@lupinum/better-convex-nuxt 0.8.0-beta.40

package/dist/runtime/convex-auth/oauth-provider-compat.js

@@ -0,0 +1,170 @@
+import { APIError } from "better-auth/api";
+import {
+  OAuthSecurityError,
+  assertSafeStoredOAuthClient,
+  assertSafeStoredOAuthResource
+} from "./oauth-security.js";
+const DISABLED_PINNED_PROVIDER_PATHS = /* @__PURE__ */ new Set([
+  "/get-access-token",
+  "/refresh-token",
+  "/.well-known/openid-configuration",
+  "/oauth2/client/rotate-secret",
+  "/oauth2/create-client",
+  "/oauth2/delete-client",
+  "/oauth2/end-session",
+  "/oauth2/get-client",
+  "/oauth2/get-clients",
+  "/oauth2/introspect",
+  "/oauth2/register",
+  "/oauth2/update-client",
+  "/oauth2/userinfo",
+  "/token"
+]);
+function invalidConfiguration() {
+  throw new OAuthSecurityError("AUTH_OAUTH_CONFIG_INVALID");
+}
+export function validatePinnedOAuthProviderRuntime(context, options, hardened) {
+  const configuredPlugins = context.options.plugins ?? [];
+  const jwtIndexes = configuredPlugins.map((plugin, index) => plugin.id === "jwt" ? index : -1).filter((index) => index >= 0);
+  const convexIndexes = configuredPlugins.map((plugin, index) => plugin.id === "@lupinum/better-convex-nuxt" ? index : -1).filter((index) => index >= 0);
+  const oauthIndexes = configuredPlugins.map((plugin, index) => plugin.id === "oauth-provider" ? index : -1).filter((index) => index >= 0);
+  if (jwtIndexes.length !== 1 || convexIndexes.length !== 1 || oauthIndexes.length !== 1 || !(jwtIndexes[0] < convexIndexes[0] && convexIndexes[0] < oauthIndexes[0])) {
+    invalidConfiguration();
+  }
+  const disabledPaths = new Set(context.options.disabledPaths ?? []);
+  if ([...DISABLED_PINNED_PROVIDER_PATHS].some((path) => !disabledPaths.has(path))) {
+    invalidConfiguration();
+  }
+  if (context.options.account?.encryptOAuthTokens !== true || context.options.account.storeAccountCookie !== false || context.options.verification?.storeIdentifier !== "hashed") {
+    invalidConfiguration();
+  }
+  const issuer = context.baseURL;
+  let issuerUrl;
+  try {
+    issuerUrl = new URL(issuer);
+  } catch {
+    invalidConfiguration();
+  }
+  if (issuerUrl.pathname !== "/api/auth" || issuerUrl.search || issuerUrl.hash || issuerUrl.username || issuerUrl.password) {
+    invalidConfiguration();
+  }
+  const jwtPlugin = configuredPlugins[jwtIndexes[0]];
+  const jwtOptions = jwtPlugin.options?.jwt;
+  const jwksOptions = jwtPlugin.options?.jwks;
+  if (!jwtOptions || typeof jwtOptions !== "object" || jwtOptions.issuer !== issuer || jwtOptions.audience !== issuer || jwtOptions.expirationTime !== "10m" || !jwksOptions || typeof jwksOptions !== "object" || jwksOptions.keyPairConfig?.alg !== "RS256" || jwksOptions.disablePrivateKeyEncryption !== false) {
+    invalidConfiguration();
+  }
+  const oauthPlugin = configuredPlugins[oauthIndexes[0]];
+  const providerOptions = oauthPlugin.options;
+  if (!providerOptions || providerOptions.clientPrivileges !== hardened.clientPrivileges || providerOptions.resourcePrivileges !== hardened.resourcePrivileges || providerOptions.customAccessTokenClaims !== hardened.customAccessTokenClaims || providerOptions.accessTokenExpiresIn !== options.accessTokenExpiresIn || providerOptions.codeExpiresIn !== options.codeExpiresIn || !Array.isArray(providerOptions.grantTypes) || providerOptions.grantTypes.length !== 1 || providerOptions.grantTypes[0] !== "authorization_code") {
+    invalidConfiguration();
+  }
+  if (process.env.NODE_ENV === "production") {
+    const proxySecret = process.env.BCN_AUTH_PROXY_IP_SECRET;
+    if (typeof proxySecret !== "string" || proxySecret.length < 32) {
+      invalidConfiguration();
+    }
+  }
+  return providerOptions;
+}
+function parseScope(value) {
+  const scopes = value.split(" ");
+  if (scopes.some((scope) => scope.length === 0) || new Set(scopes).size !== scopes.length) {
+    invalidConfiguration();
+  }
+  return scopes;
+}
+function invalidClientProfile() {
+  throw new APIError("BAD_REQUEST", {
+    message: "AUTH_OAUTH_CLIENT_PROFILE_INVALID"
+  });
+}
+function projectPinnedClientRecord(input, allowedScopes, updating) {
+  const tokenEndpointAuthMethod = updating && input.token_endpoint_auth_method === void 0 ? "client_secret_basic" : input.token_endpoint_auth_method;
+  const rawExpiry = input.client_secret_expires_at;
+  const expiresAt = rawExpiry === void 0 || rawExpiry === 0 || rawExpiry === "0" ? void 0 : typeof rawExpiry === "number" || typeof rawExpiry === "string" ? new Date(Number(rawExpiry) * 1e3) : rawExpiry;
+  return {
+    backchannelLogoutSessionRequired: input.backchannel_logout_session_required,
+    backchannelLogoutUri: input.backchannel_logout_uri,
+    clientId: "provisioning-client",
+    clientSecret: tokenEndpointAuthMethod === "client_secret_basic" ? "provisioning-secret" : null,
+    disabled: input.disabled,
+    dpopBoundAccessTokens: updating && input.dpop_bound_access_tokens === void 0 ? false : input.dpop_bound_access_tokens,
+    enableEndSession: updating && input.enable_end_session === void 0 ? false : input.enable_end_session,
+    expiresAt,
+    grantTypes: updating && input.grant_types === void 0 ? ["authorization_code"] : input.grant_types,
+    jwks: input.jwks,
+    jwksUri: input.jwks_uri,
+    metadata: input.metadata,
+    postLogoutRedirectUris: input.post_logout_redirect_uris,
+    public: updating ? false : tokenEndpointAuthMethod === "none",
+    redirectUris: updating && input.redirect_uris === void 0 ? ["https://provisioning.invalid/callback"] : input.redirect_uris,
+    requirePKCE: updating && input.require_pkce === void 0 ? true : input.require_pkce,
+    responseTypes: updating && input.response_types === void 0 ? ["code"] : input.response_types,
+    scopes: typeof input.scope === "string" ? parseScope(input.scope) : updating ? [...allowedScopes] : [],
+    skipConsent: updating && input.skip_consent === void 0 ? false : input.skip_consent,
+    softwareStatement: input.software_statement,
+    subjectType: input.subject_type,
+    tokenEndpointAuthMethod,
+    type: updating && input.type === void 0 ? "web" : input.type
+  };
+}
+export function assertSafePinnedClientProvisioning(method, body, allowedScopes) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) invalidClientProfile();
+  const input = body;
+  try {
+    if (method !== "POST") invalidConfiguration();
+    assertSafeStoredOAuthClient(
+      projectPinnedClientRecord(input, allowedScopes, false),
+      allowedScopes
+    );
+  } catch {
+    invalidClientProfile();
+  }
+}
+export function assertSafePinnedClientUpdate(method, body, allowedScopes) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) invalidClientProfile();
+  const input = body;
+  try {
+    if (method !== "PATCH") invalidConfiguration();
+    assertSafeStoredOAuthClient(
+      projectPinnedClientRecord(input, allowedScopes, true),
+      allowedScopes
+    );
+  } catch {
+    invalidClientProfile();
+  }
+}
+function invalidResourceProfile() {
+  throw new APIError("BAD_REQUEST", {
+    message: "AUTH_OAUTH_RESOURCE_PROFILE_INVALID"
+  });
+}
+export function assertSafePinnedResourceProvisioning(method, body, allowedScopes) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) invalidResourceProfile();
+  const input = body;
+  try {
+    if (method !== "POST" && method !== "PATCH") invalidConfiguration();
+    const updating = method === "PATCH";
+    assertSafeStoredOAuthResource(
+      {
+        accessTokenTtl: input.accessTokenTtl,
+        allowedScopes: input.allowedScopes,
+        customClaims: input.customClaims,
+        // Disabling an existing resource is an intentional terminal transition.
+        // Every field that can make an enabled resource unsafe still uses the
+        // canonical stored-record predicate.
+        disabled: updating ? false : input.disabled,
+        dpopBoundAccessTokensRequired: input.dpopBoundAccessTokensRequired,
+        identifier: updating ? "https://provisioning.invalid/resource" : String(input.identifier),
+        name: updating ? "Provisioning resource" : input.name,
+        refreshTokenTtl: input.refreshTokenTtl,
+        signingAlgorithm: input.signingAlgorithm,
+        signingKeyId: input.signingKeyId
+      },
+      allowedScopes
+    );
+  } catch {
+    invalidResourceProfile();
+  }
+}

package/dist/runtime/convex-auth/oauth-resource.d.ts

@@ -0,0 +1,39 @@
+import type { OAuthLiveAccess } from './oauth-live-access.js';
+import { type OAuthAccessTokenExpectations, type OAuthPrincipal } from './oauth-security.js';
+export interface VerifyOAuthBearerTokenOptions extends OAuthAccessTokenExpectations {
+    jwksUrl: string;
+}
+export type BetterAuthMcpAccessVerifierOptions = Omit<VerifyOAuthBearerTokenOptions, 'audience' | 'issuer'> & {
+    /**
+     * Required request-local Better Auth authority check. The callback runs only on the server and
+     * must validate the current session, user, client, consent, and resource grant from canonical
+     * state. Provider-private session identity never enters the MCP access context.
+     */
+    readonly validateLiveAccess: (access: OAuthLiveAccess) => Promise<boolean>;
+};
+/**
+ * Uses the pinned provider's resource client for JOSE/JWKS processing, then
+ * applies BCN's stricter beta token-class and exact-binding checks. Live
+ * session, client, consent, membership, and operation authorization remain a
+ * separate Convex transaction and are deliberately not derived from claims.
+ */
+export declare function verifyOAuthBearerToken(token: string | undefined, options: VerifyOAuthBearerTokenOptions): Promise<OAuthPrincipal>;
+/**
+ * Adapts BCN's strict Better Auth OAuth access-token profile to the provider-neutral MCP verifier
+ * contract without importing the MCP package or exposing provider-private session state.
+ */
+export declare function createBetterAuthMcpAccessVerifier(options: BetterAuthMcpAccessVerifierOptions): Readonly<{
+    verifyAccessToken(token: string, expected: {
+        readonly issuer: string;
+        readonly resource: URL;
+    }): Promise<Readonly<{
+        access: Readonly<{
+            issuer: string;
+            subject: string;
+            clientId: string;
+            resource: string;
+            scopes: readonly string[];
+        }>;
+        expiresAt: number;
+    }>>;
+}>;

package/dist/runtime/convex-auth/oauth-resource.js

@@ -0,0 +1,118 @@
+import { oauthProviderResourceClient } from "@better-auth/oauth-provider/resource-client";
+import {
+  OAuthSecurityError,
+  installUrlCanParseCompatibility,
+  prepareOAuthAccessTokenVerification
+} from "./oauth-security.js";
+const COMPACT_JWT_PATTERN = /^[\w-]+\.[\w-]+\.[\w-]+$/u;
+const MAX_COMPACT_JWT_BYTES = 8192;
+function invalidToken() {
+  throw new OAuthSecurityError("AUTH_OAUTH_TOKEN_INVALID");
+}
+function decodeVerifiedPayload(token) {
+  if (token.length > MAX_COMPACT_JWT_BYTES || !COMPACT_JWT_PATTERN.test(token)) invalidToken();
+  const encodedPayload = token.split(".")[1];
+  if (!encodedPayload || encodedPayload.length % 4 === 1) invalidToken();
+  try {
+    const base64 = encodedPayload.replaceAll("-", "+").replaceAll("_", "/");
+    const padded = `${base64}${"=".repeat((4 - base64.length % 4) % 4)}`;
+    const bytes = Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!value || typeof value !== "object" || Array.isArray(value)) invalidToken();
+    return value;
+  } catch {
+    invalidToken();
+  }
+}
+function isSecureOAuthEndpoint(value) {
+  return value.protocol === "https:" || value.protocol === "http:" && (value.hostname === "127.0.0.1" || value.hostname === "localhost" || value.hostname === "[::1]");
+}
+function requireCanonicalJwksUrl(issuer, jwksUrl) {
+  let parsedIssuer;
+  let parsedJwks;
+  try {
+    parsedIssuer = new URL(issuer);
+    parsedJwks = new URL(jwksUrl);
+  } catch {
+    throw new OAuthSecurityError("AUTH_OAUTH_TOKEN_INVALID");
+  }
+  if (!isSecureOAuthEndpoint(parsedIssuer) || parsedIssuer.username || parsedIssuer.password || parsedIssuer.search || parsedIssuer.hash || !isSecureOAuthEndpoint(parsedJwks) || parsedJwks.href !== jwksUrl || parsedJwks.origin !== parsedIssuer.origin || parsedJwks.username || parsedJwks.password || parsedJwks.search || parsedJwks.hash || jwksUrl !== `${issuer.endsWith("/") ? issuer : `${issuer}/`}jwks`) {
+    throw new OAuthSecurityError("AUTH_OAUTH_TOKEN_INVALID");
+  }
+}
+export async function verifyOAuthBearerToken(token, options) {
+  installUrlCanParseCompatibility();
+  requireCanonicalJwksUrl(options.issuer, options.jwksUrl);
+  if (typeof token !== "string") invalidToken();
+  decodeVerifiedPayload(token);
+  const maxLifetimeSeconds = options.maxLifetimeSeconds ?? 600;
+  const verification = prepareOAuthAccessTokenVerification(options);
+  const verifyBearerToken = oauthProviderResourceClient().getActions().verifyBearerToken;
+  await verifyBearerToken(token, {
+    jwksUrl: options.jwksUrl,
+    verifyOptions: {
+      algorithms: ["RS256"],
+      audience: options.audience,
+      clockTolerance: 0,
+      currentDate: verification.currentDate,
+      issuer: options.issuer,
+      maxTokenAge: `${maxLifetimeSeconds}s`,
+      typ: "at+jwt"
+    }
+  });
+  return verification.assert(decodeVerifiedPayload(token));
+}
+export function createBetterAuthMcpAccessVerifier(options) {
+  if (typeof options.validateLiveAccess !== "function") {
+    throw new OAuthSecurityError("AUTH_OAUTH_CONFIG_INVALID");
+  }
+  const fixedOptions = Object.freeze({
+    allowedScopes: Object.freeze([...options.allowedScopes]),
+    jwksUrl: options.jwksUrl,
+    ...options.clientId === void 0 ? {} : { clientId: options.clientId },
+    ...options.maxLifetimeSeconds === void 0 ? {} : { maxLifetimeSeconds: options.maxLifetimeSeconds },
+    ...options.requiredScopes === void 0 ? {} : { requiredScopes: Object.freeze([...options.requiredScopes]) },
+    ...options.subject === void 0 ? {} : { subject: options.subject },
+    validateLiveAccess: options.validateLiveAccess
+  });
+  const { validateLiveAccess, ...verificationOptions } = fixedOptions;
+  return Object.freeze({
+    async verifyAccessToken(token, expected) {
+      if (!expected || typeof expected.issuer !== "string" || !(expected.resource instanceof URL) || !isSecureOAuthEndpoint(expected.resource) || expected.resource.username || expected.resource.password || expected.resource.search || expected.resource.hash) {
+        invalidToken();
+      }
+      const resource = expected.resource.href;
+      const principal = await verifyOAuthBearerToken(token, {
+        ...verificationOptions,
+        audience: resource,
+        issuer: expected.issuer
+      });
+      let live = false;
+      try {
+        live = await validateLiveAccess(
+          Object.freeze({
+            clientId: principal.clientId,
+            issuer: expected.issuer,
+            resource,
+            scopes: Object.freeze([...principal.scopes]),
+            sessionId: principal.sessionId,
+            subject: principal.subject
+          })
+        );
+      } catch {
+        invalidToken();
+      }
+      if (live !== true) invalidToken();
+      return Object.freeze({
+        access: Object.freeze({
+          issuer: expected.issuer,
+          subject: principal.subject,
+          clientId: principal.clientId,
+          resource,
+          scopes: Object.freeze([...principal.scopes])
+        }),
+        expiresAt: principal.expiresAt
+      });
+    }
+  });
+}

package/dist/runtime/convex-auth/oauth-security.d.ts

@@ -0,0 +1,82 @@
+import type { OAuthOptions, Scope } from '@better-auth/oauth-provider';
+/**
+ * The exact Better Auth OAuth Provider profile accepted by this release.
+ *
+ * This is a pinned compatibility firewall, not a provider-neutral OAuth
+ * configuration abstraction. Runtime validation intentionally accepts only a
+ * strict subset of the exact installed provider's options.
+ */
+declare const PINNED_OAUTH_PROVIDER_KEYS: readonly ["accessTokenExpiresIn", "allowDynamicClientRegistration", "allowPublicClientPrelogin", "allowUnauthenticatedClientRegistration", "advertisedMetadata", "clientCredentialGrantDefaultScopes", "clientPrivileges", "clientRegistrationRequirePKCE", "codeExpiresIn", "consentPage", "customAccessTokenClaims", "customIdTokenClaims", "customTokenResponseFields", "customUserInfoClaims", "disableJwtPlugin", "dpop", "enforcePerClientResources", "extensions", "grantTypes", "loginPage", "m2mAccessTokenExpiresIn", "pairwiseSecret", "rateLimit", "requestUriResolver", "resourcePrivileges", "resources", "scopes", "storeClientSecret", "storeTokens", "validateInitialAccessToken"];
+export type PinnedOAuthProviderProfile = Pick<OAuthOptions<Scope[]>, (typeof PINNED_OAUTH_PROVIDER_KEYS)[number]>;
+export interface OAuthClientRecord extends Record<string, unknown> {
+    clientId: string;
+}
+export interface OAuthResourceRecord extends Record<string, unknown> {
+    identifier: string;
+}
+export interface OAuthClientResourceRecord extends Record<string, unknown> {
+    clientId: string;
+    resourceId: string;
+}
+export interface OAuthAccessTokenExpectations {
+    allowedScopes: readonly string[];
+    audience: string;
+    clientId?: string;
+    issuer: string;
+    maxLifetimeSeconds?: number;
+    requiredScopes?: readonly string[];
+    subject?: string;
+}
+export interface OAuthPrincipal {
+    clientId: string;
+    expiresAt: number;
+    scopes: readonly string[];
+    sessionId: string;
+    subject: string;
+}
+interface PrivilegeContext {
+    headers: Headers;
+    session?: unknown;
+    user?: unknown;
+    [key: string]: unknown;
+}
+interface HardenedOAuthCallbacks {
+    clientPrivileges: (context: PrivilegeContext) => Promise<boolean>;
+    customAccessTokenClaims: (info: unknown) => Promise<{
+        token_use: 'oauth-access';
+    }>;
+    resourcePrivileges: (context: PrivilegeContext) => Promise<boolean>;
+}
+export declare class OAuthSecurityError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+interface UrlCanParseTarget {
+    canParse?: (input: string | URL, base?: string | URL) => boolean;
+}
+/**
+ * Supply the one modern URL primitive absent from the manifest-pinned Convex
+ * isolate but called by @better-auth/oauth-provider@1.7.0-rc.2 while parsing
+ * RFC 8707 resources. Delete this helper and both call sites as soon as a
+ * reviewed dependency tuple supplies the primitive or removes those calls.
+ */
+export declare function installUrlCanParseCompatibility(target?: UrlCanParseTarget): void;
+export declare function validateOAuthScopes(scopes: unknown): asserts scopes is readonly string[];
+export declare function validateOAuthProviderProfile(options: PinnedOAuthProviderProfile): void;
+export declare function hardenOAuthProviderCallbacks(options: PinnedOAuthProviderProfile): HardenedOAuthCallbacks;
+export declare function validateResourceIdentifier(identifier: string): void;
+export declare function validateOAuthRedirectUris(value: unknown): asserts value is readonly string[];
+export declare function assertSafeStoredOAuthClient(client: OAuthClientRecord, allowedScopes: readonly string[]): void;
+export declare function assertSafeStoredOAuthResource(resource: OAuthResourceRecord, allowedScopes: readonly string[]): void;
+export declare function assertSafeStoredOAuthClientResource(link: OAuthClientResourceRecord, clientId: string, resourceId: string): void;
+export declare function assertSingleParameters(parameters: URLSearchParams, singletonFields: readonly string[]): void;
+export declare function requireSingleParameter(parameters: URLSearchParams, field: string): string;
+export declare function parseBoundedFormRequest(request: Request, allowedFields: readonly string[], maxBytes?: number): Promise<URLSearchParams>;
+export declare function parseBoundedFormBody(request: Request, maxBytes: number): Promise<URLSearchParams>;
+export declare function projectOAuthAuthorizationServerMetadata(officialMetadata: unknown, issuer: string, scopes: readonly string[]): Readonly<Record<string, unknown>>;
+export declare function assertOAuthAccessTokenClaims(payload: unknown, expectations: OAuthAccessTokenExpectations): OAuthPrincipal;
+export declare function prepareOAuthAccessTokenVerification(expectations: OAuthAccessTokenExpectations): Readonly<{
+    currentDate: Date;
+    assert(payload: unknown): OAuthPrincipal;
+}>;
+export {};