@soorya-u/better-auth-desktop 0.1.0

package/dist/index-CP_2Wlut.d.mts

@@ -0,0 +1,61 @@
+import { c as RequestAuthOptions, i as DesktopClientOptions, n as AuthUser, r as DesktopAdapter } from "./types-h9AEfSnq.mjs";
+import { BetterFetch, CreateFetchOption } from "@better-fetch/fetch";
+import { BetterAuthClientOptions } from "@better-auth/core";
+import { User } from "@better-auth/core/db";
+
+//#region src/core/exchange.d.ts
+type ExchangeTokenArgs = {
+  $fetch: BetterFetch;
+  options: DesktopClientOptions;
+  token: string;
+  onAuthenticated: (user: AuthUser) => void;
+  fetchOptions?: Omit<CreateFetchOption, "method"> | undefined;
+};
+declare function exchangeToken({
+  $fetch,
+  options,
+  token,
+  onAuthenticated,
+  fetchOptions
+}: ExchangeTokenArgs): Promise<{
+  data: {
+    token: string;
+    user: AuthUser;
+  };
+  error: null;
+} | {
+  data: null;
+  error: {
+    message?: string | undefined;
+    status: number;
+    statusText: string;
+  };
+}>;
+type StartAuthFlowArgs = {
+  adapter: DesktopAdapter;
+  $fetch: BetterFetch;
+  clientOptions: BetterAuthClientOptions | undefined;
+  options: DesktopClientOptions;
+  cfg: RequestAuthOptions;
+  onAuthenticated: (user: AuthUser) => void;
+  onError?: (error: unknown) => void;
+};
+declare function startAuthFlow({
+  adapter,
+  $fetch,
+  clientOptions,
+  options,
+  cfg,
+  onAuthenticated,
+  onError
+}: StartAuthFlowArgs): Promise<void>;
+//#endregion
+//#region src/core/user.d.ts
+type FetchUserImageResult = {
+  bytes: Uint8Array;
+  mimeType: string;
+};
+declare function fetchUserImage(baseURL: string | undefined, url: string): Promise<FetchUserImageResult | null>;
+declare function normalizeUserOutput<U extends User & Record<string, any>>(user: U, _options?: DesktopClientOptions | undefined): U;
+//#endregion
+export { StartAuthFlowArgs as a, ExchangeTokenArgs as i, fetchUserImage as n, exchangeToken as o, normalizeUserOutput as r, startAuthFlow as s, FetchUserImageResult as t };

package/dist/index.d.mts

@@ -0,0 +1,10 @@
+import { a as LoopbackRequest, c as RequestAuthOptions, i as DesktopClientOptions, l as Storage, n as AuthUser, o as LoopbackResponse, r as DesktopAdapter, s as LoopbackServer, t as AuthEvent } from "./types-h9AEfSnq.mjs";
+import { a as desktopClient, i as createDesktopCookieLayer, n as DesktopClientPluginOptions, r as DesktopCookieLayer, t as DesktopClientInternals } from "./client-De_zQzE1.mjs";
+import { n as keychainStorage, t as KeychainStorageOptions } from "./storage-DtgX_vmE.mjs";
+import { a as StartAuthFlowArgs, i as ExchangeTokenArgs, n as fetchUserImage, o as exchangeToken, r as normalizeUserOutput, s as startAuthFlow, t as FetchUserImageResult } from "./index-CP_2Wlut.mjs";
+import { a as isAllowedLoopbackPort, i as generateNonce, n as LOOPBACK_HOST, o as parseLoopbackUrl, r as buildLoopbackUrl, s as successPage, t as AllowedLoopbackPorts } from "./loopback-ClkAoS2u.mjs";
+
+//#region src/version.d.ts
+declare const PACKAGE_VERSION: string;
+//#endregion
+export { AllowedLoopbackPorts, AuthEvent, AuthUser, DesktopAdapter, DesktopClientInternals, DesktopClientOptions, DesktopClientPluginOptions, DesktopCookieLayer, ExchangeTokenArgs, FetchUserImageResult, KeychainStorageOptions, LOOPBACK_HOST, LoopbackRequest, LoopbackResponse, LoopbackServer, PACKAGE_VERSION, RequestAuthOptions, StartAuthFlowArgs, Storage, buildLoopbackUrl, createDesktopCookieLayer, desktopClient, exchangeToken, fetchUserImage, generateNonce, isAllowedLoopbackPort, keychainStorage, normalizeUserOutput, parseLoopbackUrl, startAuthFlow, successPage };

package/dist/index.mjs

@@ -0,0 +1,7 @@
+import { t as PACKAGE_VERSION } from "./version-1hEssvcU.mjs";
+import { n as desktopClient, t as createDesktopCookieLayer } from "./client-DhRcoap2.mjs";
+import { a as parseLoopbackUrl, i as isAllowedLoopbackPort, n as buildLoopbackUrl, o as successPage, r as generateNonce, t as LOOPBACK_HOST } from "./loopback-DTQgg1Za.mjs";
+import { i as normalizeUserOutput, n as startAuthFlow, r as fetchUserImage, t as exchangeToken } from "./exchange-DCZ0j_T5.mjs";
+import { t as keychainStorage } from "./storage-BcwDmS-W.mjs";
+import "./core/index.mjs";
+export { LOOPBACK_HOST, PACKAGE_VERSION, buildLoopbackUrl, createDesktopCookieLayer, desktopClient, exchangeToken, fetchUserImage, generateNonce, isAllowedLoopbackPort, keychainStorage, normalizeUserOutput, parseLoopbackUrl, startAuthFlow, successPage };

package/dist/loopback-ClkAoS2u.d.mts

@@ -0,0 +1,13 @@
+//#region src/core/loopback.d.ts
+declare const LOOPBACK_HOST = "127.0.0.1";
+type AllowedLoopbackPorts = number[] | {
+  min: number;
+  max: number;
+};
+declare function generateNonce(): string;
+declare function buildLoopbackUrl(port: number, path: string, nonce: string): string;
+declare function parseLoopbackUrl(raw: string, allowedPorts?: AllowedLoopbackPorts): URL | null;
+declare function isAllowedLoopbackPort(port: number, allowed: AllowedLoopbackPorts): boolean;
+declare function successPage(title?: string, message?: string): string;
+//#endregion
+export { isAllowedLoopbackPort as a, generateNonce as i, LOOPBACK_HOST as n, parseLoopbackUrl as o, buildLoopbackUrl as r, successPage as s, AllowedLoopbackPorts as t };

package/dist/loopback-DTQgg1Za.mjs

@@ -0,0 +1,35 @@
+import { generateRandomString } from "better-auth/crypto";
+//#region src/core/loopback.ts
+const LOOPBACK_HOST = "127.0.0.1";
+function generateNonce() {
+	return generateRandomString(24, "a-z", "A-Z", "0-9");
+}
+function buildLoopbackUrl(port, path, nonce) {
+	const url = new URL(`http://${LOOPBACK_HOST}:${port}`);
+	url.pathname = path.startsWith("/") ? path : `/${path}`;
+	url.searchParams.set("nonce", nonce);
+	return url.toString();
+}
+function parseLoopbackUrl(raw, allowedPorts) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "http:") return null;
+	if (url.hostname !== "127.0.0.1") return null;
+	const port = Number(url.port);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+	if (allowedPorts && !isAllowedLoopbackPort(port, allowedPorts)) return null;
+	return url;
+}
+function isAllowedLoopbackPort(port, allowed) {
+	if (Array.isArray(allowed)) return allowed.includes(port);
+	return port >= allowed.min && port <= allowed.max;
+}
+function successPage(title = "Signed in", message = "You can close this tab and return to the app.") {
+	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0;text-align:center"><main><h1 style="font-size:1.25rem;margin:0 0 .5rem">${title}</h1><p style="margin:0;opacity:.7">${message}</p></main></body></html>`;
+}
+//#endregion
+export { parseLoopbackUrl as a, isAllowedLoopbackPort as i, buildLoopbackUrl as n, successPage as o, generateNonce as r, LOOPBACK_HOST as t };

package/dist/rpc/webview.d.mts

@@ -0,0 +1,26 @@
+import { c as RequestAuthOptions } from "../types-h9AEfSnq.mjs";
+import { BetterFetchError } from "@better-fetch/fetch";
+import { User } from "@better-auth/core/db";
+
+//#region src/rpc/schema.d.ts
+type AuthBridges = {
+  getUser(): Promise<(User & Record<string, any>) | null>;
+  requestAuth(options: RequestAuthOptions): Promise<void>;
+  signOut(): Promise<void>;
+  getUserImage(url: string): Promise<{
+    dataUrl: string | null;
+  }>;
+  onAuthenticated(callback: (user: User & Record<string, any>) => void): () => void;
+  onUserUpdated(callback: (user: (User & Record<string, any>) | null) => void): () => void;
+  onAuthError(callback: (context: {
+    error: BetterFetchError | {
+      message: string;
+    };
+    path?: string;
+  }) => void): () => void;
+};
+//#endregion
+//#region src/rpc/webview.d.ts
+declare function defineAuthWebviewRPC(): AuthBridges;
+//#endregion
+export { defineAuthWebviewRPC };

package/dist/rpc/webview.mjs

@@ -0,0 +1,325 @@
+//#region node_modules/electrobun/dist/api/shared/rpc.ts
+const MAX_ID = 1e10;
+const DEFAULT_MAX_REQUEST_TIME = 1e3;
+function missingTransportMethodError(methods, action) {
+	const methodsString = methods.map((m) => `"${m}"`).join(", ");
+	return /* @__PURE__ */ new Error(`This RPC instance cannot ${action} because the transport did not provide one or more of these methods: ${methodsString}`);
+}
+function createRPC(options = {}) {
+	let debugHooks = {};
+	let transport = {};
+	let requestHandler = void 0;
+	function setTransport(newTransport) {
+		if (transport.unregisterHandler) transport.unregisterHandler();
+		transport = newTransport;
+		transport.registerHandler?.(handler);
+	}
+	function setRequestHandler(h) {
+		if (typeof h === "function") {
+			requestHandler = h;
+			return;
+		}
+		requestHandler = (method, params) => {
+			const handlerFn = h[method];
+			if (handlerFn) return handlerFn(params);
+			const fallbackHandler = h._;
+			if (!fallbackHandler) throw new Error(`The requested method has no handler: ${String(method)}`);
+			return fallbackHandler(method, params);
+		};
+	}
+	const { maxRequestTime = DEFAULT_MAX_REQUEST_TIME } = options;
+	if (options.transport) setTransport(options.transport);
+	if (options.requestHandler) setRequestHandler(options.requestHandler);
+	if (options._debugHooks) debugHooks = options._debugHooks;
+	let lastRequestId = 0;
+	function getRequestId() {
+		if (lastRequestId <= MAX_ID) return ++lastRequestId;
+		return lastRequestId = 0;
+	}
+	const requestListeners = /* @__PURE__ */ new Map();
+	const requestTimeouts = /* @__PURE__ */ new Map();
+	function requestFn(method, ...args) {
+		const params = args[0];
+		return new Promise((resolve, reject) => {
+			if (!transport.send) throw missingTransportMethodError(["send"], "make requests");
+			const requestId = getRequestId();
+			const request = {
+				type: "request",
+				id: requestId,
+				method,
+				params
+			};
+			requestListeners.set(requestId, {
+				resolve,
+				reject
+			});
+			if (maxRequestTime !== Infinity) requestTimeouts.set(requestId, setTimeout(() => {
+				requestTimeouts.delete(requestId);
+				requestListeners.delete(requestId);
+				reject(/* @__PURE__ */ new Error("RPC request timed out."));
+			}, maxRequestTime));
+			debugHooks.onSend?.(request);
+			transport.send(request);
+		});
+	}
+	const request = new Proxy(requestFn, { get: (target, prop, receiver) => {
+		if (prop in target) return Reflect.get(target, prop, receiver);
+		return (params) => requestFn(prop, params);
+	} });
+	const requestProxy = request;
+	function sendFn(message, ...args) {
+		const payload = args[0];
+		if (!transport.send) throw missingTransportMethodError(["send"], "send messages");
+		const rpcMessage = {
+			type: "message",
+			id: message,
+			payload
+		};
+		debugHooks.onSend?.(rpcMessage);
+		transport.send(rpcMessage);
+	}
+	const send = new Proxy(sendFn, { get: (target, prop, receiver) => {
+		if (prop in target) return Reflect.get(target, prop, receiver);
+		return (payload) => sendFn(prop, payload);
+	} });
+	const sendProxy = send;
+	const messageListeners = /* @__PURE__ */ new Map();
+	const wildcardMessageListeners = /* @__PURE__ */ new Set();
+	function addMessageListener(message, listener) {
+		if (!transport.registerHandler) throw missingTransportMethodError(["registerHandler"], "register message listeners");
+		if (message === "*") {
+			wildcardMessageListeners.add(listener);
+			return;
+		}
+		if (!messageListeners.has(message)) messageListeners.set(message, /* @__PURE__ */ new Set());
+		messageListeners.get(message).add(listener);
+	}
+	function removeMessageListener(message, listener) {
+		if (message === "*") {
+			wildcardMessageListeners.delete(listener);
+			return;
+		}
+		messageListeners.get(message)?.delete(listener);
+		if (messageListeners.get(message)?.size === 0) messageListeners.delete(message);
+	}
+	async function handler(message) {
+		debugHooks.onReceive?.(message);
+		if (!("type" in message)) throw new Error("Message does not contain a type.");
+		if (message.type === "request") {
+			if (!transport.send || !requestHandler) throw missingTransportMethodError(["send", "requestHandler"], "handle requests");
+			const { id, method, params } = message;
+			let response;
+			try {
+				response = {
+					type: "response",
+					id,
+					success: true,
+					payload: await requestHandler(method, params)
+				};
+			} catch (error) {
+				if (!(error instanceof Error)) throw error;
+				response = {
+					type: "response",
+					id,
+					success: false,
+					error: error.message
+				};
+			}
+			debugHooks.onSend?.(response);
+			transport.send(response);
+			return;
+		}
+		if (message.type === "response") {
+			const timeout = requestTimeouts.get(message.id);
+			if (timeout != null) clearTimeout(timeout);
+			requestTimeouts.delete(message.id);
+			const { resolve, reject } = requestListeners.get(message.id) ?? {};
+			requestListeners.delete(message.id);
+			if (!message.success) reject?.(new Error(message.error));
+			else resolve?.(message.payload);
+			return;
+		}
+		if (message.type === "message") {
+			for (const listener of wildcardMessageListeners) listener(message.id, message.payload);
+			const listeners = messageListeners.get(message.id);
+			if (!listeners) return;
+			for (const listener of listeners) listener(message.payload);
+			return;
+		}
+		throw new Error(`Unexpected RPC message type: ${message.type}`);
+	}
+	return {
+		setTransport,
+		setRequestHandler,
+		request,
+		requestProxy,
+		send,
+		sendProxy,
+		addMessageListener,
+		removeMessageListener,
+		proxy: {
+			send: sendProxy,
+			request: requestProxy
+		}
+	};
+}
+function defineElectrobunRPC(_side, config) {
+	const rpc = createRPC({
+		maxRequestTime: config.maxRequestTime,
+		requestHandler: {
+			...config.handlers.requests,
+			...config.extraRequestHandlers
+		},
+		transport: { registerHandler: () => {} }
+	});
+	const messageHandlers = config.handlers.messages;
+	if (messageHandlers) rpc.addMessageListener("*", ((messageName, payload) => {
+		const globalHandler = messageHandlers["*"];
+		if (globalHandler) globalHandler(messageName, payload);
+		const messageHandler = messageHandlers[messageName];
+		if (messageHandler) messageHandler(payload);
+	}));
+	return rpc;
+}
+//#endregion
+//#region node_modules/electrobun/dist/api/browser/index.ts
+const WEBVIEW_ID = window.__electrobunWebviewId;
+const RPC_SOCKET_PORT = window.__electrobunRpcSocketPort;
+var Electroview = class {
+	bunSocket;
+	rpc;
+	rpcHandler;
+	constructor(config) {
+		this.rpc = config.rpc;
+		this.init();
+	}
+	init() {
+		this.initSocketToBun();
+		window.__electrobun.receiveMessageFromBun = this.receiveMessageFromBun.bind(this);
+		if (this.rpc) this.rpc.setTransport(this.createTransport());
+	}
+	initSocketToBun() {
+		if (!RPC_SOCKET_PORT || !WEBVIEW_ID) return;
+		const socket = new WebSocket(`ws://localhost:${RPC_SOCKET_PORT}/socket?webviewId=${WEBVIEW_ID}`);
+		this.bunSocket = socket;
+		socket.addEventListener("open", () => {});
+		socket.addEventListener("message", async (event) => {
+			const message = event.data;
+			if (typeof message === "string") try {
+				const encryptedPacket = JSON.parse(message);
+				const decrypted = await window.__electrobun_decrypt(encryptedPacket.encryptedData, encryptedPacket.iv, encryptedPacket.tag);
+				this.rpcHandler?.(JSON.parse(decrypted));
+			} catch (err) {
+				console.error("Error parsing bun message:", err);
+			}
+			else if (message instanceof Blob) {} else console.error("UNKNOWN DATA TYPE RECEIVED:", event.data);
+		});
+		socket.addEventListener("error", (event) => {
+			console.error("Socket error:", event);
+		});
+		socket.addEventListener("close", (_event) => {});
+	}
+	createTransport() {
+		const that = this;
+		return {
+			send(message) {
+				try {
+					const messageString = JSON.stringify(message);
+					that.bunBridge(messageString);
+				} catch (error) {
+					console.error("bun: failed to serialize message to webview", error);
+				}
+			},
+			registerHandler(handler) {
+				that.rpcHandler = handler;
+			}
+		};
+	}
+	async bunBridge(msg) {
+		if (this.bunSocket?.readyState === WebSocket.OPEN) try {
+			const { encryptedData, iv, tag } = await window.__electrobun_encrypt(msg);
+			const encryptedPacketString = JSON.stringify({
+				encryptedData,
+				iv,
+				tag
+			});
+			this.bunSocket.send(encryptedPacketString);
+			return;
+		} catch (error) {
+			console.error("Error sending message to bun via socket:", error);
+		}
+		window.__electrobunBunBridge?.postMessage(msg);
+	}
+	receiveMessageFromBun(msg) {
+		if (this.rpcHandler) this.rpcHandler(msg);
+	}
+	static defineRPC(config) {
+		return defineElectrobunRPC("webview", {
+			...config,
+			extraRequestHandlers: { evaluateJavascriptWithResponse: ({ script }) => {
+				return new Promise((resolve) => {
+					try {
+						const result = new Function(script)();
+						if (result instanceof Promise) result.then((resolvedResult) => {
+							resolve(resolvedResult);
+						}).catch((error) => {
+							console.error("bun: async script execution failed", error);
+							resolve(String(error));
+						});
+						else resolve(result);
+					} catch (error) {
+						console.error("bun: failed to eval script", error);
+						resolve(String(error));
+					}
+				});
+			} }
+		});
+	}
+};
+//#endregion
+//#region src/rpc/webview.ts
+/**
+* Renderer-side auth bridge for the Electrobun WebView. Call once at the top of
+* your webview entry, then use the returned bridge:
+*
+* ```ts
+* import { defineAuthWebviewRPC } from "@soorya-u/better-auth-desktop/rpc/webview";
+* export const auth = defineAuthWebviewRPC();
+*
+* auth.onAuthenticated((user) => navigate("/threads"));
+* await auth.requestAuth({ provider: "github" });
+* ```
+*/
+function defineAuthWebviewRPC() {
+	const rpc = Electroview.defineRPC({
+		maxRequestTime: 3e4,
+		handlers: {
+			requests: {},
+			messages: {}
+		}
+	});
+	new Electroview({ rpc });
+	return {
+		getUser: () => rpc.request.getUser({}),
+		requestAuth: (options) => rpc.request.requestAuth({ options }),
+		signOut: () => rpc.request.signOut({}),
+		getUserImage: (url) => rpc.request.getUserImage({ url }),
+		onAuthenticated: (callback) => {
+			const handler = (user) => callback(user);
+			rpc.addMessageListener("onAuthenticated", handler);
+			return () => rpc.removeMessageListener("onAuthenticated", handler);
+		},
+		onUserUpdated: (callback) => {
+			const handler = (user) => callback(user);
+			rpc.addMessageListener("onUserUpdated", handler);
+			return () => rpc.removeMessageListener("onUserUpdated", handler);
+		},
+		onAuthError: (callback) => {
+			const handler = (ctx) => callback(ctx);
+			rpc.addMessageListener("onAuthError", handler);
+			return () => rpc.removeMessageListener("onAuthError", handler);
+		}
+	};
+}
+//#endregion
+export { defineAuthWebviewRPC };

package/dist/server/index.d.mts

@@ -0,0 +1,60 @@
+import { t as AllowedLoopbackPorts } from "../loopback-ClkAoS2u.mjs";
+import * as _$better_auth0 from "better-auth";
+import { BetterAuthPlugin } from "better-auth";
+
+//#region src/server/error-codes.d.ts
+declare const DESKTOP_ERROR_CODES: {
+  INVALID_CLIENT_ID: _$better_auth0.RawError<"INVALID_CLIENT_ID">;
+  INVALID_TOKEN: _$better_auth0.RawError<"INVALID_TOKEN">;
+  STATE_MISMATCH: _$better_auth0.RawError<"STATE_MISMATCH">;
+  MISSING_CODE_CHALLENGE: _$better_auth0.RawError<"MISSING_CODE_CHALLENGE">;
+  INVALID_CODE_VERIFIER: _$better_auth0.RawError<"INVALID_CODE_VERIFIER">;
+  MISSING_STATE: _$better_auth0.RawError<"MISSING_STATE">;
+  MISSING_PKCE: _$better_auth0.RawError<"MISSING_PKCE">;
+  INVALID_PKCE_METHOD: _$better_auth0.RawError<"INVALID_PKCE_METHOD">;
+  INVALID_LOOPBACK_URL: _$better_auth0.RawError<"INVALID_LOOPBACK_URL">;
+};
+//#endregion
+//#region src/server/types.d.ts
+type DesktopServerOptions = {
+  /**
+   * Client ID used to identify the desktop client during authorization. Must
+   * match the `clientID` configured in the desktop adapter.
+   * @default "desktop"
+   */
+  clientID?: string;
+  /**
+   * Duration (in seconds) for which the one-time authorization code is valid.
+   * @default 300
+   */
+  codeExpiresIn?: number;
+  /**
+   * Disable rewriting the request `origin` from the `desktop-origin` header.
+   * @default false
+   */
+  disableOriginOverride?: boolean;
+  /**
+   * Name of the one-time-code query/hash parameter appended to the loopback or
+   * web-callback URL.
+   * @default "token"
+   */
+  hashKey?: string;
+  /**
+   * Optional branded web callback page. When set, `oauth-complete` redirects the
+   * browser here (`#token=…&loopback=…`) instead of straight to the loopback,
+   * and the page must call `forwardToDesktop()` to complete the hand-off.
+   * Leave unset for the default direct-to-loopback redirect.
+   */
+  webCallbackUrl?: string;
+  /**
+   * Optional hardening: restrict the loopback port the server is willing to
+   * redirect to. Either an explicit allowlist or an inclusive `{ min, max }`
+   * range. Omit to allow any ephemeral port.
+   */
+  allowedLoopbackPorts?: AllowedLoopbackPorts;
+};
+//#endregion
+//#region src/server/plugin.d.ts
+declare const betterAuthDesktop: (options?: DesktopServerOptions) => BetterAuthPlugin;
+//#endregion
+export { DESKTOP_ERROR_CODES, type DesktopServerOptions, betterAuthDesktop };