better-auth 1.1.18-beta.2 → 1.1.18

package/dist/{chunk-2VHVLRC7.cjs → chunk-5JET74FS.cjs}

@@ -1351,6 +1351,54 @@ var getActiveMember = chunkCQNPMJJ3_cjs.createAuthEndpoint(
     return ctx.json(member);
   }
 );
+var leaveOrganization = chunkCQNPMJJ3_cjs.createAuthEndpoint(
+  "/organization/leave",
+  {
+    method: "POST",
+    body: zod.z.object({
+      organizationId: zod.z.string()
+    }),
+    use: [chunkCQNPMJJ3_cjs.sessionMiddleware, orgMiddleware]
+  },
+  async (ctx) => {
+    const session = ctx.context.session;
+    const adapter = getOrgAdapter(ctx.context);
+    const member = await adapter.findMemberByOrgId({
+      userId: session.user.id,
+      organizationId: ctx.body.organizationId
+    });
+    if (!member) {
+      throw new betterCall.APIError("BAD_REQUEST", {
+        message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND
+      });
+    }
+    const isOwnerLeaving = member.role === (ctx.context.orgOptions?.creatorRole || "owner");
+    if (isOwnerLeaving) {
+      const members = await ctx.context.adapter.findMany({
+        model: "member",
+        where: [
+          {
+            field: "organizationId",
+            value: ctx.body.organizationId
+          }
+        ]
+      });
+      const owners = members.filter(
+        (member2) => member2.role === (ctx.context.orgOptions?.creatorRole || "owner")
+      );
+      if (owners.length <= 1) {
+        throw new betterCall.APIError("BAD_REQUEST", {
+          message: ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER
+        });
+      }
+    }
+    await adapter.deleteMember(member.id);
+    if (session.session.activeOrganizationId === ctx.body.organizationId) {
+      await adapter.setActiveOrganization(session.session.token, null);
+    }
+    return ctx.json(member);
+  }
+);
 var createOrganization = chunkCQNPMJJ3_cjs.createAuthEndpoint(
   "/organization/create",
   {
@@ -1860,7 +1908,8 @@ var organization = (options) => {
     addMember: addMember(),
     removeMember,
     updateMemberRole: updateMemberRole(),
-    getActiveMember
+    getActiveMember,
+    leaveOrganization
   };
   const roles = {
     ...chunk2X5G64P2_cjs.defaultRoles,

package/dist/{chunk-CFERT2JN.js → chunk-HA5MENQC.js}

@@ -1,4 +1,4 @@
-import { createAuthEndpoint, handleOAuthUserInfo } from './chunk-KALC2G3Y.js';
+import { createAuthEndpoint, handleOAuthUserInfo, sessionMiddleware, BASE_ERROR_CODES } from './chunk-KALC2G3Y.js';
 import { createAuthorizationURL, validateAuthorizationCode } from './chunk-GTQM7JU7.js';
 import { setSessionCookie } from './chunk-QQGZ3XGI.js';
 import { generateState, parseState } from './chunk-NPO64SVN.js';
@@ -306,7 +306,7 @@ var genericOAuth = (options) => {
           }
           let tokens = void 0;
           const parsedState = await parseState(ctx);
-          const { callbackURL, codeVerifier, errorURL, newUserURL } = parsedState;
+          const { callbackURL, codeVerifier, errorURL, newUserURL, link } = parsedState;
           const code = ctx.query.code;
           let finalTokenUrl = provider.tokenUrl;
           let finalUserInfoUrl = provider.userInfoUrl;
@@ -358,6 +358,27 @@ var genericOAuth = (options) => {
             );
           }
           const mapUser = provider.mapProfileToUser ? await provider.mapProfileToUser(userInfo) : null;
+          if (link) {
+            if (link.email !== userInfo.email.toLowerCase()) {
+              return redirectOnError("email_doesn't_match");
+            }
+            const newAccount = await ctx.context.internalAdapter.createAccount({
+              userId: link.userId,
+              providerId: provider.providerId,
+              accountId: userInfo.id
+            });
+            if (!newAccount) {
+              return redirectOnError("unable_to_link_account");
+            }
+            let toRedirectTo2;
+            try {
+              const url = callbackURL;
+              toRedirectTo2 = url.toString();
+            } catch {
+              toRedirectTo2 = callbackURL;
+            }
+            throw ctx.redirect(toRedirectTo2);
+          }
           const result = await handleOAuthUserInfo(ctx, {
             userInfo: {
               ...userInfo,
@@ -392,6 +413,93 @@ var genericOAuth = (options) => {
           }
           throw ctx.redirect(toRedirectTo);
         }
+      ),
+      oAuth2LinkAccount: createAuthEndpoint(
+        "/oauth2/link",
+        {
+          method: "POST",
+          body: z.object({
+            providerId: z.string(),
+            callbackURL: z.string()
+          }),
+          use: [sessionMiddleware]
+        },
+        async (c) => {
+          const session = c.context.session;
+          const account = await c.context.internalAdapter.findAccounts(
+            session.user.id
+          );
+          const existingAccount = account.find(
+            (a) => a.providerId === c.body.providerId
+          );
+          if (existingAccount) {
+            throw new APIError("BAD_REQUEST", {
+              message: BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED
+            });
+          }
+          const provider = options.config.find(
+            (p) => p.providerId === c.body.providerId
+          );
+          if (!provider) {
+            throw new APIError("NOT_FOUND", {
+              message: BASE_ERROR_CODES.PROVIDER_NOT_FOUND
+            });
+          }
+          const {
+            providerId,
+            clientId,
+            clientSecret,
+            redirectURI,
+            authorizationUrl,
+            discoveryUrl,
+            pkce,
+            scopes
+          } = provider;
+          let finalAuthUrl = authorizationUrl;
+          if (!finalAuthUrl) {
+            if (!discoveryUrl) {
+              throw new APIError("BAD_REQUEST", {
+                message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION
+              });
+            }
+            const discovery = await betterFetch(discoveryUrl, {
+              onError(context) {
+                c.context.logger.error(context.error.message, context.error, {
+                  discoveryUrl
+                });
+              }
+            });
+            if (discovery.data) {
+              finalAuthUrl = discovery.data.authorization_endpoint;
+            }
+          }
+          if (!finalAuthUrl) {
+            throw new APIError("BAD_REQUEST", {
+              message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION
+            });
+          }
+          const state = await generateState(c, {
+            userId: session.user.id,
+            email: session.user.email
+          });
+          const url = await createAuthorizationURL({
+            id: providerId,
+            options: {
+              clientId,
+              clientSecret,
+              redirectURI: redirectURI || `${c.context.baseURL}/oauth2/callback`
+            },
+            authorizationEndpoint: finalAuthUrl,
+            state: state.state,
+            codeVerifier: pkce ? state.codeVerifier : void 0,
+            scopes: scopes || [],
+            redirectURI: `${c.context.baseURL}/oauth2/callback/${providerId}`
+          });
+          return c.json({
+            url: url.toString(),
+            redirect: true
+          });
+        }
       )
     },
     $ERROR_CODES: ERROR_CODES

package/dist/{chunk-ZQFLCL7G.js → chunk-KFSLYLGZ.js}

@@ -1349,6 +1349,54 @@ var getActiveMember = createAuthEndpoint(
     return ctx.json(member);
   }
 );
+var leaveOrganization = createAuthEndpoint(
+  "/organization/leave",
+  {
+    method: "POST",
+    body: z.object({
+      organizationId: z.string()
+    }),
+    use: [sessionMiddleware, orgMiddleware]
+  },
+  async (ctx) => {
+    const session = ctx.context.session;
+    const adapter = getOrgAdapter(ctx.context);
+    const member = await adapter.findMemberByOrgId({
+      userId: session.user.id,
+      organizationId: ctx.body.organizationId
+    });
+    if (!member) {
+      throw new APIError("BAD_REQUEST", {
+        message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND
+      });
+    }
+    const isOwnerLeaving = member.role === (ctx.context.orgOptions?.creatorRole || "owner");
+    if (isOwnerLeaving) {
+      const members = await ctx.context.adapter.findMany({
+        model: "member",
+        where: [
+          {
+            field: "organizationId",
+            value: ctx.body.organizationId
+          }
+        ]
+      });
+      const owners = members.filter(
+        (member2) => member2.role === (ctx.context.orgOptions?.creatorRole || "owner")
+      );
+      if (owners.length <= 1) {
+        throw new APIError("BAD_REQUEST", {
+          message: ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER
+        });
+      }
+    }
+    await adapter.deleteMember(member.id);
+    if (session.session.activeOrganizationId === ctx.body.organizationId) {
+      await adapter.setActiveOrganization(session.session.token, null);
+    }
+    return ctx.json(member);
+  }
+);
 var createOrganization = createAuthEndpoint(
   "/organization/create",
   {
@@ -1858,7 +1906,8 @@ var organization = (options) => {
     addMember: addMember(),
     removeMember,
     updateMemberRole: updateMemberRole(),
-    getActiveMember
+    getActiveMember,
+    leaveOrganization
   };
   const roles = {
     ...defaultRoles,

package/dist/{chunk-FS4Q5N2E.js → chunk-PB7U7ZCO.js}

@@ -26,12 +26,18 @@ var schema = {
 };
 
 // src/plugins/username/index.ts
+function defaultUsernameValidator(username2) {
+  return /^[a-zA-Z0-9_]+$/.test(username2);
+}
 var username = (options) => {
   const ERROR_CODES = {
     INVALID_USERNAME_OR_PASSWORD: "invalid username or password",
     EMAIL_NOT_VERIFIED: "email not verified",
     UNEXPECTED_ERROR: "unexpected error",
-    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another."
+    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another.",
+    USERNAME_TOO_SHORT: "username is too short",
+    USERNAME_TOO_LONG: "username is too long",
+    INVALID_USERNAME: "username is invalid"
   };
   return {
     id: "username",
@@ -79,6 +85,36 @@ var username = (options) => {
           }
         },
         async (ctx) => {
+          if (!ctx.body.username || !ctx.body.password) {
+            ctx.context.logger.error("Username or password not found");
+            throw new APIError("UNAUTHORIZED", {
+              message: ERROR_CODES.INVALID_USERNAME_OR_PASSWORD
+            });
+          }
+          const minUsernameLength = options?.minUsernameLength || 3;
+          const maxUsernameLength = options?.maxUsernameLength || 30;
+          if (ctx.body.username.length < minUsernameLength) {
+            ctx.context.logger.error("Username too short", {
+              username: ctx.body.username
+            });
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_SHORT
+            });
+          }
+          if (ctx.body.username.length > maxUsernameLength) {
+            ctx.context.logger.error("Username too long", {
+              username: ctx.body.username
+            });
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_LONG
+            });
+          }
+          const validator = options?.usernameValidator || defaultUsernameValidator;
+          if (!validator(ctx.body.username)) {
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.INVALID_USERNAME
+            });
+          }
           const user = await ctx.context.adapter.findOne({
             model: "user",
             where: [
@@ -175,11 +211,30 @@ var username = (options) => {
       before: [
         {
           matcher(context) {
-            return context.path === "/sign-up/email";
+            return context.path === "/sign-up/email" || context.path === "/update-user";
           },
           async handler(ctx) {
             const username2 = ctx.body.username;
             if (username2) {
+              const minUsernameLength = options?.minUsernameLength || 3;
+              const maxUsernameLength = options?.maxUsernameLength || 30;
+              if (username2.length < minUsernameLength) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_SHORT
+                });
+              }
+              if (username2.length > maxUsernameLength) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_LONG
+                });
+              }
+              const validator = options?.usernameValidator || defaultUsernameValidator;
+              const valid = await validator(username2);
+              if (!valid) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.INVALID_USERNAME
+                });
+              }
               const user = await ctx.context.adapter.findOne({
                 model: "user",
                 where: [

package/dist/{chunk-7TKSNJYH.js → chunk-RPETDYVK.js}

@@ -769,6 +769,29 @@ var admin = (options) => {
             success: true
           });
         }
+      ),
+      setUserPassword: createAuthEndpoint(
+        "/admin/set-user-password",
+        {
+          method: "POST",
+          body: z.object({
+            newPassword: z.string(),
+            userId: z.string()
+          }),
+          use: [adminMiddleware]
+        },
+        async (ctx) => {
+          const hashedPassword = await ctx.context.password.hash(
+            ctx.body.newPassword
+          );
+          await ctx.context.internalAdapter.updatePassword(
+            ctx.body.userId,
+            hashedPassword
+          );
+          return ctx.json({
+            status: true
+          });
+        }
       )
     },
     $ERROR_CODES: ERROR_CODES,

package/dist/{chunk-G4LNWL5L.cjs → chunk-TSWYQ5PN.cjs}

@@ -28,12 +28,18 @@ var schema = {
 };
 
 // src/plugins/username/index.ts
+function defaultUsernameValidator(username2) {
+  return /^[a-zA-Z0-9_]+$/.test(username2);
+}
 var username = (options) => {
   const ERROR_CODES = {
     INVALID_USERNAME_OR_PASSWORD: "invalid username or password",
     EMAIL_NOT_VERIFIED: "email not verified",
     UNEXPECTED_ERROR: "unexpected error",
-    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another."
+    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another.",
+    USERNAME_TOO_SHORT: "username is too short",
+    USERNAME_TOO_LONG: "username is too long",
+    INVALID_USERNAME: "username is invalid"
   };
   return {
     id: "username",
@@ -81,6 +87,36 @@ var username = (options) => {
           }
         },
         async (ctx) => {
+          if (!ctx.body.username || !ctx.body.password) {
+            ctx.context.logger.error("Username or password not found");
+            throw new betterCall.APIError("UNAUTHORIZED", {
+              message: ERROR_CODES.INVALID_USERNAME_OR_PASSWORD
+            });
+          }
+          const minUsernameLength = options?.minUsernameLength || 3;
+          const maxUsernameLength = options?.maxUsernameLength || 30;
+          if (ctx.body.username.length < minUsernameLength) {
+            ctx.context.logger.error("Username too short", {
+              username: ctx.body.username
+            });
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_SHORT
+            });
+          }
+          if (ctx.body.username.length > maxUsernameLength) {
+            ctx.context.logger.error("Username too long", {
+              username: ctx.body.username
+            });
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_LONG
+            });
+          }
+          const validator = options?.usernameValidator || defaultUsernameValidator;
+          if (!validator(ctx.body.username)) {
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.INVALID_USERNAME
+            });
+          }
           const user = await ctx.context.adapter.findOne({
             model: "user",
             where: [
@@ -177,11 +213,30 @@ var username = (options) => {
       before: [
         {
           matcher(context) {
-            return context.path === "/sign-up/email";
+            return context.path === "/sign-up/email" || context.path === "/update-user";
           },
           async handler(ctx) {
             const username2 = ctx.body.username;
             if (username2) {
+              const minUsernameLength = options?.minUsernameLength || 3;
+              const maxUsernameLength = options?.maxUsernameLength || 30;
+              if (username2.length < minUsernameLength) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_SHORT
+                });
+              }
+              if (username2.length > maxUsernameLength) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_LONG
+                });
+              }
+              const validator = options?.usernameValidator || defaultUsernameValidator;
+              const valid = await validator(username2);
+              if (!valid) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.INVALID_USERNAME
+                });
+              }
               const user = await ctx.context.adapter.findOne({
                 model: "user",
                 where: [

package/dist/{chunk-OLYRJHRO.cjs → chunk-W2IU5LNT.cjs}

@@ -771,6 +771,29 @@ var admin = (options) => {
             success: true
           });
         }
+      ),
+      setUserPassword: chunkCQNPMJJ3_cjs.createAuthEndpoint(
+        "/admin/set-user-password",
+        {
+          method: "POST",
+          body: zod.z.object({
+            newPassword: zod.z.string(),
+            userId: zod.z.string()
+          }),
+          use: [adminMiddleware]
+        },
+        async (ctx) => {
+          const hashedPassword = await ctx.context.password.hash(
+            ctx.body.newPassword
+          );
+          await ctx.context.internalAdapter.updatePassword(
+            ctx.body.userId,
+            hashedPassword
+          );
+          return ctx.json({
+            status: true
+          });
+        }
       )
     },
     $ERROR_CODES: ERROR_CODES,

package/dist/{chunk-KM2MFBY2.cjs → chunk-XW6BECDW.cjs}

@@ -308,7 +308,7 @@ var genericOAuth = (options) => {
           }
           let tokens = void 0;
           const parsedState = await chunk5E75URIA_cjs.parseState(ctx);
-          const { callbackURL, codeVerifier, errorURL, newUserURL } = parsedState;
+          const { callbackURL, codeVerifier, errorURL, newUserURL, link } = parsedState;
           const code = ctx.query.code;
           let finalTokenUrl = provider.tokenUrl;
           let finalUserInfoUrl = provider.userInfoUrl;
@@ -360,6 +360,27 @@ var genericOAuth = (options) => {
             );
           }
           const mapUser = provider.mapProfileToUser ? await provider.mapProfileToUser(userInfo) : null;
+          if (link) {
+            if (link.email !== userInfo.email.toLowerCase()) {
+              return redirectOnError("email_doesn't_match");
+            }
+            const newAccount = await ctx.context.internalAdapter.createAccount({
+              userId: link.userId,
+              providerId: provider.providerId,
+              accountId: userInfo.id
+            });
+            if (!newAccount) {
+              return redirectOnError("unable_to_link_account");
+            }
+            let toRedirectTo2;
+            try {
+              const url = callbackURL;
+              toRedirectTo2 = url.toString();
+            } catch {
+              toRedirectTo2 = callbackURL;
+            }
+            throw ctx.redirect(toRedirectTo2);
+          }
           const result = await chunkCQNPMJJ3_cjs.handleOAuthUserInfo(ctx, {
             userInfo: {
               ...userInfo,
@@ -394,6 +415,93 @@ var genericOAuth = (options) => {
           }
           throw ctx.redirect(toRedirectTo);
         }
+      ),
+      oAuth2LinkAccount: chunkCQNPMJJ3_cjs.createAuthEndpoint(
+        "/oauth2/link",
+        {
+          method: "POST",
+          body: zod.z.object({
+            providerId: zod.z.string(),
+            callbackURL: zod.z.string()
+          }),
+          use: [chunkCQNPMJJ3_cjs.sessionMiddleware]
+        },
+        async (c) => {
+          const session = c.context.session;
+          const account = await c.context.internalAdapter.findAccounts(
+            session.user.id
+          );
+          const existingAccount = account.find(
+            (a) => a.providerId === c.body.providerId
+          );
+          if (existingAccount) {
+            throw new betterCall.APIError("BAD_REQUEST", {
+              message: chunkCQNPMJJ3_cjs.BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED
+            });
+          }
+          const provider = options.config.find(
+            (p) => p.providerId === c.body.providerId
+          );
+          if (!provider) {
+            throw new betterCall.APIError("NOT_FOUND", {
+              message: chunkCQNPMJJ3_cjs.BASE_ERROR_CODES.PROVIDER_NOT_FOUND
+            });
+          }
+          const {
+            providerId,
+            clientId,
+            clientSecret,
+            redirectURI,
+            authorizationUrl,
+            discoveryUrl,
+            pkce,
+            scopes
+          } = provider;
+          let finalAuthUrl = authorizationUrl;
+          if (!finalAuthUrl) {
+            if (!discoveryUrl) {
+              throw new betterCall.APIError("BAD_REQUEST", {
+                message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION
+              });
+            }
+            const discovery = await fetch.betterFetch(discoveryUrl, {
+              onError(context) {
+                c.context.logger.error(context.error.message, context.error, {
+                  discoveryUrl
+                });
+              }
+            });
+            if (discovery.data) {
+              finalAuthUrl = discovery.data.authorization_endpoint;
+            }
+          }
+          if (!finalAuthUrl) {
+            throw new betterCall.APIError("BAD_REQUEST", {
+              message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION
+            });
+          }
+          const state = await chunk5E75URIA_cjs.generateState(c, {
+            userId: session.user.id,
+            email: session.user.email
+          });
+          const url = await chunkV6RGXSG4_cjs.createAuthorizationURL({
+            id: providerId,
+            options: {
+              clientId,
+              clientSecret,
+              redirectURI: redirectURI || `${c.context.baseURL}/oauth2/callback`
+            },
+            authorizationEndpoint: finalAuthUrl,
+            state: state.state,
+            codeVerifier: pkce ? state.codeVerifier : void 0,
+            scopes: scopes || [],
+            redirectURI: `${c.context.baseURL}/oauth2/callback/${providerId}`
+          });
+          return c.json({
+            url: url.toString(),
+            redirect: true
+          });
+        }
       )
     },
     $ERROR_CODES: ERROR_CODES

package/dist/client/plugins.d.cts

@@ -2,7 +2,7 @@ import * as nanostores from 'nanostores';
 import { AccessControl, StatementsPrimitive, Role } from '../plugins/access.cjs';
 import * as _better_fetch_fetch from '@better-fetch/fetch';
 import { BetterFetchOption } from '@better-fetch/fetch';
-import { o as organization, a as Organization, M as Member, I as Invitation } from '../index-CvVfvvKF.cjs';
+import { o as organization, a as Organization, M as Member, I as Invitation } from '../index-D2rGzLac.cjs';
 import { b as Prettify } from '../helper-Bi8FQwDD.cjs';
 import { username } from '../plugins/username.cjs';
 export { getPasskeyActions, passkeyClient } from '../plugins/passkey.cjs';

package/dist/client/plugins.d.ts

@@ -2,7 +2,7 @@ import * as nanostores from 'nanostores';
 import { AccessControl, StatementsPrimitive, Role } from '../plugins/access.js';
 import * as _better_fetch_fetch from '@better-fetch/fetch';
 import { BetterFetchOption } from '@better-fetch/fetch';
-import { o as organization, a as Organization, M as Member, I as Invitation } from '../index-BAdTrrkO.js';
+import { o as organization, a as Organization, M as Member, I as Invitation } from '../index-Cqgianwx.js';
 import { b as Prettify } from '../helper-Bi8FQwDD.js';
 import { username } from '../plugins/username.js';
 export { getPasskeyActions, passkeyClient } from '../plugins/passkey.js';