@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/api/routes/sign-in.mjs

@@ -0,0 +1,368 @@
+import { formCsrfMiddleware } from "../middlewares/origin-check.mjs";
+import { parseUserOutput } from "../../db/schema.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { getAwaitableValue } from "../../context/helpers.mjs";
+import { resolveOAuthAccountKeyForAPI, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
+import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
+import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
+import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
+import { safeCloneRequest } from "../../utils/request.mjs";
+import { createEmailVerificationToken } from "./email-verification.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
+import { SocialProviderListEnum } from "@better-auth/core/social-providers";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+//#region src/api/routes/sign-in.ts
+const socialSignInBodySchema = z.object({
+	/**
+	* Callback URL to redirect to after the user
+	* has signed in.
+	*/
+	callbackURL: z.string().meta({ description: "Callback URL to redirect to after the user has signed in" }).optional(),
+	/**
+	* callback url to redirect if the user is newly registered.
+	*
+	* useful if you have different routes for existing users and new users
+	*/
+	newUserCallbackURL: z.string().optional(),
+	/**
+	* Callback url to redirect to if an error happens
+	*
+	* If it's initiated from the client sdk this defaults to
+	* the current url.
+	*/
+	errorCallbackURL: z.string().meta({ description: "Callback URL to redirect to if an error happens" }).optional(),
+	/**
+	* OAuth2 provider to use`
+	*/
+	provider: SocialProviderListEnum,
+	/**
+	* Disable automatic redirection to the provider
+	*
+	* This is useful if you want to handle the redirection
+	* yourself like in a popup or a different tab.
+	*/
+	disableRedirect: z.boolean().meta({ description: "Disable automatic redirection to the provider. Useful for handling the redirection yourself" }).optional(),
+	/**
+	* ID token from the provider
+	*
+	* This is used to sign in the user
+	* if the user is already signed in with the
+	* provider in the frontend.
+	*
+	* Only applicable if the provider supports
+	* it. Currently only `apple` and `google` is
+	* supported out of the box.
+	*/
+	idToken: z.optional(z.object({
+		/**
+		* ID token from the provider
+		*/
+		token: z.string().meta({ description: "ID token from the provider" }),
+		/**
+		* The nonce used to generate the token
+		*/
+		nonce: z.string().meta({ description: "Nonce used to generate the token" }).optional(),
+		/**
+		* Access token from the provider
+		*/
+		accessToken: z.string().meta({ description: "Access token from the provider" }).optional(),
+		/**
+		* Refresh token from the provider
+		*/
+		refreshToken: z.string().meta({ description: "Refresh token from the provider" }).optional(),
+		/**
+		* Expiry date of the token
+		*/
+		expiresAt: z.number().meta({ description: "Expiry date of the token" }).optional(),
+		/**
+		* The user object from the provider.
+		* This is only available for some providers like Apple.
+		*/
+		user: z.object({
+			name: z.object({
+				firstName: z.string().optional(),
+				lastName: z.string().optional()
+			}).optional(),
+			email: z.string().optional()
+		}).meta({ description: "The user object from the provider. Only available for some providers like Apple." }).optional()
+	})),
+	scopes: z.array(z.string()).meta({ description: "Array of scopes to request from the provider. This will override the default scopes passed." }).optional(),
+	/**
+	* Explicitly request sign-up
+	*
+	* Should be used to allow sign up when
+	* disableImplicitSignUp for this provider is
+	* true
+	*/
+	requestSignUp: z.boolean().meta({ description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider" }).optional(),
+	/**
+	* The login hint to use for the authorization code request
+	*/
+	loginHint: z.string().meta({ description: "The login hint to use for the authorization code request" }).optional(),
+	/**
+	* Extra query parameters to append to the provider authorization URL.
+	* Reserved OAuth keys (state, client_id, redirect_uri, response_type,
+	* code_challenge, code_challenge_method, nonce, scope) are rejected.
+	*/
+	additionalParams: additionalAuthorizationParamsSchema,
+	/**
+	* Additional data to be passed through the OAuth flow
+	*/
+	additionalData: z.record(z.string(), z.any()).optional().meta({ description: "Additional data to be passed through the OAuth flow" })
+});
+const signInSocial = () => createAuthEndpoint("/sign-in/social", {
+	method: "POST",
+	operationId: "socialSignIn",
+	body: socialSignInBodySchema,
+	metadata: {
+		$Infer: {
+			body: {},
+			returned: {}
+		},
+		openapi: {
+			description: "Sign in with a social provider",
+			operationId: "socialSignIn",
+			responses: { "200": {
+				description: "Success - Returns session details (idToken branch) or an authorize URL (redirect branch)",
+				content: { "application/json": { schema: {
+					type: "object",
+					description: "Returns session details when idToken is provided, or an authorize URL otherwise",
+					properties: {
+						token: { type: "string" },
+						user: {
+							type: "object",
+							$ref: "#/components/schemas/User"
+						},
+						url: { type: "string" },
+						redirect: { type: "boolean" }
+					},
+					required: ["redirect"]
+				} } }
+			} }
+		}
+	}
+}, async (c) => {
+	const provider = await getAwaitableValue(c.context.socialProviders, { value: c.body.provider });
+	if (!provider) {
+		c.context.logger.error("Provider not found. Make sure to add the provider in your auth config", { provider: c.body.provider });
+		throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.PROVIDER_NOT_FOUND);
+	}
+	if (c.body.idToken) {
+		if (!supportsIdTokenSignIn(provider)) {
+			c.context.logger.error("Provider does not support id token verification", { provider: c.body.provider });
+			throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED);
+		}
+		const { token, nonce } = c.body.idToken;
+		if (!await verifyProviderIdToken(provider, token, nonce, c)) {
+			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
+			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);
+		}
+		const oauthTokens = {
+			idToken: token,
+			accessToken: c.body.idToken.accessToken,
+			refreshToken: c.body.idToken.refreshToken,
+			user: c.body.idToken.user
+		};
+		const userInfo = await provider.getUserInfo(oauthTokens);
+		if (!userInfo || !userInfo?.user) {
+			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
+			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
+		}
+		if (!userInfo.user.email) {
+			c.context.logger.error(missingEmailLogMessage(c.body.provider, { source: "id_token" }), { provider: c.body.provider });
+			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.USER_EMAIL_NOT_FOUND);
+		}
+		const accountKey = await resolveOAuthAccountKeyForAPI(provider, oauthTokens, userInfo.data);
+		const providerProfile = toOAuthProfileRecord(userInfo.data);
+		const data = await handleOAuthUserInfo(c, {
+			userInfo: {
+				...userInfo.user,
+				email: userInfo.user.email,
+				id: accountKey.accountId,
+				name: userInfo.user.name || "",
+				image: userInfo.user.image,
+				emailVerified: userInfo.user.emailVerified || false
+			},
+			account: {
+				...accountKey,
+				accessToken: c.body.idToken.accessToken,
+				idToken: token
+			},
+			callbackURL: c.body.callbackURL,
+			disableSignUp: provider.disableImplicitSignUp && !c.body.requestSignUp || provider.disableSignUp,
+			source: {
+				method: "oauth",
+				oauth: {
+					providerId: provider.id,
+					profile: providerProfile
+				}
+			}
+		});
+		if (data.error) {
+			if (data.error === OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_VERIFIED) throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
+			throw APIError.from("UNAUTHORIZED", {
+				message: data.error,
+				code: "OAUTH_LINK_ERROR"
+			});
+		}
+		await setSessionCookie(c, data.data);
+		return c.json({
+			redirect: false,
+			token: data.data.session.token,
+			url: void 0,
+			user: parseUserOutput(c.context.options, data.data.user)
+		});
+	}
+	const idTokenNonce = generateIdTokenNonce(provider);
+	const { codeVerifier, state } = await generateState(c, {
+		additionalData: c.body.additionalData,
+		idTokenNonce
+	});
+	const url = await provider.createAuthorizationURL({
+		state,
+		codeVerifier,
+		idTokenNonce,
+		redirectURI: `${c.context.baseURL}${getOAuthCallbackPath(provider)}`,
+		scopes: c.body.scopes,
+		loginHint: c.body.loginHint,
+		additionalParams: c.body.additionalParams
+	});
+	if (!c.body.disableRedirect) c.setHeader("Location", url.toString());
+	return c.json({
+		url: url.toString(),
+		redirect: !c.body.disableRedirect
+	});
+});
+const signInEmail = () => createAuthEndpoint("/sign-in/email", {
+	method: "POST",
+	operationId: "signInEmail",
+	use: [formCsrfMiddleware],
+	cloneRequest: true,
+	body: z.object({
+		/**
+		* Email of the user
+		*/
+		email: z.string().meta({ description: "Email of the user" }),
+		/**
+		* Password of the user
+		*/
+		password: z.string().meta({ description: "Password of the user" }),
+		/**
+		* Callback URL to use as a redirect for email
+		* verification and for possible redirects
+		*/
+		callbackURL: z.string().meta({ description: "Callback URL to use as a redirect for email verification" }).optional(),
+		/**
+		* If this is false, the session will not be remembered
+		* @default true
+		*/
+		rememberMe: z.boolean().meta({ description: "If this is false, the session will not be remembered. Default is `true`." }).default(true).optional()
+	}),
+	metadata: {
+		allowedMediaTypes: ["application/x-www-form-urlencoded", "application/json"],
+		$Infer: {
+			body: {},
+			returned: {}
+		},
+		openapi: {
+			operationId: "signInEmail",
+			description: "Sign in with email and password",
+			responses: { "200": {
+				description: "Success - Returns either session details or redirect URL",
+				content: { "application/json": { schema: {
+					type: "object",
+					description: "Session response when idToken is provided",
+					properties: {
+						redirect: {
+							type: "boolean",
+							enum: [false]
+						},
+						token: {
+							type: "string",
+							description: "Session token"
+						},
+						url: {
+							type: "string",
+							nullable: true
+						},
+						user: {
+							type: "object",
+							$ref: "#/components/schemas/User"
+						}
+					},
+					required: [
+						"redirect",
+						"token",
+						"user"
+					]
+				} } }
+			} }
+		}
+	}
+}, async (ctx) => {
+	if (!ctx.context.options?.emailAndPassword?.enabled) {
+		ctx.context.logger.error("Email and password is not enabled. Make sure to enable it in the options on you `auth.ts` file. Check `https://better-auth.com/docs/authentication/email-password` for more!");
+		throw APIError.from("BAD_REQUEST", {
+			code: "EMAIL_PASSWORD_DISABLED",
+			message: "Email and password is not enabled"
+		});
+	}
+	const { email, password } = ctx.body;
+	if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
+	const userRecord = await ctx.context.internalAdapter.findUserByEmail(email.toLowerCase(), { includeAccounts: true });
+	const credentialAccount = userRecord?.accounts.find((account) => account.providerId === "credential" && account.accountId === userRecord.user.id);
+	if (!userRecord || !credentialAccount) {
+		await ctx.context.password.hash(password);
+		ctx.context.logger.warn("User not found");
+		throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD);
+	}
+	const user = userRecord.user;
+	const currentPassword = credentialAccount.password;
+	if (!currentPassword) {
+		await ctx.context.password.hash(password);
+		ctx.context.logger.warn("Password not found");
+		throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD);
+	}
+	if (!await ctx.context.password.verify({
+		hash: currentPassword,
+		password
+	})) {
+		ctx.context.logger.warn("Invalid password");
+		throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD);
+	}
+	if (ctx.context.options?.emailAndPassword?.requireEmailVerification && !user.emailVerified) {
+		if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
+		if (ctx.context.options?.emailVerification?.sendOnSignIn) {
+			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
+			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
+			await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
+				user,
+				url,
+				token
+			}, safeCloneRequest(ctx.request)));
+		}
+		throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
+	}
+	const session = await ctx.context.internalAdapter.createSession(user.id, ctx.body.rememberMe === false);
+	if (!session) {
+		ctx.context.logger.error("Failed to create session");
+		throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
+	}
+	await setSessionCookie(ctx, {
+		session,
+		user
+	}, ctx.body.rememberMe === false);
+	if (ctx.body.callbackURL) ctx.setHeader("Location", ctx.body.callbackURL);
+	return ctx.json({
+		redirect: !!ctx.body.callbackURL,
+		token: session.token,
+		url: ctx.body.callbackURL,
+		user: parseUserOutput(ctx.context.options, user)
+	});
+});
+//#endregion
+export { signInEmail, signInSocial };

package/dist/api/routes/sign-out.d.mts

@@ -0,0 +1,51 @@
+import * as _$better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/api/routes/sign-out.d.ts
+declare const signOut: _$better_call0.StrictEndpoint<"/sign-out", {
+  method: "POST";
+  body: z.ZodOptional<z.ZodObject<{
+    callbackURL: z.ZodOptional<z.ZodString>;
+    disableRedirect: z.ZodOptional<z.ZodBoolean>;
+    state: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  operationId: string;
+  requireHeaders: true;
+  metadata: {
+    openapi: {
+      operationId: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  success: {
+                    type: string;
+                  };
+                  url: {
+                    type: string;
+                    description: string;
+                  };
+                  redirect: {
+                    type: string;
+                    description: string;
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  success: boolean;
+  url: string | undefined;
+  redirect: boolean | undefined;
+}>;
+//#endregion
+export { signOut };

package/dist/api/routes/sign-out.mjs

@@ -0,0 +1,96 @@
+import { deleteSessionCookie } from "../../cookies/index.mjs";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+//#region src/api/routes/sign-out.ts
+const signOutBodySchema = z.object({
+	callbackURL: z.string().meta({ description: "The URL to redirect to after provider logout" }).optional(),
+	disableRedirect: z.boolean().meta({ description: "Return the provider logout URL without redirecting" }).optional(),
+	state: z.string().meta({ description: "State to pass to the provider logout endpoint" }).optional()
+}).optional();
+const signOutResponse = (providerLogout) => ({
+	success: true,
+	url: providerLogout?.url,
+	redirect: providerLogout?.redirect
+});
+const signOut = createAuthEndpoint("/sign-out", {
+	method: "POST",
+	body: signOutBodySchema,
+	operationId: "signOut",
+	requireHeaders: true,
+	metadata: { openapi: {
+		operationId: "signOut",
+		description: "Sign out the current user",
+		responses: { "200": {
+			description: "Success",
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: {
+					success: { type: "boolean" },
+					url: {
+						type: "string",
+						description: "Provider logout URL when RP-initiated logout is available"
+					},
+					redirect: {
+						type: "boolean",
+						description: "Whether the client should redirect to the provider logout URL"
+					}
+				}
+			} } }
+		} }
+	} }
+}, async (ctx) => {
+	const sessionCookieToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+	let currentSession = null;
+	if (sessionCookieToken) try {
+		currentSession = await ctx.context.internalAdapter.findSession(sessionCookieToken);
+	} catch (e) {
+		ctx.context.logger.error("Failed to read session from database", e);
+	}
+	if (sessionCookieToken) try {
+		await ctx.context.internalAdapter.deleteSession(sessionCookieToken);
+	} catch (e) {
+		ctx.context.logger.error("Failed to delete session from database", e);
+	}
+	deleteSessionCookie(ctx);
+	const providerLogoutResult = await (async () => {
+		try {
+			if (!currentSession) return null;
+			const accounts = await ctx.context.internalAdapter.findAccounts(currentSession.user.id);
+			const providersById = new Map(ctx.context.socialProviders.map((provider) => [provider.id, provider]));
+			const logoutAccounts = accounts.filter((account) => Boolean(providersById.get(account.providerId)?.createEndSessionURL)).sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime());
+			if (logoutAccounts.length === 0) return null;
+			const seenProviderIds = /* @__PURE__ */ new Set();
+			const postLogoutRedirectURI = ctx.body?.callbackURL ? new URL(ctx.body.callbackURL, ctx.context.baseURL).toString() : void 0;
+			for (const account of logoutAccounts) {
+				if (seenProviderIds.has(account.providerId)) continue;
+				seenProviderIds.add(account.providerId);
+				const provider = providersById.get(account.providerId);
+				try {
+					const url = await provider?.createEndSessionURL?.({
+						idToken: account.idToken,
+						postLogoutRedirectURI,
+						state: ctx.body?.state
+					});
+					if (url) return url.toString();
+				} catch (e) {
+					ctx.context.logger.error(`Failed to create logout URL for provider "${account.providerId}"`, e);
+				}
+			}
+			return null;
+		} catch (e) {
+			ctx.context.logger.error("Failed to create provider logout URL", e);
+			return null;
+		}
+	})();
+	if (providerLogoutResult) {
+		const shouldRedirect = !ctx.body?.disableRedirect;
+		if (shouldRedirect) ctx.setHeader("Location", providerLogoutResult);
+		return ctx.json(signOutResponse({
+			url: providerLogoutResult,
+			redirect: shouldRedirect
+		}));
+	}
+	return ctx.json(signOutResponse());
+});
+//#endregion
+export { signOut };

package/dist/api/routes/sign-up.d.mts

@@ -0,0 +1,159 @@
+import { AdditionalUserFieldsInput, User } from "../../types/models.mjs";
+import { BetterAuthOptions } from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/api/routes/sign-up.d.ts
+declare const signUpEmail: <O extends BetterAuthOptions>() => _$better_call0.StrictEndpoint<"/sign-up/email", {
+  method: "POST";
+  operationId: string;
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>[];
+  body: z.ZodIntersection<z.ZodObject<{
+    name: z.ZodString;
+    email: z.ZodEmail;
+    password: z.ZodString;
+    image: z.ZodOptional<z.ZodString>;
+    callbackURL: z.ZodOptional<z.ZodString>;
+    rememberMe: z.ZodOptional<z.ZodBoolean>;
+  }, z.core.$strip>, z.ZodRecord<z.ZodString, z.ZodAny>>;
+  cloneRequest: true;
+  metadata: {
+    allowedMediaTypes: string[];
+    $Infer: {
+      body: {
+        name: string;
+        email: string;
+        password: string;
+        image?: string | undefined;
+        callbackURL?: string | undefined;
+        rememberMe?: boolean | undefined;
+      } & AdditionalUserFieldsInput<O>;
+      returned: {
+        token: string | null;
+        user: User<O["user"], O["plugins"]>;
+      };
+    };
+    openapi: {
+      operationId: string;
+      description: string;
+      requestBody: {
+        content: {
+          "application/json": {
+            schema: {
+              type: "object";
+              properties: {
+                name: {
+                  type: string;
+                  description: string;
+                };
+                email: {
+                  type: string;
+                  description: string;
+                };
+                password: {
+                  type: string;
+                  description: string;
+                };
+                image: {
+                  type: string;
+                  description: string;
+                };
+                callbackURL: {
+                  type: string;
+                  description: string;
+                };
+                rememberMe: {
+                  type: string;
+                  description: string;
+                };
+              };
+              required: string[];
+            };
+          };
+        };
+      };
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  token: {
+                    type: string;
+                    nullable: boolean;
+                    description: string;
+                  };
+                  user: {
+                    type: string;
+                    properties: {
+                      id: {
+                        type: string;
+                        description: string;
+                      };
+                      email: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      name: {
+                        type: string;
+                        description: string;
+                      };
+                      image: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      emailVerified: {
+                        type: string;
+                        description: string;
+                      };
+                      createdAt: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      updatedAt: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+        "422": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  message: {
+                    type: string;
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  token: null;
+  user: User<O["user"], O["plugins"]>;
+} | {
+  token: string;
+  user: User<O["user"], O["plugins"]>;
+}>;
+//#endregion
+export { signUpEmail };