@objectstack/plugin-auth 7.0.0 → 7.2.0

package/dist/index.mjs

@@ -1028,18 +1028,22 @@ var AuthManager = class {
       plugins.push(jwt({ schema: buildJwtPluginSchema() }));
       const { oauthProvider } = await import("@better-auth/oauth-provider");
       const baseUrl = (this.config.baseUrl ?? "").replace(/\/$/, "");
+      const uiBase = (this.config.uiBasePath ?? "/_console").replace(/\/$/, "");
       plugins.push(oauthProvider({
-        // Account SPA renders both pages — see apps/account.
-        loginPage: `${baseUrl}/_account/login`,
-        consentPage: `${baseUrl}/_account/oauth/consent`,
+        // Console SPA renders both pages (replaces the legacy Account SPA at
+        // /_account). Override `uiBasePath` in AuthConfig if Console is
+        // mounted elsewhere.
+        loginPage: `${baseUrl}${uiBase}/login`,
+        consentPage: `${baseUrl}${uiBase}/oauth/consent`,
         schema: buildOauthProviderPluginSchema()
       }));
     }
     if (enabled.deviceAuthorization) {
       const { deviceAuthorization } = await import("better-auth/plugins/device-authorization");
       const baseUrl = (this.config.baseUrl ?? "").replace(/\/$/, "");
+      const uiBase = (this.config.uiBasePath ?? "/_console").replace(/\/$/, "");
       plugins.push(deviceAuthorization({
-        verificationUri: `${baseUrl}/_account/auth/device`,
+        verificationUri: `${baseUrl}${uiBase}/auth/device`,
         schema: buildDeviceAuthorizationPluginSchema()
       }));
     }
@@ -1651,6 +1655,56 @@ var AuthPlugin = class {
         return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
       }
     });
+    rawApp.post(`${basePath}/sys-oauth-application/register`, async (c) => {
+      try {
+        let body = {};
+        try {
+          body = await c.req.json();
+        } catch {
+          body = {};
+        }
+        const name = body?.name;
+        const redirectUrlsInput = body?.redirectURLs;
+        const type = body?.type;
+        if (typeof name !== "string" || name.trim().length === 0) {
+          return c.json({ success: false, error: { code: "invalid_request", message: "name is required" } }, 400);
+        }
+        if (typeof redirectUrlsInput !== "string" || redirectUrlsInput.trim().length === 0) {
+          return c.json({ success: false, error: { code: "invalid_request", message: "redirectURLs is required" } }, 400);
+        }
+        const redirectUris = redirectUrlsInput.split(/[\r\n]+/).map((line) => line.trim()).filter((line) => line.length > 0);
+        if (redirectUris.length === 0) {
+          return c.json({ success: false, error: { code: "invalid_request", message: "redirectURLs must contain at least one URL" } }, 400);
+        }
+        const allowedTypes = /* @__PURE__ */ new Set(["web", "native", "user-agent-based"]);
+        const safeType = typeof type === "string" && allowedTypes.has(type) ? type : "web";
+        const authApi = await this.authManager.getApi();
+        if (!authApi?.createOAuthClient) {
+          return c.json({ success: false, error: { code: "unavailable", message: "OIDC provider is not enabled on this environment" } }, 503);
+        }
+        let result;
+        try {
+          result = await authApi.createOAuthClient({
+            body: {
+              client_name: name.trim(),
+              redirect_uris: redirectUris,
+              type: safeType
+            },
+            headers: c.req.raw.headers
+          });
+        } catch (err) {
+          const status = typeof err?.status === "number" ? err.status : 500;
+          const code = err?.body?.error ?? "oauth_register_failed";
+          const message = err?.body?.error_description ?? err?.message ?? "Unable to register OAuth client";
+          return c.json({ success: false, error: { code, message } }, status);
+        }
+        return c.json({ success: true, data: { client: result } });
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error("[AuthPlugin] sys-oauth-application/register failed", err);
+        return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
+      }
+    });
     rawApp.all(`${basePath}/*`, async (c) => {
       try {
         const response = await this.authManager.handleRequest(c.req.raw);