@sirketio/auth 0.0.1

package/dist/plugins/one-time-token/index.d.mts

@@ -0,0 +1,133 @@
+import { Session, User } from "../../types/models.mjs";
+import "../../types/index.mjs";
+import { GenericEndpointContext } from "@better-auth/core";
+import * as better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/plugins/one-time-token/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "one-time-token": {
+      creator: typeof oneTimeToken;
+    };
+  }
+}
+interface OneTimeTokenOptions {
+  /**
+   * Expires in minutes
+   *
+   * @default 3
+   */
+  expiresIn?: number | undefined;
+  /**
+   * Only allow server initiated requests
+   */
+  disableClientRequest?: boolean | undefined;
+  /**
+   * Generate a custom token
+   */
+  generateToken?: ((session: {
+    user: User & Record<string, any>;
+    session: Session & Record<string, any>;
+  }, ctx: GenericEndpointContext) => Promise<string>) | undefined;
+  /**
+   * Disable setting the session cookie when the token is verified
+   */
+  disableSetSessionCookie?: boolean;
+  /**
+   * This option allows you to configure how the token is stored in your database.
+   * Note: This will not affect the token that's sent, it will only affect the token stored in your database.
+   *
+   * @default "plain"
+   */
+  storeToken?: ("plain" | "hashed" | {
+    type: "custom-hasher";
+    hash: (token: string) => Promise<string>;
+  }) | undefined;
+  /**
+   * Set the OTT header on new sessions
+   */
+  setOttHeaderOnNewSession?: boolean;
+}
+declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
+  id: "one-time-token";
+  endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * GET `/one-time-token/generate`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.generateOneTimeToken`
+     *
+     * **client:**
+     * `authClient.oneTimeToken.generate`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-generate)
+     */
+    generateOneTimeToken: better_call0.StrictEndpoint<"/one-time-token/generate", {
+      method: "GET";
+      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+    }, {
+      token: string;
+    }>;
+    /**
+     * ### Endpoint
+     *
+     * POST `/one-time-token/verify`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.verifyOneTimeToken`
+     *
+     * **client:**
+     * `authClient.oneTimeToken.verify`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-verify)
+     */
+    verifyOneTimeToken: better_call0.StrictEndpoint<"/one-time-token/verify", {
+      method: "POST";
+      body: z.ZodObject<{
+        token: z.ZodString;
+      }, z.core.$strip>;
+    }, {
+      session: Session & Record<string, any>;
+      user: User & Record<string, any>;
+    }>;
+  };
+  hooks: {
+    after: {
+      matcher: () => true;
+      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+    }[];
+  };
+  options: OneTimeTokenOptions | undefined;
+};
+//#endregion
+export { OneTimeTokenOptions, oneTimeToken };
+//# sourceMappingURL=index.d.mts.map

package/dist/plugins/one-time-token/index.mjs

@@ -0,0 +1,82 @@
+import { generateRandomString } from "../../crypto/random.mjs";
+import "../../crypto/index.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { sessionMiddleware } from "../../api/routes/session.mjs";
+import "../../api/index.mjs";
+import { defaultKeyHasher } from "./utils.mjs";
+import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
+import * as z from "zod";
+
+//#region src/plugins/one-time-token/index.ts
+const verifyOneTimeTokenBodySchema = z.object({ token: z.string().meta({ description: "The token to verify. Eg: \"some-token\"" }) });
+const oneTimeToken = (options) => {
+	const opts = {
+		storeToken: "plain",
+		...options
+	};
+	async function storeToken(ctx, token) {
+		if (opts.storeToken === "hashed") return await defaultKeyHasher(token);
+		if (typeof opts.storeToken === "object" && "type" in opts.storeToken && opts.storeToken.type === "custom-hasher") return await opts.storeToken.hash(token);
+		return token;
+	}
+	async function generateToken(c, session) {
+		const token = opts?.generateToken ? await opts.generateToken(session, c) : generateRandomString(32);
+		const expiresAt = new Date(Date.now() + (opts?.expiresIn ?? 3) * 60 * 1e3);
+		const storedToken = await storeToken(c, token);
+		await c.context.internalAdapter.createVerificationValue({
+			value: session.session.token,
+			identifier: `one-time-token:${storedToken}`,
+			expiresAt
+		});
+		return token;
+	}
+	return {
+		id: "one-time-token",
+		endpoints: {
+			generateOneTimeToken: createAuthEndpoint("/one-time-token/generate", {
+				method: "GET",
+				use: [sessionMiddleware]
+			}, async (c) => {
+				if (opts?.disableClientRequest && c.request) throw c.error("BAD_REQUEST", { message: "Client requests are disabled" });
+				const session = c.context.session;
+				const token = await generateToken(c, session);
+				return c.json({ token });
+			}),
+			verifyOneTimeToken: createAuthEndpoint("/one-time-token/verify", {
+				method: "POST",
+				body: verifyOneTimeTokenBodySchema
+			}, async (c) => {
+				const { token } = c.body;
+				const storedToken = await storeToken(c, token);
+				const verificationValue = await c.context.internalAdapter.findVerificationValue(`one-time-token:${storedToken}`);
+				if (!verificationValue) throw c.error("BAD_REQUEST", { message: "Invalid token" });
+				await c.context.internalAdapter.deleteVerificationValue(verificationValue.id);
+				if (verificationValue.expiresAt < /* @__PURE__ */ new Date()) throw c.error("BAD_REQUEST", { message: "Token expired" });
+				const session = await c.context.internalAdapter.findSession(verificationValue.value);
+				if (!session) throw c.error("BAD_REQUEST", { message: "Session not found" });
+				if (!opts?.disableSetSessionCookie) await setSessionCookie(c, session);
+				if (session.session.expiresAt < /* @__PURE__ */ new Date()) throw c.error("BAD_REQUEST", { message: "Session expired" });
+				return c.json(session);
+			})
+		},
+		hooks: { after: [{
+			matcher: () => true,
+			handler: createAuthMiddleware(async (ctx) => {
+				if (ctx.context.newSession) {
+					if (!opts?.setOttHeaderOnNewSession) return;
+					const exposedHeaders = ctx.context.responseHeaders?.get("access-control-expose-headers") || "";
+					const headersSet = new Set(exposedHeaders.split(",").map((header) => header.trim()).filter(Boolean));
+					headersSet.add("set-ott");
+					const token = await generateToken(ctx, ctx.context.newSession);
+					ctx.setHeader("set-ott", token);
+					ctx.setHeader("Access-Control-Expose-Headers", Array.from(headersSet).join(", "));
+				}
+			})
+		}] },
+		options
+	};
+};
+
+//#endregion
+export { oneTimeToken };
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/one-time-token/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/one-time-token/index.ts"],"sourcesContent":["import type {\n\tBetterAuthPlugin,\n\tGenericEndpointContext,\n} from \"@better-auth/core\";\nimport {\n\tcreateAuthEndpoint,\n\tcreateAuthMiddleware,\n} from \"@better-auth/core/api\";\nimport * as z from \"zod\";\nimport { sessionMiddleware } from \"../../api\";\nimport { setSessionCookie } from \"../../cookies\";\nimport { generateRandomString } from \"../../crypto\";\nimport type { Session, User } from \"../../types\";\nimport { defaultKeyHasher } from \"./utils\";\n\ndeclare module \"@better-auth/core\" {\n\tinterface BetterAuthPluginRegistry<AuthOptions, Options> {\n\t\t\"one-time-token\": {\n\t\t\tcreator: typeof oneTimeToken;\n\t\t};\n\t}\n}\n\nexport interface OneTimeTokenOptions {\n\t/**\n\t * Expires in minutes\n\t *\n\t * @default 3\n\t */\n\texpiresIn?: number | undefined;\n\t/**\n\t * Only allow server initiated requests\n\t */\n\tdisableClientRequest?: boolean | undefined;\n\t/**\n\t * Generate a custom token\n\t */\n\tgenerateToken?:\n\t\t| ((\n\t\t\t\tsession: {\n\t\t\t\t\tuser: User & Record<string, any>;\n\t\t\t\t\tsession: Session & Record<string, any>;\n\t\t\t\t},\n\t\t\t\tctx: GenericEndpointContext,\n\t\t  ) => Promise<string>)\n\t\t| undefined;\n\t/**\n\t * Disable setting the session cookie when the token is verified\n\t */\n\tdisableSetSessionCookie?: boolean;\n\t/**\n\t * This option allows you to configure how the token is stored in your database.\n\t * Note: This will not affect the token that's sent, it will only affect the token stored in your database.\n\t *\n\t * @default \"plain\"\n\t */\n\tstoreToken?:\n\t\t| (\n\t\t\t\t| \"plain\"\n\t\t\t\t| \"hashed\"\n\t\t\t\t| { type: \"custom-hasher\"; hash: (token: string) => Promise<string> }\n\t\t  )\n\t\t| undefined;\n\t/**\n\t * Set the OTT header on new sessions\n\t */\n\tsetOttHeaderOnNewSession?: boolean;\n}\n\nconst verifyOneTimeTokenBodySchema = z.object({\n\ttoken: z.string().meta({\n\t\tdescription: 'The token to verify. Eg: \"some-token\"',\n\t}),\n});\n\nexport const oneTimeToken = (options?: OneTimeTokenOptions | undefined) => {\n\tconst opts = {\n\t\tstoreToken: \"plain\",\n\t\t...options,\n\t} satisfies OneTimeTokenOptions;\n\n\tasync function storeToken(ctx: GenericEndpointContext, token: string) {\n\t\tif (opts.storeToken === \"hashed\") {\n\t\t\treturn await defaultKeyHasher(token);\n\t\t}\n\t\tif (\n\t\t\ttypeof opts.storeToken === \"object\" &&\n\t\t\t\"type\" in opts.storeToken &&\n\t\t\topts.storeToken.type === \"custom-hasher\"\n\t\t) {\n\t\t\treturn await opts.storeToken.hash(token);\n\t\t}\n\n\t\treturn token;\n\t}\n\n\tasync function generateToken(\n\t\tc: GenericEndpointContext,\n\t\tsession: {\n\t\t\tsession: Session;\n\t\t\tuser: User;\n\t\t},\n\t) {\n\t\tconst token = opts?.generateToken\n\t\t\t? await opts.generateToken(session, c)\n\t\t\t: generateRandomString(32);\n\t\tconst expiresAt = new Date(Date.now() + (opts?.expiresIn ?? 3) * 60 * 1000);\n\t\tconst storedToken = await storeToken(c, token);\n\t\tawait c.context.internalAdapter.createVerificationValue({\n\t\t\tvalue: session.session.token,\n\t\t\tidentifier: `one-time-token:${storedToken}`,\n\t\t\texpiresAt,\n\t\t});\n\t\treturn token;\n\t}\n\n\treturn {\n\t\tid: \"one-time-token\",\n\t\tendpoints: {\n\t\t\t/**\n\t\t\t * ### Endpoint\n\t\t\t *\n\t\t\t * GET `/one-time-token/generate`\n\t\t\t *\n\t\t\t * ### API Methods\n\t\t\t *\n\t\t\t * **server:**\n\t\t\t * `auth.api.generateOneTimeToken`\n\t\t\t *\n\t\t\t * **client:**\n\t\t\t * `authClient.oneTimeToken.generate`\n\t\t\t *\n\t\t\t * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-generate)\n\t\t\t */\n\t\t\tgenerateOneTimeToken: createAuthEndpoint(\n\t\t\t\t\"/one-time-token/generate\",\n\t\t\t\t{\n\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\tuse: [sessionMiddleware],\n\t\t\t\t},\n\t\t\t\tasync (c) => {\n\t\t\t\t\t//if request exist, it means it's a client request\n\t\t\t\t\tif (opts?.disableClientRequest && c.request) {\n\t\t\t\t\t\tthrow c.error(\"BAD_REQUEST\", {\n\t\t\t\t\t\t\tmessage: \"Client requests are disabled\",\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\tconst session = c.context.session;\n\t\t\t\t\tconst token = await generateToken(c, session);\n\t\t\t\t\treturn c.json({ token });\n\t\t\t\t},\n\t\t\t),\n\t\t\t/**\n\t\t\t * ### Endpoint\n\t\t\t *\n\t\t\t * POST `/one-time-token/verify`\n\t\t\t *\n\t\t\t * ### API Methods\n\t\t\t *\n\t\t\t * **server:**\n\t\t\t * `auth.api.verifyOneTimeToken`\n\t\t\t *\n\t\t\t * **client:**\n\t\t\t * `authClient.oneTimeToken.verify`\n\t\t\t *\n\t\t\t * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-verify)\n\t\t\t */\n\t\t\tverifyOneTimeToken: createAuthEndpoint(\n\t\t\t\t\"/one-time-token/verify\",\n\t\t\t\t{\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\tbody: verifyOneTimeTokenBodySchema,\n\t\t\t\t},\n\t\t\t\tasync (c) => {\n\t\t\t\t\tconst { token } = c.body;\n\t\t\t\t\tconst storedToken = await storeToken(c, token);\n\t\t\t\t\tconst verificationValue =\n\t\t\t\t\t\tawait c.context.internalAdapter.findVerificationValue(\n\t\t\t\t\t\t\t`one-time-token:${storedToken}`,\n\t\t\t\t\t\t);\n\t\t\t\t\tif (!verificationValue) {\n\t\t\t\t\t\tthrow c.error(\"BAD_REQUEST\", {\n\t\t\t\t\t\t\tmessage: \"Invalid token\",\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\tawait c.context.internalAdapter.deleteVerificationValue(\n\t\t\t\t\t\tverificationValue.id,\n\t\t\t\t\t);\n\t\t\t\t\tif (verificationValue.expiresAt < new Date()) {\n\t\t\t\t\t\tthrow c.error(\"BAD_REQUEST\", {\n\t\t\t\t\t\t\tmessage: \"Token expired\",\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\tconst session = await c.context.internalAdapter.findSession(\n\t\t\t\t\t\tverificationValue.value,\n\t\t\t\t\t);\n\t\t\t\t\tif (!session) {\n\t\t\t\t\t\tthrow c.error(\"BAD_REQUEST\", {\n\t\t\t\t\t\t\tmessage: \"Session not found\",\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\tif (!opts?.disableSetSessionCookie) {\n\t\t\t\t\t\tawait setSessionCookie(c, session);\n\t\t\t\t\t}\n\n\t\t\t\t\tif (session.session.expiresAt < new Date()) {\n\t\t\t\t\t\tthrow c.error(\"BAD_REQUEST\", {\n\t\t\t\t\t\t\tmessage: \"Session expired\",\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\n\t\t\t\t\treturn c.json(session);\n\t\t\t\t},\n\t\t\t),\n\t\t},\n\t\thooks: {\n\t\t\tafter: [\n\t\t\t\t{\n\t\t\t\t\tmatcher: () => true,\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tif (ctx.context.newSession) {\n\t\t\t\t\t\t\tif (!opts?.setOttHeaderOnNewSession) {\n\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tconst exposedHeaders =\n\t\t\t\t\t\t\t\tctx.context.responseHeaders?.get(\n\t\t\t\t\t\t\t\t\t\"access-control-expose-headers\",\n\t\t\t\t\t\t\t\t) || \"\";\n\t\t\t\t\t\t\tconst headersSet = new Set(\n\t\t\t\t\t\t\t\texposedHeaders\n\t\t\t\t\t\t\t\t\t.split(\",\")\n\t\t\t\t\t\t\t\t\t.map((header) => header.trim())\n\t\t\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\theadersSet.add(\"set-ott\");\n\t\t\t\t\t\t\tconst token = await generateToken(ctx, ctx.context.newSession);\n\t\t\t\t\t\t\tctx.setHeader(\"set-ott\", token);\n\t\t\t\t\t\t\tctx.setHeader(\n\t\t\t\t\t\t\t\t\"Access-Control-Expose-Headers\",\n\t\t\t\t\t\t\t\tArray.from(headersSet).join(\", \"),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\toptions,\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;;;;AAqEA,MAAM,+BAA+B,EAAE,OAAO,EAC7C,OAAO,EAAE,QAAQ,CAAC,KAAK,EACtB,aAAa,2CACb,CAAC,EACF,CAAC;AAEF,MAAa,gBAAgB,YAA8C;CAC1E,MAAM,OAAO;EACZ,YAAY;EACZ,GAAG;EACH;CAED,eAAe,WAAW,KAA6B,OAAe;AACrE,MAAI,KAAK,eAAe,SACvB,QAAO,MAAM,iBAAiB,MAAM;AAErC,MACC,OAAO,KAAK,eAAe,YAC3B,UAAU,KAAK,cACf,KAAK,WAAW,SAAS,gBAEzB,QAAO,MAAM,KAAK,WAAW,KAAK,MAAM;AAGzC,SAAO;;CAGR,eAAe,cACd,GACA,SAIC;EACD,MAAM,QAAQ,MAAM,gBACjB,MAAM,KAAK,cAAc,SAAS,EAAE,GACpC,qBAAqB,GAAG;EAC3B,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,IAAI,MAAM,aAAa,KAAK,KAAK,IAAK;EAC3E,MAAM,cAAc,MAAM,WAAW,GAAG,MAAM;AAC9C,QAAM,EAAE,QAAQ,gBAAgB,wBAAwB;GACvD,OAAO,QAAQ,QAAQ;GACvB,YAAY,kBAAkB;GAC9B;GACA,CAAC;AACF,SAAO;;AAGR,QAAO;EACN,IAAI;EACJ,WAAW;GAgBV,sBAAsB,mBACrB,4BACA;IACC,QAAQ;IACR,KAAK,CAAC,kBAAkB;IACxB,EACD,OAAO,MAAM;AAEZ,QAAI,MAAM,wBAAwB,EAAE,QACnC,OAAM,EAAE,MAAM,eAAe,EAC5B,SAAS,gCACT,CAAC;IAEH,MAAM,UAAU,EAAE,QAAQ;IAC1B,MAAM,QAAQ,MAAM,cAAc,GAAG,QAAQ;AAC7C,WAAO,EAAE,KAAK,EAAE,OAAO,CAAC;KAEzB;GAgBD,oBAAoB,mBACnB,0BACA;IACC,QAAQ;IACR,MAAM;IACN,EACD,OAAO,MAAM;IACZ,MAAM,EAAE,UAAU,EAAE;IACpB,MAAM,cAAc,MAAM,WAAW,GAAG,MAAM;IAC9C,MAAM,oBACL,MAAM,EAAE,QAAQ,gBAAgB,sBAC/B,kBAAkB,cAClB;AACF,QAAI,CAAC,kBACJ,OAAM,EAAE,MAAM,eAAe,EAC5B,SAAS,iBACT,CAAC;AAEH,UAAM,EAAE,QAAQ,gBAAgB,wBAC/B,kBAAkB,GAClB;AACD,QAAI,kBAAkB,4BAAY,IAAI,MAAM,CAC3C,OAAM,EAAE,MAAM,eAAe,EAC5B,SAAS,iBACT,CAAC;IAEH,MAAM,UAAU,MAAM,EAAE,QAAQ,gBAAgB,YAC/C,kBAAkB,MAClB;AACD,QAAI,CAAC,QACJ,OAAM,EAAE,MAAM,eAAe,EAC5B,SAAS,qBACT,CAAC;AAEH,QAAI,CAAC,MAAM,wBACV,OAAM,iBAAiB,GAAG,QAAQ;AAGnC,QAAI,QAAQ,QAAQ,4BAAY,IAAI,MAAM,CACzC,OAAM,EAAE,MAAM,eAAe,EAC5B,SAAS,mBACT,CAAC;AAGH,WAAO,EAAE,KAAK,QAAQ;KAEvB;GACD;EACD,OAAO,EACN,OAAO,CACN;GACC,eAAe;GACf,SAAS,qBAAqB,OAAO,QAAQ;AAC5C,QAAI,IAAI,QAAQ,YAAY;AAC3B,SAAI,CAAC,MAAM,yBACV;KAED,MAAM,iBACL,IAAI,QAAQ,iBAAiB,IAC5B,gCACA,IAAI;KACN,MAAM,aAAa,IAAI,IACtB,eACE,MAAM,IAAI,CACV,KAAK,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ,CACjB;AACD,gBAAW,IAAI,UAAU;KACzB,MAAM,QAAQ,MAAM,cAAc,KAAK,IAAI,QAAQ,WAAW;AAC9D,SAAI,UAAU,WAAW,MAAM;AAC/B,SAAI,UACH,iCACA,MAAM,KAAK,WAAW,CAAC,KAAK,KAAK,CACjC;;KAED;GACF,CACD,EACD;EACD;EACA"}

package/dist/plugins/one-time-token/utils.mjs

@@ -0,0 +1,12 @@
+import { base64Url } from "@better-auth/utils/base64";
+import { createHash } from "@better-auth/utils/hash";
+
+//#region src/plugins/one-time-token/utils.ts
+const defaultKeyHasher = async (token) => {
+	const hash = await createHash("SHA-256").digest(new TextEncoder().encode(token));
+	return base64Url.encode(new Uint8Array(hash), { padding: false });
+};
+
+//#endregion
+export { defaultKeyHasher };
+//# sourceMappingURL=utils.mjs.map

package/dist/plugins/one-time-token/utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.mjs","names":[],"sources":["../../../src/plugins/one-time-token/utils.ts"],"sourcesContent":["import { base64Url } from \"@better-auth/utils/base64\";\nimport { createHash } from \"@better-auth/utils/hash\";\nexport const defaultKeyHasher = async (token: string) => {\n\tconst hash = await createHash(\"SHA-256\").digest(\n\t\tnew TextEncoder().encode(token),\n\t);\n\tconst hashed = base64Url.encode(new Uint8Array(hash), {\n\t\tpadding: false,\n\t});\n\treturn hashed;\n};\n"],"mappings":";;;;AAEA,MAAa,mBAAmB,OAAO,UAAkB;CACxD,MAAM,OAAO,MAAM,WAAW,UAAU,CAAC,OACxC,IAAI,aAAa,CAAC,OAAO,MAAM,CAC/B;AAID,QAHe,UAAU,OAAO,IAAI,WAAW,KAAK,EAAE,EACrD,SAAS,OACT,CAAC"}

package/dist/plugins/open-api/generator.d.mts

@@ -0,0 +1,115 @@
+import { AuthContext, BetterAuthOptions } from "@better-auth/core";
+import { DBFieldAttributeConfig, DBFieldType } from "@better-auth/core/db";
+import { OpenAPIParameter, OpenAPISchemaType } from "better-call";
+
+//#region src/plugins/open-api/generator.d.ts
+interface Path {
+  get?: {
+    tags?: string[];
+    operationId?: string;
+    description?: string;
+    security?: [{
+      bearerAuth: string[];
+    }];
+    parameters?: OpenAPIParameter[];
+    responses?: { [key in string]: {
+      description?: string;
+      content: {
+        "application/json": {
+          schema: {
+            type?: OpenAPISchemaType;
+            properties?: Record<string, any>;
+            required?: string[];
+            $ref?: string;
+          };
+        };
+      };
+    } };
+  } | undefined;
+  post?: {
+    tags?: string[];
+    operationId?: string;
+    description?: string;
+    security?: [{
+      bearerAuth: string[];
+    }];
+    parameters?: OpenAPIParameter[];
+    requestBody?: {
+      content: {
+        "application/json": {
+          schema: {
+            type?: OpenAPISchemaType;
+            properties?: Record<string, any>;
+            required?: string[];
+            $ref?: string;
+          };
+        };
+      };
+    };
+    responses?: { [key in string]: {
+      description?: string;
+      content: {
+        "application/json": {
+          schema: {
+            type?: OpenAPISchemaType;
+            properties?: Record<string, any>;
+            required?: string[];
+            $ref?: string;
+          };
+        };
+      };
+    } };
+  } | undefined;
+}
+type FieldSchema = {
+  type: DBFieldType;
+  default?: (DBFieldAttributeConfig["defaultValue"] | "Generated at runtime") | undefined;
+  readOnly?: boolean | undefined;
+  format?: string;
+};
+type OpenAPIModelSchema = {
+  type: "object";
+  properties: Record<string, FieldSchema>;
+  required?: string[] | undefined;
+};
+declare function generator(ctx: AuthContext, options: BetterAuthOptions): Promise<{
+  openapi: string;
+  info: {
+    title: string;
+    description: string;
+    version: string;
+  };
+  components: {
+    securitySchemes: {
+      apiKeyCookie: {
+        type: string;
+        in: string;
+        name: string;
+        description: string;
+      };
+      bearerAuth: {
+        type: string;
+        scheme: string;
+        description: string;
+      };
+    };
+    schemas: {
+      [x: string]: OpenAPIModelSchema;
+    };
+  };
+  security: {
+    apiKeyCookie: never[];
+    bearerAuth: never[];
+  }[];
+  servers: {
+    url: string;
+  }[];
+  tags: {
+    name: string;
+    description: string;
+  }[];
+  paths: Record<string, Path>;
+}>;
+//#endregion
+export { FieldSchema, OpenAPIModelSchema, Path, generator };
+//# sourceMappingURL=generator.d.mts.map

package/dist/plugins/open-api/generator.mjs

@@ -0,0 +1,315 @@
+import { db_exports } from "../../db/index.mjs";
+import { getEndpoints } from "../../api/index.mjs";
+import * as z from "zod";
+
+//#region src/plugins/open-api/generator.ts
+const allowedType = new Set([
+	"string",
+	"number",
+	"boolean",
+	"array",
+	"object"
+]);
+function getTypeFromZodType(zodType) {
+	if (zodType instanceof z.ZodDefault) return getTypeFromZodType(zodType.unwrap());
+	const type = zodType.type;
+	return allowedType.has(type) ? type : "string";
+}
+function getFieldSchema(field) {
+	const schema = {
+		type: field.type === "date" ? "string" : field.type,
+		...field.type === "date" && { format: "date-time" }
+	};
+	if (field.defaultValue !== void 0) schema.default = typeof field.defaultValue === "function" ? "Generated at runtime" : field.defaultValue;
+	if (field.input === false) schema.readOnly = true;
+	return schema;
+}
+function getParameters(options) {
+	const parameters = [];
+	if (options.metadata?.openapi?.parameters) {
+		parameters.push(...options.metadata.openapi.parameters);
+		return parameters;
+	}
+	if (options.query instanceof z.ZodObject) Object.entries(options.query.shape).forEach(([key, value]) => {
+		if (value instanceof z.ZodType) parameters.push({
+			name: key,
+			in: "query",
+			schema: {
+				...processZodType(value),
+				..."minLength" in value && value.minLength ? { minLength: value.minLength } : {}
+			}
+		});
+	});
+	return parameters;
+}
+function getRequestBody(options) {
+	if (options.metadata?.openapi?.requestBody) return options.metadata.openapi.requestBody;
+	if (!options.body) return void 0;
+	if (options.body instanceof z.ZodObject || options.body instanceof z.ZodOptional) {
+		const shape = options.body.shape;
+		if (!shape) return void 0;
+		const properties = {};
+		const required = [];
+		Object.entries(shape).forEach(([key, value]) => {
+			if (value instanceof z.ZodType) {
+				properties[key] = processZodType(value);
+				if (!(value instanceof z.ZodOptional)) required.push(key);
+			}
+		});
+		return {
+			required: options.body instanceof z.ZodOptional ? false : options.body ? true : false,
+			content: { "application/json": { schema: {
+				type: "object",
+				properties,
+				required
+			} } }
+		};
+	}
+}
+function processZodType(zodType) {
+	if (zodType instanceof z.ZodOptional) {
+		const innerSchema = processZodType(zodType.unwrap());
+		if (innerSchema.type) {
+			const type = Array.isArray(innerSchema.type) ? innerSchema.type : [innerSchema.type];
+			return {
+				...innerSchema,
+				type: Array.from(new Set([...type, "null"]))
+			};
+		}
+		return { anyOf: [innerSchema, { type: "null" }] };
+	}
+	if (zodType instanceof z.ZodDefault) {
+		const innerSchema = processZodType(zodType.unwrap());
+		const defaultValueDef = zodType._def.defaultValue;
+		const defaultValue = typeof defaultValueDef === "function" ? defaultValueDef() : defaultValueDef;
+		return {
+			...innerSchema,
+			default: defaultValue
+		};
+	}
+	if (zodType instanceof z.ZodObject) {
+		const shape = zodType.shape;
+		if (shape) {
+			const properties = {};
+			const required = [];
+			Object.entries(shape).forEach(([key, value]) => {
+				if (value instanceof z.ZodType) {
+					properties[key] = processZodType(value);
+					if (!(value instanceof z.ZodOptional)) required.push(key);
+				}
+			});
+			return {
+				type: "object",
+				properties,
+				...required.length > 0 ? { required } : {},
+				description: zodType.description
+			};
+		}
+	}
+	return {
+		type: getTypeFromZodType(zodType),
+		description: zodType.description
+	};
+}
+function getResponse(responses) {
+	return {
+		"400": {
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { message: { type: "string" } },
+				required: ["message"]
+			} } },
+			description: "Bad Request. Usually due to missing parameters, or invalid parameters."
+		},
+		"401": {
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { message: { type: "string" } },
+				required: ["message"]
+			} } },
+			description: "Unauthorized. Due to missing or invalid authentication."
+		},
+		"403": {
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { message: { type: "string" } }
+			} } },
+			description: "Forbidden. You do not have permission to access this resource or to perform this action."
+		},
+		"404": {
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { message: { type: "string" } }
+			} } },
+			description: "Not Found. The requested resource was not found."
+		},
+		"429": {
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { message: { type: "string" } }
+			} } },
+			description: "Too Many Requests. You have exceeded the rate limit. Try again later."
+		},
+		"500": {
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { message: { type: "string" } }
+			} } },
+			description: "Internal Server Error. This is a problem with the server that you cannot fix."
+		},
+		...responses
+	};
+}
+function toOpenApiPath(path) {
+	return path.split("/").map((part) => part.startsWith(":") ? `{${part.slice(1)}}` : part).join("/");
+}
+async function generator(ctx, options) {
+	const baseEndpoints = getEndpoints(ctx, {
+		...options,
+		plugins: []
+	});
+	const tables = (0, db_exports.getAuthTables)({
+		...options,
+		session: {
+			...options.session,
+			storeSessionInDatabase: true
+		}
+	});
+	const components = { schemas: { ...Object.entries(tables).reduce((acc, [key, value]) => {
+		const modelName = key.charAt(0).toUpperCase() + key.slice(1);
+		const fields = value.fields;
+		const required = [];
+		const properties = { id: { type: "string" } };
+		Object.entries(fields).forEach(([fieldKey, fieldValue]) => {
+			if (!fieldValue) return;
+			properties[fieldKey] = getFieldSchema(fieldValue);
+			if (fieldValue.required && fieldValue.input !== false) required.push(fieldKey);
+		});
+		Object.entries(properties).forEach(([key, prop]) => {
+			const field = value.fields[key];
+			if (field && field.type === "date" && prop.type === "string") prop.format = "date-time";
+		});
+		acc[modelName] = {
+			type: "object",
+			properties,
+			required
+		};
+		return acc;
+	}, {}) } };
+	const paths = {};
+	Object.entries(baseEndpoints.api).forEach(([_, value]) => {
+		if (!value.path || ctx.options.disabledPaths?.includes(value.path)) return;
+		const options = value.options;
+		if (options.metadata?.SERVER_ONLY) return;
+		const path = toOpenApiPath(value.path);
+		const methods = Array.isArray(options.method) ? options.method : [options.method];
+		for (const method of methods.filter((m) => m === "GET" || m === "DELETE")) paths[path] = {
+			...paths[path],
+			[method.toLowerCase()]: {
+				tags: ["Default", ...options.metadata?.openapi?.tags || []],
+				description: options.metadata?.openapi?.description,
+				operationId: options.metadata?.openapi?.operationId,
+				security: [{ bearerAuth: [] }],
+				parameters: getParameters(options),
+				responses: getResponse(options.metadata?.openapi?.responses)
+			}
+		};
+		for (const method of methods.filter((m) => m === "POST" || m === "PATCH" || m === "PUT")) {
+			const body = getRequestBody(options);
+			paths[path] = {
+				...paths[path],
+				[method.toLowerCase()]: {
+					tags: ["Default", ...options.metadata?.openapi?.tags || []],
+					description: options.metadata?.openapi?.description,
+					operationId: options.metadata?.openapi?.operationId,
+					security: [{ bearerAuth: [] }],
+					parameters: getParameters(options),
+					...body ? { requestBody: body } : { requestBody: { content: { "application/json": { schema: {
+						type: "object",
+						properties: {}
+					} } } } },
+					responses: getResponse(options.metadata?.openapi?.responses)
+				}
+			};
+		}
+	});
+	for (const plugin of options.plugins || []) {
+		if (plugin.id === "open-api") continue;
+		const pluginEndpoints = getEndpoints(ctx, {
+			...options,
+			plugins: [plugin]
+		});
+		const api = Object.keys(pluginEndpoints.api).map((key) => {
+			if (baseEndpoints.api[key] === void 0) return pluginEndpoints.api[key];
+			return null;
+		}).filter((x) => x !== null);
+		Object.entries(api).forEach(([key, value]) => {
+			if (!value.path || ctx.options.disabledPaths?.includes(value.path)) return;
+			const options = value.options;
+			if (options.metadata?.SERVER_ONLY) return;
+			const path = toOpenApiPath(value.path);
+			const methods = Array.isArray(options.method) ? options.method : [options.method];
+			for (const method of methods.filter((m) => m === "GET" || m === "DELETE")) paths[path] = {
+				...paths[path],
+				[method.toLowerCase()]: {
+					tags: options.metadata?.openapi?.tags || [plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)],
+					description: options.metadata?.openapi?.description,
+					operationId: options.metadata?.openapi?.operationId,
+					security: [{ bearerAuth: [] }],
+					parameters: getParameters(options),
+					responses: getResponse(options.metadata?.openapi?.responses)
+				}
+			};
+			for (const method of methods.filter((m) => m === "POST" || m === "PATCH" || m === "PUT")) paths[path] = {
+				...paths[path],
+				[method.toLowerCase()]: {
+					tags: options.metadata?.openapi?.tags || [plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)],
+					description: options.metadata?.openapi?.description,
+					operationId: options.metadata?.openapi?.operationId,
+					security: [{ bearerAuth: [] }],
+					parameters: getParameters(options),
+					requestBody: getRequestBody(options),
+					responses: getResponse(options.metadata?.openapi?.responses)
+				}
+			};
+		});
+	}
+	return {
+		openapi: "3.1.1",
+		info: {
+			title: "Better Auth",
+			description: "API Reference for your Better Auth Instance",
+			version: "1.1.0"
+		},
+		components: {
+			...components,
+			securitySchemes: {
+				apiKeyCookie: {
+					type: "apiKey",
+					in: "cookie",
+					name: "apiKeyCookie",
+					description: "API Key authentication via cookie"
+				},
+				bearerAuth: {
+					type: "http",
+					scheme: "bearer",
+					description: "Bearer token authentication"
+				}
+			}
+		},
+		security: [{
+			apiKeyCookie: [],
+			bearerAuth: []
+		}],
+		servers: [{ url: ctx.baseURL }],
+		tags: [{
+			name: "Default",
+			description: "Default endpoints that are included with Better Auth by default. These endpoints are not part of any plugin."
+		}],
+		paths
+	};
+}
+
+//#endregion
+export { generator };
+//# sourceMappingURL=generator.mjs.map