type is required\",\n\t\t);\n\t\tthrow ctx.redirect(errorURL);\n\t}\n\n\tconst client = await getClient(\n\t\tctx.query.client_id,\n\t\toptions.trustedClients || [],\n\t);\n\tif (!client) {\n\t\tconst errorURL = getErrorURL(\n\t\t\tctx,\n\t\t\t\"invalid_client\",\n\t\t\t\"client_id is required\",\n\t\t);\n\t\tthrow ctx.redirect(errorURL);\n\t}\n\tconst redirectURI = client.redirectUrls.find(\n\t\t(url) => url === ctx.query.redirect_uri,\n\t);\n\n\tif (!redirectURI || !query.redirect_uri) {\n\t\t/**\n\t\t * show UI error here warning the user that the redirect URI is invalid\n\t\t */\n\t\tthrow new APIError(\"BAD_REQUEST\", {\n\t\t\tmessage: \"Invalid redirect URI\",\n\t\t});\n\t}\n\tif (client.disabled) {\n\t\tconst errorURL = getErrorURL(ctx, \"client_disabled\", \"client is disabled\");\n\t\tthrow ctx.redirect(errorURL);\n\t}\n\n\tif (query.response_type !== \"code\") {\n\t\tconst errorURL = getErrorURL(\n\t\t\tctx,\n\t\t\t\"unsupported_response_type\",\n\t\t\t\"unsupported response type\",\n\t\t);\n\t\tthrow ctx.redirect(errorURL);\n\t}\n\n\tconst requestScope =\n\t\tquery.scope?.split(\" \").filter((s) => s) ||\n\t\topts.defaultScope?.split(\" \") ||\n\t\t[];\n\tconst invalidScopes = requestScope.filter((scope) => {\n\t\treturn !opts.scopes.includes(scope);\n\t});\n\tif (invalidScopes.length) {\n\t\treturn handleRedirect(\n\t\t\tformatErrorURL(\n\t\t\t\tquery.redirect_uri,\n\t\t\t\t\"invalid_scope\",\n\t\t\t\t`The following scopes are invalid: ${invalidScopes.join(\", \")}`,\n\t\t\t),\n\t\t);\n\t}\n\n\tif (\n\t\t(!query.code_challenge || !query.code_challenge_method) &&\n\t\toptions.requirePKCE\n\t) {\n\t\treturn handleRedirect(\n\t\t\tformatErrorURL(query.redirect_uri, \"invalid_request\", \"pkce is required\"),\n\t\t);\n\t}\n\n\tif (!query.code_challenge_method) {\n\t\tquery.code_challenge_method = \"plain\";\n\t}\n\n\tif (\n\t\t![\n\t\t\t\"s256\",\n\t\t\toptions.allowPlainCodeChallengeMethod ? \"plain\" : \"s256\",\n\t\t].includes(query.code_challenge_method?.toLowerCase() || \"\")\n\t) {\n\t\treturn handleRedirect(\n\t\t\tformatErrorURL(\n\t\t\t\tquery.redirect_uri,\n\t\t\t\t\"invalid_request\",\n\t\t\t\t\"invalid code_challenge method\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst code = generateRandomString(32, \"a-z\", \"A-Z\", \"0-9\");\n\tconst codeExpiresInMs = opts.codeExpiresIn! * 1000;\n\tconst expiresAt = new Date(Date.now() + codeExpiresInMs);\n\n\t// Determine if consent is required\n\t// Consent is ALWAYS required unless:\n\t// 1. The client is trusted (skipConsent = true)\n\t// 2. The user has already consented and prompt is not \"consent\"\n\tconst skipConsentForTrustedClient = client.skipConsent;\n\tconst hasAlreadyConsented = await ctx.context.adapter\n\t\t.findOne<{\n\t\t\tconsentGiven: boolean;\n\t\t\tscopes: string;\n\t\t}>({\n\t\t\tmodel: \"oauthConsent\",\n\t\t\twhere: [\n\t\t\t\t{\n\t\t\t\t\tfield: \"clientId\",\n\t\t\t\t\tvalue: client.clientId,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tfield: \"userId\",\n\t\t\t\t\tvalue: session.user.id,\n\t\t\t\t},\n\t\t\t],\n\t\t})\n\t\t.then((res) => {\n\t\t\tif (!res?.consentGiven) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst consentedScopes = res.scopes ? res.scopes.split(\" \") : [];\n\t\t\tconst hasConsented = requestScope.every((scope) =>\n\t\t\t\tconsentedScopes.includes(scope),\n\t\t\t);\n\t\t\treturn hasConsented;\n\t\t});\n\n\tconst promptSet = parsePrompt(query.prompt ?? \"\");\n\n\t// Handle prompt=none per OIDC spec 3.1.2.1\n\t// The Authorization Server MUST NOT display any authentication or consent UI\n\tif (promptSet.has(\"none\")) {\n\t\t// If consent is required, return consent_required error\n\t\tif (!skipConsentForTrustedClient && !hasAlreadyConsented) {\n\t\t\treturn handleRedirect(\n\t\t\t\tformatErrorURL(\n\t\t\t\t\tquery.redirect_uri,\n\t\t\t\t\t\"consent_required\",\n\t\t\t\t\t\"Consent required but prompt is none\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\t// If we reach here, user is authenticated and consent is satisfied\n\t\t// Continue without any UI interaction\n\t}\n\n\t// Handle max_age parameter per OIDC spec 3.1.2.1\n\t// max_age=0 is equivalent to prompt=login\n\tlet requireLogin = promptSet.has(\"login\");\n\tif (query.max_age !== undefined) {\n\t\tconst maxAge = Number(query.max_age);\n\t\tif (Number.isInteger(maxAge) && maxAge >= 0) {\n\t\t\tconst sessionAge =\n\t\t\t\t(Date.now() - new Date(session.session.createdAt).getTime()) / 1000;\n\t\t\tif (sessionAge > maxAge) {\n\t\t\t\t// Session is older than max_age, force re-authentication\n\t\t\t\trequireLogin = true;\n\t\t\t}\n\t\t}\n\t\t// If max_age is invalid (not a non-negative integer), ignore it per OIDC spec\n\t}\n\n\tconst requireConsent =\n\t\t!skipConsentForTrustedClient &&\n\t\t(!hasAlreadyConsented || promptSet.has(\"consent\"));\n\n\ttry {\n\t\t/**\n\t\t * Save the code in the database\n\t\t */\n\t\tawait ctx.context.internalAdapter.createVerificationValue({\n\t\t\tvalue: JSON.stringify({\n\t\t\t\tclientId: client.clientId,\n\t\t\t\tredirectURI: query.redirect_uri,\n\t\t\t\tscope: requestScope,\n\t\t\t\tuserId: session.user.id,\n\t\t\t\tauthTime: new Date(session.session.createdAt).getTime(),\n\t\t\t\t/**\n\t\t\t\t * Consent is required per OIDC spec unless:\n\t\t\t\t * 1. Client is trusted (skipConsent = true)\n\t\t\t\t * 2. User has already consented (and prompt is not \"consent\")\n\t\t\t\t *\n\t\t\t\t * When consent is required, the code needs to be treated as a\n\t\t\t\t * consent request. Once the user consents, the code will be\n\t\t\t\t * updated with the actual authorization code.\n\t\t\t\t */\n\t\t\t\trequireConsent,\n\t\t\t\tstate: requireConsent ? query.state : null,\n\t\t\t\tcodeChallenge: query.code_challenge,\n\t\t\t\tcodeChallengeMethod: query.code_challenge_method,\n\t\t\t\tnonce: query.nonce,\n\t\t\t}),\n\t\t\tidentifier: code,\n\t\t\texpiresAt,\n\t\t});\n\t} catch {\n\t\treturn handleRedirect(\n\t\t\tformatErrorURL(\n\t\t\t\tquery.redirect_uri,\n\t\t\t\t\"server_error\",\n\t\t\t\t\"An error occurred while processing the request\",\n\t\t\t),\n\t\t);\n\t}\n\n\tif (requireLogin) {\n\t\tawait ctx.setSignedCookie(\n\t\t\t\"oidc_login_prompt\",\n\t\t\tJSON.stringify(ctx.query),\n\t\t\tctx.context.secret,\n\t\t\t{\n\t\t\t\tmaxAge: 600,\n\t\t\t\tpath: \"/\",\n\t\t\t\tsameSite: \"lax\",\n\t\t\t},\n\t\t);\n\t\tawait ctx.setSignedCookie(\"oidc_consent_prompt\", code, ctx.context.secret, {\n\t\t\tmaxAge: 600,\n\t\t\tpath: \"/\",\n\t\t\tsameSite: \"lax\",\n\t\t});\n\n\t\tconst loginURI = `${options.loginPage}?${new URLSearchParams({\n\t\t\tclient_id: client.clientId,\n\t\t\tcode,\n\t\t\tstate: query.state,\n\t\t}).toString()}`;\n\t\treturn handleRedirect(loginURI);\n\t}\n\n\t// If consent is not required, redirect with the code immediately\n\tif (!requireConsent) {\n\t\tconst redirectURIWithCode = new URL(redirectURI);\n\t\tredirectURIWithCode.searchParams.set(\"code\", code);\n\t\tredirectURIWithCode.searchParams.set(\"state\", ctx.query.state);\n\t\treturn handleRedirect(redirectURIWithCode.toString());\n\t}\n\n\t// Consent is required - redirect to consent page or show consent HTML\n\n\tif (options?.consentPage) {\n\t\t// Set cookie to support cookie-based consent flows\n\t\tawait ctx.setSignedCookie(\"oidc_consent_prompt\", code, ctx.context.secret, {\n\t\t\tmaxAge: 600,\n\t\t\tpath: \"/\",\n\t\t\tsameSite: \"lax\",\n\t\t});\n\n\t\t// Pass the consent code as a URL parameter to support URL-based consent flows\n\t\tconst urlParams = new URLSearchParams();\n\t\turlParams.set(\"consent_code\", code);\n\t\turlParams.set(\"client_id\", client.clientId);\n\t\turlParams.set(\"scope\", requestScope.join(\" \"));\n\t\tconst consentURI = `${options.consentPage}?${urlParams.toString()}`;\n\n\t\treturn handleRedirect(consentURI);\n\t}\n\tconst htmlFn = options?.getConsentHTML;\n\n\tif (!htmlFn) {\n\t\tthrow new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\t\tmessage: \"No consent page provided\",\n\t\t});\n\t}\n\n\treturn new Response(\n\t\thtmlFn({\n\t\t\tscopes: requestScope,\n\t\t\tclientMetadata: client.metadata,\n\t\t\tclientIcon: client?.icon,\n\t\t\tclientId: client.clientId,\n\t\t\tclientName: client.name,\n\t\t\tcode,\n\t\t}),\n\t\t{\n\t\t\theaders: {\n\t\t\t\t\"content-type\": \"text/html\",\n\t\t\t},\n\t\t},\n\t);\n}\n"],"mappings":";;;;;;;;;AAQA,SAAS,eAAe,KAAa,OAAe,aAAqB;AACxE,QAAO,GACN,IAAI,SAAS,IAAI,GAAG,MAAM,IAC1B,QAAQ,MAAM,qBAAqB;;AAGrC,SAAS,YACR,KACA,OACA,aACC;AAID,QADqB,eADpB,IAAI,QAAQ,QAAQ,YAAY,YAAY,GAAG,IAAI,QAAQ,QAAQ,SACvB,OAAO,YAAY;;AAIjE,eAAsB,UACrB,KACA,SACC;CACD,MAAM,kBAAkB,QAAgB;AAEvC,MADkB,IAAI,SAAS,QAAQ,IAAI,iBAAiB,KAAK,OAEhE,QAAO,IAAI,KAAK;GACf,UAAU;GACV;GACA,CAAC;MAEF,OAAM,IAAI,SAAS,IAAI;;CAIzB,MAAM,OAAO;EACZ,eAAe;EACf,cAAc;EACd,GAAG;EACH,QAAQ;GACP;GACA;GACA;GACA;GACA,GAAI,SAAS,UAAU,EAAE;GACzB;EACD;AACD,KAAI,CAAC,IAAI,QACR,OAAM,IAAI,SAAS,gBAAgB;EAClC,mBAAmB;EACnB,OAAO;EACP,CAAC;CAEH,MAAM,UAAU,MAAM,kBAAkB,IAAI;AAC5C,KAAI,CAAC,SAAS;EAEb,MAAM,QAAQ,IAAI;AAElB,MADkB,YAAY,MAAM,UAAU,GAAG,CACnC,IAAI,OAAO,IAAI,MAAM,aAClC,QAAO,eACN,eACC,MAAM,cACN,kBACA,6CACA,CACD;;;;;AAOF,QAAM,IAAI,gBACT,qBACA,KAAK,UAAU,IAAI,MAAM,EACzB,IAAI,QAAQ,QACZ;GACC,QAAQ;GACR,MAAM;GACN,UAAU;GACV,CACD;EACD,MAAM,eAAe,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC;AACjD,SAAO,eAAe,GAAG,QAAQ,UAAU,GAAG,eAAe;;CAG9D,MAAM,QAAQ,IAAI;AAClB,KAAI,CAAC,MAAM,WAAW;EACrB,MAAM,WAAW,YAChB,KACA,kBACA,wBACA;AACD,QAAM,IAAI,SAAS,SAAS;;AAG7B,KAAI,CAAC,MAAM,eAAe;EACzB,MAAM,WAAW,YAChB,KACA,mBACA,4BACA;AACD,QAAM,IAAI,SAAS,SAAS;;CAG7B,MAAM,SAAS,MAAM,UACpB,IAAI,MAAM,WACV,QAAQ,kBAAkB,EAAE,CAC5B;AACD,KAAI,CAAC,QAAQ;EACZ,MAAM,WAAW,YAChB,KACA,kBACA,wBACA;AACD,QAAM,IAAI,SAAS,SAAS;;CAE7B,MAAM,cAAc,OAAO,aAAa,MACtC,QAAQ,QAAQ,IAAI,MAAM,aAC3B;AAED,KAAI,CAAC,eAAe,CAAC,MAAM;;;;AAI1B,OAAM,IAAI,SAAS,eAAe,EACjC,SAAS,wBACT,CAAC;AAEH,KAAI,OAAO,UAAU;EACpB,MAAM,WAAW,YAAY,KAAK,mBAAmB,qBAAqB;AAC1E,QAAM,IAAI,SAAS,SAAS;;AAG7B,KAAI,MAAM,kBAAkB,QAAQ;EACnC,MAAM,WAAW,YAChB,KACA,6BACA,4BACA;AACD,QAAM,IAAI,SAAS,SAAS;;CAG7B,MAAM,eACL,MAAM,OAAO,MAAM,IAAI,CAAC,QAAQ,MAAM,EAAE,IACxC,KAAK,cAAc,MAAM,IAAI,IAC7B,EAAE;CACH,MAAM,gBAAgB,aAAa,QAAQ,UAAU;AACpD,SAAO,CAAC,KAAK,OAAO,SAAS,MAAM;GAClC;AACF,KAAI,cAAc,OACjB,QAAO,eACN,eACC,MAAM,cACN,iBACA,qCAAqC,cAAc,KAAK,KAAK,GAC7D,CACD;AAGF,MACE,CAAC,MAAM,kBAAkB,CAAC,MAAM,0BACjC,QAAQ,YAER,QAAO,eACN,eAAe,MAAM,cAAc,mBAAmB,mBAAmB,CACzE;AAGF,KAAI,CAAC,MAAM,sBACV,OAAM,wBAAwB;AAG/B,KACC,CAAC,CACA,QACA,QAAQ,gCAAgC,UAAU,OAClD,CAAC,SAAS,MAAM,uBAAuB,aAAa,IAAI,GAAG,CAE5D,QAAO,eACN,eACC,MAAM,cACN,mBACA,gCACA,CACD;CAGF,MAAM,OAAO,qBAAqB,IAAI,OAAO,OAAO,MAAM;CAC1D,MAAM,kBAAkB,KAAK,gBAAiB;CAC9C,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,gBAAgB;CAMxD,MAAM,8BAA8B,OAAO;CAC3C,MAAM,sBAAsB,MAAM,IAAI,QAAQ,QAC5C,QAGE;EACF,OAAO;EACP,OAAO,CACN;GACC,OAAO;GACP,OAAO,OAAO;GACd,EACD;GACC,OAAO;GACP,OAAO,QAAQ,KAAK;GACpB,CACD;EACD,CAAC,CACD,MAAM,QAAQ;AACd,MAAI,CAAC,KAAK,aACT,QAAO;EAER,MAAM,kBAAkB,IAAI,SAAS,IAAI,OAAO,MAAM,IAAI,GAAG,EAAE;AAI/D,SAHqB,aAAa,OAAO,UACxC,gBAAgB,SAAS,MAAM,CAC/B;GAEA;CAEH,MAAM,YAAY,YAAY,MAAM,UAAU,GAAG;AAIjD,KAAI,UAAU,IAAI,OAAO,EAExB;MAAI,CAAC,+BAA+B,CAAC,oBACpC,QAAO,eACN,eACC,MAAM,cACN,oBACA,sCACA,CACD;;CAQH,IAAI,eAAe,UAAU,IAAI,QAAQ;AACzC,KAAI,MAAM,YAAY,QAAW;EAChC,MAAM,SAAS,OAAO,MAAM,QAAQ;AACpC,MAAI,OAAO,UAAU,OAAO,IAAI,UAAU,GAGzC;QADE,KAAK,KAAK,GAAG,IAAI,KAAK,QAAQ,QAAQ,UAAU,CAAC,SAAS,IAAI,MAC/C,OAEhB,gBAAe;;;CAMlB,MAAM,iBACL,CAAC,gCACA,CAAC,uBAAuB,UAAU,IAAI,UAAU;AAElD,KAAI;;;;AAIH,QAAM,IAAI,QAAQ,gBAAgB,wBAAwB;GACzD,OAAO,KAAK,UAAU;IACrB,UAAU,OAAO;IACjB,aAAa,MAAM;IACnB,OAAO;IACP,QAAQ,QAAQ,KAAK;IACrB,UAAU,IAAI,KAAK,QAAQ,QAAQ,UAAU,CAAC,SAAS;IAUvD;IACA,OAAO,iBAAiB,MAAM,QAAQ;IACtC,eAAe,MAAM;IACrB,qBAAqB,MAAM;IAC3B,OAAO,MAAM;IACb,CAAC;GACF,YAAY;GACZ;GACA,CAAC;SACK;AACP,SAAO,eACN,eACC,MAAM,cACN,gBACA,iDACA,CACD;;AAGF,KAAI,cAAc;AACjB,QAAM,IAAI,gBACT,qBACA,KAAK,UAAU,IAAI,MAAM,EACzB,IAAI,QAAQ,QACZ;GACC,QAAQ;GACR,MAAM;GACN,UAAU;GACV,CACD;AACD,QAAM,IAAI,gBAAgB,uBAAuB,MAAM,IAAI,QAAQ,QAAQ;GAC1E,QAAQ;GACR,MAAM;GACN,UAAU;GACV,CAAC;AAOF,SAAO,eALU,GAAG,QAAQ,UAAU,GAAG,IAAI,gBAAgB;GAC5D,WAAW,OAAO;GAClB;GACA,OAAO,MAAM;GACb,CAAC,CAAC,UAAU,GACkB;;AAIhC,KAAI,CAAC,gBAAgB;EACpB,MAAM,sBAAsB,IAAI,IAAI,YAAY;AAChD,sBAAoB,aAAa,IAAI,QAAQ,KAAK;AAClD,sBAAoB,aAAa,IAAI,SAAS,IAAI,MAAM,MAAM;AAC9D,SAAO,eAAe,oBAAoB,UAAU,CAAC;;AAKtD,KAAI,SAAS,aAAa;AAEzB,QAAM,IAAI,gBAAgB,uBAAuB,MAAM,IAAI,QAAQ,QAAQ;GAC1E,QAAQ;GACR,MAAM;GACN,UAAU;GACV,CAAC;EAGF,MAAM,YAAY,IAAI,iBAAiB;AACvC,YAAU,IAAI,gBAAgB,KAAK;AACnC,YAAU,IAAI,aAAa,OAAO,SAAS;AAC3C,YAAU,IAAI,SAAS,aAAa,KAAK,IAAI,CAAC;AAG9C,SAAO,eAFY,GAAG,QAAQ,YAAY,GAAG,UAAU,UAAU,GAEhC;;CAElC,MAAM,SAAS,SAAS;AAExB,KAAI,CAAC,OACJ,OAAM,IAAI,SAAS,yBAAyB,EAC3C,SAAS,4BACT,CAAC;AAGH,QAAO,IAAI,SACV,OAAO;EACN,QAAQ;EACR,gBAAgB,OAAO;EACvB,YAAY,QAAQ;EACpB,UAAU,OAAO;EACjB,YAAY,OAAO;EACnB;EACA,CAAC,EACF,EACC,SAAS,EACR,gBAAgB,aAChB,EACD,CACD"}