@hammadj/better-auth 1.5.0-beta.9

package/dist/plugins/api-key/schema.mjs

@@ -0,0 +1,130 @@
+import { parseJSON } from "../../client/parser.mjs";
+
+//#region src/plugins/api-key/schema.ts
+const apiKeySchema = ({ timeWindow, rateLimitMax }) => ({ apikey: { fields: {
+	name: {
+		type: "string",
+		required: false,
+		input: false
+	},
+	start: {
+		type: "string",
+		required: false,
+		input: false
+	},
+	prefix: {
+		type: "string",
+		required: false,
+		input: false
+	},
+	key: {
+		type: "string",
+		required: true,
+		input: false,
+		index: true
+	},
+	userId: {
+		type: "string",
+		references: {
+			model: "user",
+			field: "id",
+			onDelete: "cascade"
+		},
+		required: true,
+		input: false,
+		index: true
+	},
+	refillInterval: {
+		type: "number",
+		required: false,
+		input: false
+	},
+	refillAmount: {
+		type: "number",
+		required: false,
+		input: false
+	},
+	lastRefillAt: {
+		type: "date",
+		required: false,
+		input: false
+	},
+	enabled: {
+		type: "boolean",
+		required: false,
+		input: false,
+		defaultValue: true
+	},
+	rateLimitEnabled: {
+		type: "boolean",
+		required: false,
+		input: false,
+		defaultValue: true
+	},
+	rateLimitTimeWindow: {
+		type: "number",
+		required: false,
+		input: false,
+		defaultValue: timeWindow
+	},
+	rateLimitMax: {
+		type: "number",
+		required: false,
+		input: false,
+		defaultValue: rateLimitMax
+	},
+	requestCount: {
+		type: "number",
+		required: false,
+		input: false,
+		defaultValue: 0
+	},
+	remaining: {
+		type: "number",
+		required: false,
+		input: false
+	},
+	lastRequest: {
+		type: "date",
+		required: false,
+		input: false
+	},
+	expiresAt: {
+		type: "date",
+		required: false,
+		input: false
+	},
+	createdAt: {
+		type: "date",
+		required: true,
+		input: false
+	},
+	updatedAt: {
+		type: "date",
+		required: true,
+		input: false
+	},
+	permissions: {
+		type: "string",
+		required: false,
+		input: false
+	},
+	metadata: {
+		type: "string",
+		required: false,
+		input: true,
+		transform: {
+			input(value) {
+				return JSON.stringify(value);
+			},
+			output(value) {
+				if (!value) return null;
+				return parseJSON(value);
+			}
+		}
+	}
+} } });
+
+//#endregion
+export { apiKeySchema };
+//# sourceMappingURL=schema.mjs.map

package/dist/plugins/api-key/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":[],"sources":["../../../src/plugins/api-key/schema.ts"],"sourcesContent":["import type { BetterAuthPluginDBSchema } from \"@better-auth/core/db\";\nimport { parseJSON } from \"../../client/parser\";\n\nexport const apiKeySchema = ({\n\ttimeWindow,\n\trateLimitMax,\n}: {\n\ttimeWindow: number;\n\trateLimitMax: number;\n}) =>\n\t({\n\t\tapikey: {\n\t\t\tfields: {\n\t\t\t\t/**\n\t\t\t\t * The name of the key.\n\t\t\t\t */\n\t\t\t\tname: {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * Shows the first few characters of the API key\n\t\t\t\t * This allows you to show those few characters in the UI to make it easier for users to identify the API key.\n\t\t\t\t */\n\t\t\t\tstart: {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The prefix of the key.\n\t\t\t\t */\n\t\t\t\tprefix: {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The hashed key value.\n\t\t\t\t */\n\t\t\t\tkey: {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tinput: false,\n\t\t\t\t\tindex: true,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The user id of the user who created the key.\n\t\t\t\t */\n\t\t\t\tuserId: {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\treferences: { model: \"user\", field: \"id\", onDelete: \"cascade\" },\n\t\t\t\t\trequired: true,\n\t\t\t\t\tinput: false,\n\t\t\t\t\tindex: true,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The interval to refill the key in milliseconds.\n\t\t\t\t */\n\t\t\t\trefillInterval: {\n\t\t\t\t\ttype: \"number\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The amount to refill the remaining count of the key.\n\t\t\t\t */\n\t\t\t\trefillAmount: {\n\t\t\t\t\ttype: \"number\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The date and time when the key was last refilled.\n\t\t\t\t */\n\t\t\t\tlastRefillAt: {\n\t\t\t\t\ttype: \"date\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * Whether the key is enabled.\n\t\t\t\t */\n\t\t\t\tenabled: {\n\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t\tdefaultValue: true,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * Whether the key has rate limiting enabled.\n\t\t\t\t */\n\t\t\t\trateLimitEnabled: {\n\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t\tdefaultValue: true,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The time window in milliseconds for the rate limit.\n\t\t\t\t */\n\t\t\t\trateLimitTimeWindow: {\n\t\t\t\t\ttype: \"number\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t\tdefaultValue: timeWindow,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The maximum number of requests allowed within the `rateLimitTimeWindow`.\n\t\t\t\t */\n\t\t\t\trateLimitMax: {\n\t\t\t\t\ttype: \"number\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t\tdefaultValue: rateLimitMax,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The number of requests made within the rate limit time window\n\t\t\t\t */\n\t\t\t\trequestCount: {\n\t\t\t\t\ttype: \"number\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t\tdefaultValue: 0,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The remaining number of requests before the key is revoked.\n\t\t\t\t *\n\t\t\t\t * If this is null, then the key is not revoked.\n\t\t\t\t *\n\t\t\t\t * If `refillInterval` & `refillAmount` are provided, than this will refill accordingly.\n\t\t\t\t */\n\t\t\t\tremaining: {\n\t\t\t\t\ttype: \"number\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The date and time of the last request made to the key.\n\t\t\t\t */\n\t\t\t\tlastRequest: {\n\t\t\t\t\ttype: \"date\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The date and time when the key will expire.\n\t\t\t\t */\n\t\t\t\texpiresAt: {\n\t\t\t\t\ttype: \"date\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The date and time when the key was created.\n\t\t\t\t */\n\t\t\t\tcreatedAt: {\n\t\t\t\t\ttype: \"date\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The date and time when the key was last updated.\n\t\t\t\t */\n\t\t\t\tupdatedAt: {\n\t\t\t\t\ttype: \"date\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The permissions of the key.\n\t\t\t\t */\n\t\t\t\tpermissions: {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: false,\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * Any additional metadata you want to store with the key.\n\t\t\t\t */\n\t\t\t\tmetadata: {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: false,\n\t\t\t\t\tinput: true,\n\t\t\t\t\ttransform: {\n\t\t\t\t\t\tinput(value) {\n\t\t\t\t\t\t\treturn JSON.stringify(value);\n\t\t\t\t\t\t},\n\t\t\t\t\t\toutput(value) {\n\t\t\t\t\t\t\tif (!value) return null;\n\t\t\t\t\t\t\treturn parseJSON<any>(value as string);\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}) satisfies BetterAuthPluginDBSchema;\n"],"mappings":";;;AAGA,MAAa,gBAAgB,EAC5B,YACA,oBAKC,EACA,QAAQ,EACP,QAAQ;CAIP,MAAM;EACL,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAKD,OAAO;EACN,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,QAAQ;EACP,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,KAAK;EACJ,MAAM;EACN,UAAU;EACV,OAAO;EACP,OAAO;EACP;CAID,QAAQ;EACP,MAAM;EACN,YAAY;GAAE,OAAO;GAAQ,OAAO;GAAM,UAAU;GAAW;EAC/D,UAAU;EACV,OAAO;EACP,OAAO;EACP;CAID,gBAAgB;EACf,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,cAAc;EACb,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,cAAc;EACb,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,SAAS;EACR,MAAM;EACN,UAAU;EACV,OAAO;EACP,cAAc;EACd;CAID,kBAAkB;EACjB,MAAM;EACN,UAAU;EACV,OAAO;EACP,cAAc;EACd;CAID,qBAAqB;EACpB,MAAM;EACN,UAAU;EACV,OAAO;EACP,cAAc;EACd;CAID,cAAc;EACb,MAAM;EACN,UAAU;EACV,OAAO;EACP,cAAc;EACd;CAID,cAAc;EACb,MAAM;EACN,UAAU;EACV,OAAO;EACP,cAAc;EACd;CAQD,WAAW;EACV,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,aAAa;EACZ,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,WAAW;EACV,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,WAAW;EACV,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,WAAW;EACV,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,aAAa;EACZ,MAAM;EACN,UAAU;EACV,OAAO;EACP;CAID,UAAU;EACT,MAAM;EACN,UAAU;EACV,OAAO;EACP,WAAW;GACV,MAAM,OAAO;AACZ,WAAO,KAAK,UAAU,MAAM;;GAE7B,OAAO,OAAO;AACb,QAAI,CAAC,MAAO,QAAO;AACnB,WAAO,UAAe,MAAgB;;GAEvC;EACD;CACD,EACD,EACD"}

package/dist/plugins/api-key/types.d.mts

@@ -0,0 +1,346 @@
+import { InferOptionSchema } from "../../types/plugins.mjs";
+import "../../types/index.mjs";
+import { Statements } from "../access/types.mjs";
+import "../access/index.mjs";
+import { apiKeySchema } from "./schema.mjs";
+import { Awaitable, GenericEndpointContext, HookEndpointContext } from "@better-auth/core";
+
+//#region src/plugins/api-key/types.d.ts
+interface ApiKeyOptions {
+  /**
+   * The header name to check for API key
+   * @default "x-api-key"
+   */
+  apiKeyHeaders?: (string | string[]) | undefined;
+  /**
+   * Disable hashing of the API key.
+   *
+   * ⚠️ Security Warning: It's strongly recommended to not disable hashing.
+   * Storing API keys in plaintext makes them vulnerable to database breaches, potentially exposing all your users' API keys.
+   *
+   * @default false
+   */
+  disableKeyHashing?: boolean | undefined;
+  /**
+   * The function to get the API key from the context
+   */
+  customAPIKeyGetter?: ((ctx: HookEndpointContext) => string | null) | undefined;
+  /**
+   * A custom function to validate the API key
+   */
+  customAPIKeyValidator?: ((options: {
+    ctx: GenericEndpointContext;
+    key: string;
+  }) => Awaitable<boolean>) | undefined;
+  /**
+   * custom key generation function
+   */
+  customKeyGenerator?: (options: {
+    /**
+     * The length of the API key to generate
+     */
+    length: number;
+    /**
+     * The prefix of the API key to generate
+     */
+    prefix: string | undefined;
+  }) => Awaitable<string>;
+  /**
+   * The configuration for storing the starting characters of the API key in the database.
+   *
+   * Useful if you want to display the starting characters of an API key in the UI.
+   */
+  startingCharactersConfig?: {
+    /**
+     * Whether to store the starting characters in the database. If false, we will set `start` to `null`.
+     *
+     * @default true
+     */
+    shouldStore?: boolean;
+    /**
+     * The length of the starting characters to store in the database.
+     *
+     * This includes the prefix length.
+     *
+     * @default 6
+     */
+    charactersLength?: number;
+  } | undefined;
+  /**
+   * The length of the API key. Longer is better. Default is 64. (Doesn't include the prefix length)
+   * @default 64
+   */
+  defaultKeyLength?: number | undefined;
+  /**
+   * The prefix of the API key.
+   *
+   * Note: We recommend you append an underscore to the prefix to make the prefix more identifiable. (eg `hello_`)
+   */
+  defaultPrefix?: string | undefined;
+  /**
+   * The maximum length of the prefix.
+   *
+   * @default 32
+   */
+  maximumPrefixLength?: number | undefined;
+  /**
+   * Whether to require a name for the API key.
+   *
+   * @default false
+   */
+  requireName?: boolean | undefined;
+  /**
+   * The minimum length of the prefix.
+   *
+   * @default 1
+   */
+  minimumPrefixLength?: number | undefined;
+  /**
+   * The maximum length of the name.
+   *
+   * @default 32
+   */
+  maximumNameLength?: number | undefined;
+  /**
+   * The minimum length of the name.
+   *
+   * @default 1
+   */
+  minimumNameLength?: number | undefined;
+  /**
+   * Whether to enable metadata for an API key.
+   *
+   * @default false
+   */
+  enableMetadata?: boolean | undefined;
+  /**
+   * Customize the key expiration.
+   */
+  keyExpiration?: {
+    /**
+     * The default expires time in milliseconds.
+     *
+     * If `null`, then there will be no expiration time.
+     *
+     * @default null
+     */
+    defaultExpiresIn?: number | null;
+    /**
+     * Whether to disable the expires time passed from the client.
+     *
+     * If `true`, the expires time will be based on the default values.
+     *
+     * @default false
+     */
+    disableCustomExpiresTime?: boolean;
+    /**
+     * The minimum expiresIn value allowed to be set from the client. in days.
+     *
+     * @default 1
+     */
+    minExpiresIn?: number;
+    /**
+     * The maximum expiresIn value allowed to be set from the client. in days.
+     *
+     * @default 365
+     */
+    maxExpiresIn?: number;
+  } | undefined;
+  /**
+   * Default rate limiting options.
+   */
+  rateLimit?: {
+    /**
+     * Whether to enable rate limiting.
+     *
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * The duration in milliseconds where each request is counted.
+     *
+     * Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset.
+     *
+     * @default 1000 * 60 * 60 * 24 // 1 day
+     */
+    timeWindow?: number;
+    /**
+     * Maximum amount of requests allowed within a window
+     *
+     * Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset.
+     *
+     * @default 10 // 10 requests per day
+     */
+    maxRequests?: number;
+  } | undefined;
+  /**
+   * custom schema for the API key plugin
+   */
+  schema?: InferOptionSchema<ReturnType<typeof apiKeySchema>> | undefined;
+  /**
+   * An API Key can represent a valid session, so we automatically mock a session for the user if we find a valid API key in the request headers.
+   *
+   * ⚠︎ This is not recommended for production use, as it can lead to security issues.
+   * @default false
+   */
+  enableSessionForAPIKeys?: boolean | undefined;
+  /**
+   * Permissions for the API key.
+   */
+  permissions?: {
+    /**
+     * The default permissions for the API key.
+     */
+    defaultPermissions?: Statements | ((userId: string, ctx: GenericEndpointContext) => Awaitable<Statements>);
+  } | undefined;
+  /**
+   * Storage backend for API keys.
+   *
+   * - `"database"`: Store API keys in the database adapter (default)
+   * - `"secondary-storage"`: Store API keys in the configured secondary storage (e.g., Redis)
+   *
+   * @default "database"
+   */
+  storage?: "database" | "secondary-storage" | undefined;
+  /**
+   * When `storage` is `"secondary-storage"`, enable fallback to database if key is not found in secondary storage.
+   *
+   * Useful for gradual migration from database to secondary storage.
+   *
+   * @default false
+   */
+  fallbackToDatabase?: boolean | undefined;
+  /**
+   * Custom storage methods for API keys.
+   *
+   * If provided, these methods will be used instead of `ctx.context.secondaryStorage`.
+   * Custom methods take precedence over global secondary storage.
+   *
+   * Useful when you want to use a different storage backend specifically for API keys,
+   * or when you need custom logic for storage operations.
+   */
+  customStorage?: {
+    /**
+     * Get a value from storage
+     */
+    get: (key: string) => Awaitable<unknown>;
+    /**
+     * Set a value in storage
+     */
+    set: (key: string, value: string, ttl?: number | undefined) => Awaitable<void | null | unknown>;
+    /**
+     * Delete a value from storage
+     */
+    delete: (key: string) => Awaitable<void | null | string>;
+  } | undefined;
+  /**
+   * Defer non-critical updates (rate limiting counters, timestamps, remaining count)
+   * to run after the response is sent using the global `advanced.backgroundTasks` handler.
+   *
+   * Requires `advanced.backgroundTasks.handler` to be configured in the main auth options.
+   *
+   * ⚠️ Warning: Enabling this introduces eventual consistency where the response
+   * returns optimistic data before the database is updated. If the deferred update
+   * fails, the database will have stale values. Only enable if your application
+   * can tolerate this trade-off for improved latency.
+   *
+   * @default false
+   */
+  deferUpdates?: boolean | undefined;
+}
+type ApiKey = {
+  /**
+   * ID
+   */
+  id: string;
+  /**
+   * The name of the key
+   */
+  name: string | null;
+  /**
+   * Shows the first few characters of the API key, including the prefix.
+   * This allows you to show those few characters in the UI to make it easier for users to identify the API key.
+   */
+  start: string | null;
+  /**
+   * The API Key prefix. Stored as plain text.
+   */
+  prefix: string | null;
+  /**
+   * The hashed API key value
+   */
+  key: string;
+  /**
+   * The owner of the user id
+   */
+  userId: string;
+  /**
+   * The interval in milliseconds between refills of the `remaining` count
+   *
+   * @example 3600000 // refill every hour (3600000ms = 1h)
+   */
+  refillInterval: number | null;
+  /**
+   * The amount to refill
+   */
+  refillAmount: number | null;
+  /**
+   * The last refill date
+   */
+  lastRefillAt: Date | null;
+  /**
+   * Sets if key is enabled or disabled
+   *
+   * @default true
+   */
+  enabled: boolean;
+  /**
+   * Whether the key has rate limiting enabled.
+   */
+  rateLimitEnabled: boolean;
+  /**
+   * The duration in milliseconds
+   */
+  rateLimitTimeWindow: number | null;
+  /**
+   * Maximum amount of requests allowed within a window
+   */
+  rateLimitMax: number | null;
+  /**
+   * The number of requests made within the rate limit time window
+   */
+  requestCount: number;
+  /**
+   * Remaining requests (every time API key is used this should updated and should be updated on refill as well)
+   */
+  remaining: number | null;
+  /**
+   * When last request occurred
+   */
+  lastRequest: Date | null;
+  /**
+   * Expiry date of a key
+   */
+  expiresAt: Date | null;
+  /**
+   * created at
+   */
+  createdAt: Date;
+  /**
+   * updated at
+   */
+  updatedAt: Date;
+  /**
+   * Extra metadata about the apiKey
+   */
+  metadata: Record<string, any> | null;
+  /**
+   * Permissions for the API key
+   */
+  permissions?: ({
+    [key: string]: string[];
+  } | null) | undefined;
+};
+//#endregion
+export { ApiKey, ApiKeyOptions };
+//# sourceMappingURL=types.d.mts.map

package/dist/plugins/bearer/index.d.mts

@@ -0,0 +1,25 @@
+//#region src/plugins/bearer/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    bearer: {
+      creator: typeof bearer;
+    };
+  }
+}
+interface BearerOptions {
+  /**
+   * If true, only signed tokens
+   * will be converted to session
+   * cookies
+   *
+   * @default false
+   */
+  requireSignature?: boolean | undefined;
+}
+/**
+ * Converts bearer token to session cookie
+ */
+declare const bearer: (options?: BearerOptions | undefined) => BetterAuthPlugin;
+//#endregion
+export { BearerOptions, bearer };
+//# sourceMappingURL=index.d.mts.map

package/dist/plugins/bearer/index.mjs

@@ -0,0 +1,66 @@
+import { parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
+import "../../cookies/index.mjs";
+import { serializeSignedCookie } from "better-call";
+import { createAuthMiddleware } from "@better-auth/core/api";
+import { createHMAC } from "@better-auth/utils/hmac";
+
+//#region src/plugins/bearer/index.ts
+/**
+* Converts bearer token to session cookie
+*/
+const bearer = (options) => {
+	return {
+		id: "bearer",
+		hooks: {
+			before: [{
+				matcher(context) {
+					return Boolean(context.request?.headers.get("authorization") || context.headers?.get("authorization"));
+				},
+				handler: createAuthMiddleware(async (c) => {
+					const token = c.request?.headers.get("authorization")?.replace("Bearer ", "") || c.headers?.get("Authorization")?.replace("Bearer ", "");
+					if (!token) return;
+					let signedToken = "";
+					if (token.includes(".")) signedToken = token.replace("=", "");
+					else {
+						if (options?.requireSignature) return;
+						signedToken = (await serializeSignedCookie("", token, c.context.secret)).replace("=", "");
+					}
+					try {
+						const decodedToken = decodeURIComponent(signedToken);
+						if (!await createHMAC("SHA-256", "base64urlnopad").verify(c.context.secret, decodedToken.split(".")[0], decodedToken.split(".")[1])) return;
+					} catch {
+						return;
+					}
+					const existingHeaders = c.request?.headers || c.headers;
+					const headers = new Headers({ ...Object.fromEntries(existingHeaders?.entries()) });
+					headers.append("cookie", `${c.context.authCookies.sessionToken.name}=${signedToken}`);
+					return { context: { headers } };
+				})
+			}],
+			after: [{
+				matcher(context) {
+					return true;
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const setCookie = ctx.context.responseHeaders?.get("set-cookie");
+					if (!setCookie) return;
+					const parsedCookies = parseSetCookieHeader(setCookie);
+					const cookieName = ctx.context.authCookies.sessionToken.name;
+					const sessionCookie = parsedCookies.get(cookieName);
+					if (!sessionCookie || !sessionCookie.value || sessionCookie["max-age"] === 0) return;
+					const token = sessionCookie.value;
+					const exposedHeaders = ctx.context.responseHeaders?.get("access-control-expose-headers") || "";
+					const headersSet = new Set(exposedHeaders.split(",").map((header) => header.trim()).filter(Boolean));
+					headersSet.add("set-auth-token");
+					ctx.setHeader("set-auth-token", token);
+					ctx.setHeader("Access-Control-Expose-Headers", Array.from(headersSet).join(", "));
+				})
+			}]
+		},
+		options
+	};
+};
+
+//#endregion
+export { bearer };
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/bearer/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/bearer/index.ts"],"sourcesContent":["import type { BetterAuthPlugin } from \"@better-auth/core\";\nimport { createAuthMiddleware } from \"@better-auth/core/api\";\nimport { createHMAC } from \"@better-auth/utils/hmac\";\nimport { serializeSignedCookie } from \"better-call\";\nimport { parseSetCookieHeader } from \"../../cookies\";\n\ndeclare module \"@better-auth/core\" {\n\tinterface BetterAuthPluginRegistry<AuthOptions, Options> {\n\t\tbearer: {\n\t\t\tcreator: typeof bearer;\n\t\t};\n\t}\n}\n\nexport interface BearerOptions {\n\t/**\n\t * If true, only signed tokens\n\t * will be converted to session\n\t * cookies\n\t *\n\t * @default false\n\t */\n\trequireSignature?: boolean | undefined;\n}\n\n/**\n * Converts bearer token to session cookie\n */\nexport const bearer = (options?: BearerOptions | undefined) => {\n\treturn {\n\t\tid: \"bearer\",\n\t\thooks: {\n\t\t\tbefore: [\n\t\t\t\t{\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn Boolean(\n\t\t\t\t\t\t\tcontext.request?.headers.get(\"authorization\") ||\n\t\t\t\t\t\t\t\tcontext.headers?.get(\"authorization\"),\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (c) => {\n\t\t\t\t\t\tconst token =\n\t\t\t\t\t\t\tc.request?.headers.get(\"authorization\")?.replace(\"Bearer \", \"\") ||\n\t\t\t\t\t\t\tc.headers?.get(\"Authorization\")?.replace(\"Bearer \", \"\");\n\t\t\t\t\t\tif (!token) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tlet signedToken = \"\";\n\t\t\t\t\t\tif (token.includes(\".\")) {\n\t\t\t\t\t\t\tsignedToken = token.replace(\"=\", \"\");\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tif (options?.requireSignature) {\n\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tsignedToken = (\n\t\t\t\t\t\t\t\tawait serializeSignedCookie(\"\", token, c.context.secret)\n\t\t\t\t\t\t\t).replace(\"=\", \"\");\n\t\t\t\t\t\t}\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tconst decodedToken = decodeURIComponent(signedToken);\n\t\t\t\t\t\t\tconst isValid = await createHMAC(\n\t\t\t\t\t\t\t\t\"SHA-256\",\n\t\t\t\t\t\t\t\t\"base64urlnopad\",\n\t\t\t\t\t\t\t).verify(\n\t\t\t\t\t\t\t\tc.context.secret,\n\t\t\t\t\t\t\t\tdecodedToken.split(\".\")[0]!,\n\t\t\t\t\t\t\t\tdecodedToken.split(\".\")[1]!,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tif (!isValid) {\n\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst existingHeaders = (c.request?.headers ||\n\t\t\t\t\t\t\tc.headers) as Headers;\n\t\t\t\t\t\tconst headers = new Headers({\n\t\t\t\t\t\t\t...Object.fromEntries(existingHeaders?.entries()),\n\t\t\t\t\t\t});\n\t\t\t\t\t\theaders.append(\n\t\t\t\t\t\t\t\"cookie\",\n\t\t\t\t\t\t\t`${c.context.authCookies.sessionToken.name}=${signedToken}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tcontext: {\n\t\t\t\t\t\t\t\theaders,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t};\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t\tafter: [\n\t\t\t\t{\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn true;\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst setCookie = ctx.context.responseHeaders?.get(\"set-cookie\");\n\t\t\t\t\t\tif (!setCookie) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst parsedCookies = parseSetCookieHeader(setCookie);\n\t\t\t\t\t\tconst cookieName = ctx.context.authCookies.sessionToken.name;\n\t\t\t\t\t\tconst sessionCookie = parsedCookies.get(cookieName);\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t!sessionCookie ||\n\t\t\t\t\t\t\t!sessionCookie.value ||\n\t\t\t\t\t\t\tsessionCookie[\"max-age\"] === 0\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst token = sessionCookie.value;\n\t\t\t\t\t\tconst exposedHeaders =\n\t\t\t\t\t\t\tctx.context.responseHeaders?.get(\n\t\t\t\t\t\t\t\t\"access-control-expose-headers\",\n\t\t\t\t\t\t\t) || \"\";\n\t\t\t\t\t\tconst headersSet = new Set(\n\t\t\t\t\t\t\texposedHeaders\n\t\t\t\t\t\t\t\t.split(\",\")\n\t\t\t\t\t\t\t\t.map((header) => header.trim())\n\t\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t\t);\n\t\t\t\t\t\theadersSet.add(\"set-auth-token\");\n\t\t\t\t\t\tctx.setHeader(\"set-auth-token\", token);\n\t\t\t\t\t\tctx.setHeader(\n\t\t\t\t\t\t\t\"Access-Control-Expose-Headers\",\n\t\t\t\t\t\t\tArray.from(headersSet).join(\", \"),\n\t\t\t\t\t\t);\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\toptions,\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;;;;AA4BA,MAAa,UAAU,YAAwC;AAC9D,QAAO;EACN,IAAI;EACJ,OAAO;GACN,QAAQ,CACP;IACC,QAAQ,SAAS;AAChB,YAAO,QACN,QAAQ,SAAS,QAAQ,IAAI,gBAAgB,IAC5C,QAAQ,SAAS,IAAI,gBAAgB,CACtC;;IAEF,SAAS,qBAAqB,OAAO,MAAM;KAC1C,MAAM,QACL,EAAE,SAAS,QAAQ,IAAI,gBAAgB,EAAE,QAAQ,WAAW,GAAG,IAC/D,EAAE,SAAS,IAAI,gBAAgB,EAAE,QAAQ,WAAW,GAAG;AACxD,SAAI,CAAC,MACJ;KAGD,IAAI,cAAc;AAClB,SAAI,MAAM,SAAS,IAAI,CACtB,eAAc,MAAM,QAAQ,KAAK,GAAG;UAC9B;AACN,UAAI,SAAS,iBACZ;AAED,qBACC,MAAM,sBAAsB,IAAI,OAAO,EAAE,QAAQ,OAAO,EACvD,QAAQ,KAAK,GAAG;;AAEnB,SAAI;MACH,MAAM,eAAe,mBAAmB,YAAY;AASpD,UAAI,CARY,MAAM,WACrB,WACA,iBACA,CAAC,OACD,EAAE,QAAQ,QACV,aAAa,MAAM,IAAI,CAAC,IACxB,aAAa,MAAM,IAAI,CAAC,GACxB,CAEA;aAEM;AACP;;KAED,MAAM,kBAAmB,EAAE,SAAS,WACnC,EAAE;KACH,MAAM,UAAU,IAAI,QAAQ,EAC3B,GAAG,OAAO,YAAY,iBAAiB,SAAS,CAAC,EACjD,CAAC;AACF,aAAQ,OACP,UACA,GAAG,EAAE,QAAQ,YAAY,aAAa,KAAK,GAAG,cAC9C;AACD,YAAO,EACN,SAAS,EACR,SACA,EACD;MACA;IACF,CACD;GACD,OAAO,CACN;IACC,QAAQ,SAAS;AAChB,YAAO;;IAER,SAAS,qBAAqB,OAAO,QAAQ;KAC5C,MAAM,YAAY,IAAI,QAAQ,iBAAiB,IAAI,aAAa;AAChE,SAAI,CAAC,UACJ;KAED,MAAM,gBAAgB,qBAAqB,UAAU;KACrD,MAAM,aAAa,IAAI,QAAQ,YAAY,aAAa;KACxD,MAAM,gBAAgB,cAAc,IAAI,WAAW;AACnD,SACC,CAAC,iBACD,CAAC,cAAc,SACf,cAAc,eAAe,EAE7B;KAED,MAAM,QAAQ,cAAc;KAC5B,MAAM,iBACL,IAAI,QAAQ,iBAAiB,IAC5B,gCACA,IAAI;KACN,MAAM,aAAa,IAAI,IACtB,eACE,MAAM,IAAI,CACV,KAAK,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ,CACjB;AACD,gBAAW,IAAI,iBAAiB;AAChC,SAAI,UAAU,kBAAkB,MAAM;AACtC,SAAI,UACH,iCACA,MAAM,KAAK,WAAW,CAAC,KAAK,KAAK,CACjC;MACA;IACF,CACD;GACD;EACD;EACA"}

package/dist/plugins/captcha/constants.d.mts

@@ -0,0 +1,10 @@
+//#region src/plugins/captcha/constants.d.ts
+declare const Providers: {
+  readonly CLOUDFLARE_TURNSTILE: "cloudflare-turnstile";
+  readonly GOOGLE_RECAPTCHA: "google-recaptcha";
+  readonly HCAPTCHA: "hcaptcha";
+  readonly CAPTCHAFOX: "captchafox";
+};
+//#endregion
+export { Providers };
+//# sourceMappingURL=constants.d.mts.map

package/dist/plugins/captcha/constants.mjs

@@ -0,0 +1,22 @@
+//#region src/plugins/captcha/constants.ts
+const defaultEndpoints = [
+	"/sign-up/email",
+	"/sign-in/email",
+	"/request-password-reset"
+];
+const Providers = {
+	CLOUDFLARE_TURNSTILE: "cloudflare-turnstile",
+	GOOGLE_RECAPTCHA: "google-recaptcha",
+	HCAPTCHA: "hcaptcha",
+	CAPTCHAFOX: "captchafox"
+};
+const siteVerifyMap = {
+	[Providers.CLOUDFLARE_TURNSTILE]: "https://challenges.cloudflare.com/turnstile/v0/siteverify",
+	[Providers.GOOGLE_RECAPTCHA]: "https://www.google.com/recaptcha/api/siteverify",
+	[Providers.HCAPTCHA]: "https://api.hcaptcha.com/siteverify",
+	[Providers.CAPTCHAFOX]: "https://api.captchafox.com/siteverify"
+};
+
+//#endregion
+export { Providers, defaultEndpoints, siteVerifyMap };
+//# sourceMappingURL=constants.mjs.map

package/dist/plugins/captcha/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":[],"sources":["../../../src/plugins/captcha/constants.ts"],"sourcesContent":["import type { Provider } from \"./types\";\n\nexport const defaultEndpoints = [\n\t\"/sign-up/email\",\n\t\"/sign-in/email\",\n\t\"/request-password-reset\",\n];\n\nexport const Providers = {\n\tCLOUDFLARE_TURNSTILE: \"cloudflare-turnstile\",\n\tGOOGLE_RECAPTCHA: \"google-recaptcha\",\n\tHCAPTCHA: \"hcaptcha\",\n\tCAPTCHAFOX: \"captchafox\",\n} as const;\n\nexport const siteVerifyMap: Record<Provider, string> = {\n\t[Providers.CLOUDFLARE_TURNSTILE]:\n\t\t\"https://challenges.cloudflare.com/turnstile/v0/siteverify\",\n\t[Providers.GOOGLE_RECAPTCHA]:\n\t\t\"https://www.google.com/recaptcha/api/siteverify\",\n\t[Providers.HCAPTCHA]: \"https://api.hcaptcha.com/siteverify\",\n\t[Providers.CAPTCHAFOX]: \"https://api.captchafox.com/siteverify\",\n};\n"],"mappings":";AAEA,MAAa,mBAAmB;CAC/B;CACA;CACA;CACA;AAED,MAAa,YAAY;CACxB,sBAAsB;CACtB,kBAAkB;CAClB,UAAU;CACV,YAAY;CACZ;AAED,MAAa,gBAA0C;EACrD,UAAU,uBACV;EACA,UAAU,mBACV;EACA,UAAU,WAAW;EACrB,UAAU,aAAa;CACxB"}

package/dist/plugins/captcha/error-codes.mjs

@@ -0,0 +1,16 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/captcha/error-codes.ts
+const EXTERNAL_ERROR_CODES = defineErrorCodes({
+	VERIFICATION_FAILED: "Captcha verification failed",
+	MISSING_RESPONSE: "Missing CAPTCHA response",
+	UNKNOWN_ERROR: "Something went wrong"
+});
+const INTERNAL_ERROR_CODES = defineErrorCodes({
+	MISSING_SECRET_KEY: "Missing secret key",
+	SERVICE_UNAVAILABLE: "CAPTCHA service unavailable"
+});
+
+//#endregion
+export { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES };
+//# sourceMappingURL=error-codes.mjs.map

package/dist/plugins/captcha/error-codes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.mjs","names":[],"sources":["../../../src/plugins/captcha/error-codes.ts"],"sourcesContent":["// These error codes are returned by the API\nimport { defineErrorCodes } from \"@better-auth/core/utils/error-codes\";\n\nexport const EXTERNAL_ERROR_CODES = defineErrorCodes({\n\tVERIFICATION_FAILED: \"Captcha verification failed\",\n\tMISSING_RESPONSE: \"Missing CAPTCHA response\",\n\tUNKNOWN_ERROR: \"Something went wrong\",\n});\n\n// These error codes are only visible in the server logs\nexport const INTERNAL_ERROR_CODES = defineErrorCodes({\n\tMISSING_SECRET_KEY: \"Missing secret key\",\n\tSERVICE_UNAVAILABLE: \"CAPTCHA service unavailable\",\n});\n"],"mappings":";;;AAGA,MAAa,uBAAuB,iBAAiB;CACpD,qBAAqB;CACrB,kBAAkB;CAClB,eAAe;CACf,CAAC;AAGF,MAAa,uBAAuB,iBAAiB;CACpD,oBAAoB;CACpB,qBAAqB;CACrB,CAAC"}

package/dist/plugins/captcha/index.d.mts

@@ -0,0 +1,14 @@
+import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./types.mjs";
+
+//#region src/plugins/captcha/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    captcha: {
+      creator: typeof captcha;
+    };
+  }
+}
+declare const captcha: (options: CaptchaOptions) => BetterAuthPlugin;
+//#endregion
+export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, captcha };
+//# sourceMappingURL=index.d.mts.map