@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/api/index.mjs

@@ -0,0 +1,220 @@
+import { isAPIError } from "../utils/is-api-error.mjs";
+import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
+import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
+import { onRequestRateLimit } from "./rate-limiter/index.mjs";
+import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
+import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
+import { callbackOAuth } from "./routes/callback.mjs";
+import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
+import { error } from "./routes/error.mjs";
+import { ok } from "./routes/ok.mjs";
+import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
+import { signInEmail, signInSocial } from "./routes/sign-in.mjs";
+import { signOut } from "./routes/sign-out.mjs";
+import { signUpEmail } from "./routes/sign-up.mjs";
+import { updateSession } from "./routes/update-session.mjs";
+import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
+import { dispatchAuthEndpoint } from "./dispatch.mjs";
+import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
+import { logger } from "@better-auth/core/env";
+import { APIError } from "@better-auth/core/error";
+import { getIP } from "@better-auth/core/utils/ip";
+import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, createWithSpan } from "@better-auth/core/instrumentation";
+import { normalizePathname } from "@better-auth/core/utils/url";
+import { createRouter } from "better-call";
+import { NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
+//#region src/api/index.ts
+function checkEndpointConflicts(options, logger) {
+	const endpointRegistry = /* @__PURE__ */ new Map();
+	options.plugins?.forEach((plugin) => {
+		if (plugin.endpoints) {
+			for (const [key, endpoint] of Object.entries(plugin.endpoints)) if (endpoint && "path" in endpoint && typeof endpoint.path === "string") {
+				const path = endpoint.path;
+				let methods = [];
+				if (endpoint.options && "method" in endpoint.options) {
+					if (Array.isArray(endpoint.options.method)) methods = endpoint.options.method;
+					else if (typeof endpoint.options.method === "string") methods = [endpoint.options.method];
+				}
+				if (methods.length === 0) methods = ["*"];
+				if (!endpointRegistry.has(path)) endpointRegistry.set(path, []);
+				endpointRegistry.get(path).push({
+					pluginId: plugin.id,
+					endpointKey: key,
+					methods
+				});
+			}
+		}
+	});
+	const conflicts = [];
+	for (const [path, entries] of endpointRegistry.entries()) if (entries.length > 1) {
+		const methodMap = /* @__PURE__ */ new Map();
+		let hasConflict = false;
+		for (const entry of entries) for (const method of entry.methods) {
+			if (!methodMap.has(method)) methodMap.set(method, []);
+			methodMap.get(method).push(entry.pluginId);
+			if (methodMap.get(method).length > 1) hasConflict = true;
+			if (method === "*" && entries.length > 1) hasConflict = true;
+			else if (method !== "*" && methodMap.has("*")) hasConflict = true;
+		}
+		if (hasConflict) {
+			const uniquePlugins = [...new Set(entries.map((e) => e.pluginId))];
+			const conflictingMethods = [];
+			for (const [method, plugins] of methodMap.entries()) if (plugins.length > 1 || method === "*" && entries.length > 1 || method !== "*" && methodMap.has("*")) conflictingMethods.push(method);
+			conflicts.push({
+				path,
+				plugins: uniquePlugins,
+				conflictingMethods
+			});
+		}
+	}
+	if (conflicts.length > 0) {
+		const conflictMessages = conflicts.map((conflict) => `  - "${conflict.path}" [${conflict.conflictingMethods.join(", ")}] used by plugins: ${conflict.plugins.join(", ")}`).join("\n");
+		logger.error(`Endpoint path conflicts detected! Multiple plugins are trying to use the same endpoint paths with conflicting HTTP methods:
+${conflictMessages}
+
+To resolve this, you can:
+	1. Use only one of the conflicting plugins
+	2. Configure the plugins to use different paths (if supported)
+	3. Ensure plugins use different HTTP methods for the same path
+`);
+	}
+}
+function getEndpoints(ctx, options) {
+	const withSpan = createWithSpan(options);
+	const pluginEndpoints = options.plugins?.reduce((acc, plugin) => {
+		return {
+			...acc,
+			...plugin.endpoints
+		};
+	}, {}) ?? {};
+	const middlewares = options.plugins?.map((plugin) => plugin.middlewares?.map((m) => {
+		const middleware = (async (context) => {
+			const authContext = await ctx;
+			return withSpan(`middleware ${m.path} ${plugin.id}`, {
+				[ATTR_HOOK_TYPE]: "middleware",
+				[ATTR_HTTP_ROUTE]: m.path,
+				[ATTR_CONTEXT]: `plugin:${plugin.id}`
+			}, () => m.middleware({
+				...context,
+				context: {
+					...authContext,
+					...context.context
+				}
+			}));
+		});
+		middleware.options = m.middleware.options;
+		return {
+			path: m.path,
+			middleware
+		};
+	})).filter((plugin) => plugin !== void 0).flat() || [];
+	return {
+		api: toAuthEndpoints({
+			signInSocial: signInSocial(),
+			callbackOAuth,
+			getSession: getSession(),
+			signOut,
+			signUpEmail: signUpEmail(),
+			signInEmail: signInEmail(),
+			resetPassword,
+			verifyPassword,
+			verifyEmail,
+			sendVerificationEmail,
+			changeEmail,
+			changePassword,
+			setPassword,
+			updateSession: updateSession(),
+			updateUser: updateUser(),
+			deleteUser,
+			requestPasswordReset,
+			requestPasswordResetCallback,
+			listSessions: listSessions(),
+			revokeSession,
+			revokeSessions,
+			revokeOtherSessions,
+			linkSocialAccount,
+			listUserAccounts,
+			deleteUserCallback,
+			unlinkAccount,
+			refreshToken,
+			getAccessToken,
+			accountInfo,
+			...pluginEndpoints,
+			ok,
+			error
+		}, ctx),
+		middlewares
+	};
+}
+const router = (ctx, options) => {
+	const withSpan = createWithSpan(options);
+	const { api, middlewares } = getEndpoints(ctx, options);
+	const basePath = new URL(ctx.baseURL).pathname;
+	return createRouter(api, {
+		routerContext: ctx,
+		openapi: { disabled: true },
+		basePath,
+		routerMiddleware: [{
+			path: "/**",
+			middleware: originCheckMiddleware
+		}, ...middlewares],
+		allowedMediaTypes: ["application/json"],
+		skipTrailingSlashes: options.advanced?.skipTrailingSlashes ?? false,
+		async onRequest(req) {
+			const disabledPaths = ctx.options.disabledPaths || [];
+			const normalizedPath = normalizePathname(req.url, basePath);
+			if (disabledPaths.includes(normalizedPath)) return new Response("Not Found", { status: 404 });
+			const pendingSchemaCheck = ctx.checkSchema?.();
+			if (pendingSchemaCheck) await pendingSchemaCheck;
+			let currentRequest = req;
+			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
+			if (rateLimitResponse) return rateLimitResponse;
+			for (const plugin of ctx.options.plugins || []) if (plugin.onRequest) {
+				const response = await withSpan(`onRequest ${plugin.id}`, {
+					[ATTR_HOOK_TYPE]: "onRequest",
+					[ATTR_CONTEXT]: `plugin:${plugin.id}`
+				}, () => plugin.onRequest(currentRequest, ctx));
+				if (response && "response" in response) return response.response;
+				if (response && "request" in response) currentRequest = response.request;
+			}
+			return currentRequest;
+		},
+		async onResponse(res, req) {
+			for (const plugin of ctx.options.plugins || []) if (plugin.onResponse) {
+				const response = await withSpan(`onResponse ${plugin.id}`, {
+					[ATTR_HOOK_TYPE]: "onResponse",
+					[ATTR_CONTEXT]: `plugin:${plugin.id}`,
+					[ATTR_HTTP_RESPONSE_STATUS_CODE]: res.status
+				}, () => plugin.onResponse(res, ctx));
+				if (response) return response.response;
+			}
+			return res;
+		},
+		onError(e) {
+			if (isAPIError(e) && e.status === "FOUND") return;
+			if (options.onAPIError?.throw) throw e;
+			if (options.onAPIError?.onError) {
+				options.onAPIError.onError(e, ctx);
+				return;
+			}
+			const optLogLevel = options.logger?.level;
+			const log = optLogLevel === "error" || optLogLevel === "warn" || optLogLevel === "debug" ? logger : void 0;
+			if (options.logger?.disabled !== true) {
+				if (e && typeof e === "object" && "message" in e && typeof e.message === "string") {
+					if (e.message.includes("no column") || e.message.includes("column") || e.message.includes("relation") || e.message.includes("table") || e.message.includes("does not exist")) {
+						ctx.logger?.error(e.message);
+						return;
+					}
+				}
+				if (isAPIError(e)) {
+					if (e.status === "INTERNAL_SERVER_ERROR") ctx.logger.error(e.status, e);
+					log?.error(e.message);
+				} else ctx.logger?.error(e && typeof e === "object" && "name" in e ? e.name : "", e);
+			}
+		}
+	});
+};
+//#endregion
+export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/middlewares/authorization.d.mts

@@ -0,0 +1,69 @@
+import * as _$better_call0 from "better-call";
+
+//#region src/api/middlewares/authorization.d.ts
+/**
+ * Middleware that verifies the authenticated user owns a resource.
+ * Must be used after sessionMiddleware in the `use` array.
+ *
+ * Fetches the resource by ID from the request body or query,
+ * then verifies `resource[ownerField] === session.user.id`.
+ * Throws NOT_FOUND if the resource doesn't exist, FORBIDDEN if
+ * the user doesn't own it.
+ *
+ * The fetched resource is returned on `ctx.context.verifiedResource`
+ * so the handler can use it without a redundant DB query.
+ */
+declare function requireResourceOwnership(config: {
+  /** Database model name (e.g., "passkey", "apiKey") */model: string; /** Request parameter name containing the resource ID */
+  idParam: string; /** Where to find the ID: "body" or "query" */
+  idSource: "body" | "query"; /** Field on the resource that holds the owner's user ID. Default: "userId" */
+  ownerField?: string;
+  /**
+   * Custom error to throw when the resource is not found.
+   * Accepts a `{ code, message }` from `defineErrorCodes`.
+   * Default: generic NOT_FOUND.
+   */
+  notFoundError?: {
+    code: string;
+    message: string;
+  };
+  /**
+   * Custom error to throw when the user doesn't own the resource.
+   * Accepts a `{ code, message }` from `defineErrorCodes`.
+   * Default: generic FORBIDDEN.
+   */
+  forbiddenError?: {
+    code: string;
+    message: string;
+  };
+  /**
+   * HTTP status for ownership failures.
+   * @default "FORBIDDEN" (403)
+   */
+  forbiddenStatus?: "FORBIDDEN" | "UNAUTHORIZED";
+}): _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  verifiedResource: {};
+}>>;
+/**
+ * Middleware that verifies the authenticated user is a member of a
+ * specific organization with one of the allowed roles.
+ * Must be used after sessionMiddleware in the `use` array.
+ *
+ * Looks up the member record by {userId, organizationId}, then checks
+ * the member's role against the allowed list.
+ *
+ * The verified member is returned on `ctx.context.verifiedMember`.
+ */
+declare function requireOrgRole(config: {
+  /** Request parameter name containing the organization ID */orgIdParam: string; /** Where to find the org ID: "body" or "query" */
+  orgIdSource: "body" | "query";
+  /**
+   * Roles that are authorized to proceed. If omitted or empty,
+   * any org membership is sufficient.
+   */
+  allowedRoles?: string[];
+}): _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  verifiedMember: {};
+}>>;
+//#endregion
+export { requireOrgRole, requireResourceOwnership };

package/dist/api/middlewares/authorization.mjs

@@ -0,0 +1,78 @@
+import { APIError } from "@better-auth/core/error";
+import { createAuthMiddleware } from "@better-auth/core/api";
+//#region src/api/middlewares/authorization.ts
+/**
+* Middleware that verifies the authenticated user owns a resource.
+* Must be used after sessionMiddleware in the `use` array.
+*
+* Fetches the resource by ID from the request body or query,
+* then verifies `resource[ownerField] === session.user.id`.
+* Throws NOT_FOUND if the resource doesn't exist, FORBIDDEN if
+* the user doesn't own it.
+*
+* The fetched resource is returned on `ctx.context.verifiedResource`
+* so the handler can use it without a redundant DB query.
+*/
+function requireResourceOwnership(config) {
+	const ownerField = config.ownerField ?? "userId";
+	const forbiddenStatus = config.forbiddenStatus ?? "FORBIDDEN";
+	return createAuthMiddleware(async (ctx) => {
+		const session = ctx.context.session;
+		if (!session?.user?.id) throw new APIError("UNAUTHORIZED");
+		const resourceId = (config.idSource === "body" ? ctx.body : ctx.query)?.[config.idParam];
+		if (!resourceId) throw new APIError("BAD_REQUEST", { message: `Missing required parameter: ${config.idParam}` });
+		const resource = await ctx.context.adapter.findOne({
+			model: config.model,
+			where: [{
+				field: "id",
+				value: resourceId
+			}]
+		});
+		if (!resource) {
+			if (config.notFoundError) throw APIError.from("NOT_FOUND", config.notFoundError);
+			throw new APIError("NOT_FOUND");
+		}
+		if (resource[ownerField] !== session.user.id) {
+			if (config.forbiddenError) throw APIError.from(forbiddenStatus, config.forbiddenError);
+			throw new APIError(forbiddenStatus);
+		}
+		return { verifiedResource: resource };
+	});
+}
+/**
+* Middleware that verifies the authenticated user is a member of a
+* specific organization with one of the allowed roles.
+* Must be used after sessionMiddleware in the `use` array.
+*
+* Looks up the member record by {userId, organizationId}, then checks
+* the member's role against the allowed list.
+*
+* The verified member is returned on `ctx.context.verifiedMember`.
+*/
+function requireOrgRole(config) {
+	const parseMemberRoles = (role) => role.split(",").map((entry) => entry.trim()).filter(Boolean);
+	return createAuthMiddleware(async (ctx) => {
+		const session = ctx.context.session;
+		if (!session?.user?.id) throw new APIError("UNAUTHORIZED");
+		if (!ctx.context.hasPlugin("organization")) throw new APIError("BAD_REQUEST", { message: "Organization plugin is required for org role authorization" });
+		const organizationId = (config.orgIdSource === "body" ? ctx.body : ctx.query)?.[config.orgIdParam];
+		if (!organizationId) throw new APIError("BAD_REQUEST", { message: `Missing required parameter: ${config.orgIdParam}` });
+		const member = await ctx.context.adapter.findOne({
+			model: "member",
+			where: [{
+				field: "userId",
+				value: session.user.id
+			}, {
+				field: "organizationId",
+				value: organizationId
+			}]
+		});
+		if (!member) throw new APIError("FORBIDDEN", { message: "Not a member of this organization" });
+		if (config.allowedRoles?.length) {
+			if (!parseMemberRoles(member.role ?? "").some((role) => config.allowedRoles.includes(role))) throw new APIError("FORBIDDEN", { message: "Insufficient role for this operation" });
+		}
+		return { verifiedMember: member };
+	});
+}
+//#endregion
+export { requireOrgRole, requireResourceOwnership };

package/dist/api/middlewares/index.d.mts

@@ -0,0 +1,2 @@
+import { requireOrgRole, requireResourceOwnership } from "./authorization.mjs";
+import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./origin-check.mjs";

package/dist/api/middlewares/origin-check.d.mts

@@ -0,0 +1,17 @@
+import { GenericEndpointContext } from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+
+//#region src/api/middlewares/origin-check.d.ts
+/**
+ * A middleware to validate callbackURL and origin against trustedOrigins.
+ * Also handles CSRF protection using Fetch Metadata for first-login scenarios.
+ */
+declare const originCheckMiddleware: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+declare const originCheck: (getValue: (ctx: GenericEndpointContext) => string | string[]) => _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+/**
+ * Middleware for CSRF protection using Fetch Metadata headers.
+ * This prevents cross-site navigation login attacks while supporting progressive enhancement.
+ */
+declare const formCsrfMiddleware: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+//#endregion
+export { formCsrfMiddleware, originCheck, originCheckMiddleware };

package/dist/api/middlewares/origin-check.mjs

@@ -0,0 +1,155 @@
+import { getBaseURL, getOrigin } from "../../utils/url.mjs";
+import { matchesOriginPattern } from "../../auth/trusted-origins.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { normalizePathname } from "@better-auth/core/utils/url";
+import { createAuthMiddleware } from "@better-auth/core/api";
+import { deprecate } from "@better-auth/core/utils/deprecate";
+//#region src/api/middlewares/origin-check.ts
+/**
+* Checks if CSRF should be skipped for backward compatibility.
+* Previously, disableOriginCheck also disabled CSRF checks.
+* This maintains that behavior when disableCSRFCheck isn't explicitly set.
+* Only triggers for skipOriginCheck === true, not for path arrays.
+*/
+function shouldSkipCSRFForBackwardCompat(ctx) {
+	return ctx.context.skipOriginCheck === true && ctx.context.options.advanced?.disableCSRFCheck === void 0;
+}
+/**
+* Checks if the origin check should be skipped for the current request.
+* Handles both boolean (skip all) and array (skip specific paths) configurations.
+*/
+function shouldSkipOriginCheck(ctx) {
+	const skipOriginCheck = ctx.context.skipOriginCheck;
+	if (skipOriginCheck === true) return true;
+	if (Array.isArray(skipOriginCheck) && ctx.request) try {
+		const basePath = new URL(ctx.context.baseURL).pathname;
+		const currentPath = normalizePathname(ctx.request.url, basePath);
+		return skipOriginCheck.some((skipPath) => {
+			const normalizedSkipPath = skipPath.replace(/\/+$/, "");
+			return currentPath === normalizedSkipPath || currentPath.startsWith(`${normalizedSkipPath}/`);
+		});
+	} catch {}
+	return false;
+}
+/**
+* Logs deprecation warning for users relying on coupled behavior.
+* Only logs if user explicitly set disableOriginCheck (not test environment default).
+*/
+const logBackwardCompatWarning = deprecate(function logBackwardCompatWarning() {}, "disableOriginCheck: true currently also disables CSRF checks. In a future version, disableOriginCheck will ONLY disable URL validation. To keep CSRF disabled, add disableCSRFCheck: true to your config.");
+/**
+* A middleware to validate callbackURL and origin against trustedOrigins.
+* Also handles CSRF protection using Fetch Metadata for first-login scenarios.
+*/
+const originCheckMiddleware = createAuthMiddleware(async (ctx) => {
+	if (ctx.request?.method === "GET" || ctx.request?.method === "OPTIONS" || ctx.request?.method === "HEAD" || !ctx.request) return;
+	await validateOrigin(ctx);
+	if (shouldSkipOriginCheck(ctx)) return;
+	const { body, query } = ctx;
+	const callbackURL = body?.callbackURL || query?.callbackURL;
+	const redirectURL = body?.redirectTo;
+	const errorCallbackURL = body?.errorCallbackURL;
+	const newUserCallbackURL = body?.newUserCallbackURL;
+	const validateURL = (url, label) => {
+		if (!url) return;
+		if (typeof url !== "string") throw APIError.fromStatus("BAD_REQUEST", { message: `Invalid ${label}: expected a string` });
+		if (!ctx.context.isTrustedOrigin(url, { allowRelativePaths: label !== "origin" })) {
+			ctx.context.logger.error(`Invalid ${label}: ${url}`);
+			ctx.context.logger.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${ctx.context.trustedOrigins}`);
+			if (label === "origin") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ORIGIN);
+			if (label === "callbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_CALLBACK_URL);
+			if (label === "redirectURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_REDIRECT_URL);
+			if (label === "errorCallbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ERROR_CALLBACK_URL);
+			if (label === "newUserCallbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_NEW_USER_CALLBACK_URL);
+			throw APIError.fromStatus("FORBIDDEN", { message: `Invalid ${label}` });
+		}
+	};
+	callbackURL && validateURL(callbackURL, "callbackURL");
+	redirectURL && validateURL(redirectURL, "redirectURL");
+	errorCallbackURL && validateURL(errorCallbackURL, "errorCallbackURL");
+	newUserCallbackURL && validateURL(newUserCallbackURL, "newUserCallbackURL");
+});
+const originCheck = (getValue) => createAuthMiddleware(async (ctx) => {
+	if (!ctx.request) return;
+	if (shouldSkipOriginCheck(ctx)) return;
+	const callbackURL = getValue(ctx);
+	const validateURL = (url, label) => {
+		if (!url) return;
+		if (!ctx.context.isTrustedOrigin(url, { allowRelativePaths: label !== "origin" })) {
+			ctx.context.logger.error(`Invalid ${label}: ${url}`);
+			ctx.context.logger.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${ctx.context.trustedOrigins}`);
+			if (label === "origin") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ORIGIN);
+			if (label === "callbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_CALLBACK_URL);
+			if (label === "redirectURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_REDIRECT_URL);
+			if (label === "errorCallbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ERROR_CALLBACK_URL);
+			if (label === "newUserCallbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_NEW_USER_CALLBACK_URL);
+			throw APIError.fromStatus("FORBIDDEN", { message: `Invalid ${label}` });
+		}
+	};
+	const callbacks = Array.isArray(callbackURL) ? callbackURL : [callbackURL];
+	for (const url of callbacks) validateURL(url, "callbackURL");
+});
+/**
+* Validates origin header against trusted origins.
+* @param ctx - The endpoint context
+* @param forceValidate - If true, always validate origin regardless of cookies/skip flags
+*/
+async function validateOrigin(ctx, forceValidate = false) {
+	const headers = ctx.request?.headers;
+	if (!headers || !ctx.request) return;
+	const origin = headers.get("origin");
+	const originHeader = origin || headers.get("referer") || "";
+	const useCookies = headers.has("cookie");
+	if (ctx.context.skipCSRFCheck) return;
+	if (shouldSkipCSRFForBackwardCompat(ctx)) {
+		ctx.context.options.advanced?.disableOriginCheck === true && logBackwardCompatWarning();
+		return;
+	}
+	if (shouldSkipOriginCheck(ctx)) return;
+	if (!(forceValidate || useCookies)) return;
+	const inferredBaseURL = origin === "null" && headers.get("sec-fetch-site") === "same-origin" ? getBaseURL(void 0, ctx.context.options.basePath, ctx.request, false, ctx.context.options.advanced?.trustedProxyHeaders) : void 0;
+	const originToValidate = (inferredBaseURL ? getOrigin(inferredBaseURL) : void 0) ?? originHeader;
+	if (!originToValidate || originToValidate === "null") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN);
+	const trustedOrigins = Array.isArray(ctx.context.options.trustedOrigins) ? ctx.context.trustedOrigins : [...ctx.context.trustedOrigins, ...(await ctx.context.options.trustedOrigins?.(ctx.request))?.filter((v) => Boolean(v)) || []];
+	if (!trustedOrigins.some((origin) => matchesOriginPattern(originToValidate, origin))) {
+		ctx.context.logger.error(`Invalid origin: ${originToValidate}`);
+		ctx.context.logger.info(`If it's a valid URL, please add ${originToValidate} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${trustedOrigins}`);
+		throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ORIGIN);
+	}
+}
+/**
+* Middleware for CSRF protection using Fetch Metadata headers.
+* This prevents cross-site navigation login attacks while supporting progressive enhancement.
+*/
+const formCsrfMiddleware = createAuthMiddleware(async (ctx) => {
+	if (!ctx.request) return;
+	await validateFormCsrf(ctx);
+});
+/**
+* Validates CSRF protection for first-login scenarios using Fetch Metadata headers.
+* This prevents cross-site form submission attacks while supporting progressive enhancement.
+*/
+async function validateFormCsrf(ctx) {
+	const req = ctx.request;
+	if (!req) return;
+	if (ctx.context.skipCSRFCheck) return;
+	if (shouldSkipCSRFForBackwardCompat(ctx)) return;
+	const headers = req.headers;
+	if (headers.has("cookie")) return await validateOrigin(ctx);
+	const site = headers.get("Sec-Fetch-Site");
+	const mode = headers.get("Sec-Fetch-Mode");
+	const dest = headers.get("Sec-Fetch-Dest");
+	if (Boolean(site && site.trim() || mode && mode.trim() || dest && dest.trim())) {
+		if (site === "cross-site" && mode === "navigate") {
+			ctx.context.logger.error("Blocked cross-site navigation login attempt (CSRF protection)", {
+				secFetchSite: site,
+				secFetchMode: mode,
+				secFetchDest: dest
+			});
+			throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.CROSS_SITE_NAVIGATION_LOGIN_BLOCKED);
+		}
+		return await validateOrigin(ctx, true);
+	}
+	if (headers.get("origin") || headers.get("referer")) return await validateOrigin(ctx, true);
+}
+//#endregion
+export { formCsrfMiddleware, originCheck, originCheckMiddleware };