@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/email-otp/types.d.mts

@@ -0,0 +1,109 @@
+import { GenericEndpointContext } from "@better-auth/core";
+
+//#region src/plugins/email-otp/types.d.ts
+interface EmailOTPOptions {
+  /**
+   * Function to send email verification.
+   *
+   * It is recommended to not await the email sending to avoid timing attacks.
+   * On serverless platforms, use `waitUntil` or similar to ensure the email is sent.
+   */
+  sendVerificationOTP: (data: {
+    email: string;
+    otp: string;
+    type: "sign-in" | "email-verification" | "forget-password" | "change-email";
+  }, ctx?: GenericEndpointContext | undefined) => Promise<void>;
+  /**
+   * Length of the OTP
+   *
+   * @default 6
+   */
+  otpLength?: number | undefined;
+  /**
+   * Expiry time of the OTP in seconds
+   *
+   * @default 300 (5 minutes)
+   */
+  expiresIn?: number | undefined;
+  /**
+   * Custom function to generate otp
+   */
+  generateOTP?: (data: {
+    email: string;
+    type: "sign-in" | "email-verification" | "forget-password" | "change-email";
+  }, ctx?: GenericEndpointContext) => string | undefined;
+  /**
+   * Send email verification on sign-up
+   *
+   * @Default false
+   */
+  sendVerificationOnSignUp?: boolean | undefined;
+  /**
+   * A boolean value that determines whether to prevent
+   * automatic sign-up when the user is not registered.
+   *
+   * @Default false
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * Allowed attempts for the OTP code
+   * @default 3
+   */
+  allowedAttempts?: number | undefined;
+  /**
+   * Store the OTP in your database in a secure way
+   * Note: This will not affect the OTP sent to the user, it will only affect the OTP stored in your database
+   *
+   * @default "plain"
+   */
+  storeOTP?: ("hashed" | "plain" | "encrypted" | {
+    hash: (otp: string) => Promise<string>;
+  } | {
+    encrypt: (otp: string) => Promise<string>;
+    decrypt: (otp: string) => Promise<string>;
+  }) | undefined;
+  /**
+   * Strategy for handling OTP when the user requests a new OTP
+   * while an existing one is still valid.
+   *
+   * - `"rotate"`: Always generates a new OTP (default behavior).
+   * - `"reuse"`: Resends the same OTP and extends its expiry.
+   *   Only works when the OTP is recoverable (plain, encrypted, or custom encrypt/decrypt).
+   *   Falls back to `"rotate"` when OTP is hashed.
+   *
+   * @default "rotate"
+   */
+  resendStrategy?: "rotate" | "reuse" | undefined;
+  /**
+   * Change email configuration for the change email with OTP flow
+   *
+   * @default {
+   *  enabled: false,
+   *  verifyCurrentEmail: false,
+   * }
+   */
+  changeEmail?: {
+    enabled?: boolean;
+    verifyCurrentEmail?: boolean;
+  };
+  /**
+   * Override the default email verification to use email otp instead
+   *
+   * @default false
+   */
+  overrideDefaultEmailVerification?: boolean | undefined;
+  /**
+   * Rate limit configuration
+   *
+   * @default {
+   * 	window: 60,
+   * 	max: 3,
+   * }
+   */
+  rateLimit?: {
+    window: number;
+    max: number;
+  };
+}
+//#endregion
+export { EmailOTPOptions };

package/dist/plugins/email-otp/utils.mjs

@@ -0,0 +1,17 @@
+import { base64Url } from "@better-auth/utils/base64";
+import { createHash } from "@better-auth/utils/hash";
+//#region src/plugins/email-otp/utils.ts
+function toOTPIdentifier(type, email) {
+	return `${type}-otp-${email}`;
+}
+const defaultKeyHasher = async (otp) => {
+	const hash = await createHash("SHA-256").digest(new TextEncoder().encode(otp));
+	return base64Url.encode(new Uint8Array(hash), { padding: false });
+};
+function splitAtLastColon(input) {
+	const idx = input.lastIndexOf(":");
+	if (idx === -1) return [input, ""];
+	return [input.slice(0, idx), input.slice(idx + 1)];
+}
+//#endregion
+export { defaultKeyHasher, splitAtLastColon, toOTPIdentifier };

package/dist/plugins/generic-oauth/error-codes.mjs

@@ -0,0 +1,8 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+//#region src/plugins/generic-oauth/error-codes.ts
+const GENERIC_OAUTH_ERROR_CODES = defineErrorCodes({
+	INVALID_OAUTH_CONFIGURATION: "Invalid OAuth configuration",
+	TOKEN_URL_NOT_FOUND: "Invalid OAuth configuration. Token URL not found."
+});
+//#endregion
+export { GENERIC_OAUTH_ERROR_CODES };

package/dist/plugins/generic-oauth/index.d.mts

@@ -0,0 +1,52 @@
+import { GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo } from "./types.mjs";
+import { Auth0Options, auth0 } from "./providers/auth0.mjs";
+import { GumroadOptions, gumroad } from "./providers/gumroad.mjs";
+import { HubSpotOptions, hubspot } from "./providers/hubspot.mjs";
+import { KeycloakOptions, keycloak } from "./providers/keycloak.mjs";
+import { LineOptions, line } from "./providers/line.mjs";
+import { MicrosoftEntraIdOptions, microsoftEntraId } from "./providers/microsoft-entra-id.mjs";
+import { OktaOptions, okta } from "./providers/okta.mjs";
+import { PatreonOptions, patreon } from "./providers/patreon.mjs";
+import { SlackOptions, slack } from "./providers/slack.mjs";
+import { YandexOptions, yandex } from "./providers/yandex.mjs";
+import { AuthContext } from "@better-auth/core";
+import * as _$_better_auth_core_oauth20 from "@better-auth/core/oauth2";
+import { OAuthProvider } from "@better-auth/core/oauth2";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/generic-oauth/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "generic-oauth": {
+      creator: typeof genericOAuth;
+    };
+  }
+}
+/**
+ * Base type for OAuth provider options.
+ * Extracts common fields from GenericOAuthConfig for provider helpers.
+ */
+type BaseOAuthProviderOptions = Pick<GenericOAuthConfig, "clientId" | "clientSecret" | "tokenEndpointAuth" | "scopes" | "redirectURI" | "endSessionEndpoint" | "postLogoutRedirectURI" | "disableProviderLogout" | "pkce" | "disableImplicitSignUp" | "disableSignUp" | "overrideUserInfo">;
+/**
+ * A generic OAuth plugin that registers any OAuth/OIDC provider
+ * as a first-class social provider.
+ *
+ * Providers are used through the standard `signIn.social` and
+ * `callback/:id` core endpoints — no plugin-specific endpoints needed.
+ */
+declare const genericOAuth: <const ID extends string>(options: GenericOAuthOptions<ID>) => {
+  id: "generic-oauth";
+  version: string;
+  init: (ctx: AuthContext) => Promise<{
+    context: {
+      socialProviders: OAuthProvider<object, Partial<_$_better_auth_core_oauth20.ProviderOptions<object>>>[];
+    };
+  }>;
+  options: GenericOAuthOptions<ID>;
+  $ERROR_CODES: {
+    INVALID_OAUTH_CONFIGURATION: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_OAUTH_CONFIGURATION">;
+    TOKEN_URL_NOT_FOUND: _$_better_auth_core_utils_error_codes0.RawError<"TOKEN_URL_NOT_FOUND">;
+  };
+};
+//#endregion
+export { Auth0Options, BaseOAuthProviderOptions, type GenericOAuthConfig, type GenericOAuthOptions, type GenericOAuthUserInfo, GumroadOptions, HubSpotOptions, KeycloakOptions, LineOptions, MicrosoftEntraIdOptions, OktaOptions, PatreonOptions, SlackOptions, YandexOptions, auth0, genericOAuth, gumroad, hubspot, keycloak, line, microsoftEntraId, okta, patreon, slack, yandex };

package/dist/plugins/generic-oauth/index.mjs

@@ -0,0 +1,279 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { GENERIC_OAUTH_ERROR_CODES } from "./error-codes.mjs";
+import { auth0 } from "./providers/auth0.mjs";
+import { gumroad } from "./providers/gumroad.mjs";
+import { hubspot } from "./providers/hubspot.mjs";
+import { keycloak } from "./providers/keycloak.mjs";
+import { line } from "./providers/line.mjs";
+import { microsoftEntraId } from "./providers/microsoft-entra-id.mjs";
+import { okta } from "./providers/okta.mjs";
+import { patreon } from "./providers/patreon.mjs";
+import { slack } from "./providers/slack.mjs";
+import { yandex } from "./providers/yandex.mjs";
+import { APIError } from "@better-auth/core/error";
+import { applyDefaultAccessTokenExpiry, createAuthorizationURL, refreshAccessToken, validateAuthorizationCode, verifyProviderIdToken } from "@better-auth/core/oauth2";
+import { createRemoteJWKSet, decodeJwt } from "jose";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/generic-oauth/index.ts
+function isSecretlessTokenEndpointAuth(tokenEndpointAuth) {
+	return tokenEndpointAuth?.method === "private_key_jwt" || tokenEndpointAuth?.method === "none";
+}
+function isClientSecretTokenEndpointAuth(tokenEndpointAuth) {
+	return tokenEndpointAuth?.method === "client_secret_basic" || tokenEndpointAuth?.method === "client_secret_post";
+}
+async function fetchDiscovery(url, headers) {
+	const result = await betterFetch(url, {
+		method: "GET",
+		headers
+	});
+	if (result.error || !result.data) return null;
+	if (result.data.issuer) try {
+		new URL(result.data.issuer);
+	} catch {
+		return null;
+	}
+	return result.data;
+}
+async function fetchUserInfo(tokens, userInfoUrl) {
+	if (tokens.idToken) try {
+		const decoded = decodeJwt(tokens.idToken);
+		if (decoded?.sub && decoded?.email) return {
+			id: decoded.sub,
+			emailVerified: decoded.email_verified,
+			image: decoded.picture,
+			...decoded
+		};
+	} catch {}
+	if (!userInfoUrl) return null;
+	const userInfo = await betterFetch(userInfoUrl, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tokens.accessToken}` }
+	});
+	if (userInfo.error || !userInfo.data) return null;
+	return {
+		...userInfo.data,
+		email: userInfo.data.email,
+		emailVerified: userInfo.data.email_verified ?? false,
+		image: userInfo.data.picture,
+		name: userInfo.data.name
+	};
+}
+/**
+* A generic OAuth plugin that registers any OAuth/OIDC provider
+* as a first-class social provider.
+*
+* Providers are used through the standard `signIn.social` and
+* `callback/:id` core endpoints — no plugin-specific endpoints needed.
+*/
+const genericOAuth = (options) => {
+	const seenIds = /* @__PURE__ */ new Set();
+	const nonUniqueIds = /* @__PURE__ */ new Set();
+	for (const config of options.config) {
+		const id = config.providerId;
+		if (seenIds.has(id)) nonUniqueIds.add(id);
+		seenIds.add(id);
+	}
+	if (nonUniqueIds.size > 0) console.warn(`Duplicate provider IDs found: ${Array.from(nonUniqueIds).join(", ")}`);
+	return {
+		id: "generic-oauth",
+		version: PACKAGE_VERSION,
+		init: async (ctx) => {
+			const genericProviders = [];
+			for (const c of options.config) {
+				let authorizationUrl = c.authorizationUrl;
+				let tokenUrl = c.tokenUrl;
+				let userInfoUrl = c.userInfoUrl;
+				let endSessionEndpoint = c.endSessionEndpoint;
+				let issuer;
+				let isOidc = false;
+				let idTokenConfig;
+				if (c.discoveryUrl) {
+					const discovered = await fetchDiscovery(c.discoveryUrl, c.discoveryHeaders).catch((err) => {
+						ctx.logger.error(`Discovery fetch failed for "${c.providerId}": ${err}`);
+						return null;
+					});
+					if (discovered) {
+						authorizationUrl ??= discovered.authorization_endpoint;
+						tokenUrl ??= discovered.token_endpoint;
+						userInfoUrl ??= discovered.userinfo_endpoint;
+						endSessionEndpoint ??= discovered.end_session_endpoint;
+						issuer = discovered.issuer;
+						const signingAlgs = discovered.id_token_signing_alg_values_supported;
+						isOidc = Array.isArray(signingAlgs) && signingAlgs.length > 0;
+						if (discovered.jwks_uri && discovered.issuer) {
+							let jwksUrl;
+							try {
+								jwksUrl = new URL(discovered.jwks_uri, c.discoveryUrl);
+							} catch {
+								ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
+								continue;
+							}
+							idTokenConfig = {
+								jwks: createRemoteJWKSet(jwksUrl),
+								issuer: discovered.issuer,
+								audience: c.clientId,
+								algorithms: isOidc ? signingAlgs : void 0
+							};
+						}
+					}
+					if (!authorizationUrl || !tokenUrl && !c.getToken) {
+						ctx.logger.error(`Provider "${c.providerId}": discovery left no usable authorization endpoint or token exchange. Provider skipped.`);
+						continue;
+					}
+				}
+				if (c.requireIdTokenVerification && !idTokenConfig) {
+					if (c.discoveryUrl) {
+						ctx.logger.error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri. Provider skipped.`);
+						continue;
+					}
+					throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
+				}
+				const tokenEndpointAuth = c.tokenEndpointAuth;
+				if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
+				if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
+				if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
+				const accountSubject = c.accountSubject;
+				const provider = {
+					id: c.providerId,
+					name: c.name ?? c.providerId,
+					issuer,
+					accountSubject: ({ tokens, profile }) => {
+						const genericProfile = profile;
+						if (accountSubject) return accountSubject({
+							tokens,
+							profile: genericProfile
+						});
+						return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
+					},
+					idToken: idTokenConfig,
+					requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
+					allowIdpInitiated: c.allowIdpInitiated,
+					async createEndSessionURL(data) {
+						if (c.disableProviderLogout) return null;
+						if (!endSessionEndpoint) return null;
+						let url;
+						try {
+							url = new URL(endSessionEndpoint);
+						} catch {
+							return null;
+						}
+						if (data.idToken) url.searchParams.set("id_token_hint", data.idToken);
+						const configuredRedirectURI = data.postLogoutRedirectURI ?? c.postLogoutRedirectURI;
+						const postLogoutRedirectURI = configuredRedirectURI ? new URL(configuredRedirectURI, ctx.baseURL).toString() : void 0;
+						if (postLogoutRedirectURI) {
+							url.searchParams.set("post_logout_redirect_uri", postLogoutRedirectURI);
+							url.searchParams.set("client_id", c.clientId);
+							if (data.state) url.searchParams.set("state", data.state);
+						} else if (!data.idToken) url.searchParams.set("client_id", c.clientId);
+						return url;
+					},
+					createAuthorizationURL(data) {
+						if (!authorizationUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.INVALID_OAUTH_CONFIGURATION);
+						return createAuthorizationURL({
+							id: c.providerId,
+							options: {
+								clientId: c.clientId,
+								clientSecret: c.clientSecret,
+								redirectURI: c.redirectURI
+							},
+							authorizationEndpoint: authorizationUrl,
+							state: data.state,
+							codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
+							scopes: (() => {
+								const merged = [...data.scopes ?? [], ...c.scopes ?? []];
+								if (isOidc && !merged.includes("openid")) merged.unshift("openid");
+								return merged;
+							})(),
+							redirectURI: data.redirectURI,
+							prompt: c.prompt,
+							accessType: c.accessType,
+							responseType: c.responseType,
+							responseMode: c.responseMode,
+							nonce: data.idTokenNonce,
+							additionalParams: {
+								...c.authorizationUrlParams ?? {},
+								...data.additionalParams ?? {}
+							},
+							loginHint: data.loginHint
+						});
+					},
+					async validateAuthorizationCode(data) {
+						if (c.getToken) return applyDefaultAccessTokenExpiry(await c.getToken(data), c.accessTokenExpiresIn);
+						if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
+						return applyDefaultAccessTokenExpiry(await validateAuthorizationCode({
+							headers: c.authorizationHeaders,
+							code: data.code,
+							codeVerifier: c.pkce ?? true ? data.codeVerifier : void 0,
+							redirectURI: data.redirectURI,
+							options: {
+								clientId: c.clientId,
+								clientSecret: c.clientSecret,
+								redirectURI: c.redirectURI
+							},
+							tokenEndpoint: tokenUrl,
+							authentication: c.authentication,
+							tokenEndpointAuth,
+							additionalParams: c.tokenUrlParams
+						}), c.accessTokenExpiresIn);
+					},
+					async getUserInfo(tokens) {
+						const { expectedIdTokenNonce, ...oauthTokens } = tokens;
+						if (oauthTokens.idToken && provider.idToken) {
+							if (!await verifyProviderIdToken(provider, oauthTokens.idToken, expectedIdTokenNonce)) {
+								ctx.logger.error(`Provider "${c.providerId}": id_token failed verification against the discovery JWKS or expected nonce`);
+								return null;
+							}
+						}
+						const raw = c.getUserInfo ? await c.getUserInfo(oauthTokens) : await fetchUserInfo(oauthTokens, userInfoUrl);
+						if (!raw) return null;
+						const mapped = c.mapProfileToUser ? await c.mapProfileToUser(raw) : {};
+						const user = {
+							email: raw.email,
+							emailVerified: raw.emailVerified,
+							image: raw.image,
+							name: raw.name,
+							...mapped
+						};
+						return {
+							user: {
+								...user,
+								image: user.image ?? void 0
+							},
+							data: raw
+						};
+					},
+					async refreshAccessToken(refreshToken, refreshCtx) {
+						if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);
+						const resolvedRefreshParams = typeof c.refreshTokenParams === "function" ? await c.refreshTokenParams(refreshCtx) : c.refreshTokenParams;
+						return applyDefaultAccessTokenExpiry(await refreshAccessToken({
+							refreshToken,
+							options: {
+								clientId: c.clientId,
+								clientSecret: c.clientSecret
+							},
+							authentication: c.authentication,
+							tokenEndpointAuth,
+							tokenEndpoint: tokenUrl,
+							extraParams: resolvedRefreshParams
+						}), c.accessTokenExpiresIn);
+					},
+					disableImplicitSignUp: c.disableImplicitSignUp,
+					disableSignUp: c.disableSignUp,
+					options: {
+						disableSignUp: c.disableSignUp,
+						overrideUserInfoOnSignIn: c.overrideUserInfo,
+						requireEmailVerification: c.requireEmailVerification
+					}
+				};
+				genericProviders.push(provider);
+			}
+			const existingIds = new Set(ctx.socialProviders.map((p) => p.id));
+			for (const gp of genericProviders) if (existingIds.has(gp.id)) ctx.logger.warn(`Generic OAuth provider "${gp.id}" shadows a built-in social provider with the same ID`);
+			return { context: { socialProviders: genericProviders.concat(ctx.socialProviders) } };
+		},
+		options,
+		$ERROR_CODES: GENERIC_OAUTH_ERROR_CODES
+	};
+};
+//#endregion
+export { auth0, genericOAuth, gumroad, hubspot, keycloak, line, microsoftEntraId, okta, patreon, slack, yandex };

package/dist/plugins/generic-oauth/providers/auth0.d.mts

@@ -0,0 +1,36 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/auth0.d.ts
+interface Auth0Options extends BaseOAuthProviderOptions {
+  /**
+   * Auth0 domain (e.g., dev-xxx.eu.auth0.com)
+   * This will be used to construct the discovery URL.
+   */
+  domain: string;
+}
+/**
+ * Auth0 OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, auth0 } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         auth0({
+ *           clientId: process.env.AUTH0_CLIENT_ID,
+ *           clientSecret: process.env.AUTH0_CLIENT_SECRET,
+ *           domain: process.env.AUTH0_DOMAIN,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function auth0(options: Auth0Options): GenericOAuthConfig<"auth0">;
+//#endregion
+export { Auth0Options, auth0 };

package/dist/plugins/generic-oauth/providers/auth0.mjs

@@ -0,0 +1,49 @@
+//#region src/plugins/generic-oauth/providers/auth0.ts
+/**
+* Auth0 OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, auth0 } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         auth0({
+*           clientId: process.env.AUTH0_CLIENT_ID,
+*           clientSecret: process.env.AUTH0_CLIENT_SECRET,
+*           domain: process.env.AUTH0_DOMAIN,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function auth0(options) {
+	const defaultScopes = [
+		"openid",
+		"profile",
+		"email"
+	];
+	const domainUrl = options.domain.startsWith("http://") || options.domain.startsWith("https://") ? options.domain : `https://${options.domain}`;
+	return {
+		providerId: "auth0",
+		discoveryUrl: `https://${new URL(domainUrl).host}/.well-known/openid-configuration`,
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		tokenEndpointAuth: options.tokenEndpointAuth,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo
+	};
+}
+//#endregion
+export { auth0 };

package/dist/plugins/generic-oauth/providers/gumroad.d.mts

@@ -0,0 +1,31 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/gumroad.d.ts
+interface GumroadOptions extends BaseOAuthProviderOptions {}
+/**
+ * Gumroad OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, gumroad } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         gumroad({
+ *           clientId: process.env.GUMROAD_CLIENT_ID,
+ *           clientSecret: process.env.GUMROAD_CLIENT_SECRET,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * @see https://app.gumroad.com/oauth
+ */
+declare function gumroad(options: GumroadOptions): GenericOAuthConfig<"gumroad">;
+//#endregion
+export { GumroadOptions, gumroad };

package/dist/plugins/generic-oauth/providers/gumroad.mjs

@@ -0,0 +1,62 @@
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/generic-oauth/providers/gumroad.ts
+/**
+* Gumroad OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, gumroad } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         gumroad({
+*           clientId: process.env.GUMROAD_CLIENT_ID,
+*           clientSecret: process.env.GUMROAD_CLIENT_SECRET,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*
+* @see https://app.gumroad.com/oauth
+*/
+function gumroad(options) {
+	const getUserInfo = async (tokens) => {
+		const { data: profile, error } = await betterFetch("https://api.gumroad.com/v2/user", {
+			method: "GET",
+			headers: { Authorization: `Bearer ${tokens.accessToken}` }
+		});
+		if (error || !profile?.success || !profile.user) return null;
+		return {
+			id: profile.user.user_id,
+			name: profile.user.name,
+			email: profile.user.email,
+			image: profile.user.profile_url,
+			emailVerified: false
+		};
+	};
+	return {
+		providerId: "gumroad",
+		accountSubject: ({ profile }) => profile.id ?? "",
+		authorizationUrl: "https://gumroad.com/oauth/authorize",
+		tokenUrl: "https://api.gumroad.com/oauth/token",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		tokenEndpointAuth: options.tokenEndpointAuth,
+		scopes: options.scopes ?? ["view_profile"],
+		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+//#endregion
+export { gumroad };

package/dist/plugins/generic-oauth/providers/hubspot.d.mts

@@ -0,0 +1,36 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/hubspot.d.ts
+interface HubSpotOptions extends BaseOAuthProviderOptions {
+  /**
+   * OAuth scopes to request.
+   * @default ["oauth"]
+   */
+  scopes?: string[];
+}
+/**
+ * HubSpot OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, hubspot } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         hubspot({
+ *           clientId: process.env.HUBSPOT_CLIENT_ID,
+ *           clientSecret: process.env.HUBSPOT_CLIENT_SECRET,
+ *           scopes: ["oauth", "contacts"],
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function hubspot(options: HubSpotOptions): GenericOAuthConfig<"hubspot">;
+//#endregion
+export { HubSpotOptions, hubspot };