better-auth 1.2.0-beta.8 → 1.2.0-beta.9

package/dist/adapters/mongodb.cjs

@@ -15,7 +15,11 @@ var mongodb = require('mongodb');
 
 var createTransform = (options) => {
   const schema = chunkKAR56MJZ_cjs.getAuthTables(options);
+  const customIdGen = options.advanced?.generateId;
   function serializeID(field, value, model) {
+    if (customIdGen) {
+      return value;
+    }
     if (field === "id" || field === "_id" || schema[model].fields[field].references?.field === "id") {
       if (typeof value !== "string") {
         if (value instanceof mongodb.ObjectId) {
@@ -47,6 +51,9 @@ var createTransform = (options) => {
     return value;
   }
   function deserializeID(field, value, model) {
+    if (customIdGen) {
+      return value;
+    }
     if (field === "id" || schema[model].fields[field].references?.field === "id") {
       if (value instanceof mongodb.ObjectId) {
         return value.toHexString();
@@ -65,6 +72,9 @@ var createTransform = (options) => {
   }
   function getField(field, model) {
     if (field === "id") {
+      if (customIdGen) {
+        return "id";
+      }
       return "_id";
     }
     const f = schema[model].fields[field];
@@ -72,7 +82,9 @@ var createTransform = (options) => {
   }
   return {
     transformInput(data, model, action) {
-      const transformedData = action === "update" ? {} : {
+      const transformedData = action === "update" ? {} : customIdGen ? {
+        id: customIdGen({ model })
+      } : {
         _id: new mongodb.ObjectId()
       };
       const fields = schema[model].fields;
@@ -179,17 +191,18 @@ var createTransform = (options) => {
 };
 var mongodbAdapter = (db) => (options) => {
   const transform = createTransform(options);
+  const hasCustomId = options.advanced?.generateId;
   return {
     id: "mongodb-adapter",
     async create(data) {
       const { model, data: values, select } = data;
       const transformedData = transform.transformInput(values, model, "create");
-      if (transformedData.id) {
+      if (transformedData.id && !hasCustomId) {
         delete transformedData.id;
       }
       const res = await db.collection(transform.getModelName(model)).insertOne(transformedData);
       const id = res.insertedId;
-      const insertedData = { ...transformedData, id: id.toString() };
+      const insertedData = { id: id.toString(), ...transformedData };
       const t = transform.transformOutput(insertedData, model, select);
       return t;
     },

package/dist/adapters/mongodb.js

@@ -13,7 +13,11 @@ import { ObjectId } from 'mongodb';
 
 var createTransform = (options) => {
   const schema = getAuthTables(options);
+  const customIdGen = options.advanced?.generateId;
   function serializeID(field, value, model) {
+    if (customIdGen) {
+      return value;
+    }
     if (field === "id" || field === "_id" || schema[model].fields[field].references?.field === "id") {
       if (typeof value !== "string") {
         if (value instanceof ObjectId) {
@@ -45,6 +49,9 @@ var createTransform = (options) => {
     return value;
   }
   function deserializeID(field, value, model) {
+    if (customIdGen) {
+      return value;
+    }
     if (field === "id" || schema[model].fields[field].references?.field === "id") {
       if (value instanceof ObjectId) {
         return value.toHexString();
@@ -63,6 +70,9 @@ var createTransform = (options) => {
   }
   function getField(field, model) {
     if (field === "id") {
+      if (customIdGen) {
+        return "id";
+      }
       return "_id";
     }
     const f = schema[model].fields[field];
@@ -70,7 +80,9 @@ var createTransform = (options) => {
   }
   return {
     transformInput(data, model, action) {
-      const transformedData = action === "update" ? {} : {
+      const transformedData = action === "update" ? {} : customIdGen ? {
+        id: customIdGen({ model })
+      } : {
         _id: new ObjectId()
       };
       const fields = schema[model].fields;
@@ -177,17 +189,18 @@ var createTransform = (options) => {
 };
 var mongodbAdapter = (db) => (options) => {
   const transform = createTransform(options);
+  const hasCustomId = options.advanced?.generateId;
   return {
     id: "mongodb-adapter",
     async create(data) {
       const { model, data: values, select } = data;
       const transformedData = transform.transformInput(values, model, "create");
-      if (transformedData.id) {
+      if (transformedData.id && !hasCustomId) {
         delete transformedData.id;
       }
       const res = await db.collection(transform.getModelName(model)).insertOne(transformedData);
       const id = res.insertedId;
-      const insertedData = { ...transformedData, id: id.toString() };
+      const insertedData = { id: id.toString(), ...transformedData };
       const t = transform.transformOutput(insertedData, model, select);
       return t;
     },

package/dist/{chunk-XKCN2VRG.cjs → chunk-45RBYQKI.cjs}

@@ -32,12 +32,18 @@ var schema = {
 };
 
 // src/plugins/username/index.ts
+function defaultUsernameValidator(username2) {
+  return /^[a-zA-Z0-9_]+$/.test(username2);
+}
 var username = (options) => {
   const ERROR_CODES = {
     INVALID_USERNAME_OR_PASSWORD: "invalid username or password",
     EMAIL_NOT_VERIFIED: "email not verified",
     UNEXPECTED_ERROR: "unexpected error",
-    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another."
+    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another.",
+    USERNAME_TOO_SHORT: "username is too short",
+    USERNAME_TOO_LONG: "username is too long",
+    INVALID_USERNAME: "username is invalid"
   };
   return {
     id: "username",
@@ -85,6 +91,36 @@ var username = (options) => {
           }
         },
         async (ctx) => {
+          if (!ctx.body.username || !ctx.body.password) {
+            ctx.context.logger.error("Username or password not found");
+            throw new betterCall.APIError("UNAUTHORIZED", {
+              message: ERROR_CODES.INVALID_USERNAME_OR_PASSWORD
+            });
+          }
+          const minUsernameLength = options?.minUsernameLength || 3;
+          const maxUsernameLength = options?.maxUsernameLength || 30;
+          if (ctx.body.username.length < minUsernameLength) {
+            ctx.context.logger.error("Username too short", {
+              username: ctx.body.username
+            });
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_SHORT
+            });
+          }
+          if (ctx.body.username.length > maxUsernameLength) {
+            ctx.context.logger.error("Username too long", {
+              username: ctx.body.username
+            });
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_LONG
+            });
+          }
+          const validator = options?.usernameValidator || defaultUsernameValidator;
+          if (!validator(ctx.body.username)) {
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.INVALID_USERNAME
+            });
+          }
           const user = await ctx.context.adapter.findOne({
             model: "user",
             where: [
@@ -166,6 +202,7 @@ var username = (options) => {
               id: user.id,
               email: user.email,
               emailVerified: user.emailVerified,
+              username: user.username,
               name: user.name,
               image: user.image,
               createdAt: user.createdAt,
@@ -180,11 +217,30 @@ var username = (options) => {
       before: [
         {
           matcher(context) {
-            return context.path === "/sign-up/email";
+            return context.path === "/sign-up/email" || context.path === "/update-user";
           },
           handler: chunkN7UWN6ND_cjs.createAuthMiddleware(async (ctx) => {
             const username2 = ctx.body.username;
             if (username2) {
+              const minUsernameLength = options?.minUsernameLength || 3;
+              const maxUsernameLength = options?.maxUsernameLength || 30;
+              if (username2.length < minUsernameLength) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_SHORT
+                });
+              }
+              if (username2.length > maxUsernameLength) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_LONG
+                });
+              }
+              const validator = options?.usernameValidator || defaultUsernameValidator;
+              const valid = await validator(username2);
+              if (!valid) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.INVALID_USERNAME
+                });
+              }
               const user = await ctx.context.adapter.findOne({
                 model: "user",
                 where: [

package/dist/{chunk-KAEQXMEV.cjs → chunk-GSEEAIRZ.cjs}

@@ -332,7 +332,7 @@ var getMetadata = (ctx, options) => {
     issuer,
     authorization_endpoint: `${baseURL}/oauth2/authorize`,
     token_endpoint: `${baseURL}/oauth2/token`,
-    userInfo_endpoint: `${baseURL}/oauth2/userinfo`,
+    userinfo_endpoint: `${baseURL}/oauth2/userinfo`,
     jwks_uri: `${baseURL}/jwks`,
     registration_endpoint: `${baseURL}/oauth2/register`,
     scopes_supported: ["openid", "profile", "email", "offline_access"],

package/dist/{chunk-RMPI2YZ3.js → chunk-IQUHEVLH.js}

@@ -330,7 +330,7 @@ var getMetadata = (ctx, options) => {
     issuer,
     authorization_endpoint: `${baseURL}/oauth2/authorize`,
     token_endpoint: `${baseURL}/oauth2/token`,
-    userInfo_endpoint: `${baseURL}/oauth2/userinfo`,
+    userinfo_endpoint: `${baseURL}/oauth2/userinfo`,
     jwks_uri: `${baseURL}/jwks`,
     registration_endpoint: `${baseURL}/oauth2/register`,
     scopes_supported: ["openid", "profile", "email", "offline_access"],

package/dist/{chunk-5AOJMBJI.js → chunk-J6VNT2T4.js}

@@ -24,6 +24,14 @@ var admin = (options) => {
       throw new APIError("UNAUTHORIZED");
     }
     const user = session.user;
+    if (options?.adminUserIds?.includes(user.id)) {
+      return {
+        session: {
+          user,
+          session: session.session
+        }
+      };
+    }
     if (!user.role || (Array.isArray(opts.adminRole) ? !opts.adminRole.includes(user.role) : user.role !== opts.adminRole)) {
       throw new APIError("FORBIDDEN", {
         message: "Only admins can access this endpoint"

package/dist/{chunk-75SPUXMY.cjs → chunk-QNLSMTXF.cjs}

@@ -179,6 +179,9 @@ function getResponse(responses) {
     ...responses
   };
 }
+function toOpenApiPath(path) {
+  return path.split("/").map((part) => part.startsWith(":") ? `{${part.slice(1)}}` : part).join("/");
+}
 async function generator(ctx, options) {
   const baseEndpoints = chunkN7UWN6ND_cjs.getEndpoints(ctx, {
     ...options,
@@ -209,8 +212,9 @@ async function generator(ctx, options) {
   Object.entries(baseEndpoints.api).forEach(([_, value]) => {
     const options2 = value.options;
     if (options2.metadata?.SERVER_ONLY) return;
+    const path = toOpenApiPath(value.path);
     if (options2.method === "GET") {
-      paths[value.path] = {
+      paths[path] = {
         get: {
           tags: ["Default", ...options2.metadata?.openapi?.tags || []],
           description: options2.metadata?.openapi?.description,
@@ -227,7 +231,7 @@ async function generator(ctx, options) {
     }
     if (options2.method === "POST") {
       const body = getRequestBody(options2);
-      paths[value.path] = {
+      paths[path] = {
         post: {
           tags: ["Default", ...options2.metadata?.openapi?.tags || []],
           description: options2.metadata?.openapi?.description,
@@ -273,8 +277,9 @@ async function generator(ctx, options) {
     Object.entries(api).forEach(([key, value]) => {
       const options2 = value.options;
       if (options2.metadata?.SERVER_ONLY) return;
+      const path = toOpenApiPath(value.path);
       if (options2.method === "GET") {
-        paths[value.path] = {
+        paths[path] = {
           get: {
             tags: options2.metadata?.openapi?.tags || [
               plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)
@@ -292,7 +297,7 @@ async function generator(ctx, options) {
         };
       }
       if (options2.method === "POST") {
-        paths[value.path] = {
+        paths[path] = {
           post: {
             tags: options2.metadata?.openapi?.tags || [
               plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)

package/dist/{chunk-GWJDRQJ3.js → chunk-QQGRNAM2.js}

@@ -177,6 +177,9 @@ function getResponse(responses) {
     ...responses
   };
 }
+function toOpenApiPath(path) {
+  return path.split("/").map((part) => part.startsWith(":") ? `{${part.slice(1)}}` : part).join("/");
+}
 async function generator(ctx, options) {
   const baseEndpoints = getEndpoints(ctx, {
     ...options,
@@ -207,8 +210,9 @@ async function generator(ctx, options) {
   Object.entries(baseEndpoints.api).forEach(([_, value]) => {
     const options2 = value.options;
     if (options2.metadata?.SERVER_ONLY) return;
+    const path = toOpenApiPath(value.path);
     if (options2.method === "GET") {
-      paths[value.path] = {
+      paths[path] = {
         get: {
           tags: ["Default", ...options2.metadata?.openapi?.tags || []],
           description: options2.metadata?.openapi?.description,
@@ -225,7 +229,7 @@ async function generator(ctx, options) {
     }
     if (options2.method === "POST") {
       const body = getRequestBody(options2);
-      paths[value.path] = {
+      paths[path] = {
         post: {
           tags: ["Default", ...options2.metadata?.openapi?.tags || []],
           description: options2.metadata?.openapi?.description,
@@ -271,8 +275,9 @@ async function generator(ctx, options) {
     Object.entries(api).forEach(([key, value]) => {
       const options2 = value.options;
       if (options2.metadata?.SERVER_ONLY) return;
+      const path = toOpenApiPath(value.path);
       if (options2.method === "GET") {
-        paths[value.path] = {
+        paths[path] = {
           get: {
             tags: options2.metadata?.openapi?.tags || [
               plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)
@@ -290,7 +295,7 @@ async function generator(ctx, options) {
         };
       }
       if (options2.method === "POST") {
-        paths[value.path] = {
+        paths[path] = {
           post: {
             tags: options2.metadata?.openapi?.tags || [
               plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)

package/dist/{chunk-OALLKKNX.cjs → chunk-SMZIOWVN.cjs}

@@ -26,6 +26,14 @@ var admin = (options) => {
       throw new chunkN7UWN6ND_cjs.APIError("UNAUTHORIZED");
     }
     const user = session.user;
+    if (options?.adminUserIds?.includes(user.id)) {
+      return {
+        session: {
+          user,
+          session: session.session
+        }
+      };
+    }
     if (!user.role || (Array.isArray(opts.adminRole) ? !opts.adminRole.includes(user.role) : user.role !== opts.adminRole)) {
       throw new chunkN7UWN6ND_cjs.APIError("FORBIDDEN", {
         message: "Only admins can access this endpoint"

package/dist/{chunk-FX2ZHENM.js → chunk-TZ34QTAV.js}

@@ -30,12 +30,18 @@ var schema = {
 };
 
 // src/plugins/username/index.ts
+function defaultUsernameValidator(username2) {
+  return /^[a-zA-Z0-9_]+$/.test(username2);
+}
 var username = (options) => {
   const ERROR_CODES = {
     INVALID_USERNAME_OR_PASSWORD: "invalid username or password",
     EMAIL_NOT_VERIFIED: "email not verified",
     UNEXPECTED_ERROR: "unexpected error",
-    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another."
+    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another.",
+    USERNAME_TOO_SHORT: "username is too short",
+    USERNAME_TOO_LONG: "username is too long",
+    INVALID_USERNAME: "username is invalid"
   };
   return {
     id: "username",
@@ -83,6 +89,36 @@ var username = (options) => {
           }
         },
         async (ctx) => {
+          if (!ctx.body.username || !ctx.body.password) {
+            ctx.context.logger.error("Username or password not found");
+            throw new APIError("UNAUTHORIZED", {
+              message: ERROR_CODES.INVALID_USERNAME_OR_PASSWORD
+            });
+          }
+          const minUsernameLength = options?.minUsernameLength || 3;
+          const maxUsernameLength = options?.maxUsernameLength || 30;
+          if (ctx.body.username.length < minUsernameLength) {
+            ctx.context.logger.error("Username too short", {
+              username: ctx.body.username
+            });
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_SHORT
+            });
+          }
+          if (ctx.body.username.length > maxUsernameLength) {
+            ctx.context.logger.error("Username too long", {
+              username: ctx.body.username
+            });
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_LONG
+            });
+          }
+          const validator = options?.usernameValidator || defaultUsernameValidator;
+          if (!validator(ctx.body.username)) {
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.INVALID_USERNAME
+            });
+          }
           const user = await ctx.context.adapter.findOne({
             model: "user",
             where: [
@@ -164,6 +200,7 @@ var username = (options) => {
               id: user.id,
               email: user.email,
               emailVerified: user.emailVerified,
+              username: user.username,
               name: user.name,
               image: user.image,
               createdAt: user.createdAt,
@@ -178,11 +215,30 @@ var username = (options) => {
       before: [
         {
           matcher(context) {
-            return context.path === "/sign-up/email";
+            return context.path === "/sign-up/email" || context.path === "/update-user";
           },
           handler: createAuthMiddleware(async (ctx) => {
             const username2 = ctx.body.username;
             if (username2) {
+              const minUsernameLength = options?.minUsernameLength || 3;
+              const maxUsernameLength = options?.maxUsernameLength || 30;
+              if (username2.length < minUsernameLength) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_SHORT
+                });
+              }
+              if (username2.length > maxUsernameLength) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_LONG
+                });
+              }
+              const validator = options?.usernameValidator || defaultUsernameValidator;
+              const valid = await validator(username2);
+              if (!valid) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.INVALID_USERNAME
+                });
+              }
               const user = await ctx.context.adapter.findOne({
                 model: "user",
                 where: [

package/dist/{chunk-LIGJVOZ4.cjs → chunk-WLOSPOQJ.cjs}

@@ -3,7 +3,7 @@
 var chunkN7UWN6ND_cjs = require('./chunk-N7UWN6ND.cjs');
 var chunkV6HE2MP7_cjs = require('./chunk-V6HE2MP7.cjs');
 var zod = require('zod');
-var fetch = require('@better-fetch/fetch');
+var jose = require('jose');
 
 // src/utils/boolean.ts
 function toBoolean(value) {
@@ -55,59 +55,80 @@ var oneTap = (options) => ({
       },
       async (ctx) => {
         const { idToken } = ctx.body;
-        const { data, error } = await fetch.betterFetch("https://oauth2.googleapis.com/tokeninfo?id_token=" + idToken);
-        if (error) {
-          return ctx.json({
-            error: "Invalid token"
+        let payload;
+        try {
+          const JWKS = jose.createRemoteJWKSet(
+            new URL("https://www.googleapis.com/oauth2/v3/certs")
+          );
+          const { payload: verifiedPayload } = await jose.jwtVerify(
+            idToken,
+            JWKS,
+            {
+              issuer: ["https://accounts.google.com", "accounts.google.com"],
+              audience: options?.clientId || ctx.context.options.socialProviders?.google?.clientId
+            }
+          );
+          payload = verifiedPayload;
+        } catch (error) {
+          throw new chunkN7UWN6ND_cjs.APIError("BAD_REQUEST", {
+            message: "invalid id token"
           });
         }
-        const user = await ctx.context.internalAdapter.findUserByEmail(
-          data.email
-        );
+        const { email, email_verified, name, picture, sub } = payload;
+        if (!email) {
+          return ctx.json({ error: "Email not available in token" });
+        }
+        const user = await ctx.context.internalAdapter.findUserByEmail(email);
         if (!user) {
           if (options?.disableSignup) {
             throw new chunkN7UWN6ND_cjs.APIError("BAD_GATEWAY", {
               message: "User not found"
             });
           }
-          const user2 = await ctx.context.internalAdapter.createOAuthUser(
+          const newUser = await ctx.context.internalAdapter.createOAuthUser(
             {
-              email: data.email,
-              emailVerified: toBoolean(data.email_verified),
-              name: data.name,
-              image: data.picture
+              email,
+              emailVerified: typeof email_verified === "boolean" ? email_verified : toBoolean(email_verified),
+              name,
+              image: picture
             },
             {
               providerId: "google",
-              accountId: data.sub
+              accountId: sub
             }
           );
-          if (!user2) {
+          if (!newUser) {
             throw new chunkN7UWN6ND_cjs.APIError("INTERNAL_SERVER_ERROR", {
               message: "Could not create user"
             });
           }
           const session2 = await ctx.context.internalAdapter.createSession(
-            user2?.user.id,
+            newUser.user.id,
             ctx.request
           );
           await chunkV6HE2MP7_cjs.setSessionCookie(ctx, {
-            user: user2.user,
+            user: newUser.user,
             session: session2
           });
           return ctx.json({
             token: session2.token,
             user: {
-              id: user2.user.id,
-              email: user2.user.email,
-              emailVerified: user2.user.emailVerified,
-              name: user2.user.name,
-              image: user2.user.image,
-              createdAt: user2.user.createdAt,
-              updatedAt: user2.user.updatedAt
+              id: newUser.user.id,
+              email: newUser.user.email,
+              emailVerified: newUser.user.emailVerified,
+              name: newUser.user.name,
+              image: newUser.user.image,
+              createdAt: newUser.user.createdAt,
+              updatedAt: newUser.user.updatedAt
             }
           });
         }
+        const account = await ctx.context.internalAdapter.findAccount(sub);
+        if (!account) {
+          throw new chunkN7UWN6ND_cjs.APIError("UNAUTHORIZED", {
+            message: "Google sub doesn't match"
+          });
+        }
         const session = await ctx.context.internalAdapter.createSession(
           user.user.id,
           ctx.request