@thecodeorigin/auth 0.0.10 → 0.0.12

package/dist/runtime/server/routes/callback.get.js

@@ -1,10 +1,10 @@
-import { defineEventHandler, deleteCookie, getCookie, getQuery, sendRedirect } from "h3";
+import { defineEventHandler, deleteCookie, getCookie, getQuery, sendRedirect, setResponseHeader } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { z } from "zod";
 import { UserinfoClaimsSchema } from "../../../contract";
 import { clearLogoutIntent } from "../utils/logout-intent.js";
-import { callbackRedirectUri, exchangeCode, fetchUserinfo, safePath } from "../utils/oidc.js";
-import { newSessionId, setSessionCookie, writeSessionRecord } from "../utils/session.js";
+import { assertPendingAuthentication, callbackRedirectUri, clearPendingAuthentication, decodeTransaction, exchangeCode, fetchUserinfo, safePath, transactionCookieName, verifyIdToken } from "../utils/oidc.js";
+import { issueSession } from "../utils/session.js";
 const RawUserinfoSchema = UserinfoClaimsSchema.extend({
   sub: z.string(),
   email: z.string().optional(),
@@ -15,20 +15,39 @@ const RawUserinfoSchema = UserinfoClaimsSchema.extend({
 export default defineEventHandler(async (event) => {
   const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   const q = getQuery(event);
-  const fail = (e) => sendRedirect(event, `${publicRuntimeConfig.routes.error}?error=${encodeURIComponent(e)}`);
-  if (q.error)
-    return fail(String(q.error));
-  const state = getCookie(event, "tco_state");
-  const verifier = getCookie(event, "tco_verifier");
-  const redirectTo = safePath(getCookie(event, "tco_redirect"), publicRuntimeConfig.routes.home);
-  for (const c of ["tco_state", "tco_verifier", "tco_redirect"])
-    deleteCookie(event, c, { path: publicRuntimeConfig.routes.callback });
-  if (!q.code || !q.state || !state || q.state !== state || !verifier)
+  setResponseHeader(event, "cache-control", "no-store");
+  let redirectTo = publicRuntimeConfig.routes.home;
+  let verifiedTransaction = false;
+  const fail = async (error) => {
+    if (verifiedTransaction)
+      await clearPendingAuthentication(event, typeof q.state === "string" ? q.state : void 0);
+    const query = new URLSearchParams({ error, redirect: redirectTo });
+    return sendRedirect(event, `${publicRuntimeConfig.routes.error}?${query}`);
+  };
+  if (typeof q.state !== "string" || !/^[\w-]{32}$/.test(q.state))
+    return fail("invalid_state");
+  const cookieName = transactionCookieName(q.state);
+  const transactionValue = getCookie(event, cookieName);
+  deleteCookie(event, cookieName, { path: publicRuntimeConfig.routes.callback });
+  if (!transactionValue)
+    return fail("invalid_state");
+  let transaction;
+  try {
+    transaction = await decodeTransaction(transactionValue, q.state);
+    await assertPendingAuthentication(event, q.state, transaction.flowId);
+    verifiedTransaction = true;
+  } catch {
+    return fail("invalid_state");
+  }
+  redirectTo = safePath(transaction.redirect, publicRuntimeConfig.routes.home);
+  if (typeof q.error === "string")
+    return fail(q.error);
+  if (typeof q.code !== "string")
     return fail("invalid_state");
   let tokens;
   let userinfoRaw;
   try {
-    tokens = await exchangeCode(String(q.code), verifier, callbackRedirectUri(event));
+    tokens = await exchangeCode(q.code, transaction.verifier, callbackRedirectUri(event));
     userinfoRaw = await fetchUserinfo(tokens.access_token);
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
@@ -42,25 +61,36 @@ export default defineEventHandler(async (event) => {
   const verified = u.email_verified === true || u.email_verified === "true";
   if (!u.sub || !u.email || !verified)
     return fail("email_unverified");
-  const id = newSessionId();
-  await writeSessionRecord(id, {
-    sub: u.sub,
-    user: { sub: u.sub, email: u.email, name: u.name ?? null, picture: u.picture ?? null },
-    abilities: u.abilities,
-    systemRole: u.role,
-    organizations: u.organizations,
-    activeOrg: u.org,
-    entitlement: u.entitlement,
-    accessToken: tokens.access_token,
-    refreshToken: tokens.refresh_token ?? null,
-    idToken: tokens.id_token ?? null,
-    accessExpiresAt: Date.now() + (tokens.expires_in ?? 3600) * 1e3,
-    authorizationRefreshedAt: Date.now(),
-    isImpersonation: false,
-    impersonator: null,
-    backupId: null
-  });
-  await setSessionCookie(event, id);
+  try {
+    if (!tokens.id_token)
+      return fail("id_token_missing");
+    await verifyIdToken(tokens.id_token, transaction.nonce, u.sub);
+  } catch {
+    return fail("id_token_invalid");
+  }
+  const organizationAuthorizations = { ...u.organizationAuthorizations };
+  if (u.org && !Object.hasOwn(organizationAuthorizations, u.org))
+    organizationAuthorizations[u.org] = u.abilities;
+  try {
+    await issueSession(event, {
+      sub: u.sub,
+      user: { sub: u.sub, email: u.email, name: u.name ?? null, picture: u.picture ?? null },
+      abilities: u.abilities,
+      organizationAuthorizations,
+      systemRole: u.role,
+      organizations: u.organizations,
+      activeOrg: u.org,
+      entitlement: u.entitlement,
+      accessToken: tokens.access_token,
+      accessExpiresAt: Date.now() + (tokens.expires_in ?? 3600) * 1e3,
+      isImpersonation: false,
+      impersonator: null,
+      backupId: null
+    }, { validate: () => assertPendingAuthentication(event, q.state, transaction.flowId) });
+  } catch {
+    return fail("authentication_canceled");
+  }
+  await clearPendingAuthentication(event, typeof q.state === "string" ? q.state : void 0);
   clearLogoutIntent(event);
   return sendRedirect(event, redirectTo);
 });

package/dist/runtime/server/routes/sign-in.get.js

@@ -1,29 +1,31 @@
-import { createError, defineEventHandler, getQuery, sendRedirect, setCookie } from "h3";
+import { createError, defineEventHandler, getQuery, getRequestURL, sendRedirect, setCookie, setResponseHeader } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { withQuery } from "ufo";
 import { clearLogoutIntent } from "../utils/logout-intent.js";
-import { callbackRedirectUri, idpBaseUrl, pkceChallenge, randomString, safePath } from "../utils/oidc.js";
+import { beginAuthentication, callbackRedirectUri, encodeTransaction, idpBaseUrl, pkceChallenge, randomString, safePath, transactionCookieName } from "../utils/oidc.js";
 const ALLOWED_PROMPTS = /* @__PURE__ */ new Set(["login", "select_account", "consent", "none"]);
 export default defineEventHandler(async (event) => {
   const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   if (!publicRuntimeConfig.domain || !publicRuntimeConfig.clientId || !runtimeConfig.clientSecret)
     throw createError({ statusCode: 503, statusMessage: "Auth not configured" });
+  setResponseHeader(event, "cache-control", "no-store");
   clearLogoutIntent(event);
   const query = getQuery(event);
   const state = randomString(32);
   const verifier = randomString(64);
+  const nonce = randomString(32);
+  const flowId = await beginAuthentication(event, state);
   const redirectTo = safePath(query.redirect, publicRuntimeConfig.routes.home);
   const prompt = typeof query.prompt === "string" && ALLOWED_PROMPTS.has(query.prompt) ? query.prompt : void 0;
-  const opts = { httpOnly: true, secure: !import.meta.dev, sameSite: "lax", maxAge: 600, path: publicRuntimeConfig.routes.callback };
-  setCookie(event, "tco_state", state, opts);
-  setCookie(event, "tco_verifier", verifier, opts);
-  setCookie(event, "tco_redirect", redirectTo, opts);
+  const opts = { httpOnly: true, secure: getRequestURL(event).protocol === "https:", sameSite: "lax", maxAge: 600, path: publicRuntimeConfig.routes.callback };
+  setCookie(event, transactionCookieName(state), await encodeTransaction({ state, verifier, nonce, redirect: redirectTo, flowId }), opts);
   return sendRedirect(event, withQuery(`${idpBaseUrl()}/api/auth/oauth2/authorize`, {
     client_id: publicRuntimeConfig.clientId,
     redirect_uri: callbackRedirectUri(event),
     response_type: "code",
     scope: publicRuntimeConfig.scopes.join(" "),
     state,
+    nonce,
     code_challenge: await pkceChallenge(verifier),
     code_challenge_method: "S256",
     ...prompt ? { prompt } : {}

package/dist/runtime/server/routes/sign-out.get.d.ts

@@ -1,2 +1,3 @@
+/** A navigation cannot revoke authentication; logout is a same-origin POST. */
 declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
 export default _default;

package/dist/runtime/server/routes/sign-out.get.js

@@ -1,10 +1,6 @@
-import { defineEventHandler, sendRedirect } from "h3";
+import { defineEventHandler, sendRedirect, setResponseHeader } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
-import { setLogoutIntent } from "../utils/logout-intent.js";
-import { destroySession } from "../utils/session.js";
-export default defineEventHandler(async (event) => {
-  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
-  await destroySession(event);
-  setLogoutIntent(event);
-  return sendRedirect(event, publicRuntimeConfig.routes.home);
+export default defineEventHandler((event) => {
+  setResponseHeader(event, "cache-control", "no-store");
+  return sendRedirect(event, useRuntimeConfig().public.auth.routes.login);
 });

package/dist/runtime/server/utils/idp.d.ts

@@ -1,12 +1,7 @@
 import type { H3Event } from 'h3';
-import type { OrganizationContext } from '../../../contract/index.js';
 import type { SessionRecord } from './session.js';
-export declare function refreshAuthorizationContext(event: H3Event, id: string, rec: SessionRecord): Promise<OrganizationContext>;
-/**
- * Call an IdP path with the session's bearer token. Refreshes once on expiry/401.
- * Persists the rotated record. Returns parsed JSON.
- */
-export declare function idpFetch<T>(event: H3Event, id: string, rec: SessionRecord, path: string, opts?: {
+/** Explicit online directory/support operation; never refresh or mutate local authentication. */
+export declare function idpFetch<T>(_event: H3Event, _id: string, rec: SessionRecord, path: string, opts?: {
     method?: string;
     body?: Record<string, unknown>;
     query?: Record<string, string | number>;

package/dist/runtime/server/utils/idp.js

@@ -1,70 +1,22 @@
 import { createError } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
 import { $fetch } from "ofetch";
 import { idpBaseUrl } from "./oidc.js";
-import { readSessionRecordById, writeSessionRecord } from "./session.js";
-const SKEW_MS = 6e4;
-export async function refreshAuthorizationContext(event, id, rec) {
-  if (!rec.activeOrg)
-    throw createError({ statusCode: 403, statusMessage: "No active organization" });
-  return idpFetch(
-    event,
-    id,
-    rec,
-    "/api/auth/rp/organizations/context",
-    { method: "POST", body: { organizationId: rec.activeOrg } }
-  );
-}
-async function refresh(rec) {
-  if (rec.isImpersonation || !rec.refreshToken)
-    return false;
-  const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
-  try {
-    const t = await $fetch(
-      `${idpBaseUrl()}/api/auth/oauth2/token`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          "Authorization": `Basic ${btoa(`${publicRuntimeConfig.clientId}:${runtimeConfig.clientSecret}`)}`
-        },
-        body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: rec.refreshToken }).toString()
-      }
-    );
-    rec.accessToken = t.access_token;
-    rec.refreshToken = t.refresh_token ?? rec.refreshToken;
-    rec.accessExpiresAt = Date.now() + (t.expires_in ?? 3600) * 1e3;
-    return true;
-  } catch {
-    return false;
-  }
-}
-export async function idpFetch(event, id, rec, path, opts = {}) {
-  if (!rec.isImpersonation && Date.now() > rec.accessExpiresAt - SKEW_MS) {
-    if (await refresh(rec))
-      await writeSessionRecord(id, rec);
-  }
-  const call = () => $fetch(`${idpBaseUrl()}${path}`, {
-    method: opts.method,
-    body: opts.body,
-    query: opts.query,
-    headers: { Authorization: `Bearer ${rec.accessToken}` }
-  });
+export async function idpFetch(_event, _id, rec, path, opts = {}) {
+  if (!rec.accessToken || Date.now() >= rec.accessExpiresAt)
+    throw createError({ statusCode: 409, statusMessage: "Sign in again to use this identity service operation" });
   try {
-    return await call();
-  } catch (e) {
-    const status = e?.response?.status;
-    if (status !== 401)
-      throw e;
-    const fresh = await readSessionRecordById(id);
-    if (fresh && fresh.accessToken !== rec.accessToken) {
-      Object.assign(rec, fresh);
-      return call();
-    }
-    if (await refresh(rec)) {
-      await writeSessionRecord(id, rec);
-      return call();
-    }
-    throw createError({ statusCode: 401, statusMessage: "Session expired" });
+    return await $fetch(`${idpBaseUrl()}${path}`, {
+      method: opts.method,
+      body: opts.body,
+      query: opts.query,
+      headers: { Authorization: `Bearer ${rec.accessToken}` },
+      timeout: 1e4,
+      retry: 0
+    });
+  } catch (error) {
+    const status = error.response?.status;
+    if (status === 401)
+      throw createError({ statusCode: 409, statusMessage: "Sign in again to use this identity service operation" });
+    throw error;
   }
 }

package/dist/runtime/server/utils/integration-key.d.ts

@@ -1,5 +1,22 @@
 import type { H3Event } from 'h3';
 export declare function verifyOrganizationIntegrationKey(_event: H3Event, key: string): Promise<{
+    keyId: string;
+    organizationId: string;
+    version: 2;
+    clientId: string;
+    audience: "vault";
+    createdBy: string;
+    capabilities: {
+        resourceType: "environment";
+        resourceId: string;
+        actions: ("secrets:read" | "secrets:create")[];
+        keyPrefixes?: string[] | undefined;
+    }[];
+    permissions: ("secrets:read" | "secrets:create")[];
+    name: string;
+    prefix: string;
+    expiresAt: number;
+} | {
     keyId: string;
     organizationId: string;
     clientId: string;
@@ -10,4 +27,5 @@ export declare function verifyOrganizationIntegrationKey(_event: H3Event, key: s
     name: string;
     prefix: string;
     expiresAt: number | null;
+    createdBy?: string | undefined;
 }>;

package/dist/runtime/server/utils/local-auth.d.ts

@@ -0,0 +1,351 @@
+import type { BetterAuthOptions } from 'better-auth';
+export interface LocalIdentity {
+    sub: string;
+    email: string;
+    name: string | null;
+    picture: string | null;
+}
+export interface LocalSessionInput {
+    user: LocalIdentity;
+    expiresAt: number;
+    snapshot: string;
+}
+/** A fresh instance keeps the temporary identity adapter isolated per request. */
+export declare function createLocalAuth(options: BetterAuthOptions, input?: LocalSessionInput): import("better-auth").Auth<{
+    account: {
+        storeAccountCookie: false;
+    };
+    session: {
+        disableSessionRefresh: true;
+        storeSessionInDatabase: false;
+        cookieCache: {
+            enabled: false;
+        };
+        additionalFields: {
+            snapshot: {
+                type: "string";
+                required: true;
+                input: false;
+            };
+        };
+        modelName?: "session" | import("better-auth").LiteralString | undefined;
+        fields?: Partial<Record<"expiresAt" | "createdAt" | "updatedAt" | "userId" | "token" | "ipAddress" | "userAgent", string>> | undefined;
+        expiresIn?: number;
+        updateAge?: number;
+        deferSessionRefresh?: boolean;
+        preserveSessionInDatabase?: boolean;
+        freshAge?: number;
+    };
+    plugins: [{
+        id: "application-session";
+        endpoints: {
+            establishLocalSession: import("better-auth").StrictEndpoint<"/internal-establish-local-session", {
+                method: "POST";
+            }, {
+                token: string;
+            }>;
+        };
+    }];
+    appName?: string | undefined;
+    baseURL?: import("better-auth").BaseURLConfig | undefined;
+    basePath?: string | undefined;
+    secret?: string | undefined;
+    secrets?: Array<{
+        version: number;
+        value: string;
+    }> | undefined;
+    database?: (any) | undefined;
+    secondaryStorage?: import("better-auth").SecondaryStorage | undefined;
+    emailVerification?: {
+        sendVerificationEmail?: (data: {
+            user: import("better-auth").User;
+            url: string;
+            token: string;
+        }, request?: Request) => Promise<void>;
+        sendOnSignUp?: boolean;
+        sendOnSignIn?: boolean;
+        autoSignInAfterVerification?: boolean;
+        expiresIn?: number;
+        beforeEmailVerification?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+        afterEmailVerification?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+    } | undefined;
+    emailAndPassword?: {
+        enabled: boolean;
+        disableSignUp?: boolean;
+        requireEmailVerification?: boolean;
+        maxPasswordLength?: number;
+        minPasswordLength?: number;
+        sendResetPassword?: (data: {
+            user: import("better-auth").User;
+            url: string;
+            token: string;
+        }, request?: Request) => Promise<void>;
+        resetPasswordTokenExpiresIn?: number;
+        onPasswordReset?: (data: {
+            user: import("better-auth").User;
+        }, request?: Request) => Promise<void>;
+        password?: {
+            hash?: (password: string) => Promise<string>;
+            verify?: (data: {
+                hash: string;
+                password: string;
+            }) => Promise<boolean>;
+        };
+        autoSignIn?: boolean;
+        revokeSessionsOnPasswordReset?: boolean;
+        onExistingUserSignUp?: (data: {
+            user: import("better-auth").User;
+        }, request?: Request) => Promise<void>;
+        customSyntheticUser?: (params: {
+            coreFields: {
+                name: string;
+                email: string;
+                emailVerified: boolean;
+                image: string | null;
+                createdAt: Date;
+                updatedAt: Date;
+            };
+            additionalFields: Record<string, unknown>;
+            id: string;
+        }) => Record<string, unknown>;
+    } | undefined;
+    socialProviders?: import("better-auth").SocialProviders | undefined;
+    user?: (import("better-auth").BetterAuthDBOptions<"user", keyof import("better-auth").BaseUser> & {
+        changeEmail?: {
+            enabled: boolean;
+            sendChangeEmailConfirmation?: (data: {
+                user: import("better-auth").User;
+                newEmail: string;
+                url: string;
+                token: string;
+            }, request?: Request) => Promise<void>;
+            updateEmailWithoutVerification?: boolean;
+        };
+        deleteUser?: {
+            enabled?: boolean;
+            sendDeleteAccountVerification?: (data: {
+                user: import("better-auth").User;
+                url: string;
+                token: string;
+            }, request?: Request) => Promise<void>;
+            beforeDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+            afterDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+            deleteTokenExpiresIn?: number;
+        };
+    }) | undefined;
+    verification?: (import("better-auth").BetterAuthDBOptions<"verification", keyof import("better-auth").BaseVerification> & {
+        disableCleanup?: boolean;
+        storeIdentifier?: import("better-auth").StoreIdentifierOption | {
+            default: import("better-auth").StoreIdentifierOption;
+            overrides?: Record<string, import("better-auth").StoreIdentifierOption>;
+        };
+        storeInDatabase?: boolean;
+    }) | undefined;
+    trustedOrigins?: (string[] | ((request?: Request | undefined) => import("better-auth").Awaitable<(string | undefined | null)[]>)) | undefined;
+    rateLimit?: import("better-auth").BetterAuthRateLimitOptions | undefined;
+    advanced?: import("better-auth").BetterAuthAdvancedOptions | undefined;
+    logger?: import("better-auth").Logger | undefined;
+    databaseHooks?: {
+        user?: {
+            create?: {
+                before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        email?: string | undefined;
+                        emailVerified?: boolean | undefined;
+                        name?: string | undefined;
+                        image?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (user: Partial<import("better-auth").User> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        email?: string | undefined;
+                        emailVerified?: boolean | undefined;
+                        name?: string | undefined;
+                        image?: string | null | undefined;
+                    };
+                }>;
+                after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        session?: {
+            create?: {
+                before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        userId?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        token?: string | undefined;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        userId?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        token?: string | undefined;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                }>;
+                after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        account?: {
+            create?: {
+                before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        providerId?: string | undefined;
+                        accountId?: string | undefined;
+                        userId?: string | undefined;
+                        accessToken?: string | null | undefined;
+                        refreshToken?: string | null | undefined;
+                        idToken?: string | null | undefined;
+                        accessTokenExpiresAt?: Date | null | undefined;
+                        refreshTokenExpiresAt?: Date | null | undefined;
+                        scope?: string | null | undefined;
+                        password?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        providerId?: string | undefined;
+                        accountId?: string | undefined;
+                        userId?: string | undefined;
+                        accessToken?: string | null | undefined;
+                        refreshToken?: string | null | undefined;
+                        idToken?: string | null | undefined;
+                        accessTokenExpiresAt?: Date | null | undefined;
+                        refreshTokenExpiresAt?: Date | null | undefined;
+                        scope?: string | null | undefined;
+                        password?: string | null | undefined;
+                    };
+                }>;
+                after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        verification?: {
+            create?: {
+                before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        value?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        identifier?: string | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (verification: Partial<import("better-auth").Verification> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        value?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        identifier?: string | undefined;
+                    };
+                }>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+    } | undefined;
+    onAPIError?: {
+        throw?: boolean;
+        onError?: (error: unknown, ctx: import("better-auth").AuthContext) => void | Promise<void>;
+        errorURL?: string;
+        customizeDefaultErrorPage?: {
+            colors?: {
+                background?: string;
+                foreground?: string;
+                primary?: string;
+                primaryForeground?: string;
+                mutedForeground?: string;
+                border?: string;
+                destructive?: string;
+                titleBorder?: string;
+                titleColor?: string;
+                gridColor?: string;
+                cardBackground?: string;
+                cornerBorder?: string;
+            };
+            size?: {
+                radiusSm?: string;
+                radiusMd?: string;
+                radiusLg?: string;
+                textSm?: string;
+                text2xl?: string;
+                text4xl?: string;
+                text6xl?: string;
+            };
+            font?: {
+                defaultFamily?: string;
+                monoFamily?: string;
+            };
+            disableTitleBorder?: boolean;
+            disableCornerDecorations?: boolean;
+            disableBackgroundGrid?: boolean;
+        };
+    } | undefined;
+    hooks?: {
+        before?: import("better-auth/api").AuthMiddleware;
+        after?: import("better-auth/api").AuthMiddleware;
+    } | undefined;
+    disabledPaths?: string[] | undefined;
+    telemetry?: {
+        enabled?: boolean;
+        debug?: boolean;
+    } | undefined;
+    experimental?: {
+        joins?: boolean;
+    };
+}>;