better-auth 1.2.6-beta.7 → 1.2.7-beta.1

package/dist/plugins/generic-oauth/index.d.cts

@@ -1,8 +1,8 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { U as User, j as AuthContext } from '../../shared/better-auth.BiQsvaIP.cjs';
-import { O as OAuth2Tokens, a as OAuthProvider } from '../../shared/better-auth.B2Fw1vhH.cjs';
-import '../../shared/better-auth.Bi8FQwDD.cjs';
+import { U as User, l as AuthContext } from '../../shared/better-auth.BcU1Kjyq.cjs';
+import { O as OAuth2Tokens, a as OAuthProvider } from '../../shared/better-auth.DTiSPWEk.cjs';
+import '../../shared/better-auth.CYegVoq1.cjs';
 import 'kysely';
 import 'better-sqlite3';
 import 'jose';
@@ -116,6 +116,19 @@ interface GenericOAuthConfig {
      * @default "post"
      */
     authentication?: "basic" | "post";
+    /**
+     * Custom headers to include in the discovery request.
+     * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
+     */
+    discoveryHeaders?: Record<string, string>;
+    /**
+     * Override user info with the provider info.
+     *
+     * This will update the user info with the provider info,
+     * when the user signs in with the provider.
+     * @default false
+     */
+    overrideUserInfo?: boolean;
 }
 interface GenericOAuthOptions {
     /**
@@ -376,6 +389,36 @@ declare const genericOAuth: (options: GenericOAuthOptions) => {
                         };
                     };
                 }>)[];
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                    format: string;
+                                                    description: string;
+                                                };
+                                                redirect: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
             } & {
                 use: any[];
             };

package/dist/plugins/generic-oauth/index.d.mts

@@ -1,8 +1,8 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { U as User, j as AuthContext } from '../../shared/better-auth.D-oLmHIj.mjs';
-import { O as OAuth2Tokens, a as OAuthProvider } from '../../shared/better-auth.bKwabe3I.mjs';
-import '../../shared/better-auth.Bi8FQwDD.mjs';
+import { U as User, l as AuthContext } from '../../shared/better-auth.DQ7OSJbI.mjs';
+import { O as OAuth2Tokens, a as OAuthProvider } from '../../shared/better-auth.B88xucNq.mjs';
+import '../../shared/better-auth.CYegVoq1.mjs';
 import 'kysely';
 import 'better-sqlite3';
 import 'jose';
@@ -116,6 +116,19 @@ interface GenericOAuthConfig {
      * @default "post"
      */
     authentication?: "basic" | "post";
+    /**
+     * Custom headers to include in the discovery request.
+     * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
+     */
+    discoveryHeaders?: Record<string, string>;
+    /**
+     * Override user info with the provider info.
+     *
+     * This will update the user info with the provider info,
+     * when the user signs in with the provider.
+     * @default false
+     */
+    overrideUserInfo?: boolean;
 }
 interface GenericOAuthOptions {
     /**
@@ -376,6 +389,36 @@ declare const genericOAuth: (options: GenericOAuthOptions) => {
                         };
                     };
                 }>)[];
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                    format: string;
+                                                    description: string;
+                                                };
+                                                redirect: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
             } & {
                 use: any[];
             };

package/dist/plugins/generic-oauth/index.d.ts

@@ -1,8 +1,8 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { U as User, j as AuthContext } from '../../shared/better-auth.DU2QNVc_.js';
-import { O as OAuth2Tokens, a as OAuthProvider } from '../../shared/better-auth.BANAxdkL.js';
-import '../../shared/better-auth.Bi8FQwDD.js';
+import { U as User, l as AuthContext } from '../../shared/better-auth.CA2hFK4N.js';
+import { O as OAuth2Tokens, a as OAuthProvider } from '../../shared/better-auth.DNTAFSt1.js';
+import '../../shared/better-auth.CYegVoq1.js';
 import 'kysely';
 import 'better-sqlite3';
 import 'jose';
@@ -116,6 +116,19 @@ interface GenericOAuthConfig {
      * @default "post"
      */
     authentication?: "basic" | "post";
+    /**
+     * Custom headers to include in the discovery request.
+     * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
+     */
+    discoveryHeaders?: Record<string, string>;
+    /**
+     * Override user info with the provider info.
+     *
+     * This will update the user info with the provider info,
+     * when the user signs in with the provider.
+     * @default false
+     */
+    overrideUserInfo?: boolean;
 }
 interface GenericOAuthOptions {
     /**
@@ -376,6 +389,36 @@ declare const genericOAuth: (options: GenericOAuthOptions) => {
                         };
                     };
                 }>)[];
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                    format: string;
+                                                    description: string;
+                                                };
+                                                redirect: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
             } & {
                 use: any[];
             };

package/dist/plugins/generic-oauth/index.mjs

@@ -1,11 +1,11 @@
 import { betterFetch } from '@better-fetch/fetch';
 import { APIError } from 'better-call';
 import { z } from 'zod';
-import { a as createAuthEndpoint, s as sessionMiddleware, B as BASE_ERROR_CODES, h as handleOAuthUserInfo } from '../../shared/better-auth.D4jH-sJA.mjs';
+import { a as createAuthEndpoint, s as sessionMiddleware, B as BASE_ERROR_CODES, h as handleOAuthUserInfo } from '../../shared/better-auth.CWwVo_61.mjs';
 import { setSessionCookie } from '../../cookies/index.mjs';
-import '../../shared/better-auth.CepcSj5H.mjs';
+import '../../shared/better-auth.Cc72UxUH.mjs';
 import '../../shared/better-auth.8zoxzg-F.mjs';
-import '../../shared/better-auth.DH3YjMQH.mjs';
+import '../../shared/better-auth.Cqykj82J.mjs';
 import 'defu';
 import { c as createAuthorizationURL, v as validateAuthorizationCode, r as refreshAccessToken } from '../../shared/better-auth.DCVeP5-W.mjs';
 import '@better-auth/utils/hash';
@@ -23,13 +23,13 @@ import '@noble/hashes/utils';
 import '../../shared/better-auth.B4Qoxdgc.mjs';
 import '@better-auth/utils/random';
 import '../../shared/better-auth.DdzSJf-n.mjs';
+import '../../shared/better-auth.tB5eU6EY.mjs';
 import '../../shared/better-auth.CW6D9eSx.mjs';
 import '../../shared/better-auth.BUPPRXfK.mjs';
 import '@better-auth/utils/hmac';
 import '../../shared/better-auth.DDEbWX-S.mjs';
 import '../../shared/better-auth.VTXNLFMT.mjs';
 import 'jose/errors';
-import '../../shared/better-auth.tB5eU6EY.mjs';
 import '@better-auth/utils/binary';
 
 async function getUserInfo(tokens, finalUserInfoUrl) {
@@ -95,7 +95,8 @@ const genericOAuth = (options) => {
             let finalTokenUrl = c.tokenUrl;
             if (c.discoveryUrl) {
               const discovery = await betterFetch(c.discoveryUrl, {
-                method: "GET"
+                method: "GET",
+                headers: c.discoveryHeaders
               });
               if (discovery.data) {
                 finalTokenUrl = discovery.data.token_endpoint;
@@ -123,7 +124,8 @@ const genericOAuth = (options) => {
             let finalTokenUrl = c.tokenUrl;
             if (c.discoveryUrl) {
               const discovery = await betterFetch(c.discoveryUrl, {
-                method: "GET"
+                method: "GET",
+                headers: c.discoveryHeaders
               });
               if (discovery.data) {
                 finalTokenUrl = discovery.data.token_endpoint;
@@ -140,6 +142,7 @@ const genericOAuth = (options) => {
                 clientId: c.clientId,
                 clientSecret: c.clientSecret
               },
+              authentication: c.authentication,
               tokenEndpoint: finalTokenUrl
             });
           },
@@ -255,6 +258,8 @@ const genericOAuth = (options) => {
           let finalTokenUrl = tokenUrl;
           if (discoveryUrl) {
             const discovery = await betterFetch(discoveryUrl, {
+              method: "GET",
+              headers: config.discoveryHeaders,
               onError(context) {
                 ctx.context.logger.error(context.error.message, context.error, {
                   discoveryUrl
@@ -379,7 +384,8 @@ const genericOAuth = (options) => {
           let finalUserInfoUrl = provider.userInfoUrl;
           if (provider.discoveryUrl) {
             const discovery = await betterFetch(provider.discoveryUrl, {
-              method: "GET"
+              method: "GET",
+              headers: provider.discoveryHeaders
             });
             if (discovery.data) {
               finalTokenUrl = discovery.data.token_endpoint;
@@ -429,18 +435,40 @@ const genericOAuth = (options) => {
             if (ctx.context.options.account?.accountLinking?.allowDifferentEmails !== true && link.email !== mapUser.email.toLowerCase()) {
               return redirectOnError("email_doesn't_match");
             }
-            const newAccount = await ctx.context.internalAdapter.createAccount({
-              userId: link.userId,
-              providerId: provider.providerId,
-              accountId: userInfo.id,
-              accessToken: tokens.accessToken,
-              refreshToken: tokens.refreshToken,
-              accessTokenExpiresAt: tokens.accessTokenExpiresAt,
-              refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
-              scope: tokens.scopes?.join(",")
-            });
-            if (!newAccount) {
-              return redirectOnError("unable_to_link_account");
+            const existingAccount = await ctx.context.internalAdapter.findAccount(userInfo.id);
+            if (existingAccount) {
+              if (existingAccount.userId !== link.userId) {
+                return redirectOnError(
+                  "account_already_linked_to_different_user"
+                );
+              }
+              const updateData = Object.fromEntries(
+                Object.entries({
+                  accessToken: tokens.accessToken,
+                  idToken: tokens.idToken,
+                  refreshToken: tokens.refreshToken,
+                  accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+                  refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+                  scope: tokens.scopes?.join(",")
+                }).filter(([_, value]) => value !== void 0)
+              );
+              await ctx.context.internalAdapter.updateAccount(
+                existingAccount.id,
+                updateData
+              );
+            } else {
+              const newAccount = await ctx.context.internalAdapter.createAccount({
+                userId: link.userId,
+                providerId: provider.providerId,
+                accountId: userInfo.id,
+                accessToken: tokens.accessToken,
+                accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+                refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+                scope: tokens.scopes?.join(",")
+              });
+              if (!newAccount) {
+                return redirectOnError("unable_to_link_account");
+              }
             }
             let toRedirectTo2;
             try {
@@ -462,7 +490,8 @@ const genericOAuth = (options) => {
               ...tokens,
               scope: tokens.scopes?.join(",")
             },
-            disableSignUp: provider.disableImplicitSignUp && !requestSignUp || provider.disableSignUp
+            disableSignUp: provider.disableImplicitSignUp && !requestSignUp || provider.disableSignUp,
+            overrideUserInfo: provider.overrideUserInfo
           });
           if (result.error) {
             return redirectOnError(result.error.split(" ").join("_"));
@@ -490,7 +519,37 @@ const genericOAuth = (options) => {
             providerId: z.string(),
             callbackURL: z.string()
           }),
-          use: [sessionMiddleware]
+          use: [sessionMiddleware],
+          metadata: {
+            openapi: {
+              description: "Link an OAuth2 account to the current user session",
+              responses: {
+                "200": {
+                  description: "Authorization URL generated successfully for linking an OAuth2 account",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          url: {
+                            type: "string",
+                            format: "uri",
+                            description: "The authorization URL to redirect the user to for linking the OAuth2 account"
+                          },
+                          redirect: {
+                            type: "boolean",
+                            description: "Indicates that the client should redirect to the provided URL",
+                            enum: [true]
+                          }
+                        },
+                        required: ["url", "redirect"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (c) => {
           const session = c.context.session;
@@ -534,6 +593,8 @@ const genericOAuth = (options) => {
               });
             }
             const discovery = await betterFetch(discoveryUrl, {
+              method: "GET",
+              headers: provider.discoveryHeaders,
               onError(context) {
                 c.context.logger.error(context.error.message, context.error, {
                   discoveryUrl

package/dist/plugins/haveibeenpwned/index.cjs

@@ -0,0 +1,98 @@
+'use strict';
+
+const betterCall = require('better-call');
+require('../../shared/better-auth.Dg0siV5C.cjs');
+require('zod');
+require('../../shared/better-auth.DiSjtgs9.cjs');
+require('@better-auth/utils/base64');
+require('@better-auth/utils/hmac');
+require('../../shared/better-auth.DcWKCjjf.cjs');
+require('../../shared/better-auth.GpOOav9x.cjs');
+require('defu');
+const hash = require('@better-auth/utils/hash');
+const fetch = require('@better-fetch/fetch');
+require('../../cookies/index.cjs');
+require('../../shared/better-auth.ANpbi45u.cjs');
+require('../../shared/better-auth.C1hdVENX.cjs');
+require('../../shared/better-auth.D3mtHEZg.cjs');
+require('../../shared/better-auth.C-R0J0n1.cjs');
+require('../../social-providers/index.cjs');
+require('jose');
+require('../../shared/better-auth.Cm29ZKNJ.cjs');
+require('@noble/ciphers/chacha');
+require('@noble/ciphers/utils');
+require('@noble/ciphers/webcrypto');
+require('@noble/hashes/scrypt');
+require('@better-auth/utils');
+require('@better-auth/utils/hex');
+require('@noble/hashes/utils');
+require('../../shared/better-auth.CYeOI8C-.cjs');
+require('@better-auth/utils/random');
+require('../../shared/better-auth.QbbyHMYf.cjs');
+require('../../shared/better-auth.Bg6iw3ig.cjs');
+require('../../shared/better-auth.BMYo0QR-.cjs');
+require('jose/errors');
+require('@better-auth/utils/binary');
+
+const ERROR_CODES = {
+  PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password."
+};
+async function checkPasswordCompromise(password, customMessage) {
+  if (!password) return;
+  const sha1Hash = (await hash.createHash("SHA-1", "hex").digest(password)).toUpperCase();
+  const prefix = sha1Hash.substring(0, 5);
+  const suffix = sha1Hash.substring(5);
+  try {
+    const { data, error } = await fetch.betterFetch(
+      `https://api.pwnedpasswords.com/range/${prefix}`,
+      {
+        headers: {
+          "Add-Padding": "true",
+          "User-Agent": "BetterAuth Password Checker"
+        }
+      }
+    );
+    if (error) {
+      throw new betterCall.APIError("INTERNAL_SERVER_ERROR", {
+        message: `Failed to check password. Status: ${error.status}`
+      });
+    }
+    const lines = data.split("\n");
+    const found = lines.some(
+      (line) => line.split(":")[0].toUpperCase() === suffix.toUpperCase()
+    );
+    if (found) {
+      throw new betterCall.APIError("BAD_REQUEST", {
+        message: customMessage || ERROR_CODES.PASSWORD_COMPROMISED,
+        code: "PASSWORD_COMPROMISED"
+      });
+    }
+  } catch (error) {
+    if (error instanceof betterCall.APIError) throw error;
+    throw new betterCall.APIError("INTERNAL_SERVER_ERROR", {
+      message: "Failed to check password. Please try again later."
+    });
+  }
+}
+const haveIBeenPwned = (options) => ({
+  id: "haveIBeenPwned",
+  init(ctx) {
+    return {
+      context: {
+        password: {
+          ...ctx.password,
+          async hash(password) {
+            await checkPasswordCompromise(
+              password,
+              options?.customPasswordCompromisedMessage
+            );
+            return ctx.password.hash(password);
+          }
+        }
+      }
+    };
+  },
+  $ERROR_CODES: ERROR_CODES
+});
+
+exports.haveIBeenPwned = haveIBeenPwned;

package/dist/plugins/haveibeenpwned/index.d.cts

@@ -0,0 +1,36 @@
+import { l as AuthContext, p as checkPassword } from '../../shared/better-auth.BcU1Kjyq.cjs';
+import '../../shared/better-auth.CYegVoq1.cjs';
+import 'zod';
+import '../../shared/better-auth.DTiSPWEk.cjs';
+import 'jose';
+import 'kysely';
+import 'better-call';
+import 'better-sqlite3';
+
+interface HaveIBeenPwnedOptions {
+    customPasswordCompromisedMessage?: string;
+}
+declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions) => {
+    id: "haveIBeenPwned";
+    init(ctx: AuthContext): {
+        context: {
+            password: {
+                hash(password: string): Promise<string>;
+                verify: (data: {
+                    password: string;
+                    hash: string;
+                }) => Promise<boolean>;
+                config: {
+                    minPasswordLength: number;
+                    maxPasswordLength: number;
+                };
+                checkPassword: typeof checkPassword;
+            };
+        };
+    };
+    $ERROR_CODES: {
+        readonly PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password.";
+    };
+};
+
+export { type HaveIBeenPwnedOptions, haveIBeenPwned };

package/dist/plugins/haveibeenpwned/index.d.mts

@@ -0,0 +1,36 @@
+import { l as AuthContext, p as checkPassword } from '../../shared/better-auth.DQ7OSJbI.mjs';
+import '../../shared/better-auth.CYegVoq1.mjs';
+import 'zod';
+import '../../shared/better-auth.B88xucNq.mjs';
+import 'jose';
+import 'kysely';
+import 'better-call';
+import 'better-sqlite3';
+
+interface HaveIBeenPwnedOptions {
+    customPasswordCompromisedMessage?: string;
+}
+declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions) => {
+    id: "haveIBeenPwned";
+    init(ctx: AuthContext): {
+        context: {
+            password: {
+                hash(password: string): Promise<string>;
+                verify: (data: {
+                    password: string;
+                    hash: string;
+                }) => Promise<boolean>;
+                config: {
+                    minPasswordLength: number;
+                    maxPasswordLength: number;
+                };
+                checkPassword: typeof checkPassword;
+            };
+        };
+    };
+    $ERROR_CODES: {
+        readonly PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password.";
+    };
+};
+
+export { type HaveIBeenPwnedOptions, haveIBeenPwned };

package/dist/plugins/haveibeenpwned/index.d.ts

@@ -0,0 +1,36 @@
+import { l as AuthContext, p as checkPassword } from '../../shared/better-auth.CA2hFK4N.js';
+import '../../shared/better-auth.CYegVoq1.js';
+import 'zod';
+import '../../shared/better-auth.DNTAFSt1.js';
+import 'jose';
+import 'kysely';
+import 'better-call';
+import 'better-sqlite3';
+
+interface HaveIBeenPwnedOptions {
+    customPasswordCompromisedMessage?: string;
+}
+declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions) => {
+    id: "haveIBeenPwned";
+    init(ctx: AuthContext): {
+        context: {
+            password: {
+                hash(password: string): Promise<string>;
+                verify: (data: {
+                    password: string;
+                    hash: string;
+                }) => Promise<boolean>;
+                config: {
+                    minPasswordLength: number;
+                    maxPasswordLength: number;
+                };
+                checkPassword: typeof checkPassword;
+            };
+        };
+    };
+    $ERROR_CODES: {
+        readonly PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password.";
+    };
+};
+
+export { type HaveIBeenPwnedOptions, haveIBeenPwned };