@meistrari/auth-core 2.7.0 → 2.9.0

package/dist/index.d.mts

@@ -908,10 +908,10 @@ declare class ApplicationService {
      * on the verification URI to authorize the device.
      *
      * @param requesterApplicationId - The application requesting authorization
-     * @param targetApplicationId - The target application to gain access to
+     * @param targetApplicationId - The target application to gain access to. Omit it to sign the user in to the requester application itself.
      * @returns Device authorization details including codes and verification URI
      */
-    startDeviceAuthorizationFlow(requesterApplicationId: string, targetApplicationId: string): Promise<DeviceAuthorizationResponse>;
+    startDeviceAuthorizationFlow(requesterApplicationId: string, targetApplicationId?: string): Promise<DeviceAuthorizationResponse>;
     /**
      * Retrieves the context for a pending device authorization request.
      *
@@ -3423,7 +3423,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: StartAuthorizationFlowResponse;
                     error: null;
                 }>;
-                startDeviceAuthorizationFlow: (requesterApplicationId: string, targetApplicationId: string) => Promise<{
+                startDeviceAuthorizationFlow: (requesterApplicationId: string, targetApplicationId?: string) => Promise<{
                     data: null;
                     error: {
                         message?: string | undefined;
@@ -5123,14 +5123,14 @@ declare class AdminService {
      * Requests an application management route.
      *
      * These routes are served by the API itself rather than by the Better Auth
-     * handler, so they sit outside the `/api/auth` base path that the Better
-     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
-     * authenticate with the session cookie alone; a bearer token must never be
-     * attached, since the API reads one only as an internal API key and would
-     * reject the request.
+     * handler, so they sit outside the `/api/auth` base path. The request is
+     * sent to an absolute URL resolved against the API root, which better-fetch
+     * uses as-is instead of prefixing the client's base URL, so it still goes
+     * through {@link APIClient.$fetch} and picks up every fetch option the
+     * client was created with (hooks, default headers, custom fetch, cookies).
      *
-     * @param path - Path relative to the API root, without a leading slash
-     * @param request - Method, body, and query parameters
+     * @param path - Path relative to the API root, without a leading slash; `:name` segments are filled from `request.params`
+     * @param request - Method, body, query, and path parameters
      * @returns The parsed JSON response
      */
     private requestApplicationRoute;

package/dist/index.d.ts

@@ -908,10 +908,10 @@ declare class ApplicationService {
      * on the verification URI to authorize the device.
      *
      * @param requesterApplicationId - The application requesting authorization
-     * @param targetApplicationId - The target application to gain access to
+     * @param targetApplicationId - The target application to gain access to. Omit it to sign the user in to the requester application itself.
      * @returns Device authorization details including codes and verification URI
      */
-    startDeviceAuthorizationFlow(requesterApplicationId: string, targetApplicationId: string): Promise<DeviceAuthorizationResponse>;
+    startDeviceAuthorizationFlow(requesterApplicationId: string, targetApplicationId?: string): Promise<DeviceAuthorizationResponse>;
     /**
      * Retrieves the context for a pending device authorization request.
      *
@@ -3423,7 +3423,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: StartAuthorizationFlowResponse;
                     error: null;
                 }>;
-                startDeviceAuthorizationFlow: (requesterApplicationId: string, targetApplicationId: string) => Promise<{
+                startDeviceAuthorizationFlow: (requesterApplicationId: string, targetApplicationId?: string) => Promise<{
                     data: null;
                     error: {
                         message?: string | undefined;
@@ -5123,14 +5123,14 @@ declare class AdminService {
      * Requests an application management route.
      *
      * These routes are served by the API itself rather than by the Better Auth
-     * handler, so they sit outside the `/api/auth` base path that the Better
-     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
-     * authenticate with the session cookie alone; a bearer token must never be
-     * attached, since the API reads one only as an internal API key and would
-     * reject the request.
+     * handler, so they sit outside the `/api/auth` base path. The request is
+     * sent to an absolute URL resolved against the API root, which better-fetch
+     * uses as-is instead of prefixing the client's base URL, so it still goes
+     * through {@link APIClient.$fetch} and picks up every fetch option the
+     * client was created with (hooks, default headers, custom fetch, cookies).
      *
-     * @param path - Path relative to the API root, without a leading slash
-     * @param request - Method, body, and query parameters
+     * @param path - Path relative to the API root, without a leading slash; `:name` segments are filled from `request.params`
+     * @param request - Method, body, query, and path parameters
      * @returns The parsed JSON response
      */
     private requestApplicationRoute;

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "2.7.0";
+const version = "2.9.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -512,19 +512,12 @@ class ApplicationRouteError extends Error {
   code;
   details;
   status;
-  constructor(response, body) {
-    super(body?.error ?? body?.message ?? response.statusText);
+  constructor(body) {
+    super(body.error ?? body.message ?? body.statusText);
     this.name = "ApplicationRouteError";
-    this.status = response.status;
-    this.code = body?.code;
-    this.details = body?.details;
-  }
-}
-async function readErrorBody(response) {
-  try {
-    return await response.json();
-  } catch {
-    return null;
+    this.status = body.status;
+    this.code = body.code;
+    this.details = body.details;
   }
 }
 class AdminService {
@@ -545,35 +538,35 @@ class AdminService {
    * Requests an application management route.
    *
    * These routes are served by the API itself rather than by the Better Auth
-   * handler, so they sit outside the `/api/auth` base path that the Better
-   * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
-   * authenticate with the session cookie alone; a bearer token must never be
-   * attached, since the API reads one only as an internal API key and would
-   * reject the request.
-   *
-   * @param path - Path relative to the API root, without a leading slash
-   * @param request - Method, body, and query parameters
+   * handler, so they sit outside the `/api/auth` base path. The request is
+   * sent to an absolute URL resolved against the API root, which better-fetch
+   * uses as-is instead of prefixing the client's base URL, so it still goes
+   * through {@link APIClient.$fetch} and picks up every fetch option the
+   * client was created with (hooks, default headers, custom fetch, cookies).
+   *
+   * @param path - Path relative to the API root, without a leading slash; `:name` segments are filled from `request.params`
+   * @param request - Method, body, query, and path parameters
    * @returns The parsed JSON response
    */
   async requestApplicationRoute(path, request = {}) {
     const base = this.apiUrl.endsWith("/") ? this.apiUrl : `${this.apiUrl}/`;
-    const url = new URL(path, base);
-    for (const [key, value] of Object.entries(request.query ?? {})) {
-      if (value !== void 0)
-        url.searchParams.set(key, String(value));
-    }
-    const headers = new Headers({ Accept: "application/json" });
-    if (request.body !== void 0)
-      headers.set("Content-Type", "application/json");
-    const response = await fetch(url, {
+    const hasBody = request.body !== void 0;
+    const { data, error } = await this.client.$fetch(`${base}${path}`, {
       method: request.method ?? "GET",
-      credentials: "include",
-      headers,
-      ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {}
+      params: request.params,
+      query: request.query,
+      headers: {
+        Accept: "application/json",
+        ...hasBody ? { "Content-Type": "application/json" } : {}
+      },
+      ...hasBody ? { body: JSON.stringify(request.body) } : {},
+      // The client's parser revives ISO strings into Dates; these routes are typed with plain strings
+      jsonParser: (text) => JSON.parse(text),
+      throw: false
     });
-    if (!response.ok)
-      throw new ApplicationRouteError(response, await readErrorBody(response));
-    return await response.json();
+    if (error)
+      throw new ApplicationRouteError(error);
+    return data;
   }
   /**
    * Lists applications, optionally filtered by organization.
@@ -614,7 +607,8 @@ class AdminService {
    * @returns The updated application
    */
   async updateApplication(applicationId, options) {
-    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}`, {
+    return await this.requestApplicationRoute("applications/:applicationId", {
+      params: { applicationId },
       method: "PUT",
       body: options
     });
@@ -622,28 +616,29 @@ class AdminService {
   /** Lists the role catalog for an application. */
   async listApplicationRoles(applicationId) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/roles`
+      "applications/:applicationId/roles",
+      { params: { applicationId } }
     );
   }
   /** Creates an application-scoped role definition. */
   async createApplicationRole(applicationId, options) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/roles`,
-      { method: "POST", body: options }
+      "applications/:applicationId/roles",
+      { params: { applicationId }, method: "POST", body: options }
     );
   }
   /** Updates an application-scoped role definition. */
   async updateApplicationRole(applicationId, currentName, options) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/roles/${encodeURIComponent(currentName)}`,
-      { method: "PUT", body: options }
+      "applications/:applicationId/roles/:currentName",
+      { params: { applicationId, currentName }, method: "PUT", body: options }
     );
   }
   /** Deletes an application-scoped role definition. */
   async deleteApplicationRole(applicationId, name) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/roles/${encodeURIComponent(name)}`,
-      { method: "DELETE" }
+      "applications/:applicationId/roles/:name",
+      { params: { applicationId, name }, method: "DELETE" }
     );
   }
   /**
@@ -654,7 +649,8 @@ class AdminService {
    * @returns The created entitlement
    */
   async createApplicationEntitlement(applicationId, options) {
-    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/entitlements`, {
+    return await this.requestApplicationRoute("applications/:applicationId/entitlements", {
+      params: { applicationId },
       method: "POST",
       body: options
     });
@@ -666,7 +662,7 @@ class AdminService {
    * @returns Secret metadata without plaintext values
    */
   async listApplicationSecrets(applicationId) {
-    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/secrets`);
+    return await this.requestApplicationRoute("applications/:applicationId/secrets", { params: { applicationId } });
   }
   /**
    * Creates a client secret for an application.
@@ -676,7 +672,8 @@ class AdminService {
    * @returns The created secret, including the plaintext value shown only once
    */
   async createApplicationSecret(applicationId, options = {}) {
-    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/secrets`, {
+    return await this.requestApplicationRoute("applications/:applicationId/secrets", {
+      params: { applicationId },
       method: "POST",
       body: options
     });
@@ -690,8 +687,8 @@ class AdminService {
    */
   async deleteApplicationSecret(applicationId, secretId) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/secrets/${encodeURIComponent(secretId)}`,
-      { method: "DELETE" }
+      "applications/:applicationId/secrets/:secretId",
+      { params: { applicationId, secretId }, method: "DELETE" }
     );
   }
   /**
@@ -702,8 +699,8 @@ class AdminService {
    */
   async retireApplicationServiceAccount(applicationId) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/service-account`,
-      { method: "DELETE" }
+      "applications/:applicationId/service-account",
+      { params: { applicationId }, method: "DELETE" }
     );
   }
   /**
@@ -958,7 +955,8 @@ class AdminService {
    */
   async getEntitlement(entitlementId) {
     return await this.requestApplicationRoute(
-      `applications/entitlements/${encodeURIComponent(entitlementId)}`
+      "applications/entitlements/:entitlementId",
+      { params: { entitlementId } }
     );
   }
   /**
@@ -970,8 +968,8 @@ class AdminService {
    */
   async setEntitlementRules(entitlementId, options) {
     return await this.requestApplicationRoute(
-      `applications/entitlements/${encodeURIComponent(entitlementId)}/rules`,
-      { method: "PUT", body: options }
+      "applications/entitlements/:entitlementId/rules",
+      { params: { entitlementId }, method: "PUT", body: options }
     );
   }
   /**
@@ -983,8 +981,8 @@ class AdminService {
    */
   async updateEntitlement(entitlementId, options) {
     return await this.requestApplicationRoute(
-      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
-      { method: "PUT", body: options }
+      "applications/entitlements/:entitlementId",
+      { params: { entitlementId }, method: "PUT", body: options }
     );
   }
   /**
@@ -995,8 +993,8 @@ class AdminService {
    */
   async deleteEntitlement(entitlementId) {
     return await this.requestApplicationRoute(
-      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
-      { method: "DELETE" }
+      "applications/entitlements/:entitlementId",
+      { params: { entitlementId }, method: "DELETE" }
     );
   }
   /**
@@ -1538,7 +1536,7 @@ class ApplicationService {
    * on the verification URI to authorize the device.
    *
    * @param requesterApplicationId - The application requesting authorization
-   * @param targetApplicationId - The target application to gain access to
+   * @param targetApplicationId - The target application to gain access to. Omit it to sign the user in to the requester application itself.
    * @returns Device authorization details including codes and verification URI
    */
   async startDeviceAuthorizationFlow(requesterApplicationId, targetApplicationId) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "2.7.0",
+    "version": "2.9.0",
     "type": "module",
     "exports": {
         ".": {