@imtf/auth 1.1.0-beta.2 → 2.0.0

package/README.md

@@ -0,0 +1,167 @@
+# @imtf/auth - Better Auth wrapper
+
+Thin wrapper around [`better-auth`](https://www.better-auth.com/) tailored for IMTF applications. Provides IMTF-specific auth configuration, hooks, and route helpers on top of `better-auth`, for use in Next.js apps.
+
+## Pre-requisites
+
+The following peer dependencies must be installed:
+
+- `better-auth` 1.7.1
+- `zod` 4.3.6 or higher — must stay version-matched with `better-auth`'s own `zod` dependency
+- `@mui/material` 7.1.0 or higher
+- `@mui/lab` 7.0.1-beta.18 or higher
+- `react` and `react-dom` 18.0.0 or 19.0.0 or higher
+
+## Installation
+
+```bash
+npm install @imtf/auth
+```
+
+## Usage
+
+This package supplies IMTF's `better-auth` configuration and a couple of OIDC-flow helpers — it does not wrap `betterAuth()`/`createAuthClient()` themselves. Call those directly with the options this package returns.
+
+### Server: `auth.ts`
+
+```ts
+import "server-only";
+
+import { getBetterAuthOptions } from "@imtf/auth";
+import { betterAuth, type BetterAuthOptions } from "better-auth";
+
+export const auth = betterAuth({
+  ...getBetterAuthOptions({
+    oidcDiscoveryUrl: `${process.env.OIDC_ISSUER_URL}/.well-known/openid-configuration`,
+    authSecret: process.env.AUTH_SECRET!,
+    authClientId: process.env.OIDC_CLIENT_ID!,
+    authClientSecret: process.env.OIDC_CLIENT_SECRET!,
+    authBaseURL: process.env.AUTH_BASE_URL,
+  }),
+} satisfies BetterAuthOptions);
+```
+
+### Client: `auth-client.ts`
+
+```ts
+"use client";
+
+import { createAuthClient } from "better-auth/react";
+
+export const authClient = createAuthClient();
+```
+
+### Route handler: `app/api/auth/[...all]/route.ts`
+
+```ts
+import type { NextRequest } from "next/server";
+import { auth } from "@/auth";
+
+function handler(request: NextRequest) {
+  return auth.handler(request);
+}
+
+export const GET = handler;
+export const POST = handler;
+```
+
+### Federated sign-out route: `app/api/auth/sign-out-url/route.ts`
+
+```ts
+import { getSignOutUrlRoute } from "@imtf/auth";
+import { headers } from "next/headers";
+import { auth } from "@/auth";
+
+export const GET = getSignOutUrlRoute({
+  auth,
+  discoveryUrl: `${process.env.OIDC_ISSUER_URL}/.well-known/openid-configuration`,
+  headers,
+  clientId: process.env.OIDC_CLIENT_ID,
+});
+```
+
+> `clientId` lets the route build an end-session URL even when no ID token is available — for example when the OIDC provider's callback failed before better-auth stored an account cookie (missing email claim, denied consent, etc.). Without it, that case has no way to end the provider's SSO session, which otherwise leaves the user stuck in a silent re-authentication loop.
+
+### Session check in a server component
+
+```ts
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { auth } from "@/auth";
+
+export async function AuthGuard({ children }: { children: React.ReactNode }) {
+  const { accessToken } = await auth.api
+    .getAccessToken({ body: { useAccountCookie: true }, headers: await headers() })
+    .catch(() => ({ accessToken: undefined }));
+
+  if (!accessToken) redirect("/auth/sign-in");
+
+  return children;
+}
+```
+
+### Sign-in and sign-out (client components)
+
+```tsx
+"use client";
+
+import { PROVIDER_ID, useSignOut } from "@imtf/auth";
+import { authClient } from "@/auth-client";
+
+function SignInButton() {
+  const handleSignIn = () =>
+    void authClient.signIn.social({ provider: PROVIDER_ID, callbackURL: "/" });
+
+  return <button onClick={handleSignIn}>Sign in</button>;
+}
+
+function SignOutButton() {
+  const { handleSignOut } = useSignOut({ authClient });
+
+  return <button onClick={handleSignOut}>Sign out</button>;
+}
+```
+
+### Full export list
+
+```ts
+import {
+  getBetterAuthOptions,
+  getBetterAuthClientOptions,
+  getSignOutUrlRoute,
+  useSignOut,
+  PROVIDER_ID,
+} from "@imtf/auth";
+```
+
+> `getBetterAuthClientOptions` is deprecated as of `better-auth` 1.7 — generic OAuth sign-in no longer needs a client plugin, so `createAuthClient()` can be called with no options as shown above.
+
+## Development
+
+Prior to development, make sure you have installed the dependencies from the **repository root**:
+
+```bash
+pnpm install
+```
+
+## Testing
+
+To run the tests, just run:
+
+```bash
+pnpm run test
+```
+
+Coverage report can be generated with:
+
+```bash
+pnpm run test:coverage
+```
+
+## Migration from v1 to v2
+
+`@imtf/auth` v2 upgrades its `better-auth` peer dependency from `1.6.30` to `1.7.1`. `better-auth` 1.7 rewrote the generic OAuth plugin as a first-class social provider — see the [Better Auth 1.7 upgrade guide](https://www.better-auth.com/docs/guides/1-7-upgrade-guide) for the full list of breaking changes upstream. The changes relevant to consumers of this package are:
+
+- **OAuth callback URL path changed.** The redirect URI that `better-auth` exposes for the generic OIDC provider moved from `{baseURL}/oauth2/callback/{providerId}` to `{baseURL}/callback/{providerId}` (e.g. `https://app.example.com/api/auth/oauth2/callback/oidc-provider` → `https://app.example.com/api/auth/callback/oidc-provider`). **You must update the redirect URI registered with your OIDC provider/IdP client** before deploying this upgrade, or sign-in will fail.
+- **`getSignOutUrlRoute` dropped its `providerId` option.** `better-auth`'s `getAccessToken` API no longer accepts `providerId` to select an account; it now resolves the account from the signed account cookie (`useAccountCookie: true`), matching this package's database-less, `storeAccountCookie: true` configuration. If you were passing `providerId` to `getSignOutUrlRoute`, remove it — it is no longer read.
+- **No client plugin is required for generic OAuth sign-in anymore.** `getBetterAuthClientOptions()` no longer registers `genericOAuthClient()` (removed upstream). Generic/custom OAuth providers now sign in through the standard `authClient.signIn.social({ provider })` / `authClient.linkSocial({ provider })` methods. No action needed on your end beyond upgrading — this package's exported options already reflect the change.

package/lib/hooks/useSignOut.esm.js

@@ -31,12 +31,14 @@ function useSignOut({ postSignOutRedirectPath = "/auth/sign-in?sign-out=success"
 			/**
 			* Create a logout URL before we invoke authClient.signOut(), since it clears critical tokens.
 			*/
-			const response = await fetch(`${retrieveSignOutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`);
+			const response = await fetch(`${origin}${retrieveSignOutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`);
 			if (!response.ok) {
-				const { error } = await response.json().catch(() => ({ error: null }));
+				const errorBody = await response.json().catch(() => null);
+				const error = errorBody !== null && typeof errorBody === "object" && "error" in errorBody && typeof errorBody.error === "string" ? errorBody.error : null;
 				throw new Error(error ?? "Failed to create logout URL");
 			}
-			const { url } = await response.json();
+			const responseBody = await response.json();
+			const url = responseBody !== null && typeof responseBody === "object" && "url" in responseBody && typeof responseBody.url === "string" ? responseBody.url : null;
 			if (!url) {
 				standardSignOut();
 				return;

package/lib/options/auth-client.esm.js

@@ -1,8 +1,15 @@
 "use client";
-import { genericOAuthClient } from "better-auth/client/plugins";
 //#region src/options/auth-client.ts
+/**
+* Generic OAuth providers sign in through the standard `signIn.social` /
+* `linkSocial` client methods (better-auth 1.7+), so no client plugin is
+* required.
+*
+* @deprecated No longer needed — pass options directly to `createAuthClient`
+* instead. Will be removed in a future major version.
+*/
 function getBetterAuthClientOptions() {
-	return { plugins: [genericOAuthClient()] };
+	return {};
 }
 //#endregion
 export { getBetterAuthClientOptions };

package/lib/options/auth.esm.js

@@ -14,11 +14,11 @@ function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authC
 			cookieCache: {
 				enabled: true,
 				version: "1",
-				maxAge: 3600 * 24,
+				maxAge: 86400,
 				strategy: "jwe",
 				refreshCache: true
 			},
-			expiresIn: 3600 * 24,
+			expiresIn: 86400,
 			updateAge: 3600,
 			freshAge: 300
 		},

package/lib/routes/getSignOutUrlRoute.esm.js

@@ -1,6 +1,5 @@
-import { PROVIDER_ID } from "../constants.esm.js";
 //#region src/routes/getSignOutUrlRoute.ts
-function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, providerId = PROVIDER_ID, headers }) {
+function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, headers, clientId }) {
 	/**
 	* API route that constructs a federated logout URL for OIDC providers.
 	* Returns null if federated logout is disabled.
@@ -13,30 +12,45 @@ function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, provid
 			if (!federatedLogout || !discoveryUrl) return Response.json({ url: null }, { status: 200 });
 			/**
 			* Retrieve the user's ID token, to produce a valid logout URL.
+			* `useAccountCookie` reads the single OAuth account stored in the
+			* signed cookie (database-less flow), matching `storeAccountCookie`.
 			*/
 			const token = await auth.api.getAccessToken({
-				body: { providerId },
+				body: { useAccountCookie: true },
 				headers: await headers()
 			}).catch(() => null);
-			if (!token?.idToken) return Response.json({ error: "No ID token found for user" }, { status: 400 });
+			/**
+			* No ID token is available, e.g. when the OIDC provider redirected back
+			* with an error (missing email, denied consent, etc.) before better-auth
+			* ever stored an account cookie. Without `client_id`, we have no way to
+			* end the provider's SSO session, which would otherwise leave the user
+			* stuck in a silent re-authentication loop with no way to recover.
+			*/
+			if (!token?.idToken && !clientId) return Response.json({ error: "No ID token found for user" }, { status: 400 });
 			/**
 			* Fetch the well-known configuration from the OIDC provider to construct the
 			* logout URL.
 			*/
 			const wellKnownResponse = await fetch(discoveryUrl);
 			if (!wellKnownResponse.ok) return Response.json({ error: "Failed to fetch OIDC discovery document" }, { status: 500 });
-			const endSessionEndpoint = (await wellKnownResponse.json()).end_session_endpoint;
+			const wellKnownConfigJson = await wellKnownResponse.json();
+			const endSessionEndpoint = wellKnownConfigJson !== null && typeof wellKnownConfigJson === "object" && "end_session_endpoint" in wellKnownConfigJson && typeof wellKnownConfigJson.end_session_endpoint === "string" ? wellKnownConfigJson.end_session_endpoint : void 0;
 			if (!endSessionEndpoint) return Response.json({ error: "Could not determine end_session_endpoint" }, { status: 500 });
 			/**
 			* Construct the logout URL with parameters.
 			* - end_session_endpoint: The OIDC provider's end_session_endpoint.
 			* - post_logout_redirect_uri: The URL to redirect to after logout.
-			* - id_token_hint: The user's ID token.
+			* - id_token_hint: The user's ID token, when available.
+			* - client_id: Fallback identity hint when there's no ID token. The
+			*   provider uses its own browser session cookie to find the SSO
+			*   session to end, so this still works without a token, though it may
+			*   show a logout confirmation page instead of ending silently.
 			*/
 			const logoutUrl = new URL(endSessionEndpoint);
 			const postLogoutRedirectUri = request.nextUrl.searchParams.get("post_logout_redirect_uri") ?? "/auth/sign-in";
 			logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutRedirectUri);
-			logoutUrl.searchParams.set("id_token_hint", token.idToken);
+			if (token?.idToken) logoutUrl.searchParams.set("id_token_hint", token.idToken);
+			else if (clientId) logoutUrl.searchParams.set("client_id", clientId);
 			return Response.json({ url: logoutUrl.toString() });
 		} catch (error) {
 			console.error("Failed to construct logout URL:", error);

package/lib/types/hooks/useSignOut.d.ts

@@ -21,7 +21,11 @@ export type UseSignOutOptions = {
      */
     authClient: ReturnType<typeof createAuthClient>;
     /**
-     * Optional origin to use for constructing the post-logout redirect URI. Defaults to the current window location origin.
+     * Optional origin (and, if applicable, base path) prepended to both
+     * `retrieveSignOutUrlPath` and `postSignOutRedirectPath`. Defaults to the
+     * current window location origin. Useful when the app is served under a
+     * base path, since these URLs are built outside Next's router and don't
+     * get it auto-applied.
      */
     origin?: string;
 };
@@ -33,6 +37,6 @@ export type UseSignOutOptions = {
  * const { handleSignOut } = useSignOut({ postSignOutRedirectPath: "/auth/sign-in?sign-out=success" });
  * ```
  */
-export declare function useSignOut({ postSignOutRedirectPath, retrieveSignOutUrlPath, onSignOutStart, onSignOutSuccess, authClient, origin: providedOrigin }: UseSignOutOptions): {
+export declare function useSignOut({ postSignOutRedirectPath, retrieveSignOutUrlPath, onSignOutStart, onSignOutSuccess, authClient, origin: providedOrigin, }: UseSignOutOptions): {
     handleSignOut: () => Promise<void>;
 };

package/lib/types/options/auth-client.d.ts

@@ -1,178 +1,9 @@
-export declare function getBetterAuthClientOptions(): {
-    readonly plugins: [{
-        id: "generic-oauth-client";
-        version: string;
-        $InferServerPlugin: ReturnType<(options: import("better-auth/plugins").GenericOAuthOptions) => {
-            id: "generic-oauth";
-            version: string;
-            init: (ctx: import("better-auth").AuthContext) => {
-                context: {
-                    socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
-                };
-            };
-            endpoints: {
-                signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        providerId: import("zod").ZodString;
-                        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                        requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                        additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                    }, import("zod/v4/core").$strip>;
-                    metadata: {
-                        openapi: {
-                            description: string;
-                            responses: {
-                                200: {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                    };
-                                                    redirect: {
-                                                        type: string;
-                                                    };
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                }, {
-                    url: string;
-                    redirect: boolean;
-                }>;
-                oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
-                    method: "GET";
-                    query: import("zod").ZodObject<{
-                        code: import("zod").ZodOptional<import("zod").ZodString>;
-                        error: import("zod").ZodOptional<import("zod").ZodString>;
-                        error_description: import("zod").ZodOptional<import("zod").ZodString>;
-                        state: import("zod").ZodOptional<import("zod").ZodString>;
-                        iss: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("zod/v4/core").$strip>;
-                    metadata: {
-                        allowedMediaTypes: string[];
-                        openapi: {
-                            description: string;
-                            responses: {
-                                200: {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                    };
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                        scope: "server";
-                    };
-                }, void>;
-                oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        providerId: import("zod").ZodString;
-                        callbackURL: import("zod").ZodString;
-                        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("zod/v4/core").$strip>;
-                    use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-                        session: {
-                            session: Record<string, any> & {
-                                id: string;
-                                createdAt: Date;
-                                updatedAt: Date;
-                                userId: string;
-                                expiresAt: Date;
-                                token: string;
-                                ipAddress?: string | null | undefined;
-                                userAgent?: string | null | undefined;
-                            };
-                            user: Record<string, any> & {
-                                id: string;
-                                createdAt: Date;
-                                updatedAt: Date;
-                                email: string;
-                                emailVerified: boolean;
-                                name: string;
-                                image?: string | null | undefined;
-                            };
-                        };
-                    }>)[];
-                    metadata: {
-                        openapi: {
-                            description: string;
-                            responses: {
-                                "200": {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                        format: string;
-                                                        description: string;
-                                                    };
-                                                    redirect: {
-                                                        type: string;
-                                                        description: string;
-                                                        enum: boolean[];
-                                                    };
-                                                };
-                                                required: string[];
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                }, {
-                    url: string;
-                    redirect: boolean;
-                }>;
-            };
-            options: import("better-auth/plugins").GenericOAuthOptions;
-            $ERROR_CODES: {
-                INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
-                TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-                PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-                PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-                INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-                SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-                ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-                ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
-            };
-        }>;
-        $ERROR_CODES: {
-            INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
-            TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-            PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-            PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-            INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-            SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-            ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-            ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
-        };
-    }];
-};
+/**
+ * Generic OAuth providers sign in through the standard `signIn.social` /
+ * `linkSocial` client methods (better-auth 1.7+), so no client plugin is
+ * required.
+ *
+ * @deprecated No longer needed — pass options directly to `createAuthClient`
+ * instead. Will be removed in a future major version.
+ */
+export declare function getBetterAuthClientOptions(): {};

package/lib/types/options/auth.d.ts

@@ -1,4 +1,4 @@
-export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId }: {
+export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId, }: {
     oidcDiscoveryUrl: string;
     authSecret: string;
     authClientId: string;
@@ -28,163 +28,15 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
     readonly plugins: [{
         id: "generic-oauth";
         version: string;
-        init: (ctx: import("better-auth").AuthContext) => {
+        init: (ctx: import("better-auth").AuthContext) => Promise<{
             context: {
-                socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
+                socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
             };
-        };
-        endpoints: {
-            signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                }, import("zod/v4/core").$strip>;
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-            oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
-                method: "GET";
-                query: import("zod").ZodObject<{
-                    code: import("zod").ZodOptional<import("zod").ZodString>;
-                    error: import("zod").ZodOptional<import("zod").ZodString>;
-                    error_description: import("zod").ZodOptional<import("zod").ZodString>;
-                    state: import("zod").ZodOptional<import("zod").ZodString>;
-                    iss: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("zod/v4/core").$strip>;
-                metadata: {
-                    allowedMediaTypes: string[];
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                    scope: "server";
-                };
-            }, void>;
-            oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodString;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("zod/v4/core").$strip>;
-                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-                    session: {
-                        session: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            userId: string;
-                            expiresAt: Date;
-                            token: string;
-                            ipAddress?: string | null | undefined;
-                            userAgent?: string | null | undefined;
-                        };
-                        user: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            email: string;
-                            emailVerified: boolean;
-                            name: string;
-                            image?: string | null | undefined;
-                        };
-                    };
-                }>)[];
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            "200": {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                    format: string;
-                                                    description: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                    description: string;
-                                                    enum: boolean[];
-                                                };
-                                            };
-                                            required: string[];
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-        };
-        options: import("better-auth/plugins").GenericOAuthOptions;
+        }>;
+        options: import("better-auth/plugins").GenericOAuthOptions<string>;
         $ERROR_CODES: {
             INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
             TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-            PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-            PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-            INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-            SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-            ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-            ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
         };
     }, {
         id: "next-cookies";
@@ -192,11 +44,11 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
         hooks: {
             before: {
                 matcher(ctx: import("better-auth").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
             after: {
                 matcher(ctx: import("better-auth").HookEndpointContext): true;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
         };
     }];

package/lib/types/routes/getSignOutUrlRoute.d.ts

@@ -1,10 +1,15 @@
 import type { Auth } from "better-auth";
 import { headers as nextHeaders } from "next/headers";
 import type { NextRequest } from "next/server";
-export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, providerId, headers }: {
+export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, headers, clientId, }: {
     auth: Auth;
     discoveryUrl?: string;
     federatedLogout?: boolean;
-    providerId?: string;
     headers: typeof nextHeaders;
+    /**
+     * OIDC client ID, used to build the end-session URL when no ID token can be
+     * retrieved (for example, when the user never completed a sign-in, so no
+     * account cookie was ever stored). Required to recover from that case.
+     */
+    clientId?: string;
 }): (request: NextRequest) => Promise<Response>;

package/package.json

@@ -1,29 +1,14 @@
 {
   "name": "@imtf/auth",
-  "version": "1.1.0-beta.2",
+  "version": "2.0.0",
   "description": "Better auth wrapper for imtf usage",
   "license": "UNLICENSED",
   "author": "",
   "type": "module",
-  "scripts": {
-    "prebuild": "npm run build:clean",
-    "build:clean": "rimraf lib",
-    "build:js": "vite build",
-    "build:types": "tsgo --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
-    "build": "concurrently npm:build:js npm:build:types",
-    "lint": "eslint src --cache --report-unused-disable-directives --max-warnings 0",
-    "test": "vitest",
-    "test:ui": "vitest --ui --coverage",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsgo --noEmit",
-    "checks": "concurrently --kill-others-on-fail npm:lint npm:typecheck",
-    "prepublishOnly": "npm run build && npm run checks"
-  },
   "files": [
     "lib",
     "schemas"
   ],
-  "prettier": "@imtf/prettier-config",
   "module": "./lib/index.esm.js",
   "types": "./lib/types/index.d.ts",
   "exports": {
@@ -33,18 +18,32 @@
     }
   },
   "dependencies": {
-    "@imtf/panache": "^5.9.0"
+    "@imtf/panache": "^6.0.0"
   },
   "peerDependencies": {
-    "@mui/lab": "^7.0.1-beta.18",
-    "@mui/material": "^7.1.0",
+    "@mui/material": "^7.1.0 || ^9.4.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "better-auth": "^1.5.3"
+    "better-auth": "^1.7.1",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@mui/lab": "^7.0.1-beta.18",
-    "@mui/material": "^7.1.0",
-    "better-auth": "^1.5.3"
+    "@mui/material": "^9.4.0",
+    "better-auth": "^1.7.1",
+    "zod": "^4.3.6"
+  },
+  "scripts": {
+    "prebuild": "pnpm run build:clean",
+    "build:clean": "rimraf lib",
+    "build:js": "vite build",
+    "build:types": "tsc --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
+    "build": "concurrently pnpm:build:js pnpm:build:types",
+    "lint": "oxlint --type-aware --type-check --deny-warnings src",
+    "format:check": "oxfmt --check './src/**/*.{ts,tsx}'",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest",
+    "test:ui": "vitest --ui --coverage",
+    "test:coverage": "vitest run --coverage",
+    "checks": "concurrently --kill-others-on-fail pnpm:lint pnpm:typecheck pnpm:format:check"
   }
-}
+}