better-auth 0.8.3-beta.3 → 0.8.3-beta.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/dist/client/plugins.d.cts +5 -5
  2. package/dist/client/plugins.d.ts +5 -5
  3. package/dist/{index-DuhVtl9a.d.ts → index-uHjME6mS.d.ts} +21 -48
  4. package/dist/{index-DBQ0XVML.d.cts → index-xSdbpM4W.d.cts} +21 -48
  5. package/dist/plugins.cjs +3 -3
  6. package/dist/plugins.d.cts +1 -1
  7. package/dist/plugins.d.ts +1 -1
  8. package/dist/plugins.js +3 -3
  9. package/package.json +1 -1
package/dist/plugins.cjs CHANGED
@@ -1,5 +1,5 @@
1
- "use strict";var mo=Object.create;var Ge=Object.defineProperty;var po=Object.getOwnPropertyDescriptor;var fo=Object.getOwnPropertyNames;var go=Object.getPrototypeOf,ho=Object.prototype.hasOwnProperty;var wo=(e,o)=>{for(var r in o)Ge(e,r,{get:o[r],enumerable:!0})},jt=(e,o,r,t)=>{if(o&&typeof o=="object"||typeof o=="function")for(let n of fo(o))!ho.call(e,n)&&n!==r&&Ge(e,n,{get:()=>o[n],enumerable:!(t=po(o,n))||t.enumerable});return e};var Nt=(e,o,r)=>(r=e!=null?mo(go(e)):{},jt(o||!e||!e.__esModule?Ge(r,"default",{value:e,enumerable:!0}):r,e)),yo=e=>jt(Ge({},"__esModule",{value:!0}),e);var Dn={};wo(Dn,{HIDE_METADATA:()=>pe,admin:()=>Tn,anonymous:()=>In,bearer:()=>vn,createAuthEndpoint:()=>c,createAuthMiddleware:()=>S,emailOTP:()=>zn,genericOAuth:()=>Pn,getPasskeyActions:()=>oo,jwt:()=>_n,magicLink:()=>Rn,multiSession:()=>Cn,oAuthProxy:()=>Ln,oneTap:()=>Bn,optionsMiddleware:()=>gt,organization:()=>dn,passkey:()=>On,passkeyClient:()=>kn,phoneNumber:()=>En,twoFactor:()=>yn,twoFactorClient:()=>wn,username:()=>Bt});module.exports=yo(Dn);var vt=require("better-call"),Pe=require("zod");var me=require("better-call"),gt=(0,me.createMiddleware)(async()=>({})),S=(0,me.createMiddlewareCreator)({use:[gt,(0,me.createMiddleware)(async()=>({}))]}),c=(0,me.createEndpointCreator)({use:[gt]});var L=require("better-call"),_=require("zod");var Ro=require("oslo");var W=class extends Error{constructor(o,r){super(o),this.name="BetterAuthError",this.message=o,this.cause=r,this.stack=""}};var Je=Object.create(null),De=e=>globalThis.process?.env||globalThis.Deno?.env.toObject()||globalThis.__env__||(e?Je:globalThis),G=new Proxy(Je,{get(e,o){return De()[o]??Je[o]},has(e,o){let r=De();return o in r||o in Je},set(e,o,r){let t=De(!0);return t[o]=r,!0},deleteProperty(e,o){if(!o)return!1;let r=De(!0);return delete r[o],!0},ownKeys(){let e=De(!0);return Object.keys(e)}});function bo(e){return e?e!=="false":!1}var ht=typeof process<"u"&&process.env&&process.env.NODE_ENV||"";var Vt=ht==="dev"||ht==="development",Ao=ht==="test"||bo(G.TEST);var Ke=require("oslo/crypto");async function Oo({value:e,secret:o}){return new Ke.HMAC("SHA-256").sign(new TextEncoder().encode(o),new TextEncoder().encode(e)).then(t=>Buffer.from(t).toString("base64"))}function vo({value:e,signature:o,secret:r}){return new Ke.HMAC("SHA-256").verify(new TextEncoder().encode(r),Buffer.from(o,"base64"),new TextEncoder().encode(e))}var Ze={sign:Oo,verify:vo};var Ft=require("oslo/encoding");var P=(e,o="ms")=>new Date(Date.now()+(o==="sec"?e*1e3:e));function Ye(e){let o=new Map;return e.split(", ").forEach(t=>{let n=t.split(";").map(m=>m.trim()),[i,...s]=n,[a,...d]=i.split("="),u=d.join("=");if(!a||u===void 0){console.warn(`Malformed cookie: ${t}`);return}let l={value:u};s.forEach(m=>{let[f,...p]=m.split("="),h=p.join("="),k=f.trim().toLowerCase();switch(k){case"max-age":l["max-age"]=h;break;case"expires":l.expires=h?new Date(h.trim()):void 0;break;case"domain":l.domain=h?h.trim():void 0;break;case"path":l.path=h?h.trim():void 0;break;case"secure":l.secure=!0;break;case"httponly":l.httponly=!0;break;case"samesite":l.samesite=h?h.trim().toLowerCase():void 0;break;default:l[k]=h?h.trim():!0;break}}),o.set(a,l)}),o}async function w(e,o,r,t){let n=e.context.authCookies.sessionToken.options;n.maxAge=r?void 0:e.context.sessionConfig.expiresIn,await e.setSignedCookie(e.context.authCookies.sessionToken.name,o.session.id,e.context.secret,{...n,...t}),r&&await e.setSignedCookie(e.context.authCookies.dontRememberToken.name,"true",e.context.secret,e.context.authCookies.dontRememberToken.options),e.context.options.session?.cookieCache?.enabled&&e.setCookie(e.context.authCookies.sessionData.name,JSON.stringify(Ft.base64url.encode(new TextEncoder().encode(JSON.stringify({session:o,expiresAt:P(e.context.authCookies.sessionData.options.maxAge||60,"sec").getTime(),signature:await Ze.sign({value:JSON.stringify(o),secret:e.context.secret})})))),e.context.authCookies.sessionData.options),e.context.options.secondaryStorage&&await e.context.secondaryStorage?.set(o.session.id,JSON.stringify({user:o.user,session:o.session}),o.session.expiresAt.getTime()-Date.now())}function J(e){e.setCookie(e.context.authCookies.sessionToken.name,"",{maxAge:0}),e.setCookie(e.context.authCookies.sessionData.name,"",{maxAge:0}),e.setCookie(e.context.authCookies.dontRememberToken.name,"",{maxAge:0})}function Xe(e){let o=e.split("; "),r=new Map;return o.forEach(t=>{let[n,i]=t.split("=");r.set(n,i)}),r}var Jt=require("oslo/jwt");var qt=require("oslo/crypto"),Mt=require("oslo/encoding");async function $t(e){let o=await(0,qt.sha256)(new TextEncoder().encode(e));return Mt.base64url.encode(new Uint8Array(o),{includePadding:!1})}function Qt(e){return{tokenType:e.token_type,accessToken:e.access_token,refreshToken:e.refresh_token,accessTokenExpiresAt:e.expires_in?P(e.expires_in,"sec"):void 0,scopes:e?.scope?typeof e.scope=="string"?e.scope.split(" "):e.scope:[],idToken:e.id_token}}async function E({id:e,options:o,authorizationEndpoint:r,state:t,codeVerifier:n,scopes:i,claims:s,redirectURI:a}){let d=new URL(r);if(d.searchParams.set("response_type","code"),d.searchParams.set("client_id",o.clientId),d.searchParams.set("state",t),d.searchParams.set("scope",i.join(" ")),d.searchParams.set("redirect_uri",o.redirectURI||a),n){let u=await $t(n);d.searchParams.set("code_challenge_method","S256"),d.searchParams.set("code_challenge",u)}if(s){let u=s.reduce((l,m)=>(l[m]=null,l),{});d.searchParams.set("claims",JSON.stringify({id_token:{email:null,email_verified:null,...u}}))}return d}var Ht=require("@better-fetch/fetch");async function O({code:e,codeVerifier:o,redirectURI:r,options:t,tokenEndpoint:n,authentication:i}){let s=new URLSearchParams,a={"content-type":"application/x-www-form-urlencoded",accept:"application/json","user-agent":"better-auth"};if(s.set("grant_type","authorization_code"),s.set("code",e),o&&s.set("code_verifier",o),s.set("redirect_uri",r),i==="basic"){let m=btoa(`${t.clientId}:${t.clientSecret}`);a.authorization=`Basic ${m}`}else s.set("client_id",t.clientId),s.set("client_secret",t.clientSecret);let{data:d,error:u}=await(0,Ht.betterFetch)(n,{method:"POST",body:s,headers:a});if(u)throw u;return Qt(d)}var et=require("oslo/oauth2"),re=require("zod"),wt=require("better-call");var pe={isAction:!1};var Wt=require("nanoid"),z=e=>(0,Wt.nanoid)(e);var Gt=require("consola"),fe=(0,Gt.createConsola)({formatOptions:{date:!1,colors:!0,compact:!0},defaults:{tag:"Better Auth"}}),Uo=e=>({log:(...o)=>{!e?.disabled&&fe.log("",...o)},error:(...o)=>{!e?.disabled&&fe.error("",...o)},warn:(...o)=>{!e?.disabled&&fe.warn("",...o)},info:(...o)=>{!e?.disabled&&fe.info("",...o)},debug:(...o)=>{!e?.disabled&&fe.debug("",...o)},box:(...o)=>{!e?.disabled&&fe.box("",...o)},success:(...o)=>{!e?.disabled&&fe.success("",...o)},break:(...o)=>{!e?.disabled&&console.log(`
2
- `)}}),y=Uo();function Oe(e){try{return new URL(e).origin}catch{return null}}async function ve(e,o){let r=e.body?.callbackURL||(e.query?.currentURL?Oe(e.query?.currentURL):"")||e.context.options.baseURL;if(!r)throw new wt.APIError("BAD_REQUEST",{message:"callbackURL is required"});let t=(0,et.generateCodeVerifier)(),n=(0,et.generateState)(),i=JSON.stringify({callbackURL:r,codeVerifier:t,errorURL:e.query?.currentURL,link:o,expiresAt:Date.now()+10*60*1e3}),s=new Date;s.setMinutes(s.getMinutes()+10);let a=await e.context.internalAdapter.createVerificationValue({value:i,identifier:n,expiresAt:s});if(!a)throw y.error("Unable to create verification. Make sure the database adapter is properly working and there is a verification table in the database"),new wt.APIError("INTERNAL_SERVER_ERROR",{message:"Unable to create verification"});return{state:a.identifier,codeVerifier:t}}async function tt(e){let o=e.query.state,r=await e.context.internalAdapter.findVerificationValue(o);if(!r)throw y.error("State Mismatch. Verification not found",{state:o}),e.redirect(`${e.context.baseURL}/error?error=please_restart_the_process`);let t=re.z.object({callbackURL:re.z.string(),codeVerifier:re.z.string(),errorURL:re.z.string().optional(),expiresAt:re.z.number(),link:re.z.object({email:re.z.string(),userId:re.z.string()}).optional()}).parse(JSON.parse(r.value));if(t.errorURL||(t.errorURL=`${e.context.baseURL}/error`),t.expiresAt<Date.now())throw await e.context.internalAdapter.deleteVerificationValue(r.id),y.error("State expired.",{state:o}),e.redirect(`${e.context.baseURL}/error?error=please_restart_the_process`);return await e.context.internalAdapter.deleteVerificationValue(r.id),t}var Re=require("jose"),Kt=require("@better-fetch/fetch"),Zt=require("better-call"),_i=require("zod"),Yt=e=>{let o="https://appleid.apple.com/auth/token";return{id:"apple",name:"Apple",createAuthorizationURL({state:r,scopes:t,redirectURI:n}){let i=t||["email","name","openid"];return e.scope&&i.push(...e.scope),new URL(`https://appleid.apple.com/auth/authorize?client_id=${e.clientId}&response_type=code&redirect_uri=${n||e.redirectURI}&scope=${i.join(" ")}&state=${r}`)},validateAuthorizationCode:async({code:r,codeVerifier:t,redirectURI:n})=>O({code:r,codeVerifier:t,redirectURI:e.redirectURI||n,options:e,tokenEndpoint:o}),async verifyIdToken(r,t){if(e.disableIdTokenSignIn)return!1;if(e.verifyIdToken)return e.verifyIdToken(r,t);let n=(0,Re.decodeProtectedHeader)(r),{kid:i,alg:s}=n;if(!i||!s)return!1;let a=await Eo(i),{payload:d}=await(0,Re.jwtVerify)(r,a,{algorithms:[s],issuer:"https://appleid.apple.com",audience:e.clientId,maxTokenAge:"1h"});return["email_verified","is_private_email"].forEach(u=>{d[u]!==void 0&&(d[u]=!!d[u])}),t&&d.nonce!==t?!1:!!d},async getUserInfo(r){if(!r.idToken)return null;let t=(0,Jt.parseJWT)(r.idToken)?.payload;return t?{user:{id:t.sub,name:t.name,email:t.email,emailVerified:t.email_verified==="true",image:t.picture},data:t}:null}}},Eo=async e=>{let o="https://appleid.apple.com",r="/auth/keys",{data:t}=await(0,Kt.betterFetch)(`${o}${r}`);if(!t?.keys)throw new Zt.APIError("BAD_REQUEST",{message:"Keys not found"});let n=t.keys.find(i=>i.kid===e);if(!n)throw new Error(`JWK with kid ${e} not found`);return await(0,Re.importJWK)(n,n.alg)};var Xt=require("@better-fetch/fetch");var er=e=>({id:"discord",name:"Discord",createAuthorizationURL({state:o,scopes:r,redirectURI:t}){let n=r||["identify","email"];return e.scope&&n.push(...e.scope),new URL(`https://discord.com/api/oauth2/authorize?scope=${n.join("+")}&response_type=code&client_id=${e.clientId}&redirect_uri=${encodeURIComponent(e.redirectURI||t)}&state=${o}`)},validateAuthorizationCode:async({code:o,redirectURI:r})=>O({code:o,redirectURI:e.redirectURI||r,options:e,tokenEndpoint:"https://discord.com/api/oauth2/token"}),async getUserInfo(o){let{data:r,error:t}=await(0,Xt.betterFetch)("https://discord.com/api/users/@me",{headers:{authorization:`Bearer ${o.accessToken}`}});if(t)return null;if(r.avatar===null){let n=r.discriminator==="0"?Number(BigInt(r.id)>>BigInt(22))%6:parseInt(r.discriminator)%5;r.image_url=`https://cdn.discordapp.com/embed/avatars/${n}.png`}else{let n=r.avatar.startsWith("a_")?"gif":"png";r.image_url=`https://cdn.discordapp.com/avatars/${r.id}/${r.avatar}.${n}`}return{user:{id:r.id,name:r.display_name||r.username||"",email:r.email,emailVerified:r.verified,image:r.image_url},data:r}}});var tr=require("@better-fetch/fetch");var rr=e=>({id:"facebook",name:"Facebook",async createAuthorizationURL({state:o,scopes:r,redirectURI:t}){let n=r||["email","public_profile"];return e.scope&&n.push(...e.scope),await E({id:"facebook",options:e,authorizationEndpoint:"https://www.facebook.com/v21.0/dialog/oauth",scopes:n,state:o,redirectURI:t})},validateAuthorizationCode:async({code:o,redirectURI:r})=>O({code:o,redirectURI:e.redirectURI||r,options:e,tokenEndpoint:"https://graph.facebook.com/oauth/access_token"}),async getUserInfo(o){let{data:r,error:t}=await(0,tr.betterFetch)("https://graph.facebook.com/me?fields=id,name,email,picture",{auth:{type:"Bearer",token:o.accessToken}});return t?null:{user:{id:r.id,name:r.name,email:r.email,image:r.picture.data.url,emailVerified:r.email_verified},data:r}}});var yt=require("@better-fetch/fetch");var or=e=>{let o="https://github.com/login/oauth/access_token";return{id:"github",name:"GitHub",createAuthorizationURL({state:r,scopes:t,codeVerifier:n,redirectURI:i}){let s=t||["user:email"];return e.scope&&s.push(...e.scope),E({id:"github",options:e,authorizationEndpoint:"https://github.com/login/oauth/authorize",scopes:s,state:r,redirectURI:i})},validateAuthorizationCode:async({code:r,redirectURI:t})=>O({code:r,redirectURI:e.redirectURI||t,options:e,tokenEndpoint:o}),async getUserInfo(r){let{data:t,error:n}=await(0,yt.betterFetch)("https://api.github.com/user",{headers:{"User-Agent":"better-auth",authorization:`Bearer ${r.accessToken}`}});if(n)return null;let i=!1;if(!t.email){let{data:s,error:a}=await(0,yt.betterFetch)("https://api.github.com/user/emails",{headers:{authorization:`Bearer ${r.accessToken}`,"User-Agent":"better-auth"}});a||(t.email=(s.find(d=>d.primary)??s[0])?.email,i=s.find(d=>d.email===t.email)?.verified??!1)}return{user:{id:t.id.toString(),name:t.name||t.login,email:t.email,image:t.avatar_url,emailVerified:i},data:t}}}};var nr=require("oslo/jwt");var ir=require("@better-fetch/fetch"),sr=e=>({id:"google",name:"Google",async createAuthorizationURL({state:o,scopes:r,codeVerifier:t,redirectURI:n}){if(!e.clientId||!e.clientSecret)throw y.error("Client Id and Client Secret is required for Google. Make sure to provide them in the options."),new W("CLIENT_ID_AND_SECRET_REQUIRED");if(!t)throw new W("codeVerifier is required for Google");let i=r||["email","profile","openid"];e.scope&&i.push(...e.scope);let s=await E({id:"google",options:e,authorizationEndpoint:"https://accounts.google.com/o/oauth2/auth",scopes:i,state:o,codeVerifier:t,redirectURI:n});return e.accessType&&s.searchParams.set("access_type",e.accessType),e.prompt&&s.searchParams.set("prompt",e.prompt),s},validateAuthorizationCode:async({code:o,codeVerifier:r,redirectURI:t})=>O({code:o,codeVerifier:r,redirectURI:e.redirectURI||t,options:e,tokenEndpoint:"https://oauth2.googleapis.com/token"}),async verifyIdToken(o,r){if(e.disableIdTokenSignIn)return!1;if(e.verifyIdToken)return e.verifyIdToken(o,r);let t=`https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=${o}`,{data:n}=await(0,ir.betterFetch)(t);return n?n.aud===e.clientId&&n.iss==="https://accounts.google.com":!1},async getUserInfo(o){if(!o.idToken)return null;let r=(0,nr.parseJWT)(o.idToken)?.payload;return{user:{id:r.sub,name:r.name,email:r.email,image:r.picture,emailVerified:r.email_verified},data:r}}});var ar=require("@better-fetch/fetch"),dr=require("oslo/jwt");var ur=e=>{let o=e.tenantId||"common",r=`https://login.microsoftonline.com/${o}/oauth2/v2.0/authorize`,t=`https://login.microsoftonline.com/${o}/oauth2/v2.0/token`;return{id:"microsoft",name:"Microsoft EntraID",createAuthorizationURL(n){let i=n.scopes||["openid","profile","email","User.Read"];return e.scope&&i.push(...e.scope),E({id:"microsoft",options:e,authorizationEndpoint:r,state:n.state,codeVerifier:n.codeVerifier,scopes:i,redirectURI:n.redirectURI})},validateAuthorizationCode({code:n,codeVerifier:i,redirectURI:s}){return O({code:n,codeVerifier:i,redirectURI:e.redirectURI||s,options:e,tokenEndpoint:t})},async getUserInfo(n){if(!n.idToken)return null;let i=(0,dr.parseJWT)(n.idToken)?.payload,s=e.profilePhotoSize||48;return await(0,ar.betterFetch)(`https://graph.microsoft.com/v1.0/me/photos/${s}x${s}/$value`,{headers:{Authorization:`Bearer ${n.accessToken}`},async onResponse(a){if(!(e.disableProfilePhoto||!a.response.ok))try{let u=await a.response.clone().arrayBuffer(),l=Buffer.from(u).toString("base64");i.picture=`data:image/jpeg;base64, ${l}`}catch(d){y.error(d)}}}),{user:{id:i.sub,name:i.name,email:i.email,image:i.picture,emailVerified:!0},data:i}}}};var cr=require("@better-fetch/fetch");var lr=e=>({id:"spotify",name:"Spotify",createAuthorizationURL({state:o,scopes:r,codeVerifier:t,redirectURI:n}){let i=r||["user-read-email"];return e.scope&&i.push(...e.scope),E({id:"spotify",options:e,authorizationEndpoint:"https://accounts.spotify.com/authorize",scopes:i,state:o,codeVerifier:t,redirectURI:n})},validateAuthorizationCode:async({code:o,codeVerifier:r,redirectURI:t})=>O({code:o,codeVerifier:r,redirectURI:e.redirectURI||t,options:e,tokenEndpoint:"https://accounts.spotify.com/api/token"}),async getUserInfo(o){let{data:r,error:t}=await(0,cr.betterFetch)("https://api.spotify.com/v1/me",{method:"GET",headers:{Authorization:`Bearer ${o.accessToken}`}});return t?null:{user:{id:r.id,name:r.display_name,email:r.email,image:r.images[0]?.url,emailVerified:!1},data:r}}});var Ji=require("@better-fetch/fetch");var mr=require("oslo/jwt");var pr=e=>({id:"twitch",name:"Twitch",createAuthorizationURL({state:o,scopes:r,redirectURI:t}){let n=r||["user:read:email","openid"];return e.scope&&n.push(...e.scope),E({id:"twitch",redirectURI:t,options:e,authorizationEndpoint:"https://id.twitch.tv/oauth2/authorize",scopes:n,state:o,claims:e.claims||["email","email_verified","preferred_username","picture"]})},validateAuthorizationCode:async({code:o,redirectURI:r})=>O({code:o,redirectURI:e.redirectURI||r,options:e,tokenEndpoint:"https://id.twitch.tv/oauth2/token"}),async getUserInfo(o){let r=o.idToken;if(!r)return y.error("No idToken found in token"),null;let t=(0,mr.parseJWT)(r)?.payload;return{user:{id:t.sub,name:t.preferred_username,email:t.email,image:t.picture,emailVerified:!1},data:t}}});var fr=require("@better-fetch/fetch");var gr=e=>({id:"twitter",name:"Twitter",createAuthorizationURL(o){let r=o.scopes||["users.read","tweet.read","offline.access"];return e.scope&&r.push(...e.scope),E({id:"twitter",options:e,authorizationEndpoint:"https://x.com/i/oauth2/authorize",scopes:r,state:o.state,codeVerifier:o.codeVerifier,redirectURI:o.redirectURI})},validateAuthorizationCode:async({code:o,codeVerifier:r,redirectURI:t})=>O({code:o,codeVerifier:r,authentication:"basic",redirectURI:e.redirectURI||t,options:e,tokenEndpoint:"https://api.x.com/2/oauth2/token"}),async getUserInfo(o){let{data:r,error:t}=await(0,fr.betterFetch)("https://api.x.com/2/users/me?user.fields=profile_image_url",{method:"GET",headers:{Authorization:`Bearer ${o.accessToken}`}});return t?null:{user:{id:r.data.id,name:r.data.name,email:r.data.email||null,image:r.data.profile_image_url,emailVerified:r.data.verified||!1},data:r}}});var hr=require("@better-fetch/fetch");var wr=e=>{let o="https://api.dropboxapi.com/oauth2/token";return{id:"dropbox",name:"Dropbox",createAuthorizationURL:async({state:r,scopes:t,codeVerifier:n,redirectURI:i})=>{let s=t||["account_info.read"];return e.scope&&s.push(...e.scope),await E({id:"dropbox",options:e,authorizationEndpoint:"https://www.dropbox.com/oauth2/authorize",scopes:s,state:r,redirectURI:i,codeVerifier:n})},validateAuthorizationCode:async({code:r,codeVerifier:t,redirectURI:n})=>await O({code:r,codeVerifier:t,redirectURI:e.redirectURI||n,options:e,tokenEndpoint:o}),async getUserInfo(r){let{data:t,error:n}=await(0,hr.betterFetch)("https://api.dropboxapi.com/2/users/get_current_account",{method:"POST",headers:{Authorization:`Bearer ${r.accessToken}`}});return n?null:{user:{id:t.account_id,name:t.name?.display_name,email:t.email,emailVerified:t.email_verified||!1,image:t.profile_photo_url},data:t}}}};var yr=require("@better-fetch/fetch");var br=e=>{let o="https://www.linkedin.com/oauth/v2/authorization",r="https://www.linkedin.com/oauth/v2/accessToken";return{id:"linkedin",name:"Linkedin",createAuthorizationURL:async({state:t,scopes:n,redirectURI:i})=>{let s=n||["profile","email","openid"];return e.scope&&s.push(...e.scope),await E({id:"linkedin",options:e,authorizationEndpoint:o,scopes:s,state:t,redirectURI:i})},validateAuthorizationCode:async({code:t,redirectURI:n})=>await O({code:t,redirectURI:e.redirectURI||n,options:e,tokenEndpoint:r}),async getUserInfo(t){let{data:n,error:i}=await(0,yr.betterFetch)("https://api.linkedin.com/v2/userinfo",{method:"GET",headers:{Authorization:`Bearer ${t.accessToken}`}});return i?null:{user:{id:n.sub,name:n.name,email:n.email,emailVerified:n.email_verified||!1,image:n.picture},data:n}}}};var Ar=require("@better-fetch/fetch");var bt=(e="")=>e.split("://").map(o=>o.replace(/\/{2,}/g,"/")).join("://"),Io=e=>{let o=e||"https://gitlab.com";return{authorizationEndpoint:bt(`${o}/oauth/authorize`),tokenEndpoint:bt(`${o}/oauth/token`),userinfoEndpoint:bt(`${o}/api/v4/user`)}},kr=e=>{let{authorizationEndpoint:o,tokenEndpoint:r,userinfoEndpoint:t}=Io(e.issuer),n="gitlab";return{id:n,name:"Gitlab",createAuthorizationURL:async({state:s,scopes:a,codeVerifier:d,redirectURI:u})=>{let l=a||["read_user"];return e.scope&&l.push(...e.scope),await E({id:n,options:e,authorizationEndpoint:o,scopes:l,state:s,redirectURI:u,codeVerifier:d})},validateAuthorizationCode:async({code:s,redirectURI:a,codeVerifier:d})=>O({code:s,redirectURI:e.redirectURI||a,options:e,codeVerifier:d,tokenEndpoint:r}),async getUserInfo(s){let{data:a,error:d}=await(0,Ar.betterFetch)(t,{headers:{authorization:`Bearer ${s.accessToken}`}});return d||a.state!=="active"||a.locked?null:{user:{id:a.id.toString(),name:a.name??a.username,email:a.email,image:a.avatar_url,emailVerified:!0},data:a}}}};var To={apple:Yt,discord:er,facebook:rr,github:or,microsoft:ur,google:sr,spotify:lr,twitch:pr,twitter:gr,dropbox:wr,linkedin:br,gitlab:kr},rt=Object.keys(To);var Rr=require("oslo"),ot=require("oslo/jwt"),$=require("zod");var he=require("better-call");var ge=require("better-call");var Ue=require("zod");function Or(e){try{return JSON.parse(e)}catch{return null}}var vr=()=>c("/get-session",{method:"GET",query:Ue.z.optional(Ue.z.object({disableCookieCache:Ue.z.boolean().optional()})),requireHeaders:!0},async e=>{try{let o=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(!o)return e.json(null,{status:401});let r=e.getCookie(e.context.authCookies.sessionData.name),t=r?Or(Buffer.from(r,"base64").toString()):null;if(t&&!await Ze.verify({value:JSON.stringify(t.session),signature:t?.signature,secret:e.context.secret}))return J(e),e.json(null,{status:401});let n=await e.getSignedCookie(e.context.authCookies.dontRememberToken.name,e.context.secret);if(t?.session&&e.context.options.session?.cookieCache?.enabled&&!e.query?.disableCookieCache){let l=t.session;if(t.expiresAt<Date.now()||l.session.expiresAt<new Date){let f=e.context.authCookies.sessionData.name;e.setCookie(f,"",{maxAge:0})}else return e.json(l)}let i=await e.context.internalAdapter.findSession(o);if(!i||i.session.expiresAt<new Date)return J(e),i&&await e.context.internalAdapter.deleteSession(i.session.id),e.json(null,{status:401});if(n)return e.json(i);let s=e.context.sessionConfig.expiresIn,a=e.context.sessionConfig.updateAge;if(i.session.expiresAt.valueOf()-s*1e3+a*1e3<=Date.now()){let l=await e.context.internalAdapter.updateSession(i.session.id,{expiresAt:P(e.context.sessionConfig.expiresIn,"sec")});if(!l)return J(e),e.json(null,{status:401});let m=(l.expiresAt.valueOf()-Date.now())/1e3;return await w(e,{session:l,user:i.user},!1,{maxAge:m}),e.json({session:l,user:i.user})}return e.json(i)}catch(o){return e.context.logger.error(o),e.json(null,{status:500})}}),B=async e=>await vr()({...e,_flag:"json",headers:e.headers}),b=S(async e=>{let o=await B(e);if(!o?.session)throw new ge.APIError("UNAUTHORIZED");return{session:o}});var So=c("/revoke-session",{method:"POST",body:Ue.z.object({id:Ue.z.string()}),use:[b],requireHeaders:!0},async e=>{let o=e.body.id,r=await e.context.internalAdapter.findSession(o);if(!r)throw new ge.APIError("BAD_REQUEST",{message:"Session not found"});if(r.session.userId!==e.context.session.user.id)throw new ge.APIError("UNAUTHORIZED");try{await e.context.internalAdapter.deleteSession(o)}catch(t){throw e.context.logger.error(t),new ge.APIError("INTERNAL_SERVER_ERROR")}return e.json({status:!0})}),Po=c("/revoke-sessions",{method:"POST",use:[b],requireHeaders:!0},async e=>{try{await e.context.internalAdapter.deleteSessions(e.context.session.user.id)}catch(o){throw e.context.logger.error(o),new ge.APIError("INTERNAL_SERVER_ERROR")}return e.json({status:!0})}),_o=c("/revoke-other-sessions",{method:"POST",requireHeaders:!0,use:[b]},async e=>{let o=e.context.session;if(!o.user)throw new ge.APIError("UNAUTHORIZED");let n=(await e.context.internalAdapter.listSessions(o.user.id)).filter(i=>i.expiresAt>new Date).filter(i=>i.id!==e.context.session.session.id);return await Promise.all(n.map(i=>e.context.internalAdapter.deleteSession(i.id))),e.json({status:!0})});async function ie(e,o,r){return await(0,ot.createJWT)("HS256",Buffer.from(e),{email:o.toLowerCase(),updateTo:r},{expiresIn:new Rr.TimeSpan(1,"h"),issuer:"better-auth",subject:"verify-email",audiences:[o],includeIssuedTimestamp:!0})}var Co=c("/send-verification-email",{method:"POST",query:$.z.object({currentURL:$.z.string().optional()}).optional(),body:$.z.object({email:$.z.string().email(),callbackURL:$.z.string().optional()})},async e=>{if(!e.context.options.emailVerification?.sendVerificationEmail)throw e.context.logger.error("Verification email isn't enabled."),new he.APIError("BAD_REQUEST",{message:"Verification email isn't enabled"});let{email:o}=e.body,r=await e.context.internalAdapter.findUserByEmail(o);if(!r)throw new he.APIError("BAD_REQUEST",{message:"User not found"});let t=await ie(e.context.secret,o),n=`${e.context.baseURL}/verify-email?token=${t}&callbackURL=${e.body.callbackURL||e.query?.currentURL||"/"}`;return await e.context.options.emailVerification.sendVerificationEmail({user:r.user,url:n,token:t},e.request),e.json({status:!0})}),zo=c("/verify-email",{method:"GET",query:$.z.object({token:$.z.string(),callbackURL:$.z.string().optional()})},async e=>{let{token:o}=e.query,r;try{r=await(0,ot.validateJWT)("HS256",Buffer.from(e.context.secret),o)}catch(s){throw e.context.logger.error("Failed to verify email",s),new he.APIError("BAD_REQUEST",{message:"Invalid token"})}let n=$.z.object({email:$.z.string().email(),updateTo:$.z.string().optional()}).parse(r.payload);if(!await e.context.internalAdapter.findUserByEmail(n.email))throw new he.APIError("BAD_REQUEST",{message:"User not found"});if(n.updateTo){let s=await B(e);if(!s)throw e.query.callbackURL?e.redirect(`${e.query.callbackURL}?error=unauthorized`):new he.APIError("UNAUTHORIZED",{message:"Session not found"});if(s.user.email!==n.email)throw e.query.callbackURL?e.redirect(`${e.query.callbackURL}?error=unauthorized`):new he.APIError("UNAUTHORIZED",{message:"Invalid session"});let a=await e.context.internalAdapter.updateUserByEmail(n.email,{email:n.updateTo});if(await e.context.options.emailVerification?.sendVerificationEmail?.({user:a,url:`${e.context.baseURL}/verify-email?token=${o}`,token:o},e.request),e.query.callbackURL)throw e.redirect(e.query.callbackURL);return e.json({user:a,status:!0})}if(await e.context.internalAdapter.updateUserByEmail(n.email,{emailVerified:!0}),e.query.callbackURL)throw e.redirect(e.query.callbackURL);return e.json({user:null,status:!0})});var At=require("better-call");var Ur=require("better-call");var Bo=S(async e=>{if(e.request?.method!=="POST")return;let{body:o,query:r,context:t}=e,n=e.headers?.get("origin")||e.headers?.get("referer")||"",i=o?.callbackURL||r?.callbackURL,s=o?.redirectTo,a=r?.currentURL,d=t.trustedOrigins,u=e.headers?.has("cookie"),l=(f,p)=>p.includes("*")?new RegExp("^"+p.replace(/\*/g,"[^/]+").replace(/\./g,"\\.")+"$").test(f):f.startsWith(p),m=(f,p)=>{if(!f)return;if(!d.some(k=>l(f,k)||f?.startsWith("/")&&p!=="origin"&&!f.includes(":")))throw y.error(`Invalid ${p}: ${f}`),y.info(`If it's a valid URL, please add ${f} to trustedOrigins in your auth config
1
+ "use strict";var mo=Object.create;var Ge=Object.defineProperty;var po=Object.getOwnPropertyDescriptor;var fo=Object.getOwnPropertyNames;var go=Object.getPrototypeOf,ho=Object.prototype.hasOwnProperty;var wo=(e,o)=>{for(var r in o)Ge(e,r,{get:o[r],enumerable:!0})},jt=(e,o,r,t)=>{if(o&&typeof o=="object"||typeof o=="function")for(let n of fo(o))!ho.call(e,n)&&n!==r&&Ge(e,n,{get:()=>o[n],enumerable:!(t=po(o,n))||t.enumerable});return e};var Nt=(e,o,r)=>(r=e!=null?mo(go(e)):{},jt(o||!e||!e.__esModule?Ge(r,"default",{value:e,enumerable:!0}):r,e)),yo=e=>jt(Ge({},"__esModule",{value:!0}),e);var Dn={};wo(Dn,{HIDE_METADATA:()=>pe,admin:()=>Tn,anonymous:()=>In,bearer:()=>vn,createAuthEndpoint:()=>c,createAuthMiddleware:()=>S,emailOTP:()=>zn,genericOAuth:()=>Pn,getPasskeyActions:()=>oo,jwt:()=>_n,magicLink:()=>Rn,multiSession:()=>Cn,oAuthProxy:()=>Ln,oneTap:()=>Bn,optionsMiddleware:()=>gt,organization:()=>dn,passkey:()=>On,passkeyClient:()=>kn,phoneNumber:()=>En,twoFactor:()=>yn,twoFactorClient:()=>wn,username:()=>Bt});module.exports=yo(Dn);var vt=require("better-call"),Pe=require("zod");var me=require("better-call"),gt=(0,me.createMiddleware)(async()=>({})),S=(0,me.createMiddlewareCreator)({use:[gt,(0,me.createMiddleware)(async()=>({}))]}),c=(0,me.createEndpointCreator)({use:[gt]});var L=require("better-call"),_=require("zod");var Ro=require("oslo");var W=class extends Error{constructor(o,r){super(o),this.name="BetterAuthError",this.message=o,this.cause=r,this.stack=""}};var Je=Object.create(null),De=e=>globalThis.process?.env||globalThis.Deno?.env.toObject()||globalThis.__env__||(e?Je:globalThis),G=new Proxy(Je,{get(e,o){return De()[o]??Je[o]},has(e,o){let r=De();return o in r||o in Je},set(e,o,r){let t=De(!0);return t[o]=r,!0},deleteProperty(e,o){if(!o)return!1;let r=De(!0);return delete r[o],!0},ownKeys(){let e=De(!0);return Object.keys(e)}});function bo(e){return e?e!=="false":!1}var ht=typeof process<"u"&&process.env&&process.env.NODE_ENV||"";var Vt=ht==="dev"||ht==="development",Ao=ht==="test"||bo(G.TEST);var Ke=require("oslo/crypto");async function Oo({value:e,secret:o}){return new Ke.HMAC("SHA-256").sign(new TextEncoder().encode(o),new TextEncoder().encode(e)).then(t=>Buffer.from(t).toString("base64"))}function vo({value:e,signature:o,secret:r}){return new Ke.HMAC("SHA-256").verify(new TextEncoder().encode(r),Buffer.from(o,"base64"),new TextEncoder().encode(e))}var Ze={sign:Oo,verify:vo};var Ft=require("oslo/encoding");var P=(e,o="ms")=>new Date(Date.now()+(o==="sec"?e*1e3:e));function Ye(e){let o=new Map;return e.split(", ").forEach(t=>{let n=t.split(";").map(m=>m.trim()),[i,...s]=n,[a,...d]=i.split("="),u=d.join("=");if(!a||u===void 0){console.warn(`Malformed cookie: ${t}`);return}let l={value:u};s.forEach(m=>{let[f,...p]=m.split("="),h=p.join("="),k=f.trim().toLowerCase();switch(k){case"max-age":l["max-age"]=h;break;case"expires":l.expires=h?new Date(h.trim()):void 0;break;case"domain":l.domain=h?h.trim():void 0;break;case"path":l.path=h?h.trim():void 0;break;case"secure":l.secure=!0;break;case"httponly":l.httponly=!0;break;case"samesite":l.samesite=h?h.trim().toLowerCase():void 0;break;default:l[k]=h?h.trim():!0;break}}),o.set(a,l)}),o}async function w(e,o,r,t){let n=e.context.authCookies.sessionToken.options;n.maxAge=r?void 0:e.context.sessionConfig.expiresIn,await e.setSignedCookie(e.context.authCookies.sessionToken.name,o.session.id,e.context.secret,{...n,...t}),r&&await e.setSignedCookie(e.context.authCookies.dontRememberToken.name,"true",e.context.secret,e.context.authCookies.dontRememberToken.options),e.context.options.session?.cookieCache?.enabled&&e.setCookie(e.context.authCookies.sessionData.name,JSON.stringify(Ft.base64url.encode(new TextEncoder().encode(JSON.stringify({session:o,expiresAt:P(e.context.authCookies.sessionData.options.maxAge||60,"sec").getTime(),signature:await Ze.sign({value:JSON.stringify(o),secret:e.context.secret})})))),e.context.authCookies.sessionData.options),e.context.options.secondaryStorage&&await e.context.secondaryStorage?.set(o.session.id,JSON.stringify({user:o.user,session:o.session}),o.session.expiresAt.getTime()-Date.now())}function J(e){e.setCookie(e.context.authCookies.sessionToken.name,"",{maxAge:0}),e.setCookie(e.context.authCookies.sessionData.name,"",{maxAge:0}),e.setCookie(e.context.authCookies.dontRememberToken.name,"",{maxAge:0})}function Xe(e){let o=e.split("; "),r=new Map;return o.forEach(t=>{let[n,i]=t.split("=");r.set(n,i)}),r}var Jt=require("oslo/jwt");var qt=require("oslo/crypto"),Mt=require("oslo/encoding");async function $t(e){let o=await(0,qt.sha256)(new TextEncoder().encode(e));return Mt.base64url.encode(new Uint8Array(o),{includePadding:!1})}function Qt(e){return{tokenType:e.token_type,accessToken:e.access_token,refreshToken:e.refresh_token,accessTokenExpiresAt:e.expires_in?P(e.expires_in,"sec"):void 0,scopes:e?.scope?typeof e.scope=="string"?e.scope.split(" "):e.scope:[],idToken:e.id_token}}async function E({id:e,options:o,authorizationEndpoint:r,state:t,codeVerifier:n,scopes:i,claims:s,redirectURI:a}){let d=new URL(r);if(d.searchParams.set("response_type","code"),d.searchParams.set("client_id",o.clientId),d.searchParams.set("state",t),d.searchParams.set("scope",i.join(" ")),d.searchParams.set("redirect_uri",o.redirectURI||a),n){let u=await $t(n);d.searchParams.set("code_challenge_method","S256"),d.searchParams.set("code_challenge",u)}if(s){let u=s.reduce((l,m)=>(l[m]=null,l),{});d.searchParams.set("claims",JSON.stringify({id_token:{email:null,email_verified:null,...u}}))}return d}var Ht=require("@better-fetch/fetch");async function O({code:e,codeVerifier:o,redirectURI:r,options:t,tokenEndpoint:n,authentication:i}){let s=new URLSearchParams,a={"content-type":"application/x-www-form-urlencoded",accept:"application/json","user-agent":"better-auth"};if(s.set("grant_type","authorization_code"),s.set("code",e),o&&s.set("code_verifier",o),s.set("redirect_uri",r),i==="basic"){let m=btoa(`${t.clientId}:${t.clientSecret}`);a.authorization=`Basic ${m}`}else s.set("client_id",t.clientId),s.set("client_secret",t.clientSecret);let{data:d,error:u}=await(0,Ht.betterFetch)(n,{method:"POST",body:s,headers:a});if(u)throw u;return Qt(d)}var et=require("oslo/oauth2"),te=require("zod"),wt=require("better-call");var pe={isAction:!1};var Wt=require("nanoid"),z=e=>(0,Wt.nanoid)(e);var Gt=require("consola"),fe=(0,Gt.createConsola)({formatOptions:{date:!1,colors:!0,compact:!0},defaults:{tag:"Better Auth"}}),Uo=e=>({log:(...o)=>{!e?.disabled&&fe.log("",...o)},error:(...o)=>{!e?.disabled&&fe.error("",...o)},warn:(...o)=>{!e?.disabled&&fe.warn("",...o)},info:(...o)=>{!e?.disabled&&fe.info("",...o)},debug:(...o)=>{!e?.disabled&&fe.debug("",...o)},box:(...o)=>{!e?.disabled&&fe.box("",...o)},success:(...o)=>{!e?.disabled&&fe.success("",...o)},break:(...o)=>{!e?.disabled&&console.log(`
2
+ `)}}),y=Uo();function Oe(e){try{return new URL(e).origin}catch{return null}}async function ve(e,o){let r=e.body?.callbackURL||(e.query?.currentURL?Oe(e.query?.currentURL):"")||e.context.options.baseURL;if(!r)throw new wt.APIError("BAD_REQUEST",{message:"callbackURL is required"});let t=(0,et.generateCodeVerifier)(),n=(0,et.generateState)(),i=JSON.stringify({callbackURL:r,codeVerifier:t,errorURL:e.query?.currentURL,link:o,expiresAt:Date.now()+10*60*1e3}),s=new Date;s.setMinutes(s.getMinutes()+10);let a=await e.context.internalAdapter.createVerificationValue({value:i,identifier:n,expiresAt:s});if(!a)throw y.error("Unable to create verification. Make sure the database adapter is properly working and there is a verification table in the database"),new wt.APIError("INTERNAL_SERVER_ERROR",{message:"Unable to create verification"});return{state:a.identifier,codeVerifier:t}}async function tt(e){let o=e.query.state,r=await e.context.internalAdapter.findVerificationValue(o);if(!r)throw y.error("State Mismatch. Verification not found",{state:o}),e.redirect(`${e.context.baseURL}/error?error=please_restart_the_process`);let t=te.z.object({callbackURL:te.z.string(),codeVerifier:te.z.string(),errorURL:te.z.string().optional(),expiresAt:te.z.number(),link:te.z.object({email:te.z.string(),userId:te.z.string()}).optional()}).parse(JSON.parse(r.value));if(t.errorURL||(t.errorURL=`${e.context.baseURL}/error`),t.expiresAt<Date.now())throw await e.context.internalAdapter.deleteVerificationValue(r.id),y.error("State expired.",{state:o}),e.redirect(`${e.context.baseURL}/error?error=please_restart_the_process`);return await e.context.internalAdapter.deleteVerificationValue(r.id),t}var Re=require("jose"),Kt=require("@better-fetch/fetch"),Zt=require("better-call"),_i=require("zod"),Yt=e=>{let o="https://appleid.apple.com/auth/token";return{id:"apple",name:"Apple",createAuthorizationURL({state:r,scopes:t,redirectURI:n}){let i=t||["email","name","openid"];return e.scope&&i.push(...e.scope),new URL(`https://appleid.apple.com/auth/authorize?client_id=${e.clientId}&response_type=code&redirect_uri=${n||e.redirectURI}&scope=${i.join(" ")}&state=${r}`)},validateAuthorizationCode:async({code:r,codeVerifier:t,redirectURI:n})=>O({code:r,codeVerifier:t,redirectURI:e.redirectURI||n,options:e,tokenEndpoint:o}),async verifyIdToken(r,t){if(e.disableIdTokenSignIn)return!1;if(e.verifyIdToken)return e.verifyIdToken(r,t);let n=(0,Re.decodeProtectedHeader)(r),{kid:i,alg:s}=n;if(!i||!s)return!1;let a=await Eo(i),{payload:d}=await(0,Re.jwtVerify)(r,a,{algorithms:[s],issuer:"https://appleid.apple.com",audience:e.clientId,maxTokenAge:"1h"});return["email_verified","is_private_email"].forEach(u=>{d[u]!==void 0&&(d[u]=!!d[u])}),t&&d.nonce!==t?!1:!!d},async getUserInfo(r){if(!r.idToken)return null;let t=(0,Jt.parseJWT)(r.idToken)?.payload;return t?{user:{id:t.sub,name:t.name,email:t.email,emailVerified:t.email_verified==="true",image:t.picture},data:t}:null}}},Eo=async e=>{let o="https://appleid.apple.com",r="/auth/keys",{data:t}=await(0,Kt.betterFetch)(`${o}${r}`);if(!t?.keys)throw new Zt.APIError("BAD_REQUEST",{message:"Keys not found"});let n=t.keys.find(i=>i.kid===e);if(!n)throw new Error(`JWK with kid ${e} not found`);return await(0,Re.importJWK)(n,n.alg)};var Xt=require("@better-fetch/fetch");var er=e=>({id:"discord",name:"Discord",createAuthorizationURL({state:o,scopes:r,redirectURI:t}){let n=r||["identify","email"];return e.scope&&n.push(...e.scope),new URL(`https://discord.com/api/oauth2/authorize?scope=${n.join("+")}&response_type=code&client_id=${e.clientId}&redirect_uri=${encodeURIComponent(e.redirectURI||t)}&state=${o}`)},validateAuthorizationCode:async({code:o,redirectURI:r})=>O({code:o,redirectURI:e.redirectURI||r,options:e,tokenEndpoint:"https://discord.com/api/oauth2/token"}),async getUserInfo(o){let{data:r,error:t}=await(0,Xt.betterFetch)("https://discord.com/api/users/@me",{headers:{authorization:`Bearer ${o.accessToken}`}});if(t)return null;if(r.avatar===null){let n=r.discriminator==="0"?Number(BigInt(r.id)>>BigInt(22))%6:parseInt(r.discriminator)%5;r.image_url=`https://cdn.discordapp.com/embed/avatars/${n}.png`}else{let n=r.avatar.startsWith("a_")?"gif":"png";r.image_url=`https://cdn.discordapp.com/avatars/${r.id}/${r.avatar}.${n}`}return{user:{id:r.id,name:r.display_name||r.username||"",email:r.email,emailVerified:r.verified,image:r.image_url},data:r}}});var tr=require("@better-fetch/fetch");var rr=e=>({id:"facebook",name:"Facebook",async createAuthorizationURL({state:o,scopes:r,redirectURI:t}){let n=r||["email","public_profile"];return e.scope&&n.push(...e.scope),await E({id:"facebook",options:e,authorizationEndpoint:"https://www.facebook.com/v21.0/dialog/oauth",scopes:n,state:o,redirectURI:t})},validateAuthorizationCode:async({code:o,redirectURI:r})=>O({code:o,redirectURI:e.redirectURI||r,options:e,tokenEndpoint:"https://graph.facebook.com/oauth/access_token"}),async getUserInfo(o){let{data:r,error:t}=await(0,tr.betterFetch)("https://graph.facebook.com/me?fields=id,name,email,picture",{auth:{type:"Bearer",token:o.accessToken}});return t?null:{user:{id:r.id,name:r.name,email:r.email,image:r.picture.data.url,emailVerified:r.email_verified},data:r}}});var yt=require("@better-fetch/fetch");var or=e=>{let o="https://github.com/login/oauth/access_token";return{id:"github",name:"GitHub",createAuthorizationURL({state:r,scopes:t,codeVerifier:n,redirectURI:i}){let s=t||["user:email"];return e.scope&&s.push(...e.scope),E({id:"github",options:e,authorizationEndpoint:"https://github.com/login/oauth/authorize",scopes:s,state:r,redirectURI:i})},validateAuthorizationCode:async({code:r,redirectURI:t})=>O({code:r,redirectURI:e.redirectURI||t,options:e,tokenEndpoint:o}),async getUserInfo(r){let{data:t,error:n}=await(0,yt.betterFetch)("https://api.github.com/user",{headers:{"User-Agent":"better-auth",authorization:`Bearer ${r.accessToken}`}});if(n)return null;let i=!1;if(!t.email){let{data:s,error:a}=await(0,yt.betterFetch)("https://api.github.com/user/emails",{headers:{authorization:`Bearer ${r.accessToken}`,"User-Agent":"better-auth"}});a||(t.email=(s.find(d=>d.primary)??s[0])?.email,i=s.find(d=>d.email===t.email)?.verified??!1)}return{user:{id:t.id.toString(),name:t.name||t.login,email:t.email,image:t.avatar_url,emailVerified:i},data:t}}}};var nr=require("oslo/jwt");var ir=require("@better-fetch/fetch"),sr=e=>({id:"google",name:"Google",async createAuthorizationURL({state:o,scopes:r,codeVerifier:t,redirectURI:n}){if(!e.clientId||!e.clientSecret)throw y.error("Client Id and Client Secret is required for Google. Make sure to provide them in the options."),new W("CLIENT_ID_AND_SECRET_REQUIRED");if(!t)throw new W("codeVerifier is required for Google");let i=r||["email","profile","openid"];e.scope&&i.push(...e.scope);let s=await E({id:"google",options:e,authorizationEndpoint:"https://accounts.google.com/o/oauth2/auth",scopes:i,state:o,codeVerifier:t,redirectURI:n});return e.accessType&&s.searchParams.set("access_type",e.accessType),e.prompt&&s.searchParams.set("prompt",e.prompt),s},validateAuthorizationCode:async({code:o,codeVerifier:r,redirectURI:t})=>O({code:o,codeVerifier:r,redirectURI:e.redirectURI||t,options:e,tokenEndpoint:"https://oauth2.googleapis.com/token"}),async verifyIdToken(o,r){if(e.disableIdTokenSignIn)return!1;if(e.verifyIdToken)return e.verifyIdToken(o,r);let t=`https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=${o}`,{data:n}=await(0,ir.betterFetch)(t);return n?n.aud===e.clientId&&n.iss==="https://accounts.google.com":!1},async getUserInfo(o){if(!o.idToken)return null;let r=(0,nr.parseJWT)(o.idToken)?.payload;return{user:{id:r.sub,name:r.name,email:r.email,image:r.picture,emailVerified:r.email_verified},data:r}}});var ar=require("@better-fetch/fetch"),dr=require("oslo/jwt");var ur=e=>{let o=e.tenantId||"common",r=`https://login.microsoftonline.com/${o}/oauth2/v2.0/authorize`,t=`https://login.microsoftonline.com/${o}/oauth2/v2.0/token`;return{id:"microsoft",name:"Microsoft EntraID",createAuthorizationURL(n){let i=n.scopes||["openid","profile","email","User.Read"];return e.scope&&i.push(...e.scope),E({id:"microsoft",options:e,authorizationEndpoint:r,state:n.state,codeVerifier:n.codeVerifier,scopes:i,redirectURI:n.redirectURI})},validateAuthorizationCode({code:n,codeVerifier:i,redirectURI:s}){return O({code:n,codeVerifier:i,redirectURI:e.redirectURI||s,options:e,tokenEndpoint:t})},async getUserInfo(n){if(!n.idToken)return null;let i=(0,dr.parseJWT)(n.idToken)?.payload,s=e.profilePhotoSize||48;return await(0,ar.betterFetch)(`https://graph.microsoft.com/v1.0/me/photos/${s}x${s}/$value`,{headers:{Authorization:`Bearer ${n.accessToken}`},async onResponse(a){if(!(e.disableProfilePhoto||!a.response.ok))try{let u=await a.response.clone().arrayBuffer(),l=Buffer.from(u).toString("base64");i.picture=`data:image/jpeg;base64, ${l}`}catch(d){y.error(d)}}}),{user:{id:i.sub,name:i.name,email:i.email,image:i.picture,emailVerified:!0},data:i}}}};var cr=require("@better-fetch/fetch");var lr=e=>({id:"spotify",name:"Spotify",createAuthorizationURL({state:o,scopes:r,codeVerifier:t,redirectURI:n}){let i=r||["user-read-email"];return e.scope&&i.push(...e.scope),E({id:"spotify",options:e,authorizationEndpoint:"https://accounts.spotify.com/authorize",scopes:i,state:o,codeVerifier:t,redirectURI:n})},validateAuthorizationCode:async({code:o,codeVerifier:r,redirectURI:t})=>O({code:o,codeVerifier:r,redirectURI:e.redirectURI||t,options:e,tokenEndpoint:"https://accounts.spotify.com/api/token"}),async getUserInfo(o){let{data:r,error:t}=await(0,cr.betterFetch)("https://api.spotify.com/v1/me",{method:"GET",headers:{Authorization:`Bearer ${o.accessToken}`}});return t?null:{user:{id:r.id,name:r.display_name,email:r.email,image:r.images[0]?.url,emailVerified:!1},data:r}}});var Ji=require("@better-fetch/fetch");var mr=require("oslo/jwt");var pr=e=>({id:"twitch",name:"Twitch",createAuthorizationURL({state:o,scopes:r,redirectURI:t}){let n=r||["user:read:email","openid"];return e.scope&&n.push(...e.scope),E({id:"twitch",redirectURI:t,options:e,authorizationEndpoint:"https://id.twitch.tv/oauth2/authorize",scopes:n,state:o,claims:e.claims||["email","email_verified","preferred_username","picture"]})},validateAuthorizationCode:async({code:o,redirectURI:r})=>O({code:o,redirectURI:e.redirectURI||r,options:e,tokenEndpoint:"https://id.twitch.tv/oauth2/token"}),async getUserInfo(o){let r=o.idToken;if(!r)return y.error("No idToken found in token"),null;let t=(0,mr.parseJWT)(r)?.payload;return{user:{id:t.sub,name:t.preferred_username,email:t.email,image:t.picture,emailVerified:!1},data:t}}});var fr=require("@better-fetch/fetch");var gr=e=>({id:"twitter",name:"Twitter",createAuthorizationURL(o){let r=o.scopes||["users.read","tweet.read","offline.access"];return e.scope&&r.push(...e.scope),E({id:"twitter",options:e,authorizationEndpoint:"https://x.com/i/oauth2/authorize",scopes:r,state:o.state,codeVerifier:o.codeVerifier,redirectURI:o.redirectURI})},validateAuthorizationCode:async({code:o,codeVerifier:r,redirectURI:t})=>O({code:o,codeVerifier:r,authentication:"basic",redirectURI:e.redirectURI||t,options:e,tokenEndpoint:"https://api.x.com/2/oauth2/token"}),async getUserInfo(o){let{data:r,error:t}=await(0,fr.betterFetch)("https://api.x.com/2/users/me?user.fields=profile_image_url",{method:"GET",headers:{Authorization:`Bearer ${o.accessToken}`}});return t?null:{user:{id:r.data.id,name:r.data.name,email:r.data.email||null,image:r.data.profile_image_url,emailVerified:r.data.verified||!1},data:r}}});var hr=require("@better-fetch/fetch");var wr=e=>{let o="https://api.dropboxapi.com/oauth2/token";return{id:"dropbox",name:"Dropbox",createAuthorizationURL:async({state:r,scopes:t,codeVerifier:n,redirectURI:i})=>{let s=t||["account_info.read"];return e.scope&&s.push(...e.scope),await E({id:"dropbox",options:e,authorizationEndpoint:"https://www.dropbox.com/oauth2/authorize",scopes:s,state:r,redirectURI:i,codeVerifier:n})},validateAuthorizationCode:async({code:r,codeVerifier:t,redirectURI:n})=>await O({code:r,codeVerifier:t,redirectURI:e.redirectURI||n,options:e,tokenEndpoint:o}),async getUserInfo(r){let{data:t,error:n}=await(0,hr.betterFetch)("https://api.dropboxapi.com/2/users/get_current_account",{method:"POST",headers:{Authorization:`Bearer ${r.accessToken}`}});return n?null:{user:{id:t.account_id,name:t.name?.display_name,email:t.email,emailVerified:t.email_verified||!1,image:t.profile_photo_url},data:t}}}};var yr=require("@better-fetch/fetch");var br=e=>{let o="https://www.linkedin.com/oauth/v2/authorization",r="https://www.linkedin.com/oauth/v2/accessToken";return{id:"linkedin",name:"Linkedin",createAuthorizationURL:async({state:t,scopes:n,redirectURI:i})=>{let s=n||["profile","email","openid"];return e.scope&&s.push(...e.scope),await E({id:"linkedin",options:e,authorizationEndpoint:o,scopes:s,state:t,redirectURI:i})},validateAuthorizationCode:async({code:t,redirectURI:n})=>await O({code:t,redirectURI:e.redirectURI||n,options:e,tokenEndpoint:r}),async getUserInfo(t){let{data:n,error:i}=await(0,yr.betterFetch)("https://api.linkedin.com/v2/userinfo",{method:"GET",headers:{Authorization:`Bearer ${t.accessToken}`}});return i?null:{user:{id:n.sub,name:n.name,email:n.email,emailVerified:n.email_verified||!1,image:n.picture},data:n}}}};var Ar=require("@better-fetch/fetch");var bt=(e="")=>e.split("://").map(o=>o.replace(/\/{2,}/g,"/")).join("://"),Io=e=>{let o=e||"https://gitlab.com";return{authorizationEndpoint:bt(`${o}/oauth/authorize`),tokenEndpoint:bt(`${o}/oauth/token`),userinfoEndpoint:bt(`${o}/api/v4/user`)}},kr=e=>{let{authorizationEndpoint:o,tokenEndpoint:r,userinfoEndpoint:t}=Io(e.issuer),n="gitlab";return{id:n,name:"Gitlab",createAuthorizationURL:async({state:s,scopes:a,codeVerifier:d,redirectURI:u})=>{let l=a||["read_user"];return e.scope&&l.push(...e.scope),await E({id:n,options:e,authorizationEndpoint:o,scopes:l,state:s,redirectURI:u,codeVerifier:d})},validateAuthorizationCode:async({code:s,redirectURI:a,codeVerifier:d})=>O({code:s,redirectURI:e.redirectURI||a,options:e,codeVerifier:d,tokenEndpoint:r}),async getUserInfo(s){let{data:a,error:d}=await(0,Ar.betterFetch)(t,{headers:{authorization:`Bearer ${s.accessToken}`}});return d||a.state!=="active"||a.locked?null:{user:{id:a.id.toString(),name:a.name??a.username,email:a.email,image:a.avatar_url,emailVerified:!0},data:a}}}};var To={apple:Yt,discord:er,facebook:rr,github:or,microsoft:ur,google:sr,spotify:lr,twitch:pr,twitter:gr,dropbox:wr,linkedin:br,gitlab:kr},rt=Object.keys(To);var Rr=require("oslo"),ot=require("oslo/jwt"),$=require("zod");var he=require("better-call");var ge=require("better-call");var Ue=require("zod");function Or(e){try{return JSON.parse(e)}catch{return null}}var vr=()=>c("/get-session",{method:"GET",query:Ue.z.optional(Ue.z.object({disableCookieCache:Ue.z.boolean().optional()})),requireHeaders:!0},async e=>{try{let o=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(!o)return e.json(null,{status:401});let r=e.getCookie(e.context.authCookies.sessionData.name),t=r?Or(Buffer.from(r,"base64").toString()):null;if(t&&!await Ze.verify({value:JSON.stringify(t.session),signature:t?.signature,secret:e.context.secret}))return J(e),e.json(null,{status:401});let n=await e.getSignedCookie(e.context.authCookies.dontRememberToken.name,e.context.secret);if(t?.session&&e.context.options.session?.cookieCache?.enabled&&!e.query?.disableCookieCache){let l=t.session;if(t.expiresAt<Date.now()||l.session.expiresAt<new Date){let f=e.context.authCookies.sessionData.name;e.setCookie(f,"",{maxAge:0})}else return e.json(l)}let i=await e.context.internalAdapter.findSession(o);if(!i||i.session.expiresAt<new Date)return J(e),i&&await e.context.internalAdapter.deleteSession(i.session.id),e.json(null,{status:401});if(n)return e.json(i);let s=e.context.sessionConfig.expiresIn,a=e.context.sessionConfig.updateAge;if(i.session.expiresAt.valueOf()-s*1e3+a*1e3<=Date.now()){let l=await e.context.internalAdapter.updateSession(i.session.id,{expiresAt:P(e.context.sessionConfig.expiresIn,"sec")});if(!l)return J(e),e.json(null,{status:401});let m=(l.expiresAt.valueOf()-Date.now())/1e3;return await w(e,{session:l,user:i.user},!1,{maxAge:m}),e.json({session:l,user:i.user})}return e.json(i)}catch(o){return e.context.logger.error(o),e.json(null,{status:500})}}),B=async e=>await vr()({...e,_flag:"json",headers:e.headers}),b=S(async e=>{let o=await B(e);if(!o?.session)throw new ge.APIError("UNAUTHORIZED");return{session:o}});var So=c("/revoke-session",{method:"POST",body:Ue.z.object({id:Ue.z.string()}),use:[b],requireHeaders:!0},async e=>{let o=e.body.id,r=await e.context.internalAdapter.findSession(o);if(!r)throw new ge.APIError("BAD_REQUEST",{message:"Session not found"});if(r.session.userId!==e.context.session.user.id)throw new ge.APIError("UNAUTHORIZED");try{await e.context.internalAdapter.deleteSession(o)}catch(t){throw e.context.logger.error(t),new ge.APIError("INTERNAL_SERVER_ERROR")}return e.json({status:!0})}),Po=c("/revoke-sessions",{method:"POST",use:[b],requireHeaders:!0},async e=>{try{await e.context.internalAdapter.deleteSessions(e.context.session.user.id)}catch(o){throw e.context.logger.error(o),new ge.APIError("INTERNAL_SERVER_ERROR")}return e.json({status:!0})}),_o=c("/revoke-other-sessions",{method:"POST",requireHeaders:!0,use:[b]},async e=>{let o=e.context.session;if(!o.user)throw new ge.APIError("UNAUTHORIZED");let n=(await e.context.internalAdapter.listSessions(o.user.id)).filter(i=>i.expiresAt>new Date).filter(i=>i.id!==e.context.session.session.id);return await Promise.all(n.map(i=>e.context.internalAdapter.deleteSession(i.id))),e.json({status:!0})});async function ie(e,o,r){return await(0,ot.createJWT)("HS256",Buffer.from(e),{email:o.toLowerCase(),updateTo:r},{expiresIn:new Rr.TimeSpan(1,"h"),issuer:"better-auth",subject:"verify-email",audiences:[o],includeIssuedTimestamp:!0})}var Co=c("/send-verification-email",{method:"POST",query:$.z.object({currentURL:$.z.string().optional()}).optional(),body:$.z.object({email:$.z.string().email(),callbackURL:$.z.string().optional()})},async e=>{if(!e.context.options.emailVerification?.sendVerificationEmail)throw e.context.logger.error("Verification email isn't enabled."),new he.APIError("BAD_REQUEST",{message:"Verification email isn't enabled"});let{email:o}=e.body,r=await e.context.internalAdapter.findUserByEmail(o);if(!r)throw new he.APIError("BAD_REQUEST",{message:"User not found"});let t=await ie(e.context.secret,o),n=`${e.context.baseURL}/verify-email?token=${t}&callbackURL=${e.body.callbackURL||e.query?.currentURL||"/"}`;return await e.context.options.emailVerification.sendVerificationEmail({user:r.user,url:n,token:t},e.request),e.json({status:!0})}),zo=c("/verify-email",{method:"GET",query:$.z.object({token:$.z.string(),callbackURL:$.z.string().optional()})},async e=>{let{token:o}=e.query,r;try{r=await(0,ot.validateJWT)("HS256",Buffer.from(e.context.secret),o)}catch(s){throw e.context.logger.error("Failed to verify email",s),new he.APIError("BAD_REQUEST",{message:"Invalid token"})}let n=$.z.object({email:$.z.string().email(),updateTo:$.z.string().optional()}).parse(r.payload);if(!await e.context.internalAdapter.findUserByEmail(n.email))throw new he.APIError("BAD_REQUEST",{message:"User not found"});if(n.updateTo){let s=await B(e);if(!s)throw e.query.callbackURL?e.redirect(`${e.query.callbackURL}?error=unauthorized`):new he.APIError("UNAUTHORIZED",{message:"Session not found"});if(s.user.email!==n.email)throw e.query.callbackURL?e.redirect(`${e.query.callbackURL}?error=unauthorized`):new he.APIError("UNAUTHORIZED",{message:"Invalid session"});let a=await e.context.internalAdapter.updateUserByEmail(n.email,{email:n.updateTo});if(await e.context.options.emailVerification?.sendVerificationEmail?.({user:a,url:`${e.context.baseURL}/verify-email?token=${o}`,token:o},e.request),e.query.callbackURL)throw e.redirect(e.query.callbackURL);return e.json({user:a,status:!0})}if(await e.context.internalAdapter.updateUserByEmail(n.email,{emailVerified:!0}),e.query.callbackURL)throw e.redirect(e.query.callbackURL);return e.json({user:null,status:!0})});var At=require("better-call");var Ur=require("better-call");var Bo=S(async e=>{if(e.request?.method!=="POST")return;let{body:o,query:r,context:t}=e,n=e.headers?.get("origin")||e.headers?.get("referer")||"",i=o?.callbackURL||r?.callbackURL,s=o?.redirectTo,a=r?.currentURL,d=t.trustedOrigins,u=e.headers?.has("cookie"),l=(f,p)=>p.includes("*")?new RegExp("^"+p.replace(/\*/g,"[^/]+").replace(/\./g,"\\.")+"$").test(f):f.startsWith(p),m=(f,p)=>{if(!f)return;if(!d.some(k=>l(f,k)||f?.startsWith("/")&&p!=="origin"&&!f.includes(":")))throw y.error(`Invalid ${p}: ${f}`),y.info(`If it's a valid URL, please add ${f} to trustedOrigins in your auth config
3
3
  `,`Current list of trustedOrigins: ${d}`),new Ur.APIError("FORBIDDEN",{message:`Invalid ${p}`})};u&&!e.context.options.advanced?.disableCSRFCheck&&m(n,"origin"),i&&m(i,"callbackURL"),s&&m(s,"redirectURL"),a&&m(a,"currentURL")});var xo=c("/ok",{method:"GET",metadata:pe},async e=>e.json({ok:!0}));var Do=require("zod");var jo=require("better-call");var A=require("zod"),Js=A.z.object({id:A.z.string(),providerId:A.z.string(),accountId:A.z.string(),userId:A.z.string(),accessToken:A.z.string().nullish(),refreshToken:A.z.string().nullish(),idToken:A.z.string().nullish(),expiresAt:A.z.date().nullish(),password:A.z.string().nullish()}),Er=A.z.object({id:A.z.string(),email:A.z.string().transform(e=>e.toLowerCase()),emailVerified:A.z.boolean().default(!1),name:A.z.string(),image:A.z.string().nullish(),createdAt:A.z.date().default(new Date),updatedAt:A.z.date().default(new Date)}),Ks=A.z.object({id:A.z.string(),userId:A.z.string(),expiresAt:A.z.date(),ipAddress:A.z.string().nullish(),userAgent:A.z.string().nullish()}),Zs=A.z.object({id:A.z.string(),value:A.z.string(),expiresAt:A.z.date(),identifier:A.z.string()});var No=(e="Unknown")=>`<!DOCTYPE html>
4
4
  <html lang="en">
5
5
  <head>
@@ -81,4 +81,4 @@
81
81
  </div>
82
82
  </body>
83
83
  </html>`,Vo=c("/error",{method:"GET",metadata:pe},async e=>{let o=new URL(e.request?.url||"").searchParams.get("error")||"Unknown";return new Response(No(o),{headers:{"Content-Type":"text/html"}})});var v=require("better-call");async function Ee(e,{userInfo:o,account:r,callbackURL:t}){let n=await e.context.internalAdapter.findUserByEmail(o.email.toLowerCase(),{includeAccounts:!0}).catch(a=>{throw y.error(`Better auth was unable to query your database.
84
- Error: `,a),e.redirect(`${e.context.baseURL}/error?error=internal_server_error`)}),i=n?.user;if(n){let a=n.accounts.find(d=>d.providerId===r.providerId);if(a)await e.context.internalAdapter.updateAccount(a.id,{accessToken:r.accessToken,idToken:r.idToken,refreshToken:r.refreshToken,expiresAt:r.expiresAt});else{if(!e.context.options.account?.accountLinking?.trustedProviders?.includes(r.providerId)&&!o.emailVerified||e.context.options.account?.accountLinking?.enabled===!1)return Vt&&y.warn(`User already exist but account isn't linked to ${r.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`),{error:"account not linked",data:null};try{await e.context.internalAdapter.linkAccount({providerId:r.providerId,accountId:o.id.toString(),id:e.context.uuid(),userId:n.user.id,accessToken:r.accessToken,idToken:r.idToken,refreshToken:r.refreshToken,expiresAt:r.expiresAt})}catch(l){return y.error("Unable to link account",l),{error:"unable to link account",data:null}}}}else try{let a=o.emailVerified||!1;if(i=await e.context.internalAdapter.createOAuthUser({...o,id:e.context.uuid(),emailVerified:a,email:o.email.toLowerCase()},{accessToken:r.accessToken,idToken:r.idToken,refreshToken:r.refreshToken,expiresAt:r.expiresAt,providerId:r.providerId,accountId:o.id.toString()}).then(d=>d?.user),!a&&i&&e.context.options.emailVerification?.sendOnSignUp){let d=await ie(e.context.secret,i.email),u=`${e.context.baseURL}/verify-email?token=${d}&callbackURL=${t}`;await e.context.options.emailVerification?.sendVerificationEmail?.({user:i,url:u,token:d},e.request)}}catch(a){return y.error("Unable to create user",a),{error:"unable to create user",data:null}}if(!i)return{error:"unable to create user",data:null};let s=await e.context.internalAdapter.createSession(i.id,e.request);return s?{data:{session:s,user:i},error:null}:{error:"unable to create session",data:null}}var Fo=c("/sign-in/social",{method:"POST",query:_.z.object({currentURL:_.z.string().optional()}).optional(),body:_.z.object({callbackURL:_.z.string().optional(),provider:_.z.enum(rt),idToken:_.z.optional(_.z.object({token:_.z.string(),nonce:_.z.string().optional(),accessToken:_.z.string().optional(),refreshToken:_.z.string().optional(),expiresAt:_.z.number().optional()}))})},async e=>{let o=e.context.socialProviders.find(i=>i.id===e.body.provider);if(!o)throw e.context.logger.error("Provider not found. Make sure to add the provider in your auth config",{provider:e.body.provider}),new L.APIError("NOT_FOUND",{message:"Provider not found"});if(e.body.idToken){if(!o.verifyIdToken)throw e.context.logger.error("Provider does not support id token verification",{provider:e.body.provider}),new L.APIError("NOT_FOUND",{message:"Provider does not support id token verification"});let{token:i,nonce:s}=e.body.idToken;if(!await o.verifyIdToken(i,s))throw e.context.logger.error("Invalid id token",{provider:e.body.provider}),new L.APIError("UNAUTHORIZED",{message:"Invalid id token"});let d=await o.getUserInfo({idToken:i,accessToken:e.body.idToken.accessToken,refreshToken:e.body.idToken.refreshToken});if(!d||!d?.user)throw e.context.logger.error("Failed to get user info",{provider:e.body.provider}),new L.APIError("UNAUTHORIZED",{message:"Failed to get user info"});if(!d.user.email)throw e.context.logger.error("User email not found",{provider:e.body.provider}),new L.APIError("UNAUTHORIZED",{message:"User email not found"});let u=await Ee(e,{userInfo:{email:d.user.email,id:d.user.id,name:d.user.name||"",image:d.user.image,emailVerified:d.user.emailVerified||!1},account:{providerId:o.id,accountId:d.user.id,accessToken:e.body.idToken.accessToken}});if(u.error)throw new L.APIError("UNAUTHORIZED",{message:u.error});return await w(e,u.data),e.json({session:u.data.session,user:u.data.user,url:`${e.body.callbackURL||e.query?.currentURL||e.context.options.baseURL}`,redirect:!0})}let{codeVerifier:r,state:t}=await ve(e),n=await o.createAuthorizationURL({state:t,codeVerifier:r,redirectURI:`${e.context.baseURL}/callback/${o.id}`});return e.json({url:n.toString(),redirect:!0})}),qo=c("/sign-in/email",{method:"POST",body:_.z.object({email:_.z.string(),password:_.z.string(),callbackURL:_.z.string().optional(),rememberMe:_.z.boolean().default(!1).optional()})},async e=>{if(!e.context.options?.emailAndPassword?.enabled)throw e.context.logger.error("Email and password is not enabled. Make sure to enable it in the options on you `auth.ts` file. Check `https://better-auth.com/docs/authentication/email-password` for more!"),new L.APIError("BAD_REQUEST",{message:"Email and password is not enabled"});let{email:o,password:r}=e.body;if(!_.z.string().email().safeParse(o).success)throw new L.APIError("BAD_REQUEST",{message:"Invalid email"});let n=await e.context.internalAdapter.findUserByEmail(o,{includeAccounts:!0});if(!n)throw await e.context.password.hash(r),e.context.logger.error("User not found",{email:o}),new L.APIError("UNAUTHORIZED",{message:"Invalid email or password"});let i=n.accounts.find(u=>u.providerId==="credential");if(!i)throw e.context.logger.error("Credential account not found",{email:o}),new L.APIError("UNAUTHORIZED",{message:"Invalid email or password"});let s=i?.password;if(!s)throw e.context.logger.error("Password not found",{email:o}),new L.APIError("UNAUTHORIZED",{message:"Unexpected error"});if(!await e.context.password.verify(s,r))throw e.context.logger.error("Invalid password"),new L.APIError("UNAUTHORIZED",{message:"Invalid email or password"});if(e.context.options?.emailAndPassword?.requireEmailVerification&&!n.user.emailVerified){if(!e.context.options?.emailVerification?.sendVerificationEmail)throw y.error("Email verification is required but no email verification handler is provided"),new L.APIError("INTERNAL_SERVER_ERROR",{message:"Email is not verified."});let u=await ie(e.context.secret,n.user.email),l=`${e.context.baseURL}/verify-email?token=${u}`;throw await e.context.options.emailVerification.sendVerificationEmail({user:n.user,url:l,token:u},e.request),e.context.logger.error("Email not verified",{email:o}),new L.APIError("FORBIDDEN",{message:"Email is not verified. Check your email for a verification link"})}let d=await e.context.internalAdapter.createSession(n.user.id,e.headers,e.body.rememberMe===!1);if(!d)throw e.context.logger.error("Failed to create session"),new L.APIError("UNAUTHORIZED",{message:"Failed to create session"});return await w(e,{session:d,user:n.user},e.body.rememberMe===!1),e.json({user:n.user,session:d,redirect:!!e.body.callbackURL,url:e.body.callbackURL})});var je=require("zod");var Mo=c("/callback/:id",{method:["GET","POST"],query:je.z.object({state:je.z.string(),code:je.z.string().optional(),error:je.z.string().optional()}),metadata:pe},async e=>{if(!e.query.code)throw e.redirect(`${e.context.baseURL}/error?error=${e.query.error||"no_code"}`);let o=e.context.socialProviders.find(k=>k.id===e.params.id);if(!o)throw e.context.logger.error("Oauth provider with id",e.params.id,"not found"),e.redirect(`${e.context.baseURL}/error?error=oauth_provider_not_found`);let{codeVerifier:r,callbackURL:t,link:n,errorURL:i}=await tt(e),s;try{s=await o.validateAuthorizationCode({code:e.query.code,codeVerifier:r,redirectURI:`${e.context.baseURL}/callback/${o.id}`})}catch(k){throw e.context.logger.error(k),e.redirect(`${e.context.baseURL}/error?error=please_restart_the_process`)}let a=await o.getUserInfo(s).then(k=>k?.user),u={id:z(),...a};function l(k){let U=i||t||`${e.context.baseURL}/error`;throw U.includes("?")?U=`${U}&error=${k}`:U=`${U}?error=${k}`,e.redirect(U)}if(!a)return y.error("Unable to get user info"),l("unable_to_get_user_info");if(!u.email)return e.context.logger.error("Provider did not return email. This could be due to misconfiguration in the provider settings."),l("email_not_found");if(!t)throw y.error("No callback URL found"),e.redirect(`${e.context.baseURL}/error?error=please_restart_the_process`);if(n){if(n.email!==u.email.toLowerCase())return l("email_doesn't_match");if(!await e.context.internalAdapter.createAccount({userId:n.userId,providerId:o.id,accountId:a.id}))return l("unable_to_link_account");let U;try{U=new URL(t).toString()}catch{U=t}throw e.redirect(U)}let m=await Ee(e,{userInfo:{email:u.email,id:u.id,name:u.name||"",image:u.image,emailVerified:u.emailVerified||!1},account:{providerId:o.id,accountId:a.id,accessToken:s.accessToken,refreshToken:s.refreshToken,expiresAt:s.accessTokenExpiresAt},callbackURL:t});if(m.error)return l(m.error.split(" ").join("_"));let{session:f,user:p}=m.data;await w(e,{session:f,user:p});let h;try{h=new URL(t).toString()}catch{h=t}throw e.redirect(h)});var rd=require("zod");var Ir=require("better-call"),$o=c("/sign-out",{method:"POST",requireHeaders:!0},async e=>{let o=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(!o)throw new Ir.APIError("BAD_REQUEST",{message:"Session not found"});return await e.context.internalAdapter.deleteSession(o),J(e),e.json({success:!0})});var Q=require("zod");var Ne=require("better-call");function Tr(e,o,r){let t=o?new URL(o,e.baseURL):new URL(`${e.baseURL}/error`);return r&&Object.entries(r).forEach(([n,i])=>t.searchParams.set(n,i)),t.href}function en(e,o,r){let t=new URL(o,e.baseURL);return r&&Object.entries(r).forEach(([n,i])=>t.searchParams.set(n,i)),t.href}var Qo=c("/forget-password",{method:"POST",body:Q.z.object({email:Q.z.string().email(),redirectTo:Q.z.string()})},async e=>{if(!e.context.options.emailAndPassword?.sendResetPassword)throw e.context.logger.error("Reset password isn't enabled.Please pass an emailAndPassword.sendResetPasswordToken function in your auth config!"),new Ne.APIError("BAD_REQUEST",{message:"Reset password isn't enabled"});let{email:o,redirectTo:r}=e.body,t=await e.context.internalAdapter.findUserByEmail(o,{includeAccounts:!0});if(!t)return e.context.logger.error("Reset Password: User not found",{email:o}),e.json({status:!1},{body:{status:!0}});let n=60*60*1,i=new Date(Date.now()+1e3*(e.context.options.emailAndPassword.resetPasswordTokenExpiresIn||n)),s=e.context.uuid();await e.context.internalAdapter.createVerificationValue({value:t.user.id,identifier:`reset-password:${s}`,expiresAt:i});let a=`${e.context.baseURL}/reset-password/${s}?callbackURL=${r}`;return await e.context.options.emailAndPassword.sendResetPassword({user:t.user,url:a},e.request),e.json({status:!0})}),Ho=c("/reset-password/:token",{method:"GET",query:Q.z.object({callbackURL:Q.z.string()})},async e=>{let{token:o}=e.params,{callbackURL:r}=e.query;if(!o||!r)throw e.redirect(Tr(e.context,r,{error:"INVALID_TOKEN"}));let t=await e.context.internalAdapter.findVerificationValue(`reset-password:${o}`);throw!t||t.expiresAt<new Date?e.redirect(Tr(e.context,r,{error:"INVALID_TOKEN"})):e.redirect(en(e.context,r,{token:o}))}),Wo=c("/reset-password",{query:Q.z.optional(Q.z.object({token:Q.z.string().optional(),currentURL:Q.z.string().optional()})),method:"POST",body:Q.z.object({newPassword:Q.z.string()})},async e=>{let o=e.query?.token||(e.query?.currentURL?new URL(e.query.currentURL).searchParams.get("token"):"");if(!o)throw new Ne.APIError("BAD_REQUEST",{message:"Token not found"});let{newPassword:r}=e.body,t=`reset-password:${o}`,n=await e.context.internalAdapter.findVerificationValue(t);if(!n||n.expiresAt<new Date)throw new Ne.APIError("BAD_REQUEST",{message:"Invalid token"});await e.context.internalAdapter.deleteVerificationValue(n.id);let i=n.value,s=await e.context.password.hash(r);if(!(await e.context.internalAdapter.findAccounts(i)).find(l=>l.providerId==="credential"))return await e.context.internalAdapter.createAccount({userId:i,providerId:"credential",password:s,accountId:e.context.uuid()}),e.json({status:!0});if(!await e.context.internalAdapter.updatePassword(i,s))throw new Ne.APIError("BAD_REQUEST",{message:"Failed to update password"});return e.json({status:!0})});var V=require("zod");var j=require("better-call");var Go=c("/change-password",{method:"POST",body:V.z.object({newPassword:V.z.string(),currentPassword:V.z.string(),revokeOtherSessions:V.z.boolean().optional()}),use:[b]},async e=>{let{newPassword:o,currentPassword:r,revokeOtherSessions:t}=e.body,n=e.context.session,i=e.context.password.config.minPasswordLength;if(o.length<i)throw e.context.logger.error("Password is too short"),new j.APIError("BAD_REQUEST",{message:"Password is too short"});let s=e.context.password.config.maxPasswordLength;if(o.length>s)throw e.context.logger.error("Password is too long"),new j.APIError("BAD_REQUEST",{message:"Password too long"});let d=(await e.context.internalAdapter.findAccounts(n.user.id)).find(m=>m.providerId==="credential"&&m.password);if(!d||!d.password)throw new j.APIError("BAD_REQUEST",{message:"User does not have a password"});let u=await e.context.password.hash(o);if(!await e.context.password.verify(d.password,r))throw new j.APIError("BAD_REQUEST",{message:"Incorrect password"});if(await e.context.internalAdapter.updateAccount(d.id,{password:u}),t){await e.context.internalAdapter.deleteSessions(n.user.id);let m=await e.context.internalAdapter.createSession(n.user.id,e.headers);if(!m)throw new j.APIError("INTERNAL_SERVER_ERROR",{message:"Unable to create session"});await w(e,{session:m,user:n.user})}return e.json(n.user)}),Jo=c("/set-password",{method:"POST",body:V.z.object({newPassword:V.z.string()}),metadata:{SERVER_ONLY:!0},use:[b]},async e=>{let{newPassword:o}=e.body,r=e.context.session,t=e.context.password.config.minPasswordLength;if(o.length<t)throw e.context.logger.error("Password is too short"),new j.APIError("BAD_REQUEST",{message:"Password is too short"});let n=e.context.password.config.maxPasswordLength;if(o.length>n)throw e.context.logger.error("Password is too long"),new j.APIError("BAD_REQUEST",{message:"Password too long"});let s=(await e.context.internalAdapter.findAccounts(r.user.id)).find(d=>d.providerId==="credential"&&d.password),a=await e.context.password.hash(o);if(!s)return await e.context.internalAdapter.linkAccount({userId:r.user.id,providerId:"credential",accountId:r.user.id,password:a}),e.json(r.user);throw new j.APIError("BAD_REQUEST",{message:"user already has a password"})}),Ko=c("/delete-user",{method:"POST",body:V.z.object({password:V.z.string()}),use:[b]},async e=>{let{password:o}=e.body,r=e.context.session,n=(await e.context.internalAdapter.findAccounts(r.user.id)).find(s=>s.providerId==="credential"&&s.password);if(!n||!n.password)throw new j.APIError("BAD_REQUEST",{message:"User does not have a password"});if(!await e.context.password.verify(n.password,o))throw new j.APIError("BAD_REQUEST",{message:"Incorrect password"});return await e.context.internalAdapter.deleteUser(r.user.id),await e.context.internalAdapter.deleteSessions(r.user.id),J(e),e.json(null)}),Zo=c("/change-email",{method:"POST",query:V.z.object({currentURL:V.z.string().optional()}).optional(),body:V.z.object({newEmail:V.z.string().email(),callbackURL:V.z.string().optional()}),use:[b]},async e=>{if(!e.context.options.user?.changeEmail?.enabled)throw e.context.logger.error("Change email is disabled."),new j.APIError("BAD_REQUEST",{message:"Change email is disabled"});if(e.body.newEmail===e.context.session.user.email)throw e.context.logger.error("Email is the same"),new j.APIError("BAD_REQUEST",{message:"Email is the same"});if(await e.context.internalAdapter.findUserByEmail(e.body.newEmail))throw e.context.logger.error("Email already exists"),new j.APIError("BAD_REQUEST",{message:"Couldn't update your email"});if(e.context.session.user.emailVerified!==!0){let n=await e.context.internalAdapter.updateUserByEmail(e.context.session.user.email,{email:e.body.newEmail});return e.json({user:n,status:!0})}if(!e.context.options.user.changeEmail.sendChangeEmailVerification)throw e.context.logger.error("Verification email isn't enabled."),new j.APIError("BAD_REQUEST",{message:"Verification email isn't enabled"});let r=await ie(e.context.secret,e.context.session.user.email,e.body.newEmail),t=`${e.context.baseURL}/verify-email?token=${r}&callbackURL=${e.body.callbackURL||e.query?.currentURL||"/"}`;return await e.context.options.user.changeEmail.sendChangeEmailVerification({user:e.context.session.user,newEmail:e.body.newEmail,url:t,token:r},e.request),e.json({user:null,status:!0})});var Ie=require("zod");var kt=require("better-call");var Yo=c("/list-accounts",{method:"GET",use:[b]},async e=>{let o=e.context.session,r=await e.context.internalAdapter.findAccounts(o.user.id);return e.json(r.map(t=>({id:t.id,provider:t.providerId})))}),Xo=c("/link-social",{method:"POST",requireHeaders:!0,query:Ie.z.object({currentURL:Ie.z.string().optional()}).optional(),body:Ie.z.object({callbackURL:Ie.z.string().optional(),provider:Ie.z.enum(rt)}),use:[b]},async e=>{let o=e.context.session;if((await e.context.internalAdapter.findAccounts(o.user.id)).find(a=>a.providerId===e.body.provider))throw new kt.APIError("BAD_REQUEST",{message:"Social Account is already linked."});let n=e.context.socialProviders.find(a=>a.id===e.body.provider);if(!n)throw e.context.logger.error("Provider not found. Make sure to add the provider in your auth config",{provider:e.body.provider}),new kt.APIError("NOT_FOUND",{message:"Provider not found"});let i=await ve(e,{userId:o.user.id,email:o.user.email}),s=await n.createAuthorizationURL({state:i.state,codeVerifier:i.codeVerifier,redirectURI:`${e.context.baseURL}/callback/${n.id}`});return e.json({url:s.toString(),redirect:!0})});var Sr=(e,o)=>{let r={};for(let[t,n]of Object.entries(e))r[t]=i=>n({...i,context:{...o,...i.context}}),r[t].path=n.path,r[t].method=n.method,r[t].options=n.options,r[t].headers=n.headers;return r};var Te=class extends Error{path;constructor(o,r){super(o),this.path=r}},nt=class{constructor(o){this.s=o;this.statements=o}statements;newRole(o){return new it(o)}},it=class e{statements;constructor(o){this.statements=o}authorize(o,r){for(let[t,n]of Object.entries(o)){let i=this.statements[t];if(!i)return{success:!1,error:`You are not allowed to access resource: ${t}`};let s=r==="OR"?n.some(a=>i.includes(a)):n.every(a=>i.includes(a));return s?{success:s}:{success:!1,error:`unauthorized to access resource "${t}"`}}return{success:!1,error:"Not authorized"}}static fromString(o){let r=JSON.parse(o);if(typeof r!="object")throw new Te("statements is not an object",".");for(let[t,n]of Object.entries(r)){if(typeof t!="string")throw new Te("invalid resource identifier",t);if(!Array.isArray(n))throw new Te("actions is not an array",t);for(let i=0;i<n.length;i++)if(typeof n[i]!="string")throw new Te("action is not a string",`${t}[${i}]`)}return new e(r)}toString(){return JSON.stringify(this.statements)}};var tn=e=>new nt(e),rn={organization:["update","delete"],member:["create","update","delete"],invitation:["create","cancel"]},Ot=tn(rn),on=Ot.newRole({organization:["update"],invitation:["create","cancel"],member:["create","update","delete"]}),nn=Ot.newRole({organization:["update","delete"],member:["create","update","delete"],invitation:["create","cancel"]}),sn=Ot.newRole({organization:[],member:[],invitation:[]}),Pr={admin:on,owner:nn,member:sn};var C=(e,o)=>{let r=e.adapter;return{findOrganizationBySlug:async t=>await r.findOne({model:"organization",where:[{field:"slug",value:t}]}),createOrganization:async t=>{let n=await r.create({model:"organization",data:{...t.organization,metadata:t.organization.metadata?JSON.stringify(t.organization.metadata):void 0}}),i=await r.create({model:"member",data:{id:z(),organizationId:n.id,userId:t.user.id,createdAt:new Date,role:o?.creatorRole||"owner"}});return{...n,metadata:n.metadata?JSON.parse(n.metadata):void 0,members:[{...i,user:{id:t.user.id,name:t.user.name,email:t.user.email,image:t.user.image}}]}},findMemberByEmail:async t=>{let n=await r.findOne({model:e.tables.user.tableName,where:[{field:"email",value:t.email}]});if(!n)return null;let i=await r.findOne({model:"member",where:[{field:"organizationId",value:t.organizationId},{field:"userId",value:n.id}]});return i?{...i,user:{id:n.id,name:n.name,email:n.email,image:n.image}}:null},findMemberByOrgId:async t=>{let[n,i]=await Promise.all([await r.findOne({model:"member",where:[{field:"userId",value:t.userId},{field:"organizationId",value:t.organizationId}]}),await r.findOne({model:e.tables.user.tableName,where:[{field:"id",value:t.userId}]})]);return!i||!n?null:{...n,user:{id:i.id,name:i.name,email:i.email,image:i.image}}},findMemberById:async t=>{let n=await r.findOne({model:"member",where:[{field:"id",value:t}]});if(!n)return null;let i=await r.findOne({model:e.tables.user.tableName,where:[{field:"id",value:n.userId}]});return i?{...n,user:{id:i.id,name:i.name,email:i.email,image:i.image}}:null},createMember:async t=>await r.create({model:"member",data:t}),updateMember:async(t,n)=>await r.update({model:"member",where:[{field:"id",value:t}],update:{role:n}}),deleteMember:async t=>await r.delete({model:"member",where:[{field:"id",value:t}]}),updateOrganization:async(t,n)=>await r.update({model:"organization",where:[{field:"id",value:t}],update:n}),deleteOrganization:async t=>(await r.delete({model:"member",where:[{field:"organizationId",value:t}]}),await r.delete({model:"invitation",where:[{field:"organizationId",value:t}]}),await r.delete({model:"organization",where:[{field:"id",value:t}]}),t),setActiveOrganization:async(t,n)=>await r.update({model:e.tables.session.tableName,where:[{field:"id",value:t}],update:{activeOrganizationId:n}}),findOrganizationById:async t=>await r.findOne({model:"organization",where:[{field:"id",value:t}]}),findFullOrganization:async(t,n)=>{let[i,s,a]=await Promise.all([r.findOne({model:"organization",where:[{field:"id",value:t}]}),r.findMany({model:"invitation",where:[{field:"organizationId",value:t}]}),r.findMany({model:"member",where:[{field:"organizationId",value:t}]})]);if(!i)return null;let d=a.map(f=>f.userId),u=await r.findMany({model:e.tables.user.tableName,where:[{field:"id",value:d,operator:"in"}]}),l=new Map(u.map(f=>[f.id,f])),m=a.map(f=>{let p=l.get(f.userId);if(!p)throw new W("Unexpected error: User not found for member");return{...f,user:{id:p.id,name:p.name,email:p.email,image:p.image}}});return{...i,invitations:s,members:m}},listOrganizations:async t=>{let n=await r.findMany({model:"member",where:[{field:"userId",value:t}]});if(!n||n.length===0)return[];let i=n.map(a=>a.organizationId);return await r.findMany({model:"organization",where:[{field:"id",value:i,operator:"in"}]})},createInvitation:async({invitation:t,user:n})=>{let s=P(o?.invitationExpiresIn||1728e5);return await r.create({model:"invitation",data:{id:z(),email:t.email,role:t.role,organizationId:t.organizationId,status:"pending",expiresAt:s,inviterId:n.id}})},findInvitationById:async t=>await r.findOne({model:"invitation",where:[{field:"id",value:t}]}),findPendingInvitation:async t=>(await r.findMany({model:"invitation",where:[{field:"email",value:t.email},{field:"organizationId",value:t.organizationId},{field:"status",value:"pending"}]})).filter(i=>new Date(i.expiresAt)>new Date),updateInvitation:async t=>await r.update({model:"invitation",where:[{field:"id",value:t.invitationId}],update:{status:t.status}})}};var Kd=require("better-call");var x=S(async e=>({})),D=S({use:[b]},async e=>({session:e.context.session}));var F=require("zod");var R=require("zod"),st=R.z.enum(["admin","member","owner"]),an=R.z.enum(["pending","accepted","rejected","canceled"]).default("pending"),eu=R.z.object({id:R.z.string(),name:R.z.string(),slug:R.z.string(),logo:R.z.string().optional(),metadata:R.z.record(R.z.string()).or(R.z.string().transform(e=>JSON.parse(e))).optional(),createdAt:R.z.date()}),tu=R.z.object({id:R.z.string(),organizationId:R.z.string(),userId:R.z.string(),role:st,createdAt:R.z.date()}),ru=R.z.object({id:R.z.string(),organizationId:R.z.string(),email:R.z.string(),role:st,status:an,inviterId:R.z.string(),expiresAt:R.z.date()});var I=require("better-call"),_r=c("/organization/invite-member",{method:"POST",use:[x,D],body:F.z.object({email:F.z.string(),role:st,organizationId:F.z.string().optional(),resend:F.z.boolean().optional()})},async e=>{if(!e.context.orgOptions.sendInvitationEmail)throw y.warn("Invitation email is not enabled. Pass `sendInvitationEmail` to the plugin options to enable it."),new I.APIError("BAD_REQUEST",{message:"Invitation email is not enabled"});let o=e.context.session,r=e.body.organizationId||o.session.activeOrganizationId;if(!r)throw new I.APIError("BAD_REQUEST",{message:"Organization not found"});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)throw new I.APIError("BAD_REQUEST",{message:"Member not found!"});let i=e.context.roles[n.role];if(!i)throw new I.APIError("BAD_REQUEST",{message:"Role not found!"});if(i.authorize({invitation:["create"]}).error)throw new I.APIError("FORBIDDEN",{message:"You are not allowed to invite members"});if(await t.findMemberByEmail({email:e.body.email,organizationId:r}))throw new I.APIError("BAD_REQUEST",{message:"User is already a member of this organization"});if((await t.findPendingInvitation({email:e.body.email,organizationId:r})).length&&!e.body.resend)throw new I.APIError("BAD_REQUEST",{message:"User is already invited to this organization"});let u=await t.createInvitation({invitation:{role:e.body.role,email:e.body.email,organizationId:r},user:o.user}),l=await t.findOrganizationById(r);if(!l)throw new I.APIError("BAD_REQUEST",{message:"Organization not found"});return await e.context.orgOptions.sendInvitationEmail?.({id:u.id,role:u.role,email:u.email,organization:l,inviter:{...n,user:o.user}},e.request),e.json(u)}),Cr=c("/organization/accept-invitation",{method:"POST",body:F.z.object({invitationId:F.z.string()}),use:[x,D]},async e=>{let o=e.context.session,r=C(e.context,e.context.orgOptions),t=await r.findInvitationById(e.body.invitationId);if(!t||t.expiresAt<new Date||t.status!=="pending")throw new I.APIError("BAD_REQUEST",{message:"Invitation not found!"});if(t.email!==o.user.email)throw new I.APIError("FORBIDDEN",{message:"You are not the recipient of the invitation"});let n=await r.updateInvitation({invitationId:e.body.invitationId,status:"accepted"}),i=await r.createMember({id:z(),organizationId:t.organizationId,userId:o.user.id,role:t.role,createdAt:new Date});return await r.setActiveOrganization(o.session.id,t.organizationId),n?e.json({invitation:n,member:i}):e.json(null,{status:400,body:{message:"Invitation not found!"}})}),zr=c("/organization/reject-invitation",{method:"POST",body:F.z.object({invitationId:F.z.string()}),use:[x,D]},async e=>{let o=e.context.session,r=C(e.context,e.context.orgOptions),t=await r.findInvitationById(e.body.invitationId);if(!t||t.expiresAt<new Date||t.status!=="pending")throw new I.APIError("BAD_REQUEST",{message:"Invitation not found!"});if(t.email!==o.user.email)throw new I.APIError("FORBIDDEN",{message:"You are not the recipient of the invitation"});let n=await r.updateInvitation({invitationId:e.body.invitationId,status:"rejected"});return e.json({invitation:n,member:null})}),Br=c("/organization/cancel-invitation",{method:"POST",body:F.z.object({invitationId:F.z.string()}),use:[x,D]},async e=>{let o=e.context.session,r=C(e.context,e.context.orgOptions),t=await r.findInvitationById(e.body.invitationId);if(!t)throw new I.APIError("BAD_REQUEST",{message:"Invitation not found!"});let n=await r.findMemberByOrgId({userId:o.user.id,organizationId:t.organizationId});if(!n)throw new I.APIError("BAD_REQUEST",{message:"Member not found!"});if(e.context.roles[n.role].authorize({invitation:["cancel"]}).error)throw new I.APIError("FORBIDDEN",{message:"You are not allowed to cancel this invitation"});let s=await r.updateInvitation({invitationId:e.body.invitationId,status:"canceled"});return e.json(s)}),xr=c("/organization/get-invitation",{method:"GET",use:[x],requireHeaders:!0,query:F.z.object({id:F.z.string()})},async e=>{let o=await B(e);if(!o)throw new I.APIError("UNAUTHORIZED",{message:"Not authenticated"});let r=C(e.context,e.context.orgOptions),t=await r.findInvitationById(e.query.id);if(!t||t.status!=="pending"||t.expiresAt<new Date)throw new I.APIError("BAD_REQUEST",{message:"Invitation not found!"});if(t.email!==o.user.email)throw new I.APIError("FORBIDDEN",{message:"You are not the recipient of the invitation"});let n=await r.findOrganizationById(t.organizationId);if(!n)throw new I.APIError("BAD_REQUEST",{message:"Organization not found"});let i=await r.findMemberByOrgId({userId:t.inviterId,organizationId:t.organizationId});if(!i)throw new I.APIError("BAD_REQUEST",{message:"Inviter is no longer a member of the organization"});return e.json({...t,organizationName:n.name,organizationSlug:n.slug,inviterEmail:i.user.email})});var se=require("zod");var Se=require("better-call"),Lr=c("/organization/remove-member",{method:"POST",body:se.z.object({memberIdOrEmail:se.z.string(),organizationId:se.z.string().optional()}),use:[x,D]},async e=>{let o=e.context.session,r=e.body.organizationId||o.session.activeOrganizationId;if(!r)return e.json(null,{status:400,body:{message:"No active organization found!"}});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)throw new Se.APIError("BAD_REQUEST",{message:"Member not found!"});let i=e.context.roles[n.role];if(!i)throw new Se.APIError("BAD_REQUEST",{message:"Role not found!"});let s=o.user.email===e.body.memberIdOrEmail||n.id===e.body.memberIdOrEmail;if(s&&n.role===(e.context.orgOptions?.creatorRole||"owner"))throw new Se.APIError("BAD_REQUEST",{message:"You cannot leave the organization as the owner"});if(!(s||i.authorize({member:["delete"]}).success))throw new Se.APIError("UNAUTHORIZED",{message:"You are not allowed to delete this member"});let u=null;if(e.body.memberIdOrEmail.includes("@")?u=await t.findMemberByEmail({email:e.body.memberIdOrEmail,organizationId:r}):u=await t.findMemberById(e.body.memberIdOrEmail),u?.organizationId!==r)throw new Se.APIError("BAD_REQUEST",{message:"Member not found!"});return await t.deleteMember(u.id),o.user.id===u.userId&&o.session.activeOrganizationId===u.organizationId&&await t.setActiveOrganization(o.session.id,null),e.json({member:u})}),Dr=c("/organization/update-member-role",{method:"POST",body:se.z.object({role:se.z.enum(["admin","member","owner"]),memberId:se.z.string(),organizationId:se.z.string().optional()}),use:[x,D]},async e=>{let o=e.context.session,r=e.body.organizationId||o.session.activeOrganizationId;if(!r)return e.json(null,{status:400,body:{message:"No active organization found!"}});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)return e.json(null,{status:400,body:{message:"Member not found!"}});let i=e.context.roles[n.role];if(!i)return e.json(null,{status:400,body:{message:"Role not found!"}});if(i.authorize({member:["update"]}).error||e.body.role==="owner"&&n.role!=="owner")return e.json(null,{body:{message:"You are not allowed to update this member"},status:403});let a=await t.updateMember(e.body.memberId,e.body.role);return a?e.json(a):e.json(null,{status:400,body:{message:"Member not found!"}})}),jr=c("/organization/get-active-member",{method:"GET",use:[x,D]},async e=>{let o=e.context.session,r=o.session.activeOrganizationId;if(!r)return e.json(null,{status:400,body:{message:"No active organization found!"}});let n=await C(e.context,e.context.orgOptions).findMemberByOrgId({userId:o.user.id,organizationId:r});return n?e.json(n):e.json(null,{status:400,body:{message:"Member not found!"}})});var T=require("zod");var ae=require("better-call"),Nr=c("/organization/create",{method:"POST",body:T.z.object({name:T.z.string(),slug:T.z.string(),userId:T.z.string().optional(),logo:T.z.string().optional(),metadata:T.z.record(T.z.string()).optional()}),use:[x,D]},async e=>{let o=e.context.session.user;if(!o)return e.json(null,{status:401});let r=e.context.orgOptions;if(!(typeof r?.allowUserToCreateOrganization=="function"?await r.allowUserToCreateOrganization(o):r?.allowUserToCreateOrganization===void 0?!0:r.allowUserToCreateOrganization))throw new ae.APIError("FORBIDDEN",{message:"You are not allowed to create an organization"});let n=C(e.context,r),i=await n.listOrganizations(o.id);if(typeof r.organizationLimit=="number"?i.length>=r.organizationLimit:typeof r.organizationLimit=="function"?await r.organizationLimit(o):!1)throw new ae.APIError("FORBIDDEN",{message:"You have reached the organization limit"});if(await n.findOrganizationBySlug(e.body.slug))throw new ae.APIError("BAD_REQUEST",{message:"Organization with this slug already exists"});let d=await n.createOrganization({organization:{id:z(),slug:e.body.slug,name:e.body.name,logo:e.body.logo,createdAt:new Date,metadata:e.body.metadata},user:o});return e.json(d)}),Vr=c("/organization/update",{method:"POST",body:T.z.object({data:T.z.object({name:T.z.string().optional(),slug:T.z.string().optional(),logo:T.z.string().optional()}).partial(),organizationId:T.z.string().optional()}),requireHeaders:!0,use:[x]},async e=>{let o=await e.context.getSession(e);if(!o)throw new ae.APIError("UNAUTHORIZED",{message:"User not found"});let r=e.body.organizationId||o.session.activeOrganizationId;if(!r)return e.json(null,{status:400,body:{message:"Organization id not found!"}});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)return e.json(null,{status:400,body:{message:"User is not a member of this organization!"}});let i=e.context.roles[n.role];if(!i)return e.json(null,{status:400,body:{message:"Role not found!"}});if(i.authorize({organization:["update"]}).error)return e.json(null,{body:{message:"You are not allowed to update this organization"},status:403});let a=await t.updateOrganization(r,e.body.data);return e.json(a)}),Fr=c("/organization/delete",{method:"POST",body:T.z.object({organizationId:T.z.string()}),requireHeaders:!0,use:[x]},async e=>{let o=await e.context.getSession(e);if(!o)return e.json(null,{status:401});let r=e.body.organizationId;if(!r)return e.json(null,{status:400,body:{message:"Organization id not found!"}});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)return e.json(null,{status:400,body:{message:"User is not a member of this organization!"}});let i=e.context.roles[n.role];if(!i)return e.json(null,{status:400,body:{message:"Role not found!"}});if(i.authorize({organization:["delete"]}).error)throw new ae.APIError("FORBIDDEN",{message:"You are not allowed to delete this organization"});return r===o.session.activeOrganizationId&&await t.setActiveOrganization(o.session.id,null),await t.deleteOrganization(r),e.json(r)}),qr=c("/organization/get-full-organization",{method:"GET",query:T.z.optional(T.z.object({organizationId:T.z.string().optional()})),requireHeaders:!0,use:[x,D]},async e=>{let o=e.context.session,r=e.query?.organizationId||o.session.activeOrganizationId;if(!r)return e.json(null,{status:200});let n=await C(e.context,e.context.orgOptions).findFullOrganization(r,e.context.db||void 0);if(!n)throw new ae.APIError("BAD_REQUEST",{message:"Organization not found"});return e.json(n)}),Mr=c("/organization/set-active",{method:"POST",body:T.z.object({organizationId:T.z.string().nullable().optional()}),use:[D,x]},async e=>{let o=C(e.context,e.context.orgOptions),r=e.context.session,t=e.body.organizationId;if(t===null)return r.session.activeOrganizationId&&await o.setActiveOrganization(r.session.id,null),e.json(null);if(!t){let s=r.session.activeOrganizationId;if(!s)return e.json(null);t=s}if(!await o.findMemberByOrgId({userId:r.user.id,organizationId:t}))throw await o.setActiveOrganization(r.session.id,null),new ae.APIError("FORBIDDEN",{message:"You are not a member of this organization"});await o.setActiveOrganization(r.session.id,t);let i=await o.findFullOrganization(t,e.context.db||void 0);return e.json(i)}),$r=c("/organization/list",{method:"GET",use:[x,D]},async e=>{let r=await C(e.context,e.context.orgOptions).listOrganizations(e.context.session.user.id);return e.json(r)});var dn=e=>{let o={createOrganization:Nr,updateOrganization:Vr,deleteOrganization:Fr,setActiveOrganization:Mr,getFullOrganization:qr,listOrganization:$r,createInvitation:_r,cancelInvitation:Br,acceptInvitation:Cr,getInvitation:xr,rejectInvitation:zr,removeMember:Lr,updateMemberRole:Dr,getActiveMember:jr},r={...Pr,...e?.roles};return{id:"organization",endpoints:{...Sr(o,{orgOptions:e||{},roles:r,getSession:async n=>await B(n)}),hasPermission:c("/organization/has-permission",{method:"POST",requireHeaders:!0,body:Pe.z.object({permission:Pe.z.record(Pe.z.string(),Pe.z.array(Pe.z.string()))}),use:[D]},async n=>{if(!n.context.session.session.activeOrganizationId)throw new vt.APIError("BAD_REQUEST",{message:"No active organization"});let s=await C(n.context).findMemberByOrgId({userId:n.context.session.user.id,organizationId:n.context.session.session.activeOrganizationId||""});if(!s)throw new vt.APIError("UNAUTHORIZED",{message:"You are not a member of this organization"});let d=r[s.role].authorize(n.body.permission);return d.error?n.json({error:d.error,success:!1},{status:403}):n.json({error:null,success:!0})})},schema:{session:{fields:{activeOrganizationId:{type:"string",required:!1,fieldName:e?.schema?.session?.fields?.activeOrganizationId}}},organization:{fields:{name:{type:"string",required:!0,fieldName:e?.schema?.organization?.fields?.name},slug:{type:"string",unique:!0,fieldName:e?.schema?.organization?.fields?.slug},logo:{type:"string",required:!1,fieldName:e?.schema?.organization?.fields?.logo},createdAt:{type:"date",required:!0,fieldName:e?.schema?.organization?.fields?.createdAt},metadata:{type:"string",required:!1,fieldName:e?.schema?.organization?.fields?.metadata}}},member:{fields:{organizationId:{type:"string",required:!0,references:{model:"organization",field:"id"},fieldName:e?.schema?.member?.fields?.organizationId},userId:{type:"string",required:!0,fieldName:e?.schema?.member?.fields?.userId},role:{type:"string",required:!0,defaultValue:"member",fieldName:e?.schema?.member?.fields?.role},createdAt:{type:"date",required:!0,fieldName:e?.schema?.member?.fields?.createdAt}}},invitation:{fields:{organizationId:{type:"string",required:!0,references:{model:"organization",field:"id"},fieldName:e?.schema?.invitation?.fields?.organizationId},email:{type:"string",required:!0,fieldName:e?.schema?.invitation?.fields?.email},role:{type:"string",required:!1,fieldName:e?.schema?.invitation?.fields?.role},status:{type:"string",required:!0,defaultValue:"pending",fieldName:e?.schema?.invitation?.fields?.status},expiresAt:{type:"date",required:!0,fieldName:e?.schema?.invitation?.fields?.expiresAt},inviterId:{type:"string",references:{model:"user",field:"id"},fieldName:e?.schema?.invitation?.fields?.inviterId,required:!0}}}},$Infer:{Organization:{},Invitation:{},Member:{},ActiveOrganization:{}}}};var Rt=Nt(require("uncrypto"),1);function un(e){return e.toString(2).padStart(8,"0")}function cn(e){return[...e].map(o=>un(o)).join("")}function Qr(e){return parseInt(cn(e),2)}function ln(e){if(e<0||!Number.isInteger(e))throw new Error("Argument 'max' must be an integer greater than or equal to 0");let o=(e-1).toString(2).length,r=o%8,t=new Uint8Array(Math.ceil(o/8));Rt.default.getRandomValues(t),r!==0&&(t[0]&=(1<<r)-1);let n=Qr(t);for(;n>=e;)Rt.default.getRandomValues(t),r!==0&&(t[0]&=(1<<r)-1),n=Qr(t);return n}function q(e,o){let r="";for(let t=0;t<e;t++)r+=o[ln(o.length)];return r}function M(...e){let o=new Set(e),r="";for(let t of o)t==="a-z"?r+="abcdefghijklmnopqrstuvwxyz":t==="A-Z"?r+="ABCDEFGHIJKLMNOPQRSTUVWXYZ":t==="0-9"?r+="0123456789":r+=t;return r}var $e=require("zod");var Et=require("@noble/ciphers/chacha"),_e=require("@noble/ciphers/utils"),It=require("@noble/ciphers/webcrypto"),Tt=require("oslo/crypto"),Ut=Nt(require("uncrypto"),1);var Hr=require("oslo/encoding");var mn=require("@noble/hashes/scrypt"),pn=require("uncrypto");async function Ve(e,o){let r=new TextEncoder,t={name:"HMAC",hash:"SHA-256"},n=await Ut.default.subtle.importKey("raw",r.encode(e),t,!1,["sign","verify"]),i=await Ut.default.subtle.sign(t.name,n,r.encode(o));return btoa(String.fromCharCode(...new Uint8Array(i)))}var oe=async({key:e,data:o})=>{let r=await(0,Tt.sha256)(new TextEncoder().encode(e)),t=(0,_e.utf8ToBytes)(o),n=(0,It.managedNonce)(Et.xchacha20poly1305)(new Uint8Array(r));return(0,_e.bytesToHex)(n.encrypt(t))},de=async({key:e,data:o})=>{let r=await(0,Tt.sha256)(new TextEncoder().encode(e)),t=(0,_e.hexToBytes)(o),n=(0,It.managedNonce)(Et.xchacha20poly1305)(new Uint8Array(r));return new TextDecoder().decode(n.decrypt(t))};var K=require("zod");var Ce=require("better-call");var at="two_factor";var dt="trust_device";var St=require("zod");var we=S({body:St.z.object({trustDevice:St.z.boolean().optional()})},async e=>{let o=await B(e);if(!o){let r=e.context.createAuthCookie(at),t=await e.getSignedCookie(r.name,e.context.secret);if(!t)throw new Ce.APIError("UNAUTHORIZED",{message:"invalid two factor cookie"});let n=await e.context.internalAdapter.findUserById(t);if(!n)throw new Ce.APIError("UNAUTHORIZED",{message:"invalid two factor cookie"});let i=await e.context.internalAdapter.createSession(t,e.request);if(!i)throw new Ce.APIError("INTERNAL_SERVER_ERROR",{message:"failed to create session"});return{valid:async()=>{if(await w(e,{session:i,user:n}),e.body.trustDevice){let s=e.context.createAuthCookie(dt,{maxAge:2592e3}),a=await Ve(e.context.secret,`${n.id}!${i.id}`);await e.setSignedCookie(s.name,`${a}!${i.id}`,e.context.secret,s.attributes)}return e.json({session:i,user:n})},invalid:async()=>{throw new Ce.APIError("UNAUTHORIZED",{message:"invalid two factor authentication"})},session:{id:i.id,userId:i.userId,expiresAt:i.expiresAt,user:n}}}return{valid:async()=>e.json({session:o,user:o.user}),invalid:async()=>{throw new Ce.APIError("UNAUTHORIZED",{message:"invalid two factor authentication"})},session:o}});var ze=require("better-call");function fn(e){return Array.from({length:e?.amount??10}).fill(null).map(()=>q(e?.length??10,M("a-z","0-9"))).map(o=>`${o.slice(0,5)}-${o.slice(5)}`)}async function Pt(e,o){let r=e,t=o?.customBackupCodesGenerate?o.customBackupCodesGenerate():fn(),n=await oe({data:JSON.stringify(t),key:r});return{backupCodes:t,encryptedBackupCodes:n}}async function gn(e,o){let r=await Wr(e.backupCodes,o);return r?{status:r.includes(e.code),updated:r.filter(t=>t!==e.code)}:{status:!1,updated:null}}async function Wr(e,o){let r=Buffer.from(await de({key:o,data:e})).toString("utf-8"),t=JSON.parse(r),n=K.z.array(K.z.string()).safeParse(t);return n.success?n.data:null}var Gr=(e,o)=>({id:"backup_code",endpoints:{verifyBackupCode:c("/two-factor/verify-backup-code",{method:"POST",body:K.z.object({code:K.z.string(),disableSession:K.z.boolean().optional()}),use:[we]},async r=>{let t=r.context.session.user,n=await r.context.adapter.findOne({model:o,where:[{field:"userId",value:t.id}]});if(!n)throw new ze.APIError("BAD_REQUEST",{message:"Backup codes aren't enabled"});let i=await gn({backupCodes:n.backupCodes,code:r.body.code},r.context.secret);if(!i.status)throw new ze.APIError("UNAUTHORIZED",{message:"Invalid backup code"});let s=await oe({key:r.context.secret,data:JSON.stringify(i.updated)});return await r.context.adapter.update({model:o,update:{backupCodes:s},where:[{field:"userId",value:t.id}]}),r.body.disableSession||await w(r,{session:r.context.session,user:t}),r.json({user:t,session:r.context.session})}),generateBackupCodes:c("/two-factor/generate-backup-codes",{method:"POST",body:K.z.object({password:K.z.string()}),use:[b]},async r=>{let t=r.context.session.user;if(!t.twoFactorEnabled)throw new ze.APIError("BAD_REQUEST",{message:"Two factor isn't enabled"});await r.context.password.checkPassword(t.id,r);let n=await Pt(r.context.secret,e);return await r.context.adapter.update({model:o,update:{backupCodes:n.encryptedBackupCodes},where:[{field:"userId",value:r.context.session.user.id}]}),r.json({status:!0,backupCodes:n.backupCodes})}),viewBackupCodes:c("/two-factor/view-backup-codes",{method:"GET",body:K.z.object({userId:K.z.string()}),metadata:{SERVER_ONLY:!0}},async r=>{let t=await r.context.adapter.findOne({model:o,where:[{field:"userId",value:r.body.userId}]});if(!t)throw new ze.APIError("BAD_REQUEST",{message:"Backup codes aren't enabled"});let n=await Wr(t.backupCodes,r.context.secret);if(!n)throw new ze.APIError("BAD_REQUEST",{message:"Backup codes aren't enabled"});return r.json({status:!0,backupCodes:n})})}});var Fe=require("better-call"),Jr=require("oslo/otp"),_t=require("zod");var Kr=require("oslo"),Zr=(e,o)=>{let r={...e,period:new Kr.TimeSpan(e?.period||3,"m")},t=new Jr.TOTPController({digits:6,period:r.period}),n=c("/two-factor/send-otp",{method:"POST",use:[we]},async s=>{if(!e||!e.sendOTP)throw s.context.logger.error("send otp isn't configured. Please configure the send otp function on otp options."),new Fe.APIError("BAD_REQUEST",{message:"otp isn't configured"});let a=s.context.session.user,d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d)throw new Fe.APIError("BAD_REQUEST",{message:"OTP isn't enabled"});let u=await t.generate(Buffer.from(d.secret));return await e.sendOTP({user:a,otp:u},s.request),s.json({status:!0})}),i=c("/two-factor/verify-otp",{method:"POST",body:_t.z.object({code:_t.z.string()}),use:[we]},async s=>{let a=s.context.session.user;if(!a.twoFactorEnabled)throw new Fe.APIError("BAD_REQUEST",{message:"two factor isn't enabled"});let d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d)throw new Fe.APIError("BAD_REQUEST",{message:"OTP isn't enabled"});return await t.generate(Buffer.from(d.secret))===s.body.code?s.context.valid():s.context.invalid()});return{id:"otp",endpoints:{send2FaOTP:n,verifyOTP:i}}};var ye=require("better-call"),Yr=require("oslo"),Me=require("oslo/otp"),qe=require("zod");var Xr=(e,o)=>{let r={...e,digits:6,period:new Yr.TimeSpan(e?.period||30,"s")},t=c("/totp/generate",{method:"POST",use:[b]},async s=>{if(!e)throw s.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp"),new ye.APIError("BAD_REQUEST",{message:"totp isn't configured"});let a=s.context.session.user,d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d)throw new ye.APIError("BAD_REQUEST",{message:"totp isn't enabled"});return{code:await new Me.TOTPController(r).generate(Buffer.from(d.secret))}}),n=c("/two-factor/get-totp-uri",{method:"POST",use:[b],body:qe.z.object({password:qe.z.string()})},async s=>{if(!e)throw s.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp"),new ye.APIError("BAD_REQUEST",{message:"totp isn't configured"});let a=s.context.session.user,d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d||!a.twoFactorEnabled)throw new ye.APIError("BAD_REQUEST",{message:"totp isn't enabled"});return await s.context.password.checkPassword(a.id,s),{totpURI:(0,Me.createTOTPKeyURI)(e?.issuer||"BetterAuth",a.email,Buffer.from(d.secret),r)}}),i=c("/two-factor/verify-totp",{method:"POST",body:qe.z.object({code:qe.z.string()}),use:[we]},async s=>{if(!e)throw s.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp"),new ye.APIError("BAD_REQUEST",{message:"totp isn't configured"});let a=s.context.session.user,d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d)throw new ye.APIError("BAD_REQUEST",{message:"totp isn't enabled"});let u=new Me.TOTPController(r),l=await de({key:s.context.secret,data:d.secret}),m=Buffer.from(l);if(!await u.verify(s.body.code,m))return s.context.invalid();if(!a.twoFactorEnabled){let p=await s.context.internalAdapter.updateUser(a.id,{twoFactorEnabled:!0}),h=await s.context.internalAdapter.createSession(a.id,s.request);await w(s,{session:h,user:p})}return s.context.valid()});return{id:"totp",endpoints:{generateTOTP:t,viewTOTPURI:n,verifyTOTP:i}}};var hn=require("better-call");async function Ct(e,o){let t=(await e.context.internalAdapter.findAccounts(o.userId))?.find(s=>s.providerId==="credential"),n=t?.password;return!t||!n?!1:await e.context.password.verify(n,o.password)}var ut=require("better-call"),eo=require("oslo/otp"),to=require("oslo");var wn=(e={redirect:!0,twoFactorPage:"/"})=>({id:"two-factor",$InferServerPlugin:{},atomListeners:[{matcher:o=>o.startsWith("/two-factor/"),signal:"$sessionSignal"}],pathMethods:{"/two-factor/disable":"POST","/two-factor/enable":"POST","/two-factor/send-otp":"POST","/two-factor/generate-backup-codes":"POST"},fetchPlugins:[{id:"two-factor",name:"two-factor",hooks:{async onSuccess(o){o.data?.twoFactorRedirect&&(e.redirect||e.twoFactorPage)&&typeof window<"u"&&(window.location.href=e.twoFactorPage)}}}]});var yn=e=>{let o={twoFactorTable:e?.twoFactorTable||"twoFactor"},r=Xr({issuer:e?.issuer||"better-auth",...e?.totpOptions},o.twoFactorTable),t=Gr({...e?.backupCodeOptions},o.twoFactorTable),n=Zr({...e?.otpOptions},o.twoFactorTable);return{id:"two-factor",endpoints:{...r.endpoints,...n.endpoints,...t.endpoints,enableTwoFactor:c("/two-factor/enable",{method:"POST",body:$e.z.object({password:$e.z.string().min(8)}),use:[b]},async i=>{let s=i.context.session.user,{password:a}=i.body;if(!await Ct(i,{password:a,userId:s.id}))throw new ut.APIError("BAD_REQUEST",{message:"Invalid password"});let u=q(16,M("a-z","0-9","-")),l=await oe({key:i.context.secret,data:u}),m=await Pt(i.context.secret,e?.backupCodeOptions);if(e?.skipVerificationOnEnable){let p=await i.context.internalAdapter.updateUser(s.id,{twoFactorEnabled:!0}),h=await i.context.internalAdapter.createSession(p.id,i.request);await w(i,{session:h,user:s})}await i.context.adapter.deleteMany({model:o.twoFactorTable,where:[{field:"userId",value:s.id}]}),await i.context.adapter.create({model:o.twoFactorTable,data:{id:i.context.uuid(),secret:l,backupCodes:m.encryptedBackupCodes,userId:s.id}});let f=(0,eo.createTOTPKeyURI)(e?.issuer||"BetterAuth",s.email,Buffer.from(u),{digits:e?.totpOptions?.digits||6,period:new to.TimeSpan(e?.totpOptions?.period||30,"s")});return i.json({totpURI:f,backupCodes:m.backupCodes})}),disableTwoFactor:c("/two-factor/disable",{method:"POST",body:$e.z.object({password:$e.z.string().min(8)}),use:[b]},async i=>{let s=i.context.session.user,{password:a}=i.body;if(!await Ct(i,{password:a,userId:s.id}))throw new ut.APIError("BAD_REQUEST",{message:"Invalid password"});return await i.context.internalAdapter.updateUser(s.id,{twoFactorEnabled:!1}),await i.context.adapter.delete({model:o.twoFactorTable,where:[{field:"userId",value:s.id}]}),i.json({status:!0})})},options:e,hooks:{after:[{matcher(i){return i.path==="/sign-in/email"||i.path==="/sign-in/username"},handler:S(async i=>{let s=i.context.returned;if(s instanceof Response&&s?.status!==200||s instanceof ut.APIError)return;let a=s instanceof Response?await s.clone().json():s;if(!a.user.twoFactorEnabled)return;let d=i.context.createAuthCookie(dt,{maxAge:30*24*60*60}),u=await i.getSignedCookie(d.name,i.context.secret);if(u){let[f,p]=u.split("!"),h=await Ve(i.context.secret,`${a.user.id}!${p}`);if(f===h){let k=await Ve(i.context.secret,`${a.user.id}!${a.session.id}`);await i.setSignedCookie(d.name,`${k}!${a.session.id}`,i.context.secret,d.attributes);return}}J(i),await i.context.internalAdapter.deleteSession(a.session.id);let l=i.context.createAuthCookie(at,{maxAge:60*10});return await i.setSignedCookie(l.name,a.user.id,i.context.secret,l.attributes),{response:new Response(JSON.stringify({twoFactorRedirect:!0}),{headers:i.responseHeader})}})}]},schema:{user:{fields:{twoFactorEnabled:{type:"boolean",required:!1,defaultValue:!1,input:!1}}},twoFactor:{tableName:o.twoFactorTable,fields:{secret:{type:"string",required:!0,returned:!1},backupCodes:{type:"string",required:!0,returned:!1},userId:{type:"string",required:!0,returned:!1,references:{model:"user",field:"id"}}}}},rateLimit:[{pathMatcher(i){return i.startsWith("/two-factor/")},window:10,max:3}]}};var ue=require("@simplewebauthn/server"),H=require("better-call");var Z=require("zod");var Be=require("@simplewebauthn/browser");var An=require("@better-fetch/fetch");var Lc=require("nanostores");var Rc=require("@better-fetch/fetch");var bn=require("nanostores");var Ec=require("@better-fetch/fetch"),ct=require("nanostores"),zt=(e,o,r,t)=>{let n=(0,ct.atom)({data:null,error:null,isPending:!0,isRefetching:!1}),i=()=>{let a=typeof t=="function"?t({data:n.get().data,error:n.get().error,isPending:n.get().isPending}):t;return r(o,{...a,onSuccess:async d=>{n.set({data:d.data,error:null,isPending:!1,isRefetching:!1}),await a?.onSuccess?.(d)},async onError(d){n.set({error:d.error,data:null,isPending:!1,isRefetching:!1}),await a?.onError?.(d)},async onRequest(d){let u=n.get();n.set({isPending:u.data===null,data:u.data,error:null,isRefetching:!0}),await a?.onRequest?.(d)}})};e=Array.isArray(e)?e:[e];let s=!1;for(let a of e)a.subscribe(()=>{s?i():(0,ct.onMount)(n,()=>(i(),s=!0,()=>{n.off(),a.off()}))});return n};var ro=require("nanostores"),oo=(e,{$listPasskeys:o})=>({signIn:{passkey:async(n,i)=>{let s=await e("/passkey/generate-authenticate-options",{method:"POST",body:{email:n?.email}});if(!s.data)return s;try{let a=await(0,Be.startAuthentication)(s.data,n?.autoFill||!1),d=await e("/passkey/verify-authentication",{body:{response:a},...n?.fetchOptions,...i,method:"POST"});if(!d.data)return d}catch{return{data:null,error:{message:"auth cancelled",status:400,statusText:"BAD_REQUEST"}}}}},passkey:{addPasskey:async(n,i)=>{let s=await e("/passkey/generate-register-options",{method:"GET"});if(!s.data)return s;try{let a=await(0,Be.startRegistration)(s.data),d=await e("/passkey/verify-registration",{...n?.fetchOptions,...i,body:{response:a,name:n?.name},method:"POST"});if(!d.data)return d;o.set(Math.random())}catch(a){return a instanceof Be.WebAuthnError?a.code==="ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED"?{data:null,error:{message:"previously registered",status:400,statusText:"BAD_REQUEST"}}:a.code==="ERROR_CEREMONY_ABORTED"?{data:null,error:{message:"registration cancelled",status:400,statusText:"BAD_REQUEST"}}:{data:null,error:{message:a.message,status:400,statusText:"BAD_REQUEST"}}:{data:null,error:{message:a instanceof Error?a.message:"unknown error",status:500,statusText:"INTERNAL_SERVER_ERROR"}}}}},$Infer:{}}),kn=()=>{let e=(0,ro.atom)();return{id:"passkey",$InferServerPlugin:{},getActions:o=>oo(o,{$listPasskeys:e}),getAtoms(o){return{listPasskeys:zt(e,"/passkey/list-user-passkeys",o,{method:"GET"}),$listPasskeys:e}},pathMethods:{"/passkey/register":"POST","/passkey/authenticate":"POST"},atomListeners:[{matcher(o){return o==="/passkey/verify-registration"||o==="/passkey/delete-passkey"},signal:"_listPasskeys"}]}};var On=e=>{let o=G.BETTER_AUTH_URL,r=e?.rpID||o?.replace("http://","").replace("https://","").split(":")[0]||"localhost";if(!r)throw new W("passkey rpID not found. Please provide a rpID in the options or set the BETTER_AUTH_URL environment variable.");let t={origin:null,...e,rpID:r,advanced:{webAuthnChallengeCookie:"better-auth-passkey",...e?.advanced}},n=new Date(Date.now()+1e3*60*5),i=new Date,s=Math.floor((n.getTime()-i.getTime())/1e3);return{id:"passkey",endpoints:{generatePasskeyRegistrationOptions:c("/passkey/generate-register-options",{method:"GET",use:[b],metadata:{client:!1}},async a=>{let d=a.context.session,u=await a.context.adapter.findMany({model:"passkey",where:[{field:"userId",value:d.user.id}]}),l=new Uint8Array(Buffer.from(q(32,M("a-z","0-9")))),m;m=await(0,ue.generateRegistrationOptions)({rpName:t.rpName||a.context.appName,rpID:t.rpID,userID:l,userName:d.user.email||d.user.id,attestationType:"none",excludeCredentials:u.map(p=>({id:p.id,transports:p.transports?.split(",")})),authenticatorSelection:{residentKey:"preferred",userVerification:"preferred",authenticatorAttachment:"platform"}});let f=z();return await a.setSignedCookie(t.advanced.webAuthnChallengeCookie,f,a.context.secret,{secure:!0,httpOnly:!0,sameSite:"lax",maxAge:s}),await a.context.internalAdapter.createVerificationValue({identifier:f,value:JSON.stringify({expectedChallenge:m.challenge,userData:{id:d.user.id}}),expiresAt:n}),a.json(m,{status:200})}),generatePasskeyAuthenticationOptions:c("/passkey/generate-authenticate-options",{method:"POST",body:Z.z.object({email:Z.z.string().optional()}).optional()},async a=>{let d=await B(a),u=[];d&&(u=await a.context.adapter.findMany({model:"passkey",where:[{field:"userId",value:d.user.id}]}));let l=await(0,ue.generateAuthenticationOptions)({rpID:t.rpID,userVerification:"preferred",...u.length?{allowCredentials:u.map(p=>({id:p.id,transports:p.transports?.split(",")}))}:{}}),m={expectedChallenge:l.challenge,userData:{id:d?.user.id||""}},f=z();return await a.setSignedCookie(t.advanced.webAuthnChallengeCookie,f,a.context.secret,{secure:!0,httpOnly:!0,sameSite:"lax",maxAge:s}),await a.context.internalAdapter.createVerificationValue({identifier:f,value:JSON.stringify(m),expiresAt:n}),a.json(l,{status:200})}),verifyPasskeyRegistration:c("/passkey/verify-registration",{method:"POST",body:Z.z.object({response:Z.z.any(),name:Z.z.string().optional()}),use:[b]},async a=>{let d=e?.origin||a.headers?.get("origin")||"";if(!d)return a.json(null,{status:400});let u=a.body.response,l=await a.getSignedCookie(t.advanced.webAuthnChallengeCookie,a.context.secret);if(!l)throw new H.APIError("BAD_REQUEST",{message:"Challenge not found"});let m=await a.context.internalAdapter.findVerificationValue(l);if(!m)return a.json(null,{status:400});let{expectedChallenge:f,userData:p}=JSON.parse(m.value);if(p.id!==a.context.session.user.id)throw new H.APIError("UNAUTHORIZED",{message:"You are not authorized to register this passkey"});try{let h=await(0,ue.verifyRegistrationResponse)({response:u,expectedChallenge:f,expectedOrigin:d,expectedRPID:e?.rpID}),{verified:k,registrationInfo:U}=h;if(!k||!U)return a.json(null,{status:400});let{credentialID:te,credentialPublicKey:Ae,counter:N,credentialDeviceType:pt,credentialBackedUp:ke}=U,le=Buffer.from(Ae).toString("base64"),ft=z(),co={name:a.body.name,userId:p.id,webauthnUserID:ft,id:te,publicKey:le,counter:N,deviceType:pt,transports:u.response.transports.join(","),backedUp:ke,createdAt:new Date},lo=await a.context.adapter.create({model:"passkey",data:co});return a.json(lo,{status:200})}catch(h){throw console.log(h),new H.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to verify registration"})}}),verifyPasskeyAuthentication:c("/passkey/verify-authentication",{method:"POST",body:Z.z.object({response:Z.z.any()})},async a=>{let d=e?.origin||a.headers?.get("origin")||"";if(!d)throw new H.APIError("BAD_REQUEST",{message:"origin missing"});let u=a.body.response,l=await a.getSignedCookie(t.advanced.webAuthnChallengeCookie,a.context.secret);if(!l)throw new H.APIError("BAD_REQUEST",{message:"Challenge not found"});let m=await a.context.internalAdapter.findVerificationValue(l);if(!m)throw new H.APIError("BAD_REQUEST",{message:"Challenge not found"});let{expectedChallenge:f}=JSON.parse(m.value),p=await a.context.adapter.findOne({model:"passkey",where:[{field:"id",value:u.id}]});if(!p)throw new H.APIError("UNAUTHORIZED",{message:"Passkey not found"});try{let h=await(0,ue.verifyAuthenticationResponse)({response:u,expectedChallenge:f,expectedOrigin:d,expectedRPID:t.rpID,authenticator:{credentialID:p.id,credentialPublicKey:new Uint8Array(Buffer.from(p.publicKey,"base64")),counter:p.counter,transports:p.transports?.split(",")}}),{verified:k}=h;if(!k)throw new H.APIError("UNAUTHORIZED",{message:"Authentication failed"});await a.context.adapter.update({model:"passkey",where:[{field:"id",value:p.id}],update:{counter:h.authenticationInfo.newCounter}});let U=await a.context.internalAdapter.createSession(p.userId,a.request);if(!U)throw new H.APIError("INTERNAL_SERVER_ERROR",{message:"Unable to create session"});let te=await a.context.internalAdapter.findUserById(p.userId);if(!te)throw new H.APIError("INTERNAL_SERVER_ERROR",{message:"User not found"});return await w(a,{session:U,user:te}),a.json({session:U},{status:200})}catch(h){throw a.context.logger.error(h),new H.APIError("BAD_REQUEST",{message:"Failed to verify authentication"})}}),listPasskeys:c("/passkey/list-user-passkeys",{method:"GET",use:[b]},async a=>{let d=await a.context.adapter.findMany({model:"passkey",where:[{field:"userId",value:a.context.session.user.id}]});return a.json(d,{status:200})}),deletePasskey:c("/passkey/delete-passkey",{method:"POST",body:Z.z.object({id:Z.z.string()}),use:[b]},async a=>(await a.context.adapter.delete({model:"passkey",where:[{field:"id",value:a.body.id}]}),a.json(null,{status:200})))},schema:{passkey:{fields:{name:{type:"string",required:!1},publicKey:{type:"string",required:!0},userId:{type:"string",references:{model:"user",field:"id"},required:!0},webauthnUserID:{type:"string",required:!0},counter:{type:"number",required:!0},deviceType:{type:"string",required:!0},backedUp:{type:"boolean",required:!0},transports:{type:"string",required:!1},createdAt:{type:"date",defaultValue:new Date,required:!1}}}}}};var Qe=require("zod");var He=require("better-call"),Bt=()=>({id:"username",endpoints:{signInUsername:c("/sign-in/username",{method:"POST",body:Qe.z.object({username:Qe.z.string(),password:Qe.z.string(),rememberMe:Qe.z.boolean().optional()})},async e=>{let o=await e.context.adapter.findOne({model:e.context.tables.user.tableName,where:[{field:"username",value:e.body.username}]});if(!o)throw await e.context.password.hash(e.body.password),e.context.logger.error("User not found",{username:Bt}),new He.APIError("UNAUTHORIZED",{message:"Invalid username or password"});let r=await e.context.adapter.findOne({model:e.context.tables.account.tableName,where:[{field:e.context.tables.account.fields.userId.fieldName||"userId",value:o.id},{field:e.context.tables.account.fields.providerId.fieldName||"providerId",value:"credential"}]});if(!r)throw new He.APIError("UNAUTHORIZED",{message:"Invalid username or password"});let t=r?.password;if(!t)throw e.context.logger.error("Password not found",{username:Bt}),new He.APIError("UNAUTHORIZED",{message:"Unexpected error"});if(!await e.context.password.verify(t,e.body.password))throw e.context.logger.error("Invalid password"),new He.APIError("UNAUTHORIZED",{message:"Invalid username or password"});let i=await e.context.internalAdapter.createSession(o.id,e.request,e.body.rememberMe===!1);return i?(await e.setSignedCookie(e.context.authCookies.sessionToken.name,i.id,e.context.secret,e.body.rememberMe===!1?{...e.context.authCookies.sessionToken.options,maxAge:void 0}:e.context.authCookies.sessionToken.options),e.json({user:o,session:i})):e.json(null,{status:500,body:{message:"Failed to create session",status:500}})})},schema:{user:{fields:{username:{type:"string",required:!1,unique:!0,returned:!0}}}}});var no=require("better-call"),vn=()=>({id:"bearer",hooks:{before:[{matcher(e){return!!(e.request?.headers.get("authorization")||e.headers?.get("authorization"))},handler:async e=>{let o=e.request?.headers.get("authorization")?.replace("Bearer ","")||e.headers?.get("authorization")?.replace("Bearer ","");if(!o)return;let r="";return o.includes(".")?r=o:r=await(0,no.serializeSigned)("",o,e.context.secret),e.request&&e.request.headers.set("cookie",`${e.context.authCookies.sessionToken.name}=${r.replace("=","")}`),e.headers&&e.headers.set("cookie",`${e.context.authCookies.sessionToken.name}=${r.replace("=","")}`),{context:e}}}]}});var be=require("zod");var xt=require("better-call");var Rn=e=>({id:"magic-link",endpoints:{signInMagicLink:c("/sign-in/magic-link",{method:"POST",requireHeaders:!0,body:be.z.object({email:be.z.string().email(),callbackURL:be.z.string().optional()})},async o=>{let{email:r}=o.body;if(e.disableSignUp&&!await o.context.internalAdapter.findUserByEmail(r))throw new xt.APIError("BAD_REQUEST",{message:"User not found"});let t=q(32,M("a-z","A-Z"));await o.context.internalAdapter.createVerificationValue({identifier:t,value:r,expiresAt:new Date(Date.now()+(e.expiresIn||60*5)*1e3)});let n=`${o.context.baseURL}/magic-link/verify?token=${t}&callbackURL=${o.body.callbackURL||"/"}`;try{await e.sendMagicLink({email:r,url:n,token:t},o.request)}catch(i){throw o.context.logger.error("Failed to send magic link",i),new xt.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to send magic link"})}return o.json({status:!0})}),magicLinkVerify:c("/magic-link/verify",{method:"GET",query:be.z.object({token:be.z.string(),callbackURL:be.z.string().optional()}),requireHeaders:!0},async o=>{let{token:r,callbackURL:t}=o.query,n=t?.startsWith("http")?t:t?`${o.context.options.baseURL}${t}`:o.context.options.baseURL,i=await o.context.internalAdapter.findVerificationValue(r);if(!i)throw o.redirect(`${n}?error=INVALID_TOKEN`);if(i.expiresAt<new Date)throw await o.context.internalAdapter.deleteVerificationValue(i.id),o.redirect(`${n}?error=EXPIRED_TOKEN`);await o.context.internalAdapter.deleteVerificationValue(i.id);let s=i.value,a=await o.context.internalAdapter.findUserByEmail(s),d=a?.user.id||"";if(!a){if(e.disableSignUp)throw o.redirect(`${n}?error=USER_NOT_FOUND`);if(d=(await o.context.internalAdapter.createUser({email:s,emailVerified:!0,name:s})).id,!d)throw o.redirect(`${n}?error=USER_NOT_CREATED`)}let u=await o.context.internalAdapter.createSession(d,o.headers);if(!u)throw o.redirect(`${n}?error=SESSION_NOT_CREATED`);if(await w(o,{session:u,user:a?.user}),!t)return o.json({status:!0});throw o.redirect(t)})},rateLimit:[{pathMatcher(o){return o.startsWith("/sign-in/magic-link")||o.startsWith("/magic-link/verify")},window:e.rateLimit?.window||60,max:e.rateLimit?.max||5}]});var ce=require("zod");var Y=require("better-call");function Un(e){return q(e,M("0-9"))}var En=e=>{let o={phoneNumber:"phoneNumber",phoneNumberVerified:"phoneNumberVerified",code:"code",createdAt:"createdAt",expiresIn:e?.expiresIn||300,otpLength:e?.otpLength||6};return{id:"phone-number",endpoints:{sendPhoneNumberOTP:c("/phone-number/send-otp",{method:"POST",body:ce.z.object({phoneNumber:ce.z.string()})},async r=>{if(!e?.sendOTP)throw y.warn("sendOTP not implemented"),new Y.APIError("NOT_IMPLEMENTED",{message:"sendOTP not implemented"});let t=Un(o.otpLength);return await r.context.internalAdapter.createVerificationValue({value:t,identifier:r.body.phoneNumber,expiresAt:P(o.expiresIn,"sec")}),await e.sendOTP({phoneNumber:r.body.phoneNumber,code:t},r.request),r.json({code:t},{body:{message:"Code sent"}})}),verifyPhoneNumber:c("/phone-number/verify",{method:"POST",body:ce.z.object({phoneNumber:ce.z.string(),code:ce.z.string(),disableSession:ce.z.boolean().optional(),updatePhoneNumber:ce.z.boolean().optional()})},async r=>{let t=await r.context.internalAdapter.findVerificationValue(r.body.phoneNumber);if(!t||t.expiresAt<new Date)throw t&&t.expiresAt<new Date?(await r.context.internalAdapter.deleteVerificationValue(t.id),new Y.APIError("BAD_REQUEST",{message:"OTP expired"})):new Y.APIError("BAD_REQUEST",{message:"OTP not found"});if(t.value!==r.body.code)throw new Y.APIError("BAD_REQUEST",{message:"Invalid OTP"});if(await r.context.internalAdapter.deleteVerificationValue(t.id),r.body.updatePhoneNumber){let i=await B(r);if(!i)throw new Y.APIError("UNAUTHORIZED",{message:"Session not found"});let s=await r.context.internalAdapter.updateUser(i.user.id,{[o.phoneNumber]:r.body.phoneNumber,[o.phoneNumberVerified]:!0});return r.json({user:s,session:i.session})}let n=await r.context.adapter.findOne({model:r.context.tables.user.tableName,where:[{value:r.body.phoneNumber,field:o.phoneNumber}]});if(n)n=await r.context.internalAdapter.updateUser(n.id,{[o.phoneNumberVerified]:!0});else if(e?.signUpOnVerification){if(n=await r.context.internalAdapter.createUser({email:e.signUpOnVerification.getTempEmail(r.body.phoneNumber),name:e.signUpOnVerification.getTempName?e.signUpOnVerification.getTempName(r.body.phoneNumber):r.body.phoneNumber,[o.phoneNumber]:r.body.phoneNumber,[o.phoneNumberVerified]:!0}),!n)throw new Y.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to create user"})}else throw new Y.APIError("BAD_REQUEST",{message:"Phone number not found"});if(!n)throw new Y.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to update user"});if(!r.body.disableSession){let i=await r.context.internalAdapter.createSession(n.id,r.request);if(!i)throw new Y.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to create session"});return await w(r,{session:i,user:n}),r.json({user:n,session:i})}return r.json({user:n,session:null})})},schema:{user:{fields:{phoneNumber:{type:"string",required:!1,unique:!0,returned:!0},phoneNumberVerified:{type:"boolean",required:!1,returned:!0,input:!1}}}}}};var Il=require("zod");var In=e=>({id:"anonymous",endpoints:{signInAnonymous:c("/sign-in/anonymous",{method:"POST"},async o=>{let{emailDomainName:r=Oe(o.context.baseURL)}=e||{},t=z(),n=`temp-${t}@${r}`,i=await o.context.internalAdapter.createUser({id:t,email:n,emailVerified:!1,isAnonymous:!0,name:"Anonymous",createdAt:new Date,updatedAt:new Date});if(!i)return o.json(null,{status:500,body:{message:"Failed to create user",status:500}});let s=await o.context.internalAdapter.createSession(i.id,o.request);return s?(await w(o,{session:s,user:i}),o.json({user:i,session:s})):o.json(null,{status:400,body:{message:"Could not create session"}})})},hooks:{after:[{matcher(o){return o.path?.startsWith("/sign-in")||o.path?.startsWith("/sign-up")},async handler(o){let r=o.context.returned;if(!(r instanceof Response))return;let t=r.headers.get("set-cookie"),n=o.context.authCookies.sessionToken.name,i=Ye(t||"").get(n)?.value.split(".")[0];if(!i)return;let s=await B(o);if(!(!s||!s.user.isAnonymous)){if(o.path==="/sign-in/anonymous")throw new v.APIError("BAD_REQUEST",{message:"Anonymous users cannot sign in again anonymously"});if(e?.onLinkAccount){let a=await o.context.internalAdapter.findSession(i);if(!a)return;await e?.onLinkAccount?.({anonymousUser:s,newUser:a})}e?.disableDeleteAnonymousUser||await o.context.internalAdapter.deleteUser(s.user.id)}}}]},schema:{user:{fields:{isAnonymous:{type:"boolean",required:!1}}}}});var g=require("zod");var Tn=e=>{let o={defaultRole:"user",adminRole:"admin",...e},r=S(async t=>{let n=await B(t);if(!n?.session)throw new v.APIError("UNAUTHORIZED");let i=n.user;if(!i.role||(Array.isArray(o.adminRole)?!o.adminRole.includes(i.role):i.role!==o.adminRole))throw new v.APIError("FORBIDDEN",{message:"Only admins can access this endpoint"});return{session:{user:i,session:n.session}}});return{id:"admin",init(t){return{options:{databaseHooks:{user:{create:{async before(n){if(e?.defaultRole!==!1)return{data:{role:e?.defaultRole??"user",...n}}}}},session:{create:{async before(n){let i=await t.internalAdapter.findUserById(n.userId);if(i.banned){if(i.banExpires&&i.banExpires<Date.now()){await t.internalAdapter.updateUser(n.userId,{banned:!1,banReason:null,banExpires:null});return}return!1}}}}}}}},hooks:{after:[{matcher(t){return t.path==="/list-sessions"},handler:S(async t=>{let n=t.context.returned;if(n instanceof Response){let s=(await n.clone().json()).filter(d=>!d.impersonatedBy),a=new Response(JSON.stringify(s),{status:200,statusText:"OK",headers:n.headers});return t.json({response:a})}})}]},endpoints:{setRole:c("/admin/set-role",{method:"POST",body:g.z.object({userId:g.z.string(),role:g.z.string()}),use:[r]},async t=>{let n=await t.context.internalAdapter.updateUser(t.body.userId,{role:t.body.role});return t.json({user:n})}),createUser:c("/admin/create-user",{method:"POST",body:g.z.object({email:g.z.string(),password:g.z.string(),name:g.z.string(),role:g.z.string(),data:g.z.optional(g.z.record(g.z.any()))}),use:[r]},async t=>{if(await t.context.internalAdapter.findUserByEmail(t.body.email))throw new v.APIError("BAD_REQUEST",{message:"User already exists"});let i=await t.context.internalAdapter.createUser({email:t.body.email,name:t.body.name,role:t.body.role,...t.body.data});if(!i)throw new v.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to create user"});let s=await t.context.password.hash(t.body.password);return await t.context.internalAdapter.linkAccount({accountId:i.id,providerId:"credential",password:s,userId:i.id}),t.json({user:i})}),listUsers:c("/admin/list-users",{method:"GET",use:[r],query:g.z.object({searchValue:g.z.string().optional(),searchField:g.z.enum(["email","name"]).optional(),searchOperator:g.z.enum(["contains","starts_with","ends_with"]).optional(),limit:g.z.string().or(g.z.number()).optional(),offset:g.z.string().or(g.z.number()).optional(),sortBy:g.z.string().optional(),sortDirection:g.z.enum(["asc","desc"]).optional(),filterField:g.z.string().optional(),filterValue:g.z.string().or(g.z.number()).or(g.z.boolean()).optional(),filterOperator:g.z.enum(["eq","ne","lt","lte","gt","gte"]).optional()})},async t=>{let n=[];t.query?.searchValue&&n.push({field:t.query.searchField||"email",operator:t.query.searchOperator||"contains",value:t.query.searchValue}),t.query?.filterValue&&n.push({field:t.query.filterField||"email",operator:t.query.filterOperator||"eq",value:t.query.filterValue});try{let i=await t.context.internalAdapter.listUsers(Number(t.query?.limit)||void 0,Number(t.query?.offset)||void 0,t.query?.sortBy?{field:t.query.sortBy,direction:t.query.sortDirection||"asc"}:void 0,n.length?n:void 0);return t.json({users:i})}catch(i){return console.log(i),t.json({users:[]})}}),listUserSessions:c("/admin/list-user-sessions",{method:"POST",use:[r],body:g.z.object({userId:g.z.string()})},async t=>({sessions:await t.context.internalAdapter.listSessions(t.body.userId)})),unbanUser:c("/admin/unban-user",{method:"POST",body:g.z.object({userId:g.z.string()}),use:[r]},async t=>{let n=await t.context.internalAdapter.updateUser(t.body.userId,{banned:!1});return t.json({user:n})}),banUser:c("/admin/ban-user",{method:"POST",body:g.z.object({userId:g.z.string(),banReason:g.z.string().optional(),banExpiresIn:g.z.number().optional()}),use:[r]},async t=>{if(t.body.userId===t.context.session.user.id)throw new v.APIError("BAD_REQUEST",{message:"You cannot ban yourself"});let n=await t.context.internalAdapter.updateUser(t.body.userId,{banned:!0,banReason:t.body.banReason||e?.defaultBanReason||"No reason",banExpires:t.body.banExpiresIn?P(t.body.banExpiresIn,"sec"):e?.defaultBanExpiresIn?P(e.defaultBanExpiresIn,"sec"):void 0});return await t.context.internalAdapter.deleteSessions(t.body.userId),t.json({user:n})}),impersonateUser:c("/admin/impersonate-user",{method:"POST",body:g.z.object({userId:g.z.string()}),use:[r]},async t=>{let n=await t.context.internalAdapter.findUserById(t.body.userId);if(!n)throw new v.APIError("NOT_FOUND",{message:"User not found"});let i=await t.context.internalAdapter.createSession(n.id,void 0,!0,{impersonatedBy:t.context.session.user.id,expiresAt:e?.impersonationSessionDuration?P(e.impersonationSessionDuration,"sec"):P(60*60,"sec")});if(!i)throw new v.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to create session"});return await w(t,{session:i,user:n},!0),t.json({session:i,user:n})}),revokeUserSession:c("/admin/revoke-user-session",{method:"POST",body:g.z.object({sessionId:g.z.string()}),use:[r]},async t=>(await t.context.internalAdapter.deleteSession(t.body.sessionId),t.json({success:!0}))),revokeUserSessions:c("/admin/revoke-user-sessions",{method:"POST",body:g.z.object({userId:g.z.string()}),use:[r]},async t=>(await t.context.internalAdapter.deleteSessions(t.body.userId),t.json({success:!0}))),removeUser:c("/admin/remove-user",{method:"POST",body:g.z.object({userId:g.z.string()}),use:[r]},async t=>(await t.context.internalAdapter.deleteUser(t.body.userId),t.json({success:!0})))},schema:{user:{fields:{role:{type:"string",required:!1,input:!1},banned:{type:"boolean",defaultValue:!1,required:!1,input:!1},banReason:{type:"string",required:!1,input:!1},banExpires:{type:"date",required:!1,input:!1}}},session:{fields:{impersonatedBy:{type:"string",required:!1}}}}}};var X=require("zod"),xe=require("better-call");var lt=require("@better-fetch/fetch");var io=require("oslo/jwt");async function Sn(e,o,r){if(o==="oidc"&&e.idToken){let n=(0,io.parseJWT)(e.idToken);if(n?.payload)return n.payload}return r?(await(0,lt.betterFetch)(r,{method:"GET",headers:{Authorization:`Bearer ${e.accessToken}`}})).data:null}var Pn=e=>({id:"generic-oauth",endpoints:{signInWithOAuth2:c("/sign-in/oauth2",{method:"POST",query:X.z.object({currentURL:X.z.string().optional()}).optional(),body:X.z.object({providerId:X.z.string(),callbackURL:X.z.string().optional()})},async o=>{let{providerId:r}=o.body,t=e.config.find(le=>le.providerId===r);if(!t)throw new xe.APIError("BAD_REQUEST",{message:`No config found for provider ${r}`});let{discoveryUrl:n,authorizationUrl:i,tokenUrl:s,clientId:a,clientSecret:d,scopes:u,redirectURI:l,responseType:m,pkce:f,prompt:p,accessType:h}=t,k=i,U=s;if(n){let le=await(0,lt.betterFetch)(n,{onError(ft){y.error(ft.error,{discoveryUrl:n})}});le.data&&(k=le.data.authorization_endpoint,U=le.data.token_endpoint)}if(!k||!U)throw new xe.APIError("BAD_REQUEST",{message:"Invalid OAuth configuration."});let te=o.query?.currentURL?new URL(o.query?.currentURL):null,Ae=o.body.callbackURL?.startsWith("http")?o.body.callbackURL:`${te?.origin}${o.body.callbackURL||""}`,{state:N,codeVerifier:pt}=await ve(o),ke=await E({id:r,options:{clientId:a,clientSecret:d,redirectURI:l},authorizationEndpoint:k,state:N,codeVerifier:f?pt:void 0,scopes:u||[],redirectURI:`${o.context.baseURL}/oauth2/callback/${r}`});return m&&m!=="code"&&ke.searchParams.set("response_type",m),p&&ke.searchParams.set("prompt",p),h&&ke.searchParams.set("access_type",h),o.json({url:ke.toString(),redirect:!0})}),oAuth2Callback:c("/oauth2/callback/:providerId",{method:"GET",query:X.z.object({code:X.z.string().optional(),error:X.z.string().optional(),state:X.z.string()})},async o=>{if(o.query.error||!o.query.code)throw o.redirect(`${o.context.baseURL}?error=${o.query.error||"oAuth_code_missing"}`);let r=e.config.find(N=>N.providerId===o.params.providerId);if(!r)throw new xe.APIError("BAD_REQUEST",{message:`No config found for provider ${o.params.providerId}`});let t,n=await tt(o),{callbackURL:i,codeVerifier:s,errorURL:a}=n,d=o.query.code,u=r.tokenUrl,l=r.userInfoUrl;if(r.discoveryUrl){let N=await(0,lt.betterFetch)(r.discoveryUrl,{method:"GET"});N.data&&(u=N.data.token_endpoint,l=N.data.userinfo_endpoint)}try{if(!u)throw new xe.APIError("BAD_REQUEST",{message:"Invalid OAuth configuration."});t=await O({code:d,codeVerifier:s,redirectURI:`${o.context.baseURL}/oauth2/callback/${r.providerId}`,options:{clientId:r.clientId,clientSecret:r.clientSecret},tokenEndpoint:u})}catch(N){throw o.context.logger.error(N),o.redirect(`${a}?error=oauth_code_verification_failed`)}if(!t)throw new xe.APIError("BAD_REQUEST",{message:"Invalid OAuth configuration."});let m=r.getUserInfo?await r.getUserInfo(t):await Sn(t,r.type||"oauth2",l),f=z(),p=Er.safeParse({...m,id:f});if(!m||p.success===!1)throw y.error("Unable to get user info",p.error),o.redirect(`${o.context.baseURL}/error?error=please_restart_the_process`);let h=await Ee(o,{userInfo:p.data,account:{providerId:r.providerId,accountId:m.id,accessToken:t.accessToken}});function k(N){throw o.redirect(`${a||i||`${o.context.baseURL}/error`}?error=${N}`)}if(h.error)return k(h.error.split(" ").join("_"));let{session:U,user:te}=h.data;await w(o,{session:U,user:te});let Ae;try{Ae=new URL(i).toString()}catch{Ae=i}throw o.redirect(Ae)})}});var Le=require("zod"),so={jwks:{fields:{publicKey:{type:"string",required:!0},privateKey:{type:"string",required:!0},createdAt:{type:"date",required:!0}}}},Ql=Le.z.object({id:Le.z.string(),publicKey:Le.z.string(),privateKey:Le.z.string(),createdAt:Le.z.date()});var Lt=e=>({getAllKeys:async()=>await e.findMany({model:"jwks"}),getLatestKey:async()=>(await e.findMany({model:"jwks",sortBy:{field:"createdAt",direction:"desc"},limit:1}))[0],createJwk:async o=>await e.create({model:"jwks",data:{...o,createdAt:new Date}})});var ne=require("jose");var _n=e=>({id:"jwt",endpoints:{getJwks:c("/jwks",{method:"GET"},async o=>{let t=await Lt(o.context.adapter).getAllKeys();return o.json({keys:t.map(n=>({...JSON.parse(n.publicKey),kid:n.id}))})}),getToken:c("/token",{method:"GET",requireHeaders:!0,use:[b]},async o=>{let r=Lt(o.context.adapter),t=await r.getLatestKey(),n=!e?.jwks?.disablePrivateKeyEncryption;if(t===void 0){let{publicKey:u,privateKey:l}=await(0,ne.generateKeyPair)(e?.jwks?.keyPairConfig?.alg??"EdDSA",e?.jwks?.keyPairConfig??{crv:"Ed25519"}),m=await(0,ne.exportJWK)(u),f=await(0,ne.exportJWK)(l),p=JSON.stringify(f),h={id:crypto.randomUUID(),publicKey:JSON.stringify(m),privateKey:n?JSON.stringify(await oe({key:o.context.options.secret,data:p})):p,createdAt:new Date};t=await r.createJwk(h)}let i=n?await de({key:o.context.options.secret,data:JSON.parse(t.privateKey)}):t.privateKey,s=await(0,ne.importJWK)(JSON.parse(i)),a=e?.jwt?.definePayload?await e?.jwt.definePayload(o.context.session.user):o.context.session.user,d=await new ne.SignJWT({...a,...o.context.session.session.impersonatedBy?{impersonatedBy:o.context.session.session.impersonatedBy}:{}}).setProtectedHeader({alg:e?.jwks?.keyPairConfig?.alg??"EdDSA",kid:t.id}).setIssuedAt().setIssuer(e?.jwt?.issuer??o.context.options.baseURL).setAudience(e?.jwt?.audience??o.context.options.baseURL).setExpirationTime(e?.jwt?.expirationTime??"15m").setSubject(o.context.session.user.id).sign(s);return o.json({token:d})})},schema:so});var We=require("zod");var Cn=e=>{let o={maximumSessions:5,...e},r=t=>t.includes("_multi-");return{id:"multi-session",endpoints:{listDeviceSessions:c("/multi-session/list-device-sessions",{method:"GET",requireHeaders:!0},async t=>{let n=t.headers?.get("cookie");if(!n)return t.json([]);let i=Object.fromEntries(Xe(n)),s=(await Promise.all(Object.entries(i).filter(([u])=>r(u)).map(async([u])=>await t.getSignedCookie(u,t.context.secret)))).filter(u=>u!==void 0);if(!s.length)return t.json([]);let d=(await t.context.internalAdapter.findSessions(s)).filter(u=>u&&u.session.expiresAt>new Date).filter((u,l,m)=>l===m.findIndex(f=>f.user.id===u.user.id));return Object.entries(i).filter(([u])=>r(u)).forEach(([u,l])=>{d.some(m=>m.session.id===l)||t.setCookie(u,"",{...t.context.authCookies.sessionToken.options,maxAge:0})}),t.json(d)}),setActiveSession:c("/multi-session/set-active",{method:"POST",body:We.z.object({sessionId:We.z.string()}),requireHeaders:!0,use:[b]},async t=>{let n=t.body.sessionId,i=`${t.context.authCookies.sessionToken.name}_multi-${n}`;if(!await t.getSignedCookie(i,t.context.secret))throw new v.APIError("UNAUTHORIZED",{message:"Invalid session id"});let a=await t.context.internalAdapter.findSession(n);if(!a||a.session.expiresAt<new Date)throw t.setCookie(i,"",{...t.context.authCookies.sessionToken.options,maxAge:0}),new v.APIError("UNAUTHORIZED",{message:"Invalid session id"});return await t.setSignedCookie(t.context.authCookies.sessionToken.name,n,t.context.secret,t.context.authCookies.sessionToken.options),t.json(a)}),revokeDeviceSession:c("/multi-session/revoke",{method:"POST",body:We.z.object({sessionId:We.z.string()}),requireHeaders:!0,use:[b]},async t=>{let n=t.body.sessionId,i=`${t.context.authCookies.sessionToken.name}_multi-${n}`;if(!await t.getSignedCookie(i,t.context.secret))throw new v.APIError("UNAUTHORIZED",{message:"Invalid session id"});let a=await t.context.internalAdapter.findSession(n);return t.setCookie(i,"",{...t.context.authCookies.sessionToken.options,maxAge:0}),a?(await t.context.internalAdapter.deleteSession(n),t.json({success:!0})):t.json({success:!0})})},hooks:{after:[{matcher:()=>!0,handler:S(async t=>{if(!t.context.returned||!(t.context.returned instanceof Response))return;let n=t.context.returned.headers.get("set-cookie");if(!n)return;let i=Ye(n),s=t.context.authCookies.sessionToken,a=i.get(s.name)?.value;if(!a)return;let d=Xe(t.headers?.get("cookie")||""),u=a.split(".")[0],l=`${s.name}_multi-${u}`;if(i.get(l)||d.get(l)||Object.keys(Object.fromEntries(d)).filter(r).length+(n.includes("session_token")?1:0)>o.maximumSessions)return;await t.setSignedCookie(l,u,t.context.secret,s.options);let f=t.context.returned;return f.headers.append("Set-Cookie",t.responseHeader.get("set-cookie")),{response:f}})},{matcher:t=>t.path==="/sign-out",handler:S(async t=>{if(!(t.context.returned instanceof Response))return;let n=t.headers?.get("cookie");if(!n)return;let i=Object.fromEntries(Xe(n));await Promise.all(Object.entries(i).map(async([a,d])=>{if(r(a)){t.setCookie(a,"",{maxAge:0});let u=a.split("_multi-")[1];await t.context.internalAdapter.deleteSession(u)}}));let s=t.context.returned;return s.headers.append("Set-Cookie",t.responseHeader.get("set-cookie")),{response:s}})}]}}};var ee=require("zod");var zn=e=>{let o={expireIn:300,otpLength:6,...e};return{id:"email-otp",endpoints:{sendVerificationOTP:c("/email-otp/send-verification-otp",{method:"POST",body:ee.z.object({email:ee.z.string(),type:ee.z.enum(["email-verification","sign-in"])})},async r=>{if(!e?.sendVerificationOTP)throw y.error("send email verification is not implemented"),new v.APIError("BAD_REQUEST",{message:"send email verification is not implemented"});let t=r.body.email,n=q(o.otpLength,M("0-9"));return await r.context.internalAdapter.createVerificationValue({value:n,identifier:`${r.body.type}-otp-${t}`,expiresAt:P(o.expireIn,"sec")}),await e.sendVerificationOTP({email:t,otp:n,type:r.body.type},r.request),r.json({success:!0})}),verifyEmailOTP:c("/email-otp/verify-email",{method:"POST",body:ee.z.object({email:ee.z.string(),otp:ee.z.string()})},async r=>{let t=r.body.email,n=await r.context.internalAdapter.findVerificationValue(`email-verification-otp-${t}`);if(!n||n.expiresAt<new Date)throw n&&await r.context.internalAdapter.deleteVerificationValue(n.id),new v.APIError("BAD_REQUEST",{message:"Invalid OTP"});let i=r.body.otp;if(n.value!==i)throw new v.APIError("BAD_REQUEST",{message:"Invalid OTP"});await r.context.internalAdapter.deleteVerificationValue(n.id);let s=await r.context.internalAdapter.findUserByEmail(t);if(!s)throw new v.APIError("BAD_REQUEST",{message:"User not found"});let a=await r.context.internalAdapter.updateUser(s.user.id,{email:t,emailVerified:!0});return r.json({user:a})}),signInEmailOTP:c("/sign-in/email-otp",{method:"POST",body:ee.z.object({email:ee.z.string(),otp:ee.z.string()})},async r=>{let t=r.body.email,n=await r.context.internalAdapter.findVerificationValue(`sign-in-otp-${t}`);if(!n||n.expiresAt<new Date)throw n&&await r.context.internalAdapter.deleteVerificationValue(n.id),new v.APIError("BAD_REQUEST",{message:"Invalid OTP"});let i=r.body.otp;if(n.value!==i)throw new v.APIError("BAD_REQUEST",{message:"Invalid OTP"});await r.context.internalAdapter.deleteVerificationValue(n.id);let s=await r.context.internalAdapter.findUserByEmail(t);if(!s){if(o.disableSignUp)throw new v.APIError("BAD_REQUEST",{message:"User not found"});let d=await r.context.internalAdapter.createUser({email:t,emailVerified:!0,name:t}),u=await r.context.internalAdapter.createSession(d.id,r.request);return await w(r,{session:u,user:d}),r.json({user:d,session:u})}let a=await r.context.internalAdapter.createSession(s.user.id,r.request);return await w(r,{session:a,user:s.user}),r.json({session:a,user:s})})},hooks:{after:[{matcher(r){return!!(r.path?.startsWith("/sign-up")&&o.sendVerificationOnSignUp)},async handler(r){let t=r.context.returned;if(t?.status!==200)return;let n=await t.clone().json();if(n.user.email&&n.user.emailVerified===!1){let i=q(o.otpLength,M("0-9"));await r.context.internalAdapter.createVerificationValue({value:i,identifier:`email-verification-otp-${n.user.email}`,expiresAt:P(o.expireIn,"sec")}),await e.sendVerificationOTP({email:n.user.email,otp:i,type:"email-verification"},r.request)}}}]}}};var Dt=require("zod");var uo=require("@better-fetch/fetch");function ao(e){return e==="true"||e===!0}var Bn=e=>({id:"one-tap",endpoints:{oneTapCallback:c("/one-tap/callback",{method:"POST",body:Dt.z.object({idToken:Dt.z.string()})},async o=>{let{idToken:r}=o.body,{data:t,error:n}=await(0,uo.betterFetch)("https://oauth2.googleapis.com/tokeninfo?id_token="+r);if(n)return o.json({error:"Invalid token"});let i=await o.context.internalAdapter.findUserByEmail(t.email);if(!i){if(e?.disableSignup)throw new v.APIError("BAD_GATEWAY",{message:"User not found"});let a=await o.context.internalAdapter.createOAuthUser({email:t.email,emailVerified:ao(t.email_verified),name:t.name,image:t.picture},{providerId:"google",accountId:t.sub});if(!a)throw new v.APIError("INTERNAL_SERVER_ERROR",{message:"Could not create user"});let d=await o.context.internalAdapter.createSession(a?.user.id,o.request);return await w(o,{user:a.user,session:d}),o.json({session:d,user:a})}let s=await o.context.internalAdapter.createSession(i.user.id,o.request);return await w(o,{user:i.user,session:s}),o.json({session:s,user:i})})}});var mt=require("zod");function xn(){let e=G.VERCEL_URL,o=G.NETLIFY_URL,r=G.RENDER_URL,t=G.AWS_LAMBDA_FUNCTION_NAME,n=G.GOOGLE_CLOUD_FUNCTION_NAME,i=G.AZURE_FUNCTION_NAME;return e||o||r||t||n||i}var Ln=e=>({id:"oauth-proxy",endpoints:{oAuthProxy:c("/oauth-proxy-callback",{method:"GET",query:mt.z.object({callbackURL:mt.z.string(),cookies:mt.z.string()})},async o=>{let r=o.query.cookies,t=await de({key:o.context.secret,data:r});throw o.setHeader("set-cookie",t),o.redirect(o.query.callbackURL)})},hooks:{after:[{matcher(o){return o.path?.startsWith("/callback")},handler:S(async o=>{let r=o.context.returned;if(!r||!(r instanceof Response))return;let t=r.headers.get("location");if(t?.includes("/oauth-proxy-callback?callbackURL")){if(!t.startsWith("http"))return;let n=new URL(t);if(n.origin===Oe(o.context.baseURL)){let u=n.searchParams.get("callbackURL");return u?(r.headers.set("location",u),{response:r}):void 0}let s=r.headers.get("set-cookie");if(!s)return;let a=await oe({key:o.context.secret,data:s}),d=`${t}&cookies=${encodeURIComponent(a)}`;return r.headers.set("location",d),{response:r}}})}],before:[{matcher(o){return o.path?.startsWith("/sign-in/social")},async handler(o){let r=new URL(e?.currentURL||o.request?.url||xn()||o.context.baseURL);return o.body.callbackURL=`${r.origin}${o.context.options.basePath||"/api/auth"}/oauth-proxy-callback?callbackURL=${encodeURIComponent(o.body.callbackURL||o.context.baseURL)}`,{context:o}}}]}});0&&(module.exports={HIDE_METADATA,admin,anonymous,bearer,createAuthEndpoint,createAuthMiddleware,emailOTP,genericOAuth,getPasskeyActions,jwt,magicLink,multiSession,oAuthProxy,oneTap,optionsMiddleware,organization,passkey,passkeyClient,phoneNumber,twoFactor,twoFactorClient,username});
84
+ Error: `,a),e.redirect(`${e.context.baseURL}/error?error=internal_server_error`)}),i=n?.user;if(n){let a=n.accounts.find(d=>d.providerId===r.providerId);if(a)await e.context.internalAdapter.updateAccount(a.id,{accessToken:r.accessToken,idToken:r.idToken,refreshToken:r.refreshToken,expiresAt:r.expiresAt});else{if(!e.context.options.account?.accountLinking?.trustedProviders?.includes(r.providerId)&&!o.emailVerified||e.context.options.account?.accountLinking?.enabled===!1)return Vt&&y.warn(`User already exist but account isn't linked to ${r.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`),{error:"account not linked",data:null};try{await e.context.internalAdapter.linkAccount({providerId:r.providerId,accountId:o.id.toString(),id:e.context.uuid(),userId:n.user.id,accessToken:r.accessToken,idToken:r.idToken,refreshToken:r.refreshToken,expiresAt:r.expiresAt})}catch(l){return y.error("Unable to link account",l),{error:"unable to link account",data:null}}}}else try{let a=o.emailVerified||!1;if(i=await e.context.internalAdapter.createOAuthUser({...o,id:e.context.uuid(),emailVerified:a,email:o.email.toLowerCase()},{accessToken:r.accessToken,idToken:r.idToken,refreshToken:r.refreshToken,expiresAt:r.expiresAt,providerId:r.providerId,accountId:o.id.toString()}).then(d=>d?.user),!a&&i&&e.context.options.emailVerification?.sendOnSignUp){let d=await ie(e.context.secret,i.email),u=`${e.context.baseURL}/verify-email?token=${d}&callbackURL=${t}`;await e.context.options.emailVerification?.sendVerificationEmail?.({user:i,url:u,token:d},e.request)}}catch(a){return y.error("Unable to create user",a),{error:"unable to create user",data:null}}if(!i)return{error:"unable to create user",data:null};let s=await e.context.internalAdapter.createSession(i.id,e.request);return s?{data:{session:s,user:i},error:null}:{error:"unable to create session",data:null}}var Fo=c("/sign-in/social",{method:"POST",query:_.z.object({currentURL:_.z.string().optional()}).optional(),body:_.z.object({callbackURL:_.z.string().optional(),provider:_.z.enum(rt),idToken:_.z.optional(_.z.object({token:_.z.string(),nonce:_.z.string().optional(),accessToken:_.z.string().optional(),refreshToken:_.z.string().optional(),expiresAt:_.z.number().optional()}))})},async e=>{let o=e.context.socialProviders.find(i=>i.id===e.body.provider);if(!o)throw e.context.logger.error("Provider not found. Make sure to add the provider in your auth config",{provider:e.body.provider}),new L.APIError("NOT_FOUND",{message:"Provider not found"});if(e.body.idToken){if(!o.verifyIdToken)throw e.context.logger.error("Provider does not support id token verification",{provider:e.body.provider}),new L.APIError("NOT_FOUND",{message:"Provider does not support id token verification"});let{token:i,nonce:s}=e.body.idToken;if(!await o.verifyIdToken(i,s))throw e.context.logger.error("Invalid id token",{provider:e.body.provider}),new L.APIError("UNAUTHORIZED",{message:"Invalid id token"});let d=await o.getUserInfo({idToken:i,accessToken:e.body.idToken.accessToken,refreshToken:e.body.idToken.refreshToken});if(!d||!d?.user)throw e.context.logger.error("Failed to get user info",{provider:e.body.provider}),new L.APIError("UNAUTHORIZED",{message:"Failed to get user info"});if(!d.user.email)throw e.context.logger.error("User email not found",{provider:e.body.provider}),new L.APIError("UNAUTHORIZED",{message:"User email not found"});let u=await Ee(e,{userInfo:{email:d.user.email,id:d.user.id,name:d.user.name||"",image:d.user.image,emailVerified:d.user.emailVerified||!1},account:{providerId:o.id,accountId:d.user.id,accessToken:e.body.idToken.accessToken}});if(u.error)throw new L.APIError("UNAUTHORIZED",{message:u.error});return await w(e,u.data),e.json({session:u.data.session,user:u.data.user,url:`${e.body.callbackURL||e.query?.currentURL||e.context.options.baseURL}`,redirect:!0})}let{codeVerifier:r,state:t}=await ve(e),n=await o.createAuthorizationURL({state:t,codeVerifier:r,redirectURI:`${e.context.baseURL}/callback/${o.id}`});return e.json({url:n.toString(),redirect:!0})}),qo=c("/sign-in/email",{method:"POST",body:_.z.object({email:_.z.string(),password:_.z.string(),callbackURL:_.z.string().optional(),rememberMe:_.z.boolean().default(!1).optional()})},async e=>{if(!e.context.options?.emailAndPassword?.enabled)throw e.context.logger.error("Email and password is not enabled. Make sure to enable it in the options on you `auth.ts` file. Check `https://better-auth.com/docs/authentication/email-password` for more!"),new L.APIError("BAD_REQUEST",{message:"Email and password is not enabled"});let{email:o,password:r}=e.body;if(!_.z.string().email().safeParse(o).success)throw new L.APIError("BAD_REQUEST",{message:"Invalid email"});let n=await e.context.internalAdapter.findUserByEmail(o,{includeAccounts:!0});if(!n)throw await e.context.password.hash(r),e.context.logger.error("User not found",{email:o}),new L.APIError("UNAUTHORIZED",{message:"Invalid email or password"});let i=n.accounts.find(u=>u.providerId==="credential");if(!i)throw e.context.logger.error("Credential account not found",{email:o}),new L.APIError("UNAUTHORIZED",{message:"Invalid email or password"});let s=i?.password;if(!s)throw e.context.logger.error("Password not found",{email:o}),new L.APIError("UNAUTHORIZED",{message:"Unexpected error"});if(!await e.context.password.verify(s,r))throw e.context.logger.error("Invalid password"),new L.APIError("UNAUTHORIZED",{message:"Invalid email or password"});if(e.context.options?.emailAndPassword?.requireEmailVerification&&!n.user.emailVerified){if(!e.context.options?.emailVerification?.sendVerificationEmail)throw y.error("Email verification is required but no email verification handler is provided"),new L.APIError("INTERNAL_SERVER_ERROR",{message:"Email is not verified."});let u=await ie(e.context.secret,n.user.email),l=`${e.context.baseURL}/verify-email?token=${u}`;throw await e.context.options.emailVerification.sendVerificationEmail({user:n.user,url:l,token:u},e.request),e.context.logger.error("Email not verified",{email:o}),new L.APIError("FORBIDDEN",{message:"Email is not verified. Check your email for a verification link"})}let d=await e.context.internalAdapter.createSession(n.user.id,e.headers,e.body.rememberMe===!1);if(!d)throw e.context.logger.error("Failed to create session"),new L.APIError("UNAUTHORIZED",{message:"Failed to create session"});return await w(e,{session:d,user:n.user},e.body.rememberMe===!1),e.json({user:n.user,session:d,redirect:!!e.body.callbackURL,url:e.body.callbackURL})});var je=require("zod");var Mo=c("/callback/:id",{method:["GET","POST"],query:je.z.object({state:je.z.string(),code:je.z.string().optional(),error:je.z.string().optional()}),metadata:pe},async e=>{if(!e.query.code)throw e.redirect(`${e.context.baseURL}/error?error=${e.query.error||"no_code"}`);let o=e.context.socialProviders.find(k=>k.id===e.params.id);if(!o)throw e.context.logger.error("Oauth provider with id",e.params.id,"not found"),e.redirect(`${e.context.baseURL}/error?error=oauth_provider_not_found`);let{codeVerifier:r,callbackURL:t,link:n,errorURL:i}=await tt(e),s;try{s=await o.validateAuthorizationCode({code:e.query.code,codeVerifier:r,redirectURI:`${e.context.baseURL}/callback/${o.id}`})}catch(k){throw e.context.logger.error(k),e.redirect(`${e.context.baseURL}/error?error=please_restart_the_process`)}let a=await o.getUserInfo(s).then(k=>k?.user),u={id:z(),...a};function l(k){let U=i||t||`${e.context.baseURL}/error`;throw U.includes("?")?U=`${U}&error=${k}`:U=`${U}?error=${k}`,e.redirect(U)}if(!a)return y.error("Unable to get user info"),l("unable_to_get_user_info");if(!u.email)return e.context.logger.error("Provider did not return email. This could be due to misconfiguration in the provider settings."),l("email_not_found");if(!t)throw y.error("No callback URL found"),e.redirect(`${e.context.baseURL}/error?error=please_restart_the_process`);if(n){if(n.email!==u.email.toLowerCase())return l("email_doesn't_match");if(!await e.context.internalAdapter.createAccount({userId:n.userId,providerId:o.id,accountId:a.id}))return l("unable_to_link_account");let U;try{U=new URL(t).toString()}catch{U=t}throw e.redirect(U)}let m=await Ee(e,{userInfo:{email:u.email,id:u.id,name:u.name||"",image:u.image,emailVerified:u.emailVerified||!1},account:{providerId:o.id,accountId:a.id,accessToken:s.accessToken,refreshToken:s.refreshToken,expiresAt:s.accessTokenExpiresAt},callbackURL:t});if(m.error)return l(m.error.split(" ").join("_"));let{session:f,user:p}=m.data;await w(e,{session:f,user:p});let h;try{h=new URL(t).toString()}catch{h=t}throw e.redirect(h)});var rd=require("zod");var Ir=require("better-call"),$o=c("/sign-out",{method:"POST",requireHeaders:!0},async e=>{let o=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(!o)throw new Ir.APIError("BAD_REQUEST",{message:"Session not found"});return await e.context.internalAdapter.deleteSession(o),J(e),e.json({success:!0})});var Q=require("zod");var Ne=require("better-call");function Tr(e,o,r){let t=o?new URL(o,e.baseURL):new URL(`${e.baseURL}/error`);return r&&Object.entries(r).forEach(([n,i])=>t.searchParams.set(n,i)),t.href}function en(e,o,r){let t=new URL(o,e.baseURL);return r&&Object.entries(r).forEach(([n,i])=>t.searchParams.set(n,i)),t.href}var Qo=c("/forget-password",{method:"POST",body:Q.z.object({email:Q.z.string().email(),redirectTo:Q.z.string()})},async e=>{if(!e.context.options.emailAndPassword?.sendResetPassword)throw e.context.logger.error("Reset password isn't enabled.Please pass an emailAndPassword.sendResetPasswordToken function in your auth config!"),new Ne.APIError("BAD_REQUEST",{message:"Reset password isn't enabled"});let{email:o,redirectTo:r}=e.body,t=await e.context.internalAdapter.findUserByEmail(o,{includeAccounts:!0});if(!t)return e.context.logger.error("Reset Password: User not found",{email:o}),e.json({status:!1},{body:{status:!0}});let n=60*60*1,i=new Date(Date.now()+1e3*(e.context.options.emailAndPassword.resetPasswordTokenExpiresIn||n)),s=e.context.uuid();await e.context.internalAdapter.createVerificationValue({value:t.user.id,identifier:`reset-password:${s}`,expiresAt:i});let a=`${e.context.baseURL}/reset-password/${s}?callbackURL=${r}`;return await e.context.options.emailAndPassword.sendResetPassword({user:t.user,url:a},e.request),e.json({status:!0})}),Ho=c("/reset-password/:token",{method:"GET",query:Q.z.object({callbackURL:Q.z.string()})},async e=>{let{token:o}=e.params,{callbackURL:r}=e.query;if(!o||!r)throw e.redirect(Tr(e.context,r,{error:"INVALID_TOKEN"}));let t=await e.context.internalAdapter.findVerificationValue(`reset-password:${o}`);throw!t||t.expiresAt<new Date?e.redirect(Tr(e.context,r,{error:"INVALID_TOKEN"})):e.redirect(en(e.context,r,{token:o}))}),Wo=c("/reset-password",{query:Q.z.optional(Q.z.object({token:Q.z.string().optional(),currentURL:Q.z.string().optional()})),method:"POST",body:Q.z.object({newPassword:Q.z.string()})},async e=>{let o=e.query?.token||(e.query?.currentURL?new URL(e.query.currentURL).searchParams.get("token"):"");if(!o)throw new Ne.APIError("BAD_REQUEST",{message:"Token not found"});let{newPassword:r}=e.body,t=`reset-password:${o}`,n=await e.context.internalAdapter.findVerificationValue(t);if(!n||n.expiresAt<new Date)throw new Ne.APIError("BAD_REQUEST",{message:"Invalid token"});await e.context.internalAdapter.deleteVerificationValue(n.id);let i=n.value,s=await e.context.password.hash(r);if(!(await e.context.internalAdapter.findAccounts(i)).find(l=>l.providerId==="credential"))return await e.context.internalAdapter.createAccount({userId:i,providerId:"credential",password:s,accountId:e.context.uuid()}),e.json({status:!0});if(!await e.context.internalAdapter.updatePassword(i,s))throw new Ne.APIError("BAD_REQUEST",{message:"Failed to update password"});return e.json({status:!0})});var V=require("zod");var j=require("better-call");var Go=c("/change-password",{method:"POST",body:V.z.object({newPassword:V.z.string(),currentPassword:V.z.string(),revokeOtherSessions:V.z.boolean().optional()}),use:[b]},async e=>{let{newPassword:o,currentPassword:r,revokeOtherSessions:t}=e.body,n=e.context.session,i=e.context.password.config.minPasswordLength;if(o.length<i)throw e.context.logger.error("Password is too short"),new j.APIError("BAD_REQUEST",{message:"Password is too short"});let s=e.context.password.config.maxPasswordLength;if(o.length>s)throw e.context.logger.error("Password is too long"),new j.APIError("BAD_REQUEST",{message:"Password too long"});let d=(await e.context.internalAdapter.findAccounts(n.user.id)).find(m=>m.providerId==="credential"&&m.password);if(!d||!d.password)throw new j.APIError("BAD_REQUEST",{message:"User does not have a password"});let u=await e.context.password.hash(o);if(!await e.context.password.verify(d.password,r))throw new j.APIError("BAD_REQUEST",{message:"Incorrect password"});if(await e.context.internalAdapter.updateAccount(d.id,{password:u}),t){await e.context.internalAdapter.deleteSessions(n.user.id);let m=await e.context.internalAdapter.createSession(n.user.id,e.headers);if(!m)throw new j.APIError("INTERNAL_SERVER_ERROR",{message:"Unable to create session"});await w(e,{session:m,user:n.user})}return e.json(n.user)}),Jo=c("/set-password",{method:"POST",body:V.z.object({newPassword:V.z.string()}),metadata:{SERVER_ONLY:!0},use:[b]},async e=>{let{newPassword:o}=e.body,r=e.context.session,t=e.context.password.config.minPasswordLength;if(o.length<t)throw e.context.logger.error("Password is too short"),new j.APIError("BAD_REQUEST",{message:"Password is too short"});let n=e.context.password.config.maxPasswordLength;if(o.length>n)throw e.context.logger.error("Password is too long"),new j.APIError("BAD_REQUEST",{message:"Password too long"});let s=(await e.context.internalAdapter.findAccounts(r.user.id)).find(d=>d.providerId==="credential"&&d.password),a=await e.context.password.hash(o);if(!s)return await e.context.internalAdapter.linkAccount({userId:r.user.id,providerId:"credential",accountId:r.user.id,password:a}),e.json(r.user);throw new j.APIError("BAD_REQUEST",{message:"user already has a password"})}),Ko=c("/delete-user",{method:"POST",body:V.z.object({password:V.z.string()}),use:[b]},async e=>{let{password:o}=e.body,r=e.context.session,n=(await e.context.internalAdapter.findAccounts(r.user.id)).find(s=>s.providerId==="credential"&&s.password);if(!n||!n.password)throw new j.APIError("BAD_REQUEST",{message:"User does not have a password"});if(!await e.context.password.verify(n.password,o))throw new j.APIError("BAD_REQUEST",{message:"Incorrect password"});return await e.context.internalAdapter.deleteUser(r.user.id),await e.context.internalAdapter.deleteSessions(r.user.id),J(e),e.json(null)}),Zo=c("/change-email",{method:"POST",query:V.z.object({currentURL:V.z.string().optional()}).optional(),body:V.z.object({newEmail:V.z.string().email(),callbackURL:V.z.string().optional()}),use:[b]},async e=>{if(!e.context.options.user?.changeEmail?.enabled)throw e.context.logger.error("Change email is disabled."),new j.APIError("BAD_REQUEST",{message:"Change email is disabled"});if(e.body.newEmail===e.context.session.user.email)throw e.context.logger.error("Email is the same"),new j.APIError("BAD_REQUEST",{message:"Email is the same"});if(await e.context.internalAdapter.findUserByEmail(e.body.newEmail))throw e.context.logger.error("Email already exists"),new j.APIError("BAD_REQUEST",{message:"Couldn't update your email"});if(e.context.session.user.emailVerified!==!0){let n=await e.context.internalAdapter.updateUserByEmail(e.context.session.user.email,{email:e.body.newEmail});return e.json({user:n,status:!0})}if(!e.context.options.user.changeEmail.sendChangeEmailVerification)throw e.context.logger.error("Verification email isn't enabled."),new j.APIError("BAD_REQUEST",{message:"Verification email isn't enabled"});let r=await ie(e.context.secret,e.context.session.user.email,e.body.newEmail),t=`${e.context.baseURL}/verify-email?token=${r}&callbackURL=${e.body.callbackURL||e.query?.currentURL||"/"}`;return await e.context.options.user.changeEmail.sendChangeEmailVerification({user:e.context.session.user,newEmail:e.body.newEmail,url:t,token:r},e.request),e.json({user:null,status:!0})});var Ie=require("zod");var kt=require("better-call");var Yo=c("/list-accounts",{method:"GET",use:[b]},async e=>{let o=e.context.session,r=await e.context.internalAdapter.findAccounts(o.user.id);return e.json(r.map(t=>({id:t.id,provider:t.providerId})))}),Xo=c("/link-social",{method:"POST",requireHeaders:!0,query:Ie.z.object({currentURL:Ie.z.string().optional()}).optional(),body:Ie.z.object({callbackURL:Ie.z.string().optional(),provider:Ie.z.enum(rt)}),use:[b]},async e=>{let o=e.context.session;if((await e.context.internalAdapter.findAccounts(o.user.id)).find(a=>a.providerId===e.body.provider))throw new kt.APIError("BAD_REQUEST",{message:"Social Account is already linked."});let n=e.context.socialProviders.find(a=>a.id===e.body.provider);if(!n)throw e.context.logger.error("Provider not found. Make sure to add the provider in your auth config",{provider:e.body.provider}),new kt.APIError("NOT_FOUND",{message:"Provider not found"});let i=await ve(e,{userId:o.user.id,email:o.user.email}),s=await n.createAuthorizationURL({state:i.state,codeVerifier:i.codeVerifier,redirectURI:`${e.context.baseURL}/callback/${n.id}`});return e.json({url:s.toString(),redirect:!0})});var Sr=(e,o)=>{let r={};for(let[t,n]of Object.entries(e))r[t]=i=>n({...i,context:{...o,...i.context}}),r[t].path=n.path,r[t].method=n.method,r[t].options=n.options,r[t].headers=n.headers;return r};var Te=class extends Error{path;constructor(o,r){super(o),this.path=r}},nt=class{constructor(o){this.s=o;this.statements=o}statements;newRole(o){return new it(o)}},it=class e{statements;constructor(o){this.statements=o}authorize(o,r){for(let[t,n]of Object.entries(o)){let i=this.statements[t];if(!i)return{success:!1,error:`You are not allowed to access resource: ${t}`};let s=r==="OR"?n.some(a=>i.includes(a)):n.every(a=>i.includes(a));return s?{success:s}:{success:!1,error:`unauthorized to access resource "${t}"`}}return{success:!1,error:"Not authorized"}}static fromString(o){let r=JSON.parse(o);if(typeof r!="object")throw new Te("statements is not an object",".");for(let[t,n]of Object.entries(r)){if(typeof t!="string")throw new Te("invalid resource identifier",t);if(!Array.isArray(n))throw new Te("actions is not an array",t);for(let i=0;i<n.length;i++)if(typeof n[i]!="string")throw new Te("action is not a string",`${t}[${i}]`)}return new e(r)}toString(){return JSON.stringify(this.statements)}};var tn=e=>new nt(e),rn={organization:["update","delete"],member:["create","update","delete"],invitation:["create","cancel"]},Ot=tn(rn),on=Ot.newRole({organization:["update"],invitation:["create","cancel"],member:["create","update","delete"]}),nn=Ot.newRole({organization:["update","delete"],member:["create","update","delete"],invitation:["create","cancel"]}),sn=Ot.newRole({organization:[],member:[],invitation:[]}),Pr={admin:on,owner:nn,member:sn};var C=(e,o)=>{let r=e.adapter;return{findOrganizationBySlug:async t=>await r.findOne({model:"organization",where:[{field:"slug",value:t}]}),createOrganization:async t=>{let n=await r.create({model:"organization",data:{...t.organization,metadata:t.organization.metadata?JSON.stringify(t.organization.metadata):void 0}}),i=await r.create({model:"member",data:{id:z(),organizationId:n.id,userId:t.user.id,createdAt:new Date,role:o?.creatorRole||"owner"}});return{...n,metadata:n.metadata?JSON.parse(n.metadata):void 0,members:[{...i,user:{id:t.user.id,name:t.user.name,email:t.user.email,image:t.user.image}}]}},findMemberByEmail:async t=>{let n=await r.findOne({model:e.tables.user.tableName,where:[{field:"email",value:t.email}]});if(!n)return null;let i=await r.findOne({model:"member",where:[{field:"organizationId",value:t.organizationId},{field:"userId",value:n.id}]});return i?{...i,user:{id:n.id,name:n.name,email:n.email,image:n.image}}:null},findMemberByOrgId:async t=>{let[n,i]=await Promise.all([await r.findOne({model:"member",where:[{field:"userId",value:t.userId},{field:"organizationId",value:t.organizationId}]}),await r.findOne({model:e.tables.user.tableName,where:[{field:"id",value:t.userId}]})]);return!i||!n?null:{...n,user:{id:i.id,name:i.name,email:i.email,image:i.image}}},findMemberById:async t=>{let n=await r.findOne({model:"member",where:[{field:"id",value:t}]});if(!n)return null;let i=await r.findOne({model:e.tables.user.tableName,where:[{field:"id",value:n.userId}]});return i?{...n,user:{id:i.id,name:i.name,email:i.email,image:i.image}}:null},createMember:async t=>await r.create({model:"member",data:t}),updateMember:async(t,n)=>await r.update({model:"member",where:[{field:"id",value:t}],update:{role:n}}),deleteMember:async t=>await r.delete({model:"member",where:[{field:"id",value:t}]}),updateOrganization:async(t,n)=>await r.update({model:"organization",where:[{field:"id",value:t}],update:n}),deleteOrganization:async t=>(await r.delete({model:"member",where:[{field:"organizationId",value:t}]}),await r.delete({model:"invitation",where:[{field:"organizationId",value:t}]}),await r.delete({model:"organization",where:[{field:"id",value:t}]}),t),setActiveOrganization:async(t,n)=>await r.update({model:e.tables.session.tableName,where:[{field:"id",value:t}],update:{activeOrganizationId:n}}),findOrganizationById:async t=>await r.findOne({model:"organization",where:[{field:"id",value:t}]}),findFullOrganization:async(t,n)=>{let[i,s,a]=await Promise.all([r.findOne({model:"organization",where:[{field:"id",value:t}]}),r.findMany({model:"invitation",where:[{field:"organizationId",value:t}]}),r.findMany({model:"member",where:[{field:"organizationId",value:t}]})]);if(!i)return null;let d=a.map(f=>f.userId),u=await r.findMany({model:e.tables.user.tableName,where:[{field:"id",value:d,operator:"in"}]}),l=new Map(u.map(f=>[f.id,f])),m=a.map(f=>{let p=l.get(f.userId);if(!p)throw new W("Unexpected error: User not found for member");return{...f,user:{id:p.id,name:p.name,email:p.email,image:p.image}}});return{...i,invitations:s,members:m}},listOrganizations:async t=>{let n=await r.findMany({model:"member",where:[{field:"userId",value:t}]});if(!n||n.length===0)return[];let i=n.map(a=>a.organizationId);return await r.findMany({model:"organization",where:[{field:"id",value:i,operator:"in"}]})},createInvitation:async({invitation:t,user:n})=>{let s=P(o?.invitationExpiresIn||1728e5);return await r.create({model:"invitation",data:{id:z(),email:t.email,role:t.role,organizationId:t.organizationId,status:"pending",expiresAt:s,inviterId:n.id}})},findInvitationById:async t=>await r.findOne({model:"invitation",where:[{field:"id",value:t}]}),findPendingInvitation:async t=>(await r.findMany({model:"invitation",where:[{field:"email",value:t.email},{field:"organizationId",value:t.organizationId},{field:"status",value:"pending"}]})).filter(i=>new Date(i.expiresAt)>new Date),updateInvitation:async t=>await r.update({model:"invitation",where:[{field:"id",value:t.invitationId}],update:{status:t.status}})}};var Kd=require("better-call");var x=S(async e=>({})),D=S({use:[b]},async e=>({session:e.context.session}));var F=require("zod");var R=require("zod"),st=R.z.enum(["admin","member","owner"]),an=R.z.enum(["pending","accepted","rejected","canceled"]).default("pending"),eu=R.z.object({id:R.z.string(),name:R.z.string(),slug:R.z.string(),logo:R.z.string().nullish(),metadata:R.z.record(R.z.string()).or(R.z.string().transform(e=>JSON.parse(e))).nullish(),createdAt:R.z.date()}),tu=R.z.object({id:R.z.string(),organizationId:R.z.string(),userId:R.z.string(),role:st,createdAt:R.z.date()}),ru=R.z.object({id:R.z.string(),organizationId:R.z.string(),email:R.z.string(),role:st,status:an,inviterId:R.z.string(),expiresAt:R.z.date()});var I=require("better-call"),_r=c("/organization/invite-member",{method:"POST",use:[x,D],body:F.z.object({email:F.z.string(),role:st,organizationId:F.z.string().optional(),resend:F.z.boolean().optional()})},async e=>{if(!e.context.orgOptions.sendInvitationEmail)throw y.warn("Invitation email is not enabled. Pass `sendInvitationEmail` to the plugin options to enable it."),new I.APIError("BAD_REQUEST",{message:"Invitation email is not enabled"});let o=e.context.session,r=e.body.organizationId||o.session.activeOrganizationId;if(!r)throw new I.APIError("BAD_REQUEST",{message:"Organization not found"});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)throw new I.APIError("BAD_REQUEST",{message:"Member not found!"});let i=e.context.roles[n.role];if(!i)throw new I.APIError("BAD_REQUEST",{message:"Role not found!"});if(i.authorize({invitation:["create"]}).error)throw new I.APIError("FORBIDDEN",{message:"You are not allowed to invite members"});if(await t.findMemberByEmail({email:e.body.email,organizationId:r}))throw new I.APIError("BAD_REQUEST",{message:"User is already a member of this organization"});if((await t.findPendingInvitation({email:e.body.email,organizationId:r})).length&&!e.body.resend)throw new I.APIError("BAD_REQUEST",{message:"User is already invited to this organization"});let u=await t.createInvitation({invitation:{role:e.body.role,email:e.body.email,organizationId:r},user:o.user}),l=await t.findOrganizationById(r);if(!l)throw new I.APIError("BAD_REQUEST",{message:"Organization not found"});return await e.context.orgOptions.sendInvitationEmail?.({id:u.id,role:u.role,email:u.email,organization:l,inviter:{...n,user:o.user}},e.request),e.json(u)}),Cr=c("/organization/accept-invitation",{method:"POST",body:F.z.object({invitationId:F.z.string()}),use:[x,D]},async e=>{let o=e.context.session,r=C(e.context,e.context.orgOptions),t=await r.findInvitationById(e.body.invitationId);if(!t||t.expiresAt<new Date||t.status!=="pending")throw new I.APIError("BAD_REQUEST",{message:"Invitation not found!"});if(t.email!==o.user.email)throw new I.APIError("FORBIDDEN",{message:"You are not the recipient of the invitation"});let n=await r.updateInvitation({invitationId:e.body.invitationId,status:"accepted"}),i=await r.createMember({id:z(),organizationId:t.organizationId,userId:o.user.id,role:t.role,createdAt:new Date});return await r.setActiveOrganization(o.session.id,t.organizationId),n?e.json({invitation:n,member:i}):e.json(null,{status:400,body:{message:"Invitation not found!"}})}),zr=c("/organization/reject-invitation",{method:"POST",body:F.z.object({invitationId:F.z.string()}),use:[x,D]},async e=>{let o=e.context.session,r=C(e.context,e.context.orgOptions),t=await r.findInvitationById(e.body.invitationId);if(!t||t.expiresAt<new Date||t.status!=="pending")throw new I.APIError("BAD_REQUEST",{message:"Invitation not found!"});if(t.email!==o.user.email)throw new I.APIError("FORBIDDEN",{message:"You are not the recipient of the invitation"});let n=await r.updateInvitation({invitationId:e.body.invitationId,status:"rejected"});return e.json({invitation:n,member:null})}),Br=c("/organization/cancel-invitation",{method:"POST",body:F.z.object({invitationId:F.z.string()}),use:[x,D]},async e=>{let o=e.context.session,r=C(e.context,e.context.orgOptions),t=await r.findInvitationById(e.body.invitationId);if(!t)throw new I.APIError("BAD_REQUEST",{message:"Invitation not found!"});let n=await r.findMemberByOrgId({userId:o.user.id,organizationId:t.organizationId});if(!n)throw new I.APIError("BAD_REQUEST",{message:"Member not found!"});if(e.context.roles[n.role].authorize({invitation:["cancel"]}).error)throw new I.APIError("FORBIDDEN",{message:"You are not allowed to cancel this invitation"});let s=await r.updateInvitation({invitationId:e.body.invitationId,status:"canceled"});return e.json(s)}),xr=c("/organization/get-invitation",{method:"GET",use:[x],requireHeaders:!0,query:F.z.object({id:F.z.string()})},async e=>{let o=await B(e);if(!o)throw new I.APIError("UNAUTHORIZED",{message:"Not authenticated"});let r=C(e.context,e.context.orgOptions),t=await r.findInvitationById(e.query.id);if(!t||t.status!=="pending"||t.expiresAt<new Date)throw new I.APIError("BAD_REQUEST",{message:"Invitation not found!"});if(t.email!==o.user.email)throw new I.APIError("FORBIDDEN",{message:"You are not the recipient of the invitation"});let n=await r.findOrganizationById(t.organizationId);if(!n)throw new I.APIError("BAD_REQUEST",{message:"Organization not found"});let i=await r.findMemberByOrgId({userId:t.inviterId,organizationId:t.organizationId});if(!i)throw new I.APIError("BAD_REQUEST",{message:"Inviter is no longer a member of the organization"});return e.json({...t,organizationName:n.name,organizationSlug:n.slug,inviterEmail:i.user.email})});var se=require("zod");var Se=require("better-call"),Lr=c("/organization/remove-member",{method:"POST",body:se.z.object({memberIdOrEmail:se.z.string(),organizationId:se.z.string().optional()}),use:[x,D]},async e=>{let o=e.context.session,r=e.body.organizationId||o.session.activeOrganizationId;if(!r)return e.json(null,{status:400,body:{message:"No active organization found!"}});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)throw new Se.APIError("BAD_REQUEST",{message:"Member not found!"});let i=e.context.roles[n.role];if(!i)throw new Se.APIError("BAD_REQUEST",{message:"Role not found!"});let s=o.user.email===e.body.memberIdOrEmail||n.id===e.body.memberIdOrEmail;if(s&&n.role===(e.context.orgOptions?.creatorRole||"owner"))throw new Se.APIError("BAD_REQUEST",{message:"You cannot leave the organization as the owner"});if(!(s||i.authorize({member:["delete"]}).success))throw new Se.APIError("UNAUTHORIZED",{message:"You are not allowed to delete this member"});let u=null;if(e.body.memberIdOrEmail.includes("@")?u=await t.findMemberByEmail({email:e.body.memberIdOrEmail,organizationId:r}):u=await t.findMemberById(e.body.memberIdOrEmail),u?.organizationId!==r)throw new Se.APIError("BAD_REQUEST",{message:"Member not found!"});return await t.deleteMember(u.id),o.user.id===u.userId&&o.session.activeOrganizationId===u.organizationId&&await t.setActiveOrganization(o.session.id,null),e.json({member:u})}),Dr=c("/organization/update-member-role",{method:"POST",body:se.z.object({role:se.z.enum(["admin","member","owner"]),memberId:se.z.string(),organizationId:se.z.string().optional()}),use:[x,D]},async e=>{let o=e.context.session,r=e.body.organizationId||o.session.activeOrganizationId;if(!r)return e.json(null,{status:400,body:{message:"No active organization found!"}});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)return e.json(null,{status:400,body:{message:"Member not found!"}});let i=e.context.roles[n.role];if(!i)return e.json(null,{status:400,body:{message:"Role not found!"}});if(i.authorize({member:["update"]}).error||e.body.role==="owner"&&n.role!=="owner")return e.json(null,{body:{message:"You are not allowed to update this member"},status:403});let a=await t.updateMember(e.body.memberId,e.body.role);return a?e.json(a):e.json(null,{status:400,body:{message:"Member not found!"}})}),jr=c("/organization/get-active-member",{method:"GET",use:[x,D]},async e=>{let o=e.context.session,r=o.session.activeOrganizationId;if(!r)return e.json(null,{status:400,body:{message:"No active organization found!"}});let n=await C(e.context,e.context.orgOptions).findMemberByOrgId({userId:o.user.id,organizationId:r});return n?e.json(n):e.json(null,{status:400,body:{message:"Member not found!"}})});var T=require("zod");var ae=require("better-call"),Nr=c("/organization/create",{method:"POST",body:T.z.object({name:T.z.string(),slug:T.z.string(),userId:T.z.string().optional(),logo:T.z.string().optional(),metadata:T.z.record(T.z.string()).optional()}),use:[x,D]},async e=>{let o=e.context.session.user;if(!o)return e.json(null,{status:401});let r=e.context.orgOptions;if(!(typeof r?.allowUserToCreateOrganization=="function"?await r.allowUserToCreateOrganization(o):r?.allowUserToCreateOrganization===void 0?!0:r.allowUserToCreateOrganization))throw new ae.APIError("FORBIDDEN",{message:"You are not allowed to create an organization"});let n=C(e.context,r),i=await n.listOrganizations(o.id);if(typeof r.organizationLimit=="number"?i.length>=r.organizationLimit:typeof r.organizationLimit=="function"?await r.organizationLimit(o):!1)throw new ae.APIError("FORBIDDEN",{message:"You have reached the organization limit"});if(await n.findOrganizationBySlug(e.body.slug))throw new ae.APIError("BAD_REQUEST",{message:"Organization with this slug already exists"});let d=await n.createOrganization({organization:{id:z(),slug:e.body.slug,name:e.body.name,logo:e.body.logo,createdAt:new Date,metadata:e.body.metadata},user:o});return e.json(d)}),Vr=c("/organization/update",{method:"POST",body:T.z.object({data:T.z.object({name:T.z.string().optional(),slug:T.z.string().optional(),logo:T.z.string().optional()}).partial(),organizationId:T.z.string().optional()}),requireHeaders:!0,use:[x]},async e=>{let o=await e.context.getSession(e);if(!o)throw new ae.APIError("UNAUTHORIZED",{message:"User not found"});let r=e.body.organizationId||o.session.activeOrganizationId;if(!r)return e.json(null,{status:400,body:{message:"Organization id not found!"}});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)return e.json(null,{status:400,body:{message:"User is not a member of this organization!"}});let i=e.context.roles[n.role];if(!i)return e.json(null,{status:400,body:{message:"Role not found!"}});if(i.authorize({organization:["update"]}).error)return e.json(null,{body:{message:"You are not allowed to update this organization"},status:403});let a=await t.updateOrganization(r,e.body.data);return e.json(a)}),Fr=c("/organization/delete",{method:"POST",body:T.z.object({organizationId:T.z.string()}),requireHeaders:!0,use:[x]},async e=>{let o=await e.context.getSession(e);if(!o)return e.json(null,{status:401});let r=e.body.organizationId;if(!r)return e.json(null,{status:400,body:{message:"Organization id not found!"}});let t=C(e.context,e.context.orgOptions),n=await t.findMemberByOrgId({userId:o.user.id,organizationId:r});if(!n)return e.json(null,{status:400,body:{message:"User is not a member of this organization!"}});let i=e.context.roles[n.role];if(!i)return e.json(null,{status:400,body:{message:"Role not found!"}});if(i.authorize({organization:["delete"]}).error)throw new ae.APIError("FORBIDDEN",{message:"You are not allowed to delete this organization"});return r===o.session.activeOrganizationId&&await t.setActiveOrganization(o.session.id,null),await t.deleteOrganization(r),e.json(r)}),qr=c("/organization/get-full-organization",{method:"GET",query:T.z.optional(T.z.object({organizationId:T.z.string().optional()})),requireHeaders:!0,use:[x,D]},async e=>{let o=e.context.session,r=e.query?.organizationId||o.session.activeOrganizationId;if(!r)return e.json(null,{status:200});let n=await C(e.context,e.context.orgOptions).findFullOrganization(r,e.context.db||void 0);if(!n)throw new ae.APIError("BAD_REQUEST",{message:"Organization not found"});return e.json(n)}),Mr=c("/organization/set-active",{method:"POST",body:T.z.object({organizationId:T.z.string().nullable().optional()}),use:[D,x]},async e=>{let o=C(e.context,e.context.orgOptions),r=e.context.session,t=e.body.organizationId;if(t===null)return r.session.activeOrganizationId&&await o.setActiveOrganization(r.session.id,null),e.json(null);if(!t){let s=r.session.activeOrganizationId;if(!s)return e.json(null);t=s}if(!await o.findMemberByOrgId({userId:r.user.id,organizationId:t}))throw await o.setActiveOrganization(r.session.id,null),new ae.APIError("FORBIDDEN",{message:"You are not a member of this organization"});await o.setActiveOrganization(r.session.id,t);let i=await o.findFullOrganization(t,e.context.db||void 0);return e.json(i)}),$r=c("/organization/list",{method:"GET",use:[x,D]},async e=>{let r=await C(e.context,e.context.orgOptions).listOrganizations(e.context.session.user.id);return e.json(r)});var dn=e=>{let o={createOrganization:Nr,updateOrganization:Vr,deleteOrganization:Fr,setActiveOrganization:Mr,getFullOrganization:qr,listOrganization:$r,createInvitation:_r,cancelInvitation:Br,acceptInvitation:Cr,getInvitation:xr,rejectInvitation:zr,removeMember:Lr,updateMemberRole:Dr,getActiveMember:jr},r={...Pr,...e?.roles};return{id:"organization",endpoints:{...Sr(o,{orgOptions:e||{},roles:r,getSession:async n=>await B(n)}),hasPermission:c("/organization/has-permission",{method:"POST",requireHeaders:!0,body:Pe.z.object({permission:Pe.z.record(Pe.z.string(),Pe.z.array(Pe.z.string()))}),use:[D]},async n=>{if(!n.context.session.session.activeOrganizationId)throw new vt.APIError("BAD_REQUEST",{message:"No active organization"});let s=await C(n.context).findMemberByOrgId({userId:n.context.session.user.id,organizationId:n.context.session.session.activeOrganizationId||""});if(!s)throw new vt.APIError("UNAUTHORIZED",{message:"You are not a member of this organization"});let d=r[s.role].authorize(n.body.permission);return d.error?n.json({error:d.error,success:!1},{status:403}):n.json({error:null,success:!0})})},schema:{session:{fields:{activeOrganizationId:{type:"string",required:!1,fieldName:e?.schema?.session?.fields?.activeOrganizationId}}},organization:{fields:{name:{type:"string",required:!0,fieldName:e?.schema?.organization?.fields?.name},slug:{type:"string",unique:!0,fieldName:e?.schema?.organization?.fields?.slug},logo:{type:"string",required:!1,fieldName:e?.schema?.organization?.fields?.logo},createdAt:{type:"date",required:!0,fieldName:e?.schema?.organization?.fields?.createdAt},metadata:{type:"string",required:!1,fieldName:e?.schema?.organization?.fields?.metadata}}},member:{fields:{organizationId:{type:"string",required:!0,references:{model:"organization",field:"id"},fieldName:e?.schema?.member?.fields?.organizationId},userId:{type:"string",required:!0,fieldName:e?.schema?.member?.fields?.userId},role:{type:"string",required:!0,defaultValue:"member",fieldName:e?.schema?.member?.fields?.role},createdAt:{type:"date",required:!0,fieldName:e?.schema?.member?.fields?.createdAt}}},invitation:{fields:{organizationId:{type:"string",required:!0,references:{model:"organization",field:"id"},fieldName:e?.schema?.invitation?.fields?.organizationId},email:{type:"string",required:!0,fieldName:e?.schema?.invitation?.fields?.email},role:{type:"string",required:!1,fieldName:e?.schema?.invitation?.fields?.role},status:{type:"string",required:!0,defaultValue:"pending",fieldName:e?.schema?.invitation?.fields?.status},expiresAt:{type:"date",required:!0,fieldName:e?.schema?.invitation?.fields?.expiresAt},inviterId:{type:"string",references:{model:"user",field:"id"},fieldName:e?.schema?.invitation?.fields?.inviterId,required:!0}}}},$Infer:{Organization:{},Invitation:{},Member:{},ActiveOrganization:{}}}};var Rt=Nt(require("uncrypto"),1);function un(e){return e.toString(2).padStart(8,"0")}function cn(e){return[...e].map(o=>un(o)).join("")}function Qr(e){return parseInt(cn(e),2)}function ln(e){if(e<0||!Number.isInteger(e))throw new Error("Argument 'max' must be an integer greater than or equal to 0");let o=(e-1).toString(2).length,r=o%8,t=new Uint8Array(Math.ceil(o/8));Rt.default.getRandomValues(t),r!==0&&(t[0]&=(1<<r)-1);let n=Qr(t);for(;n>=e;)Rt.default.getRandomValues(t),r!==0&&(t[0]&=(1<<r)-1),n=Qr(t);return n}function q(e,o){let r="";for(let t=0;t<e;t++)r+=o[ln(o.length)];return r}function M(...e){let o=new Set(e),r="";for(let t of o)t==="a-z"?r+="abcdefghijklmnopqrstuvwxyz":t==="A-Z"?r+="ABCDEFGHIJKLMNOPQRSTUVWXYZ":t==="0-9"?r+="0123456789":r+=t;return r}var $e=require("zod");var Et=require("@noble/ciphers/chacha"),_e=require("@noble/ciphers/utils"),It=require("@noble/ciphers/webcrypto"),Tt=require("oslo/crypto"),Ut=Nt(require("uncrypto"),1);var Hr=require("oslo/encoding");var mn=require("@noble/hashes/scrypt"),pn=require("uncrypto");async function Ve(e,o){let r=new TextEncoder,t={name:"HMAC",hash:"SHA-256"},n=await Ut.default.subtle.importKey("raw",r.encode(e),t,!1,["sign","verify"]),i=await Ut.default.subtle.sign(t.name,n,r.encode(o));return btoa(String.fromCharCode(...new Uint8Array(i)))}var re=async({key:e,data:o})=>{let r=await(0,Tt.sha256)(new TextEncoder().encode(e)),t=(0,_e.utf8ToBytes)(o),n=(0,It.managedNonce)(Et.xchacha20poly1305)(new Uint8Array(r));return(0,_e.bytesToHex)(n.encrypt(t))},de=async({key:e,data:o})=>{let r=await(0,Tt.sha256)(new TextEncoder().encode(e)),t=(0,_e.hexToBytes)(o),n=(0,It.managedNonce)(Et.xchacha20poly1305)(new Uint8Array(r));return new TextDecoder().decode(n.decrypt(t))};var K=require("zod");var Ce=require("better-call");var at="two_factor";var dt="trust_device";var St=require("zod");var we=S({body:St.z.object({trustDevice:St.z.boolean().optional()})},async e=>{let o=await B(e);if(!o){let r=e.context.createAuthCookie(at),t=await e.getSignedCookie(r.name,e.context.secret);if(!t)throw new Ce.APIError("UNAUTHORIZED",{message:"invalid two factor cookie"});let n=await e.context.internalAdapter.findUserById(t);if(!n)throw new Ce.APIError("UNAUTHORIZED",{message:"invalid two factor cookie"});let i=await e.context.internalAdapter.createSession(t,e.request);if(!i)throw new Ce.APIError("INTERNAL_SERVER_ERROR",{message:"failed to create session"});return{valid:async()=>{if(await w(e,{session:i,user:n}),e.body.trustDevice){let s=e.context.createAuthCookie(dt,{maxAge:2592e3}),a=await Ve(e.context.secret,`${n.id}!${i.id}`);await e.setSignedCookie(s.name,`${a}!${i.id}`,e.context.secret,s.attributes)}return e.json({session:i,user:n})},invalid:async()=>{throw new Ce.APIError("UNAUTHORIZED",{message:"invalid two factor authentication"})},session:{id:i.id,userId:i.userId,expiresAt:i.expiresAt,user:n}}}return{valid:async()=>e.json({session:o,user:o.user}),invalid:async()=>{throw new Ce.APIError("UNAUTHORIZED",{message:"invalid two factor authentication"})},session:o}});var ze=require("better-call");function fn(e){return Array.from({length:e?.amount??10}).fill(null).map(()=>q(e?.length??10,M("a-z","0-9"))).map(o=>`${o.slice(0,5)}-${o.slice(5)}`)}async function Pt(e,o){let r=e,t=o?.customBackupCodesGenerate?o.customBackupCodesGenerate():fn(),n=await re({data:JSON.stringify(t),key:r});return{backupCodes:t,encryptedBackupCodes:n}}async function gn(e,o){let r=await Wr(e.backupCodes,o);return r?{status:r.includes(e.code),updated:r.filter(t=>t!==e.code)}:{status:!1,updated:null}}async function Wr(e,o){let r=Buffer.from(await de({key:o,data:e})).toString("utf-8"),t=JSON.parse(r),n=K.z.array(K.z.string()).safeParse(t);return n.success?n.data:null}var Gr=(e,o)=>({id:"backup_code",endpoints:{verifyBackupCode:c("/two-factor/verify-backup-code",{method:"POST",body:K.z.object({code:K.z.string(),disableSession:K.z.boolean().optional()}),use:[we]},async r=>{let t=r.context.session.user,n=await r.context.adapter.findOne({model:o,where:[{field:"userId",value:t.id}]});if(!n)throw new ze.APIError("BAD_REQUEST",{message:"Backup codes aren't enabled"});let i=await gn({backupCodes:n.backupCodes,code:r.body.code},r.context.secret);if(!i.status)throw new ze.APIError("UNAUTHORIZED",{message:"Invalid backup code"});let s=await re({key:r.context.secret,data:JSON.stringify(i.updated)});return await r.context.adapter.update({model:o,update:{backupCodes:s},where:[{field:"userId",value:t.id}]}),r.body.disableSession||await w(r,{session:r.context.session,user:t}),r.json({user:t,session:r.context.session})}),generateBackupCodes:c("/two-factor/generate-backup-codes",{method:"POST",body:K.z.object({password:K.z.string()}),use:[b]},async r=>{let t=r.context.session.user;if(!t.twoFactorEnabled)throw new ze.APIError("BAD_REQUEST",{message:"Two factor isn't enabled"});await r.context.password.checkPassword(t.id,r);let n=await Pt(r.context.secret,e);return await r.context.adapter.update({model:o,update:{backupCodes:n.encryptedBackupCodes},where:[{field:"userId",value:r.context.session.user.id}]}),r.json({status:!0,backupCodes:n.backupCodes})}),viewBackupCodes:c("/two-factor/view-backup-codes",{method:"GET",body:K.z.object({userId:K.z.string()}),metadata:{SERVER_ONLY:!0}},async r=>{let t=await r.context.adapter.findOne({model:o,where:[{field:"userId",value:r.body.userId}]});if(!t)throw new ze.APIError("BAD_REQUEST",{message:"Backup codes aren't enabled"});let n=await Wr(t.backupCodes,r.context.secret);if(!n)throw new ze.APIError("BAD_REQUEST",{message:"Backup codes aren't enabled"});return r.json({status:!0,backupCodes:n})})}});var Fe=require("better-call"),Jr=require("oslo/otp"),_t=require("zod");var Kr=require("oslo"),Zr=(e,o)=>{let r={...e,period:new Kr.TimeSpan(e?.period||3,"m")},t=new Jr.TOTPController({digits:6,period:r.period}),n=c("/two-factor/send-otp",{method:"POST",use:[we]},async s=>{if(!e||!e.sendOTP)throw s.context.logger.error("send otp isn't configured. Please configure the send otp function on otp options."),new Fe.APIError("BAD_REQUEST",{message:"otp isn't configured"});let a=s.context.session.user,d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d)throw new Fe.APIError("BAD_REQUEST",{message:"OTP isn't enabled"});let u=await t.generate(Buffer.from(d.secret));return await e.sendOTP({user:a,otp:u},s.request),s.json({status:!0})}),i=c("/two-factor/verify-otp",{method:"POST",body:_t.z.object({code:_t.z.string()}),use:[we]},async s=>{let a=s.context.session.user;if(!a.twoFactorEnabled)throw new Fe.APIError("BAD_REQUEST",{message:"two factor isn't enabled"});let d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d)throw new Fe.APIError("BAD_REQUEST",{message:"OTP isn't enabled"});return await t.generate(Buffer.from(d.secret))===s.body.code?s.context.valid():s.context.invalid()});return{id:"otp",endpoints:{send2FaOTP:n,verifyOTP:i}}};var ye=require("better-call"),Yr=require("oslo"),Me=require("oslo/otp"),qe=require("zod");var Xr=(e,o)=>{let r={...e,digits:6,period:new Yr.TimeSpan(e?.period||30,"s")},t=c("/totp/generate",{method:"POST",use:[b]},async s=>{if(!e)throw s.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp"),new ye.APIError("BAD_REQUEST",{message:"totp isn't configured"});let a=s.context.session.user,d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d)throw new ye.APIError("BAD_REQUEST",{message:"totp isn't enabled"});return{code:await new Me.TOTPController(r).generate(Buffer.from(d.secret))}}),n=c("/two-factor/get-totp-uri",{method:"POST",use:[b],body:qe.z.object({password:qe.z.string()})},async s=>{if(!e)throw s.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp"),new ye.APIError("BAD_REQUEST",{message:"totp isn't configured"});let a=s.context.session.user,d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d||!a.twoFactorEnabled)throw new ye.APIError("BAD_REQUEST",{message:"totp isn't enabled"});return await s.context.password.checkPassword(a.id,s),{totpURI:(0,Me.createTOTPKeyURI)(e?.issuer||"BetterAuth",a.email,Buffer.from(d.secret),r)}}),i=c("/two-factor/verify-totp",{method:"POST",body:qe.z.object({code:qe.z.string()}),use:[we]},async s=>{if(!e)throw s.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp"),new ye.APIError("BAD_REQUEST",{message:"totp isn't configured"});let a=s.context.session.user,d=await s.context.adapter.findOne({model:o,where:[{field:"userId",value:a.id}]});if(!d)throw new ye.APIError("BAD_REQUEST",{message:"totp isn't enabled"});let u=new Me.TOTPController(r),l=await de({key:s.context.secret,data:d.secret}),m=Buffer.from(l);if(!await u.verify(s.body.code,m))return s.context.invalid();if(!a.twoFactorEnabled){let p=await s.context.internalAdapter.updateUser(a.id,{twoFactorEnabled:!0}),h=await s.context.internalAdapter.createSession(a.id,s.request);await w(s,{session:h,user:p})}return s.context.valid()});return{id:"totp",endpoints:{generateTOTP:t,viewTOTPURI:n,verifyTOTP:i}}};var hn=require("better-call");async function Ct(e,o){let t=(await e.context.internalAdapter.findAccounts(o.userId))?.find(s=>s.providerId==="credential"),n=t?.password;return!t||!n?!1:await e.context.password.verify(n,o.password)}var ut=require("better-call"),eo=require("oslo/otp"),to=require("oslo");var wn=(e={redirect:!0,twoFactorPage:"/"})=>({id:"two-factor",$InferServerPlugin:{},atomListeners:[{matcher:o=>o.startsWith("/two-factor/"),signal:"$sessionSignal"}],pathMethods:{"/two-factor/disable":"POST","/two-factor/enable":"POST","/two-factor/send-otp":"POST","/two-factor/generate-backup-codes":"POST"},fetchPlugins:[{id:"two-factor",name:"two-factor",hooks:{async onSuccess(o){o.data?.twoFactorRedirect&&(e.redirect||e.twoFactorPage)&&typeof window<"u"&&(window.location.href=e.twoFactorPage)}}}]});var yn=e=>{let o={twoFactorTable:e?.twoFactorTable||"twoFactor"},r=Xr({issuer:e?.issuer||"better-auth",...e?.totpOptions},o.twoFactorTable),t=Gr({...e?.backupCodeOptions},o.twoFactorTable),n=Zr({...e?.otpOptions},o.twoFactorTable);return{id:"two-factor",endpoints:{...r.endpoints,...n.endpoints,...t.endpoints,enableTwoFactor:c("/two-factor/enable",{method:"POST",body:$e.z.object({password:$e.z.string().min(8)}),use:[b]},async i=>{let s=i.context.session.user,{password:a}=i.body;if(!await Ct(i,{password:a,userId:s.id}))throw new ut.APIError("BAD_REQUEST",{message:"Invalid password"});let u=q(16,M("a-z","0-9","-")),l=await re({key:i.context.secret,data:u}),m=await Pt(i.context.secret,e?.backupCodeOptions);if(e?.skipVerificationOnEnable){let p=await i.context.internalAdapter.updateUser(s.id,{twoFactorEnabled:!0}),h=await i.context.internalAdapter.createSession(p.id,i.request);await w(i,{session:h,user:s})}await i.context.adapter.deleteMany({model:o.twoFactorTable,where:[{field:"userId",value:s.id}]}),await i.context.adapter.create({model:o.twoFactorTable,data:{id:i.context.uuid(),secret:l,backupCodes:m.encryptedBackupCodes,userId:s.id}});let f=(0,eo.createTOTPKeyURI)(e?.issuer||"BetterAuth",s.email,Buffer.from(u),{digits:e?.totpOptions?.digits||6,period:new to.TimeSpan(e?.totpOptions?.period||30,"s")});return i.json({totpURI:f,backupCodes:m.backupCodes})}),disableTwoFactor:c("/two-factor/disable",{method:"POST",body:$e.z.object({password:$e.z.string().min(8)}),use:[b]},async i=>{let s=i.context.session.user,{password:a}=i.body;if(!await Ct(i,{password:a,userId:s.id}))throw new ut.APIError("BAD_REQUEST",{message:"Invalid password"});return await i.context.internalAdapter.updateUser(s.id,{twoFactorEnabled:!1}),await i.context.adapter.delete({model:o.twoFactorTable,where:[{field:"userId",value:s.id}]}),i.json({status:!0})})},options:e,hooks:{after:[{matcher(i){return i.path==="/sign-in/email"||i.path==="/sign-in/username"},handler:S(async i=>{let s=i.context.returned;if(s instanceof Response&&s?.status!==200||s instanceof ut.APIError)return;let a=s instanceof Response?await s.clone().json():s;if(!a.user.twoFactorEnabled)return;let d=i.context.createAuthCookie(dt,{maxAge:30*24*60*60}),u=await i.getSignedCookie(d.name,i.context.secret);if(u){let[f,p]=u.split("!"),h=await Ve(i.context.secret,`${a.user.id}!${p}`);if(f===h){let k=await Ve(i.context.secret,`${a.user.id}!${a.session.id}`);await i.setSignedCookie(d.name,`${k}!${a.session.id}`,i.context.secret,d.attributes);return}}J(i),await i.context.internalAdapter.deleteSession(a.session.id);let l=i.context.createAuthCookie(at,{maxAge:60*10});return await i.setSignedCookie(l.name,a.user.id,i.context.secret,l.attributes),{response:new Response(JSON.stringify({twoFactorRedirect:!0}),{headers:i.responseHeader})}})}]},schema:{user:{fields:{twoFactorEnabled:{type:"boolean",required:!1,defaultValue:!1,input:!1}}},twoFactor:{tableName:o.twoFactorTable,fields:{secret:{type:"string",required:!0,returned:!1},backupCodes:{type:"string",required:!0,returned:!1},userId:{type:"string",required:!0,returned:!1,references:{model:"user",field:"id"}}}}},rateLimit:[{pathMatcher(i){return i.startsWith("/two-factor/")},window:10,max:3}]}};var ue=require("@simplewebauthn/server"),H=require("better-call");var Z=require("zod");var Be=require("@simplewebauthn/browser");var An=require("@better-fetch/fetch");var Lc=require("nanostores");var Rc=require("@better-fetch/fetch");var bn=require("nanostores");var Ec=require("@better-fetch/fetch"),ct=require("nanostores"),zt=(e,o,r,t)=>{let n=(0,ct.atom)({data:null,error:null,isPending:!0,isRefetching:!1}),i=()=>{let a=typeof t=="function"?t({data:n.get().data,error:n.get().error,isPending:n.get().isPending}):t;return r(o,{...a,onSuccess:async d=>{n.set({data:d.data,error:null,isPending:!1,isRefetching:!1}),await a?.onSuccess?.(d)},async onError(d){n.set({error:d.error,data:null,isPending:!1,isRefetching:!1}),await a?.onError?.(d)},async onRequest(d){let u=n.get();n.set({isPending:u.data===null,data:u.data,error:null,isRefetching:!0}),await a?.onRequest?.(d)}})};e=Array.isArray(e)?e:[e];let s=!1;for(let a of e)a.subscribe(()=>{s?i():(0,ct.onMount)(n,()=>(i(),s=!0,()=>{n.off(),a.off()}))});return n};var ro=require("nanostores"),oo=(e,{$listPasskeys:o})=>({signIn:{passkey:async(n,i)=>{let s=await e("/passkey/generate-authenticate-options",{method:"POST",body:{email:n?.email}});if(!s.data)return s;try{let a=await(0,Be.startAuthentication)(s.data,n?.autoFill||!1),d=await e("/passkey/verify-authentication",{body:{response:a},...n?.fetchOptions,...i,method:"POST"});if(!d.data)return d}catch{return{data:null,error:{message:"auth cancelled",status:400,statusText:"BAD_REQUEST"}}}}},passkey:{addPasskey:async(n,i)=>{let s=await e("/passkey/generate-register-options",{method:"GET"});if(!s.data)return s;try{let a=await(0,Be.startRegistration)(s.data),d=await e("/passkey/verify-registration",{...n?.fetchOptions,...i,body:{response:a,name:n?.name},method:"POST"});if(!d.data)return d;o.set(Math.random())}catch(a){return a instanceof Be.WebAuthnError?a.code==="ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED"?{data:null,error:{message:"previously registered",status:400,statusText:"BAD_REQUEST"}}:a.code==="ERROR_CEREMONY_ABORTED"?{data:null,error:{message:"registration cancelled",status:400,statusText:"BAD_REQUEST"}}:{data:null,error:{message:a.message,status:400,statusText:"BAD_REQUEST"}}:{data:null,error:{message:a instanceof Error?a.message:"unknown error",status:500,statusText:"INTERNAL_SERVER_ERROR"}}}}},$Infer:{}}),kn=()=>{let e=(0,ro.atom)();return{id:"passkey",$InferServerPlugin:{},getActions:o=>oo(o,{$listPasskeys:e}),getAtoms(o){return{listPasskeys:zt(e,"/passkey/list-user-passkeys",o,{method:"GET"}),$listPasskeys:e}},pathMethods:{"/passkey/register":"POST","/passkey/authenticate":"POST"},atomListeners:[{matcher(o){return o==="/passkey/verify-registration"||o==="/passkey/delete-passkey"},signal:"_listPasskeys"}]}};var On=e=>{let o=G.BETTER_AUTH_URL,r=e?.rpID||o?.replace("http://","").replace("https://","").split(":")[0]||"localhost";if(!r)throw new W("passkey rpID not found. Please provide a rpID in the options or set the BETTER_AUTH_URL environment variable.");let t={origin:null,...e,rpID:r,advanced:{webAuthnChallengeCookie:"better-auth-passkey",...e?.advanced}},n=new Date(Date.now()+1e3*60*5),i=new Date,s=Math.floor((n.getTime()-i.getTime())/1e3);return{id:"passkey",endpoints:{generatePasskeyRegistrationOptions:c("/passkey/generate-register-options",{method:"GET",use:[b],metadata:{client:!1}},async a=>{let d=a.context.session,u=await a.context.adapter.findMany({model:"passkey",where:[{field:"userId",value:d.user.id}]}),l=new Uint8Array(Buffer.from(q(32,M("a-z","0-9")))),m;m=await(0,ue.generateRegistrationOptions)({rpName:t.rpName||a.context.appName,rpID:t.rpID,userID:l,userName:d.user.email||d.user.id,attestationType:"none",excludeCredentials:u.map(p=>({id:p.id,transports:p.transports?.split(",")})),authenticatorSelection:{residentKey:"preferred",userVerification:"preferred",authenticatorAttachment:"platform"}});let f=z();return await a.setSignedCookie(t.advanced.webAuthnChallengeCookie,f,a.context.secret,{secure:!0,httpOnly:!0,sameSite:"lax",maxAge:s}),await a.context.internalAdapter.createVerificationValue({identifier:f,value:JSON.stringify({expectedChallenge:m.challenge,userData:{id:d.user.id}}),expiresAt:n}),a.json(m,{status:200})}),generatePasskeyAuthenticationOptions:c("/passkey/generate-authenticate-options",{method:"POST",body:Z.z.object({email:Z.z.string().optional()}).optional()},async a=>{let d=await B(a),u=[];d&&(u=await a.context.adapter.findMany({model:"passkey",where:[{field:"userId",value:d.user.id}]}));let l=await(0,ue.generateAuthenticationOptions)({rpID:t.rpID,userVerification:"preferred",...u.length?{allowCredentials:u.map(p=>({id:p.id,transports:p.transports?.split(",")}))}:{}}),m={expectedChallenge:l.challenge,userData:{id:d?.user.id||""}},f=z();return await a.setSignedCookie(t.advanced.webAuthnChallengeCookie,f,a.context.secret,{secure:!0,httpOnly:!0,sameSite:"lax",maxAge:s}),await a.context.internalAdapter.createVerificationValue({identifier:f,value:JSON.stringify(m),expiresAt:n}),a.json(l,{status:200})}),verifyPasskeyRegistration:c("/passkey/verify-registration",{method:"POST",body:Z.z.object({response:Z.z.any(),name:Z.z.string().optional()}),use:[b]},async a=>{let d=e?.origin||a.headers?.get("origin")||"";if(!d)return a.json(null,{status:400});let u=a.body.response,l=await a.getSignedCookie(t.advanced.webAuthnChallengeCookie,a.context.secret);if(!l)throw new H.APIError("BAD_REQUEST",{message:"Challenge not found"});let m=await a.context.internalAdapter.findVerificationValue(l);if(!m)return a.json(null,{status:400});let{expectedChallenge:f,userData:p}=JSON.parse(m.value);if(p.id!==a.context.session.user.id)throw new H.APIError("UNAUTHORIZED",{message:"You are not authorized to register this passkey"});try{let h=await(0,ue.verifyRegistrationResponse)({response:u,expectedChallenge:f,expectedOrigin:d,expectedRPID:e?.rpID}),{verified:k,registrationInfo:U}=h;if(!k||!U)return a.json(null,{status:400});let{credentialID:ee,credentialPublicKey:Ae,counter:N,credentialDeviceType:pt,credentialBackedUp:ke}=U,le=Buffer.from(Ae).toString("base64"),ft=z(),co={name:a.body.name,userId:p.id,webauthnUserID:ft,id:ee,publicKey:le,counter:N,deviceType:pt,transports:u.response.transports.join(","),backedUp:ke,createdAt:new Date},lo=await a.context.adapter.create({model:"passkey",data:co});return a.json(lo,{status:200})}catch(h){throw console.log(h),new H.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to verify registration"})}}),verifyPasskeyAuthentication:c("/passkey/verify-authentication",{method:"POST",body:Z.z.object({response:Z.z.any()})},async a=>{let d=e?.origin||a.headers?.get("origin")||"";if(!d)throw new H.APIError("BAD_REQUEST",{message:"origin missing"});let u=a.body.response,l=await a.getSignedCookie(t.advanced.webAuthnChallengeCookie,a.context.secret);if(!l)throw new H.APIError("BAD_REQUEST",{message:"Challenge not found"});let m=await a.context.internalAdapter.findVerificationValue(l);if(!m)throw new H.APIError("BAD_REQUEST",{message:"Challenge not found"});let{expectedChallenge:f}=JSON.parse(m.value),p=await a.context.adapter.findOne({model:"passkey",where:[{field:"id",value:u.id}]});if(!p)throw new H.APIError("UNAUTHORIZED",{message:"Passkey not found"});try{let h=await(0,ue.verifyAuthenticationResponse)({response:u,expectedChallenge:f,expectedOrigin:d,expectedRPID:t.rpID,authenticator:{credentialID:p.id,credentialPublicKey:new Uint8Array(Buffer.from(p.publicKey,"base64")),counter:p.counter,transports:p.transports?.split(",")}}),{verified:k}=h;if(!k)throw new H.APIError("UNAUTHORIZED",{message:"Authentication failed"});await a.context.adapter.update({model:"passkey",where:[{field:"id",value:p.id}],update:{counter:h.authenticationInfo.newCounter}});let U=await a.context.internalAdapter.createSession(p.userId,a.request);if(!U)throw new H.APIError("INTERNAL_SERVER_ERROR",{message:"Unable to create session"});let ee=await a.context.internalAdapter.findUserById(p.userId);if(!ee)throw new H.APIError("INTERNAL_SERVER_ERROR",{message:"User not found"});return await w(a,{session:U,user:ee}),a.json({session:U},{status:200})}catch(h){throw a.context.logger.error(h),new H.APIError("BAD_REQUEST",{message:"Failed to verify authentication"})}}),listPasskeys:c("/passkey/list-user-passkeys",{method:"GET",use:[b]},async a=>{let d=await a.context.adapter.findMany({model:"passkey",where:[{field:"userId",value:a.context.session.user.id}]});return a.json(d,{status:200})}),deletePasskey:c("/passkey/delete-passkey",{method:"POST",body:Z.z.object({id:Z.z.string()}),use:[b]},async a=>(await a.context.adapter.delete({model:"passkey",where:[{field:"id",value:a.body.id}]}),a.json(null,{status:200})))},schema:{passkey:{fields:{name:{type:"string",required:!1},publicKey:{type:"string",required:!0},userId:{type:"string",references:{model:"user",field:"id"},required:!0},webauthnUserID:{type:"string",required:!0},counter:{type:"number",required:!0},deviceType:{type:"string",required:!0},backedUp:{type:"boolean",required:!0},transports:{type:"string",required:!1},createdAt:{type:"date",defaultValue:new Date,required:!1}}}}}};var Qe=require("zod");var He=require("better-call"),Bt=()=>({id:"username",endpoints:{signInUsername:c("/sign-in/username",{method:"POST",body:Qe.z.object({username:Qe.z.string(),password:Qe.z.string(),rememberMe:Qe.z.boolean().optional()})},async e=>{let o=await e.context.adapter.findOne({model:e.context.tables.user.tableName,where:[{field:"username",value:e.body.username}]});if(!o)throw await e.context.password.hash(e.body.password),e.context.logger.error("User not found",{username:Bt}),new He.APIError("UNAUTHORIZED",{message:"Invalid username or password"});let r=await e.context.adapter.findOne({model:e.context.tables.account.tableName,where:[{field:e.context.tables.account.fields.userId.fieldName||"userId",value:o.id},{field:e.context.tables.account.fields.providerId.fieldName||"providerId",value:"credential"}]});if(!r)throw new He.APIError("UNAUTHORIZED",{message:"Invalid username or password"});let t=r?.password;if(!t)throw e.context.logger.error("Password not found",{username:Bt}),new He.APIError("UNAUTHORIZED",{message:"Unexpected error"});if(!await e.context.password.verify(t,e.body.password))throw e.context.logger.error("Invalid password"),new He.APIError("UNAUTHORIZED",{message:"Invalid username or password"});let i=await e.context.internalAdapter.createSession(o.id,e.request,e.body.rememberMe===!1);return i?(await e.setSignedCookie(e.context.authCookies.sessionToken.name,i.id,e.context.secret,e.body.rememberMe===!1?{...e.context.authCookies.sessionToken.options,maxAge:void 0}:e.context.authCookies.sessionToken.options),e.json({user:o,session:i})):e.json(null,{status:500,body:{message:"Failed to create session",status:500}})})},schema:{user:{fields:{username:{type:"string",required:!1,unique:!0,returned:!0}}}}});var no=require("better-call"),vn=()=>({id:"bearer",hooks:{before:[{matcher(e){return!!(e.request?.headers.get("authorization")||e.headers?.get("authorization"))},handler:async e=>{let o=e.request?.headers.get("authorization")?.replace("Bearer ","")||e.headers?.get("authorization")?.replace("Bearer ","");if(!o)return;let r="";return o.includes(".")?r=o:r=await(0,no.serializeSigned)("",o,e.context.secret),e.request&&e.request.headers.set("cookie",`${e.context.authCookies.sessionToken.name}=${r.replace("=","")}`),e.headers&&e.headers.set("cookie",`${e.context.authCookies.sessionToken.name}=${r.replace("=","")}`),{context:e}}}]}});var be=require("zod");var xt=require("better-call");var Rn=e=>({id:"magic-link",endpoints:{signInMagicLink:c("/sign-in/magic-link",{method:"POST",requireHeaders:!0,body:be.z.object({email:be.z.string().email(),callbackURL:be.z.string().optional()})},async o=>{let{email:r}=o.body;if(e.disableSignUp&&!await o.context.internalAdapter.findUserByEmail(r))throw new xt.APIError("BAD_REQUEST",{message:"User not found"});let t=q(32,M("a-z","A-Z"));await o.context.internalAdapter.createVerificationValue({identifier:t,value:r,expiresAt:new Date(Date.now()+(e.expiresIn||60*5)*1e3)});let n=`${o.context.baseURL}/magic-link/verify?token=${t}&callbackURL=${o.body.callbackURL||"/"}`;try{await e.sendMagicLink({email:r,url:n,token:t},o.request)}catch(i){throw o.context.logger.error("Failed to send magic link",i),new xt.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to send magic link"})}return o.json({status:!0})}),magicLinkVerify:c("/magic-link/verify",{method:"GET",query:be.z.object({token:be.z.string(),callbackURL:be.z.string().optional()}),requireHeaders:!0},async o=>{let{token:r,callbackURL:t}=o.query,n=t?.startsWith("http")?t:t?`${o.context.options.baseURL}${t}`:o.context.options.baseURL,i=await o.context.internalAdapter.findVerificationValue(r);if(!i)throw o.redirect(`${n}?error=INVALID_TOKEN`);if(i.expiresAt<new Date)throw await o.context.internalAdapter.deleteVerificationValue(i.id),o.redirect(`${n}?error=EXPIRED_TOKEN`);await o.context.internalAdapter.deleteVerificationValue(i.id);let s=i.value,a=await o.context.internalAdapter.findUserByEmail(s),d=a?.user.id||"";if(!a){if(e.disableSignUp)throw o.redirect(`${n}?error=USER_NOT_FOUND`);if(d=(await o.context.internalAdapter.createUser({email:s,emailVerified:!0,name:s})).id,!d)throw o.redirect(`${n}?error=USER_NOT_CREATED`)}let u=await o.context.internalAdapter.createSession(d,o.headers);if(!u)throw o.redirect(`${n}?error=SESSION_NOT_CREATED`);if(await w(o,{session:u,user:a?.user}),!t)return o.json({status:!0});throw o.redirect(t)})},rateLimit:[{pathMatcher(o){return o.startsWith("/sign-in/magic-link")||o.startsWith("/magic-link/verify")},window:e.rateLimit?.window||60,max:e.rateLimit?.max||5}]});var ce=require("zod");var oe=require("better-call");function Un(e){return q(e,M("0-9"))}var En=e=>{let o={phoneNumber:"phoneNumber",phoneNumberVerified:"phoneNumberVerified",code:"code",createdAt:"createdAt",expiresIn:e?.expiresIn||300,otpLength:e?.otpLength||6};return{id:"phone-number",endpoints:{sendPhoneNumberOTP:c("/phone-number/send-otp",{method:"POST",body:ce.z.object({phoneNumber:ce.z.string()})},async r=>{if(!e?.sendOTP)throw y.warn("sendOTP not implemented"),new oe.APIError("NOT_IMPLEMENTED",{message:"sendOTP not implemented"});let t=Un(o.otpLength);return await r.context.internalAdapter.createVerificationValue({value:t,identifier:r.body.phoneNumber,expiresAt:P(o.expiresIn,"sec")}),await e.sendOTP({phoneNumber:r.body.phoneNumber,code:t},r.request),r.json({code:t},{body:{message:"Code sent"}})}),verifyPhoneNumber:c("/phone-number/verify",{method:"POST",body:ce.z.object({phoneNumber:ce.z.string(),code:ce.z.string(),disableSession:ce.z.boolean().optional(),updatePhoneNumber:ce.z.boolean().optional()})},async r=>{let t=await r.context.internalAdapter.findVerificationValue(r.body.phoneNumber);if(!t||t.expiresAt<new Date)throw t&&t.expiresAt<new Date?(await r.context.internalAdapter.deleteVerificationValue(t.id),new oe.APIError("BAD_REQUEST",{message:"OTP expired"})):new oe.APIError("BAD_REQUEST",{message:"OTP not found"});if(t.value!==r.body.code)throw new oe.APIError("BAD_REQUEST",{message:"Invalid OTP"});if(await r.context.internalAdapter.deleteVerificationValue(t.id),r.body.updatePhoneNumber){let i=await B(r);if(!i)throw new oe.APIError("UNAUTHORIZED",{message:"Session not found"});let s=await r.context.internalAdapter.updateUser(i.user.id,{[o.phoneNumber]:r.body.phoneNumber,[o.phoneNumberVerified]:!0});return r.json({user:s,session:i.session})}let n=await r.context.adapter.findOne({model:r.context.tables.user.tableName,where:[{value:r.body.phoneNumber,field:o.phoneNumber}]});if(await e?.callbackOnVerification?.({phoneNumber:r.body.phoneNumber,user:n},r.request),n)n=await r.context.internalAdapter.updateUser(n.id,{[o.phoneNumberVerified]:!0});else if(e?.signUpOnVerification){if(n=await r.context.internalAdapter.createUser({email:e.signUpOnVerification.getTempEmail(r.body.phoneNumber),name:e.signUpOnVerification.getTempName?e.signUpOnVerification.getTempName(r.body.phoneNumber):r.body.phoneNumber,[o.phoneNumber]:r.body.phoneNumber,[o.phoneNumberVerified]:!0}),!n)throw new oe.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to create user"})}else return r.json(null);if(!n)throw new oe.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to update user"});if(!r.body.disableSession){let i=await r.context.internalAdapter.createSession(n.id,r.request);if(!i)throw new oe.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to create session"});return await w(r,{session:i,user:n}),r.json({user:n,session:i})}return r.json({user:n,session:null})})},schema:{user:{fields:{phoneNumber:{type:"string",required:!1,unique:!0,returned:!0},phoneNumberVerified:{type:"boolean",required:!1,returned:!0,input:!1}}}}}};var Il=require("zod");var In=e=>({id:"anonymous",endpoints:{signInAnonymous:c("/sign-in/anonymous",{method:"POST"},async o=>{let{emailDomainName:r=Oe(o.context.baseURL)}=e||{},t=z(),n=`temp-${t}@${r}`,i=await o.context.internalAdapter.createUser({id:t,email:n,emailVerified:!1,isAnonymous:!0,name:"Anonymous",createdAt:new Date,updatedAt:new Date});if(!i)return o.json(null,{status:500,body:{message:"Failed to create user",status:500}});let s=await o.context.internalAdapter.createSession(i.id,o.request);return s?(await w(o,{session:s,user:i}),o.json({user:i,session:s})):o.json(null,{status:400,body:{message:"Could not create session"}})})},hooks:{after:[{matcher(o){return o.path?.startsWith("/sign-in")||o.path?.startsWith("/sign-up")},async handler(o){let r=o.context.returned;if(!(r instanceof Response))return;let t=r.headers.get("set-cookie"),n=o.context.authCookies.sessionToken.name,i=Ye(t||"").get(n)?.value.split(".")[0];if(!i)return;let s=await B(o);if(!(!s||!s.user.isAnonymous)){if(o.path==="/sign-in/anonymous")throw new v.APIError("BAD_REQUEST",{message:"Anonymous users cannot sign in again anonymously"});if(e?.onLinkAccount){let a=await o.context.internalAdapter.findSession(i);if(!a)return;await e?.onLinkAccount?.({anonymousUser:s,newUser:a})}e?.disableDeleteAnonymousUser||await o.context.internalAdapter.deleteUser(s.user.id)}}}]},schema:{user:{fields:{isAnonymous:{type:"boolean",required:!1}}}}});var g=require("zod");var Tn=e=>{let o={defaultRole:"user",adminRole:"admin",...e},r=S(async t=>{let n=await B(t);if(!n?.session)throw new v.APIError("UNAUTHORIZED");let i=n.user;if(!i.role||(Array.isArray(o.adminRole)?!o.adminRole.includes(i.role):i.role!==o.adminRole))throw new v.APIError("FORBIDDEN",{message:"Only admins can access this endpoint"});return{session:{user:i,session:n.session}}});return{id:"admin",init(t){return{options:{databaseHooks:{user:{create:{async before(n){if(e?.defaultRole!==!1)return{data:{role:e?.defaultRole??"user",...n}}}}},session:{create:{async before(n){let i=await t.internalAdapter.findUserById(n.userId);if(i.banned){if(i.banExpires&&i.banExpires<Date.now()){await t.internalAdapter.updateUser(n.userId,{banned:!1,banReason:null,banExpires:null});return}return!1}}}}}}}},hooks:{after:[{matcher(t){return t.path==="/list-sessions"},handler:S(async t=>{let n=t.context.returned;if(n instanceof Response){let s=(await n.clone().json()).filter(d=>!d.impersonatedBy),a=new Response(JSON.stringify(s),{status:200,statusText:"OK",headers:n.headers});return t.json({response:a})}})}]},endpoints:{setRole:c("/admin/set-role",{method:"POST",body:g.z.object({userId:g.z.string(),role:g.z.string()}),use:[r]},async t=>{let n=await t.context.internalAdapter.updateUser(t.body.userId,{role:t.body.role});return t.json({user:n})}),createUser:c("/admin/create-user",{method:"POST",body:g.z.object({email:g.z.string(),password:g.z.string(),name:g.z.string(),role:g.z.string(),data:g.z.optional(g.z.record(g.z.any()))}),use:[r]},async t=>{if(await t.context.internalAdapter.findUserByEmail(t.body.email))throw new v.APIError("BAD_REQUEST",{message:"User already exists"});let i=await t.context.internalAdapter.createUser({email:t.body.email,name:t.body.name,role:t.body.role,...t.body.data});if(!i)throw new v.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to create user"});let s=await t.context.password.hash(t.body.password);return await t.context.internalAdapter.linkAccount({accountId:i.id,providerId:"credential",password:s,userId:i.id}),t.json({user:i})}),listUsers:c("/admin/list-users",{method:"GET",use:[r],query:g.z.object({searchValue:g.z.string().optional(),searchField:g.z.enum(["email","name"]).optional(),searchOperator:g.z.enum(["contains","starts_with","ends_with"]).optional(),limit:g.z.string().or(g.z.number()).optional(),offset:g.z.string().or(g.z.number()).optional(),sortBy:g.z.string().optional(),sortDirection:g.z.enum(["asc","desc"]).optional(),filterField:g.z.string().optional(),filterValue:g.z.string().or(g.z.number()).or(g.z.boolean()).optional(),filterOperator:g.z.enum(["eq","ne","lt","lte","gt","gte"]).optional()})},async t=>{let n=[];t.query?.searchValue&&n.push({field:t.query.searchField||"email",operator:t.query.searchOperator||"contains",value:t.query.searchValue}),t.query?.filterValue&&n.push({field:t.query.filterField||"email",operator:t.query.filterOperator||"eq",value:t.query.filterValue});try{let i=await t.context.internalAdapter.listUsers(Number(t.query?.limit)||void 0,Number(t.query?.offset)||void 0,t.query?.sortBy?{field:t.query.sortBy,direction:t.query.sortDirection||"asc"}:void 0,n.length?n:void 0);return t.json({users:i})}catch(i){return console.log(i),t.json({users:[]})}}),listUserSessions:c("/admin/list-user-sessions",{method:"POST",use:[r],body:g.z.object({userId:g.z.string()})},async t=>({sessions:await t.context.internalAdapter.listSessions(t.body.userId)})),unbanUser:c("/admin/unban-user",{method:"POST",body:g.z.object({userId:g.z.string()}),use:[r]},async t=>{let n=await t.context.internalAdapter.updateUser(t.body.userId,{banned:!1});return t.json({user:n})}),banUser:c("/admin/ban-user",{method:"POST",body:g.z.object({userId:g.z.string(),banReason:g.z.string().optional(),banExpiresIn:g.z.number().optional()}),use:[r]},async t=>{if(t.body.userId===t.context.session.user.id)throw new v.APIError("BAD_REQUEST",{message:"You cannot ban yourself"});let n=await t.context.internalAdapter.updateUser(t.body.userId,{banned:!0,banReason:t.body.banReason||e?.defaultBanReason||"No reason",banExpires:t.body.banExpiresIn?P(t.body.banExpiresIn,"sec"):e?.defaultBanExpiresIn?P(e.defaultBanExpiresIn,"sec"):void 0});return await t.context.internalAdapter.deleteSessions(t.body.userId),t.json({user:n})}),impersonateUser:c("/admin/impersonate-user",{method:"POST",body:g.z.object({userId:g.z.string()}),use:[r]},async t=>{let n=await t.context.internalAdapter.findUserById(t.body.userId);if(!n)throw new v.APIError("NOT_FOUND",{message:"User not found"});let i=await t.context.internalAdapter.createSession(n.id,void 0,!0,{impersonatedBy:t.context.session.user.id,expiresAt:e?.impersonationSessionDuration?P(e.impersonationSessionDuration,"sec"):P(60*60,"sec")});if(!i)throw new v.APIError("INTERNAL_SERVER_ERROR",{message:"Failed to create session"});return await w(t,{session:i,user:n},!0),t.json({session:i,user:n})}),revokeUserSession:c("/admin/revoke-user-session",{method:"POST",body:g.z.object({sessionId:g.z.string()}),use:[r]},async t=>(await t.context.internalAdapter.deleteSession(t.body.sessionId),t.json({success:!0}))),revokeUserSessions:c("/admin/revoke-user-sessions",{method:"POST",body:g.z.object({userId:g.z.string()}),use:[r]},async t=>(await t.context.internalAdapter.deleteSessions(t.body.userId),t.json({success:!0}))),removeUser:c("/admin/remove-user",{method:"POST",body:g.z.object({userId:g.z.string()}),use:[r]},async t=>(await t.context.internalAdapter.deleteUser(t.body.userId),t.json({success:!0})))},schema:{user:{fields:{role:{type:"string",required:!1,input:!1},banned:{type:"boolean",defaultValue:!1,required:!1,input:!1},banReason:{type:"string",required:!1,input:!1},banExpires:{type:"date",required:!1,input:!1}}},session:{fields:{impersonatedBy:{type:"string",required:!1}}}}}};var Y=require("zod"),xe=require("better-call");var lt=require("@better-fetch/fetch");var io=require("oslo/jwt");async function Sn(e,o,r){if(o==="oidc"&&e.idToken){let n=(0,io.parseJWT)(e.idToken);if(n?.payload)return n.payload}return r?(await(0,lt.betterFetch)(r,{method:"GET",headers:{Authorization:`Bearer ${e.accessToken}`}})).data:null}var Pn=e=>({id:"generic-oauth",endpoints:{signInWithOAuth2:c("/sign-in/oauth2",{method:"POST",query:Y.z.object({currentURL:Y.z.string().optional()}).optional(),body:Y.z.object({providerId:Y.z.string(),callbackURL:Y.z.string().optional()})},async o=>{let{providerId:r}=o.body,t=e.config.find(le=>le.providerId===r);if(!t)throw new xe.APIError("BAD_REQUEST",{message:`No config found for provider ${r}`});let{discoveryUrl:n,authorizationUrl:i,tokenUrl:s,clientId:a,clientSecret:d,scopes:u,redirectURI:l,responseType:m,pkce:f,prompt:p,accessType:h}=t,k=i,U=s;if(n){let le=await(0,lt.betterFetch)(n,{onError(ft){y.error(ft.error,{discoveryUrl:n})}});le.data&&(k=le.data.authorization_endpoint,U=le.data.token_endpoint)}if(!k||!U)throw new xe.APIError("BAD_REQUEST",{message:"Invalid OAuth configuration."});let ee=o.query?.currentURL?new URL(o.query?.currentURL):null,Ae=o.body.callbackURL?.startsWith("http")?o.body.callbackURL:`${ee?.origin}${o.body.callbackURL||""}`,{state:N,codeVerifier:pt}=await ve(o),ke=await E({id:r,options:{clientId:a,clientSecret:d,redirectURI:l},authorizationEndpoint:k,state:N,codeVerifier:f?pt:void 0,scopes:u||[],redirectURI:`${o.context.baseURL}/oauth2/callback/${r}`});return m&&m!=="code"&&ke.searchParams.set("response_type",m),p&&ke.searchParams.set("prompt",p),h&&ke.searchParams.set("access_type",h),o.json({url:ke.toString(),redirect:!0})}),oAuth2Callback:c("/oauth2/callback/:providerId",{method:"GET",query:Y.z.object({code:Y.z.string().optional(),error:Y.z.string().optional(),state:Y.z.string()})},async o=>{if(o.query.error||!o.query.code)throw o.redirect(`${o.context.baseURL}?error=${o.query.error||"oAuth_code_missing"}`);let r=e.config.find(N=>N.providerId===o.params.providerId);if(!r)throw new xe.APIError("BAD_REQUEST",{message:`No config found for provider ${o.params.providerId}`});let t,n=await tt(o),{callbackURL:i,codeVerifier:s,errorURL:a}=n,d=o.query.code,u=r.tokenUrl,l=r.userInfoUrl;if(r.discoveryUrl){let N=await(0,lt.betterFetch)(r.discoveryUrl,{method:"GET"});N.data&&(u=N.data.token_endpoint,l=N.data.userinfo_endpoint)}try{if(!u)throw new xe.APIError("BAD_REQUEST",{message:"Invalid OAuth configuration."});t=await O({code:d,codeVerifier:s,redirectURI:`${o.context.baseURL}/oauth2/callback/${r.providerId}`,options:{clientId:r.clientId,clientSecret:r.clientSecret},tokenEndpoint:u})}catch(N){throw o.context.logger.error(N),o.redirect(`${a}?error=oauth_code_verification_failed`)}if(!t)throw new xe.APIError("BAD_REQUEST",{message:"Invalid OAuth configuration."});let m=r.getUserInfo?await r.getUserInfo(t):await Sn(t,r.type||"oauth2",l),f=z(),p=Er.safeParse({...m,id:f});if(!m||p.success===!1)throw y.error("Unable to get user info",p.error),o.redirect(`${o.context.baseURL}/error?error=please_restart_the_process`);let h=await Ee(o,{userInfo:p.data,account:{providerId:r.providerId,accountId:m.id,accessToken:t.accessToken}});function k(N){throw o.redirect(`${a||i||`${o.context.baseURL}/error`}?error=${N}`)}if(h.error)return k(h.error.split(" ").join("_"));let{session:U,user:ee}=h.data;await w(o,{session:U,user:ee});let Ae;try{Ae=new URL(i).toString()}catch{Ae=i}throw o.redirect(Ae)})}});var Le=require("zod"),so={jwks:{fields:{publicKey:{type:"string",required:!0},privateKey:{type:"string",required:!0},createdAt:{type:"date",required:!0}}}},Ql=Le.z.object({id:Le.z.string(),publicKey:Le.z.string(),privateKey:Le.z.string(),createdAt:Le.z.date()});var Lt=e=>({getAllKeys:async()=>await e.findMany({model:"jwks"}),getLatestKey:async()=>(await e.findMany({model:"jwks",sortBy:{field:"createdAt",direction:"desc"},limit:1}))[0],createJwk:async o=>await e.create({model:"jwks",data:{...o,createdAt:new Date}})});var ne=require("jose");var _n=e=>({id:"jwt",endpoints:{getJwks:c("/jwks",{method:"GET"},async o=>{let t=await Lt(o.context.adapter).getAllKeys();return o.json({keys:t.map(n=>({...JSON.parse(n.publicKey),kid:n.id}))})}),getToken:c("/token",{method:"GET",requireHeaders:!0,use:[b]},async o=>{let r=Lt(o.context.adapter),t=await r.getLatestKey(),n=!e?.jwks?.disablePrivateKeyEncryption;if(t===void 0){let{publicKey:u,privateKey:l}=await(0,ne.generateKeyPair)(e?.jwks?.keyPairConfig?.alg??"EdDSA",e?.jwks?.keyPairConfig??{crv:"Ed25519"}),m=await(0,ne.exportJWK)(u),f=await(0,ne.exportJWK)(l),p=JSON.stringify(f),h={id:crypto.randomUUID(),publicKey:JSON.stringify(m),privateKey:n?JSON.stringify(await re({key:o.context.options.secret,data:p})):p,createdAt:new Date};t=await r.createJwk(h)}let i=n?await de({key:o.context.options.secret,data:JSON.parse(t.privateKey)}):t.privateKey,s=await(0,ne.importJWK)(JSON.parse(i)),a=e?.jwt?.definePayload?await e?.jwt.definePayload(o.context.session.user):o.context.session.user,d=await new ne.SignJWT({...a,...o.context.session.session.impersonatedBy?{impersonatedBy:o.context.session.session.impersonatedBy}:{}}).setProtectedHeader({alg:e?.jwks?.keyPairConfig?.alg??"EdDSA",kid:t.id}).setIssuedAt().setIssuer(e?.jwt?.issuer??o.context.options.baseURL).setAudience(e?.jwt?.audience??o.context.options.baseURL).setExpirationTime(e?.jwt?.expirationTime??"15m").setSubject(o.context.session.user.id).sign(s);return o.json({token:d})})},schema:so});var We=require("zod");var Cn=e=>{let o={maximumSessions:5,...e},r=t=>t.includes("_multi-");return{id:"multi-session",endpoints:{listDeviceSessions:c("/multi-session/list-device-sessions",{method:"GET",requireHeaders:!0},async t=>{let n=t.headers?.get("cookie");if(!n)return t.json([]);let i=Object.fromEntries(Xe(n)),s=(await Promise.all(Object.entries(i).filter(([u])=>r(u)).map(async([u])=>await t.getSignedCookie(u,t.context.secret)))).filter(u=>u!==void 0);if(!s.length)return t.json([]);let d=(await t.context.internalAdapter.findSessions(s)).filter(u=>u&&u.session.expiresAt>new Date).filter((u,l,m)=>l===m.findIndex(f=>f.user.id===u.user.id));return Object.entries(i).filter(([u])=>r(u)).forEach(([u,l])=>{d.some(m=>m.session.id===l)||t.setCookie(u,"",{...t.context.authCookies.sessionToken.options,maxAge:0})}),t.json(d)}),setActiveSession:c("/multi-session/set-active",{method:"POST",body:We.z.object({sessionId:We.z.string()}),requireHeaders:!0,use:[b]},async t=>{let n=t.body.sessionId,i=`${t.context.authCookies.sessionToken.name}_multi-${n}`;if(!await t.getSignedCookie(i,t.context.secret))throw new v.APIError("UNAUTHORIZED",{message:"Invalid session id"});let a=await t.context.internalAdapter.findSession(n);if(!a||a.session.expiresAt<new Date)throw t.setCookie(i,"",{...t.context.authCookies.sessionToken.options,maxAge:0}),new v.APIError("UNAUTHORIZED",{message:"Invalid session id"});return await t.setSignedCookie(t.context.authCookies.sessionToken.name,n,t.context.secret,t.context.authCookies.sessionToken.options),t.json(a)}),revokeDeviceSession:c("/multi-session/revoke",{method:"POST",body:We.z.object({sessionId:We.z.string()}),requireHeaders:!0,use:[b]},async t=>{let n=t.body.sessionId,i=`${t.context.authCookies.sessionToken.name}_multi-${n}`;if(!await t.getSignedCookie(i,t.context.secret))throw new v.APIError("UNAUTHORIZED",{message:"Invalid session id"});let a=await t.context.internalAdapter.findSession(n);return t.setCookie(i,"",{...t.context.authCookies.sessionToken.options,maxAge:0}),a?(await t.context.internalAdapter.deleteSession(n),t.json({success:!0})):t.json({success:!0})})},hooks:{after:[{matcher:()=>!0,handler:S(async t=>{if(!t.context.returned||!(t.context.returned instanceof Response))return;let n=t.context.returned.headers.get("set-cookie");if(!n)return;let i=Ye(n),s=t.context.authCookies.sessionToken,a=i.get(s.name)?.value;if(!a)return;let d=Xe(t.headers?.get("cookie")||""),u=a.split(".")[0],l=`${s.name}_multi-${u}`;if(i.get(l)||d.get(l)||Object.keys(Object.fromEntries(d)).filter(r).length+(n.includes("session_token")?1:0)>o.maximumSessions)return;await t.setSignedCookie(l,u,t.context.secret,s.options);let f=t.context.returned;return f.headers.append("Set-Cookie",t.responseHeader.get("set-cookie")),{response:f}})},{matcher:t=>t.path==="/sign-out",handler:S(async t=>{if(!(t.context.returned instanceof Response))return;let n=t.headers?.get("cookie");if(!n)return;let i=Object.fromEntries(Xe(n));await Promise.all(Object.entries(i).map(async([a,d])=>{if(r(a)){t.setCookie(a,"",{maxAge:0});let u=a.split("_multi-")[1];await t.context.internalAdapter.deleteSession(u)}}));let s=t.context.returned;return s.headers.append("Set-Cookie",t.responseHeader.get("set-cookie")),{response:s}})}]}}};var X=require("zod");var zn=e=>{let o={expireIn:300,otpLength:6,...e};return{id:"email-otp",endpoints:{sendVerificationOTP:c("/email-otp/send-verification-otp",{method:"POST",body:X.z.object({email:X.z.string(),type:X.z.enum(["email-verification","sign-in"])})},async r=>{if(!e?.sendVerificationOTP)throw y.error("send email verification is not implemented"),new v.APIError("BAD_REQUEST",{message:"send email verification is not implemented"});let t=r.body.email,n=q(o.otpLength,M("0-9"));return await r.context.internalAdapter.createVerificationValue({value:n,identifier:`${r.body.type}-otp-${t}`,expiresAt:P(o.expireIn,"sec")}),await e.sendVerificationOTP({email:t,otp:n,type:r.body.type},r.request),r.json({success:!0})}),verifyEmailOTP:c("/email-otp/verify-email",{method:"POST",body:X.z.object({email:X.z.string(),otp:X.z.string()})},async r=>{let t=r.body.email,n=await r.context.internalAdapter.findVerificationValue(`email-verification-otp-${t}`);if(!n||n.expiresAt<new Date)throw n&&await r.context.internalAdapter.deleteVerificationValue(n.id),new v.APIError("BAD_REQUEST",{message:"Invalid OTP"});let i=r.body.otp;if(n.value!==i)throw new v.APIError("BAD_REQUEST",{message:"Invalid OTP"});await r.context.internalAdapter.deleteVerificationValue(n.id);let s=await r.context.internalAdapter.findUserByEmail(t);if(!s)throw new v.APIError("BAD_REQUEST",{message:"User not found"});let a=await r.context.internalAdapter.updateUser(s.user.id,{email:t,emailVerified:!0});return r.json({user:a})}),signInEmailOTP:c("/sign-in/email-otp",{method:"POST",body:X.z.object({email:X.z.string(),otp:X.z.string()})},async r=>{let t=r.body.email,n=await r.context.internalAdapter.findVerificationValue(`sign-in-otp-${t}`);if(!n||n.expiresAt<new Date)throw n&&await r.context.internalAdapter.deleteVerificationValue(n.id),new v.APIError("BAD_REQUEST",{message:"Invalid OTP"});let i=r.body.otp;if(n.value!==i)throw new v.APIError("BAD_REQUEST",{message:"Invalid OTP"});await r.context.internalAdapter.deleteVerificationValue(n.id);let s=await r.context.internalAdapter.findUserByEmail(t);if(!s){if(o.disableSignUp)throw new v.APIError("BAD_REQUEST",{message:"User not found"});let d=await r.context.internalAdapter.createUser({email:t,emailVerified:!0,name:t}),u=await r.context.internalAdapter.createSession(d.id,r.request);return await w(r,{session:u,user:d}),r.json({user:d,session:u})}let a=await r.context.internalAdapter.createSession(s.user.id,r.request);return await w(r,{session:a,user:s.user}),r.json({session:a,user:s})})},hooks:{after:[{matcher(r){return!!(r.path?.startsWith("/sign-up")&&o.sendVerificationOnSignUp)},async handler(r){let t=r.context.returned;if(t?.status!==200)return;let n=await t.clone().json();if(n.user.email&&n.user.emailVerified===!1){let i=q(o.otpLength,M("0-9"));await r.context.internalAdapter.createVerificationValue({value:i,identifier:`email-verification-otp-${n.user.email}`,expiresAt:P(o.expireIn,"sec")}),await e.sendVerificationOTP({email:n.user.email,otp:i,type:"email-verification"},r.request)}}}]}}};var Dt=require("zod");var uo=require("@better-fetch/fetch");function ao(e){return e==="true"||e===!0}var Bn=e=>({id:"one-tap",endpoints:{oneTapCallback:c("/one-tap/callback",{method:"POST",body:Dt.z.object({idToken:Dt.z.string()})},async o=>{let{idToken:r}=o.body,{data:t,error:n}=await(0,uo.betterFetch)("https://oauth2.googleapis.com/tokeninfo?id_token="+r);if(n)return o.json({error:"Invalid token"});let i=await o.context.internalAdapter.findUserByEmail(t.email);if(!i){if(e?.disableSignup)throw new v.APIError("BAD_GATEWAY",{message:"User not found"});let a=await o.context.internalAdapter.createOAuthUser({email:t.email,emailVerified:ao(t.email_verified),name:t.name,image:t.picture},{providerId:"google",accountId:t.sub});if(!a)throw new v.APIError("INTERNAL_SERVER_ERROR",{message:"Could not create user"});let d=await o.context.internalAdapter.createSession(a?.user.id,o.request);return await w(o,{user:a.user,session:d}),o.json({session:d,user:a})}let s=await o.context.internalAdapter.createSession(i.user.id,o.request);return await w(o,{user:i.user,session:s}),o.json({session:s,user:i})})}});var mt=require("zod");function xn(){let e=G.VERCEL_URL,o=G.NETLIFY_URL,r=G.RENDER_URL,t=G.AWS_LAMBDA_FUNCTION_NAME,n=G.GOOGLE_CLOUD_FUNCTION_NAME,i=G.AZURE_FUNCTION_NAME;return e||o||r||t||n||i}var Ln=e=>({id:"oauth-proxy",endpoints:{oAuthProxy:c("/oauth-proxy-callback",{method:"GET",query:mt.z.object({callbackURL:mt.z.string(),cookies:mt.z.string()})},async o=>{let r=o.query.cookies,t=await de({key:o.context.secret,data:r});throw o.setHeader("set-cookie",t),o.redirect(o.query.callbackURL)})},hooks:{after:[{matcher(o){return o.path?.startsWith("/callback")},handler:S(async o=>{let r=o.context.returned;if(!r||!(r instanceof Response))return;let t=r.headers.get("location");if(t?.includes("/oauth-proxy-callback?callbackURL")){if(!t.startsWith("http"))return;let n=new URL(t);if(n.origin===Oe(o.context.baseURL)){let u=n.searchParams.get("callbackURL");return u?(r.headers.set("location",u),{response:r}):void 0}let s=r.headers.get("set-cookie");if(!s)return;let a=await re({key:o.context.secret,data:s}),d=`${t}&cookies=${encodeURIComponent(a)}`;return r.headers.set("location",d),{response:r}}})}],before:[{matcher(o){return o.path?.startsWith("/sign-in/social")},async handler(o){let r=new URL(e?.currentURL||o.request?.url||xn()||o.context.baseURL);return o.body.callbackURL=`${r.origin}${o.context.options.basePath||"/api/auth"}/oauth-proxy-callback?callbackURL=${encodeURIComponent(o.body.callbackURL||o.context.baseURL)}`,{context:o}}}]}});0&&(module.exports={HIDE_METADATA,admin,anonymous,bearer,createAuthEndpoint,createAuthMiddleware,emailOTP,genericOAuth,getPasskeyActions,jwt,magicLink,multiSession,oAuthProxy,oneTap,optionsMiddleware,organization,passkey,passkeyClient,phoneNumber,twoFactor,twoFactorClient,username});