@imtf/auth 1.1.0-beta.1 → 2.0.0-beta.0

package/README.md

@@ -0,0 +1,164 @@
+# @imtf/auth - Better Auth wrapper
+
+Thin wrapper around [`better-auth`](https://www.better-auth.com/) tailored for IMTF applications. Provides IMTF-specific auth configuration, hooks, and route helpers on top of `better-auth`, for use in Next.js apps.
+
+## Pre-requisites
+
+The following peer dependencies must be installed:
+
+- `better-auth` 1.7.1
+- `zod` 4.3.6 or higher — must stay version-matched with `better-auth`'s own `zod` dependency
+- `@mui/material` 7.1.0 or higher
+- `@mui/lab` 7.0.1-beta.18 or higher
+- `react` and `react-dom` 18.0.0 or 19.0.0 or higher
+
+## Installation
+
+```bash
+npm install @imtf/auth
+```
+
+## Usage
+
+This package supplies IMTF's `better-auth` configuration and a couple of OIDC-flow helpers — it does not wrap `betterAuth()`/`createAuthClient()` themselves. Call those directly with the options this package returns.
+
+### Server: `auth.ts`
+
+```ts
+import "server-only";
+
+import { getBetterAuthOptions } from "@imtf/auth";
+import { betterAuth, type BetterAuthOptions } from "better-auth";
+
+export const auth = betterAuth({
+  ...getBetterAuthOptions({
+    oidcDiscoveryUrl: `${process.env.OIDC_ISSUER_URL}/.well-known/openid-configuration`,
+    authSecret: process.env.AUTH_SECRET!,
+    authClientId: process.env.OIDC_CLIENT_ID!,
+    authClientSecret: process.env.OIDC_CLIENT_SECRET!,
+    authBaseURL: process.env.AUTH_BASE_URL,
+  }),
+} satisfies BetterAuthOptions);
+```
+
+### Client: `auth-client.ts`
+
+```ts
+"use client";
+
+import { createAuthClient } from "better-auth/react";
+
+export const authClient = createAuthClient();
+```
+
+### Route handler: `app/api/auth/[...all]/route.ts`
+
+```ts
+import type { NextRequest } from "next/server";
+import { auth } from "@/auth";
+
+function handler(request: NextRequest) {
+  return auth.handler(request);
+}
+
+export const GET = handler;
+export const POST = handler;
+```
+
+### Federated sign-out route: `app/api/auth/sign-out-url/route.ts`
+
+```ts
+import { getSignOutUrlRoute } from "@imtf/auth";
+import { headers } from "next/headers";
+import { auth } from "@/auth";
+
+export const GET = getSignOutUrlRoute({
+  auth,
+  discoveryUrl: `${process.env.OIDC_ISSUER_URL}/.well-known/openid-configuration`,
+  headers,
+});
+```
+
+### Session check in a server component
+
+```ts
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { auth } from "@/auth";
+
+export async function AuthGuard({ children }: { children: React.ReactNode }) {
+  const { accessToken } = await auth.api
+    .getAccessToken({ body: { useAccountCookie: true }, headers: await headers() })
+    .catch(() => ({ accessToken: undefined }));
+
+  if (!accessToken) redirect("/auth/sign-in");
+
+  return children;
+}
+```
+
+### Sign-in and sign-out (client components)
+
+```tsx
+"use client";
+
+import { PROVIDER_ID, useSignOut } from "@imtf/auth";
+import { authClient } from "@/auth-client";
+
+function SignInButton() {
+  const handleSignIn = () =>
+    void authClient.signIn.social({ provider: PROVIDER_ID, callbackURL: "/" });
+
+  return <button onClick={handleSignIn}>Sign in</button>;
+}
+
+function SignOutButton() {
+  const { handleSignOut } = useSignOut({ authClient });
+
+  return <button onClick={handleSignOut}>Sign out</button>;
+}
+```
+
+### Full export list
+
+```ts
+import {
+  getBetterAuthOptions,
+  getBetterAuthClientOptions,
+  getSignOutUrlRoute,
+  useSignOut,
+  PROVIDER_ID,
+} from "@imtf/auth";
+```
+
+> `getBetterAuthClientOptions` is deprecated as of `better-auth` 1.7 — generic OAuth sign-in no longer needs a client plugin, so `createAuthClient()` can be called with no options as shown above.
+
+## Development
+
+Prior to development, make sure you have installed the dependencies from the **repository root**:
+
+```bash
+pnpm install
+```
+
+## Testing
+
+To run the tests, just run:
+
+```bash
+pnpm run test
+```
+
+Coverage report can be generated with:
+
+```bash
+pnpm run test:coverage
+```
+
+## Migration from v1 to v2
+
+`@imtf/auth` v2 upgrades its `better-auth` peer dependency from `1.6.30` to `1.7.1`. `better-auth` 1.7 rewrote the generic OAuth plugin as a first-class social provider — see the [Better Auth 1.7 upgrade guide](https://www.better-auth.com/docs/guides/1-7-upgrade-guide) for the full list of breaking changes upstream. The changes relevant to consumers of this package are:
+
+- **OAuth callback URL path changed.** The redirect URI that `better-auth` exposes for the generic OIDC provider moved from `{baseURL}/oauth2/callback/{providerId}` to `{baseURL}/callback/{providerId}` (e.g. `https://app.example.com/api/auth/oauth2/callback/oidc-provider` → `https://app.example.com/api/auth/callback/oidc-provider`). **You must update the redirect URI registered with your OIDC provider/IdP client** before deploying this upgrade, or sign-in will fail.
+- **`getSignOutUrlRoute` dropped its `providerId` option.** `better-auth`'s `getAccessToken` API no longer accepts `providerId` to select an account; it now resolves the account from the signed account cookie (`useAccountCookie: true`), matching this package's database-less, `storeAccountCookie: true` configuration. If you were passing `providerId` to `getSignOutUrlRoute`, remove it — it is no longer read.
+- **No client plugin is required for generic OAuth sign-in anymore.** `getBetterAuthClientOptions()` no longer registers `genericOAuthClient()` (removed upstream). Generic/custom OAuth providers now sign in through the standard `authClient.signIn.social({ provider })` / `authClient.linkSocial({ provider })` methods. No action needed on your end beyond upgrading — this package's exported options already reflect the change.

package/lib/constants.esm.js

@@ -1,4 +1,7 @@
-const PROVIDER_ID = "oidc-provider";
-export {
-  PROVIDER_ID
-};
+//#region src/constants.ts
+/**
+* Generic OIDC provider identifier used for authentication.
+*/
+var PROVIDER_ID = "oidc-provider";
+//#endregion
+export { PROVIDER_ID };

package/lib/hooks/useSignOut.esm.js

@@ -1,57 +1,70 @@
+"use client";
 import { useCallback } from "react";
-function useSignOut({
-  postSignOutRedirectPath = "/auth/sign-in?sign-out=success",
-  retrieveSignOutUrlPath = "/api/auth/sign-out-url",
-  onSignOutStart,
-  onSignOutSuccess,
-  authClient,
-  origin: providedOrigin
-}) {
-  const origin = providedOrigin ?? (typeof window !== "undefined" ? window.location.origin : "");
-  const standardSignOut = useCallback(() => {
-    onSignOutStart?.();
-    void authClient.signOut({
-      fetchOptions: {
-        onSuccess: onSignOutSuccess
-      }
-    });
-  }, [authClient, onSignOutStart, onSignOutSuccess]);
-  const handleSignOut = useCallback(async () => {
-    const postLogoutRedirectUri = `${origin}${postSignOutRedirectPath}`;
-    try {
-      const response = await fetch(
-        `${retrieveSignOutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`
-      );
-      if (!response.ok) {
-        const { error } = await response.json().catch(() => ({ error: null }));
-        throw new Error(error ?? "Failed to create logout URL");
-      }
-      const { url } = await response.json();
-      if (!url) {
-        standardSignOut();
-        return;
-      }
-      await authClient.signOut();
-      if (typeof window === "undefined") {
-        return;
-      }
-      window.location.href = url;
-    } catch (error) {
-      console.error(
-        "Error during federated logout, switching to standard logout:",
-        error
-      );
-      standardSignOut();
-    }
-  }, [
-    authClient,
-    origin,
-    postSignOutRedirectPath,
-    retrieveSignOutUrlPath,
-    standardSignOut
-  ]);
-  return { handleSignOut };
+//#region src/hooks/useSignOut.tsx
+/**
+* Custom hook for handling user sign-out with support for federated logout.
+*
+* @example
+* ```tsx
+* const { handleSignOut } = useSignOut({ postSignOutRedirectPath: "/auth/sign-in?sign-out=success" });
+* ```
+*/
+function useSignOut({ postSignOutRedirectPath = "/auth/sign-in?sign-out=success", retrieveSignOutUrlPath = "/api/auth/sign-out-url", onSignOutStart, onSignOutSuccess, authClient, origin: providedOrigin }) {
+	const origin = providedOrigin ?? (typeof window !== "undefined" ? window.location.origin : "");
+	/**
+	* Performs a standard (non-federated) sign-out and redirects to the sign-in page.
+	*/
+	const standardSignOut = useCallback(() => {
+		onSignOutStart?.();
+		authClient.signOut({ fetchOptions: { onSuccess: onSignOutSuccess } });
+	}, [
+		authClient,
+		onSignOutStart,
+		onSignOutSuccess
+	]);
+	return { handleSignOut: useCallback(async () => {
+		const postLogoutRedirectUri = `${origin}${postSignOutRedirectPath}`;
+		/**
+		* Attempt federated logout. This is, surprisingly, not built into better-auth:
+		*/
+		try {
+			/**
+			* Create a logout URL before we invoke authClient.signOut(), since it clears critical tokens.
+			*/
+			const response = await fetch(`${origin}${retrieveSignOutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`);
+			if (!response.ok) {
+				const errorBody = await response.json().catch(() => null);
+				const error = errorBody !== null && typeof errorBody === "object" && "error" in errorBody && typeof errorBody.error === "string" ? errorBody.error : null;
+				throw new Error(error ?? "Failed to create logout URL");
+			}
+			const responseBody = await response.json();
+			const url = responseBody !== null && typeof responseBody === "object" && "url" in responseBody && typeof responseBody.url === "string" ? responseBody.url : null;
+			if (!url) {
+				standardSignOut();
+				return;
+			}
+			/**
+			* Sign out from better-auth, then redirect the user to the OIDC provider's
+			* end_session_endpoint to terminate the federated session. The provider
+			* should automatically redirect back to the application after logout.
+			*/
+			await authClient.signOut();
+			if (typeof window === "undefined") return;
+			window.location.href = url;
+		} catch (error) {
+			console.error("Error during federated logout, switching to standard logout:", error);
+			/**
+			* Fallback: Standard logout
+			*/
+			standardSignOut();
+		}
+	}, [
+		authClient,
+		origin,
+		postSignOutRedirectPath,
+		retrieveSignOutUrlPath,
+		standardSignOut
+	]) };
 }
-export {
-  useSignOut
-};
+//#endregion
+export { useSignOut };

package/lib/index.esm.js

@@ -1,12 +1,6 @@
+import { PROVIDER_ID } from "./constants.esm.js";
 import { getBetterAuthOptions } from "./options/auth.esm.js";
 import { getBetterAuthClientOptions } from "./options/auth-client.esm.js";
 import { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute.esm.js";
-import { PROVIDER_ID } from "./constants.esm.js";
 import { useSignOut } from "./hooks/useSignOut.esm.js";
-export {
-  PROVIDER_ID,
-  getBetterAuthClientOptions,
-  getBetterAuthOptions,
-  getSignOutUrlRoute,
-  useSignOut
-};
+export { PROVIDER_ID, getBetterAuthClientOptions, getBetterAuthOptions, getSignOutUrlRoute, useSignOut };

package/lib/options/auth-client.esm.js

@@ -1,9 +1,15 @@
-import { genericOAuthClient } from "better-auth/client/plugins";
+"use client";
+//#region src/options/auth-client.ts
+/**
+* Generic OAuth providers sign in through the standard `signIn.social` /
+* `linkSocial` client methods (better-auth 1.7+), so no client plugin is
+* required.
+*
+* @deprecated No longer needed — pass options directly to `createAuthClient`
+* instead. Will be removed in a future major version.
+*/
 function getBetterAuthClientOptions() {
-  return {
-    plugins: [genericOAuthClient()]
-  };
+	return {};
 }
-export {
-  getBetterAuthClientOptions
-};
+//#endregion
+export { getBetterAuthClientOptions };

package/lib/options/auth.esm.js

@@ -1,61 +1,42 @@
+import { PROVIDER_ID } from "../constants.esm.js";
 import { nextCookies } from "better-auth/next-js";
 import { genericOAuth } from "better-auth/plugins";
-import { PROVIDER_ID } from "../constants.esm.js";
-function getBetterAuthOptions({
-  oidcDiscoveryUrl,
-  authSecret,
-  authBaseURL,
-  authClientId,
-  authClientSecret,
-  providerId = PROVIDER_ID
-}) {
-  return {
-    secret: authSecret,
-    baseURL: authBaseURL,
-    session: {
-      cookieCache: {
-        enabled: true,
-        version: "1",
-        maxAge: 60 * 60 * 24,
-        // Cache duration in seconds (1 day)
-        strategy: "jwe",
-        refreshCache: true
-        // Enable stateless refresh
-      },
-      expiresIn: 60 * 60 * 24,
-      // Session expiration (1 day)
-      updateAge: 60 * 60,
-      // How often to update the session (1 hour)
-      freshAge: 60 * 5
-      // Consider session fresh for 5 minutes
-    },
-    account: {
-      updateAccountOnSignIn: true,
-      storeStateStrategy: "cookie",
-      storeAccountCookie: true
-      // Store account data in cookie (required for database-less flows)
-    },
-    plugins: [
-      genericOAuth({
-        config: [
-          {
-            providerId,
-            clientId: authClientId,
-            clientSecret: authClientSecret,
-            discoveryUrl: oidcDiscoveryUrl,
-            scopes: ["openid"],
-            pkce: true
-          }
-        ]
-      }),
-      // Next.js cookie integration for server actions and middleware
-      nextCookies()
-    ],
-    onAPIError: {
-      errorURL: "/auth/error"
-    }
-  };
+//#region src/options/auth.ts
+function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId = PROVIDER_ID }) {
+	/**
+	* Better-auth configuration with OIDC/OAuth2 support.
+	* Uses cookie-based session storage for database-less authentication.
+	*/
+	return {
+		secret: authSecret,
+		baseURL: authBaseURL,
+		session: {
+			cookieCache: {
+				enabled: true,
+				version: "1",
+				maxAge: 86400,
+				strategy: "jwe",
+				refreshCache: true
+			},
+			expiresIn: 86400,
+			updateAge: 3600,
+			freshAge: 300
+		},
+		account: {
+			updateAccountOnSignIn: true,
+			storeStateStrategy: "cookie",
+			storeAccountCookie: true
+		},
+		plugins: [genericOAuth({ config: [{
+			providerId,
+			clientId: authClientId,
+			clientSecret: authClientSecret,
+			discoveryUrl: oidcDiscoveryUrl,
+			scopes: ["openid"],
+			pkce: true
+		}] }), nextCookies()],
+		onAPIError: { errorURL: "/auth/error" }
+	};
 }
-export {
-  getBetterAuthOptions
-};
+//#endregion
+export { getBetterAuthOptions };

package/lib/routes/getSignOutUrlRoute.esm.js

@@ -1,60 +1,50 @@
-import { PROVIDER_ID } from "../constants.esm.js";
-function getSignOutUrlRoute({
-  auth,
-  discoveryUrl,
-  federatedLogout = true,
-  providerId = PROVIDER_ID,
-  headers
-}) {
-  return async function GET(request) {
-    try {
-      if (!federatedLogout || !discoveryUrl) {
-        return Response.json({ url: null }, { status: 200 });
-      }
-      const token = await auth.api.getAccessToken({
-        body: {
-          providerId
-        },
-        headers: await headers()
-      }).catch(() => null);
-      if (!token?.idToken) {
-        return Response.json(
-          { error: "No ID token found for user" },
-          { status: 400 }
-        );
-      }
-      const wellKnownResponse = await fetch(discoveryUrl);
-      if (!wellKnownResponse.ok) {
-        return Response.json(
-          { error: "Failed to fetch OIDC discovery document" },
-          { status: 500 }
-        );
-      }
-      const wellKnownConfig = await wellKnownResponse.json();
-      const endSessionEndpoint = wellKnownConfig.end_session_endpoint;
-      if (!endSessionEndpoint) {
-        return Response.json(
-          { error: "Could not determine end_session_endpoint" },
-          { status: 500 }
-        );
-      }
-      const logoutUrl = new URL(endSessionEndpoint);
-      const postLogoutRedirectUri = request.nextUrl.searchParams.get("post_logout_redirect_uri") ?? "/auth/sign-in";
-      logoutUrl.searchParams.set(
-        "post_logout_redirect_uri",
-        postLogoutRedirectUri
-      );
-      logoutUrl.searchParams.set("id_token_hint", token.idToken);
-      return Response.json({ url: logoutUrl.toString() });
-    } catch (error) {
-      console.error("Failed to construct logout URL:", error);
-      return Response.json(
-        { error: "Failed to construct logout URL" },
-        { status: 500 }
-      );
-    }
-  };
+//#region src/routes/getSignOutUrlRoute.ts
+function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, headers }) {
+	/**
+	* API route that constructs a federated logout URL for OIDC providers.
+	* Returns null if federated logout is disabled.
+	*
+	* @param request - Next.js request object with optional post_logout_redirect_uri parameter
+	* @returns JSON response with logout URL or error
+	*/
+	return async function GET(request) {
+		try {
+			if (!federatedLogout || !discoveryUrl) return Response.json({ url: null }, { status: 200 });
+			/**
+			* Retrieve the user's ID token, to produce a valid logout URL.
+			* `useAccountCookie` reads the single OAuth account stored in the
+			* signed cookie (database-less flow), matching `storeAccountCookie`.
+			*/
+			const token = await auth.api.getAccessToken({
+				body: { useAccountCookie: true },
+				headers: await headers()
+			}).catch(() => null);
+			if (!token?.idToken) return Response.json({ error: "No ID token found for user" }, { status: 400 });
+			/**
+			* Fetch the well-known configuration from the OIDC provider to construct the
+			* logout URL.
+			*/
+			const wellKnownResponse = await fetch(discoveryUrl);
+			if (!wellKnownResponse.ok) return Response.json({ error: "Failed to fetch OIDC discovery document" }, { status: 500 });
+			const wellKnownConfigJson = await wellKnownResponse.json();
+			const endSessionEndpoint = wellKnownConfigJson !== null && typeof wellKnownConfigJson === "object" && "end_session_endpoint" in wellKnownConfigJson && typeof wellKnownConfigJson.end_session_endpoint === "string" ? wellKnownConfigJson.end_session_endpoint : void 0;
+			if (!endSessionEndpoint) return Response.json({ error: "Could not determine end_session_endpoint" }, { status: 500 });
+			/**
+			* Construct the logout URL with parameters.
+			* - end_session_endpoint: The OIDC provider's end_session_endpoint.
+			* - post_logout_redirect_uri: The URL to redirect to after logout.
+			* - id_token_hint: The user's ID token.
+			*/
+			const logoutUrl = new URL(endSessionEndpoint);
+			const postLogoutRedirectUri = request.nextUrl.searchParams.get("post_logout_redirect_uri") ?? "/auth/sign-in";
+			logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutRedirectUri);
+			logoutUrl.searchParams.set("id_token_hint", token.idToken);
+			return Response.json({ url: logoutUrl.toString() });
+		} catch (error) {
+			console.error("Failed to construct logout URL:", error);
+			return Response.json({ error: "Failed to construct logout URL" }, { status: 500 });
+		}
+	};
 }
-export {
-  getSignOutUrlRoute
-};
+//#endregion
+export { getSignOutUrlRoute };

package/lib/types/hooks/useSignOut.d.ts

@@ -21,7 +21,11 @@ export type UseSignOutOptions = {
      */
     authClient: ReturnType<typeof createAuthClient>;
     /**
-     * Optional origin to use for constructing the post-logout redirect URI. Defaults to the current window location origin.
+     * Optional origin (and, if applicable, base path) prepended to both
+     * `retrieveSignOutUrlPath` and `postSignOutRedirectPath`. Defaults to the
+     * current window location origin. Useful when the app is served under a
+     * base path, since these URLs are built outside Next's router and don't
+     * get it auto-applied.
      */
     origin?: string;
 };

package/lib/types/options/auth-client.d.ts

@@ -1,176 +1,9 @@
-export declare function getBetterAuthClientOptions(): {
-    readonly plugins: [{
-        id: "generic-oauth-client";
-        $InferServerPlugin: ReturnType<(options: import("better-auth/plugins").GenericOAuthOptions) => {
-            id: "generic-oauth";
-            init: (ctx: import("better-auth").AuthContext) => {
-                context: {
-                    socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
-                };
-            };
-            endpoints: {
-                signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        providerId: import("zod").ZodString;
-                        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                        requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                        additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                    }, import("better-auth").$strip>;
-                    metadata: {
-                        openapi: {
-                            description: string;
-                            responses: {
-                                200: {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                    };
-                                                    redirect: {
-                                                        type: string;
-                                                    };
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                }, {
-                    url: string;
-                    redirect: boolean;
-                }>;
-                oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
-                    method: "GET";
-                    query: import("zod").ZodObject<{
-                        code: import("zod").ZodOptional<import("zod").ZodString>;
-                        error: import("zod").ZodOptional<import("zod").ZodString>;
-                        error_description: import("zod").ZodOptional<import("zod").ZodString>;
-                        state: import("zod").ZodOptional<import("zod").ZodString>;
-                        iss: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("better-auth").$strip>;
-                    metadata: {
-                        allowedMediaTypes: string[];
-                        openapi: {
-                            description: string;
-                            responses: {
-                                200: {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                    };
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                        scope: "server";
-                    };
-                }, void>;
-                oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        providerId: import("zod").ZodString;
-                        callbackURL: import("zod").ZodString;
-                        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("better-auth").$strip>;
-                    use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-                        session: {
-                            session: Record<string, any> & {
-                                id: string;
-                                createdAt: Date;
-                                updatedAt: Date;
-                                userId: string;
-                                expiresAt: Date;
-                                token: string;
-                                ipAddress?: string | null | undefined;
-                                userAgent?: string | null | undefined;
-                            };
-                            user: Record<string, any> & {
-                                id: string;
-                                createdAt: Date;
-                                updatedAt: Date;
-                                email: string;
-                                emailVerified: boolean;
-                                name: string;
-                                image?: string | null | undefined;
-                            };
-                        };
-                    }>)[];
-                    metadata: {
-                        openapi: {
-                            description: string;
-                            responses: {
-                                "200": {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                        format: string;
-                                                        description: string;
-                                                    };
-                                                    redirect: {
-                                                        type: string;
-                                                        description: string;
-                                                        enum: boolean[];
-                                                    };
-                                                };
-                                                required: string[];
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                }, {
-                    url: string;
-                    redirect: boolean;
-                }>;
-            };
-            options: import("better-auth/plugins").GenericOAuthOptions;
-            $ERROR_CODES: {
-                INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
-                TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-                PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-                PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-                INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-                SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-                ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-                ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
-            };
-        }>;
-        $ERROR_CODES: {
-            INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
-            TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-            PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-            PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-            INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-            SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-            ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-            ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
-        };
-    }];
-};
+/**
+ * Generic OAuth providers sign in through the standard `signIn.social` /
+ * `linkSocial` client methods (better-auth 1.7+), so no client plugin is
+ * required.
+ *
+ * @deprecated No longer needed — pass options directly to `createAuthClient`
+ * instead. Will be removed in a future major version.
+ */
+export declare function getBetterAuthClientOptions(): {};

package/lib/types/options/auth.d.ts

@@ -27,174 +27,28 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
     };
     readonly plugins: [{
         id: "generic-oauth";
-        init: (ctx: import("better-auth").AuthContext) => {
+        version: string;
+        init: (ctx: import("better-auth").AuthContext) => Promise<{
             context: {
-                socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
+                socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
             };
-        };
-        endpoints: {
-            signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                }, import("better-auth").$strip>;
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-            oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
-                method: "GET";
-                query: import("zod").ZodObject<{
-                    code: import("zod").ZodOptional<import("zod").ZodString>;
-                    error: import("zod").ZodOptional<import("zod").ZodString>;
-                    error_description: import("zod").ZodOptional<import("zod").ZodString>;
-                    state: import("zod").ZodOptional<import("zod").ZodString>;
-                    iss: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth").$strip>;
-                metadata: {
-                    allowedMediaTypes: string[];
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                    scope: "server";
-                };
-            }, void>;
-            oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodString;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth").$strip>;
-                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-                    session: {
-                        session: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            userId: string;
-                            expiresAt: Date;
-                            token: string;
-                            ipAddress?: string | null | undefined;
-                            userAgent?: string | null | undefined;
-                        };
-                        user: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            email: string;
-                            emailVerified: boolean;
-                            name: string;
-                            image?: string | null | undefined;
-                        };
-                    };
-                }>)[];
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            "200": {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                    format: string;
-                                                    description: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                    description: string;
-                                                    enum: boolean[];
-                                                };
-                                            };
-                                            required: string[];
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-        };
-        options: import("better-auth/plugins").GenericOAuthOptions;
+        }>;
+        options: import("better-auth/plugins").GenericOAuthOptions<string>;
         $ERROR_CODES: {
             INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
             TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-            PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-            PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-            INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-            SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-            ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-            ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
         };
     }, {
         id: "next-cookies";
+        version: string;
         hooks: {
             before: {
                 matcher(ctx: import("better-auth").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
             after: {
                 matcher(ctx: import("better-auth").HookEndpointContext): true;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
         };
     }];

package/lib/types/routes/getSignOutUrlRoute.d.ts

@@ -1,10 +1,9 @@
 import type { Auth } from "better-auth";
 import { headers as nextHeaders } from "next/headers";
 import type { NextRequest } from "next/server";
-export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, providerId, headers, }: {
+export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, headers, }: {
     auth: Auth;
     discoveryUrl?: string;
     federatedLogout?: boolean;
-    providerId?: string;
     headers: typeof nextHeaders;
 }): (request: NextRequest) => Promise<Response>;

package/package.json

@@ -1,29 +1,14 @@
 {
   "name": "@imtf/auth",
-  "version": "1.1.0-beta.1",
+  "version": "2.0.0-beta.0",
   "description": "Better auth wrapper for imtf usage",
   "license": "UNLICENSED",
   "author": "",
   "type": "module",
-  "scripts": {
-    "prebuild": "npm run build:clean",
-    "build:clean": "rimraf lib",
-    "build:js": "vite build",
-    "build:types": "tsc --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
-    "build": "concurrently npm:build:js npm:build:types",
-    "lint": "eslint src --cache --report-unused-disable-directives --max-warnings 0",
-    "test": "vitest",
-    "test:ui": "vitest --ui --coverage",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc --noEmit",
-    "checks": "concurrently --kill-others-on-fail npm:lint npm:typecheck",
-    "prepublishOnly": "npm run build && npm run checks"
-  },
   "files": [
     "lib",
     "schemas"
   ],
-  "prettier": "@imtf/prettier-config",
   "module": "./lib/index.esm.js",
   "types": "./lib/types/index.d.ts",
   "exports": {
@@ -33,18 +18,34 @@
     }
   },
   "dependencies": {
-    "@imtf/panache": "^5.6.0"
+    "@imtf/panache": "^5.10.2"
   },
   "peerDependencies": {
     "@mui/lab": "^7.0.1-beta.18",
     "@mui/material": "^7.1.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "better-auth": "^1.5.3"
+    "better-auth": "^1.7.1",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@mui/lab": "^7.0.1-beta.18",
     "@mui/material": "^7.1.0",
-    "better-auth": "^1.5.3"
+    "better-auth": "^1.7.1",
+    "zod": "^4.3.6"
+  },
+  "scripts": {
+    "prebuild": "pnpm run build:clean",
+    "build:clean": "rimraf lib",
+    "build:js": "vite build",
+    "build:types": "tsc --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
+    "build": "concurrently pnpm:build:js pnpm:build:types",
+    "lint": "oxlint --type-aware --type-check --deny-warnings src",
+    "format:check": "oxfmt --check './src/**/*.{ts,tsx}'",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest",
+    "test:ui": "vitest --ui --coverage",
+    "test:coverage": "vitest run --coverage",
+    "checks": "concurrently --kill-others-on-fail pnpm:lint pnpm:typecheck pnpm:format:check"
   }
-}
+}