@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/index.mjs

@@ -0,0 +1,49 @@
+import { HIDE_METADATA } from "../utils/hide-metadata.mjs";
+import { createAccessControl, role } from "./access/access.mjs";
+import { MULTI_SESSION_ERROR_CODES } from "./multi-session/error-codes.mjs";
+import { OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_MESSAGE_TYPE, POPUP_MARKER_COOKIE } from "./oauth-popup/constants.mjs";
+import { OAUTH_POPUP_ERROR_CODES } from "./oauth-popup/error-codes.mjs";
+import { TWO_FACTOR_ERROR_CODES } from "./two-factor/error-code.mjs";
+import { twoFactorClient } from "./two-factor/client.mjs";
+import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
+import { admin } from "./admin/admin.mjs";
+import { anonymous } from "./anonymous/index.mjs";
+import { bearer } from "./bearer/index.mjs";
+import { captcha } from "./captcha/index.mjs";
+import { customSession } from "./custom-session/index.mjs";
+import { redeemDeviceCode } from "./device-authorization/routes.mjs";
+import { deviceAuthorization, deviceAuthorizationOptionsSchema } from "./device-authorization/index.mjs";
+import { emailOTP } from "./email-otp/index.mjs";
+import { auth0 } from "./generic-oauth/providers/auth0.mjs";
+import { gumroad } from "./generic-oauth/providers/gumroad.mjs";
+import { hubspot } from "./generic-oauth/providers/hubspot.mjs";
+import { keycloak } from "./generic-oauth/providers/keycloak.mjs";
+import { line } from "./generic-oauth/providers/line.mjs";
+import { microsoftEntraId } from "./generic-oauth/providers/microsoft-entra-id.mjs";
+import { okta } from "./generic-oauth/providers/okta.mjs";
+import { patreon } from "./generic-oauth/providers/patreon.mjs";
+import { slack } from "./generic-oauth/providers/slack.mjs";
+import { yandex } from "./generic-oauth/providers/yandex.mjs";
+import { genericOAuth } from "./generic-oauth/index.mjs";
+import { haveIBeenPwned, isPasswordCompromised } from "./haveibeenpwned/index.mjs";
+import { createJwk, generateExportedKeyPair, toExpJWT } from "./jwt/utils.mjs";
+import { getJwtToken, resolveSigningKey, signJWT } from "./jwt/sign.mjs";
+import { verifyJWT } from "./jwt/verify.mjs";
+import { jwt } from "./jwt/index.mjs";
+import { lastLoginMethod } from "./last-login-method/index.mjs";
+import { magicLink } from "./magic-link/index.mjs";
+import { multiSession } from "./multi-session/index.mjs";
+import { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_SCRIPT_CSP_HASH, oauthPopup } from "./oauth-popup/index.mjs";
+import { oAuthProxy } from "./oauth-proxy/index.mjs";
+import { oneTap } from "./one-tap/index.mjs";
+import { oneTimeToken } from "./one-time-token/index.mjs";
+import { openAPI } from "./open-api/index.mjs";
+import { getOrgAdapter } from "./organization/adapter.mjs";
+import { hasPermission } from "./organization/has-permission.mjs";
+import { organization, parseRoles } from "./organization/organization.mjs";
+import { phoneNumber } from "./phone-number/index.mjs";
+import { siwe } from "./siwe/index.mjs";
+import { testUtils } from "./test-utils/index.mjs";
+import { twoFactor } from "./two-factor/index.mjs";
+import { username } from "./username/index.mjs";
+export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, auth0, bearer, captcha, createAccessControl, createJwk, customSession, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateExportedKeyPair, genericOAuth, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, microsoftEntraId, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, yandex };

package/dist/plugins/jwt/adapter.mjs

@@ -0,0 +1,68 @@
+import { getCurrentAdapter } from "@better-auth/core/context";
+//#region src/plugins/jwt/adapter.ts
+const getJwksAdapter = (baseAdapter, options) => {
+	return {
+		getAllKeys: async (ctx) => {
+			if (options?.adapter?.getJwks) return await options.adapter.getJwks(ctx);
+			return await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" });
+		},
+		getLatestKey: async (ctx) => {
+			const now = /* @__PURE__ */ new Date();
+			const isLive = (k) => !k.expiresAt || k.expiresAt > now;
+			if (options?.adapter?.getJwks) return (await options.adapter.getJwks(ctx))?.filter(isLive).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
+			return (await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" }))?.filter(isLive).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
+		},
+		/**
+		* Look up a key by its `id` (matches the JWS `kid` header). Returns
+		* `undefined` when no key with that id exists.
+		*
+		* When `options.adapter.getJwks` is configured (custom keyring),
+		* filters in-memory after fetching the full set — the custom adapter
+		* isn't required to implement an id index.
+		*/
+		getKeyById: async (ctx, id) => {
+			if (options?.adapter?.getJwks) return (await options.adapter.getJwks(ctx))?.find((k) => k.id === id);
+			return await (await getCurrentAdapter(baseAdapter)).findOne({
+				model: "jwks",
+				where: [{
+					field: "id",
+					value: id
+				}]
+			}) ?? void 0;
+		},
+		/**
+		* Find the most recent key matching a specific algorithm. Used when
+		* a caller (e.g. an OAuth audience) specifies `signingAlgorithm` but
+		* not a specific `kid`. Returns `undefined` if no key with the alg
+		* exists — callers decide whether to mint one or reject.
+		*
+		* Legacy rows persisted before the `alg` column existed have
+		* `alg: null`. Per `schema.ts`, those rows are treated as the
+		* configured default alg (`options.jwks.keyPairConfig.alg ?? "EdDSA"`),
+		* so deployments that have only legacy rows can still satisfy an
+		* audience-pinned `signingAlgorithm` matching the default.
+		*
+		* Expired keys are filtered out here — see `getLatestKey` for
+		* rationale.
+		*/
+		getLatestKeyByAlg: async (ctx, alg) => {
+			const candidates = options?.adapter?.getJwks ? await options.adapter.getJwks(ctx) : await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" });
+			if (!candidates) return void 0;
+			const configAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+			const now = /* @__PURE__ */ new Date();
+			return candidates.filter((k) => k.alg === alg || k.alg == null && configAlg === alg).filter((k) => !k.expiresAt || k.expiresAt > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
+		},
+		createJwk: async (ctx, webKey) => {
+			if (options?.adapter?.createJwk) return await options.adapter.createJwk(webKey, ctx);
+			return await (await getCurrentAdapter(baseAdapter)).create({
+				model: "jwks",
+				data: {
+					...webKey,
+					createdAt: /* @__PURE__ */ new Date()
+				}
+			});
+		}
+	};
+};
+//#endregion
+export { getJwksAdapter };

package/dist/plugins/jwt/client.d.mts

@@ -0,0 +1,41 @@
+import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./types.mjs";
+import { jwt } from "./index.mjs";
+import { BetterAuthClientOptions, ClientFetchOption, ClientStore } from "@better-auth/core";
+import { JSONWebKeySet } from "jose";
+import { BetterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/jwt/client.d.ts
+interface JwtClientOptions {
+  jwks?: {
+    /**
+     * The path of the endpoint exposing the JWKS.
+     * Must match the server configuration.
+     *
+     * @default /jwks
+     */
+    jwksPath?: string;
+  };
+}
+declare const jwtClient: (options?: JwtClientOptions) => {
+  id: "better-auth-client";
+  version: string;
+  $InferServerPlugin: ReturnType<typeof jwt>;
+  pathMethods: {
+    [x: string]: "GET";
+  };
+  getActions: ($fetch: BetterFetch, _$store: ClientStore, _options: BetterAuthClientOptions | undefined) => {
+    jwks: (fetchOptions?: ClientFetchOption) => Promise<{
+      data: null;
+      error: {
+        message?: string | undefined;
+        status: number;
+        statusText: string;
+      };
+    } | {
+      data: JSONWebKeySet;
+      error: null;
+    }>;
+  };
+};
+//#endregion
+export { jwtClient };

package/dist/plugins/jwt/client.mjs

@@ -0,0 +1,19 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+//#region src/plugins/jwt/client.ts
+const jwtClient = (options) => {
+	const jwksPath = options?.jwks?.jwksPath ?? "/jwks";
+	return {
+		id: "better-auth-client",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		pathMethods: { [jwksPath]: "GET" },
+		getActions: ($fetch, _$store, _options) => ({ jwks: async (fetchOptions) => {
+			return await $fetch(jwksPath, {
+				method: "GET",
+				...fetchOptions
+			});
+		} })
+	};
+};
+//#endregion
+export { jwtClient };

package/dist/plugins/jwt/cookie-cache.mjs

@@ -0,0 +1,77 @@
+import { SESSION_COOKIE_JWT_AUDIENCE, SESSION_COOKIE_JWT_TYPE, getSessionCookieJwtVerifyOptions, parseSessionCookieJwtPayload } from "../../cookies/jwt.mjs";
+import { getJwksAdapter } from "./adapter.mjs";
+import { resolveSigningKey } from "./sign.mjs";
+import { BetterAuthError } from "@better-auth/core/error";
+import { SignJWT, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+//#region src/plugins/jwt/cookie-cache.ts
+function getCookieCacheJwtIssuer(ctx) {
+	const baseURL = ctx.context.options.baseURL;
+	return typeof baseURL === "string" ? baseURL || "better-auth:session-cache" : ctx.context.baseURL || "better-auth:session-cache";
+}
+async function importLocalPublicKey(ctx, token, options) {
+	const header = decodeProtectedHeader(token);
+	const kid = header.kid;
+	if (!kid) {
+		ctx.context.logger.debug("Cookie-cache JWT missing kid in header");
+		return null;
+	}
+	const keys = await getJwksAdapter(ctx.context.adapter, options).getAllKeys(ctx);
+	if (!keys?.length) {
+		ctx.context.logger.debug("No JWKS keys available for cookie-cache JWT");
+		return null;
+	}
+	const key = keys.find((entry) => entry.id === kid);
+	if (!key) {
+		ctx.context.logger.debug(`No JWKS key found for cookie-cache JWT kid: ${kid}`);
+		return null;
+	}
+	const alg = key.alg ?? options?.jwks?.keyPairConfig?.alg ?? header.alg;
+	if (!alg) {
+		ctx.context.logger.debug(`No JWT algorithm available for cookie-cache JWT kid: ${kid}`);
+		return null;
+	}
+	return {
+		alg,
+		publicKey: await importJWK(JSON.parse(key.publicKey), alg)
+	};
+}
+async function signCookieCacheJWT(ctx, payload, expiresIn, options) {
+	const resolvedKey = await resolveSigningKey(ctx, options);
+	if (!resolvedKey) throw new BetterAuthError("`jwt({ sessionCookieCache: true })` requires locally managed JWT plugin keys and does not support `jwt.sign`.");
+	return await new SignJWT({
+		...payload,
+		sid: payload.session.token
+	}).setProtectedHeader({
+		alg: resolvedKey.alg,
+		kid: resolvedKey.kid,
+		typ: SESSION_COOKIE_JWT_TYPE
+	}).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + expiresIn).setIssuer(getCookieCacheJwtIssuer(ctx)).setAudience(SESSION_COOKIE_JWT_AUDIENCE).setSubject(payload.user.id).sign(resolvedKey.privateKey);
+}
+async function verifyCookieCacheJWT(ctx, token, options) {
+	try {
+		if (decodeProtectedHeader(token).typ !== "better-auth.session-cache+jwt") return null;
+		const key = await importLocalPublicKey(ctx, token, options);
+		if (!key) return null;
+		const { payload } = await jwtVerify(token, key.publicKey, {
+			...getSessionCookieJwtVerifyOptions({ issuer: getCookieCacheJwtIssuer(ctx) }),
+			algorithms: [key.alg]
+		});
+		const parsed = parseSessionCookieJwtPayload(payload);
+		if (!parsed) return null;
+		return {
+			payload: parsed,
+			expiresAt: parsed.exp ? parsed.exp * 1e3 : Date.now()
+		};
+	} catch (error) {
+		ctx.context.logger.debug("Cookie-cache JWT verification failed", error);
+		return null;
+	}
+}
+function createCookieCacheSigner(options) {
+	return {
+		sign: (ctx, payload, expiresIn) => signCookieCacheJWT(ctx, payload, expiresIn, options),
+		verify: (ctx, token) => verifyCookieCacheJWT(ctx, token, options)
+	};
+}
+//#endregion
+export { createCookieCacheSigner };

package/dist/plugins/jwt/index.d.mts

@@ -0,0 +1,246 @@
+import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./types.mjs";
+import { getJwtToken, resolveSigningKey, signJWT } from "./sign.mjs";
+import { createJwk, generateExportedKeyPair, toExpJWT } from "./utils.mjs";
+import { verifyJWT } from "./verify.mjs";
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+import * as z from "zod";
+import { JSONWebKeySet, JWTPayload } from "jose";
+
+//#region src/plugins/jwt/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    jwt: {
+      creator: typeof jwt;
+    };
+  }
+}
+declare const jwt: <O extends JwtOptions>(options?: O) => {
+  id: "jwt";
+  version: string;
+  options: NoInfer<O>;
+  init(ctx: _$_better_auth_core0.AuthContext): {
+    context: {
+      sessionConfig: {
+        cookieCacheSigner: _$_better_auth_core0.CookieCacheSigner;
+        updateAge: number;
+        expiresIn: number;
+        freshAge: number;
+        cookieRefreshCache: false | {
+          enabled: true;
+          updateAge: number;
+        };
+      };
+    };
+  } | undefined;
+  endpoints: {
+    getJwks: _$better_call0.StrictEndpoint<string, {
+      method: "GET";
+      metadata: {
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      keys: {
+                        type: string;
+                        description: string;
+                        items: {
+                          type: string;
+                          properties: {
+                            kid: {
+                              type: string;
+                              description: string;
+                            };
+                            kty: {
+                              type: string;
+                              description: string;
+                            };
+                            alg: {
+                              type: string;
+                              description: string;
+                            };
+                            use: {
+                              type: string;
+                              description: string;
+                              enum: string[];
+                              nullable: boolean;
+                            };
+                            n: {
+                              type: string;
+                              description: string;
+                              nullable: boolean;
+                            };
+                            e: {
+                              type: string;
+                              description: string;
+                              nullable: boolean;
+                            };
+                            crv: {
+                              type: string;
+                              description: string;
+                              nullable: boolean;
+                            };
+                            x: {
+                              type: string;
+                              description: string;
+                              nullable: boolean;
+                            };
+                            y: {
+                              type: string;
+                              description: string;
+                              nullable: boolean;
+                            };
+                          };
+                          required: string[];
+                        };
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, JSONWebKeySet>;
+    getToken: _$better_call0.StrictEndpoint<"/token", {
+      method: "GET";
+      requireHeaders: true;
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      metadata: {
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      token: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      token: string;
+    }>;
+    signJWT: _$better_call0.StrictEndpoint<string, {
+      method: "POST";
+      metadata: {
+        $Infer: {
+          body: {
+            payload: JWTPayload;
+            overrideOptions?: JwtOptions | undefined;
+          };
+        };
+      };
+      body: z.ZodObject<{
+        payload: z.ZodRecord<z.ZodString, z.ZodAny>;
+        overrideOptions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>;
+    }, {
+      token: string;
+    }>;
+    verifyJWT: _$better_call0.StrictEndpoint<string, {
+      method: "POST";
+      metadata: {
+        $Infer: {
+          body: {
+            token: string;
+            issuer?: string;
+          };
+          response: {
+            payload: {
+              sub: string;
+              aud: string;
+              [key: string]: any;
+            } | null;
+          };
+        };
+      };
+      body: z.ZodObject<{
+        token: z.ZodString;
+        issuer: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+    }, {
+      payload: (JWTPayload & Required<Pick<JWTPayload, "sub" | "aud">>) | null;
+    }>;
+  };
+  hooks: {
+    after: {
+      matcher(context: _$_better_auth_core0.HookEndpointContext): boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
+  schema: {
+    jwks: {
+      fields: {
+        publicKey: {
+          type: "string";
+          required: true;
+        };
+        privateKey: {
+          type: "string";
+          required: true;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+        };
+        expiresAt: {
+          type: "date";
+          required: false;
+        };
+        alg: {
+          type: "string";
+          required: false;
+        };
+        crv: {
+          type: "string";
+          required: false;
+        };
+      };
+    };
+  };
+};
+//#endregion
+export { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey, createJwk, generateExportedKeyPair, getJwtToken, jwt, resolveSigningKey, signJWT, toExpJWT, verifyJWT };