better-auth 1.2.6-beta.7 → 1.2.7-beta.1

package/dist/plugins/phone-number/index.mjs

@@ -1,11 +1,11 @@
 import { z } from 'zod';
-import { a as createAuthEndpoint, g as getSessionFromCtx, B as BASE_ERROR_CODES } from '../../shared/better-auth.D4jH-sJA.mjs';
+import { a as createAuthEndpoint, g as getSessionFromCtx, B as BASE_ERROR_CODES } from '../../shared/better-auth.CWwVo_61.mjs';
 import { APIError } from 'better-call';
-import { m as mergeSchema } from '../../shared/better-auth.CepcSj5H.mjs';
+import { m as mergeSchema } from '../../shared/better-auth.Cc72UxUH.mjs';
 import { g as generateRandomString } from '../../shared/better-auth.B4Qoxdgc.mjs';
 import { setSessionCookie } from '../../cookies/index.mjs';
 import '../../shared/better-auth.8zoxzg-F.mjs';
-import '../../shared/better-auth.DH3YjMQH.mjs';
+import '../../shared/better-auth.Cqykj82J.mjs';
 import 'defu';
 import { g as getDate } from '../../shared/better-auth.CW6D9eSx.mjs';
 import '../../social-providers/index.mjs';
@@ -24,14 +24,25 @@ import '@noble/hashes/utils';
 import '../../shared/better-auth.DdzSJf-n.mjs';
 import '@better-auth/utils/random';
 import '../../shared/better-auth.BdyOG_p4.mjs';
+import '../../shared/better-auth.tB5eU6EY.mjs';
 import '../../shared/better-auth.BUPPRXfK.mjs';
 import '@better-auth/utils/hmac';
 import '../../shared/better-auth.DDEbWX-S.mjs';
 import '../../shared/better-auth.VTXNLFMT.mjs';
 import 'jose/errors';
-import '../../shared/better-auth.tB5eU6EY.mjs';
 import '@better-auth/utils/binary';
 
+const ERROR_CODES = {
+  INVALID_PHONE_NUMBER: "Invalid phone number",
+  PHONE_NUMBER_EXIST: "Phone number already exist",
+  INVALID_PHONE_NUMBER_OR_PASSWORD: "Invalid phone number or password",
+  UNEXPECTED_ERROR: "Unexpected error",
+  OTP_NOT_FOUND: "OTP not found",
+  OTP_EXPIRED: "OTP expired",
+  INVALID_OTP: "Invalid OTP",
+  PHONE_NUMBER_NOT_VERIFIED: "Phone number not verified"
+};
+
 function generateOTP(size) {
   return generateRandomString(size, "0-9");
 }
@@ -45,15 +56,6 @@ const phoneNumber = (options) => {
     code: "code",
     createdAt: "createdAt"
   };
-  const ERROR_CODES = {
-    INVALID_PHONE_NUMBER: "Invalid phone number",
-    PHONE_NUMBER_EXIST: "Phone number already exist",
-    INVALID_PHONE_NUMBER_OR_PASSWORD: "Invalid phone number or password",
-    UNEXPECTED_ERROR: "Unexpected error",
-    OTP_NOT_FOUND: "OTP not found",
-    OTP_EXPIRED: "OTP expired",
-    INVALID_OTP: "Invalid OTP"
-  };
   return {
     id: "phone-number",
     endpoints: {
@@ -128,6 +130,23 @@ const phoneNumber = (options) => {
               message: ERROR_CODES.INVALID_PHONE_NUMBER_OR_PASSWORD
             });
           }
+          if (opts.requireVerification) {
+            if (!user.phoneNumberVerified) {
+              const otp = generateOTP(opts.otpLength);
+              await ctx.context.internalAdapter.createVerificationValue({
+                value: otp,
+                identifier: phoneNumber2,
+                expiresAt: getDate(opts.expiresIn, "sec")
+              });
+              await opts.sendOTP?.({
+                phoneNumber: phoneNumber2,
+                code: otp
+              });
+              throw new APIError("UNAUTHORIZED", {
+                message: ERROR_CODES.PHONE_NUMBER_NOT_VERIFIED
+              });
+            }
+          }
           const accounts = await ctx.context.internalAdapter.findAccountByUserId(user.id);
           const credentialAccount = accounts.find(
             (a) => a.providerId === "credential"
@@ -244,7 +263,7 @@ const phoneNumber = (options) => {
           }
           const code = generateOTP(opts.otpLength);
           await ctx.context.internalAdapter.createVerificationValue({
-            value: code,
+            value: `${code}:0`,
             identifier: ctx.body.phoneNumber,
             expiresAt: getDate(opts.expiresIn, "sec")
           });
@@ -296,20 +315,83 @@ const phoneNumber = (options) => {
               summary: "Verify phone number",
               description: "Use this endpoint to verify phone number",
               responses: {
-                200: {
-                  description: "Success",
+                "200": {
+                  description: "Phone number verified successfully",
                   content: {
                     "application/json": {
                       schema: {
                         type: "object",
                         properties: {
-                          user: {
-                            $ref: "#/components/schemas/User"
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the verification was successful",
+                            enum: [true]
                           },
-                          session: {
-                            $ref: "#/components/schemas/Session"
+                          token: {
+                            type: "string",
+                            nullable: true,
+                            description: "Session token if session is created, null if disableSession is true or no session is created"
+                          },
+                          user: {
+                            type: "object",
+                            nullable: true,
+                            properties: {
+                              id: {
+                                type: "string",
+                                description: "Unique identifier of the user"
+                              },
+                              email: {
+                                type: "string",
+                                format: "email",
+                                nullable: true,
+                                description: "User's email address"
+                              },
+                              emailVerified: {
+                                type: "boolean",
+                                nullable: true,
+                                description: "Whether the email is verified"
+                              },
+                              name: {
+                                type: "string",
+                                nullable: true,
+                                description: "User's name"
+                              },
+                              image: {
+                                type: "string",
+                                format: "uri",
+                                nullable: true,
+                                description: "User's profile image URL"
+                              },
+                              phoneNumber: {
+                                type: "string",
+                                description: "User's phone number"
+                              },
+                              phoneNumberVerified: {
+                                type: "boolean",
+                                description: "Whether the phone number is verified"
+                              },
+                              createdAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the user was created"
+                              },
+                              updatedAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the user was last updated"
+                              }
+                            },
+                            required: [
+                              "id",
+                              "phoneNumber",
+                              "phoneNumberVerified",
+                              "createdAt",
+                              "updatedAt"
+                            ],
+                            description: "User object with phone number details, null if no user is created or found"
                           }
-                        }
+                        },
+                        required: ["status"]
                       }
                     }
                   }
@@ -335,7 +417,18 @@ const phoneNumber = (options) => {
               message: ERROR_CODES.OTP_NOT_FOUND
             });
           }
-          if (otp.value !== ctx.body.code) {
+          const [otpValue, attempts] = otp.value.split(":");
+          const allowedAttempts = options?.allowedAttempts || 3;
+          if (attempts && parseInt(attempts) >= allowedAttempts) {
+            await ctx.context.internalAdapter.deleteVerificationValue(otp.id);
+            throw new APIError("FORBIDDEN", {
+              message: "Too many attempts"
+            });
+          }
+          if (otpValue !== ctx.body.code) {
+            await ctx.context.internalAdapter.updateVerificationValue(otp.id, {
+              value: `${otpValue}:${parseInt(attempts || "0") + 1}`
+            });
             throw new APIError("BAD_REQUEST", {
               message: "Invalid OTP"
             });
@@ -443,7 +536,7 @@ const phoneNumber = (options) => {
           if (!ctx.body.disableSession) {
             const session = await ctx.context.internalAdapter.createSession(
               user.id,
-              ctx.request
+              ctx.headers
             );
             if (!session) {
               throw new APIError("INTERNAL_SERVER_ERROR", {
@@ -493,7 +586,32 @@ const phoneNumber = (options) => {
           method: "POST",
           body: z.object({
             phoneNumber: z.string()
-          })
+          }),
+          metadata: {
+            openapi: {
+              description: "Request OTP for password reset via phone number",
+              responses: {
+                "200": {
+                  description: "OTP sent successfully for password reset",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the OTP was sent successfully",
+                            enum: [true]
+                          }
+                        },
+                        required: ["status"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (ctx) => {
           const user = await ctx.context.adapter.findOne({
@@ -512,7 +630,7 @@ const phoneNumber = (options) => {
           }
           const code = generateOTP(opts.otpLength);
           await ctx.context.internalAdapter.createVerificationValue({
-            value: code,
+            value: `${code}:0`,
             identifier: `${ctx.body.phoneNumber}-forget-password`,
             expiresAt: getDate(opts.expiresIn, "sec")
           });
@@ -536,7 +654,32 @@ const phoneNumber = (options) => {
             otp: z.string(),
             phoneNumber: z.string(),
             newPassword: z.string()
-          })
+          }),
+          metadata: {
+            openapi: {
+              description: "Reset password using phone number OTP",
+              responses: {
+                "200": {
+                  description: "Password reset successfully",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the password was reset successfully",
+                            enum: [true]
+                          }
+                        },
+                        required: ["status"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (ctx) => {
           const verification = await ctx.context.internalAdapter.findVerificationValue(
@@ -552,7 +695,23 @@ const phoneNumber = (options) => {
               message: ERROR_CODES.OTP_EXPIRED
             });
           }
-          if (verification.value !== ctx.body.otp) {
+          const [otpValue, attempts] = verification.value.split(":");
+          const allowedAttempts = options?.allowedAttempts || 3;
+          if (attempts && parseInt(attempts) >= allowedAttempts) {
+            await ctx.context.internalAdapter.deleteVerificationValue(
+              verification.id
+            );
+            throw new APIError("FORBIDDEN", {
+              message: "Too many attempts"
+            });
+          }
+          if (ctx.body.otp !== otpValue) {
+            await ctx.context.internalAdapter.updateVerificationValue(
+              verification.id,
+              {
+                value: `${otpValue}:${parseInt(attempts || "0") + 1}`
+              }
+            );
             throw new APIError("BAD_REQUEST", {
               message: ERROR_CODES.INVALID_OTP
             });
@@ -585,6 +744,15 @@ const phoneNumber = (options) => {
       )
     },
     schema: mergeSchema(schema, options?.schema),
+    rateLimit: [
+      {
+        pathMatcher(path) {
+          return path.startsWith("/phone-number");
+        },
+        window: 60 * 1e3,
+        max: 10
+      }
+    ],
     $ERROR_CODES: ERROR_CODES
   };
 };

package/dist/plugins/sso/index.cjs

@@ -2,9 +2,9 @@
 
 const zod = require('zod');
 const betterCall = require('better-call');
-const refreshToken = require('../../shared/better-auth.BDYXUcLv.cjs');
+const refreshToken = require('../../shared/better-auth.Dg0siV5C.cjs');
 const cookies_index = require('../../cookies/index.cjs');
-require('../../shared/better-auth.C5H9XEzZ.cjs');
+require('../../shared/better-auth.DcWKCjjf.cjs');
 require('../../shared/better-auth.DiSjtgs9.cjs');
 require('../../shared/better-auth.GpOOav9x.cjs');
 require('defu');
@@ -25,13 +25,13 @@ require('@noble/hashes/utils');
 require('../../shared/better-auth.CYeOI8C-.cjs');
 require('@better-auth/utils/random');
 require('../../shared/better-auth.ANpbi45u.cjs');
+require('../../shared/better-auth.D3mtHEZg.cjs');
 require('../../shared/better-auth.C1hdVENX.cjs');
 require('../../shared/better-auth.Bg6iw3ig.cjs');
 require('@better-auth/utils/hmac');
 require('../../shared/better-auth.BMYo0QR-.cjs');
 require('../../shared/better-auth.C-R0J0n1.cjs');
 require('jose/errors');
-require('../../shared/better-auth.D3mtHEZg.cjs');
 require('@better-auth/utils/binary');
 
 const sso = (options) => {
@@ -98,7 +98,10 @@ const sso = (options) => {
             }).optional(),
             organizationId: zod.z.string({
               description: "If organization plugin is enabled, the organization id to link the provider to"
-            }).optional()
+            }).optional(),
+            overrideUserInfo: zod.z.boolean({
+              description: "Override user info with the provider info. Defaults to false"
+            }).default(false).optional()
           }),
           use: [refreshToken.sessionMiddleware],
           metadata: {
@@ -107,7 +110,160 @@ const sso = (options) => {
               description: "This endpoint is used to register an OIDC provider. This is used to configure the provider and link it to an organization",
               responses: {
                 "200": {
-                  description: "The created provider"
+                  description: "OIDC provider created successfully",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          issuer: {
+                            type: "string",
+                            format: "uri",
+                            description: "The issuer URL of the provider"
+                          },
+                          domain: {
+                            type: "string",
+                            description: "The domain of the provider, used for email matching"
+                          },
+                          oidcConfig: {
+                            type: "object",
+                            properties: {
+                              issuer: {
+                                type: "string",
+                                format: "uri",
+                                description: "The issuer URL of the provider"
+                              },
+                              pkce: {
+                                type: "boolean",
+                                description: "Whether PKCE is enabled for the authorization flow"
+                              },
+                              clientId: {
+                                type: "string",
+                                description: "The client ID for the provider"
+                              },
+                              clientSecret: {
+                                type: "string",
+                                description: "The client secret for the provider"
+                              },
+                              authorizationEndpoint: {
+                                type: "string",
+                                format: "uri",
+                                nullable: true,
+                                description: "The authorization endpoint URL"
+                              },
+                              discoveryEndpoint: {
+                                type: "string",
+                                format: "uri",
+                                description: "The discovery endpoint URL"
+                              },
+                              userInfoEndpoint: {
+                                type: "string",
+                                format: "uri",
+                                nullable: true,
+                                description: "The user info endpoint URL"
+                              },
+                              scopes: {
+                                type: "array",
+                                items: { type: "string" },
+                                nullable: true,
+                                description: "The scopes requested from the provider"
+                              },
+                              tokenEndpoint: {
+                                type: "string",
+                                format: "uri",
+                                nullable: true,
+                                description: "The token endpoint URL"
+                              },
+                              tokenEndpointAuthentication: {
+                                type: "string",
+                                enum: [
+                                  "client_secret_post",
+                                  "client_secret_basic"
+                                ],
+                                nullable: true,
+                                description: "Authentication method for the token endpoint"
+                              },
+                              jwksEndpoint: {
+                                type: "string",
+                                format: "uri",
+                                nullable: true,
+                                description: "The JWKS endpoint URL"
+                              },
+                              mapping: {
+                                type: "object",
+                                nullable: true,
+                                properties: {
+                                  id: {
+                                    type: "string",
+                                    description: "Field mapping for user ID (defaults to 'sub')"
+                                  },
+                                  email: {
+                                    type: "string",
+                                    description: "Field mapping for email (defaults to 'email')"
+                                  },
+                                  emailVerified: {
+                                    type: "string",
+                                    nullable: true,
+                                    description: "Field mapping for email verification (defaults to 'email_verified')"
+                                  },
+                                  name: {
+                                    type: "string",
+                                    description: "Field mapping for name (defaults to 'name')"
+                                  },
+                                  image: {
+                                    type: "string",
+                                    nullable: true,
+                                    description: "Field mapping for image (defaults to 'picture')"
+                                  },
+                                  extraFields: {
+                                    type: "object",
+                                    additionalProperties: { type: "string" },
+                                    nullable: true,
+                                    description: "Additional field mappings"
+                                  }
+                                },
+                                required: ["id", "email", "name"]
+                              }
+                            },
+                            required: [
+                              "issuer",
+                              "pkce",
+                              "clientId",
+                              "clientSecret",
+                              "discoveryEndpoint"
+                            ],
+                            description: "OIDC configuration for the provider"
+                          },
+                          organizationId: {
+                            type: "string",
+                            nullable: true,
+                            description: "ID of the linked organization, if any"
+                          },
+                          userId: {
+                            type: "string",
+                            description: "ID of the user who registered the provider"
+                          },
+                          providerId: {
+                            type: "string",
+                            description: "Unique identifier for the provider"
+                          },
+                          redirectURI: {
+                            type: "string",
+                            format: "uri",
+                            description: "The redirect URI for the provider callback"
+                          }
+                        },
+                        required: [
+                          "issuer",
+                          "domain",
+                          "oidcConfig",
+                          "userId",
+                          "providerId",
+                          "redirectURI"
+                        ]
+                      }
+                    }
+                  }
                 }
               }
             }
@@ -138,7 +294,8 @@ const sso = (options) => {
                 discoveryEndpoint: body.discoveryEndpoint || `${body.issuer}/.well-known/openid-configuration`,
                 mapping: body.mapping,
                 scopes: body.scopes,
-                userinfoEndpoint: body.userInfoEndpoint
+                userinfoEndpoint: body.userInfoEndpoint,
+                overrideUserInfo: ctx.body.overrideUserInfo || options?.defaultOverrideUserInfo || false
               }),
               organizationId: body.organizationId,
               userId: ctx.context.session.user.id,
@@ -224,6 +381,31 @@ const sso = (options) => {
                     }
                   }
                 }
+              },
+              responses: {
+                "200": {
+                  description: "Authorization URL generated successfully for SSO sign-in",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          url: {
+                            type: "string",
+                            format: "uri",
+                            description: "The authorization URL to redirect the user to for SSO sign-in"
+                          },
+                          redirect: {
+                            type: "boolean",
+                            description: "Indicates that the client should redirect to the provided URL",
+                            enum: [true]
+                          }
+                        },
+                        required: ["url", "redirect"]
+                      }
+                    }
+                  }
+                }
               }
             }
           }
@@ -479,7 +661,8 @@ const sso = (options) => {
               refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
               scope: tokenResponse.scopes?.join(",")
             },
-            disableSignUp: options?.disableImplicitSignUp && !requestSignUp
+            disableSignUp: options?.disableImplicitSignUp && !requestSignUp,
+            overrideUserInfo: config.overrideUserInfo
           });
           if (linked.error) {
             throw ctx.redirect(