@imtf/auth 1.1.0-beta.2 → 2.0.0-beta.0

package/README.md

@@ -0,0 +1,164 @@
+# @imtf/auth - Better Auth wrapper
+
+Thin wrapper around [`better-auth`](https://www.better-auth.com/) tailored for IMTF applications. Provides IMTF-specific auth configuration, hooks, and route helpers on top of `better-auth`, for use in Next.js apps.
+
+## Pre-requisites
+
+The following peer dependencies must be installed:
+
+- `better-auth` 1.7.1
+- `zod` 4.3.6 or higher — must stay version-matched with `better-auth`'s own `zod` dependency
+- `@mui/material` 7.1.0 or higher
+- `@mui/lab` 7.0.1-beta.18 or higher
+- `react` and `react-dom` 18.0.0 or 19.0.0 or higher
+
+## Installation
+
+```bash
+npm install @imtf/auth
+```
+
+## Usage
+
+This package supplies IMTF's `better-auth` configuration and a couple of OIDC-flow helpers — it does not wrap `betterAuth()`/`createAuthClient()` themselves. Call those directly with the options this package returns.
+
+### Server: `auth.ts`
+
+```ts
+import "server-only";
+
+import { getBetterAuthOptions } from "@imtf/auth";
+import { betterAuth, type BetterAuthOptions } from "better-auth";
+
+export const auth = betterAuth({
+  ...getBetterAuthOptions({
+    oidcDiscoveryUrl: `${process.env.OIDC_ISSUER_URL}/.well-known/openid-configuration`,
+    authSecret: process.env.AUTH_SECRET!,
+    authClientId: process.env.OIDC_CLIENT_ID!,
+    authClientSecret: process.env.OIDC_CLIENT_SECRET!,
+    authBaseURL: process.env.AUTH_BASE_URL,
+  }),
+} satisfies BetterAuthOptions);
+```
+
+### Client: `auth-client.ts`
+
+```ts
+"use client";
+
+import { createAuthClient } from "better-auth/react";
+
+export const authClient = createAuthClient();
+```
+
+### Route handler: `app/api/auth/[...all]/route.ts`
+
+```ts
+import type { NextRequest } from "next/server";
+import { auth } from "@/auth";
+
+function handler(request: NextRequest) {
+  return auth.handler(request);
+}
+
+export const GET = handler;
+export const POST = handler;
+```
+
+### Federated sign-out route: `app/api/auth/sign-out-url/route.ts`
+
+```ts
+import { getSignOutUrlRoute } from "@imtf/auth";
+import { headers } from "next/headers";
+import { auth } from "@/auth";
+
+export const GET = getSignOutUrlRoute({
+  auth,
+  discoveryUrl: `${process.env.OIDC_ISSUER_URL}/.well-known/openid-configuration`,
+  headers,
+});
+```
+
+### Session check in a server component
+
+```ts
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { auth } from "@/auth";
+
+export async function AuthGuard({ children }: { children: React.ReactNode }) {
+  const { accessToken } = await auth.api
+    .getAccessToken({ body: { useAccountCookie: true }, headers: await headers() })
+    .catch(() => ({ accessToken: undefined }));
+
+  if (!accessToken) redirect("/auth/sign-in");
+
+  return children;
+}
+```
+
+### Sign-in and sign-out (client components)
+
+```tsx
+"use client";
+
+import { PROVIDER_ID, useSignOut } from "@imtf/auth";
+import { authClient } from "@/auth-client";
+
+function SignInButton() {
+  const handleSignIn = () =>
+    void authClient.signIn.social({ provider: PROVIDER_ID, callbackURL: "/" });
+
+  return <button onClick={handleSignIn}>Sign in</button>;
+}
+
+function SignOutButton() {
+  const { handleSignOut } = useSignOut({ authClient });
+
+  return <button onClick={handleSignOut}>Sign out</button>;
+}
+```
+
+### Full export list
+
+```ts
+import {
+  getBetterAuthOptions,
+  getBetterAuthClientOptions,
+  getSignOutUrlRoute,
+  useSignOut,
+  PROVIDER_ID,
+} from "@imtf/auth";
+```
+
+> `getBetterAuthClientOptions` is deprecated as of `better-auth` 1.7 — generic OAuth sign-in no longer needs a client plugin, so `createAuthClient()` can be called with no options as shown above.
+
+## Development
+
+Prior to development, make sure you have installed the dependencies from the **repository root**:
+
+```bash
+pnpm install
+```
+
+## Testing
+
+To run the tests, just run:
+
+```bash
+pnpm run test
+```
+
+Coverage report can be generated with:
+
+```bash
+pnpm run test:coverage
+```
+
+## Migration from v1 to v2
+
+`@imtf/auth` v2 upgrades its `better-auth` peer dependency from `1.6.30` to `1.7.1`. `better-auth` 1.7 rewrote the generic OAuth plugin as a first-class social provider — see the [Better Auth 1.7 upgrade guide](https://www.better-auth.com/docs/guides/1-7-upgrade-guide) for the full list of breaking changes upstream. The changes relevant to consumers of this package are:
+
+- **OAuth callback URL path changed.** The redirect URI that `better-auth` exposes for the generic OIDC provider moved from `{baseURL}/oauth2/callback/{providerId}` to `{baseURL}/callback/{providerId}` (e.g. `https://app.example.com/api/auth/oauth2/callback/oidc-provider` → `https://app.example.com/api/auth/callback/oidc-provider`). **You must update the redirect URI registered with your OIDC provider/IdP client** before deploying this upgrade, or sign-in will fail.
+- **`getSignOutUrlRoute` dropped its `providerId` option.** `better-auth`'s `getAccessToken` API no longer accepts `providerId` to select an account; it now resolves the account from the signed account cookie (`useAccountCookie: true`), matching this package's database-less, `storeAccountCookie: true` configuration. If you were passing `providerId` to `getSignOutUrlRoute`, remove it — it is no longer read.
+- **No client plugin is required for generic OAuth sign-in anymore.** `getBetterAuthClientOptions()` no longer registers `genericOAuthClient()` (removed upstream). Generic/custom OAuth providers now sign in through the standard `authClient.signIn.social({ provider })` / `authClient.linkSocial({ provider })` methods. No action needed on your end beyond upgrading — this package's exported options already reflect the change.

package/lib/hooks/useSignOut.esm.js

@@ -31,12 +31,14 @@ function useSignOut({ postSignOutRedirectPath = "/auth/sign-in?sign-out=success"
 			/**
 			* Create a logout URL before we invoke authClient.signOut(), since it clears critical tokens.
 			*/
-			const response = await fetch(`${retrieveSignOutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`);
+			const response = await fetch(`${origin}${retrieveSignOutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`);
 			if (!response.ok) {
-				const { error } = await response.json().catch(() => ({ error: null }));
+				const errorBody = await response.json().catch(() => null);
+				const error = errorBody !== null && typeof errorBody === "object" && "error" in errorBody && typeof errorBody.error === "string" ? errorBody.error : null;
 				throw new Error(error ?? "Failed to create logout URL");
 			}
-			const { url } = await response.json();
+			const responseBody = await response.json();
+			const url = responseBody !== null && typeof responseBody === "object" && "url" in responseBody && typeof responseBody.url === "string" ? responseBody.url : null;
 			if (!url) {
 				standardSignOut();
 				return;

package/lib/options/auth-client.esm.js

@@ -1,8 +1,15 @@
 "use client";
-import { genericOAuthClient } from "better-auth/client/plugins";
 //#region src/options/auth-client.ts
+/**
+* Generic OAuth providers sign in through the standard `signIn.social` /
+* `linkSocial` client methods (better-auth 1.7+), so no client plugin is
+* required.
+*
+* @deprecated No longer needed — pass options directly to `createAuthClient`
+* instead. Will be removed in a future major version.
+*/
 function getBetterAuthClientOptions() {
-	return { plugins: [genericOAuthClient()] };
+	return {};
 }
 //#endregion
 export { getBetterAuthClientOptions };

package/lib/options/auth.esm.js

@@ -14,11 +14,11 @@ function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authC
 			cookieCache: {
 				enabled: true,
 				version: "1",
-				maxAge: 3600 * 24,
+				maxAge: 86400,
 				strategy: "jwe",
 				refreshCache: true
 			},
-			expiresIn: 3600 * 24,
+			expiresIn: 86400,
 			updateAge: 3600,
 			freshAge: 300
 		},

package/lib/routes/getSignOutUrlRoute.esm.js

@@ -1,6 +1,5 @@
-import { PROVIDER_ID } from "../constants.esm.js";
 //#region src/routes/getSignOutUrlRoute.ts
-function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, providerId = PROVIDER_ID, headers }) {
+function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, headers }) {
 	/**
 	* API route that constructs a federated logout URL for OIDC providers.
 	* Returns null if federated logout is disabled.
@@ -13,9 +12,11 @@ function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, provid
 			if (!federatedLogout || !discoveryUrl) return Response.json({ url: null }, { status: 200 });
 			/**
 			* Retrieve the user's ID token, to produce a valid logout URL.
+			* `useAccountCookie` reads the single OAuth account stored in the
+			* signed cookie (database-less flow), matching `storeAccountCookie`.
 			*/
 			const token = await auth.api.getAccessToken({
-				body: { providerId },
+				body: { useAccountCookie: true },
 				headers: await headers()
 			}).catch(() => null);
 			if (!token?.idToken) return Response.json({ error: "No ID token found for user" }, { status: 400 });
@@ -25,7 +26,8 @@ function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, provid
 			*/
 			const wellKnownResponse = await fetch(discoveryUrl);
 			if (!wellKnownResponse.ok) return Response.json({ error: "Failed to fetch OIDC discovery document" }, { status: 500 });
-			const endSessionEndpoint = (await wellKnownResponse.json()).end_session_endpoint;
+			const wellKnownConfigJson = await wellKnownResponse.json();
+			const endSessionEndpoint = wellKnownConfigJson !== null && typeof wellKnownConfigJson === "object" && "end_session_endpoint" in wellKnownConfigJson && typeof wellKnownConfigJson.end_session_endpoint === "string" ? wellKnownConfigJson.end_session_endpoint : void 0;
 			if (!endSessionEndpoint) return Response.json({ error: "Could not determine end_session_endpoint" }, { status: 500 });
 			/**
 			* Construct the logout URL with parameters.

package/lib/types/hooks/useSignOut.d.ts

@@ -21,7 +21,11 @@ export type UseSignOutOptions = {
      */
     authClient: ReturnType<typeof createAuthClient>;
     /**
-     * Optional origin to use for constructing the post-logout redirect URI. Defaults to the current window location origin.
+     * Optional origin (and, if applicable, base path) prepended to both
+     * `retrieveSignOutUrlPath` and `postSignOutRedirectPath`. Defaults to the
+     * current window location origin. Useful when the app is served under a
+     * base path, since these URLs are built outside Next's router and don't
+     * get it auto-applied.
      */
     origin?: string;
 };
@@ -33,6 +37,6 @@ export type UseSignOutOptions = {
  * const { handleSignOut } = useSignOut({ postSignOutRedirectPath: "/auth/sign-in?sign-out=success" });
  * ```
  */
-export declare function useSignOut({ postSignOutRedirectPath, retrieveSignOutUrlPath, onSignOutStart, onSignOutSuccess, authClient, origin: providedOrigin }: UseSignOutOptions): {
+export declare function useSignOut({ postSignOutRedirectPath, retrieveSignOutUrlPath, onSignOutStart, onSignOutSuccess, authClient, origin: providedOrigin, }: UseSignOutOptions): {
     handleSignOut: () => Promise<void>;
 };

package/lib/types/options/auth-client.d.ts

@@ -1,178 +1,9 @@
-export declare function getBetterAuthClientOptions(): {
-    readonly plugins: [{
-        id: "generic-oauth-client";
-        version: string;
-        $InferServerPlugin: ReturnType<(options: import("better-auth/plugins").GenericOAuthOptions) => {
-            id: "generic-oauth";
-            version: string;
-            init: (ctx: import("better-auth").AuthContext) => {
-                context: {
-                    socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
-                };
-            };
-            endpoints: {
-                signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        providerId: import("zod").ZodString;
-                        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                        disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                        requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                        additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                    }, import("zod/v4/core").$strip>;
-                    metadata: {
-                        openapi: {
-                            description: string;
-                            responses: {
-                                200: {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                    };
-                                                    redirect: {
-                                                        type: string;
-                                                    };
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                }, {
-                    url: string;
-                    redirect: boolean;
-                }>;
-                oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
-                    method: "GET";
-                    query: import("zod").ZodObject<{
-                        code: import("zod").ZodOptional<import("zod").ZodString>;
-                        error: import("zod").ZodOptional<import("zod").ZodString>;
-                        error_description: import("zod").ZodOptional<import("zod").ZodString>;
-                        state: import("zod").ZodOptional<import("zod").ZodString>;
-                        iss: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("zod/v4/core").$strip>;
-                    metadata: {
-                        allowedMediaTypes: string[];
-                        openapi: {
-                            description: string;
-                            responses: {
-                                200: {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                    };
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                        scope: "server";
-                    };
-                }, void>;
-                oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        providerId: import("zod").ZodString;
-                        callbackURL: import("zod").ZodString;
-                        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("zod/v4/core").$strip>;
-                    use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-                        session: {
-                            session: Record<string, any> & {
-                                id: string;
-                                createdAt: Date;
-                                updatedAt: Date;
-                                userId: string;
-                                expiresAt: Date;
-                                token: string;
-                                ipAddress?: string | null | undefined;
-                                userAgent?: string | null | undefined;
-                            };
-                            user: Record<string, any> & {
-                                id: string;
-                                createdAt: Date;
-                                updatedAt: Date;
-                                email: string;
-                                emailVerified: boolean;
-                                name: string;
-                                image?: string | null | undefined;
-                            };
-                        };
-                    }>)[];
-                    metadata: {
-                        openapi: {
-                            description: string;
-                            responses: {
-                                "200": {
-                                    description: string;
-                                    content: {
-                                        "application/json": {
-                                            schema: {
-                                                type: "object";
-                                                properties: {
-                                                    url: {
-                                                        type: string;
-                                                        format: string;
-                                                        description: string;
-                                                    };
-                                                    redirect: {
-                                                        type: string;
-                                                        description: string;
-                                                        enum: boolean[];
-                                                    };
-                                                };
-                                                required: string[];
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                }, {
-                    url: string;
-                    redirect: boolean;
-                }>;
-            };
-            options: import("better-auth/plugins").GenericOAuthOptions;
-            $ERROR_CODES: {
-                INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
-                TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-                PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-                PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-                INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-                SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-                ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-                ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
-            };
-        }>;
-        $ERROR_CODES: {
-            INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
-            TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-            PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-            PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-            INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-            SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-            ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-            ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
-        };
-    }];
-};
+/**
+ * Generic OAuth providers sign in through the standard `signIn.social` /
+ * `linkSocial` client methods (better-auth 1.7+), so no client plugin is
+ * required.
+ *
+ * @deprecated No longer needed — pass options directly to `createAuthClient`
+ * instead. Will be removed in a future major version.
+ */
+export declare function getBetterAuthClientOptions(): {};

package/lib/types/options/auth.d.ts

@@ -1,4 +1,4 @@
-export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId }: {
+export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId, }: {
     oidcDiscoveryUrl: string;
     authSecret: string;
     authClientId: string;
@@ -28,163 +28,15 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
     readonly plugins: [{
         id: "generic-oauth";
         version: string;
-        init: (ctx: import("better-auth").AuthContext) => {
+        init: (ctx: import("better-auth").AuthContext) => Promise<{
             context: {
-                socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
+                socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
             };
-        };
-        endpoints: {
-            signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                }, import("zod/v4/core").$strip>;
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-            oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
-                method: "GET";
-                query: import("zod").ZodObject<{
-                    code: import("zod").ZodOptional<import("zod").ZodString>;
-                    error: import("zod").ZodOptional<import("zod").ZodString>;
-                    error_description: import("zod").ZodOptional<import("zod").ZodString>;
-                    state: import("zod").ZodOptional<import("zod").ZodString>;
-                    iss: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("zod/v4/core").$strip>;
-                metadata: {
-                    allowedMediaTypes: string[];
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                    scope: "server";
-                };
-            }, void>;
-            oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodString;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("zod/v4/core").$strip>;
-                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-                    session: {
-                        session: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            userId: string;
-                            expiresAt: Date;
-                            token: string;
-                            ipAddress?: string | null | undefined;
-                            userAgent?: string | null | undefined;
-                        };
-                        user: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            email: string;
-                            emailVerified: boolean;
-                            name: string;
-                            image?: string | null | undefined;
-                        };
-                    };
-                }>)[];
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            "200": {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                    format: string;
-                                                    description: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                    description: string;
-                                                    enum: boolean[];
-                                                };
-                                            };
-                                            required: string[];
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-        };
-        options: import("better-auth/plugins").GenericOAuthOptions;
+        }>;
+        options: import("better-auth/plugins").GenericOAuthOptions<string>;
         $ERROR_CODES: {
             INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
             TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
-            PROVIDER_CONFIG_NOT_FOUND: import("better-auth").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-            PROVIDER_ID_REQUIRED: import("better-auth").RawError<"PROVIDER_ID_REQUIRED">;
-            INVALID_OAUTH_CONFIG: import("better-auth").RawError<"INVALID_OAUTH_CONFIG">;
-            SESSION_REQUIRED: import("better-auth").RawError<"SESSION_REQUIRED">;
-            ISSUER_MISMATCH: import("better-auth").RawError<"ISSUER_MISMATCH">;
-            ISSUER_MISSING: import("better-auth").RawError<"ISSUER_MISSING">;
         };
     }, {
         id: "next-cookies";
@@ -192,11 +44,11 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
         hooks: {
             before: {
                 matcher(ctx: import("better-auth").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
             after: {
                 matcher(ctx: import("better-auth").HookEndpointContext): true;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
         };
     }];

package/lib/types/routes/getSignOutUrlRoute.d.ts

@@ -1,10 +1,9 @@
 import type { Auth } from "better-auth";
 import { headers as nextHeaders } from "next/headers";
 import type { NextRequest } from "next/server";
-export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, providerId, headers }: {
+export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, headers, }: {
     auth: Auth;
     discoveryUrl?: string;
     federatedLogout?: boolean;
-    providerId?: string;
     headers: typeof nextHeaders;
 }): (request: NextRequest) => Promise<Response>;

package/package.json

@@ -1,29 +1,14 @@
 {
   "name": "@imtf/auth",
-  "version": "1.1.0-beta.2",
+  "version": "2.0.0-beta.0",
   "description": "Better auth wrapper for imtf usage",
   "license": "UNLICENSED",
   "author": "",
   "type": "module",
-  "scripts": {
-    "prebuild": "npm run build:clean",
-    "build:clean": "rimraf lib",
-    "build:js": "vite build",
-    "build:types": "tsgo --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
-    "build": "concurrently npm:build:js npm:build:types",
-    "lint": "eslint src --cache --report-unused-disable-directives --max-warnings 0",
-    "test": "vitest",
-    "test:ui": "vitest --ui --coverage",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsgo --noEmit",
-    "checks": "concurrently --kill-others-on-fail npm:lint npm:typecheck",
-    "prepublishOnly": "npm run build && npm run checks"
-  },
   "files": [
     "lib",
     "schemas"
   ],
-  "prettier": "@imtf/prettier-config",
   "module": "./lib/index.esm.js",
   "types": "./lib/types/index.d.ts",
   "exports": {
@@ -33,18 +18,34 @@
     }
   },
   "dependencies": {
-    "@imtf/panache": "^5.9.0"
+    "@imtf/panache": "^5.10.2"
   },
   "peerDependencies": {
     "@mui/lab": "^7.0.1-beta.18",
     "@mui/material": "^7.1.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "better-auth": "^1.5.3"
+    "better-auth": "^1.7.1",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@mui/lab": "^7.0.1-beta.18",
     "@mui/material": "^7.1.0",
-    "better-auth": "^1.5.3"
+    "better-auth": "^1.7.1",
+    "zod": "^4.3.6"
+  },
+  "scripts": {
+    "prebuild": "pnpm run build:clean",
+    "build:clean": "rimraf lib",
+    "build:js": "vite build",
+    "build:types": "tsc --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
+    "build": "concurrently pnpm:build:js pnpm:build:types",
+    "lint": "oxlint --type-aware --type-check --deny-warnings src",
+    "format:check": "oxfmt --check './src/**/*.{ts,tsx}'",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest",
+    "test:ui": "vitest --ui --coverage",
+    "test:coverage": "vitest run --coverage",
+    "checks": "concurrently --kill-others-on-fail pnpm:lint pnpm:typecheck pnpm:format:check"
   }
-}
+}