better-auth 1.2.0-beta.1 → 1.2.0-beta.11

package/dist/{chunk-YW3B2ST3.js → chunk-BY25AMN4.js}

@@ -1,7 +1,7 @@
-import { createAuthEndpoint, handleOAuthUserInfo } from './chunk-3EY3LSQR.js';
-import { createAuthorizationURL, validateAuthorizationCode } from './chunk-GTQM7JU7.js';
+import { createAuthEndpoint, handleOAuthUserInfo, sessionMiddleware, BASE_ERROR_CODES } from './chunk-IVS5VS3V.js';
+import { createAuthorizationURL, validateAuthorizationCode } from './chunk-R42K7GPF.js';
 import { setSessionCookie } from './chunk-QQGZ3XGI.js';
-import { generateState, parseState } from './chunk-NPO64SVN.js';
+import { generateState, parseState } from './chunk-ZFUBVSZD.js';
 import { betterFetch } from '@better-fetch/fetch';
 import { APIError } from 'better-call';
 import { z } from 'zod';
@@ -142,6 +142,9 @@ var genericOAuth = (options) => {
             }).optional(),
             disableRedirect: z.boolean({
               description: "Disable redirect"
+            }).optional(),
+            scopes: z.array(z.string(), {
+              message: "Scopes to be passed to the provider authorization request."
             }).optional()
           }),
           metadata: {
@@ -234,7 +237,7 @@ var genericOAuth = (options) => {
             authorizationEndpoint: finalAuthUrl,
             state,
             codeVerifier: pkce ? codeVerifier : void 0,
-            scopes: scopes || [],
+            scopes: ctx.body.scopes ? [...ctx.body.scopes, ...scopes || []] : scopes || [],
             redirectURI: `${ctx.context.baseURL}/oauth2/callback/${providerId}`
           });
           if (responseType && responseType !== "code") {
@@ -306,7 +309,7 @@ var genericOAuth = (options) => {
           }
           let tokens = void 0;
           const parsedState = await parseState(ctx);
-          const { callbackURL, codeVerifier, errorURL, newUserURL } = parsedState;
+          const { callbackURL, codeVerifier, errorURL, newUserURL, link } = parsedState;
           const code = ctx.query.code;
           let finalTokenUrl = provider.tokenUrl;
           let finalUserInfoUrl = provider.userInfoUrl;
@@ -358,6 +361,27 @@ var genericOAuth = (options) => {
             );
           }
           const mapUser = provider.mapProfileToUser ? await provider.mapProfileToUser(userInfo) : null;
+          if (link) {
+            if (ctx.context.options.account?.accountLinking?.allowDifferentEmails !== true && link.email !== userInfo.email.toLowerCase()) {
+              return redirectOnError("email_doesn't_match");
+            }
+            const newAccount = await ctx.context.internalAdapter.createAccount({
+              userId: link.userId,
+              providerId: provider.providerId,
+              accountId: userInfo.id
+            });
+            if (!newAccount) {
+              return redirectOnError("unable_to_link_account");
+            }
+            let toRedirectTo2;
+            try {
+              const url = callbackURL;
+              toRedirectTo2 = url.toString();
+            } catch {
+              toRedirectTo2 = callbackURL;
+            }
+            throw ctx.redirect(toRedirectTo2);
+          }
           const result = await handleOAuthUserInfo(ctx, {
             userInfo: {
               ...userInfo,
@@ -392,6 +416,93 @@ var genericOAuth = (options) => {
           }
           throw ctx.redirect(toRedirectTo);
         }
+      ),
+      oAuth2LinkAccount: createAuthEndpoint(
+        "/oauth2/link",
+        {
+          method: "POST",
+          body: z.object({
+            providerId: z.string(),
+            callbackURL: z.string()
+          }),
+          use: [sessionMiddleware]
+        },
+        async (c) => {
+          const session = c.context.session;
+          const account = await c.context.internalAdapter.findAccounts(
+            session.user.id
+          );
+          const existingAccount = account.find(
+            (a) => a.providerId === c.body.providerId
+          );
+          if (existingAccount) {
+            throw new APIError("BAD_REQUEST", {
+              message: BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED
+            });
+          }
+          const provider = options.config.find(
+            (p) => p.providerId === c.body.providerId
+          );
+          if (!provider) {
+            throw new APIError("NOT_FOUND", {
+              message: BASE_ERROR_CODES.PROVIDER_NOT_FOUND
+            });
+          }
+          const {
+            providerId,
+            clientId,
+            clientSecret,
+            redirectURI,
+            authorizationUrl,
+            discoveryUrl,
+            pkce,
+            scopes
+          } = provider;
+          let finalAuthUrl = authorizationUrl;
+          if (!finalAuthUrl) {
+            if (!discoveryUrl) {
+              throw new APIError("BAD_REQUEST", {
+                message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION
+              });
+            }
+            const discovery = await betterFetch(discoveryUrl, {
+              onError(context) {
+                c.context.logger.error(context.error.message, context.error, {
+                  discoveryUrl
+                });
+              }
+            });
+            if (discovery.data) {
+              finalAuthUrl = discovery.data.authorization_endpoint;
+            }
+          }
+          if (!finalAuthUrl) {
+            throw new APIError("BAD_REQUEST", {
+              message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION
+            });
+          }
+          const state = await generateState(c, {
+            userId: session.user.id,
+            email: session.user.email
+          });
+          const url = await createAuthorizationURL({
+            id: providerId,
+            options: {
+              clientId,
+              clientSecret,
+              redirectURI: redirectURI || `${c.context.baseURL}/oauth2/callback`
+            },
+            authorizationEndpoint: finalAuthUrl,
+            state: state.state,
+            codeVerifier: pkce ? state.codeVerifier : void 0,
+            scopes: scopes || [],
+            redirectURI: `${c.context.baseURL}/oauth2/callback/${providerId}`
+          });
+          return c.json({
+            url: url.toString(),
+            redirect: true
+          });
+        }
       )
     },
     $ERROR_CODES: ERROR_CODES

package/dist/{chunk-LZ5DEQVH.cjs → chunk-C4T7TNDG.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var chunkPIWBUHRB_cjs = require('./chunk-PIWBUHRB.cjs');
+var chunkUPQLFVFU_cjs = require('./chunk-UPQLFVFU.cjs');
 var zod = require('zod');
 
 var customSession = (fn, options) => {
   return {
     id: "custom-session",
     endpoints: {
-      getSession: chunkPIWBUHRB_cjs.createAuthEndpoint(
+      getSession: chunkUPQLFVFU_cjs.createAuthEndpoint(
         "/get-session",
         {
           method: "GET",
@@ -30,7 +30,7 @@ var customSession = (fn, options) => {
           )
         },
         async (ctx) => {
-          const session = await chunkPIWBUHRB_cjs.getSessionFromCtx(ctx);
+          const session = await chunkUPQLFVFU_cjs.getSessionFromCtx(ctx);
           if (!session) {
             return ctx.json(null);
           }

package/dist/{chunk-PJ4KWXLQ.cjs → chunk-DH5E7574.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var chunkPIWBUHRB_cjs = require('./chunk-PIWBUHRB.cjs');
+var chunkUPQLFVFU_cjs = require('./chunk-UPQLFVFU.cjs');
 var chunkS5UORXJH_cjs = require('./chunk-S5UORXJH.cjs');
 var chunkV6HE2MP7_cjs = require('./chunk-V6HE2MP7.cjs');
-var chunkB5UCLTPZ_cjs = require('./chunk-B5UCLTPZ.cjs');
+var chunkUQC2FUXC_cjs = require('./chunk-UQC2FUXC.cjs');
 
 // src/plugins/anonymous/index.ts
 var schema = {
@@ -25,7 +25,7 @@ var anonymous = (options) => {
   return {
     id: "anonymous",
     endpoints: {
-      signInAnonymous: chunkPIWBUHRB_cjs.createAuthEndpoint(
+      signInAnonymous: chunkUPQLFVFU_cjs.createAuthEndpoint(
         "/sign-in/anonymous",
         {
           method: "POST",
@@ -67,7 +67,7 @@ var anonymous = (options) => {
             name: "Anonymous",
             createdAt: /* @__PURE__ */ new Date(),
             updatedAt: /* @__PURE__ */ new Date()
-          });
+          }, ctx);
           if (!newUser) {
             throw ctx.error("INTERNAL_SERVER_ERROR", {
               message: ERROR_CODES.FAILED_TO_CREATE_USER
@@ -109,14 +109,14 @@ var anonymous = (options) => {
           matcher(ctx) {
             return ctx.path.startsWith("/sign-in") || ctx.path.startsWith("/sign-up") || ctx.path.startsWith("/callback") || ctx.path.startsWith("/oauth2/callback") || ctx.path.startsWith("/magic-link/verify") || ctx.path.startsWith("/email-otp/verify-email");
           },
-          handler: chunkPIWBUHRB_cjs.createAuthMiddleware(async (ctx) => {
+          handler: chunkUPQLFVFU_cjs.createAuthMiddleware(async (ctx) => {
             const setCookie = ctx.context.responseHeaders?.get("set-cookie");
             const sessionTokenName = ctx.context.authCookies.sessionToken.name;
             const sessionCookie = chunkV6HE2MP7_cjs.parseSetCookieHeader(setCookie || "").get(sessionTokenName)?.value.split(".")[0];
             if (!sessionCookie) {
               return;
             }
-            const session = await chunkPIWBUHRB_cjs.getSessionFromCtx(
+            const session = await chunkUPQLFVFU_cjs.getSessionFromCtx(
               ctx,
               {
                 disableRefresh: true
@@ -126,7 +126,7 @@ var anonymous = (options) => {
               return;
             }
             if (ctx.path === "/sign-in/anonymous") {
-              throw new chunkPIWBUHRB_cjs.APIError("BAD_REQUEST", {
+              throw new chunkUPQLFVFU_cjs.APIError("BAD_REQUEST", {
                 message: ERROR_CODES.ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY
               });
             }
@@ -147,7 +147,7 @@ var anonymous = (options) => {
         }
       ]
     },
-    schema: chunkB5UCLTPZ_cjs.mergeSchema(schema, options?.schema),
+    schema: chunkUQC2FUXC_cjs.mergeSchema(schema, options?.schema),
     $ERROR_CODES: ERROR_CODES
   };
 };

package/dist/{chunk-5RY45WFV.js → chunk-DIIVSN3J.js}

@@ -1,4 +1,4 @@
-import { createAuthMiddleware, createAuthEndpoint, sessionMiddleware, APIError, getSessionFromCtx } from './chunk-3EY3LSQR.js';
+import { createAuthMiddleware, createAuthEndpoint, sessionMiddleware, APIError, getSessionFromCtx } from './chunk-IVS5VS3V.js';
 import { parseSetCookieHeader } from './chunk-QQGZ3XGI.js';
 import { generateRandomString } from './chunk-DBPOZRMS.js';
 import { SignJWT } from 'jose';
@@ -6,6 +6,7 @@ import { z } from 'zod';
 import { subtle } from '@better-auth/utils';
 import { APIError as APIError$1 } from 'better-call';
 import { createHash } from '@better-auth/utils/hash';
+import { base64 } from '@better-auth/utils/base64';
 
 // src/plugins/oidc-provider/schema.ts
 var schema = {
@@ -258,7 +259,8 @@ async function authorize(ctx, options) {
         requireConsent: query.prompt === "consent",
         state: query.prompt === "consent" ? query.state : null,
         codeChallenge: query.code_challenge,
-        codeChallengeMethod: query.code_challenge_method
+        codeChallengeMethod: query.code_challenge_method,
+        nonce: query.nonce
       }),
       identifier: code,
       expiresAt
@@ -330,7 +332,7 @@ var getMetadata = (ctx, options) => {
     issuer,
     authorization_endpoint: `${baseURL}/oauth2/authorize`,
     token_endpoint: `${baseURL}/oauth2/token`,
-    userInfo_endpoint: `${baseURL}/oauth2/userinfo`,
+    userinfo_endpoint: `${baseURL}/oauth2/userinfo`,
     jwks_uri: `${baseURL}/jwks`,
     registration_endpoint: `${baseURL}/oauth2/register`,
     scopes_supported: ["openid", "profile", "email", "offline_access"],
@@ -473,9 +475,6 @@ var oidcProvider = (options) => {
             });
           }
           if (verification.expiresAt < /* @__PURE__ */ new Date()) {
-            await ctx.context.internalAdapter.deleteVerificationValue(
-              verification.id
-            );
             throw new APIError("UNAUTHORIZED", {
               error_description: "Code expired",
               error: "invalid_grant"
@@ -555,9 +554,35 @@ var oidcProvider = (options) => {
               error: "invalid_request"
             });
           }
+          let { client_id, client_secret } = body;
+          const authorization = ctx.request?.headers.get("authorization") || null;
+          if (authorization && !client_id && !client_secret && authorization.startsWith("Basic ")) {
+            try {
+              const encoded = authorization.replace("Basic ", "");
+              const decoded = new TextDecoder().decode(base64.decode(encoded));
+              if (!decoded.includes(":")) {
+                throw new APIError("UNAUTHORIZED", {
+                  error_description: "invalid authorization header format",
+                  error: "invalid_client"
+                });
+              }
+              const [id, secret] = decoded.split(":");
+              if (!id || !secret) {
+                throw new APIError("UNAUTHORIZED", {
+                  error_description: "invalid authorization header format",
+                  error: "invalid_client"
+                });
+              }
+              client_id = id;
+              client_secret = secret;
+            } catch (error) {
+              throw new APIError("UNAUTHORIZED", {
+                error_description: "invalid authorization header format",
+                error: "invalid_client"
+              });
+            }
+          }
           const {
-            client_id,
-            client_secret,
             grant_type,
             code,
             redirect_uri,
@@ -650,9 +675,6 @@ var oidcProvider = (options) => {
             });
           }
           if (verificationValue.expiresAt < /* @__PURE__ */ new Date()) {
-            await ctx.context.internalAdapter.deleteVerificationValue(
-              verificationValue.id
-            );
             throw new APIError("UNAUTHORIZED", {
               error_description: "code expired",
               error: "invalid_grant"
@@ -749,7 +771,7 @@ var oidcProvider = (options) => {
           }
           const requestedScopes = value.scope;
           await ctx.context.internalAdapter.deleteVerificationValue(
-            code.toString()
+            verificationValue.id
           );
           const accessToken = generateRandomString(32, "a-z", "A-Z");
           const refreshToken = generateRandomString(32, "A-Z", "a-z");
@@ -813,7 +835,7 @@ var oidcProvider = (options) => {
             aud: client_id.toString(),
             iat: Date.now(),
             auth_time: ctx.context.session?.session.createdAt.getTime(),
-            nonce: body.nonce,
+            nonce: value.nonce,
             acr: "urn:mace:incommon:iap:silver",
             // default to silver - ⚠︎ this should be configurable and should be validated against the client's metadata
             ...userClaims
@@ -893,6 +915,7 @@ var oidcProvider = (options) => {
           }
           const requestedScopes = accessToken.scopes.split(" ");
           const userClaims = {
+            sub: user.id,
             email: requestedScopes.includes("email") ? user.email : void 0,
             name: requestedScopes.includes("profile") ? user.name : void 0,
             picture: requestedScopes.includes("profile") ? user.image : void 0,

package/dist/{chunk-OSBTXYDD.cjs → chunk-GQKBG2VQ.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var chunkPIWBUHRB_cjs = require('./chunk-PIWBUHRB.cjs');
-var chunkV6RGXSG4_cjs = require('./chunk-V6RGXSG4.cjs');
+var chunkUPQLFVFU_cjs = require('./chunk-UPQLFVFU.cjs');
+var chunkSVC7H7K4_cjs = require('./chunk-SVC7H7K4.cjs');
 var chunkV6HE2MP7_cjs = require('./chunk-V6HE2MP7.cjs');
-var chunk5E75URIA_cjs = require('./chunk-5E75URIA.cjs');
+var chunk2Z6CVQHH_cjs = require('./chunk-2Z6CVQHH.cjs');
 var fetch = require('@better-fetch/fetch');
 var betterCall = require('better-call');
 var zod = require('zod');
@@ -54,7 +54,7 @@ var genericOAuth = (options) => {
           id: c.providerId,
           name: c.providerId,
           createAuthorizationURL(data) {
-            return chunkV6RGXSG4_cjs.createAuthorizationURL({
+            return chunkSVC7H7K4_cjs.createAuthorizationURL({
               id: c.providerId,
               options: {
                 clientId: c.clientId,
@@ -84,7 +84,7 @@ var genericOAuth = (options) => {
                 message: "Invalid OAuth configuration. Token URL not found."
               });
             }
-            return chunkV6RGXSG4_cjs.validateAuthorizationCode({
+            return chunkSVC7H7K4_cjs.validateAuthorizationCode({
               code: data.code,
               codeVerifier: data.codeVerifier,
               redirectURI: data.redirectURI,
@@ -125,7 +125,7 @@ var genericOAuth = (options) => {
       };
     },
     endpoints: {
-      signInWithOAuth2: chunkPIWBUHRB_cjs.createAuthEndpoint(
+      signInWithOAuth2: chunkUPQLFVFU_cjs.createAuthEndpoint(
         "/sign-in/oauth2",
         {
           method: "POST",
@@ -144,6 +144,9 @@ var genericOAuth = (options) => {
             }).optional(),
             disableRedirect: zod.z.boolean({
               description: "Disable redirect"
+            }).optional(),
+            scopes: zod.z.array(zod.z.string(), {
+              message: "Scopes to be passed to the provider authorization request."
             }).optional()
           }),
           metadata: {
@@ -225,8 +228,8 @@ var genericOAuth = (options) => {
             }
             finalAuthUrl = withAdditionalParams.toString();
           }
-          const { state, codeVerifier } = await chunk5E75URIA_cjs.generateState(ctx);
-          const authUrl = await chunkV6RGXSG4_cjs.createAuthorizationURL({
+          const { state, codeVerifier } = await chunk2Z6CVQHH_cjs.generateState(ctx);
+          const authUrl = await chunkSVC7H7K4_cjs.createAuthorizationURL({
             id: providerId,
             options: {
               clientId,
@@ -236,7 +239,7 @@ var genericOAuth = (options) => {
             authorizationEndpoint: finalAuthUrl,
             state,
             codeVerifier: pkce ? codeVerifier : void 0,
-            scopes: scopes || [],
+            scopes: ctx.body.scopes ? [...ctx.body.scopes, ...scopes || []] : scopes || [],
             redirectURI: `${ctx.context.baseURL}/oauth2/callback/${providerId}`
           });
           if (responseType && responseType !== "code") {
@@ -254,7 +257,7 @@ var genericOAuth = (options) => {
           });
         }
       ),
-      oAuth2Callback: chunkPIWBUHRB_cjs.createAuthEndpoint(
+      oAuth2Callback: chunkUPQLFVFU_cjs.createAuthEndpoint(
         "/oauth2/callback/:providerId",
         {
           method: "GET",
@@ -307,8 +310,8 @@ var genericOAuth = (options) => {
             });
           }
           let tokens = void 0;
-          const parsedState = await chunk5E75URIA_cjs.parseState(ctx);
-          const { callbackURL, codeVerifier, errorURL, newUserURL } = parsedState;
+          const parsedState = await chunk2Z6CVQHH_cjs.parseState(ctx);
+          const { callbackURL, codeVerifier, errorURL, newUserURL, link } = parsedState;
           const code = ctx.query.code;
           let finalTokenUrl = provider.tokenUrl;
           let finalUserInfoUrl = provider.userInfoUrl;
@@ -327,7 +330,7 @@ var genericOAuth = (options) => {
                 message: "Invalid OAuth configuration."
               });
             }
-            tokens = await chunkV6RGXSG4_cjs.validateAuthorizationCode({
+            tokens = await chunkSVC7H7K4_cjs.validateAuthorizationCode({
               code,
               codeVerifier: provider.pkce ? codeVerifier : void 0,
               redirectURI: `${ctx.context.baseURL}/oauth2/callback/${provider.providerId}`,
@@ -360,7 +363,28 @@ var genericOAuth = (options) => {
             );
           }
           const mapUser = provider.mapProfileToUser ? await provider.mapProfileToUser(userInfo) : null;
-          const result = await chunkPIWBUHRB_cjs.handleOAuthUserInfo(ctx, {
+          if (link) {
+            if (ctx.context.options.account?.accountLinking?.allowDifferentEmails !== true && link.email !== userInfo.email.toLowerCase()) {
+              return redirectOnError("email_doesn't_match");
+            }
+            const newAccount = await ctx.context.internalAdapter.createAccount({
+              userId: link.userId,
+              providerId: provider.providerId,
+              accountId: userInfo.id
+            });
+            if (!newAccount) {
+              return redirectOnError("unable_to_link_account");
+            }
+            let toRedirectTo2;
+            try {
+              const url = callbackURL;
+              toRedirectTo2 = url.toString();
+            } catch {
+              toRedirectTo2 = callbackURL;
+            }
+            throw ctx.redirect(toRedirectTo2);
+          }
+          const result = await chunkUPQLFVFU_cjs.handleOAuthUserInfo(ctx, {
             userInfo: {
               ...userInfo,
               ...mapUser
@@ -394,6 +418,93 @@ var genericOAuth = (options) => {
           }
           throw ctx.redirect(toRedirectTo);
         }
+      ),
+      oAuth2LinkAccount: chunkUPQLFVFU_cjs.createAuthEndpoint(
+        "/oauth2/link",
+        {
+          method: "POST",
+          body: zod.z.object({
+            providerId: zod.z.string(),
+            callbackURL: zod.z.string()
+          }),
+          use: [chunkUPQLFVFU_cjs.sessionMiddleware]
+        },
+        async (c) => {
+          const session = c.context.session;
+          const account = await c.context.internalAdapter.findAccounts(
+            session.user.id
+          );
+          const existingAccount = account.find(
+            (a) => a.providerId === c.body.providerId
+          );
+          if (existingAccount) {
+            throw new betterCall.APIError("BAD_REQUEST", {
+              message: chunkUPQLFVFU_cjs.BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED
+            });
+          }
+          const provider = options.config.find(
+            (p) => p.providerId === c.body.providerId
+          );
+          if (!provider) {
+            throw new betterCall.APIError("NOT_FOUND", {
+              message: chunkUPQLFVFU_cjs.BASE_ERROR_CODES.PROVIDER_NOT_FOUND
+            });
+          }
+          const {
+            providerId,
+            clientId,
+            clientSecret,
+            redirectURI,
+            authorizationUrl,
+            discoveryUrl,
+            pkce,
+            scopes
+          } = provider;
+          let finalAuthUrl = authorizationUrl;
+          if (!finalAuthUrl) {
+            if (!discoveryUrl) {
+              throw new betterCall.APIError("BAD_REQUEST", {
+                message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION
+              });
+            }
+            const discovery = await fetch.betterFetch(discoveryUrl, {
+              onError(context) {
+                c.context.logger.error(context.error.message, context.error, {
+                  discoveryUrl
+                });
+              }
+            });
+            if (discovery.data) {
+              finalAuthUrl = discovery.data.authorization_endpoint;
+            }
+          }
+          if (!finalAuthUrl) {
+            throw new betterCall.APIError("BAD_REQUEST", {
+              message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION
+            });
+          }
+          const state = await chunk2Z6CVQHH_cjs.generateState(c, {
+            userId: session.user.id,
+            email: session.user.email
+          });
+          const url = await chunkSVC7H7K4_cjs.createAuthorizationURL({
+            id: providerId,
+            options: {
+              clientId,
+              clientSecret,
+              redirectURI: redirectURI || `${c.context.baseURL}/oauth2/callback`
+            },
+            authorizationEndpoint: finalAuthUrl,
+            state: state.state,
+            codeVerifier: pkce ? state.codeVerifier : void 0,
+            scopes: scopes || [],
+            redirectURI: `${c.context.baseURL}/oauth2/callback/${providerId}`
+          });
+          return c.json({
+            url: url.toString(),
+            redirect: true
+          });
+        }
       )
     },
     $ERROR_CODES: ERROR_CODES