@protobase/server 0.68.6 → 0.69.0

package/dist/better-auth/connections/declared-connections.js

@@ -0,0 +1,54 @@
+import { connectionProviderId } from "../../workflows/connections/connection-provider.js";
+import { isIP } from "node:net";
+//#region src/better-auth/connections/declared-connections.ts
+const clientOf = (value) => typeof value?.clientId === "string" && value.clientId !== "" && typeof value.clientSecret === "string" && value.clientSecret !== "" ? {
+	clientId: value.clientId,
+	clientSecret: value.clientSecret
+} : void 0;
+const literalHost = (url) => {
+	const host = new URL(url).hostname.replace(/^\[|\]$/g, "");
+	return host === "localhost" || isIP(host) !== 0;
+};
+/**
+* The connections of an app's workflow plugins, each with its provider: the sign-in provider it names, whose client
+* revokes its tokens, or one of its own, whose client `clients` gives by `<plugin>:<connection>`. Startup stops on a
+* client no `oauth` connection declares, and on an endpoint by address unless `allowPrivateAddresses`.
+*/
+const resolveConnections = (declared, clients, socialProviders, allowPrivateAddresses) => {
+	const keys = new Set(declared.filter(({ declaration }) => "oauth" in declaration).map(({ plugin, name }) => `${plugin}:${name}`));
+	const unknown = Object.keys(clients).find((key) => !keys.has(key));
+	if (unknown !== void 0) throw new Error(`auth.connections: "${unknown}" is no workflow plugin's connection that signs in through a provider of its own`);
+	return declared.map((connection) => {
+		const { plugin, name, declaration } = connection;
+		const key = `${plugin}:${name}`;
+		const providerId = connectionProviderId(plugin, name, declaration);
+		const urls = "signIn" in declaration ? [declaration.revocation_url] : [
+			declaration.oauth.authorization_url,
+			declaration.oauth.token_url,
+			declaration.oauth.user_info_url,
+			declaration.oauth.revocation_url
+		];
+		if (!allowPrivateAddresses && urls.some((url) => url !== void 0 && literalHost(url))) throw new Error(`Workflow plugin "${plugin}": the connection "${name}" names a host by its address; give its provider's name, or allow private addresses for development (workflows.allowPrivateAddresses)`);
+		if ("signIn" in declaration) {
+			const client = clientOf(socialProviders[declaration.signIn]);
+			return {
+				...connection,
+				key,
+				providerId,
+				...client && { client },
+				...declaration.revocation_url && { revocationUrl: declaration.revocation_url }
+			};
+		}
+		const client = clientOf(clients[key]);
+		if (Object.hasOwn(clients, key) && !client) throw new Error(`auth.connections: "${key}" needs its clientId and clientSecret`);
+		return {
+			...connection,
+			key,
+			providerId,
+			...client && { client },
+			...declaration.oauth.revocation_url && { revocationUrl: declaration.oauth.revocation_url }
+		};
+	});
+};
+//#endregion
+export { resolveConnections };

package/dist/better-auth/connections/revoke-token.js

@@ -0,0 +1,34 @@
+import { AddressRefusedError, pinnedRequest } from "../../webhooks/table/pinned-request.js";
+//#region src/better-auth/connections/revoke-token.ts
+/** The longest a provider gets to revoke a token: disconnecting does not wait on it any longer. */
+const revokeTimeoutMs = 1e4;
+const unreachable = (error) => error instanceof AddressRefusedError || error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError" || typeof error.code === "string");
+/**
+* Revokes a token at its provider (RFC 7009), through the guarded request, which refuses a private address unless the
+* app allows them: whether the provider took it. A provider out of reach or refusing is false, so disconnecting still
+* deletes the token; nothing of the request or its answer is logged or returned, as both carry the token.
+*/
+const revokeToken = async ({ url, client, token, hint, allowPrivateAddresses }) => {
+	const init = {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			token,
+			token_type_hint: hint,
+			...client && {
+				client_id: client.clientId,
+				client_secret: client.clientSecret
+			}
+		}).toString(),
+		signal: AbortSignal.timeout(revokeTimeoutMs)
+	};
+	const response = await pinnedRequest(url, init, { allowPrivateAddresses }).catch((error) => {
+		if (unreachable(error)) return;
+		throw error;
+	});
+	if (!response) return false;
+	await response.body?.cancel();
+	return response.ok;
+};
+//#endregion
+export { revokeToken };

package/dist/better-auth/create-auth.d.ts

@@ -5,12 +5,13 @@ import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
 import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
-import { ReplacingContext } from "./end-replaced-session.js";
 import { VersionedSecret } from "./secret-versions.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PersonalMailProvider } from "../personal-mail/personal-mail-provider.js";
+import { ConnectionClient, DeclaredConnection, ResolvedConnection } from "./connections/declared-connections.js";
+import { ConnectionListener } from "./connections/connection-events.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
 import { OperatorProvider } from "./operator-provider.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
@@ -117,8 +118,22 @@ export type CreateAuthOptions = {
    * `socialProviders` must have: Gmail through `google`. Needs `encryptOAuthTokens`. Default none.
    */
   personalMail?: PersonalMailProviderId[];
-  /** Encrypt the OAuth access and refresh tokens Better Auth stores for social sign-ins, with `secret`; `personalMail` needs it. Default off. */
+  /** Encrypt the OAuth access and refresh tokens Better Auth stores for social sign-ins, with `secret`; `personalMail` and workflow connections need it. Default off. */
   encryptOAuthTokens?: boolean;
+  /**
+   * The OAuth client of each workflow plugin's connection that signs in through a provider of its own, by
+   * `<plugin>:<connection>`, such as `{ 'acme:account': { clientId, clientSecret } }`; its redirect URI is
+   * `{baseURL}/api/auth/callback/workflow-<plugin>-<connection>`. A connection through one of `socialProviders` needs none.
+   */
+  connections?: Record<string, ConnectionClient>;
+  /**
+   * The connections the app's workflow plugins declare, which people connect accounts through (`createAdmin` passes
+   * them from `workflows.plugins`), and whether their providers may be at private addresses, for development and tests.
+   */
+  workflowConnections?: {
+    declared: DeclaredConnection[];
+    allowPrivateAddresses?: boolean;
+  };
   /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */
   onUserCreated?: UserCreatedHook;
   /**
@@ -299,6 +314,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
   account: {
     encryptOAuthTokens?: true | undefined;
     accountLinking: {
+      trustedProviders?: string[] | undefined;
       allowDifferentEmails: true;
     };
     fields: {
@@ -590,17 +606,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress?
-              /**
-               * What the sign-in page leads with: `password`, the email address and a password, with emailing a code below it; or
-               * `emailCode`, the address and "Email me a sign-in code", with the password behind "Use a password", for apps whose
-               * people mostly never set one. Only while the policy leaves both on; default `password`.
-               */
-              /**
-               * What the sign-in page leads with: `password`, the email address and a password, with emailing a code below it; or
-               * `emailCode`, the address and "Email me a sign-in code", with the password behind "Use a password", for apps whose
-               * people mostly never set one. Only while the policy leaves both on; default `password`.
-               */ : string | null | undefined;
+              ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
             };
           };
@@ -3419,6 +3425,102 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
       INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
       TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
     };
+  } | {
+    id: "protobase-connection-providers";
+    init: (ctx: import("better-auth").AuthContext) => {
+      context: {
+        socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+      };
+    };
+  } | {
+    id: "protobase-connections";
+    endpoints: {
+      listConnections: import("better-call").StrictEndpoint<string, {
+        method: "GET";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        connections: {
+          key: string;
+          label: string;
+          provider: string;
+          scopes: string[];
+          link_params: Record<string, string>;
+          accounts: {
+            id: string;
+            scopes: string[];
+            created_at: Date;
+            needs_sign_in: boolean;
+          }[];
+        }[];
+      }>;
+      disconnectConnection: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          accountId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        disconnected: boolean;
+        revoked: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  } | {
+    id: "protobase-refresh-refusals";
+    init: (ctx: import("better-auth").AuthContext) => {
+      context: {
+        socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+      };
+    };
   } | {
     id: "sso";
     version: string;
@@ -8978,10 +9080,40 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
       };
     };
     session: {
-      create: {
-        after: (session: {
-          token: string;
-        }, ctx: ReplacingContext | null) => Promise<void>;
+      create?: {
+        before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            userId?: string | undefined;
+            expiresAt?: Date | undefined;
+            token?: string | undefined;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          } & Record<string, any>;
+        }>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      update?: {
+        before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            [x: string]: any;
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            userId?: string | undefined;
+            expiresAt?: Date | undefined;
+            token?: string | undefined;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+        }>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      delete?: {
+        before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
       };
     };
     account: {
@@ -9201,6 +9333,19 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
   personalMail: PersonalMailProvider[];
   /** Mail from `userId`'s own mailbox, through the mail provider they linked (see `personalMailer`). */
   personalMailer: (userId: string) => Mailer;
+  /** What workflow connections can sign in with: whether tokens are stored encrypted, the sign-in providers, the connections with a client. */
+  connectionSupport: {
+    encrypted: boolean;
+    signInProviders: string[];
+    clients: string[];
+  };
+  /** The workflow connections people connect accounts through, and the listener (`set`) the workflows give for their links and disconnects. */
+  connections: {
+    declared: ResolvedConnection[];
+    events: {
+      set: (next: ConnectionListener) => undefined;
+    };
+  };
   /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
   mcp: {
     resource: string;

package/dist/better-auth/create-auth.js

@@ -5,10 +5,16 @@ import { defaultSignInPolicy } from "./sign-in-policy.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
+import { refreshRefusalsPlugin } from "./refresh-refusals.js";
 import { betterAuthLinkedAccounts } from "../personal-mail/linked-accounts.js";
 import { resolvePersonalMail } from "../personal-mail/personal-mail-providers.js";
 import { personalMailer } from "../personal-mail/personal-mailer.js";
 import { mailLinkHooks } from "../personal-mail/mail-link-hooks.js";
+import { bothAccountHooks, connectionAccountHooks } from "./connections/connection-account-hooks.js";
+import { connectionEvents } from "./connections/connection-events.js";
+import { connectionProvidersPlugin } from "./connections/connection-oauth-provider.js";
+import { connectionsPlugin } from "./connections/connections-plugin.js";
+import { resolveConnections } from "./connections/declared-connections.js";
 import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { authLogger } from "./auth-logger.js";
@@ -69,6 +75,20 @@ const withEndedReplaced = (hooks) => ({
 		after: endReplacedSession
 	}
 });
+const refusingConnectionSessions = (hooks, refuse) => {
+	if (!refuse) return hooks;
+	const before = hooks.create?.before;
+	return {
+		...hooks,
+		create: {
+			...hooks.create,
+			before: async (session, context) => {
+				await refuse(session, context);
+				return before?.(session, context);
+			}
+		}
+	};
+};
 const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
@@ -101,7 +121,9 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion, lockedAccounts = [], ...plugins }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion, lockedAccounts = [], connections, ...plugins }) => {
+	const connectionHooks = connections && connections.resolved.length > 0 ? connectionAccountHooks(connections.resolved, connections.events) : void 0;
+	const ownProviders = (connections?.resolved ?? []).filter(({ declaration }) => "oauth" in declaration).map(({ providerId }) => providerId);
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -201,7 +223,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		verification: coreNames.verification,
 		account: {
 			...coreNames.account,
-			accountLinking: { allowDifferentEmails: true },
+			accountLinking: {
+				allowDifferentEmails: true,
+				...ownProviders.length > 0 && { trustedProviders: ownProviders }
+			},
 			...options.encryptOAuthTokens && { encryptOAuthTokens: true }
 		},
 		plugins: [
@@ -238,6 +263,12 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				defaultPolicy: signInPolicy
 			})] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
+			...connections && connections.resolved.length > 0 ? [connectionProvidersPlugin(connections.resolved, { allowPrivateAddresses: connections.allowPrivateAddresses }), connectionsPlugin({
+				connections: connections.resolved,
+				events: connections.events,
+				allowPrivateAddresses: connections.allowPrivateAddresses
+			})] : [],
+			refreshRefusalsPlugin(),
 			...saml.length > 0 ? [loaded(plugins.samlPlugin, "sso.saml")(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
 			passwordChecksPlugin(),
@@ -320,8 +351,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				},
 				update: { before: async (user) => ({ data: confirmedOnUpdate(user, /* @__PURE__ */ new Date()) }) }
 			},
-			session: withEndedReplaced(organizations ? sessionOrganizationHooks(context) : {}),
-			account: mailLinkHooks(resolvePersonalMail(options.personalMail ?? [], Object.keys(options.socialProviders ?? {}), options.encryptOAuthTokens === true))
+			session: refusingConnectionSessions(withEndedReplaced(organizations ? sessionOrganizationHooks(context) : {}), connectionHooks?.session.create?.before),
+			account: ((mail) => connectionHooks ? bothAccountHooks(mail, connectionHooks.account) : mail)(mailLinkHooks(resolvePersonalMail(options.personalMail ?? [], Object.keys(options.socialProviders ?? {}), options.encryptOAuthTokens === true)))
 		},
 		rateLimit: {
 			enabled: true,
@@ -408,6 +439,13 @@ const createAuth = (options, plugins = {}) => {
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const saml = resolveSamlProviders(options.sso?.saml ?? [], [...socialProviders, ...platformSignIn ? [platformSignIn.provider] : []]);
 	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders, options.encryptOAuthTokens === true);
+	if (Object.keys(options.connections ?? {}).length > 0 && options.encryptOAuthTokens !== true) throw new Error("auth.connections: the connected accounts' tokens would be stored in plain text; turn on auth.encryptOAuthTokens");
+	const allowPrivateAddresses = options.workflowConnections?.allowPrivateAddresses === true;
+	const resolvedConnections = resolveConnections(options.workflowConnections?.declared ?? [], options.connections ?? {}, options.socialProviders ?? {}, allowPrivateAddresses);
+	const clash = resolvedConnections.find(({ declaration, providerId }) => "oauth" in declaration && socialProviders.includes(providerId));
+	if (clash) throw new Error(`Workflow plugin "${clash.plugin}": its connection "${clash.name}" signs in as "${clash.providerId}", which is a sign-in provider's id too`);
+	const connectionClients = resolvedConnections.filter(({ declaration, client }) => "oauth" in declaration && client).map(({ key }) => key);
+	const events = connectionEvents();
 	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
 	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions);
@@ -436,7 +474,12 @@ const createAuth = (options, plugins = {}) => {
 		signInPolicy,
 		...organizations && { organizations },
 		...mcp && { mcp },
-		context
+		context,
+		connections: {
+			resolved: resolvedConnections,
+			events,
+			allowPrivateAddresses
+		}
 	});
 	assertNoEndpointKeyClashes(authOptions.plugins);
 	const auth = betterAuth(authOptions);
@@ -503,6 +546,17 @@ const createAuth = (options, plugins = {}) => {
 		personalMail,
 		/** Mail from `userId`'s own mailbox, through the mail provider they linked (see `personalMailer`). */
 		personalMailer: (userId) => personalMailer(betterAuthLinkedAccounts(auth), personalMail, userId),
+		/** What workflow connections can sign in with: whether tokens are stored encrypted, the sign-in providers, the connections with a client. */
+		connectionSupport: {
+			encrypted: options.encryptOAuthTokens === true,
+			signInProviders: socialProviders,
+			clients: connectionClients
+		},
+		/** The workflow connections people connect accounts through, and the listener (`set`) the workflows give for their links and disconnects. */
+		connections: {
+			declared: resolvedConnections,
+			events: { set: events.set }
+		},
 		/** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
 		mcp: mcp && {
 			resource: mcp.resource,

package/dist/better-auth/refresh-refusals.js

@@ -0,0 +1,43 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/better-auth/refresh-refusals.ts
+/**
+* The token endpoint's error (RFC 6749, section 5.2) that refuses the refresh token itself, as for a revoked grant or
+* an expired refresh token: the link no longer signs in, and only connecting it again helps.
+*/
+const refusal = "invalid_grant";
+/** Whether a provider's refresh threw for a refused grant: Better Auth's own fetch's error, or a connection provider's. */
+const refreshRefused = (error) => typeof error === "object" && error !== null && error.error === refusal;
+const watched = new AsyncLocalStorage();
+/** Runs `work` and tells whether a provider refused a refresh token in it, whether `work` resolved or threw. */
+const watchRefusals = async (work) => {
+	const outcome = { refused: false };
+	return {
+		...await watched.run(outcome, () => work().then((value) => ({ value }), (error) => ({ error }))),
+		refused: outcome.refused
+	};
+};
+const marking = (provider) => {
+	const refresh = provider.refreshAccessToken;
+	if (!refresh) return provider;
+	return {
+		...provider,
+		refreshAccessToken: async (...args) => {
+			try {
+				return await refresh(...args);
+			} catch (error) {
+				if (refreshRefused(error)) {
+					const outcome = watched.getStore();
+					if (outcome) outcome.refused = true;
+				}
+				throw error;
+			}
+		}
+	};
+};
+/** Has every provider's refresh mark a refused grant for `watchRefusals`; after the plugins that add providers. */
+const refreshRefusalsPlugin = () => ({
+	id: "protobase-refresh-refusals",
+	init: (ctx) => ({ context: { socialProviders: ctx.socialProviders.map(marking) } })
+});
+//#endregion
+export { refreshRefusalsPlugin, refreshRefused, watchRefusals };

package/dist/better-auth/staff-checks.js

@@ -46,6 +46,7 @@ const accountChanges = [
 	"/delete-user",
 	"/link-social",
 	"/unlink-account",
+	"/connections/disconnect",
 	"/revoke-sessions",
 	"/revoke-other-sessions",
 	"/two-factor/enable",

package/dist/notifications/history-routes.js

@@ -1,7 +1,7 @@
 import { badRequest } from "../problem.js";
+import { ownSignInUser } from "./caller.js";
 import { historyIdPattern } from "./history.js";
 import "./history-store.js";
-import { ownSignInUser } from "./caller.js";
 import { historyCursor, historyPosition } from "./history-cursor.js";
 import { jsonBody, jsonOnly, limitedBody, queryOf } from "./history-request.js";
 import { historyUrl } from "./history-url.js";

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.68.6";
+var version = "0.69.0";
 //#endregion
 export { version };

package/dist/personal-mail/linked-accounts.js

@@ -1,3 +1,4 @@
+import { watchRefusals } from "../better-auth/refresh-refusals.js";
 import { PersonalMailError } from "./personal-mail-error.js";
 import { APIError } from "better-auth/api";
 //#region src/personal-mail/linked-accounts.ts
@@ -5,7 +6,7 @@ const storedScopes = (scope) => (scope ?? "").split(/[\s,]+/).filter(Boolean);
 /**
 * The accounts Better Auth keeps, with the tokens it stores, decrypted when `encryptOAuthTokens` is on. Its
 * `getAccessToken` refreshes a token within five seconds of expiry with the provider's refresh token and stores the new
-* one; when the provider refuses the refresh, as for a revoked grant, that is `link_expired`.
+* one; when the provider refuses the refresh token, as for a revoked grant, that is `link_expired`.
 */
 const betterAuthLinkedAccounts = (auth) => ({
 	accounts: async (userId) => {
@@ -17,21 +18,24 @@ const betterAuthLinkedAccounts = (auth) => ({
 		}));
 	},
 	accessToken: async (userId, account, provider) => {
-		const accessToken = await validAccessToken(auth, userId, account.id, provider);
+		const accessToken = await accountAccessToken(auth, userId, account.id);
 		if (!accessToken) throw new PersonalMailError("link_expired", provider);
 		return accessToken;
 	}
 });
-const validAccessToken = async (auth, userId, accountId, provider) => {
-	try {
-		return (await auth.api.getAccessToken({ body: {
-			accountId,
-			userId
-		} })).accessToken;
-	} catch (error) {
-		if (error instanceof APIError && error.body?.code === "FAILED_TO_GET_ACCESS_TOKEN") throw new PersonalMailError("link_expired", provider);
-		throw error;
-	}
+/**
+* A valid access token of the account, refreshed first when it expired; undefined when the provider refused the refresh
+* token (`invalid_grant`) or the account holds none. A refresh that failed otherwise, as when the provider was down,
+* throws, so the caller tries again later rather than asking the person to connect the account again.
+*/
+const accountAccessToken = async (auth, userId, accountId) => {
+	const answer = await watchRefusals(() => auth.api.getAccessToken({ body: {
+		accountId,
+		userId
+	} }));
+	if ("value" in answer) return answer.value.accessToken || void 0;
+	if (answer.refused && answer.error instanceof APIError && answer.error.body?.code === "FAILED_TO_GET_ACCESS_TOKEN") return;
+	throw answer.error;
 };
 //#endregion
-export { betterAuthLinkedAccounts, storedScopes };
+export { accountAccessToken, betterAuthLinkedAccounts, storedScopes };

package/dist/types.d.ts

@@ -76,6 +76,8 @@ export type WriteEvent = {
   tenant?: TenantValue;
   /** The writer is a visitor without a token, through a public form. */
   anonymous?: true;
+  /** The writer's session as the API resolved it, for a hook that allows a write only for someone signed in as themselves (`ownSignInUser`). */
+  session: Session;
   before?: Row;
   after?: Row;
 };

package/dist/webhooks/attempt.js

@@ -1,9 +1,9 @@
+import { AddressRefusedError, pinnedRequest } from "./table/pinned-request.js";
+import { readLimited } from "./table/read-limited.js";
 import { invokeFunction } from "../functions/define-function.js";
 import { retryAfterMs } from "./retry-schedule.js";
 import { standardWebhookHeaders } from "./standard-webhooks.js";
 import { subscriberSession } from "./subscriber-view.js";
-import { AddressRefusedError, pinnedRequest } from "./table/pinned-request.js";
-import { readLimited } from "./table/read-limited.js";
 //#region src/webhooks/attempt.ts
 /** How long a receiver has to answer. */
 const attemptTimeoutMs = 15e3;

package/dist/webhooks/table/webhook-table.js

@@ -1,5 +1,5 @@
-import { betterAuthOwnerRoles } from "./owner-roles.js";
 import { checkWebhookUrl } from "./address-check.js";
+import { betterAuthOwnerRoles } from "./owner-roles.js";
 import { webhooksSchema } from "./options.js";
 import { tableSubscriptions } from "./table-subscriptions.js";
 //#region src/webhooks/table/webhook-table.ts

package/dist/workflows/connections/connection-accounts.js

@@ -0,0 +1,18 @@
+import { accountAccessToken, storedScopes } from "../../personal-mail/linked-accounts.js";
+//#region src/workflows/connections/connection-accounts.ts
+/** The accounts Better Auth keeps, read through its internal adapter, with its refreshing `getAccessToken`. */
+const betterAuthConnectionAccounts = (auth) => ({
+	find: async (userId, accountId) => {
+		const account = (await (await auth.$context).internalAdapter.findAccounts(userId)).find((candidate) => candidate.id === accountId);
+		if (!account) return;
+		return {
+			id: account.id,
+			providerId: account.providerId,
+			scopes: storedScopes(account.scope),
+			refreshToken: account.refreshToken ?? null
+		};
+	},
+	accessToken: (userId, accountId) => accountAccessToken(auth, userId, accountId)
+});
+//#endregion
+export { betterAuthConnectionAccounts };