@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/multi-session/index.d.mts

@@ -0,0 +1,212 @@
+import { MULTI_SESSION_ERROR_CODES } from "./error-codes.mjs";
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+import * as _$better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/plugins/multi-session/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "multi-session": {
+      creator: typeof multiSession;
+    };
+  }
+}
+interface MultiSessionConfig {
+  /**
+   * The maximum number of sessions a user can have
+   * at a time
+   * @default 5
+   */
+  maximumSessions?: number | undefined;
+}
+declare const multiSession: (options?: MultiSessionConfig | undefined) => {
+  id: "multi-session";
+  version: string;
+  endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * GET `/multi-session/list-device-sessions`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.listDeviceSessions`
+     *
+     * **client:**
+     * `authClient.multiSession.listDeviceSessions`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-list-device-sessions)
+     */
+    listDeviceSessions: _$better_call0.StrictEndpoint<"/multi-session/list-device-sessions", {
+      method: "GET";
+      requireHeaders: true;
+    }, {
+      session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    }[]>;
+    /**
+     * ### Endpoint
+     *
+     * POST `/multi-session/set-active`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.setActiveSession`
+     *
+     * **client:**
+     * `authClient.multiSession.setActive`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-set-active)
+     */
+    setActiveSession: _$better_call0.StrictEndpoint<"/multi-session/set-active", {
+      method: "POST";
+      body: z.ZodObject<{
+        sessionToken: z.ZodString;
+      }, z.core.$strip>;
+      requireHeaders: true;
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      session: {
+                        $ref: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      } & Record<string, any>;
+      user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      } & Record<string, any>;
+    }>;
+    /**
+     * ### Endpoint
+     *
+     * POST `/multi-session/revoke`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.revokeDeviceSession`
+     *
+     * **client:**
+     * `authClient.multiSession.revoke`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-revoke)
+     */
+    revokeDeviceSession: _$better_call0.StrictEndpoint<"/multi-session/revoke", {
+      method: "POST";
+      body: z.ZodObject<{
+        sessionToken: z.ZodString;
+      }, z.core.$strip>;
+      requireHeaders: true;
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      status: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      status: boolean;
+    }>;
+  };
+  hooks: {
+    after: {
+      matcher: (context: _$_better_auth_core0.HookEndpointContext) => boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
+  options: MultiSessionConfig | undefined;
+  $ERROR_CODES: {
+    INVALID_SESSION_TOKEN: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+  };
+};
+//#endregion
+export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, MultiSessionConfig, multiSession };

package/dist/plugins/multi-session/index.mjs

@@ -0,0 +1,217 @@
+import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
+import { SECURE_COOKIE_PREFIX, parseCookies, parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
+import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
+import { sessionMiddleware } from "../../api/routes/session.mjs";
+import { APIError } from "../../api/index.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { MULTI_SESSION_ERROR_CODES } from "./error-codes.mjs";
+import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
+import * as z from "zod";
+//#region src/plugins/multi-session/index.ts
+const setActiveSessionBodySchema = z.object({ sessionToken: z.string().meta({ description: "The session token to set as active" }) });
+const revokeDeviceSessionBodySchema = z.object({ sessionToken: z.string().meta({ description: "The session token to revoke" }) });
+const multiSession = (options) => {
+	const opts = {
+		maximumSessions: 5,
+		...options
+	};
+	const isMultiSessionCookie = (key) => key.includes("_multi-");
+	return {
+		id: "multi-session",
+		version: PACKAGE_VERSION,
+		endpoints: {
+			/**
+			* ### Endpoint
+			*
+			* GET `/multi-session/list-device-sessions`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.listDeviceSessions`
+			*
+			* **client:**
+			* `authClient.multiSession.listDeviceSessions`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-list-device-sessions)
+			*/
+			listDeviceSessions: createAuthEndpoint("/multi-session/list-device-sessions", {
+				method: "GET",
+				requireHeaders: true
+			}, async (ctx) => {
+				const cookieHeader = ctx.headers?.get("cookie");
+				if (!cookieHeader) return ctx.json([]);
+				const cookies = Object.fromEntries(parseCookies(cookieHeader));
+				const sessionTokens = (await Promise.all(Object.entries(cookies).filter(([key]) => isMultiSessionCookie(key)).map(async ([key]) => await ctx.getSignedCookie(key, ctx.context.secret)))).filter((v) => typeof v === "string");
+				if (!sessionTokens.length) return ctx.json([]);
+				const uniqueUserSessions = (await ctx.context.internalAdapter.findSessions(sessionTokens, { onlyActiveSessions: true })).filter((session) => session && session.session.expiresAt > /* @__PURE__ */ new Date()).reduce((acc, session) => {
+					if (!acc.find((s) => s.user.id === session.user.id)) acc.push(session);
+					return acc;
+				}, []);
+				return ctx.json(uniqueUserSessions.map((item) => ({
+					session: parseSessionOutput(ctx.context.options, item.session),
+					user: parseUserOutput(ctx.context.options, item.user)
+				})));
+			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/multi-session/set-active`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.setActiveSession`
+			*
+			* **client:**
+			* `authClient.multiSession.setActive`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-set-active)
+			*/
+			setActiveSession: createAuthEndpoint("/multi-session/set-active", {
+				method: "POST",
+				body: setActiveSessionBodySchema,
+				requireHeaders: true,
+				metadata: { openapi: {
+					description: "Set the active session",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { session: { $ref: "#/components/schemas/Session" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const sessionToken = ctx.body.sessionToken;
+				const multiSessionCookieName = `${ctx.context.authCookies.sessionToken.name}_multi-${sessionToken.toLowerCase()}`;
+				const sessionCookie = await ctx.getSignedCookie(multiSessionCookieName, ctx.context.secret);
+				if (!sessionCookie) throw APIError.from("UNAUTHORIZED", MULTI_SESSION_ERROR_CODES.INVALID_SESSION_TOKEN);
+				const session = await ctx.context.internalAdapter.findSession(sessionCookie);
+				if (!session || session.session.expiresAt < /* @__PURE__ */ new Date()) {
+					expireCookie(ctx, {
+						name: multiSessionCookieName,
+						attributes: ctx.context.authCookies.sessionToken.attributes
+					});
+					throw APIError.from("UNAUTHORIZED", MULTI_SESSION_ERROR_CODES.INVALID_SESSION_TOKEN);
+				}
+				await setSessionCookie(ctx, session);
+				return ctx.json({
+					session: parseSessionOutput(ctx.context.options, session.session),
+					user: parseUserOutput(ctx.context.options, session.user)
+				});
+			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/multi-session/revoke`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.revokeDeviceSession`
+			*
+			* **client:**
+			* `authClient.multiSession.revoke`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-revoke)
+			*/
+			revokeDeviceSession: createAuthEndpoint("/multi-session/revoke", {
+				method: "POST",
+				body: revokeDeviceSessionBodySchema,
+				requireHeaders: true,
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "Revoke a device session",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const sessionToken = ctx.body.sessionToken;
+				const multiSessionCookieName = `${ctx.context.authCookies.sessionToken.name}_multi-${sessionToken.toLowerCase()}`;
+				const sessionCookie = await ctx.getSignedCookie(multiSessionCookieName, ctx.context.secret);
+				if (!sessionCookie) throw APIError.from("UNAUTHORIZED", MULTI_SESSION_ERROR_CODES.INVALID_SESSION_TOKEN);
+				await ctx.context.internalAdapter.deleteSession(sessionCookie);
+				expireCookie(ctx, {
+					name: multiSessionCookieName,
+					attributes: ctx.context.authCookies.sessionToken.attributes
+				});
+				if (!(ctx.context.session?.session.token === sessionCookie)) return ctx.json({ status: true });
+				const cookieHeader = ctx.headers?.get("cookie");
+				if (cookieHeader) {
+					const cookies = Object.fromEntries(parseCookies(cookieHeader));
+					const sessionTokens = (await Promise.all(Object.entries(cookies).filter(([key]) => isMultiSessionCookie(key)).map(async ([key]) => await ctx.getSignedCookie(key, ctx.context.secret)))).filter((v) => typeof v === "string");
+					const internalAdapter = ctx.context.internalAdapter;
+					if (sessionTokens.length > 0) {
+						const validSessions = (await internalAdapter.findSessions(sessionTokens)).filter((session) => session && session.session.expiresAt > /* @__PURE__ */ new Date());
+						if (validSessions.length > 0) {
+							const nextSession = validSessions[0];
+							await setSessionCookie(ctx, nextSession);
+						} else deleteSessionCookie(ctx);
+					} else deleteSessionCookie(ctx);
+				} else deleteSessionCookie(ctx);
+				return ctx.json({ status: true });
+			})
+		},
+		hooks: { after: [{
+			matcher: () => true,
+			handler: createAuthMiddleware(async (ctx) => {
+				const cookieString = ctx.context.responseHeaders?.get("set-cookie");
+				if (!cookieString) return;
+				const newSession = ctx.context.newSession;
+				if (!newSession) return;
+				const sessionCookieConfig = ctx.context.authCookies.sessionToken;
+				const sessionToken = newSession.session.token;
+				const cookieName = `${sessionCookieConfig.name}_multi-${sessionToken.toLowerCase()}`;
+				const setCookies = parseSetCookieHeader(cookieString);
+				const cookies = parseCookies(ctx.headers?.get("cookie") || "");
+				if (setCookies.get(cookieName) || cookies.get(cookieName)) return;
+				const multiSessionKeys = Object.keys(Object.fromEntries(cookies)).filter(isMultiSessionCookie);
+				const tokensToDelete = [];
+				for (const key of multiSessionKeys) {
+					const token = await ctx.getSignedCookie(key, ctx.context.secret);
+					if (!token) continue;
+					if ((await ctx.context.internalAdapter.findSession(token))?.user.id === newSession.user.id) {
+						tokensToDelete.push(token);
+						ctx.setCookie(key, "", {
+							...sessionCookieConfig.attributes,
+							maxAge: 0
+						});
+					}
+				}
+				if (tokensToDelete.length > 0) await ctx.context.internalAdapter.deleteSessions(tokensToDelete);
+				if (multiSessionKeys.length - tokensToDelete.length + (cookieString.includes(sessionCookieConfig.name) ? 1 : 0) > opts.maximumSessions) return;
+				await ctx.setSignedCookie(cookieName, sessionToken, ctx.context.secret, sessionCookieConfig.attributes);
+			})
+		}, {
+			matcher: (context) => context.path === "/sign-out",
+			handler: createAuthMiddleware(async (ctx) => {
+				const cookieHeader = ctx.headers?.get("cookie");
+				if (!cookieHeader) return;
+				const cookies = Object.fromEntries(parseCookies(cookieHeader));
+				const multiSessionKeys = Object.keys(cookies).filter((key) => isMultiSessionCookie(key));
+				const verifiedTokens = (await Promise.all(multiSessionKeys.map(async (key) => {
+					const verifiedToken = await ctx.getSignedCookie(key, ctx.context.secret);
+					if (verifiedToken) {
+						expireCookie(ctx, {
+							name: key.toLowerCase().replace(SECURE_COOKIE_PREFIX.toLowerCase(), SECURE_COOKIE_PREFIX),
+							attributes: ctx.context.authCookies.sessionToken.attributes
+						});
+						return verifiedToken;
+					}
+					return null;
+				}))).filter((v) => typeof v === "string");
+				if (verifiedTokens.length > 0) await ctx.context.internalAdapter.deleteSessions(verifiedTokens);
+			})
+		}] },
+		options,
+		$ERROR_CODES: MULTI_SESSION_ERROR_CODES
+	};
+};
+//#endregion
+export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, multiSession };

package/dist/plugins/oauth-popup/client.d.mts

@@ -0,0 +1,82 @@
+import { POPUP_TOKEN_STORAGE_KEY } from "./constants.mjs";
+import { OAUTH_POPUP_ERROR_CODES } from "./error-codes.mjs";
+import { oauthPopup } from "./index.mjs";
+import { BetterAuthClientOptions, ClientStore } from "@better-auth/core";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+import { BetterFetch, BetterFetchPlugin } from "@better-fetch/fetch";
+
+//#region src/plugins/oauth-popup/client.d.ts
+/** Inputs for `authClient.signIn.popup`; mirror the redirect sign-in. */
+interface SignInPopupOptions {
+  /** Built-in social provider id (e.g. `"google"`). */
+  provider?: string;
+  /** Generic OAuth provider id (registered via `genericOAuth`). */
+  providerId?: string;
+  callbackURL?: string;
+  errorCallbackURL?: string;
+  newUserCallbackURL?: string;
+  requestSignUp?: boolean;
+  scopes?: string[];
+  additionalData?: Record<string, unknown>;
+  /** `window.open` feature string; defaults to a centered 500x600 window. */
+  windowFeatures?: string;
+  /** How long (ms) to wait for the popup to complete. Default 5 minutes. */
+  timeoutMs?: number;
+}
+interface SignInPopupResult {
+  data: {
+    success: boolean;
+  } | null;
+  error: {
+    code: string;
+    message: string;
+    status?: number;
+  } | null;
+}
+/** Reads the stored popup token (browser-only; null otherwise). */
+declare function getStoredPopupToken(): string | null;
+/**
+ * Attaches the popup token as a bearer header when embedded (where the cookie is
+ * partitioned), and clears it once the session ends so it can't be reused.
+ */
+declare const popupBearerFetchPlugin: BetterFetchPlugin;
+interface SignInPopupDeps {
+  $fetch: BetterFetch;
+  options?: BetterAuthClientOptions | undefined;
+  /** Refreshes the reactive session, as the redirect flow's atom listeners do. */
+  notifySessionSignal: () => void;
+}
+/**
+ * Builds `signIn.popup`. Runs the sign-in in the popup's own first-party
+ * context (so the OAuth state cookie lands there), waits for the completion
+ * page to post the session token back, stores it for the bearer fetch plugin,
+ * and refreshes the reactive session.
+ */
+declare function createSignInPopup({
+  $fetch,
+  options,
+  notifySessionSignal
+}: SignInPopupDeps): (opts: SignInPopupOptions) => Promise<SignInPopupResult>;
+/**
+ * Client plugin for popup OAuth sign-in. Adds `authClient.signIn.popup`. Pair
+ * with the server `oauthPopup` and `bearer` plugins.
+ */
+declare const oauthPopupClient: () => {
+  id: "oauth-popup";
+  version: string;
+  $InferServerPlugin: ReturnType<typeof oauthPopup>;
+  $ERROR_CODES: {
+    POPUP_SIGN_IN_FAILED: _$_better_auth_core_utils_error_codes0.RawError<"POPUP_SIGN_IN_FAILED">;
+    POPUP_BLOCKED: _$_better_auth_core_utils_error_codes0.RawError<"POPUP_BLOCKED">;
+    POPUP_CLOSED: _$_better_auth_core_utils_error_codes0.RawError<"POPUP_CLOSED">;
+    POPUP_TIMEOUT: _$_better_auth_core_utils_error_codes0.RawError<"POPUP_TIMEOUT">;
+  };
+  fetchPlugins: BetterFetchPlugin[];
+  getActions: ($fetch: BetterFetch, $store: ClientStore, options: BetterAuthClientOptions | undefined) => {
+    signIn: {
+      popup: (opts: SignInPopupOptions) => Promise<SignInPopupResult>;
+    };
+  };
+};
+//#endregion
+export { SignInPopupOptions, SignInPopupResult, createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };