@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/api/routes/password.mjs

@@ -0,0 +1,206 @@
+import { originCheck } from "../middlewares/origin-check.mjs";
+import { getDate } from "../../utils/date.mjs";
+import { sensitiveSessionMiddleware } from "./session.mjs";
+import { validatePassword } from "../../utils/password.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { generateId } from "@better-auth/core/utils/id";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+//#region src/api/routes/password.ts
+function redirectError(ctx, callbackURL, query) {
+	const url = callbackURL ? new URL(callbackURL, ctx.baseURL) : new URL(`${ctx.baseURL}/error`);
+	if (query) Object.entries(query).forEach(([k, v]) => url.searchParams.set(k, v));
+	return url.href;
+}
+function redirectCallback(ctx, callbackURL, query) {
+	const url = new URL(callbackURL, ctx.baseURL);
+	if (query) Object.entries(query).forEach(([k, v]) => url.searchParams.set(k, v));
+	return url.href;
+}
+const requestPasswordReset = createAuthEndpoint("/request-password-reset", {
+	method: "POST",
+	body: z.object({
+		/**
+		* The email address of the user to send a password reset email to.
+		*/
+		email: z.email().meta({ description: "The email address of the user to send a password reset email to" }),
+		/**
+		* The URL to redirect the user to reset their password.
+		* If the token isn't valid or expired, it'll be redirected with a query parameter `?
+		* error=INVALID_TOKEN`. If the token is valid, it'll be redirected with a query parameter `?
+		* token=VALID_TOKEN
+		*/
+		redirectTo: z.string().meta({ description: "The URL to redirect the user to reset their password. If the token isn't valid or expired, it'll be redirected with a query parameter `?error=INVALID_TOKEN`. If the token is valid, it'll be redirected with a query parameter `?token=VALID_TOKEN" }).optional()
+	}),
+	metadata: { openapi: {
+		operationId: "requestPasswordReset",
+		description: "Send a password reset email to the user",
+		responses: { "200": {
+			description: "Success",
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: {
+					status: { type: "boolean" },
+					message: { type: "string" }
+				}
+			} } }
+		} }
+	} },
+	use: [originCheck((ctx) => ctx.body.redirectTo)]
+}, async (ctx) => {
+	if (!ctx.context.options.emailAndPassword?.sendResetPassword) {
+		ctx.context.logger.error("Reset password isn't enabled.Please pass an emailAndPassword.sendResetPassword function in your auth config!");
+		throw APIError.from("BAD_REQUEST", {
+			message: "Reset password isn't enabled",
+			code: "RESET_PASSWORD_DISABLED"
+		});
+	}
+	const { email, redirectTo } = ctx.body;
+	const user = await ctx.context.internalAdapter.findUserByEmail(email, { includeAccounts: true });
+	if (!user) {
+		/**
+		* We simulate the verification token generation and the database lookup
+		* to mitigate timing attacks.
+		*/
+		generateId(24);
+		await ctx.context.internalAdapter.findVerificationValue("dummy-verification-token");
+		ctx.context.logger.warn("Reset Password: User not found");
+		return ctx.json({
+			status: true,
+			message: "If this email exists in our system, check your email for the reset link"
+		});
+	}
+	const expiresAt = getDate(ctx.context.options.emailAndPassword.resetPasswordTokenExpiresIn || 3600 * 1, "sec");
+	const verificationToken = generateId(24);
+	await ctx.context.internalAdapter.createVerificationValue({
+		value: user.user.id,
+		identifier: `reset-password:${verificationToken}`,
+		expiresAt
+	});
+	const callbackURL = redirectTo ? encodeURIComponent(redirectTo) : "";
+	const url = `${ctx.context.baseURL}/reset-password/${verificationToken}?callbackURL=${callbackURL}`;
+	await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailAndPassword.sendResetPassword({
+		user: user.user,
+		url,
+		token: verificationToken
+	}, ctx.request));
+	return ctx.json({
+		status: true,
+		message: "If this email exists in our system, check your email for the reset link"
+	});
+});
+const requestPasswordResetCallback = createAuthEndpoint("/reset-password/:token", {
+	method: "GET",
+	operationId: "resetPasswordCallback",
+	query: z.object({ callbackURL: z.string().meta({ description: "The URL to redirect the user to reset their password" }) }),
+	use: [originCheck((ctx) => ctx.query.callbackURL)],
+	metadata: { openapi: {
+		operationId: "resetPasswordCallback",
+		description: "Redirects the user to the callback URL with the token",
+		parameters: [{
+			name: "token",
+			in: "path",
+			required: true,
+			description: "The token to reset the password",
+			schema: { type: "string" }
+		}, {
+			name: "callbackURL",
+			in: "query",
+			required: true,
+			description: "The URL to redirect the user to reset their password",
+			schema: { type: "string" }
+		}],
+		responses: { "200": {
+			description: "Success",
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { token: { type: "string" } }
+			} } }
+		} }
+	} }
+}, async (ctx) => {
+	const { token } = ctx.params;
+	const { callbackURL } = ctx.query;
+	if (!token || !callbackURL) throw ctx.redirect(redirectError(ctx.context, callbackURL, { error: "INVALID_TOKEN" }));
+	const verification = await ctx.context.internalAdapter.findVerificationValue(`reset-password:${token}`);
+	if (!verification || verification.expiresAt < /* @__PURE__ */ new Date()) throw ctx.redirect(redirectError(ctx.context, callbackURL, { error: "INVALID_TOKEN" }));
+	throw ctx.redirect(redirectCallback(ctx.context, callbackURL, { token }));
+});
+const resetPassword = createAuthEndpoint("/reset-password", {
+	method: "POST",
+	operationId: "resetPassword",
+	query: z.object({ token: z.string().optional() }).optional(),
+	body: z.object({
+		newPassword: z.string().meta({ description: "The new password to set" }),
+		token: z.string().meta({ description: "The token to reset the password" }).optional()
+	}),
+	metadata: { openapi: {
+		operationId: "resetPassword",
+		description: "Reset the password for a user",
+		responses: { "200": {
+			description: "Success",
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { status: { type: "boolean" } }
+			} } }
+		} }
+	} }
+}, async (ctx) => {
+	const token = ctx.body.token || ctx.query?.token;
+	if (!token) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);
+	const { newPassword } = ctx.body;
+	const minLength = ctx.context.password?.config.minPasswordLength;
+	const maxLength = ctx.context.password?.config.maxPasswordLength;
+	if (newPassword.length < minLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
+	if (newPassword.length > maxLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	const id = `reset-password:${token}`;
+	const verification = await ctx.context.internalAdapter.consumeVerificationValue(id);
+	if (!verification) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);
+	const userId = verification.value;
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
+	const hashedPassword = await ctx.context.password.hash(newPassword);
+	if (!await ctx.context.internalAdapter.findCredentialAccount(userId)) await ctx.context.internalAdapter.createAccount({
+		userId,
+		providerId: "credential",
+		accountId: user.id,
+		password: hashedPassword
+	});
+	else await ctx.context.internalAdapter.updatePassword(userId, hashedPassword);
+	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user }, ctx.request);
+	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(userId);
+	return ctx.json({ status: true });
+});
+const verifyPassword = createAuthEndpoint("/verify-password", {
+	method: "POST",
+	body: z.object({ 
+	/**
+	* The password to verify
+	*/
+password: z.string().meta({ description: "The password to verify" }) }),
+	metadata: {
+		scope: "server",
+		openapi: {
+			operationId: "verifyPassword",
+			description: "Verify the current user's password",
+			responses: { "200": {
+				description: "Success",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: { status: { type: "boolean" } }
+				} } }
+			} }
+		}
+	},
+	use: [sensitiveSessionMiddleware]
+}, async (ctx) => {
+	const { password } = ctx.body;
+	const session = ctx.context.session;
+	if (!await validatePassword(ctx, {
+		password,
+		userId: session.user.id
+	})) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
+	return ctx.json({ status: true });
+});
+//#endregion
+export { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword };

package/dist/api/routes/session.d.mts

@@ -0,0 +1,450 @@
+import { Prettify as Prettify$1 } from "../../types/helper.mjs";
+import { Session as Session$1, User as User$1 } from "../../types/models.mjs";
+import { BetterAuthOptions, GenericEndpointContext } from "@better-auth/core";
+import * as _$_better_auth_core_db0 from "@better-auth/core/db";
+import * as _$better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/api/routes/session.d.ts
+declare const getSession: <Option extends BetterAuthOptions>() => _$better_call0.StrictEndpoint<"/get-session", {
+  method: ("GET" | "POST")[];
+  operationId: string;
+  query: z.ZodOptional<z.ZodObject<{
+    disableCookieCache: z.ZodOptional<z.ZodCoercedBoolean<unknown>>;
+    disableRefresh: z.ZodOptional<z.ZodCoercedBoolean<unknown>>;
+  }, z.core.$strip>>;
+  requireHeaders: true;
+  metadata: {
+    openapi: {
+      operationId: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  session: {
+                    $ref: string;
+                  };
+                  user: {
+                    $ref: string;
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  session: Session$1<Option["session"], Option["plugins"]>;
+  user: User$1<Option["user"], Option["plugins"]>;
+} | null>;
+/**
+ * Whether the deployment keeps sessions in a durable server-side store
+ * (a database or secondary storage) rather than only in the signed cookie.
+ *
+ * Sensitive operations use this to decide whether the cookie cache is merely an
+ * optimization that must be bypassed for an authoritative read (`true`), or the
+ * only place the session lives and therefore the authority itself (`false`, for
+ * stateless / DB-less deployments). Pass the result as `disableCookieCache` so a
+ * revoked-but-cached session cannot authorize a sensitive action.
+ */
+declare const isStateful: (ctx: GenericEndpointContext) => boolean;
+declare const getSessionFromCtx: <U extends Record<string, any> = Record<string, any>, S extends Record<string, any> = Record<string, any>>(ctx: GenericEndpointContext, config?: {
+  disableCookieCache?: boolean;
+  disableRefresh?: boolean;
+} | undefined) => Promise<{
+  session: S & Session$1;
+  user: U & User$1;
+} | null>;
+/**
+ * Reads the session from the source that can authorize sensitive work.
+ *
+ * Stateful deployments must re-read the server-side session store because an
+ * earlier hook may have populated `ctx.context.session` from cookie cache.
+ * Stateless deployments keep the signed cookie as the session record.
+ */
+declare const getAuthoritativeSessionFromCtx: <U extends Record<string, any> = Record<string, any>, S extends Record<string, any> = Record<string, any>>(ctx: GenericEndpointContext) => Promise<{
+  session: S & {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null | undefined;
+    userAgent?: string | null | undefined;
+  };
+  user: U & {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null | undefined;
+  };
+} | null>;
+/**
+ * The middleware forces the endpoint to require a valid session.
+ */
+declare const sessionMiddleware: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+}>>;
+/**
+ * This middleware forces the endpoint to require a valid authoritative session.
+ * This should be used for sensitive operations like password changes, account deletion, etc.
+ */
+declare const sensitiveSessionMiddleware: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+}>>;
+/**
+ * This middleware allows you to call the endpoint on the client if session is valid.
+ * However, if called on the server, no session is required.
+ */
+declare const requestOnlySessionMiddleware: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  } | null;
+}>>;
+/**
+ * This middleware forces the endpoint to require a valid session,
+ * as well as making sure the session is fresh before proceeding.
+ *
+ * Session freshness check will be skipped if the session config's freshAge
+ * is set to 0
+ */
+declare const freshSessionMiddleware: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  session: {
+    session: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: Record<string, any> & {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+}>>;
+/**
+ * user active sessions list
+ */
+declare const listSessions: <Option extends BetterAuthOptions>() => _$better_call0.StrictEndpoint<"/list-sessions", {
+  method: "GET";
+  operationId: string;
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    };
+  }>>[];
+  requireHeaders: true;
+  metadata: {
+    openapi: {
+      operationId: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "array";
+                items: {
+                  $ref: string;
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, Prettify$1<{
+  id: string;
+  createdAt: Date;
+  updatedAt: Date;
+  userId: string;
+  expiresAt: Date;
+  token: string;
+  ipAddress?: string | null | undefined;
+  userAgent?: string | null | undefined;
+} & _$_better_auth_core_db0.InferDBFieldsFromOptions<Option["session"]> & _$_better_auth_core_db0.InferDBFieldsFromPlugins<"session", Option["plugins"]> extends infer T ? { [K in keyof T]: T[K] } : never>[]>;
+/**
+ * revoke a single session
+ */
+declare const revokeSession: _$better_call0.StrictEndpoint<"/revoke-session", {
+  method: "POST";
+  body: z.ZodObject<{
+    token: z.ZodString;
+  }, z.core.$strip>;
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    };
+  }>>[];
+  requireHeaders: true;
+  metadata: {
+    openapi: {
+      description: string;
+      requestBody: {
+        content: {
+          "application/json": {
+            schema: {
+              type: "object";
+              properties: {
+                token: {
+                  type: string;
+                  description: string;
+                };
+              };
+              required: string[];
+            };
+          };
+        };
+      };
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  status: {
+                    type: string;
+                    description: string;
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  status: boolean;
+}>;
+/**
+ * revoke all user sessions
+ */
+declare const revokeSessions: _$better_call0.StrictEndpoint<"/revoke-sessions", {
+  method: "POST";
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    };
+  }>>[];
+  requireHeaders: true;
+  metadata: {
+    openapi: {
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  status: {
+                    type: string;
+                    description: string;
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  status: boolean;
+}>;
+declare const revokeOtherSessions: _$better_call0.StrictEndpoint<"/revoke-other-sessions", {
+  method: "POST";
+  requireHeaders: true;
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    };
+  }>>[];
+  metadata: {
+    openapi: {
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  status: {
+                    type: string;
+                    description: string;
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  status: boolean;
+}>;
+//#endregion
+export { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };