@sirketio/auth 0.0.1

package/dist/plugins/custom-session/index.mjs

@@ -0,0 +1,78 @@
+import { parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
+import { getSession } from "../../api/routes/session.mjs";
+import "../../api/index.mjs";
+import { getEndpointResponse } from "../../utils/plugin-helper.mjs";
+import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
+import * as z from "zod";
+
+//#region src/plugins/custom-session/index.ts
+const getSessionQuerySchema = z.optional(z.object({
+	disableCookieCache: z.boolean().meta({ description: "Disable cookie cache and fetch session from database" }).or(z.string().transform((v) => v === "true")).optional(),
+	disableRefresh: z.boolean().meta({ description: "Disable session refresh. Useful for checking session status, without updating the session" }).optional()
+}));
+const customSession = (fn, options, pluginOptions) => {
+	return {
+		id: "custom-session",
+		hooks: { after: [{
+			matcher: (ctx) => ctx.path === "/multi-session/list-device-sessions" && (pluginOptions?.shouldMutateListDeviceSessionsEndpoint ?? false),
+			handler: createAuthMiddleware(async (ctx) => {
+				const response = await getEndpointResponse(ctx);
+				if (!response) return;
+				const newResponse = await Promise.all(response.map(async (v) => await fn(v, ctx)));
+				return ctx.json(newResponse);
+			})
+		}] },
+		endpoints: { getSession: createAuthEndpoint("/get-session", {
+			method: "GET",
+			query: getSessionQuerySchema,
+			metadata: {
+				CUSTOM_SESSION: true,
+				openapi: {
+					description: "Get custom session data",
+					responses: { "200": {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "array",
+							nullable: true,
+							items: { $ref: "#/components/schemas/Session" }
+						} } }
+					} }
+				}
+			},
+			requireHeaders: true
+		}, async (ctx) => {
+			const session = await getSession()({
+				...ctx,
+				asResponse: false,
+				headers: ctx.headers,
+				returnHeaders: true
+			}).catch((e) => {
+				return null;
+			});
+			if (!session?.response) return ctx.json(null);
+			const fnResult = await fn(session.response, ctx);
+			for (const cookieStr of session.headers.getSetCookie()) parseSetCookieHeader(cookieStr).forEach((attrs, name) => {
+				ctx.setCookie(name, attrs.value, {
+					maxAge: attrs["max-age"],
+					expires: attrs.expires,
+					domain: attrs.domain,
+					path: attrs.path,
+					secure: attrs.secure,
+					httpOnly: attrs.httponly,
+					sameSite: attrs.samesite
+				});
+			});
+			session.headers.delete("set-cookie");
+			session.headers.forEach((value, key) => {
+				ctx.setHeader(key, value);
+			});
+			return ctx.json(fnResult);
+		}) },
+		$Infer: { Session: {} },
+		options: pluginOptions
+	};
+};
+
+//#endregion
+export { customSession };
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/custom-session/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/custom-session/index.ts"],"sourcesContent":["import type {\n\tBetterAuthOptions,\n\tBetterAuthPlugin,\n\tGenericEndpointContext,\n} from \"@better-auth/core\";\nimport {\n\tcreateAuthEndpoint,\n\tcreateAuthMiddleware,\n} from \"@better-auth/core/api\";\nimport type { Session, User } from \"@better-auth/core/db\";\nimport * as z from \"zod\";\nimport { getSession } from \"../../api\";\nimport { parseSetCookieHeader } from \"../../cookies/cookie-utils\";\nimport { getEndpointResponse } from \"../../utils/plugin-helper\";\n\ndeclare module \"@better-auth/core\" {\n\tinterface BetterAuthPluginRegistry<AuthOptions, Options> {\n\t\t\"custom-session\": {\n\t\t\tcreator: typeof customSession;\n\t\t};\n\t}\n}\n\nconst getSessionQuerySchema = z.optional(\n\tz.object({\n\t\t/**\n\t\t * If cookie cache is enabled, it will disable the cache\n\t\t * and fetch the session from the database\n\t\t */\n\t\tdisableCookieCache: z\n\t\t\t.boolean()\n\t\t\t.meta({\n\t\t\t\tdescription: \"Disable cookie cache and fetch session from database\",\n\t\t\t})\n\t\t\t.or(z.string().transform((v) => v === \"true\"))\n\t\t\t.optional(),\n\t\tdisableRefresh: z\n\t\t\t.boolean()\n\t\t\t.meta({\n\t\t\t\tdescription:\n\t\t\t\t\t\"Disable session refresh. Useful for checking session status, without updating the session\",\n\t\t\t})\n\t\t\t.optional(),\n\t}),\n);\n\nexport type CustomSessionPluginOptions = {\n\t/**\n\t * This option is used to determine if the list-device-sessions endpoint should be mutated to the custom session data.\n\t * @default false\n\t */\n\tshouldMutateListDeviceSessionsEndpoint?: boolean | undefined;\n};\n\nexport const customSession = <\n\tReturns extends Record<string, any>,\n\tO extends BetterAuthOptions = BetterAuthOptions,\n>(\n\tfn: (\n\t\tsession: {\n\t\t\tuser: User<O[\"user\"], O[\"plugins\"]>;\n\t\t\tsession: Session<O[\"session\"], O[\"plugins\"]>;\n\t\t},\n\t\tctx: GenericEndpointContext,\n\t) => Promise<Returns>,\n\toptions?: O | undefined,\n\tpluginOptions?: CustomSessionPluginOptions | undefined,\n) => {\n\treturn {\n\t\tid: \"custom-session\",\n\t\thooks: {\n\t\t\tafter: [\n\t\t\t\t{\n\t\t\t\t\tmatcher: (ctx) =>\n\t\t\t\t\t\tctx.path === \"/multi-session/list-device-sessions\" &&\n\t\t\t\t\t\t(pluginOptions?.shouldMutateListDeviceSessionsEndpoint ?? false),\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst response = await getEndpointResponse<[]>(ctx);\n\t\t\t\t\t\tif (!response) return;\n\t\t\t\t\t\tconst newResponse = await Promise.all(\n\t\t\t\t\t\t\tresponse.map(async (v) => await fn(v, ctx)),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn ctx.json(newResponse);\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\tendpoints: {\n\t\t\tgetSession: createAuthEndpoint(\n\t\t\t\t\"/get-session\",\n\t\t\t\t{\n\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\tquery: getSessionQuerySchema,\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tCUSTOM_SESSION: true,\n\t\t\t\t\t\topenapi: {\n\t\t\t\t\t\t\tdescription: \"Get custom session data\",\n\t\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\t\tdescription: \"Success\",\n\t\t\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\t\t\"application/json\": {\n\t\t\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t$ref: \"#/components/schemas/Session\",\n\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\trequireHeaders: true,\n\t\t\t\t},\n\t\t\t\tasync (ctx): Promise<Returns | null> => {\n\t\t\t\t\tconst session = await getSession()({\n\t\t\t\t\t\t...ctx,\n\t\t\t\t\t\tasResponse: false,\n\t\t\t\t\t\theaders: ctx.headers,\n\t\t\t\t\t\treturnHeaders: true,\n\t\t\t\t\t}).catch((e) => {\n\t\t\t\t\t\treturn null;\n\t\t\t\t\t});\n\t\t\t\t\tif (!session?.response) {\n\t\t\t\t\t\treturn ctx.json(null);\n\t\t\t\t\t}\n\t\t\t\t\tconst fnResult = await fn(session.response as any, ctx);\n\n\t\t\t\t\tfor (const cookieStr of session.headers.getSetCookie()) {\n\t\t\t\t\t\tconst parsed = parseSetCookieHeader(cookieStr);\n\t\t\t\t\t\tparsed.forEach((attrs, name) => {\n\t\t\t\t\t\t\tctx.setCookie(name, attrs.value, {\n\t\t\t\t\t\t\t\tmaxAge: attrs[\"max-age\"],\n\t\t\t\t\t\t\t\texpires: attrs.expires,\n\t\t\t\t\t\t\t\tdomain: attrs.domain,\n\t\t\t\t\t\t\t\tpath: attrs.path,\n\t\t\t\t\t\t\t\tsecure: attrs.secure,\n\t\t\t\t\t\t\t\thttpOnly: attrs.httponly,\n\t\t\t\t\t\t\t\tsameSite: attrs.samesite,\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\tsession.headers.delete(\"set-cookie\");\n\n\t\t\t\t\tsession.headers.forEach((value, key) => {\n\t\t\t\t\t\tctx.setHeader(key, value);\n\t\t\t\t\t});\n\t\t\t\t\treturn ctx.json(fnResult);\n\t\t\t\t},\n\t\t\t),\n\t\t},\n\t\t$Infer: {\n\t\t\tSession: {} as Awaited<ReturnType<typeof fn>>,\n\t\t},\n\t\toptions: pluginOptions,\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;;AAuBA,MAAM,wBAAwB,EAAE,SAC/B,EAAE,OAAO;CAKR,oBAAoB,EAClB,SAAS,CACT,KAAK,EACL,aAAa,wDACb,CAAC,CACD,GAAG,EAAE,QAAQ,CAAC,WAAW,MAAM,MAAM,OAAO,CAAC,CAC7C,UAAU;CACZ,gBAAgB,EACd,SAAS,CACT,KAAK,EACL,aACC,6FACD,CAAC,CACD,UAAU;CACZ,CAAC,CACF;AAUD,MAAa,iBAIZ,IAOA,SACA,kBACI;AACJ,QAAO;EACN,IAAI;EACJ,OAAO,EACN,OAAO,CACN;GACC,UAAU,QACT,IAAI,SAAS,0CACZ,eAAe,0CAA0C;GAC3D,SAAS,qBAAqB,OAAO,QAAQ;IAC5C,MAAM,WAAW,MAAM,oBAAwB,IAAI;AACnD,QAAI,CAAC,SAAU;IACf,MAAM,cAAc,MAAM,QAAQ,IACjC,SAAS,IAAI,OAAO,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,CAC3C;AACD,WAAO,IAAI,KAAK,YAAY;KAC3B;GACF,CACD,EACD;EACD,WAAW,EACV,YAAY,mBACX,gBACA;GACC,QAAQ;GACR,OAAO;GACP,UAAU;IACT,gBAAgB;IAChB,SAAS;KACR,aAAa;KACb,WAAW,EACV,OAAO;MACN,aAAa;MACb,SAAS,EACR,oBAAoB,EACnB,QAAQ;OACP,MAAM;OACN,UAAU;OACV,OAAO,EACN,MAAM,gCACN;OACD,EACD,EACD;MACD,EACD;KACD;IACD;GACD,gBAAgB;GAChB,EACD,OAAO,QAAiC;GACvC,MAAM,UAAU,MAAM,YAAY,CAAC;IAClC,GAAG;IACH,YAAY;IACZ,SAAS,IAAI;IACb,eAAe;IACf,CAAC,CAAC,OAAO,MAAM;AACf,WAAO;KACN;AACF,OAAI,CAAC,SAAS,SACb,QAAO,IAAI,KAAK,KAAK;GAEtB,MAAM,WAAW,MAAM,GAAG,QAAQ,UAAiB,IAAI;AAEvD,QAAK,MAAM,aAAa,QAAQ,QAAQ,cAAc,CAErD,CADe,qBAAqB,UAAU,CACvC,SAAS,OAAO,SAAS;AAC/B,QAAI,UAAU,MAAM,MAAM,OAAO;KAChC,QAAQ,MAAM;KACd,SAAS,MAAM;KACf,QAAQ,MAAM;KACd,MAAM,MAAM;KACZ,QAAQ,MAAM;KACd,UAAU,MAAM;KAChB,UAAU,MAAM;KAChB,CAAC;KACD;AAEH,WAAQ,QAAQ,OAAO,aAAa;AAEpC,WAAQ,QAAQ,SAAS,OAAO,QAAQ;AACvC,QAAI,UAAU,KAAK,MAAM;KACxB;AACF,UAAO,IAAI,KAAK,SAAS;IAE1B,EACD;EACD,QAAQ,EACP,SAAS,EAAE,EACX;EACD,SAAS;EACT"}

package/dist/plugins/device-authorization/client.d.mts

@@ -0,0 +1,17 @@
+import { deviceAuthorization } from "./index.mjs";
+
+//#region src/plugins/device-authorization/client.d.ts
+declare const deviceAuthorizationClient: () => {
+  id: "device-authorization";
+  $InferServerPlugin: ReturnType<typeof deviceAuthorization>;
+  pathMethods: {
+    "/device/code": "POST";
+    "/device/token": "POST";
+    "/device": "GET";
+    "/device/approve": "POST";
+    "/device/deny": "POST";
+  };
+};
+//#endregion
+export { deviceAuthorizationClient };
+//# sourceMappingURL=client.d.mts.map

package/dist/plugins/device-authorization/client.mjs

@@ -0,0 +1,18 @@
+//#region src/plugins/device-authorization/client.ts
+const deviceAuthorizationClient = () => {
+	return {
+		id: "device-authorization",
+		$InferServerPlugin: {},
+		pathMethods: {
+			"/device/code": "POST",
+			"/device/token": "POST",
+			"/device": "GET",
+			"/device/approve": "POST",
+			"/device/deny": "POST"
+		}
+	};
+};
+
+//#endregion
+export { deviceAuthorizationClient };
+//# sourceMappingURL=client.mjs.map

package/dist/plugins/device-authorization/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.mjs","names":[],"sources":["../../../src/plugins/device-authorization/client.ts"],"sourcesContent":["import type { BetterAuthClientPlugin } from \"@better-auth/core\";\nimport type { deviceAuthorization } from \".\";\n\nexport const deviceAuthorizationClient = () => {\n\treturn {\n\t\tid: \"device-authorization\",\n\t\t$InferServerPlugin: {} as ReturnType<typeof deviceAuthorization>,\n\t\tpathMethods: {\n\t\t\t\"/device/code\": \"POST\",\n\t\t\t\"/device/token\": \"POST\",\n\t\t\t\"/device\": \"GET\",\n\t\t\t\"/device/approve\": \"POST\",\n\t\t\t\"/device/deny\": \"POST\",\n\t\t},\n\t} satisfies BetterAuthClientPlugin;\n};\n"],"mappings":";AAGA,MAAa,kCAAkC;AAC9C,QAAO;EACN,IAAI;EACJ,oBAAoB,EAAE;EACtB,aAAa;GACZ,gBAAgB;GAChB,iBAAiB;GACjB,WAAW;GACX,mBAAmB;GACnB,gBAAgB;GAChB;EACD"}

package/dist/plugins/device-authorization/error-codes.mjs

@@ -0,0 +1,21 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/device-authorization/error-codes.ts
+const DEVICE_AUTHORIZATION_ERROR_CODES = defineErrorCodes({
+	INVALID_DEVICE_CODE: "Invalid device code",
+	EXPIRED_DEVICE_CODE: "Device code has expired",
+	EXPIRED_USER_CODE: "User code has expired",
+	AUTHORIZATION_PENDING: "Authorization pending",
+	ACCESS_DENIED: "Access denied",
+	INVALID_USER_CODE: "Invalid user code",
+	DEVICE_CODE_ALREADY_PROCESSED: "Device code already processed",
+	POLLING_TOO_FREQUENTLY: "Polling too frequently",
+	USER_NOT_FOUND: "User not found",
+	FAILED_TO_CREATE_SESSION: "Failed to create session",
+	INVALID_DEVICE_CODE_STATUS: "Invalid device code status",
+	AUTHENTICATION_REQUIRED: "Authentication required"
+});
+
+//#endregion
+export { DEVICE_AUTHORIZATION_ERROR_CODES };
+//# sourceMappingURL=error-codes.mjs.map

package/dist/plugins/device-authorization/error-codes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.mjs","names":[],"sources":["../../../src/plugins/device-authorization/error-codes.ts"],"sourcesContent":["import { defineErrorCodes } from \"@better-auth/core/utils/error-codes\";\n\nexport const DEVICE_AUTHORIZATION_ERROR_CODES = defineErrorCodes({\n\tINVALID_DEVICE_CODE: \"Invalid device code\",\n\tEXPIRED_DEVICE_CODE: \"Device code has expired\",\n\tEXPIRED_USER_CODE: \"User code has expired\",\n\tAUTHORIZATION_PENDING: \"Authorization pending\",\n\tACCESS_DENIED: \"Access denied\",\n\tINVALID_USER_CODE: \"Invalid user code\",\n\tDEVICE_CODE_ALREADY_PROCESSED: \"Device code already processed\",\n\tPOLLING_TOO_FREQUENTLY: \"Polling too frequently\",\n\tUSER_NOT_FOUND: \"User not found\",\n\tFAILED_TO_CREATE_SESSION: \"Failed to create session\",\n\tINVALID_DEVICE_CODE_STATUS: \"Invalid device code status\",\n\tAUTHENTICATION_REQUIRED: \"Authentication required\",\n});\n"],"mappings":";;;AAEA,MAAa,mCAAmC,iBAAiB;CAChE,qBAAqB;CACrB,qBAAqB;CACrB,mBAAmB;CACnB,uBAAuB;CACvB,eAAe;CACf,mBAAmB;CACnB,+BAA+B;CAC/B,wBAAwB;CACxB,gBAAgB;CAChB,0BAA0B;CAC1B,4BAA4B;CAC5B,yBAAyB;CACzB,CAAC"}

package/dist/plugins/device-authorization/index.d.mts

@@ -0,0 +1,424 @@
+import { TimeString, ms, sec } from "../../utils/time.mjs";
+import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+import * as better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/plugins/device-authorization/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "device-authorization": {
+      creator: typeof deviceAuthorization;
+    };
+  }
+}
+declare const deviceAuthorizationOptionsSchema: z.ZodObject<{
+  expiresIn: z.ZodDefault<z.ZodCustom<TimeString, TimeString>>;
+  interval: z.ZodDefault<z.ZodCustom<TimeString, TimeString>>;
+  deviceCodeLength: z.ZodDefault<z.ZodNumber>;
+  userCodeLength: z.ZodDefault<z.ZodNumber>;
+  generateDeviceCode: z.ZodOptional<z.ZodCustom<() => string | Promise<string>, () => string | Promise<string>>>;
+  generateUserCode: z.ZodOptional<z.ZodCustom<() => string | Promise<string>, () => string | Promise<string>>>;
+  validateClient: z.ZodOptional<z.ZodCustom<(clientId: string) => boolean | Promise<boolean>, (clientId: string) => boolean | Promise<boolean>>>;
+  onDeviceAuthRequest: z.ZodOptional<z.ZodCustom<(clientId: string, scope: string | undefined) => void | Promise<void>, (clientId: string, scope: string | undefined) => void | Promise<void>>>;
+  verificationUri: z.ZodOptional<z.ZodString>;
+  schema: z.ZodCustom<{
+    deviceCode?: {
+      modelName?: string | undefined;
+      fields?: {
+        deviceCode?: string | undefined;
+        userCode?: string | undefined;
+        userId?: string | undefined;
+        expiresAt?: string | undefined;
+        status?: string | undefined;
+        lastPolledAt?: string | undefined;
+        pollingInterval?: string | undefined;
+        clientId?: string | undefined;
+        scope?: string | undefined;
+      } | undefined;
+    } | undefined;
+  }, {
+    deviceCode?: {
+      modelName?: string | undefined;
+      fields?: {
+        deviceCode?: string | undefined;
+        userCode?: string | undefined;
+        userId?: string | undefined;
+        expiresAt?: string | undefined;
+        status?: string | undefined;
+        lastPolledAt?: string | undefined;
+        pollingInterval?: string | undefined;
+        clientId?: string | undefined;
+        scope?: string | undefined;
+      } | undefined;
+    } | undefined;
+  }>;
+}, z.core.$strip>;
+type DeviceAuthorizationOptions = z.infer<typeof deviceAuthorizationOptionsSchema>;
+declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions>) => {
+  id: "device-authorization";
+  schema: {
+    deviceCode: {
+      fields: {
+        deviceCode: {
+          type: "string";
+          required: true;
+        };
+        userCode: {
+          type: "string";
+          required: true;
+        };
+        userId: {
+          type: "string";
+          required: false;
+        };
+        expiresAt: {
+          type: "date";
+          required: true;
+        };
+        status: {
+          type: "string";
+          required: true;
+        };
+        lastPolledAt: {
+          type: "date";
+          required: false;
+        };
+        pollingInterval: {
+          type: "number";
+          required: false;
+        };
+        clientId: {
+          type: "string";
+          required: false;
+        };
+        scope: {
+          type: "string";
+          required: false;
+        };
+      };
+    };
+  };
+  endpoints: {
+    deviceCode: better_call0.StrictEndpoint<"/device/code", {
+      method: "POST";
+      body: z.ZodObject<{
+        client_id: z.ZodString;
+        scope: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+      error: z.ZodObject<{
+        error: z.ZodEnum<{
+          invalid_request: "invalid_request";
+          invalid_client: "invalid_client";
+        }>;
+        error_description: z.ZodString;
+      }, z.core.$strip>;
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      device_code: {
+                        type: string;
+                        description: string;
+                      };
+                      user_code: {
+                        type: string;
+                        description: string;
+                      };
+                      verification_uri: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      verification_uri_complete: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      expires_in: {
+                        type: string;
+                        description: string;
+                      };
+                      interval: {
+                        type: string;
+                        description: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+            400: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      error: {
+                        type: string;
+                        enum: string[];
+                      };
+                      error_description: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      device_code: string;
+      user_code: string;
+      verification_uri: string;
+      verification_uri_complete: string;
+      expires_in: number;
+      interval: number;
+    }>;
+    deviceToken: better_call0.StrictEndpoint<"/device/token", {
+      method: "POST";
+      body: z.ZodObject<{
+        grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:device_code">;
+        device_code: z.ZodString;
+        client_id: z.ZodString;
+      }, z.core.$strip>;
+      error: z.ZodObject<{
+        error: z.ZodEnum<{
+          invalid_request: "invalid_request";
+          invalid_grant: "invalid_grant";
+          authorization_pending: "authorization_pending";
+          slow_down: "slow_down";
+          expired_token: "expired_token";
+          access_denied: "access_denied";
+        }>;
+        error_description: z.ZodString;
+      }, z.core.$strip>;
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      session: {
+                        $ref: string;
+                      };
+                      user: {
+                        $ref: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+            400: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      error: {
+                        type: string;
+                        enum: string[];
+                      };
+                      error_description: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      access_token: string;
+      token_type: string;
+      expires_in: number;
+      scope: string;
+    }>;
+    deviceVerify: better_call0.StrictEndpoint<"/device", {
+      method: "GET";
+      query: z.ZodObject<{
+        user_code: z.ZodString;
+      }, z.core.$strip>;
+      error: z.ZodObject<{
+        error: z.ZodEnum<{
+          invalid_request: "invalid_request";
+        }>;
+        error_description: z.ZodString;
+      }, z.core.$strip>;
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      user_code: {
+                        type: string;
+                        description: string;
+                      };
+                      status: {
+                        type: string;
+                        enum: string[];
+                        description: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      user_code: string;
+      status: string;
+    }>;
+    deviceApprove: better_call0.StrictEndpoint<"/device/approve", {
+      method: "POST";
+      body: z.ZodObject<{
+        userCode: z.ZodString;
+      }, z.core.$strip>;
+      error: z.ZodObject<{
+        error: z.ZodEnum<{
+          invalid_request: "invalid_request";
+          expired_token: "expired_token";
+          access_denied: "access_denied";
+          device_code_already_processed: "device_code_already_processed";
+          unauthorized: "unauthorized";
+        }>;
+        error_description: z.ZodString;
+      }, z.core.$strip>;
+      requireHeaders: true;
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      success: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      success: boolean;
+    }>;
+    deviceDeny: better_call0.StrictEndpoint<"/device/deny", {
+      method: "POST";
+      body: z.ZodObject<{
+        userCode: z.ZodString;
+      }, z.core.$strip>;
+      error: z.ZodObject<{
+        error: z.ZodEnum<{
+          invalid_request: "invalid_request";
+          expired_token: "expired_token";
+          access_denied: "access_denied";
+          unauthorized: "unauthorized";
+        }>;
+        error_description: z.ZodString;
+      }, z.core.$strip>;
+      requireHeaders: true;
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      success: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      success: boolean;
+    }>;
+  };
+  $ERROR_CODES: {
+    USER_NOT_FOUND: _better_auth_core_utils_error_codes0.RawError<"USER_NOT_FOUND">;
+    FAILED_TO_CREATE_SESSION: _better_auth_core_utils_error_codes0.RawError<"FAILED_TO_CREATE_SESSION">;
+    INVALID_DEVICE_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_DEVICE_CODE">;
+    EXPIRED_DEVICE_CODE: _better_auth_core_utils_error_codes0.RawError<"EXPIRED_DEVICE_CODE">;
+    EXPIRED_USER_CODE: _better_auth_core_utils_error_codes0.RawError<"EXPIRED_USER_CODE">;
+    AUTHORIZATION_PENDING: _better_auth_core_utils_error_codes0.RawError<"AUTHORIZATION_PENDING">;
+    ACCESS_DENIED: _better_auth_core_utils_error_codes0.RawError<"ACCESS_DENIED">;
+    INVALID_USER_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_USER_CODE">;
+    DEVICE_CODE_ALREADY_PROCESSED: _better_auth_core_utils_error_codes0.RawError<"DEVICE_CODE_ALREADY_PROCESSED">;
+    POLLING_TOO_FREQUENTLY: _better_auth_core_utils_error_codes0.RawError<"POLLING_TOO_FREQUENTLY">;
+    INVALID_DEVICE_CODE_STATUS: _better_auth_core_utils_error_codes0.RawError<"INVALID_DEVICE_CODE_STATUS">;
+    AUTHENTICATION_REQUIRED: _better_auth_core_utils_error_codes0.RawError<"AUTHENTICATION_REQUIRED">;
+  };
+  options: Partial<{
+    expiresIn: TimeString;
+    interval: TimeString;
+    deviceCodeLength: number;
+    userCodeLength: number;
+    schema: {
+      deviceCode?: {
+        modelName?: string | undefined;
+        fields?: {
+          deviceCode?: string | undefined;
+          userCode?: string | undefined;
+          userId?: string | undefined;
+          expiresAt?: string | undefined;
+          status?: string | undefined;
+          lastPolledAt?: string | undefined;
+          pollingInterval?: string | undefined;
+          clientId?: string | undefined;
+          scope?: string | undefined;
+        } | undefined;
+      } | undefined;
+    };
+    generateDeviceCode?: (() => string | Promise<string>) | undefined;
+    generateUserCode?: (() => string | Promise<string>) | undefined;
+    validateClient?: ((clientId: string) => boolean | Promise<boolean>) | undefined;
+    onDeviceAuthRequest?: ((clientId: string, scope: string | undefined) => void | Promise<void>) | undefined;
+    verificationUri?: string | undefined;
+  }>;
+};
+//#endregion
+export { DeviceAuthorizationOptions, TimeString, deviceAuthorization, deviceAuthorizationOptionsSchema, ms, sec };
+//# sourceMappingURL=index.d.mts.map

package/dist/plugins/device-authorization/index.mjs

@@ -0,0 +1,50 @@
+import { mergeSchema } from "../../db/schema.mjs";
+import "../../db/index.mjs";
+import { ms } from "../../utils/time.mjs";
+import { DEVICE_AUTHORIZATION_ERROR_CODES } from "./error-codes.mjs";
+import { deviceApprove, deviceCode, deviceDeny, deviceToken, deviceVerify } from "./routes.mjs";
+import { schema } from "./schema.mjs";
+import * as z from "zod";
+
+//#region src/plugins/device-authorization/index.ts
+const timeStringSchema = z.custom((val) => {
+	if (typeof val !== "string") return false;
+	try {
+		ms(val);
+		return true;
+	} catch {
+		return false;
+	}
+}, { message: "Invalid time string format. Use formats like '30m', '5s', '1h', etc." });
+const deviceAuthorizationOptionsSchema = z.object({
+	expiresIn: timeStringSchema.default("30m").describe("Time in seconds until the device code expires. Use formats like '30m', '5s', '1h', etc."),
+	interval: timeStringSchema.default("5s").describe("Time in seconds between polling attempts. Use formats like '30m', '5s', '1h', etc."),
+	deviceCodeLength: z.number().int().positive().default(40).describe("Length of the device code to be generated. Default is 40 characters."),
+	userCodeLength: z.number().int().positive().default(8).describe("Length of the user code to be generated. Default is 8 characters."),
+	generateDeviceCode: z.custom((val) => typeof val === "function", { message: "generateDeviceCode must be a function that returns a string or a promise that resolves to a string." }).optional().describe("Function to generate a device code. If not provided, a default random string generator will be used."),
+	generateUserCode: z.custom((val) => typeof val === "function", { message: "generateUserCode must be a function that returns a string or a promise that resolves to a string." }).optional().describe("Function to generate a user code. If not provided, a default random string generator will be used."),
+	validateClient: z.custom((val) => typeof val === "function", { message: "validateClient must be a function that returns a boolean or a promise that resolves to a boolean." }).optional().describe("Function to validate the client ID. If not provided, no validation will be performed."),
+	onDeviceAuthRequest: z.custom((val) => typeof val === "function", { message: "onDeviceAuthRequest must be a function that returns void or a promise that resolves to void." }).optional().describe("Function to handle device authorization requests. If not provided, no additional actions will be taken."),
+	verificationUri: z.string().optional().describe("The URI where users verify their device code. Can be an absolute URL (https://example.com/device) or relative path (/custom-path). This will be returned as verification_uri in the device code response. If not provided, defaults to /device."),
+	schema: z.custom(() => true)
+});
+const deviceAuthorization = (options = {}) => {
+	const opts = deviceAuthorizationOptionsSchema.parse(options);
+	return {
+		id: "device-authorization",
+		schema: mergeSchema(schema, options?.schema),
+		endpoints: {
+			deviceCode: deviceCode(opts),
+			deviceToken: deviceToken(opts),
+			deviceVerify,
+			deviceApprove,
+			deviceDeny
+		},
+		$ERROR_CODES: DEVICE_AUTHORIZATION_ERROR_CODES,
+		options
+	};
+};
+
+//#endregion
+export { deviceAuthorization, deviceAuthorizationOptionsSchema };
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/device-authorization/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/device-authorization/index.ts"],"sourcesContent":["import type { BetterAuthPlugin } from \"@better-auth/core\";\nimport * as z from \"zod\";\nimport { mergeSchema } from \"../../db\";\nimport type { InferOptionSchema } from \"../../types/plugins\";\nimport type { TimeString } from \"../../utils/time\";\nimport { ms } from \"../../utils/time\";\nimport { DEVICE_AUTHORIZATION_ERROR_CODES } from \"./error-codes\";\nimport {\n\tdeviceApprove,\n\tdeviceCode,\n\tdeviceDeny,\n\tdeviceToken,\n\tdeviceVerify,\n} from \"./routes\";\nimport { schema } from \"./schema\";\n\ndeclare module \"@better-auth/core\" {\n\tinterface BetterAuthPluginRegistry<AuthOptions, Options> {\n\t\t\"device-authorization\": {\n\t\t\tcreator: typeof deviceAuthorization;\n\t\t};\n\t}\n}\n\nconst timeStringSchema = z.custom<TimeString>(\n\t(val) => {\n\t\tif (typeof val !== \"string\") return false;\n\t\ttry {\n\t\t\tms(val as TimeString);\n\t\t\treturn true;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n\t{\n\t\tmessage:\n\t\t\t\"Invalid time string format. Use formats like '30m', '5s', '1h', etc.\",\n\t},\n);\n\nexport const deviceAuthorizationOptionsSchema = z.object({\n\texpiresIn: timeStringSchema\n\t\t.default(\"30m\")\n\t\t.describe(\n\t\t\t\"Time in seconds until the device code expires. Use formats like '30m', '5s', '1h', etc.\",\n\t\t),\n\tinterval: timeStringSchema\n\t\t.default(\"5s\")\n\t\t.describe(\n\t\t\t\"Time in seconds between polling attempts. Use formats like '30m', '5s', '1h', etc.\",\n\t\t),\n\tdeviceCodeLength: z\n\t\t.number()\n\t\t.int()\n\t\t.positive()\n\t\t.default(40)\n\t\t.describe(\n\t\t\t\"Length of the device code to be generated. Default is 40 characters.\",\n\t\t),\n\tuserCodeLength: z\n\t\t.number()\n\t\t.int()\n\t\t.positive()\n\t\t.default(8)\n\t\t.describe(\n\t\t\t\"Length of the user code to be generated. Default is 8 characters.\",\n\t\t),\n\tgenerateDeviceCode: z\n\t\t.custom<() => string | Promise<string>>(\n\t\t\t(val) => typeof val === \"function\",\n\t\t\t{\n\t\t\t\tmessage:\n\t\t\t\t\t\"generateDeviceCode must be a function that returns a string or a promise that resolves to a string.\",\n\t\t\t},\n\t\t)\n\t\t.optional()\n\t\t.describe(\n\t\t\t\"Function to generate a device code. If not provided, a default random string generator will be used.\",\n\t\t),\n\tgenerateUserCode: z\n\t\t.custom<() => string | Promise<string>>(\n\t\t\t(val) => typeof val === \"function\",\n\t\t\t{\n\t\t\t\tmessage:\n\t\t\t\t\t\"generateUserCode must be a function that returns a string or a promise that resolves to a string.\",\n\t\t\t},\n\t\t)\n\t\t.optional()\n\t\t.describe(\n\t\t\t\"Function to generate a user code. If not provided, a default random string generator will be used.\",\n\t\t),\n\tvalidateClient: z\n\t\t.custom<(clientId: string) => boolean | Promise<boolean>>(\n\t\t\t(val) => typeof val === \"function\",\n\t\t\t{\n\t\t\t\tmessage:\n\t\t\t\t\t\"validateClient must be a function that returns a boolean or a promise that resolves to a boolean.\",\n\t\t\t},\n\t\t)\n\t\t.optional()\n\t\t.describe(\n\t\t\t\"Function to validate the client ID. If not provided, no validation will be performed.\",\n\t\t),\n\tonDeviceAuthRequest: z\n\t\t.custom<\n\t\t\t(clientId: string, scope: string | undefined) => void | Promise<void>\n\t\t>((val) => typeof val === \"function\", {\n\t\t\tmessage:\n\t\t\t\t\"onDeviceAuthRequest must be a function that returns void or a promise that resolves to void.\",\n\t\t})\n\t\t.optional()\n\t\t.describe(\n\t\t\t\"Function to handle device authorization requests. If not provided, no additional actions will be taken.\",\n\t\t),\n\tverificationUri: z\n\t\t.string()\n\t\t.optional()\n\t\t.describe(\n\t\t\t\"The URI where users verify their device code. Can be an absolute URL (https://example.com/device) or relative path (/custom-path). This will be returned as verification_uri in the device code response. If not provided, defaults to /device.\",\n\t\t),\n\tschema: z.custom<InferOptionSchema<typeof schema>>(() => true),\n});\n\nexport type DeviceAuthorizationOptions = z.infer<\n\ttypeof deviceAuthorizationOptionsSchema\n>;\n\nexport const deviceAuthorization = (\n\toptions: Partial<DeviceAuthorizationOptions> = {},\n) => {\n\tconst opts = deviceAuthorizationOptionsSchema.parse(options);\n\n\treturn {\n\t\tid: \"device-authorization\",\n\t\tschema: mergeSchema(schema, options?.schema),\n\t\tendpoints: {\n\t\t\tdeviceCode: deviceCode(opts),\n\t\t\tdeviceToken: deviceToken(opts),\n\t\t\tdeviceVerify,\n\t\t\tdeviceApprove,\n\t\t\tdeviceDeny,\n\t\t},\n\t\t$ERROR_CODES: DEVICE_AUTHORIZATION_ERROR_CODES,\n\t\toptions,\n\t} satisfies BetterAuthPlugin;\n};\n\nexport type * from \"../../utils/time\";\n"],"mappings":";;;;;;;;;AAwBA,MAAM,mBAAmB,EAAE,QACzB,QAAQ;AACR,KAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,KAAI;AACH,KAAG,IAAkB;AACrB,SAAO;SACA;AACP,SAAO;;GAGT,EACC,SACC,wEACD,CACD;AAED,MAAa,mCAAmC,EAAE,OAAO;CACxD,WAAW,iBACT,QAAQ,MAAM,CACd,SACA,0FACA;CACF,UAAU,iBACR,QAAQ,KAAK,CACb,SACA,qFACA;CACF,kBAAkB,EAChB,QAAQ,CACR,KAAK,CACL,UAAU,CACV,QAAQ,GAAG,CACX,SACA,uEACA;CACF,gBAAgB,EACd,QAAQ,CACR,KAAK,CACL,UAAU,CACV,QAAQ,EAAE,CACV,SACA,oEACA;CACF,oBAAoB,EAClB,QACC,QAAQ,OAAO,QAAQ,YACxB,EACC,SACC,uGACD,CACD,CACA,UAAU,CACV,SACA,uGACA;CACF,kBAAkB,EAChB,QACC,QAAQ,OAAO,QAAQ,YACxB,EACC,SACC,qGACD,CACD,CACA,UAAU,CACV,SACA,qGACA;CACF,gBAAgB,EACd,QACC,QAAQ,OAAO,QAAQ,YACxB,EACC,SACC,qGACD,CACD,CACA,UAAU,CACV,SACA,wFACA;CACF,qBAAqB,EACnB,QAEE,QAAQ,OAAO,QAAQ,YAAY,EACrC,SACC,gGACD,CAAC,CACD,UAAU,CACV,SACA,0GACA;CACF,iBAAiB,EACf,QAAQ,CACR,UAAU,CACV,SACA,kPACA;CACF,QAAQ,EAAE,aAA+C,KAAK;CAC9D,CAAC;AAMF,MAAa,uBACZ,UAA+C,EAAE,KAC7C;CACJ,MAAM,OAAO,iCAAiC,MAAM,QAAQ;AAE5D,QAAO;EACN,IAAI;EACJ,QAAQ,YAAY,QAAQ,SAAS,OAAO;EAC5C,WAAW;GACV,YAAY,WAAW,KAAK;GAC5B,aAAa,YAAY,KAAK;GAC9B;GACA;GACA;GACA;EACD,cAAc;EACd;EACA"}