@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/last-login-method/index.mjs

@@ -0,0 +1,98 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { createAuthMiddleware } from "@better-auth/core/api";
+//#region src/plugins/last-login-method/index.ts
+/**
+* Plugin to track the last used login method
+*/
+const lastLoginMethod = (userConfig) => {
+	const defaultResolveMethod = (ctx) => {
+		const path = ctx.path;
+		if (!path) return null;
+		if (path.startsWith("/callback/")) return ctx.params?.id || path.split("/").pop();
+		if (path === "/sign-in/email" || path === "/sign-up/email") return "email";
+		if (path.includes("siwe")) return "siwe";
+		if (path.includes("/passkey/verify-authentication")) return "passkey";
+		if (path.startsWith("/magic-link/verify")) return "magic-link";
+		if (path === "/sign-in/email-otp") return "email-otp";
+		return null;
+	};
+	const getResolveContext = (ctx) => {
+		return ctx.path ? ctx : {
+			...ctx,
+			path: ""
+		};
+	};
+	const resolveMethod = (ctx) => {
+		const resolveContext = getResolveContext(ctx);
+		return config.customResolveMethod?.(resolveContext) ?? defaultResolveMethod(resolveContext);
+	};
+	const config = {
+		cookieName: "better-auth.last_used_login_method",
+		maxAge: 3600 * 24 * 30,
+		...userConfig
+	};
+	return {
+		id: "last-login-method",
+		version: PACKAGE_VERSION,
+		init(ctx) {
+			return { options: { databaseHooks: {
+				user: { create: { async before(user, context) {
+					if (!config.storeInDatabase) return;
+					if (!context) return;
+					const lastUsedLoginMethod = resolveMethod(context);
+					if (lastUsedLoginMethod) return { data: {
+						...user,
+						lastLoginMethod: lastUsedLoginMethod
+					} };
+				} } },
+				session: { create: { async after(session, context) {
+					if (!config.storeInDatabase) return;
+					if (!context) return;
+					const lastUsedLoginMethod = resolveMethod(context);
+					if (lastUsedLoginMethod && session?.userId) try {
+						await ctx.internalAdapter.updateUser(session.userId, { lastLoginMethod: lastUsedLoginMethod });
+					} catch (error) {
+						ctx.logger.error("Failed to update lastLoginMethod", error);
+					}
+				} } }
+			} } };
+		},
+		hooks: { after: [{
+			matcher() {
+				return true;
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				const lastUsedLoginMethod = resolveMethod(ctx);
+				if (lastUsedLoginMethod) {
+					const setCookieHeaders = ctx.context.responseHeaders?.getSetCookie?.() || [];
+					const sessionTokenName = ctx.context.authCookies.sessionToken.name;
+					if (setCookieHeaders.some((cookie) => cookie.includes(sessionTokenName))) {
+						const cookieAttributes = {
+							...ctx.context.authCookies.sessionToken.attributes,
+							maxAge: config.maxAge,
+							httpOnly: false
+						};
+						let isPermitted = true;
+						if (config.beforeStoreCookie) try {
+							isPermitted = await config.beforeStoreCookie(ctx, lastUsedLoginMethod);
+						} catch (error) {
+							if (ctx.context.logger) ctx.context.logger.error?.("[LastLoginMethod] Error in beforeStoreCookie hook", error);
+							isPermitted = false;
+						}
+						if (!isPermitted) return;
+						ctx.setCookie(config.cookieName, lastUsedLoginMethod, cookieAttributes);
+					}
+				}
+			})
+		}] },
+		schema: config.storeInDatabase ? { user: { fields: { lastLoginMethod: {
+			type: "string",
+			input: false,
+			required: false,
+			fieldName: config.schema?.user?.lastLoginMethod || "lastLoginMethod"
+		} } } } : void 0,
+		options: userConfig
+	};
+};
+//#endregion
+export { lastLoginMethod };

package/dist/plugins/magic-link/client.d.mts

@@ -0,0 +1,10 @@
+import { magicLink } from "./index.mjs";
+
+//#region src/plugins/magic-link/client.d.ts
+declare const magicLinkClient: () => {
+  id: "magic-link";
+  version: string;
+  $InferServerPlugin: ReturnType<typeof magicLink>;
+};
+//#endregion
+export { magicLinkClient };

package/dist/plugins/magic-link/client.mjs

@@ -0,0 +1,11 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+//#region src/plugins/magic-link/client.ts
+const magicLinkClient = () => {
+	return {
+		id: "magic-link",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {}
+	};
+};
+//#endregion
+export { magicLinkClient };

package/dist/plugins/magic-link/index.d.mts

@@ -0,0 +1,213 @@
+import { Awaitable, GenericEndpointContext } from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/plugins/magic-link/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "magic-link": {
+      creator: typeof magicLink;
+    };
+  }
+}
+interface MagicLinkOptions {
+  /**
+   * Time in seconds until the magic link expires.
+   * @default (60 * 5) // 5 minutes
+   */
+  expiresIn?: number | undefined;
+  /**
+   * Allowed attempts for verifying the magic link token.
+   *
+   * @deprecated Multi-attempt verification is no longer supported. Each
+   * magic link token is consumed atomically on the first verification call,
+   * so a given token mints at most one session regardless of this value
+   * The option is kept for source compatibility and may be removed in a future
+   * major; any value other than `1` is ignored and emits a `console.warn` at
+   * plugin construction.
+   *
+   * @default 1
+   */
+  allowedAttempts?: number;
+  /**
+   * Send magic link implementation.
+   */
+  sendMagicLink: (data: {
+    email: string;
+    url: string;
+    token: string;
+    metadata?: Record<string, any>;
+  }, ctx?: GenericEndpointContext | undefined) => Awaitable<void>;
+  /**
+   * Disable sign up if user is not found.
+   *
+   * @default false
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * Rate limit configuration.
+   *
+   * @default {
+   *  window: 60,
+   *  max: 5,
+   * }
+   */
+  rateLimit?: {
+    window: number;
+    max: number;
+  } | undefined;
+  /**
+   * Custom function to generate a token
+   */
+  generateToken?: ((email: string) => Awaitable<string>) | undefined;
+  /**
+   * This option allows you to configure how the token is stored in your database.
+   * Note: This will not affect the token that's sent, it will only affect the token stored in your database.
+   *
+   * @default "plain"
+   */
+  storeToken?: ("plain" | "hashed" | {
+    type: "custom-hasher";
+    hash: (token: string) => Promise<string>;
+  }) | undefined;
+}
+declare const magicLink: (options: MagicLinkOptions) => {
+  id: "magic-link";
+  version: string;
+  endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * POST `/sign-in/magic-link`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.signInMagicLink`
+     *
+     * **client:**
+     * `authClient.signIn.magicLink`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/sign-in#api-method-sign-in-magic-link)
+     */
+    signInMagicLink: _$better_call0.StrictEndpoint<"/sign-in/magic-link", {
+      method: "POST";
+      requireHeaders: true;
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>[];
+      body: z.ZodObject<{
+        email: z.ZodEmail;
+        name: z.ZodOptional<z.ZodString>;
+        callbackURL: z.ZodOptional<z.ZodString>;
+        newUserCallbackURL: z.ZodOptional<z.ZodString>;
+        errorCallbackURL: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      status: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      status: boolean;
+    }>;
+    /**
+     * ### Endpoint
+     *
+     * GET `/magic-link/verify`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.magicLinkVerify`
+     *
+     * **client:**
+     * `authClient.magicLink.verify`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/magic-link#api-method-magic-link-verify)
+     */
+    magicLinkVerify: _$better_call0.StrictEndpoint<"/magic-link/verify", {
+      method: "GET";
+      query: z.ZodObject<{
+        token: z.ZodString;
+        callbackURL: z.ZodOptional<z.ZodString>;
+        errorCallbackURL: z.ZodOptional<z.ZodString>;
+        newUserCallbackURL: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>[];
+      requireHeaders: true;
+      metadata: {
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      session: {
+                        $ref: string;
+                      };
+                      user: {
+                        $ref: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      token: string;
+      user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+      session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+    }>;
+  };
+  rateLimit: {
+    pathMatcher(path: string): boolean;
+    window: number;
+    max: number;
+  }[];
+  options: MagicLinkOptions;
+};
+//#endregion
+export { MagicLinkOptions, magicLink };

package/dist/plugins/magic-link/index.mjs

@@ -0,0 +1,208 @@
+import { isAPIError } from "../../utils/is-api-error.mjs";
+import { formCsrfMiddleware, originCheck } from "../../api/middlewares/origin-check.mjs";
+import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
+import { generateRandomString } from "../../crypto/random.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { defaultKeyHasher } from "./utils.mjs";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+//#region src/plugins/magic-link/index.ts
+const signInMagicLinkBodySchema = z.object({
+	email: z.email().meta({ description: "Email address to send the magic link" }),
+	name: z.string().meta({ description: "User display name. Only used if the user is registering for the first time. Eg: \"my-name\"" }).optional(),
+	callbackURL: z.string().meta({ description: "URL to redirect after magic link verification" }).optional(),
+	newUserCallbackURL: z.string().meta({ description: "URL to redirect after new user signup. Only used if the user is registering for the first time." }).optional(),
+	errorCallbackURL: z.string().meta({ description: "URL to redirect after error." }).optional(),
+	metadata: z.record(z.string(), z.any()).meta({ description: "Additional metadata to pass to sendMagicLink." }).optional()
+});
+const magicLinkVerifyQuerySchema = z.object({
+	token: z.string().meta({ description: "Verification token" }),
+	callbackURL: z.string().meta({ description: "URL to redirect after magic link verification, if not provided the user will be redirected to the root URL. Eg: \"/dashboard\"" }).optional(),
+	errorCallbackURL: z.string().meta({ description: "URL to redirect after error." }).optional(),
+	newUserCallbackURL: z.string().meta({ description: "URL to redirect after new user signup. Only used if the user is registering for the first time." }).optional()
+});
+const magicLink = (options) => {
+	const opts = {
+		storeToken: "plain",
+		allowedAttempts: 1,
+		...options
+	};
+	if (options.allowedAttempts !== void 0 && options.allowedAttempts !== 1) console.warn("[better-auth/magic-link] `allowedAttempts` is ignored: tokens are consumed atomically on the first verification call. Any value other than `1` has no effect; remove the option to silence this warning.");
+	async function storeToken(ctx, token) {
+		if (opts.storeToken === "hashed") return await defaultKeyHasher(token);
+		if (typeof opts.storeToken === "object" && "type" in opts.storeToken && opts.storeToken.type === "custom-hasher") return await opts.storeToken.hash(token);
+		return token;
+	}
+	return {
+		id: "magic-link",
+		version: PACKAGE_VERSION,
+		endpoints: {
+			/**
+			* ### Endpoint
+			*
+			* POST `/sign-in/magic-link`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.signInMagicLink`
+			*
+			* **client:**
+			* `authClient.signIn.magicLink`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/sign-in#api-method-sign-in-magic-link)
+			*/
+			signInMagicLink: createAuthEndpoint("/sign-in/magic-link", {
+				method: "POST",
+				requireHeaders: true,
+				use: [formCsrfMiddleware],
+				body: signInMagicLinkBodySchema,
+				metadata: { openapi: {
+					operationId: "signInWithMagicLink",
+					description: "Sign in with magic link",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { email, metadata } = ctx.body;
+				const verificationToken = opts?.generateToken ? await opts.generateToken(email) : generateRandomString(32, "a-z", "A-Z");
+				const storedToken = await storeToken(ctx, verificationToken);
+				await ctx.context.internalAdapter.createVerificationValue({
+					identifier: storedToken,
+					value: JSON.stringify({
+						email,
+						name: ctx.body.name
+					}),
+					expiresAt: new Date(Date.now() + (opts.expiresIn || 300) * 1e3)
+				});
+				const realBaseURL = new URL(ctx.context.baseURL);
+				const pathname = realBaseURL.pathname === "/" ? "" : realBaseURL.pathname;
+				const basePath = pathname ? "" : ctx.context.options.basePath || "";
+				const url = new URL(`${pathname}${basePath}/magic-link/verify`, realBaseURL.origin);
+				url.searchParams.set("token", verificationToken);
+				url.searchParams.set("callbackURL", ctx.body.callbackURL || "/");
+				if (ctx.body.newUserCallbackURL) url.searchParams.set("newUserCallbackURL", ctx.body.newUserCallbackURL);
+				if (ctx.body.errorCallbackURL) url.searchParams.set("errorCallbackURL", ctx.body.errorCallbackURL);
+				await options.sendMagicLink({
+					email,
+					url: url.toString(),
+					token: verificationToken,
+					metadata
+				}, ctx);
+				return ctx.json({ status: true });
+			}),
+			/**
+			* ### Endpoint
+			*
+			* GET `/magic-link/verify`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.magicLinkVerify`
+			*
+			* **client:**
+			* `authClient.magicLink.verify`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/magic-link#api-method-magic-link-verify)
+			*/
+			magicLinkVerify: createAuthEndpoint("/magic-link/verify", {
+				method: "GET",
+				query: magicLinkVerifyQuerySchema,
+				use: [
+					originCheck((ctx) => {
+						return ctx.query.callbackURL ? decodeURIComponent(ctx.query.callbackURL) : "/";
+					}),
+					originCheck((ctx) => {
+						return ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : "/";
+					}),
+					originCheck((ctx) => {
+						return ctx.query.errorCallbackURL ? decodeURIComponent(ctx.query.errorCallbackURL) : "/";
+					})
+				],
+				requireHeaders: true,
+				metadata: { openapi: {
+					operationId: "verifyMagicLink",
+					description: "Verify magic link",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								session: { $ref: "#/components/schemas/Session" },
+								user: { $ref: "#/components/schemas/User" }
+							}
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const token = ctx.query.token;
+				const callbackURL = new URL(ctx.query.callbackURL ? decodeURIComponent(ctx.query.callbackURL) : "/", ctx.context.baseURL).toString();
+				const errorCallbackURL = new URL(ctx.query.errorCallbackURL ? decodeURIComponent(ctx.query.errorCallbackURL) : callbackURL, ctx.context.baseURL);
+				function redirectWithError(error, description) {
+					errorCallbackURL.searchParams.set("error", error);
+					if (description) errorCallbackURL.searchParams.set("error_description", description);
+					throw ctx.redirect(errorCallbackURL.toString());
+				}
+				const newUserCallbackURL = new URL(ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : callbackURL, ctx.context.baseURL).toString();
+				const storedToken = await storeToken(ctx, token);
+				const tokenValue = await ctx.context.internalAdapter.consumeVerificationValue(storedToken);
+				if (!tokenValue) redirectWithError("INVALID_TOKEN");
+				const { email, name } = JSON.parse(tokenValue.value);
+				let isNewUser = false;
+				let user = await ctx.context.internalAdapter.findUserByEmail(email).then((res) => res?.user);
+				if (!user) if (!opts.disableSignUp) {
+					let newUser;
+					try {
+						newUser = await ctx.context.internalAdapter.createUser({
+							email,
+							emailVerified: true,
+							name: name || ""
+						}, { method: "magic-link" });
+					} catch (e) {
+						if (isAPIError(e) && e.body?.code) redirectWithError(e.body.code, e.body.message);
+						throw e;
+					}
+					isNewUser = true;
+					user = newUser;
+					if (!user) redirectWithError("failed_to_create_user");
+				} else redirectWithError("new_user_signup_disabled");
+				if (!user.emailVerified) {
+					const promotedUser = await revokeUnprovenAccountAccess(ctx, user.id);
+					if (!promotedUser) redirectWithError("user_not_found");
+					user = promotedUser;
+				}
+				const session = await ctx.context.internalAdapter.createSession(user.id);
+				if (!session) redirectWithError("failed_to_create_session");
+				await setSessionCookie(ctx, {
+					session,
+					user
+				});
+				if (!ctx.query.callbackURL) return ctx.json({
+					token: session.token,
+					user: parseUserOutput(ctx.context.options, user),
+					session: parseSessionOutput(ctx.context.options, session)
+				});
+				if (isNewUser) throw ctx.redirect(newUserCallbackURL);
+				throw ctx.redirect(callbackURL);
+			})
+		},
+		rateLimit: [{
+			pathMatcher(path) {
+				return path.startsWith("/sign-in/magic-link") || path.startsWith("/magic-link/verify");
+			},
+			window: opts.rateLimit?.window || 60,
+			max: opts.rateLimit?.max || 5
+		}],
+		options
+	};
+};
+//#endregion
+export { magicLink };

package/dist/plugins/magic-link/utils.mjs

@@ -0,0 +1,9 @@
+import { base64Url } from "@better-auth/utils/base64";
+import { createHash } from "@better-auth/utils/hash";
+//#region src/plugins/magic-link/utils.ts
+const defaultKeyHasher = async (otp) => {
+	const hash = await createHash("SHA-256").digest(new TextEncoder().encode(otp));
+	return base64Url.encode(new Uint8Array(hash), { padding: false });
+};
+//#endregion
+export { defaultKeyHasher };

package/dist/plugins/multi-session/client.d.mts

@@ -0,0 +1,19 @@
+import { MULTI_SESSION_ERROR_CODES } from "./error-codes.mjs";
+import { MultiSessionConfig, multiSession } from "./index.mjs";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/multi-session/client.d.ts
+declare const multiSessionClient: () => {
+  id: "multi-session";
+  version: string;
+  $InferServerPlugin: ReturnType<typeof multiSession>;
+  atomListeners: {
+    matcher(path: string): path is "/multi-session/set-active";
+    signal: "$sessionSignal";
+  }[];
+  $ERROR_CODES: {
+    INVALID_SESSION_TOKEN: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+  };
+};
+//#endregion
+export { multiSessionClient };

package/dist/plugins/multi-session/client.mjs

@@ -0,0 +1,19 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { MULTI_SESSION_ERROR_CODES } from "./error-codes.mjs";
+//#region src/plugins/multi-session/client.ts
+const multiSessionClient = () => {
+	return {
+		id: "multi-session",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		atomListeners: [{
+			matcher(path) {
+				return path === "/multi-session/set-active";
+			},
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: MULTI_SESSION_ERROR_CODES
+	};
+};
+//#endregion
+export { multiSessionClient };

package/dist/plugins/multi-session/error-codes.d.mts

@@ -0,0 +1,8 @@
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/multi-session/error-codes.d.ts
+declare const MULTI_SESSION_ERROR_CODES: {
+  INVALID_SESSION_TOKEN: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+};
+//#endregion
+export { MULTI_SESSION_ERROR_CODES };

package/dist/plugins/multi-session/error-codes.mjs

@@ -0,0 +1,5 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+//#region src/plugins/multi-session/error-codes.ts
+const MULTI_SESSION_ERROR_CODES = defineErrorCodes({ INVALID_SESSION_TOKEN: "Invalid session token" });
+//#endregion
+export { MULTI_SESSION_ERROR_CODES };