@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/oauth2/link-account.d.mts

@@ -0,0 +1,96 @@
+import { Account, User } from "../types/models.mjs";
+import { GenericEndpointContext, UserProvisioningSource } from "@better-auth/core";
+
+//#region src/oauth2/link-account.d.ts
+declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
+  userInfo: Omit<User, "createdAt" | "updatedAt">;
+  account: Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+  callbackURL?: string | undefined;
+  disableSignUp?: boolean | undefined;
+  overrideUserInfo?: boolean | undefined;
+  isTrustedProvider?: boolean | undefined;
+  trustProviderByName?: boolean | undefined;
+  source?: UserProvisioningSource | undefined;
+  selectedUser?: {
+    userId: string;
+    profile: "preserve" | "update";
+  } | undefined;
+  deferNonDatabaseWrites?: boolean | undefined;
+  requireExactAccountBinding?: boolean | undefined;
+}): Promise<{
+  error: string;
+  data: null;
+  isRegister: boolean;
+  accountCookie?: undefined;
+} | {
+  error: string;
+  data: null;
+  isRegister?: undefined;
+  accountCookie?: undefined;
+} | {
+  data: {
+    session: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+  error: null;
+  isRegister: boolean;
+  accountCookie: {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    providerId: string;
+    accountId: string;
+    userId: string;
+    accessToken?: string | null | undefined;
+    refreshToken?: string | null | undefined;
+    idToken?: string | null | undefined;
+    accessTokenExpiresAt?: Date | null | undefined;
+    refreshTokenExpiresAt?: Date | null | undefined;
+    scope?: string | null | undefined;
+    password?: string | null | undefined;
+  } | null;
+}>;
+/**
+ * Provider profile a freshly linked account may copy onto the local user.
+ * `email` and `emailVerified` are identity anchors and are stripped before
+ * the remaining fields are written. Provider identity is resolved separately
+ * from the raw profile through the provider's account-key contract.
+ */
+type LinkedProviderProfile = {
+  name?: string | undefined;
+  email?: string | null | undefined;
+  emailVerified?: boolean | undefined;
+  image?: string | null | undefined;
+};
+/**
+ * Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
+ * copy the freshly linked provider's profile onto the local user, matching the
+ * field set persisted on sign-up. The local `email` and `emailVerified` are
+ * never changed, so a link can't rebind the account's identity, and
+ * `updateUser` drops `undefined` fields, so a provider that omits one leaves
+ * the existing column intact.
+ *
+ * Returns the updated user so a caller that issues a session can seed the
+ * cookie cache with the fresh row. Returns `undefined` when the policy is
+ * disabled or the update fails: a failed profile sync must not abort the link.
+ */
+declare function applyUpdateUserInfoOnLink(c: GenericEndpointContext, userId: string, userInfo: LinkedProviderProfile): Promise<User | undefined>;
+//#endregion
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };

package/dist/oauth2/link-account.mjs

@@ -0,0 +1,329 @@
+import { isAPIError } from "../utils/is-api-error.mjs";
+import { parseAdditionalUserInputFromProviderProfile } from "../db/schema.mjs";
+import { setAccountCookie } from "../cookies/session-store.mjs";
+import { assertValidUserInfo } from "../utils/validate-user-info.mjs";
+import { OAUTH_CALLBACK_ERROR_CODES, redirectOnError } from "./errors.mjs";
+import { setTokenUtil } from "./utils.mjs";
+import { createEmailVerificationToken } from "../api/routes/email-verification.mjs";
+import { queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
+import { isDevelopment } from "@better-auth/core/env";
+import { APIError } from "@better-auth/core/error";
+//#region src/oauth2/link-account.ts
+async function handleOAuthUserInfo(c, opts) {
+	const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
+	const source = opts.source ?? {
+		method: "oauth",
+		oauth: { providerId: account.providerId }
+	};
+	const requireExactAccountBinding = !!opts.selectedUser || opts.requireExactAccountBinding === true;
+	let pendingAccountCookie = null;
+	const accountOwner = await c.context.internalAdapter.findAccountOwnerByKey({
+		providerId: account.providerId,
+		accountId: account.accountId
+	}).catch((e) => {
+		c.context.logger.error("Better auth was unable to query your database.\nError: ", e);
+		redirectOnError(c, c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`, "internal_server_error");
+	});
+	if (accountOwner?.kind === "orphaned") {
+		c.context.logger.error("OAuth account references a missing user. Repair the account before retrying authentication.");
+		return {
+			error: "unable to link account",
+			data: null,
+			isRegister: false
+		};
+	}
+	const dbUser = await (async () => {
+		if (accountOwner?.kind === "owned") {
+			if (opts.selectedUser && accountOwner.user.id !== opts.selectedUser.userId) throw new APIError("CONFLICT", {
+				code: "account_ownership_conflict",
+				message: "Account is already linked to another user"
+			});
+			return {
+				user: accountOwner.user,
+				linkedAccount: accountOwner.account,
+				accounts: [accountOwner.account]
+			};
+		}
+		if (opts.selectedUser) {
+			const selectedUser = await c.context.internalAdapter.findUserById(opts.selectedUser.userId);
+			if (!selectedUser) throw new APIError("NOT_FOUND", {
+				code: "user_not_found",
+				message: "User not found"
+			});
+			return {
+				user: selectedUser,
+				linkedAccount: null,
+				accounts: []
+			};
+		}
+		const emailMatch = await c.context.internalAdapter.findUserByEmail(userInfo.email.toLowerCase(), { includeAccounts: true });
+		if (!emailMatch) return null;
+		return {
+			user: emailMatch.user,
+			linkedAccount: null,
+			accounts: emailMatch.accounts
+		};
+	})().catch((e) => {
+		if (isAPIError(e)) throw e;
+		c.context.logger.error("Better auth was unable to query your database.\nError: ", e);
+		redirectOnError(c, c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`, "internal_server_error");
+	});
+	let user = dbUser?.user;
+	const isRegister = !user;
+	if (dbUser) {
+		const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.providerId === account.providerId && acc.accountId === account.accountId);
+		if (!linkedAccount) {
+			const accountLinking = c.context.options.account?.accountLinking;
+			const isTrustedProvider = opts.isTrustedProvider || opts.trustProviderByName !== false && c.context.trustedProviders.includes(account.providerId);
+			const requireLocalEmailVerified = accountLinking?.requireLocalEmailVerified ?? true;
+			if (!opts.selectedUser && (!isTrustedProvider && !userInfo.emailVerified || requireLocalEmailVerified && !dbUser.user.emailVerified || accountLinking?.enabled === false || accountLinking?.disableImplicitLinking === true)) {
+				if (isDevelopment()) c.context.logger.warn(`User already exist but account isn't linked to ${account.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`);
+				return {
+					error: "account not linked",
+					data: null
+				};
+			}
+			try {
+				const { id: _accountId, ...providerUserInfo } = userInfo;
+				await assertValidUserInfo(c, {
+					user: {
+						...providerUserInfo,
+						id: dbUser.user.id,
+						email: userInfo.email.toLowerCase()
+					},
+					source: {
+						...source,
+						action: "link-account"
+					}
+				});
+				const createdAccount = await c.context.internalAdapter.linkAccount({
+					providerId: account.providerId,
+					accountId: account.accountId,
+					userId: dbUser.user.id,
+					accessToken: await setTokenUtil(account.accessToken, c.context),
+					refreshToken: await setTokenUtil(account.refreshToken, c.context),
+					idToken: account.idToken,
+					accessTokenExpiresAt: account.accessTokenExpiresAt,
+					refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+					scope: account.scope
+				});
+				if (!createdAccount) return {
+					error: "unable to link account",
+					data: null
+				};
+				if (requireExactAccountBinding && (createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
+					code: "account_hook_binding_conflict",
+					message: "Account hook changed the selected authentication binding"
+				});
+				if (c.context.options.account?.storeAccountCookie) if (opts.deferNonDatabaseWrites) pendingAccountCookie = createdAccount;
+				else await setAccountCookie(c, createdAccount);
+			} catch (e) {
+				if (isAPIError(e)) throw e;
+				c.context.logger.error("Unable to link account", e);
+				return {
+					error: "unable to link account",
+					data: null
+				};
+			}
+			if (!opts.selectedUser && userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
+			if (!opts.selectedUser) user = await applyUpdateUserInfoOnLink(c, dbUser.user.id, userInfo) ?? user;
+		} else {
+			const { id: _accountId, ...providerUserInfo } = userInfo;
+			await assertValidUserInfo(c, {
+				user: {
+					...providerUserInfo,
+					id: dbUser.user.id,
+					email: userInfo.email.toLowerCase()
+				},
+				source: {
+					...source,
+					action: "sign-in"
+				}
+			});
+			/**
+			* `scope` intentionally omitted. Updated only via linkSocial.
+			*
+			* @see {@link Account.scope}
+			*/
+			const freshTokens = c.context.options.account?.updateAccountOnSignIn !== false ? Object.fromEntries(Object.entries({
+				providerId: account.providerId,
+				idToken: account.idToken,
+				accessToken: await setTokenUtil(account.accessToken, c.context),
+				refreshToken: await setTokenUtil(account.refreshToken, c.context),
+				accessTokenExpiresAt: account.accessTokenExpiresAt,
+				refreshTokenExpiresAt: account.refreshTokenExpiresAt
+			}).filter(([_, value]) => value !== void 0)) : {};
+			if (c.context.options.account?.storeAccountCookie) {
+				const accountCookie = {
+					...linkedAccount,
+					...freshTokens
+				};
+				if (opts.deferNonDatabaseWrites) pendingAccountCookie = accountCookie;
+				else await setAccountCookie(c, accountCookie);
+			}
+			if (Object.keys(freshTokens).length > 0) {
+				const updatedAccount = await c.context.internalAdapter.updateAccount(linkedAccount.id, freshTokens);
+				if (!updatedAccount) return {
+					error: "unable to update account",
+					data: null
+				};
+				if (requireExactAccountBinding && (updatedAccount.accountId !== account.accountId || updatedAccount.providerId !== account.providerId || updatedAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
+					code: "account_hook_binding_conflict",
+					message: "Account hook changed the selected authentication binding"
+				});
+				if (opts.deferNonDatabaseWrites && pendingAccountCookie) pendingAccountCookie = updatedAccount;
+			}
+			if (!opts.selectedUser && userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
+		}
+		if (opts.selectedUser ? opts.selectedUser.profile === "update" : overrideUserInfo) {
+			const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+			const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "update");
+			const updatedUser = await c.context.internalAdapter.updateUser(dbUser.user.id, {
+				name,
+				image,
+				...additionalUserFields,
+				email: userInfo.email.toLowerCase(),
+				emailVerified: userInfo.email.toLowerCase() === dbUser.user.email ? dbUser.user.emailVerified || userInfo.emailVerified : userInfo.emailVerified
+			});
+			if (updatedUser == null) c.context.logger.warn("Could not update user info during OAuth sign in; preserving existing user for session.");
+			if (opts.selectedUser && updatedUser && updatedUser.id !== opts.selectedUser.userId) throw new APIError("CONFLICT", {
+				code: "user_hook_selection_conflict",
+				message: "User hook changed the selected user"
+			});
+			user = updatedUser ?? user;
+		}
+	} else {
+		if (disableSignUp) return {
+			error: "signup disabled",
+			data: null,
+			isRegister: false
+		};
+		try {
+			const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+			const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "create");
+			const accountData = {
+				accessToken: await setTokenUtil(account.accessToken, c.context),
+				refreshToken: await setTokenUtil(account.refreshToken, c.context),
+				idToken: account.idToken,
+				accessTokenExpiresAt: account.accessTokenExpiresAt,
+				refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+				scope: account.scope,
+				providerId: account.providerId,
+				accountId: account.accountId
+			};
+			const { createdUser, createdAccount } = await runWithTransaction(c.context.adapter, async () => {
+				const createdUser = await c.context.internalAdapter.createUser({
+					name,
+					image,
+					...additionalUserFields,
+					email: userInfo.email.toLowerCase(),
+					emailVerified: userInfo.emailVerified
+				}, source);
+				return {
+					createdUser,
+					createdAccount: await c.context.internalAdapter.createAccount({
+						...accountData,
+						userId: createdUser.id
+					})
+				};
+			});
+			if (requireExactAccountBinding && (createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== createdUser.id)) throw new APIError("CONFLICT", {
+				code: "account_hook_binding_conflict",
+				message: "Account hook changed the selected authentication binding"
+			});
+			user = createdUser;
+			if (c.context.options.account?.storeAccountCookie) if (opts.deferNonDatabaseWrites) pendingAccountCookie = createdAccount;
+			else await setAccountCookie(c, createdAccount);
+		} catch (e) {
+			if (isAPIError(e)) throw e;
+			c.context.logger.error("Unable to create OAuth user", e);
+			return {
+				error: "unable to create user",
+				data: null,
+				isRegister: false
+			};
+		}
+	}
+	if (!user) return {
+		error: "unable to create user",
+		data: null,
+		isRegister: false
+	};
+	const requireEmailVerification = c.context.socialProviders.find((p) => p.id === account.providerId)?.options?.requireEmailVerification;
+	if (isRegister && !user.emailVerified && (c.context.options.emailVerification?.sendOnSignUp ?? requireEmailVerification)) await dispatchVerificationEmail(c, user, callbackURL, opts.deferNonDatabaseWrites);
+	if (requireEmailVerification && !user.emailVerified) {
+		if (!isRegister && c.context.options.emailVerification?.sendOnSignIn) await dispatchVerificationEmail(c, user, callbackURL, opts.deferNonDatabaseWrites);
+		return {
+			error: OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_VERIFIED,
+			data: null,
+			isRegister
+		};
+	}
+	const session = await c.context.internalAdapter.createSession(user.id, void 0, void 0, void 0, { deferSecondaryStorageWrites: opts.deferNonDatabaseWrites === true });
+	if (!session) return {
+		error: "unable to create session",
+		data: null,
+		isRegister: false
+	};
+	if (requireExactAccountBinding && session.userId !== (opts.selectedUser?.userId ?? user.id)) throw new APIError("CONFLICT", {
+		code: "session_hook_user_conflict",
+		message: "Session hook changed the selected user"
+	});
+	return {
+		data: {
+			session,
+			user
+		},
+		error: null,
+		isRegister,
+		accountCookie: pendingAccountCookie
+	};
+}
+async function dispatchVerificationEmail(c, user, callbackURL, deferUntilAfterTransaction) {
+	const sendVerificationEmail = c.context.options.emailVerification?.sendVerificationEmail;
+	if (!sendVerificationEmail) return;
+	const send = async () => {
+		try {
+			const token = await createEmailVerificationToken(c.context.secret, user.email, void 0, c.context.options.emailVerification?.expiresIn);
+			const url = `${c.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(callbackURL || "/")}`;
+			await c.context.runInBackgroundOrAwait(sendVerificationEmail({
+				user,
+				url,
+				token
+			}, c.request));
+		} catch (e) {
+			c.context.logger.error("Failed to send OAuth verification email", e);
+		}
+	};
+	if (deferUntilAfterTransaction) await queueAfterTransactionHook(send);
+	else await send();
+}
+/**
+* Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
+* copy the freshly linked provider's profile onto the local user, matching the
+* field set persisted on sign-up. The local `email` and `emailVerified` are
+* never changed, so a link can't rebind the account's identity, and
+* `updateUser` drops `undefined` fields, so a provider that omits one leaves
+* the existing column intact.
+*
+* Returns the updated user so a caller that issues a session can seed the
+* cookie cache with the fresh row. Returns `undefined` when the policy is
+* disabled or the update fails: a failed profile sync must not abort the link.
+*/
+async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
+	if (c.context.options.account?.accountLinking?.updateUserInfoOnLink !== true) return;
+	try {
+		const { email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+		const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "update");
+		return await c.context.internalAdapter.updateUser(userId, {
+			name,
+			image,
+			...additionalUserFields
+		});
+	} catch (e) {
+		c.context.logger.warn("Could not update user info on account link", e);
+		return;
+	}
+}
+//#endregion
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };

package/dist/oauth2/state.d.mts

@@ -0,0 +1,54 @@
+import { GenericEndpointContext } from "@better-auth/core";
+
+//#region src/oauth2/state.d.ts
+/**
+ * Mint the OIDC `nonce` for the redirect flow, or `undefined` when the provider
+ * does not require ID-token nonce binding. Every redirect entrypoint (social
+ * sign-in, account linking, IDP-initiated bounce, and the OAuth popup) mints
+ * through this helper, so the value sent on the authorization URL and the value
+ * persisted in state are produced one way and cannot drift apart.
+ */
+declare function generateIdTokenNonce(provider: {
+  requiresIdTokenNonce?: boolean | undefined;
+}): string | undefined;
+/**
+ * Inputs for {@link generateState}. Grouped into one object so call sites read
+ * by name instead of by position.
+ */
+interface GenerateStateOptions {
+  /** Link target when this flow links a provider identity to an existing user. */
+  link?: {
+    email: string;
+    userId: string;
+  } | undefined;
+  /** Extra data to round-trip through state; `false` writes none. */
+  additionalData?: Record<string, any> | false | undefined;
+  /** The `state` nonce already used to build the authorization URL. Minted when omitted. */
+  state?: string | undefined;
+  /** The PKCE `codeVerifier` already used to build the authorization URL. Minted when omitted. */
+  codeVerifier?: string | undefined;
+  /** The OIDC nonce already sent as the authorization URL `nonce` parameter. */
+  idTokenNonce?: string | undefined;
+}
+declare function generateState(c: GenericEndpointContext, options?: GenerateStateOptions): Promise<{
+  state: string;
+  codeVerifier: string;
+}>;
+declare function parseState(c: GenericEndpointContext): Promise<{
+  [x: string]: unknown;
+  callbackURL: string;
+  codeVerifier: string;
+  expiresAt: number;
+  errorURL?: string | undefined;
+  newUserURL?: string | undefined;
+  oauthState?: string | undefined;
+  link?: {
+    email: string;
+    userId: string;
+  } | undefined;
+  requestSignUp?: boolean | undefined;
+  idTokenNonce?: string | undefined;
+  serverContext?: Record<string, unknown> | undefined;
+}>;
+//#endregion
+export { GenerateStateOptions, generateIdTokenNonce, generateState, parseState };

package/dist/oauth2/state.mjs

@@ -0,0 +1,67 @@
+import { generateRandomString } from "../crypto/random.mjs";
+import { redirectOnError } from "./errors.mjs";
+import { getOAuthServerContext, setOAuthState } from "../api/state/oauth.mjs";
+import { StateError, generateGenericState, parseGenericState } from "../state.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+//#region src/oauth2/state.ts
+/**
+* Mint the OIDC `nonce` for the redirect flow, or `undefined` when the provider
+* does not require ID-token nonce binding. Every redirect entrypoint (social
+* sign-in, account linking, IDP-initiated bounce, and the OAuth popup) mints
+* through this helper, so the value sent on the authorization URL and the value
+* persisted in state are produced one way and cannot drift apart.
+*/
+function generateIdTokenNonce(provider) {
+	return provider.requiresIdTokenNonce ? generateRandomString(32) : void 0;
+}
+async function generateState(c, options) {
+	const callbackURL = c.body?.callbackURL || c.context.options.baseURL;
+	if (!callbackURL) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.CALLBACK_URL_REQUIRED);
+	const codeVerifier = options?.codeVerifier ?? generateRandomString(128);
+	const pendingServerContext = await getOAuthServerContext();
+	const serverContext = pendingServerContext && Object.keys(pendingServerContext).length ? pendingServerContext : void 0;
+	const stateData = {
+		...options?.additionalData ? options.additionalData : {},
+		callbackURL,
+		codeVerifier,
+		errorURL: c.body?.errorCallbackURL,
+		newUserURL: c.body?.newUserCallbackURL,
+		link: options?.link,
+		serverContext,
+		expiresAt: Date.now() + 600 * 1e3,
+		requestSignUp: c.body?.requestSignUp,
+		idTokenNonce: options?.idTokenNonce
+	};
+	await setOAuthState(stateData);
+	try {
+		return generateGenericState(c, stateData);
+	} catch (error) {
+		c.context.logger.error("Failed to create verification", error);
+		throw new APIError("INTERNAL_SERVER_ERROR", {
+			message: "Unable to create verification",
+			cause: error
+		});
+	}
+}
+async function parseState(c) {
+	const state = c.query.state || c.body?.state;
+	const errorURL = c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`;
+	let parsedData;
+	try {
+		parsedData = await parseGenericState(c, state);
+	} catch (error) {
+		c.context.logger.error("Failed to parse state", error);
+		let code = "internal_server_error";
+		let redirectErrorURL = errorURL;
+		if (error instanceof StateError) {
+			code = error.code === "state_security_mismatch" ? "state_mismatch" : error.code;
+			redirectErrorURL = error.errorURL || errorURL;
+		}
+		redirectOnError(c, redirectErrorURL, code);
+	}
+	if (!parsedData.errorURL) parsedData.errorURL = errorURL;
+	if (parsedData) await setOAuthState(parsedData);
+	return parsedData;
+}
+//#endregion
+export { generateIdTokenNonce, generateState, parseState };

package/dist/oauth2/utils.d.mts

@@ -0,0 +1,11 @@
+import { AuthContext, LiteralString } from "@better-auth/core";
+
+//#region src/oauth2/utils.d.ts
+declare function decryptOAuthToken(token: string, ctx: AuthContext): string | Promise<string>;
+declare function setTokenUtil(token: string | null | undefined, ctx: AuthContext): string | Promise<string> | null | undefined;
+declare function getOAuthCallbackPath(provider: {
+  id: LiteralString;
+  callbackPath?: string | undefined;
+}): string;
+//#endregion
+export { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil };

package/dist/oauth2/utils.mjs

@@ -0,0 +1,33 @@
+import { symmetricDecrypt, symmetricEncrypt } from "../crypto/index.mjs";
+//#region src/oauth2/utils.ts
+/**
+* Check if a string looks like encrypted data
+*/
+function isLikelyEncrypted(token) {
+	if (token.startsWith("$ba$")) return true;
+	return token.length % 2 === 0 && /^[0-9a-f]+$/i.test(token);
+}
+function decryptOAuthToken(token, ctx) {
+	if (!token) return token;
+	if (ctx.options.account?.encryptOAuthTokens) {
+		if (!isLikelyEncrypted(token)) return token;
+		return symmetricDecrypt({
+			key: ctx.secretConfig,
+			data: token
+		});
+	}
+	return token;
+}
+function setTokenUtil(token, ctx) {
+	if (ctx.options.account?.encryptOAuthTokens && token) return symmetricEncrypt({
+		key: ctx.secretConfig,
+		data: token
+	});
+	return token;
+}
+function getOAuthCallbackPath(provider) {
+	if (!provider.callbackPath) return `/callback/${provider.id}`;
+	return provider.callbackPath.startsWith("/") ? provider.callbackPath : `/${provider.callbackPath}`;
+}
+//#endregion
+export { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil };

package/dist/package.mjs

@@ -0,0 +1,4 @@
+//#region package.json
+var version = "1.7.5";
+//#endregion
+export { version };

package/dist/plugins/access/access.d.mts

@@ -0,0 +1,17 @@
+import { ExactRoleStatements, Role, RoleInput, Statements } from "./types.mjs";
+
+//#region src/plugins/access/access.d.ts
+type AuthorizeResponse = {
+  success: false;
+  error: string;
+} | {
+  success: true;
+  error?: never | undefined;
+};
+declare function role<const TRoleStatements extends Statements, TAuthorizeStatements extends Statements = TRoleStatements>(statements: TRoleStatements): Role<ExactRoleStatements<TRoleStatements>, TAuthorizeStatements>;
+declare function createAccessControl<const TStatements extends Statements>(s: TStatements): {
+  newRole<const TRoleStatements extends Statements>(statements: RoleInput<TStatements, TRoleStatements>): Role<ExactRoleStatements<TRoleStatements>, TStatements>;
+  statements: TStatements;
+};
+//#endregion
+export { AuthorizeResponse, createAccessControl, role };