@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/anonymous/types.d.mts

@@ -0,0 +1,65 @@
+import { Session, User } from "../../types/models.mjs";
+import { InferOptionSchema } from "../../types/plugins.mjs";
+import { schema } from "./schema.mjs";
+import { AuthContext, Awaitable, GenericEndpointContext } from "@better-auth/core";
+import { EndpointContext } from "better-call";
+
+//#region src/plugins/anonymous/types.d.ts
+type AnonymousSession = {
+  session: Session;
+  user: User;
+} & {
+  user: {
+    isAnonymous: boolean | null;
+  };
+} & Record<string, any>;
+interface UserWithAnonymous extends User {
+  isAnonymous: boolean;
+}
+interface AnonymousOptions {
+  /**
+   * Configure a custom domain for anonymous user email addresses.
+   * @default "anonymous.placeholder.invalid"
+   */
+  emailDomainName?: string | undefined;
+  /**
+   * A useful hook to run after an anonymous user
+   * is about to link their account.
+   */
+  onLinkAccount?: ((data: {
+    anonymousUser: {
+      user: UserWithAnonymous & Record<string, any>;
+      session: Session & Record<string, any>;
+    };
+    newUser: {
+      user: User & Record<string, any>;
+      session: Session & Record<string, any>;
+    };
+    ctx: GenericEndpointContext;
+  }) => Awaitable<void>) | undefined;
+  /**
+   * Disable deleting the anonymous user
+   */
+  disableDeleteAnonymousUser?: boolean | undefined;
+  /**
+   * A hook to generate a name for the anonymous user.
+   * Useful if you want to have random names for anonymous users, or if `name` is unique in your database.
+   * @returns The name for the anonymous user.
+   */
+  generateName?: ((ctx: EndpointContext<"/sign-in/anonymous", {
+    method: "POST";
+  }, AuthContext>) => Awaitable<string>) | undefined;
+  /**
+   * A custom random email generation function.
+   * Useful when you want to specify a temporary email in a different format from the default.
+   * You are responsible for ensuring the email is unique to avoid conflicts.
+   * @returns The email address for the anonymous user.
+   */
+  generateRandomEmail?: (() => Awaitable<string>) | undefined;
+  /**
+   * Custom schema for the anonymous plugin
+   */
+  schema?: InferOptionSchema<typeof schema> | undefined;
+}
+//#endregion
+export { AnonymousOptions, AnonymousSession, UserWithAnonymous };

package/dist/plugins/bearer/index.d.mts

@@ -0,0 +1,45 @@
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+
+//#region src/plugins/bearer/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    bearer: {
+      creator: typeof bearer;
+    };
+  }
+}
+interface BearerOptions {
+  /**
+   * If true, only signed tokens
+   * will be converted to session
+   * cookies
+   *
+   * @default false
+   */
+  requireSignature?: boolean | undefined;
+}
+/**
+ * Converts bearer token to session cookie
+ */
+declare const bearer: (options?: BearerOptions | undefined) => {
+  id: "bearer";
+  version: string;
+  hooks: {
+    before: {
+      matcher(context: _$_better_auth_core0.HookEndpointContext): boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+        context: {
+          headers: Headers;
+        };
+      } | undefined>>;
+    }[];
+    after: {
+      matcher(context: _$_better_auth_core0.HookEndpointContext): true;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
+  options: BearerOptions | undefined;
+};
+//#endregion
+export { BearerOptions, bearer };

package/dist/plugins/bearer/index.mjs

@@ -0,0 +1,74 @@
+import { parseSetCookieHeader, setRequestCookie } from "../../cookies/cookie-utils.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { serializeSignedCookie } from "better-call";
+import { createAuthMiddleware } from "@better-auth/core/api";
+import { createHMAC } from "@better-auth/utils/hmac";
+//#region src/plugins/bearer/index.ts
+const BEARER_SCHEME = "bearer ";
+function tryDecode(str) {
+	try {
+		return decodeURIComponent(str);
+	} catch {
+		return str;
+	}
+}
+/**
+* Converts bearer token to session cookie
+*/
+const bearer = (options) => {
+	return {
+		id: "bearer",
+		version: PACKAGE_VERSION,
+		hooks: {
+			before: [{
+				matcher(context) {
+					return Boolean(context.request?.headers.get("authorization") || context.headers?.get("authorization"));
+				},
+				handler: createAuthMiddleware(async (c) => {
+					const authHeader = c.request?.headers.get("authorization") || c.headers?.get("Authorization");
+					if (!authHeader) return;
+					if (authHeader.slice(0, 7).toLowerCase() !== BEARER_SCHEME) return;
+					const token = authHeader.slice(7).trim();
+					if (!token) return;
+					let decodedToken;
+					if (token.includes(".")) decodedToken = token.includes("%") ? tryDecode(token) : token;
+					else {
+						if (options?.requireSignature) return;
+						decodedToken = tryDecode((await serializeSignedCookie("", token, c.context.secret)).replace("=", ""));
+					}
+					try {
+						if (!await createHMAC("SHA-256", "base64urlnopad").verify(c.context.secret, decodedToken.split(".")[0], decodedToken.split(".")[1])) return;
+					} catch {
+						return;
+					}
+					const existingHeaders = c.request?.headers || c.headers;
+					const headers = new Headers({ ...Object.fromEntries(existingHeaders?.entries()) });
+					setRequestCookie(headers, c.context.authCookies.sessionToken.name, decodedToken);
+					return { context: { headers } };
+				})
+			}],
+			after: [{
+				matcher(context) {
+					return true;
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const setCookie = ctx.context.responseHeaders?.get("set-cookie");
+					if (!setCookie) return;
+					const parsedCookies = parseSetCookieHeader(setCookie);
+					const cookieName = ctx.context.authCookies.sessionToken.name;
+					const sessionCookie = parsedCookies.get(cookieName);
+					if (!sessionCookie || !sessionCookie.value || sessionCookie["max-age"] === 0) return;
+					const token = sessionCookie.value;
+					const exposedHeaders = ctx.context.responseHeaders?.get("access-control-expose-headers") || "";
+					const headersSet = new Set(exposedHeaders.split(",").map((header) => header.trim()).filter(Boolean));
+					headersSet.add("set-auth-token");
+					ctx.setHeader("set-auth-token", token);
+					ctx.setHeader("Access-Control-Expose-Headers", Array.from(headersSet).join(", "));
+				})
+			}]
+		},
+		options
+	};
+};
+//#endregion
+export { bearer };

package/dist/plugins/captcha/constants.d.mts

@@ -0,0 +1,9 @@
+//#region src/plugins/captcha/constants.d.ts
+declare const Providers: {
+  readonly CLOUDFLARE_TURNSTILE: "cloudflare-turnstile";
+  readonly GOOGLE_RECAPTCHA: "google-recaptcha";
+  readonly HCAPTCHA: "hcaptcha";
+  readonly CAPTCHAFOX: "captchafox";
+};
+//#endregion
+export { Providers };

package/dist/plugins/captcha/constants.mjs

@@ -0,0 +1,27 @@
+//#region src/plugins/captcha/constants.ts
+/**
+* Upper bound (in milliseconds) for a single provider verification request.
+* Without it, a hanging provider would tie up the request indefinitely before
+* any rate limiting applies, so every verify handler aborts at this deadline
+* and fails closed.
+*/
+const CAPTCHA_VERIFY_TIMEOUT_MS = 1e4;
+const defaultEndpoints = [
+	"/sign-up/email",
+	"/sign-in/email",
+	"/request-password-reset"
+];
+const Providers = {
+	CLOUDFLARE_TURNSTILE: "cloudflare-turnstile",
+	GOOGLE_RECAPTCHA: "google-recaptcha",
+	HCAPTCHA: "hcaptcha",
+	CAPTCHAFOX: "captchafox"
+};
+const siteVerifyMap = {
+	[Providers.CLOUDFLARE_TURNSTILE]: "https://challenges.cloudflare.com/turnstile/v0/siteverify",
+	[Providers.GOOGLE_RECAPTCHA]: "https://www.google.com/recaptcha/api/siteverify",
+	[Providers.HCAPTCHA]: "https://api.hcaptcha.com/siteverify",
+	[Providers.CAPTCHAFOX]: "https://api.captchafox.com/siteverify"
+};
+//#endregion
+export { CAPTCHA_VERIFY_TIMEOUT_MS, Providers, defaultEndpoints, siteVerifyMap };

package/dist/plugins/captcha/error-codes.mjs

@@ -0,0 +1,13 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+//#region src/plugins/captcha/error-codes.ts
+const EXTERNAL_ERROR_CODES = defineErrorCodes({
+	VERIFICATION_FAILED: "Captcha verification failed",
+	MISSING_RESPONSE: "Missing CAPTCHA response",
+	UNKNOWN_ERROR: "Something went wrong"
+});
+const INTERNAL_ERROR_CODES = defineErrorCodes({
+	MISSING_SECRET_KEY: "Missing secret key",
+	SERVICE_UNAVAILABLE: "CAPTCHA service unavailable"
+});
+//#endregion
+export { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES };

package/dist/plugins/captcha/index.d.mts

@@ -0,0 +1,27 @@
+import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./types.mjs";
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/captcha/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    captcha: {
+      creator: typeof captcha;
+    };
+  }
+}
+declare const captcha: (options: CaptchaOptions) => {
+  id: "captcha";
+  version: string;
+  $ERROR_CODES: {
+    VERIFICATION_FAILED: _$_better_auth_core_utils_error_codes0.RawError<"VERIFICATION_FAILED">;
+    MISSING_RESPONSE: _$_better_auth_core_utils_error_codes0.RawError<"MISSING_RESPONSE">;
+    UNKNOWN_ERROR: _$_better_auth_core_utils_error_codes0.RawError<"UNKNOWN_ERROR">;
+  };
+  onRequest: (request: Request, ctx: _$_better_auth_core0.AuthContext) => Promise<{
+    response: Response;
+  } | undefined>;
+  options: CaptchaOptions;
+};
+//#endregion
+export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, captcha };

package/dist/plugins/captcha/index.mjs

@@ -0,0 +1,79 @@
+import { wildcardMatch } from "../../utils/wildcard.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { middlewareResponse } from "../../utils/middleware-response.mjs";
+import { Providers, defaultEndpoints, siteVerifyMap } from "./constants.mjs";
+import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "./error-codes.mjs";
+import { captchaFox } from "./verify-handlers/captchafox.mjs";
+import { cloudflareTurnstile } from "./verify-handlers/cloudflare-turnstile.mjs";
+import { googleRecaptcha } from "./verify-handlers/google-recaptcha.mjs";
+import { hCaptcha } from "./verify-handlers/h-captcha.mjs";
+import { getIP } from "@better-auth/core/utils/ip";
+//#region src/plugins/captcha/index.ts
+const normalizeEndpointPath = (pathname, basePath) => {
+	let normalizedPathname = (pathname.startsWith(basePath) ? pathname.slice(basePath.length) : pathname).replace(/\/{2,}/g, "/");
+	if (!normalizedPathname.startsWith("/")) normalizedPathname = `/${normalizedPathname}`;
+	if (normalizedPathname.length > 1 && normalizedPathname.endsWith("/")) normalizedPathname = normalizedPathname.slice(0, -1);
+	return normalizedPathname;
+};
+const captcha = (options) => ({
+	id: "captcha",
+	version: PACKAGE_VERSION,
+	$ERROR_CODES: EXTERNAL_ERROR_CODES,
+	onRequest: async (request, ctx) => {
+		try {
+			const endpoints = options.endpoints?.length ? options.endpoints : defaultEndpoints;
+			const url = new URL(request.url);
+			const basePath = ctx.options.basePath ?? "/api/auth";
+			const pathname = normalizeEndpointPath(url.pathname, basePath);
+			if (!endpoints.some((endpoint) => endpoint.includes("*") ? wildcardMatch(endpoint)(pathname) : endpoint === pathname)) return;
+			if (!options.secretKey) throw new Error(INTERNAL_ERROR_CODES.MISSING_SECRET_KEY.message);
+			const captchaResponse = request.headers.get("x-captcha-response");
+			const remoteUserIP = getIP(request, ctx.options) ?? void 0;
+			if (!captchaResponse) return middlewareResponse({
+				message: EXTERNAL_ERROR_CODES.MISSING_RESPONSE.message,
+				code: EXTERNAL_ERROR_CODES.MISSING_RESPONSE.code,
+				status: 400
+			});
+			const handlerParams = {
+				siteVerifyURL: options.siteVerifyURLOverride || siteVerifyMap[options.provider],
+				captchaResponse,
+				secretKey: options.secretKey,
+				remoteIP: remoteUserIP
+			};
+			if (options.provider === Providers.CLOUDFLARE_TURNSTILE) return await cloudflareTurnstile({
+				...handlerParams,
+				logger: ctx.logger,
+				expectedAction: options.expectedAction,
+				allowedHostnames: options.allowedHostnames
+			});
+			if (options.provider === Providers.GOOGLE_RECAPTCHA) return await googleRecaptcha({
+				...handlerParams,
+				minScore: options.minScore,
+				expectedAction: options.expectedAction,
+				allowedHostnames: options.allowedHostnames
+			});
+			if (options.provider === Providers.HCAPTCHA) return await hCaptcha({
+				...handlerParams,
+				siteKey: options.siteKey
+			});
+			if (options.provider === Providers.CAPTCHAFOX) return await captchaFox({
+				...handlerParams,
+				siteKey: options.siteKey
+			});
+		} catch (_error) {
+			const errorMessage = _error instanceof Error ? _error.message : void 0;
+			ctx.logger.error(errorMessage ?? "Unknown error", {
+				endpoint: request.url,
+				message: _error
+			});
+			return middlewareResponse({
+				message: EXTERNAL_ERROR_CODES.UNKNOWN_ERROR.message,
+				code: EXTERNAL_ERROR_CODES.UNKNOWN_ERROR.code,
+				status: 500
+			});
+		}
+	},
+	options
+});
+//#endregion
+export { captcha };

package/dist/plugins/captcha/types.d.mts

@@ -0,0 +1,52 @@
+import { Providers } from "./constants.mjs";
+
+//#region src/plugins/captcha/types.d.ts
+type Provider = (typeof Providers)[keyof typeof Providers];
+interface BaseCaptchaOptions {
+  secretKey: string;
+  /**
+   * Paths where captcha verification is enforced. Paths match exactly unless
+   * they include wildcards, such as `/sign-in/*` or `/sign-in/**`.
+   */
+  endpoints?: string[] | undefined;
+  siteVerifyURLOverride?: string | undefined;
+}
+interface GoogleRecaptchaOptions extends BaseCaptchaOptions {
+  provider: typeof Providers.GOOGLE_RECAPTCHA;
+  minScore?: number | undefined;
+  /**
+   * Expected reCAPTCHA v3 `action`. When set, a verification whose action does
+   * not match is rejected, preventing a token minted for another action on the
+   * same site key from being replayed against this endpoint.
+   */
+  expectedAction?: string | undefined;
+  /**
+   * Allow-list of hostnames the token must have been issued for. When set, a
+   * verification reporting a different hostname is rejected.
+   */
+  allowedHostnames?: string[] | undefined;
+}
+interface CloudflareTurnstileOptions extends BaseCaptchaOptions {
+  provider: typeof Providers.CLOUDFLARE_TURNSTILE;
+  /**
+   * Expected Turnstile `action`. When set, a verification whose action does
+   * not match is rejected, preventing cross-context token reuse.
+   */
+  expectedAction?: string | undefined;
+  /**
+   * Allow-list of hostnames the token must have been issued for. When set, a
+   * verification reporting a different or missing hostname is rejected.
+   */
+  allowedHostnames?: string[] | undefined;
+}
+interface HCaptchaOptions extends BaseCaptchaOptions {
+  provider: typeof Providers.HCAPTCHA;
+  siteKey?: string | undefined;
+}
+interface CaptchaFoxOptions extends BaseCaptchaOptions {
+  provider: typeof Providers.CAPTCHAFOX;
+  siteKey?: string | undefined;
+}
+type CaptchaOptions = GoogleRecaptchaOptions | CloudflareTurnstileOptions | HCaptchaOptions | CaptchaFoxOptions;
+//#endregion
+export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider };

package/dist/plugins/captcha/utils.mjs

@@ -0,0 +1,9 @@
+//#region src/plugins/captcha/utils.ts
+const encodeToURLParams = (obj) => {
+	if (typeof obj !== "object" || obj === null || Array.isArray(obj)) throw new Error("Input must be a non-null object.");
+	const params = new URLSearchParams();
+	for (const [key, value] of Object.entries(obj)) if (value !== void 0 && value !== null) params.append(key, String(value));
+	return params.toString();
+};
+//#endregion
+export { encodeToURLParams };

package/dist/plugins/captcha/verify-handlers/captchafox.mjs

@@ -0,0 +1,27 @@
+import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
+import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
+import { encodeToURLParams } from "../utils.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/captcha/verify-handlers/captchafox.ts
+const captchaFox = async ({ siteVerifyURL, captchaResponse, secretKey, siteKey, remoteIP }) => {
+	const response = await betterFetch(siteVerifyURL, {
+		method: "POST",
+		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: encodeToURLParams({
+			secret: secretKey,
+			response: captchaResponse,
+			...siteKey && { sitekey: siteKey },
+			...remoteIP && { remoteIp: remoteIP }
+		})
+	});
+	if (!response.data || response.error) throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message);
+	if (!response.data.success) return middlewareResponse({
+		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+		status: 403
+	});
+};
+//#endregion
+export { captchaFox };

package/dist/plugins/captcha/verify-handlers/cloudflare-turnstile.mjs

@@ -0,0 +1,47 @@
+import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
+import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/captcha/verify-handlers/cloudflare-turnstile.ts
+const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey, logger, remoteIP, expectedAction, allowedHostnames }) => {
+	const response = await betterFetch(siteVerifyURL, {
+		method: "POST",
+		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			secret: secretKey,
+			response: captchaResponse,
+			...remoteIP && { remoteip: remoteIP }
+		})
+	});
+	if (!response.data || response.error) throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message);
+	const verificationFailed = (details) => {
+		logger.warn("Cloudflare Turnstile verification failed", {
+			provider: "cloudflare-turnstile",
+			...details
+		});
+		return middlewareResponse({
+			message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+			code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+			status: 403
+		});
+	};
+	if (!response.data.success) return verificationFailed({
+		reason: "siteverify_rejected",
+		errorCodes: response.data["error-codes"] ?? [],
+		...response.data.hostname && { hostname: response.data.hostname },
+		...response.data.action && { action: response.data.action }
+	});
+	if (expectedAction && response.data.action !== expectedAction) return verificationFailed({
+		reason: "action_mismatch",
+		expectedAction,
+		actualAction: response.data.action
+	});
+	if (allowedHostnames && allowedHostnames.length > 0 && !(response.data.hostname && allowedHostnames.includes(response.data.hostname))) return verificationFailed({
+		reason: "hostname_mismatch",
+		allowedHostnames,
+		actualHostname: response.data.hostname
+	});
+};
+//#endregion
+export { cloudflareTurnstile };

package/dist/plugins/captcha/verify-handlers/google-recaptcha.mjs

@@ -0,0 +1,32 @@
+import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
+import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
+import { encodeToURLParams } from "../utils.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/captcha/verify-handlers/google-recaptcha.ts
+const isV3 = (response) => {
+	return "score" in response && typeof response.score === "number";
+};
+const googleRecaptcha = async ({ siteVerifyURL, captchaResponse, secretKey, minScore = .5, remoteIP, expectedAction, allowedHostnames }) => {
+	const response = await betterFetch(siteVerifyURL, {
+		method: "POST",
+		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: encodeToURLParams({
+			secret: secretKey,
+			response: captchaResponse,
+			...remoteIP && { remoteip: remoteIP }
+		})
+	});
+	if (!response.data || response.error) throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message);
+	const verificationFailed = () => middlewareResponse({
+		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+		status: 403
+	});
+	if (!response.data.success || isV3(response.data) && response.data.score < minScore) return verificationFailed();
+	if (expectedAction && response.data.action !== expectedAction) return verificationFailed();
+	if (allowedHostnames && allowedHostnames.length > 0 && !allowedHostnames.includes(response.data.hostname)) return verificationFailed();
+};
+//#endregion
+export { googleRecaptcha };

package/dist/plugins/captcha/verify-handlers/h-captcha.mjs

@@ -0,0 +1,27 @@
+import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
+import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
+import { encodeToURLParams } from "../utils.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/captcha/verify-handlers/h-captcha.ts
+const hCaptcha = async ({ siteVerifyURL, captchaResponse, secretKey, siteKey, remoteIP }) => {
+	const response = await betterFetch(siteVerifyURL, {
+		method: "POST",
+		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: encodeToURLParams({
+			secret: secretKey,
+			response: captchaResponse,
+			...siteKey && { sitekey: siteKey },
+			...remoteIP && { remoteip: remoteIP }
+		})
+	});
+	if (!response.data || response.error) throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message);
+	if (!response.data.success) return middlewareResponse({
+		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+		status: 403
+	});
+};
+//#endregion
+export { hCaptcha };

package/dist/plugins/custom-session/client.d.mts

@@ -0,0 +1,17 @@
+import { BetterAuthOptions } from "../../types/index.mjs";
+import { Auth } from "better-auth";
+
+//#region src/plugins/custom-session/client.d.ts
+declare const customSessionClient: <A extends Auth | {
+  options: BetterAuthOptions;
+}>() => {
+  id: "infer-server-plugin";
+  version: string;
+  $InferServerPlugin: (A extends {
+    options: infer O;
+  } ? O : A)["plugins"] extends (infer P)[] ? P extends {
+    id: "custom-session";
+  } ? P : never : never;
+};
+//#endregion
+export { customSessionClient };

package/dist/plugins/custom-session/client.mjs

@@ -0,0 +1,7 @@
+import { InferServerPlugin } from "../../client/plugins/infer-plugin.mjs";
+//#region src/plugins/custom-session/client.ts
+const customSessionClient = () => {
+	return InferServerPlugin();
+};
+//#endregion
+export { customSessionClient };

package/dist/plugins/custom-session/index.d.mts

@@ -0,0 +1,73 @@
+import * as _$_better_auth_core0 from "@better-auth/core";
+import { BetterAuthOptions, GenericEndpointContext } from "@better-auth/core";
+import { Session, User } from "@better-auth/core/db";
+import * as _$better_call0 from "better-call";
+import * as _$zod from "zod";
+import * as _$zod_v4_core0 from "zod/v4/core";
+
+//#region src/plugins/custom-session/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "custom-session": {
+      creator: typeof customSession;
+    };
+  }
+}
+type CustomSessionPluginOptions = {
+  /**
+   * This option is used to determine if the list-device-sessions endpoint should be mutated to the custom session data.
+   * @default false
+   */
+  shouldMutateListDeviceSessionsEndpoint?: boolean | undefined;
+};
+declare const customSession: <Returns extends Record<string, any>, O extends BetterAuthOptions = BetterAuthOptions>(fn: (session: {
+  user: User<O["user"], O["plugins"]>;
+  session: Session<O["session"], O["plugins"]>;
+}, ctx: GenericEndpointContext) => Promise<Returns>, options?: O | undefined, pluginOptions?: CustomSessionPluginOptions | undefined) => {
+  id: "custom-session";
+  version: string;
+  hooks: {
+    after: {
+      matcher: (ctx: _$_better_auth_core0.HookEndpointContext) => boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<Awaited<Returns>[] | undefined>>;
+    }[];
+  };
+  endpoints: {
+    getSession: _$better_call0.StrictEndpoint<"/get-session", {
+      method: "GET";
+      query: _$zod.ZodOptional<_$zod.ZodObject<{
+        disableCookieCache: _$zod.ZodOptional<_$zod.ZodCoercedBoolean<unknown>>;
+        disableRefresh: _$zod.ZodOptional<_$zod.ZodCoercedBoolean<unknown>>;
+      }, _$zod_v4_core0.$strip>>;
+      metadata: {
+        CUSTOM_SESSION: boolean;
+        openapi: {
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "array";
+                    nullable: boolean;
+                    items: {
+                      $ref: string;
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+      requireHeaders: true;
+    }, Returns | null>;
+  };
+  $Infer: {
+    Session: Awaited<ReturnType<typeof fn>>;
+  };
+  options: CustomSessionPluginOptions | undefined;
+};
+//#endregion
+export { CustomSessionPluginOptions, customSession };