@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/utils/password.mjs

@@ -0,0 +1,32 @@
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+//#region src/utils/password.ts
+async function validatePassword(ctx, data) {
+	const credentialAccount = await ctx.context.internalAdapter.findCredentialAccount(data.userId);
+	const currentPassword = credentialAccount?.password;
+	if (!credentialAccount || !currentPassword) return false;
+	return await ctx.context.password.verify({
+		hash: currentPassword,
+		password: data.password
+	});
+}
+async function checkPassword(userId, c) {
+	const credentialAccount = await c.context.internalAdapter.findCredentialAccount(userId);
+	const currentPassword = credentialAccount?.password;
+	const password = c.body.password;
+	if (!credentialAccount || !currentPassword || !password) {
+		if (password) await c.context.password.hash(password);
+		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
+	}
+	if (!await c.context.password.verify({
+		hash: currentPassword,
+		password
+	})) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
+	return true;
+}
+async function shouldRequirePassword(ctx, userId, allowPasswordless) {
+	if (!allowPasswordless) return true;
+	const credentialAccount = await ctx.context.internalAdapter.findCredentialAccount(userId);
+	return Boolean(credentialAccount?.password);
+}
+//#endregion
+export { checkPassword, shouldRequirePassword, validatePassword };

package/dist/utils/plugin-helper.mjs

@@ -0,0 +1,14 @@
+import { isAPIError } from "./is-api-error.mjs";
+//#region src/utils/plugin-helper.ts
+const getEndpointResponse = async (ctx) => {
+	const returned = ctx.context.returned;
+	if (!returned) return null;
+	if (returned instanceof Response) {
+		if (returned.status !== 200) return null;
+		return await returned.clone().json();
+	}
+	if (isAPIError(returned)) return null;
+	return returned;
+};
+//#endregion
+export { getEndpointResponse };

package/dist/utils/request.mjs

@@ -0,0 +1,23 @@
+//#region src/utils/request.ts
+function safeCloneRequest(request) {
+	if (!request) return;
+	try {
+		return request.clone();
+	} catch {
+		return new Request(request.url, {
+			cache: request.cache,
+			credentials: request.credentials,
+			headers: request.headers,
+			integrity: request.integrity,
+			keepalive: request.keepalive,
+			method: request.method,
+			mode: request.mode,
+			redirect: request.redirect,
+			referrer: request.referrer,
+			referrerPolicy: request.referrerPolicy,
+			signal: request.signal
+		});
+	}
+}
+//#endregion
+export { safeCloneRequest };

package/dist/utils/shim.mjs

@@ -0,0 +1,22 @@
+//#region src/utils/shim.ts
+const shimContext = (originalObject, newContext) => {
+	const shimmedObj = {};
+	for (const [key, value] of Object.entries(originalObject)) {
+		shimmedObj[key] = (ctx) => {
+			return value({
+				...ctx,
+				context: {
+					...newContext,
+					...ctx.context
+				}
+			});
+		};
+		shimmedObj[key].path = value.path;
+		shimmedObj[key].method = value.method;
+		shimmedObj[key].options = value.options;
+		shimmedObj[key].headers = value.headers;
+	}
+	return shimmedObj;
+};
+//#endregion
+export { shimContext };

package/dist/utils/time.d.mts

@@ -0,0 +1,48 @@
+//#region src/utils/time.d.ts
+type Years = "years" | "year" | "yrs" | "yr" | "y";
+type Months = "months" | "month" | "mo";
+type Weeks = "weeks" | "week" | "w";
+type Days = "days" | "day" | "d";
+type Hours = "hours" | "hour" | "hrs" | "hr" | "h";
+type Minutes = "minutes" | "minute" | "mins" | "min" | "m";
+type Seconds = "seconds" | "second" | "secs" | "sec" | "s";
+type Unit = Years | Months | Weeks | Days | Hours | Minutes | Seconds;
+type UnitAnyCase = Capitalize<Unit> | Uppercase<Unit> | Unit;
+type Suffix = " ago" | " from now";
+type Prefix = "+" | "-" | "+ " | "- ";
+type BaseTimeString = `${number}${UnitAnyCase}` | `${number} ${UnitAnyCase}`;
+/**
+ * A typed string representing a time duration.
+ * Supports formats like "7d", "30m", "1 hour", "2 hours ago", "-5m", etc.
+ */
+type TimeString = BaseTimeString | `${BaseTimeString}${Suffix}` | `${Prefix}${BaseTimeString}`;
+/**
+ * Parse a time string and return the value in milliseconds.
+ *
+ * @param value - A time string like "7d", "30m", "1 hour", "2 hours ago"
+ * @returns The parsed value in milliseconds
+ * @throws TypeError if the string format is invalid
+ *
+ * @example
+ * ms("1d")          // 86400000
+ * ms("2 hours")     // 7200000
+ * ms("30s")         // 30000
+ * ms("2 hours ago") // -7200000
+ */
+declare function ms(value: TimeString): number;
+/**
+ * Parse a time string and return the value in seconds.
+ *
+ * @param value - A time string like "7d", "30m", "1 hour", "2 hours ago"
+ * @returns The parsed value in seconds (rounded)
+ * @throws TypeError if the string format is invalid
+ *
+ * @example
+ * sec("1d")          // 86400
+ * sec("2 hours")     // 7200
+ * sec("-30s")        // -30
+ * sec("2 hours ago") // -7200
+ */
+declare function sec(value: TimeString): number;
+//#endregion
+export { TimeString, ms, sec };

package/dist/utils/time.mjs

@@ -0,0 +1,98 @@
+//#region src/utils/time.ts
+const SEC = 1e3;
+const MIN = SEC * 60;
+const HOUR = MIN * 60;
+const DAY = HOUR * 24;
+const WEEK = DAY * 7;
+const MONTH = DAY * 30;
+const YEAR = DAY * 365.25;
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|months?|mo|years?|yrs?|y)(?: (ago|from now))?$/i;
+function parse(value) {
+	const match = REGEX.exec(value);
+	if (!match || match[4] && match[1]) throw new TypeError(`Invalid time string format: "${value}". Use formats like "7d", "30m", "1 hour", etc.`);
+	const n = parseFloat(match[2]);
+	const unit = match[3].toLowerCase();
+	let result;
+	switch (unit) {
+		case "years":
+		case "year":
+		case "yrs":
+		case "yr":
+		case "y":
+			result = n * YEAR;
+			break;
+		case "months":
+		case "month":
+		case "mo":
+			result = n * MONTH;
+			break;
+		case "weeks":
+		case "week":
+		case "w":
+			result = n * WEEK;
+			break;
+		case "days":
+		case "day":
+		case "d":
+			result = n * DAY;
+			break;
+		case "hours":
+		case "hour":
+		case "hrs":
+		case "hr":
+		case "h":
+			result = n * HOUR;
+			break;
+		case "minutes":
+		case "minute":
+		case "mins":
+		case "min":
+		case "m":
+			result = n * MIN;
+			break;
+		case "seconds":
+		case "second":
+		case "secs":
+		case "sec":
+		case "s":
+			result = n * SEC;
+			break;
+		default: throw new TypeError(`Unknown time unit: "${unit}"`);
+	}
+	if (match[1] === "-" || match[4] === "ago") return -result;
+	return result;
+}
+/**
+* Parse a time string and return the value in milliseconds.
+*
+* @param value - A time string like "7d", "30m", "1 hour", "2 hours ago"
+* @returns The parsed value in milliseconds
+* @throws TypeError if the string format is invalid
+*
+* @example
+* ms("1d")          // 86400000
+* ms("2 hours")     // 7200000
+* ms("30s")         // 30000
+* ms("2 hours ago") // -7200000
+*/
+function ms(value) {
+	return parse(value);
+}
+/**
+* Parse a time string and return the value in seconds.
+*
+* @param value - A time string like "7d", "30m", "1 hour", "2 hours ago"
+* @returns The parsed value in seconds (rounded)
+* @throws TypeError if the string format is invalid
+*
+* @example
+* sec("1d")          // 86400
+* sec("2 hours")     // 7200
+* sec("-30s")        // -30
+* sec("2 hours ago") // -7200
+*/
+function sec(value) {
+	return Math.round(parse(value) / 1e3);
+}
+//#endregion
+export { ms, sec };

package/dist/utils/url.d.mts

@@ -0,0 +1,78 @@
+import { BaseURLConfig, DynamicBaseURLConfig } from "@better-auth/core";
+
+//#region src/utils/url.d.ts
+declare function trimTrailingSlashes(value: string): string;
+declare function getBaseURL(url?: string, path?: string, request?: Request, loadEnv?: boolean, trustedProxyHeaders?: boolean | undefined): string | undefined;
+declare function getOrigin(url: string): string | null;
+declare function getProtocol(url: string): string | null;
+declare function getHost(url: string): string | null;
+/**
+ * Checks if the baseURL config is a dynamic config object
+ */
+declare function isDynamicBaseURLConfig(config: BaseURLConfig | undefined): config is DynamicBaseURLConfig;
+/**
+ * Check if a value is a `Request`
+ * - `instanceof`: works for native Request instances
+ * - `toString`: handles where instanceof check fails but the object is still a
+ *   valid Request (e.g. cross-realm, polyfills). Paired with a shape check so
+ *   an object that only spoofs `Symbol.toStringTag` without the real shape is
+ *   rejected before downstream code tries to read `.headers` / `.url`.
+ *
+ * @param value The value to check
+ * @returns `true` if the value is a Request instance
+ */
+declare function isRequestLike(value: unknown): value is Request;
+/**
+ * Extracts the host from a `Request` or `Headers`.
+ * Honors `x-forwarded-host` only when `trustedProxyHeaders` is enabled,
+ * then falls back to the `host` header and finally the request URL.
+ */
+declare function getHostFromSource(source: Request | Headers, trustedProxyHeaders?: boolean): string | null;
+/**
+ * Extracts the protocol from a `Request` or `Headers`.
+ * Honors `x-forwarded-proto` only when `trustedProxyHeaders` is enabled,
+ * then falls back to the request URL, then to "https".
+ */
+declare function getProtocolFromSource(source: Request | Headers, configProtocol?: "http" | "https" | "auto" | undefined, trustedProxyHeaders?: boolean): "http" | "https";
+/**
+ * Matches a hostname against a host pattern.
+ * Supports wildcard patterns like `*.vercel.app` or `preview-*.myapp.com`.
+ *
+ * @param host The hostname to test (e.g., "myapp.com", "preview-123.vercel.app")
+ * @param pattern The host pattern (e.g., "myapp.com", "*.vercel.app")
+ * @returns {boolean} true if the host matches the pattern, false otherwise.
+ *
+ * @example
+ * ```ts
+ * matchesHostPattern("myapp.com", "myapp.com") // true
+ * matchesHostPattern("preview-123.vercel.app", "*.vercel.app") // true
+ * matchesHostPattern("preview-123.myapp.com", "preview-*.myapp.com") // true
+ * matchesHostPattern("evil.com", "myapp.com") // false
+ * ```
+ */
+declare const matchesHostPattern: (host: string, pattern: string) => boolean;
+/**
+ * Resolves the base URL from a dynamic config based on the incoming request.
+ * Validates the derived host against the allowedHosts allowlist.
+ *
+ * @param config The dynamic base URL config
+ * @param request The incoming request
+ * @param basePath The base path to append
+ * @returns The resolved base URL with path
+ * @throws BetterAuthError if host is not in allowedHosts and no fallback is set
+ */
+declare function resolveDynamicBaseURL(config: DynamicBaseURLConfig, source: Request | Headers, basePath: string, trustedProxyHeaders?: boolean): string;
+/**
+ * Resolves the base URL from any config type (static string or dynamic object).
+ * This is the main entry point for base URL resolution.
+ *
+ * @param config The base URL config (string or object)
+ * @param basePath The base path to append
+ * @param request Optional request for dynamic resolution
+ * @param loadEnv Whether to load from environment variables
+ * @param trustedProxyHeaders Whether to trust proxy headers (for legacy behavior)
+ * @returns The resolved base URL with path
+ */
+declare function resolveBaseURL(config: BaseURLConfig | undefined, basePath: string, source?: Request | Headers, loadEnv?: boolean, trustedProxyHeaders?: boolean): string | undefined;
+//#endregion
+export { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/dist/utils/url.mjs

@@ -0,0 +1,238 @@
+import { wildcardMatch } from "./wildcard.mjs";
+import { env } from "@better-auth/core/env";
+import { BetterAuthError } from "@better-auth/core/error";
+//#region src/utils/url.ts
+const SLASH_CHAR_CODE = "/".charCodeAt(0);
+/**
+* Minimal loopback check for dev scheme inference only. Reachable from
+* `client/config.ts` via `getBaseURL`, so we MUST NOT import the full
+* `@better-auth/core/utils/host` classifier here: its `utils/ip` dependency
+* on zod would leak into the client bundle (see `e2e/smoke/test/vite.spec.ts`).
+*
+* Server-side SSRF/loopback checks (oauth redirect matching, trusted-origin
+* resolution, electron fetch gate) continue to use the authoritative
+* `isLoopbackHost` from `@better-auth/core/utils/host`. This helper's only
+* job is picking `http` vs `https` for dev ergonomics.
+*/
+function isLoopbackForDevScheme(host) {
+	const hostname = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase();
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname.startsWith("127.");
+}
+function trimTrailingSlashes(value) {
+	let end = value.length;
+	while (end > 0 && value.charCodeAt(end - 1) === SLASH_CHAR_CODE) end--;
+	return end === value.length ? value : value.slice(0, end);
+}
+function checkHasPath(url) {
+	try {
+		return (trimTrailingSlashes(new URL(url).pathname) || "/") !== "/";
+	} catch {
+		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`);
+	}
+}
+function assertHasProtocol(url) {
+	try {
+		const parsedUrl = new URL(url);
+		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new BetterAuthError(`Invalid base URL: ${url}. URL must include 'http://' or 'https://'`);
+	} catch (error) {
+		if (error instanceof BetterAuthError) throw error;
+		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`, { cause: error });
+	}
+}
+function withPath(url, path = "/api/auth") {
+	assertHasProtocol(url);
+	if (checkHasPath(url)) return url;
+	const trimmedUrl = trimTrailingSlashes(url);
+	if (!path || path === "/") return trimmedUrl;
+	path = path.startsWith("/") ? path : `/${path}`;
+	return `${trimmedUrl}${path}`;
+}
+function validateProxyHeader(header, type) {
+	if (!header || header.trim() === "") return false;
+	if (type === "proto") return header === "http" || header === "https";
+	if (type === "host") {
+		if ([
+			/\.\./,
+			/\0/,
+			/[\s]/,
+			/^[.]/,
+			/[<>'"]/,
+			/javascript:/i,
+			/file:/i,
+			/data:/i
+		].some((pattern) => pattern.test(header))) return false;
+		return /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(header) || /^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(header) || /^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(header) || /^localhost(:[0-9]{1,5})?$/i.test(header);
+	}
+	return false;
+}
+function getBaseURL(url, path, request, loadEnv, trustedProxyHeaders) {
+	if (url) return withPath(url, path);
+	if (loadEnv !== false) {
+		const fromEnv = env.BETTER_AUTH_URL || env.NEXT_PUBLIC_BETTER_AUTH_URL || env.PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_AUTH_URL || (env.BASE_URL !== "/" ? env.BASE_URL : void 0);
+		if (fromEnv) return withPath(fromEnv, path);
+	}
+	const fromRequest = request?.headers.get("x-forwarded-host");
+	const fromRequestProto = request?.headers.get("x-forwarded-proto");
+	if (fromRequest && fromRequestProto && trustedProxyHeaders) {
+		if (validateProxyHeader(fromRequestProto, "proto") && validateProxyHeader(fromRequest, "host")) try {
+			return withPath(`${fromRequestProto}://${fromRequest}`, path);
+		} catch (_error) {}
+	}
+	if (request) {
+		const url = getOrigin(request.url);
+		if (!url) throw new BetterAuthError("Could not get origin from request. Please provide a valid base URL.");
+		return withPath(url, path);
+	}
+	if (typeof window !== "undefined" && window.location) return withPath(window.location.origin, path);
+}
+function getOrigin(url) {
+	try {
+		const parsedUrl = new URL(url);
+		return parsedUrl.origin === "null" ? null : parsedUrl.origin;
+	} catch {
+		return null;
+	}
+}
+function getProtocol(url) {
+	try {
+		return new URL(url).protocol;
+	} catch {
+		return null;
+	}
+}
+function getHost(url) {
+	try {
+		return new URL(url).host;
+	} catch {
+		return null;
+	}
+}
+/**
+* Checks if the baseURL config is a dynamic config object
+*/
+function isDynamicBaseURLConfig(config) {
+	return typeof config === "object" && config !== null && "allowedHosts" in config && Array.isArray(config.allowedHosts);
+}
+/**
+* Check if a value is a `Request`
+* - `instanceof`: works for native Request instances
+* - `toString`: handles where instanceof check fails but the object is still a
+*   valid Request (e.g. cross-realm, polyfills). Paired with a shape check so
+*   an object that only spoofs `Symbol.toStringTag` without the real shape is
+*   rejected before downstream code tries to read `.headers` / `.url`.
+*
+* @param value The value to check
+* @returns `true` if the value is a Request instance
+*/
+function isRequestLike(value) {
+	if (value instanceof Request) return true;
+	if (typeof value !== "object" || value === null || Object.prototype.toString.call(value) !== "[object Request]") return false;
+	const v = value;
+	return typeof v.url === "string" && typeof v.headers === "object" && v.headers !== null && typeof v.headers.get === "function";
+}
+/**
+* Extracts the host from a `Request` or `Headers`.
+* Honors `x-forwarded-host` only when `trustedProxyHeaders` is enabled,
+* then falls back to the `host` header and finally the request URL.
+*/
+function getHostFromSource(source, trustedProxyHeaders) {
+	const headers = isRequestLike(source) ? source.headers : source;
+	if (trustedProxyHeaders) {
+		const forwardedHost = headers.get("x-forwarded-host");
+		if (forwardedHost && validateProxyHeader(forwardedHost, "host")) return forwardedHost;
+	}
+	const host = headers.get("host");
+	if (host && validateProxyHeader(host, "host")) return host;
+	if (isRequestLike(source)) try {
+		return new URL(source.url).host;
+	} catch {
+		return null;
+	}
+	return null;
+}
+/**
+* Extracts the protocol from a `Request` or `Headers`.
+* Honors `x-forwarded-proto` only when `trustedProxyHeaders` is enabled,
+* then falls back to the request URL, then to "https".
+*/
+function getProtocolFromSource(source, configProtocol, trustedProxyHeaders) {
+	if (configProtocol === "http" || configProtocol === "https") return configProtocol;
+	const headers = isRequestLike(source) ? source.headers : source;
+	if (trustedProxyHeaders) {
+		const forwardedProto = headers.get("x-forwarded-proto");
+		if (forwardedProto && validateProxyHeader(forwardedProto, "proto")) return forwardedProto;
+	}
+	if (isRequestLike(source)) try {
+		const url = new URL(source.url);
+		if (url.protocol === "http:" || url.protocol === "https:") return url.protocol.slice(0, -1);
+	} catch {}
+	const host = getHostFromSource(source, trustedProxyHeaders);
+	if (host && isLoopbackForDevScheme(host)) return "http";
+	return "https";
+}
+/**
+* Matches a hostname against a host pattern.
+* Supports wildcard patterns like `*.vercel.app` or `preview-*.myapp.com`.
+*
+* @param host The hostname to test (e.g., "myapp.com", "preview-123.vercel.app")
+* @param pattern The host pattern (e.g., "myapp.com", "*.vercel.app")
+* @returns {boolean} true if the host matches the pattern, false otherwise.
+*
+* @example
+* ```ts
+* matchesHostPattern("myapp.com", "myapp.com") // true
+* matchesHostPattern("preview-123.vercel.app", "*.vercel.app") // true
+* matchesHostPattern("preview-123.myapp.com", "preview-*.myapp.com") // true
+* matchesHostPattern("evil.com", "myapp.com") // false
+* ```
+*/
+const matchesHostPattern = (host, pattern) => {
+	if (!host || !pattern) return false;
+	const normalizedHost = host.replace(/^https?:\/\//, "").split("/")[0].toLowerCase();
+	const normalizedPattern = pattern.replace(/^https?:\/\//, "").split("/")[0].toLowerCase();
+	if (normalizedPattern.includes("*") || normalizedPattern.includes("?")) return wildcardMatch(normalizedPattern)(normalizedHost);
+	return normalizedHost.toLowerCase() === normalizedPattern.toLowerCase();
+};
+/**
+* Resolves the base URL from a dynamic config based on the incoming request.
+* Validates the derived host against the allowedHosts allowlist.
+*
+* @param config The dynamic base URL config
+* @param request The incoming request
+* @param basePath The base path to append
+* @returns The resolved base URL with path
+* @throws BetterAuthError if host is not in allowedHosts and no fallback is set
+*/
+function resolveDynamicBaseURL(config, source, basePath, trustedProxyHeaders) {
+	const host = getHostFromSource(source, trustedProxyHeaders);
+	if (!host) {
+		if (config.fallback) return withPath(config.fallback, basePath);
+		throw new BetterAuthError("Could not determine host from request headers. Please provide a fallback URL in your baseURL config.");
+	}
+	if (config.allowedHosts.some((pattern) => matchesHostPattern(host, pattern))) return withPath(`${getProtocolFromSource(source, config.protocol, trustedProxyHeaders)}://${host}`, basePath);
+	if (config.fallback) return withPath(config.fallback, basePath);
+	throw new BetterAuthError(`Host "${host}" is not in the allowed hosts list. Allowed hosts: ${config.allowedHosts.join(", ")}. Add this host to your allowedHosts config or provide a fallback URL.`);
+}
+/**
+* Resolves the base URL from any config type (static string or dynamic object).
+* This is the main entry point for base URL resolution.
+*
+* @param config The base URL config (string or object)
+* @param basePath The base path to append
+* @param request Optional request for dynamic resolution
+* @param loadEnv Whether to load from environment variables
+* @param trustedProxyHeaders Whether to trust proxy headers (for legacy behavior)
+* @returns The resolved base URL with path
+*/
+function resolveBaseURL(config, basePath, source, loadEnv, trustedProxyHeaders) {
+	if (isDynamicBaseURLConfig(config)) {
+		if (source) return resolveDynamicBaseURL(config, source, basePath, trustedProxyHeaders);
+		if (config.fallback) return withPath(config.fallback, basePath);
+		return getBaseURL(void 0, basePath, void 0, loadEnv, trustedProxyHeaders);
+	}
+	const request = isRequestLike(source) ? source : void 0;
+	if (typeof config === "string") return getBaseURL(config, basePath, request, loadEnv, trustedProxyHeaders);
+	return getBaseURL(void 0, basePath, request, loadEnv, trustedProxyHeaders);
+}
+//#endregion
+export { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/dist/utils/validate-user-info.mjs

@@ -0,0 +1,44 @@
+import { APIError } from "@better-auth/core/error";
+//#region src/utils/validate-user-info.ts
+function assertValidUserInfoSource(source) {
+	if (!source?.method) throw new APIError("FORBIDDEN", {
+		code: "validation_source_missing",
+		message: "User validation source is required"
+	});
+	if (source.method === "oauth" && !source.oauth?.providerId) throw new APIError("FORBIDDEN", {
+		code: "validation_source_missing",
+		message: "OAuth user validation source requires oauth.providerId"
+	});
+	if ((source.method === "sso-oidc" || source.method === "sso-saml") && !source.sso?.providerId) throw new APIError("FORBIDDEN", {
+		code: "validation_source_missing",
+		message: "SSO user validation source requires sso.providerId"
+	});
+}
+/**
+* Invoke the application's `user.validateUserInfo` gate and throw a `403`
+* {@link APIError} if it rejects.
+*
+* Fails closed: if the hook throws, provisioning is rejected rather than
+* silently allowed.
+*/
+async function assertValidUserInfo(ctx, data) {
+	const validate = ctx.context.options.user?.validateUserInfo;
+	if (!validate) return;
+	assertValidUserInfoSource(data.source);
+	let result;
+	try {
+		result = await validate(data, ctx);
+	} catch (error) {
+		ctx.context.logger.error("validateUserInfo callback threw", error);
+		throw new APIError("FORBIDDEN", {
+			code: "validation_failed",
+			message: "User validation failed"
+		});
+	}
+	if (result?.error) throw new APIError("FORBIDDEN", {
+		code: result.error,
+		message: result.errorDescription || result.error
+	});
+}
+//#endregion
+export { assertValidUserInfo, assertValidUserInfoSource };