better-auth 1.4.18 → 1.4.19

package/dist/plugins/api-key/index.d.mts

@@ -1,12 +1,12 @@
 import { ApiKey, ApiKeyOptions } from "./types.mjs";
-import * as _better_auth_core32 from "@better-auth/core";
-import * as _better_auth_core_db24 from "@better-auth/core/db";
+import * as _better_auth_core22 from "@better-auth/core";
+import * as _better_auth_core_db3 from "@better-auth/core/db";
 import * as _better_auth_core_env0 from "@better-auth/core/env";
-import * as _better_auth_core_oauth28 from "@better-auth/core/oauth2";
-import * as _better_auth_core_db_adapter1 from "@better-auth/core/db/adapter";
-import * as better_call729 from "better-call";
-import * as zod1946 from "zod";
-import * as zod_v4_core280 from "zod/v4/core";
+import * as _better_auth_core_oauth22 from "@better-auth/core/oauth2";
+import * as _better_auth_core_db_adapter0 from "@better-auth/core/db/adapter";
+import * as better_call267 from "better-call";
+import * as zod530 from "zod";
+import * as zod_v4_core78 from "zod/v4/core";
 
 //#region src/plugins/api-key/index.d.ts
 declare const defaultKeyHasher: (key: string) => Promise<string>;
@@ -69,8 +69,8 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
   };
   hooks: {
     before: {
-      matcher: (ctx: _better_auth_core32.HookEndpointContext) => boolean;
-      handler: (inputContext: better_call729.MiddlewareInputContext<better_call729.MiddlewareOptions>) => Promise<{
+      matcher: (ctx: _better_auth_core22.HookEndpointContext) => boolean;
+      handler: (inputContext: better_call267.MiddlewareInputContext<better_call267.MiddlewareOptions>) => Promise<{
         user: {
           id: string;
           createdAt: Date;
@@ -91,11 +91,11 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
           expiresAt: Date;
         };
       } | {
-        context: better_call729.MiddlewareContext<better_call729.MiddlewareOptions, {
+        context: better_call267.MiddlewareContext<better_call267.MiddlewareOptions, {
           returned?: unknown | undefined;
           responseHeaders?: Headers | undefined;
-        } & _better_auth_core32.PluginContext & _better_auth_core32.InfoContext & {
-          options: _better_auth_core32.BetterAuthOptions;
+        } & _better_auth_core22.PluginContext & _better_auth_core22.InfoContext & {
+          options: _better_auth_core22.BetterAuthOptions;
           appName: string;
           baseURL: string;
           trustedOrigins: string[];
@@ -107,29 +107,29 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
             storeStateStrategy: "database" | "cookie";
           };
           newSession: {
-            session: _better_auth_core_db24.Session & Record<string, any>;
-            user: _better_auth_core_db24.User & Record<string, any>;
+            session: _better_auth_core_db3.Session & Record<string, any>;
+            user: _better_auth_core_db3.User & Record<string, any>;
           } | null;
           session: {
-            session: _better_auth_core_db24.Session & Record<string, any>;
-            user: _better_auth_core_db24.User & Record<string, any>;
+            session: _better_auth_core_db3.Session & Record<string, any>;
+            user: _better_auth_core_db3.User & Record<string, any>;
           } | null;
           setNewSession: (session: {
-            session: _better_auth_core_db24.Session & Record<string, any>;
-            user: _better_auth_core_db24.User & Record<string, any>;
+            session: _better_auth_core_db3.Session & Record<string, any>;
+            user: _better_auth_core_db3.User & Record<string, any>;
           } | null) => void;
-          socialProviders: _better_auth_core_oauth28.OAuthProvider[];
-          authCookies: _better_auth_core32.BetterAuthCookies;
+          socialProviders: _better_auth_core_oauth22.OAuthProvider[];
+          authCookies: _better_auth_core22.BetterAuthCookies;
           logger: ReturnType<typeof _better_auth_core_env0.createLogger>;
           rateLimit: {
             enabled: boolean;
             window: number;
             max: number;
             storage: "memory" | "database" | "secondary-storage";
-          } & Omit<_better_auth_core32.BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
-          adapter: _better_auth_core_db_adapter1.DBAdapter<_better_auth_core32.BetterAuthOptions>;
-          internalAdapter: _better_auth_core32.InternalAdapter<_better_auth_core32.BetterAuthOptions>;
-          createAuthCookie: (cookieName: string, overrideAttributes?: Partial<better_call729.CookieOptions> | undefined) => _better_auth_core32.BetterAuthCookie;
+          } & Omit<_better_auth_core22.BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
+          adapter: _better_auth_core_db_adapter0.DBAdapter<_better_auth_core22.BetterAuthOptions>;
+          internalAdapter: _better_auth_core22.InternalAdapter<_better_auth_core22.BetterAuthOptions>;
+          createAuthCookie: (cookieName: string, overrideAttributes?: Partial<better_call267.CookieOptions> | undefined) => _better_auth_core22.BetterAuthCookie;
           secret: string;
           sessionConfig: {
             updateAge: number;
@@ -141,10 +141,10 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
             };
           };
           generateId: (options: {
-            model: _better_auth_core_db24.ModelNames;
+            model: _better_auth_core_db3.ModelNames;
             size?: number | undefined;
           }) => string | false;
-          secondaryStorage: _better_auth_core_db24.SecondaryStorage | undefined;
+          secondaryStorage: _better_auth_core_db3.SecondaryStorage | undefined;
           password: {
             hash: (password: string) => Promise<string>;
             verify: (data: {
@@ -155,9 +155,9 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
               minPasswordLength: number;
               maxPasswordLength: number;
             };
-            checkPassword: (userId: string, ctx: _better_auth_core32.GenericEndpointContext<_better_auth_core32.BetterAuthOptions>) => Promise<boolean>;
+            checkPassword: (userId: string, ctx: _better_auth_core22.GenericEndpointContext<_better_auth_core22.BetterAuthOptions>) => Promise<boolean>;
           };
-          tables: _better_auth_core_db24.BetterAuthDBSchema;
+          tables: _better_auth_core_db3.BetterAuthDBSchema;
           runMigrations: () => Promise<void>;
           publishTelemetry: (event: {
             type: string;
@@ -167,7 +167,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
           skipOriginCheck: boolean | string[];
           skipCSRFCheck: boolean;
           runInBackground: (promise: Promise<unknown>) => void;
-          runInBackgroundOrAwait: (promise: Promise<unknown> | void) => _better_auth_core32.Awaitable<unknown>;
+          runInBackgroundOrAwait: (promise: Promise<unknown> | void) => _better_auth_core22.Awaitable<unknown>;
         }>;
       }>;
     }[];
@@ -188,22 +188,22 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/api-key#api-method-api-key-create)
      */
-    createApiKey: better_call729.StrictEndpoint<"/api-key/create", {
+    createApiKey: better_call267.StrictEndpoint<"/api-key/create", {
       method: "POST";
-      body: zod1946.ZodObject<{
-        name: zod1946.ZodOptional<zod1946.ZodString>;
-        expiresIn: zod1946.ZodDefault<zod1946.ZodNullable<zod1946.ZodOptional<zod1946.ZodNumber>>>;
-        userId: zod1946.ZodOptional<zod1946.ZodCoercedString<unknown>>;
-        prefix: zod1946.ZodOptional<zod1946.ZodString>;
-        remaining: zod1946.ZodDefault<zod1946.ZodNullable<zod1946.ZodOptional<zod1946.ZodNumber>>>;
-        metadata: zod1946.ZodOptional<zod1946.ZodAny>;
-        refillAmount: zod1946.ZodOptional<zod1946.ZodNumber>;
-        refillInterval: zod1946.ZodOptional<zod1946.ZodNumber>;
-        rateLimitTimeWindow: zod1946.ZodOptional<zod1946.ZodNumber>;
-        rateLimitMax: zod1946.ZodOptional<zod1946.ZodNumber>;
-        rateLimitEnabled: zod1946.ZodOptional<zod1946.ZodBoolean>;
-        permissions: zod1946.ZodOptional<zod1946.ZodRecord<zod1946.ZodString, zod1946.ZodArray<zod1946.ZodString>>>;
-      }, zod_v4_core280.$strip>;
+      body: zod530.ZodObject<{
+        name: zod530.ZodOptional<zod530.ZodString>;
+        expiresIn: zod530.ZodDefault<zod530.ZodNullable<zod530.ZodOptional<zod530.ZodNumber>>>;
+        userId: zod530.ZodOptional<zod530.ZodCoercedString<unknown>>;
+        prefix: zod530.ZodOptional<zod530.ZodString>;
+        remaining: zod530.ZodDefault<zod530.ZodNullable<zod530.ZodOptional<zod530.ZodNumber>>>;
+        metadata: zod530.ZodOptional<zod530.ZodAny>;
+        refillAmount: zod530.ZodOptional<zod530.ZodNumber>;
+        refillInterval: zod530.ZodOptional<zod530.ZodNumber>;
+        rateLimitTimeWindow: zod530.ZodOptional<zod530.ZodNumber>;
+        rateLimitMax: zod530.ZodOptional<zod530.ZodNumber>;
+        rateLimitEnabled: zod530.ZodOptional<zod530.ZodBoolean>;
+        permissions: zod530.ZodOptional<zod530.ZodRecord<zod530.ZodString, zod530.ZodArray<zod530.ZodString>>>;
+      }, zod_v4_core78.$strip>;
       metadata: {
         openapi: {
           description: string;
@@ -368,17 +368,32 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/api-key#api-method-api-key-verify)
      */
-    verifyApiKey: better_call729.StrictEndpoint<string, {
+    verifyApiKey: better_call267.StrictEndpoint<string, {
       method: "POST";
-      body: zod1946.ZodObject<{
-        key: zod1946.ZodString;
-        permissions: zod1946.ZodOptional<zod1946.ZodRecord<zod1946.ZodString, zod1946.ZodArray<zod1946.ZodString>>>;
-      }, zod_v4_core280.$strip>;
+      body: zod530.ZodObject<{
+        key: zod530.ZodString;
+        permissions: zod530.ZodOptional<zod530.ZodRecord<zod530.ZodString, zod530.ZodArray<zod530.ZodString>>>;
+      }, zod_v4_core78.$strip>;
     }, {
+      valid: boolean;
+      error: {
+        message: "Invalid API key.";
+        code: "KEY_NOT_FOUND";
+      };
+      key: null;
+    } | {
       valid: boolean;
       error: {
         message: string | undefined;
         code: string;
+        cause?: unknown;
+      };
+      key: null;
+    } | {
+      valid: boolean;
+      error: {
+        message: "Invalid API key.";
+        code: "INVALID_API_KEY";
       };
       key: null;
     } | {
@@ -401,12 +416,12 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/api-key#api-method-api-key-get)
      */
-    getApiKey: better_call729.StrictEndpoint<"/api-key/get", {
+    getApiKey: better_call267.StrictEndpoint<"/api-key/get", {
       method: "GET";
-      query: zod1946.ZodObject<{
-        id: zod1946.ZodString;
-      }, zod_v4_core280.$strip>;
-      use: ((inputContext: better_call729.MiddlewareInputContext<better_call729.MiddlewareOptions>) => Promise<{
+      query: zod530.ZodObject<{
+        id: zod530.ZodString;
+      }, zod_v4_core78.$strip>;
+      use: ((inputContext: better_call267.MiddlewareInputContext<better_call267.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -588,23 +603,23 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/api-key#api-method-api-key-update)
      */
-    updateApiKey: better_call729.StrictEndpoint<"/api-key/update", {
+    updateApiKey: better_call267.StrictEndpoint<"/api-key/update", {
       method: "POST";
-      body: zod1946.ZodObject<{
-        keyId: zod1946.ZodString;
-        userId: zod1946.ZodOptional<zod1946.ZodCoercedString<unknown>>;
-        name: zod1946.ZodOptional<zod1946.ZodString>;
-        enabled: zod1946.ZodOptional<zod1946.ZodBoolean>;
-        remaining: zod1946.ZodOptional<zod1946.ZodNumber>;
-        refillAmount: zod1946.ZodOptional<zod1946.ZodNumber>;
-        refillInterval: zod1946.ZodOptional<zod1946.ZodNumber>;
-        metadata: zod1946.ZodOptional<zod1946.ZodAny>;
-        expiresIn: zod1946.ZodNullable<zod1946.ZodOptional<zod1946.ZodNumber>>;
-        rateLimitEnabled: zod1946.ZodOptional<zod1946.ZodBoolean>;
-        rateLimitTimeWindow: zod1946.ZodOptional<zod1946.ZodNumber>;
-        rateLimitMax: zod1946.ZodOptional<zod1946.ZodNumber>;
-        permissions: zod1946.ZodNullable<zod1946.ZodOptional<zod1946.ZodRecord<zod1946.ZodString, zod1946.ZodArray<zod1946.ZodString>>>>;
-      }, zod_v4_core280.$strip>;
+      body: zod530.ZodObject<{
+        keyId: zod530.ZodString;
+        userId: zod530.ZodOptional<zod530.ZodCoercedString<unknown>>;
+        name: zod530.ZodOptional<zod530.ZodString>;
+        enabled: zod530.ZodOptional<zod530.ZodBoolean>;
+        remaining: zod530.ZodOptional<zod530.ZodNumber>;
+        refillAmount: zod530.ZodOptional<zod530.ZodNumber>;
+        refillInterval: zod530.ZodOptional<zod530.ZodNumber>;
+        metadata: zod530.ZodOptional<zod530.ZodAny>;
+        expiresIn: zod530.ZodNullable<zod530.ZodOptional<zod530.ZodNumber>>;
+        rateLimitEnabled: zod530.ZodOptional<zod530.ZodBoolean>;
+        rateLimitTimeWindow: zod530.ZodOptional<zod530.ZodNumber>;
+        rateLimitMax: zod530.ZodOptional<zod530.ZodNumber>;
+        permissions: zod530.ZodNullable<zod530.ZodOptional<zod530.ZodRecord<zod530.ZodString, zod530.ZodArray<zod530.ZodString>>>>;
+      }, zod_v4_core78.$strip>;
       metadata: {
         openapi: {
           description: string;
@@ -764,12 +779,12 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/api-key#api-method-api-key-delete)
      */
-    deleteApiKey: better_call729.StrictEndpoint<"/api-key/delete", {
+    deleteApiKey: better_call267.StrictEndpoint<"/api-key/delete", {
       method: "POST";
-      body: zod1946.ZodObject<{
-        keyId: zod1946.ZodString;
-      }, zod_v4_core280.$strip>;
-      use: ((inputContext: better_call729.MiddlewareInputContext<better_call729.MiddlewareOptions>) => Promise<{
+      body: zod530.ZodObject<{
+        keyId: zod530.ZodString;
+      }, zod_v4_core78.$strip>;
+      use: ((inputContext: better_call267.MiddlewareInputContext<better_call267.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -850,9 +865,9 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/api-key#api-method-api-key-list)
      */
-    listApiKeys: better_call729.StrictEndpoint<"/api-key/list", {
+    listApiKeys: better_call267.StrictEndpoint<"/api-key/list", {
       method: "GET";
-      use: ((inputContext: better_call729.MiddlewareInputContext<better_call729.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: better_call267.MiddlewareInputContext<better_call267.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1034,7 +1049,7 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/api-key#api-method-api-key-delete-all-expired-api-keys)
      */
-    deleteAllExpiredApiKeys: better_call729.StrictEndpoint<string, {
+    deleteAllExpiredApiKeys: better_call267.StrictEndpoint<string, {
       method: "POST";
     }, {
       success: boolean;
@@ -1156,8 +1171,8 @@ declare const apiKey: (options?: ApiKeyOptions | undefined) => {
           required: false;
           input: true;
           transform: {
-            input(value: _better_auth_core_db24.DBPrimitive): string;
-            output(value: _better_auth_core_db24.DBPrimitive): any;
+            input(value: _better_auth_core_db3.DBPrimitive): string;
+            output(value: _better_auth_core_db3.DBPrimitive): any;
           };
         };
       };

package/dist/plugins/api-key/routes/verify-api-key.mjs

@@ -205,6 +205,7 @@ function verifyApiKey({ opts, schema, deleteAllExpiredApiKeys }) {
 			if (error instanceof APIError) return ctx.json({
 				valid: false,
 				error: {
+					...error.body,
 					message: error.body?.message,
 					code: error.body?.code
 				},

package/dist/plugins/api-key/routes/verify-api-key.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify-api-key.mjs","names":["updated: ApiKey","newApiKey: ApiKey | null","apiKey: ApiKey | null","migratedMetadata: Record<string, any> | null"],"sources":["../../../../src/plugins/api-key/routes/verify-api-key.ts"],"sourcesContent":["import type { AuthContext, GenericEndpointContext } from \"@better-auth/core\";\nimport { createAuthEndpoint } from \"@better-auth/core/api\";\nimport { safeJSONParse } from \"@better-auth/core/utils\";\nimport * as z from \"zod\";\nimport { APIError } from \"../../../api\";\nimport { role } from \"../../access\";\nimport { API_KEY_TABLE_NAME, ERROR_CODES } from \"..\";\nimport { defaultKeyHasher } from \"../\";\nimport {\n\tdeleteApiKey,\n\tgetApiKey,\n\tmigrateDoubleStringifiedMetadata,\n\tsetApiKey,\n} from \"../adapter\";\nimport { isRateLimited } from \"../rate-limit\";\nimport type { apiKeySchema } from \"../schema\";\nimport type { ApiKey } from \"../types\";\nimport type { PredefinedApiKeyOptions } from \".\";\n\nexport async function validateApiKey({\n\thashedKey,\n\tctx,\n\topts,\n\tschema,\n\tpermissions,\n}: {\n\thashedKey: string;\n\topts: PredefinedApiKeyOptions;\n\tschema: ReturnType<typeof apiKeySchema>;\n\tpermissions?: Record<string, string[]> | undefined;\n\tctx: GenericEndpointContext;\n}) {\n\tconst apiKey = await getApiKey(ctx, hashedKey, opts);\n\n\tif (!apiKey) {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\tmessage: ERROR_CODES.INVALID_API_KEY,\n\t\t});\n\t}\n\n\tif (apiKey.enabled === false) {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\tmessage: ERROR_CODES.KEY_DISABLED,\n\t\t\tcode: \"KEY_DISABLED\" as const,\n\t\t});\n\t}\n\n\tif (apiKey.expiresAt) {\n\t\tconst now = Date.now();\n\t\tconst expiresAt = new Date(apiKey.expiresAt).getTime();\n\t\tif (now > expiresAt) {\n\t\t\tconst deleteExpiredKey = async () => {\n\t\t\t\tif (opts.storage === \"secondary-storage\" && opts.fallbackToDatabase) {\n\t\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t\t});\n\t\t\t\t} else if (opts.storage === \"secondary-storage\") {\n\t\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\t} else {\n\t\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t};\n\n\t\t\tif (opts.deferUpdates) {\n\t\t\t\tctx.context.runInBackground(\n\t\t\t\t\tdeleteExpiredKey().catch((error) => {\n\t\t\t\t\t\tctx.context.logger.error(\"Deferred update failed:\", error);\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tawait deleteExpiredKey();\n\t\t\t}\n\n\t\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\t\tmessage: ERROR_CODES.KEY_EXPIRED,\n\t\t\t\tcode: \"KEY_EXPIRED\" as const,\n\t\t\t});\n\t\t}\n\t}\n\n\tif (permissions) {\n\t\tconst apiKeyPermissions = apiKey.permissions\n\t\t\t? safeJSONParse<{\n\t\t\t\t\t[key: string]: string[];\n\t\t\t\t}>(apiKey.permissions)\n\t\t\t: null;\n\n\t\tif (!apiKeyPermissions) {\n\t\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\t\tmessage: ERROR_CODES.KEY_NOT_FOUND,\n\t\t\t\tcode: \"KEY_NOT_FOUND\" as const,\n\t\t\t});\n\t\t}\n\t\tconst r = role(apiKeyPermissions as any);\n\t\tconst result = r.authorize(permissions);\n\t\tif (!result.success) {\n\t\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\t\tmessage: ERROR_CODES.KEY_NOT_FOUND,\n\t\t\t\tcode: \"KEY_NOT_FOUND\" as const,\n\t\t\t});\n\t\t}\n\t}\n\n\tlet remaining = apiKey.remaining;\n\tlet lastRefillAt = apiKey.lastRefillAt;\n\n\tif (apiKey.remaining === 0 && apiKey.refillAmount === null) {\n\t\tconst deleteExhaustedKey = async () => {\n\t\t\tif (opts.storage === \"secondary-storage\" && opts.fallbackToDatabase) {\n\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t});\n\t\t\t} else if (opts.storage === \"secondary-storage\") {\n\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t} else {\n\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t});\n\t\t\t}\n\t\t};\n\n\t\tif (opts.deferUpdates) {\n\t\t\tctx.context.runInBackground(\n\t\t\t\tdeleteExhaustedKey().catch((error) => {\n\t\t\t\t\tctx.context.logger.error(\"Deferred update failed:\", error);\n\t\t\t\t}),\n\t\t\t);\n\t\t} else {\n\t\t\tawait deleteExhaustedKey();\n\t\t}\n\n\t\tthrow new APIError(\"TOO_MANY_REQUESTS\", {\n\t\t\tmessage: ERROR_CODES.USAGE_EXCEEDED,\n\t\t\tcode: \"USAGE_EXCEEDED\" as const,\n\t\t});\n\t} else if (remaining !== null) {\n\t\tconst now = Date.now();\n\t\tconst refillInterval = apiKey.refillInterval;\n\t\tconst refillAmount = apiKey.refillAmount;\n\t\tconst lastTime = new Date(lastRefillAt ?? apiKey.createdAt).getTime();\n\n\t\tif (refillInterval && refillAmount) {\n\t\t\t// if they provide refill info, then we should refill once the interval is reached.\n\n\t\t\tconst timeSinceLastRequest = now - lastTime;\n\t\t\tif (timeSinceLastRequest > refillInterval) {\n\t\t\t\tremaining = refillAmount;\n\t\t\t\tlastRefillAt = new Date();\n\t\t\t}\n\t\t}\n\n\t\tif (remaining === 0) {\n\t\t\t// if there are no more remaining requests, than the key is invalid\n\t\t\tthrow new APIError(\"TOO_MANY_REQUESTS\", {\n\t\t\t\tmessage: ERROR_CODES.USAGE_EXCEEDED,\n\t\t\t\tcode: \"USAGE_EXCEEDED\" as const,\n\t\t\t});\n\t\t} else {\n\t\t\tremaining--;\n\t\t}\n\t}\n\n\tconst { message, success, update, tryAgainIn } = isRateLimited(apiKey, opts);\n\n\tif (success === false) {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\tmessage: message ?? undefined,\n\t\t\tcode: \"RATE_LIMITED\" as const,\n\t\t\tdetails: {\n\t\t\t\ttryAgainIn,\n\t\t\t},\n\t\t});\n\t}\n\n\tconst updated: ApiKey = {\n\t\t...apiKey,\n\t\t...update,\n\t\tremaining,\n\t\tlastRefillAt,\n\t\tupdatedAt: new Date(),\n\t};\n\n\tconst performUpdate = async (): Promise<ApiKey | null> => {\n\t\tif (opts.storage === \"database\") {\n\t\t\treturn ctx.context.adapter.update<ApiKey>({\n\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\tupdate: { ...updated, id: undefined },\n\t\t\t});\n\t\t} else if (\n\t\t\topts.storage === \"secondary-storage\" &&\n\t\t\topts.fallbackToDatabase\n\t\t) {\n\t\t\tconst dbUpdated = await ctx.context.adapter.update<ApiKey>({\n\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\tupdate: { ...updated, id: undefined },\n\t\t\t});\n\t\t\tif (dbUpdated) {\n\t\t\t\tawait setApiKey(ctx, dbUpdated, opts);\n\t\t\t}\n\t\t\treturn dbUpdated;\n\t\t} else {\n\t\t\tawait setApiKey(ctx, updated, opts);\n\t\t\treturn updated;\n\t\t}\n\t};\n\n\tlet newApiKey: ApiKey | null = null;\n\n\tif (opts.deferUpdates) {\n\t\tctx.context.runInBackground(\n\t\t\tperformUpdate().catch((error) => {\n\t\t\t\tctx.context.logger.error(\"Failed to update API key:\", error);\n\t\t\t}),\n\t\t);\n\t\tnewApiKey = updated;\n\t} else {\n\t\tnewApiKey = await performUpdate();\n\t\tif (!newApiKey) {\n\t\t\tthrow new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\t\t\tmessage: ERROR_CODES.FAILED_TO_UPDATE_API_KEY,\n\t\t\t\tcode: \"INTERNAL_SERVER_ERROR\" as const,\n\t\t\t});\n\t\t}\n\t}\n\n\treturn newApiKey;\n}\n\nconst verifyApiKeyBodySchema = z.object({\n\tkey: z.string().meta({\n\t\tdescription: \"The key to verify\",\n\t}),\n\tpermissions: z\n\t\t.record(z.string(), z.array(z.string()))\n\t\t.meta({\n\t\t\tdescription: \"The permissions to verify.\",\n\t\t})\n\t\t.optional(),\n});\n\nexport function verifyApiKey({\n\topts,\n\tschema,\n\tdeleteAllExpiredApiKeys,\n}: {\n\topts: PredefinedApiKeyOptions;\n\tschema: ReturnType<typeof apiKeySchema>;\n\tdeleteAllExpiredApiKeys(\n\t\tctx: AuthContext,\n\t\tbyPassLastCheckTime?: boolean | undefined,\n\t): Promise<void>;\n}) {\n\treturn createAuthEndpoint(\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tbody: verifyApiKeyBodySchema,\n\t\t},\n\t\tasync (ctx) => {\n\t\t\tconst { key } = ctx.body;\n\n\t\t\tif (opts.customAPIKeyValidator) {\n\t\t\t\tconst isValid = await opts.customAPIKeyValidator({ ctx, key });\n\t\t\t\tif (!isValid) {\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tvalid: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tmessage: ERROR_CODES.INVALID_API_KEY,\n\t\t\t\t\t\t\tcode: \"KEY_NOT_FOUND\" as const,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tkey: null,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst hashed = opts.disableKeyHashing ? key : await defaultKeyHasher(key);\n\n\t\t\tlet apiKey: ApiKey | null = null;\n\n\t\t\ttry {\n\t\t\t\tapiKey = await validateApiKey({\n\t\t\t\t\thashedKey: hashed,\n\t\t\t\t\tpermissions: ctx.body.permissions,\n\t\t\t\t\tctx,\n\t\t\t\t\topts,\n\t\t\t\t\tschema,\n\t\t\t\t});\n\n\t\t\t\tif (opts.deferUpdates) {\n\t\t\t\t\tctx.context.runInBackground(\n\t\t\t\t\t\tdeleteAllExpiredApiKeys(ctx.context).catch((err) => {\n\t\t\t\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\t\t\t\"Failed to delete expired API keys:\",\n\t\t\t\t\t\t\t\terr,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tctx.context.logger.error(\"Failed to validate API key:\", error);\n\t\t\t\tif (error instanceof APIError) {\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tvalid: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tmessage: error.body?.message,\n\t\t\t\t\t\t\tcode: error.body?.code as string,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tkey: null,\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\treturn ctx.json({\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tmessage: ERROR_CODES.INVALID_API_KEY,\n\t\t\t\t\t\tcode: \"INVALID_API_KEY\" as const,\n\t\t\t\t\t},\n\t\t\t\t\tkey: null,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst { key: _, ...returningApiKey } = apiKey ?? {\n\t\t\t\tkey: 1,\n\t\t\t\tpermissions: undefined,\n\t\t\t};\n\n\t\t\t// Migrate legacy double-stringified metadata if needed\n\t\t\tlet migratedMetadata: Record<string, any> | null = null;\n\t\t\tif (apiKey) {\n\t\t\t\tmigratedMetadata = await migrateDoubleStringifiedMetadata(\n\t\t\t\t\tctx,\n\t\t\t\t\tapiKey,\n\t\t\t\t\topts,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturningApiKey.permissions = returningApiKey.permissions\n\t\t\t\t? safeJSONParse<{\n\t\t\t\t\t\t[key: string]: string[];\n\t\t\t\t\t}>(returningApiKey.permissions)\n\t\t\t\t: null;\n\n\t\t\treturn ctx.json({\n\t\t\t\tvalid: true,\n\t\t\t\terror: null,\n\t\t\t\tkey:\n\t\t\t\t\tapiKey === null\n\t\t\t\t\t\t? null\n\t\t\t\t\t\t: ({\n\t\t\t\t\t\t\t\t...returningApiKey,\n\t\t\t\t\t\t\t\tmetadata: migratedMetadata,\n\t\t\t\t\t\t\t} as Omit<ApiKey, \"key\">),\n\t\t\t});\n\t\t},\n\t);\n}\n"],"mappings":";;;;;;;;;;;AAmBA,eAAsB,eAAe,EACpC,WACA,KACA,MACA,QACA,eAOE;CACF,MAAM,SAAS,MAAM,UAAU,KAAK,WAAW,KAAK;AAEpD,KAAI,CAAC,OACJ,OAAM,IAAI,SAAS,gBAAgB,EAClC,SAAS,YAAY,iBACrB,CAAC;AAGH,KAAI,OAAO,YAAY,MACtB,OAAM,IAAI,SAAS,gBAAgB;EAClC,SAAS,YAAY;EACrB,MAAM;EACN,CAAC;AAGH,KAAI,OAAO,WAGV;MAFY,KAAK,KAAK,GACJ,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,EACjC;GACpB,MAAM,mBAAmB,YAAY;AACpC,QAAI,KAAK,YAAY,uBAAuB,KAAK,oBAAoB;AACpE,WAAM,aAAa,KAAK,QAAQ,KAAK;AACrC,WAAM,IAAI,QAAQ,QAAQ,OAAO;MAChC,OAAO;MACP,OAAO,CAAC;OAAE,OAAO;OAAM,OAAO,OAAO;OAAI,CAAC;MAC1C,CAAC;eACQ,KAAK,YAAY,oBAC3B,OAAM,aAAa,KAAK,QAAQ,KAAK;QAErC,OAAM,IAAI,QAAQ,QAAQ,OAAO;KAChC,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAM,OAAO,OAAO;MAAI,CAAC;KAC1C,CAAC;;AAIJ,OAAI,KAAK,aACR,KAAI,QAAQ,gBACX,kBAAkB,CAAC,OAAO,UAAU;AACnC,QAAI,QAAQ,OAAO,MAAM,2BAA2B,MAAM;KACzD,CACF;OAED,OAAM,kBAAkB;AAGzB,SAAM,IAAI,SAAS,gBAAgB;IAClC,SAAS,YAAY;IACrB,MAAM;IACN,CAAC;;;AAIJ,KAAI,aAAa;EAChB,MAAM,oBAAoB,OAAO,cAC9B,cAEE,OAAO,YAAY,GACrB;AAEH,MAAI,CAAC,kBACJ,OAAM,IAAI,SAAS,gBAAgB;GAClC,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;AAIH,MAAI,CAFM,KAAK,kBAAyB,CACvB,UAAU,YAAY,CAC3B,QACX,OAAM,IAAI,SAAS,gBAAgB;GAClC,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;;CAIJ,IAAI,YAAY,OAAO;CACvB,IAAI,eAAe,OAAO;AAE1B,KAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,MAAM;EAC3D,MAAM,qBAAqB,YAAY;AACtC,OAAI,KAAK,YAAY,uBAAuB,KAAK,oBAAoB;AACpE,UAAM,aAAa,KAAK,QAAQ,KAAK;AACrC,UAAM,IAAI,QAAQ,QAAQ,OAAO;KAChC,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAM,OAAO,OAAO;MAAI,CAAC;KAC1C,CAAC;cACQ,KAAK,YAAY,oBAC3B,OAAM,aAAa,KAAK,QAAQ,KAAK;OAErC,OAAM,IAAI,QAAQ,QAAQ,OAAO;IAChC,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAM,OAAO,OAAO;KAAI,CAAC;IAC1C,CAAC;;AAIJ,MAAI,KAAK,aACR,KAAI,QAAQ,gBACX,oBAAoB,CAAC,OAAO,UAAU;AACrC,OAAI,QAAQ,OAAO,MAAM,2BAA2B,MAAM;IACzD,CACF;MAED,OAAM,oBAAoB;AAG3B,QAAM,IAAI,SAAS,qBAAqB;GACvC,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;YACQ,cAAc,MAAM;EAC9B,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,iBAAiB,OAAO;EAC9B,MAAM,eAAe,OAAO;EAC5B,MAAM,WAAW,IAAI,KAAK,gBAAgB,OAAO,UAAU,CAAC,SAAS;AAErE,MAAI,kBAAkB,cAIrB;OAD6B,MAAM,WACR,gBAAgB;AAC1C,gBAAY;AACZ,mCAAe,IAAI,MAAM;;;AAI3B,MAAI,cAAc,EAEjB,OAAM,IAAI,SAAS,qBAAqB;GACvC,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;MAEF;;CAIF,MAAM,EAAE,SAAS,SAAS,QAAQ,eAAe,cAAc,QAAQ,KAAK;AAE5E,KAAI,YAAY,MACf,OAAM,IAAI,SAAS,gBAAgB;EAClC,SAAS,WAAW;EACpB,MAAM;EACN,SAAS,EACR,YACA;EACD,CAAC;CAGH,MAAMA,UAAkB;EACvB,GAAG;EACH,GAAG;EACH;EACA;EACA,2BAAW,IAAI,MAAM;EACrB;CAED,MAAM,gBAAgB,YAAoC;AACzD,MAAI,KAAK,YAAY,WACpB,QAAO,IAAI,QAAQ,QAAQ,OAAe;GACzC,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAM,OAAO,OAAO;IAAI,CAAC;GAC1C,QAAQ;IAAE,GAAG;IAAS,IAAI;IAAW;GACrC,CAAC;WAEF,KAAK,YAAY,uBACjB,KAAK,oBACJ;GACD,MAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,OAAe;IAC1D,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAM,OAAO,OAAO;KAAI,CAAC;IAC1C,QAAQ;KAAE,GAAG;KAAS,IAAI;KAAW;IACrC,CAAC;AACF,OAAI,UACH,OAAM,UAAU,KAAK,WAAW,KAAK;AAEtC,UAAO;SACD;AACN,SAAM,UAAU,KAAK,SAAS,KAAK;AACnC,UAAO;;;CAIT,IAAIC,YAA2B;AAE/B,KAAI,KAAK,cAAc;AACtB,MAAI,QAAQ,gBACX,eAAe,CAAC,OAAO,UAAU;AAChC,OAAI,QAAQ,OAAO,MAAM,6BAA6B,MAAM;IAC3D,CACF;AACD,cAAY;QACN;AACN,cAAY,MAAM,eAAe;AACjC,MAAI,CAAC,UACJ,OAAM,IAAI,SAAS,yBAAyB;GAC3C,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;;AAIJ,QAAO;;AAGR,MAAM,yBAAyB,EAAE,OAAO;CACvC,KAAK,EAAE,QAAQ,CAAC,KAAK,EACpB,aAAa,qBACb,CAAC;CACF,aAAa,EACX,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CACvC,KAAK,EACL,aAAa,8BACb,CAAC,CACD,UAAU;CACZ,CAAC;AAEF,SAAgB,aAAa,EAC5B,MACA,QACA,2BAQE;AACF,QAAO,mBACN;EACC,QAAQ;EACR,MAAM;EACN,EACD,OAAO,QAAQ;EACd,MAAM,EAAE,QAAQ,IAAI;AAEpB,MAAI,KAAK,uBAER;OAAI,CADY,MAAM,KAAK,sBAAsB;IAAE;IAAK;IAAK,CAAC,CAE7D,QAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,SAAS,YAAY;KACrB,MAAM;KACN;IACD,KAAK;IACL,CAAC;;EAIJ,MAAM,SAAS,KAAK,oBAAoB,MAAM,MAAM,iBAAiB,IAAI;EAEzE,IAAIC,SAAwB;AAE5B,MAAI;AACH,YAAS,MAAM,eAAe;IAC7B,WAAW;IACX,aAAa,IAAI,KAAK;IACtB;IACA;IACA;IACA,CAAC;AAEF,OAAI,KAAK,aACR,KAAI,QAAQ,gBACX,wBAAwB,IAAI,QAAQ,CAAC,OAAO,QAAQ;AACnD,QAAI,QAAQ,OAAO,MAClB,sCACA,IACA;KACA,CACF;WAEM,OAAO;AACf,OAAI,QAAQ,OAAO,MAAM,+BAA+B,MAAM;AAC9D,OAAI,iBAAiB,SACpB,QAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,SAAS,MAAM,MAAM;KACrB,MAAM,MAAM,MAAM;KAClB;IACD,KAAK;IACL,CAAC;AAGH,UAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,SAAS,YAAY;KACrB,MAAM;KACN;IACD,KAAK;IACL,CAAC;;EAGH,MAAM,EAAE,KAAK,GAAG,GAAG,oBAAoB,UAAU;GAChD,KAAK;GACL,aAAa;GACb;EAGD,IAAIC,mBAA+C;AACnD,MAAI,OACH,oBAAmB,MAAM,iCACxB,KACA,QACA,KACA;AAGF,kBAAgB,cAAc,gBAAgB,cAC3C,cAEE,gBAAgB,YAAY,GAC9B;AAEH,SAAO,IAAI,KAAK;GACf,OAAO;GACP,OAAO;GACP,KACC,WAAW,OACR,OACC;IACD,GAAG;IACH,UAAU;IACV;GACJ,CAAC;GAEH"}
+{"version":3,"file":"verify-api-key.mjs","names":["updated: ApiKey","newApiKey: ApiKey | null","apiKey: ApiKey | null","migratedMetadata: Record<string, any> | null"],"sources":["../../../../src/plugins/api-key/routes/verify-api-key.ts"],"sourcesContent":["import type { AuthContext, GenericEndpointContext } from \"@better-auth/core\";\nimport { createAuthEndpoint } from \"@better-auth/core/api\";\nimport { safeJSONParse } from \"@better-auth/core/utils\";\nimport * as z from \"zod\";\nimport { APIError } from \"../../../api\";\nimport { role } from \"../../access\";\nimport { API_KEY_TABLE_NAME, ERROR_CODES } from \"..\";\nimport { defaultKeyHasher } from \"../\";\nimport {\n\tdeleteApiKey,\n\tgetApiKey,\n\tmigrateDoubleStringifiedMetadata,\n\tsetApiKey,\n} from \"../adapter\";\nimport { isRateLimited } from \"../rate-limit\";\nimport type { apiKeySchema } from \"../schema\";\nimport type { ApiKey } from \"../types\";\nimport type { PredefinedApiKeyOptions } from \".\";\n\nexport async function validateApiKey({\n\thashedKey,\n\tctx,\n\topts,\n\tschema,\n\tpermissions,\n}: {\n\thashedKey: string;\n\topts: PredefinedApiKeyOptions;\n\tschema: ReturnType<typeof apiKeySchema>;\n\tpermissions?: Record<string, string[]> | undefined;\n\tctx: GenericEndpointContext;\n}) {\n\tconst apiKey = await getApiKey(ctx, hashedKey, opts);\n\n\tif (!apiKey) {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\tmessage: ERROR_CODES.INVALID_API_KEY,\n\t\t});\n\t}\n\n\tif (apiKey.enabled === false) {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\tmessage: ERROR_CODES.KEY_DISABLED,\n\t\t\tcode: \"KEY_DISABLED\" as const,\n\t\t});\n\t}\n\n\tif (apiKey.expiresAt) {\n\t\tconst now = Date.now();\n\t\tconst expiresAt = new Date(apiKey.expiresAt).getTime();\n\t\tif (now > expiresAt) {\n\t\t\tconst deleteExpiredKey = async () => {\n\t\t\t\tif (opts.storage === \"secondary-storage\" && opts.fallbackToDatabase) {\n\t\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t\t});\n\t\t\t\t} else if (opts.storage === \"secondary-storage\") {\n\t\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\t} else {\n\t\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t};\n\n\t\t\tif (opts.deferUpdates) {\n\t\t\t\tctx.context.runInBackground(\n\t\t\t\t\tdeleteExpiredKey().catch((error) => {\n\t\t\t\t\t\tctx.context.logger.error(\"Deferred update failed:\", error);\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tawait deleteExpiredKey();\n\t\t\t}\n\n\t\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\t\tmessage: ERROR_CODES.KEY_EXPIRED,\n\t\t\t\tcode: \"KEY_EXPIRED\" as const,\n\t\t\t});\n\t\t}\n\t}\n\n\tif (permissions) {\n\t\tconst apiKeyPermissions = apiKey.permissions\n\t\t\t? safeJSONParse<{\n\t\t\t\t\t[key: string]: string[];\n\t\t\t\t}>(apiKey.permissions)\n\t\t\t: null;\n\n\t\tif (!apiKeyPermissions) {\n\t\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\t\tmessage: ERROR_CODES.KEY_NOT_FOUND,\n\t\t\t\tcode: \"KEY_NOT_FOUND\" as const,\n\t\t\t});\n\t\t}\n\t\tconst r = role(apiKeyPermissions as any);\n\t\tconst result = r.authorize(permissions);\n\t\tif (!result.success) {\n\t\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\t\tmessage: ERROR_CODES.KEY_NOT_FOUND,\n\t\t\t\tcode: \"KEY_NOT_FOUND\" as const,\n\t\t\t});\n\t\t}\n\t}\n\n\tlet remaining = apiKey.remaining;\n\tlet lastRefillAt = apiKey.lastRefillAt;\n\n\tif (apiKey.remaining === 0 && apiKey.refillAmount === null) {\n\t\tconst deleteExhaustedKey = async () => {\n\t\t\tif (opts.storage === \"secondary-storage\" && opts.fallbackToDatabase) {\n\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t});\n\t\t\t} else if (opts.storage === \"secondary-storage\") {\n\t\t\t\tawait deleteApiKey(ctx, apiKey, opts);\n\t\t\t} else {\n\t\t\t\tawait ctx.context.adapter.delete({\n\t\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\t});\n\t\t\t}\n\t\t};\n\n\t\tif (opts.deferUpdates) {\n\t\t\tctx.context.runInBackground(\n\t\t\t\tdeleteExhaustedKey().catch((error) => {\n\t\t\t\t\tctx.context.logger.error(\"Deferred update failed:\", error);\n\t\t\t\t}),\n\t\t\t);\n\t\t} else {\n\t\t\tawait deleteExhaustedKey();\n\t\t}\n\n\t\tthrow new APIError(\"TOO_MANY_REQUESTS\", {\n\t\t\tmessage: ERROR_CODES.USAGE_EXCEEDED,\n\t\t\tcode: \"USAGE_EXCEEDED\" as const,\n\t\t});\n\t} else if (remaining !== null) {\n\t\tconst now = Date.now();\n\t\tconst refillInterval = apiKey.refillInterval;\n\t\tconst refillAmount = apiKey.refillAmount;\n\t\tconst lastTime = new Date(lastRefillAt ?? apiKey.createdAt).getTime();\n\n\t\tif (refillInterval && refillAmount) {\n\t\t\t// if they provide refill info, then we should refill once the interval is reached.\n\n\t\t\tconst timeSinceLastRequest = now - lastTime;\n\t\t\tif (timeSinceLastRequest > refillInterval) {\n\t\t\t\tremaining = refillAmount;\n\t\t\t\tlastRefillAt = new Date();\n\t\t\t}\n\t\t}\n\n\t\tif (remaining === 0) {\n\t\t\t// if there are no more remaining requests, than the key is invalid\n\t\t\tthrow new APIError(\"TOO_MANY_REQUESTS\", {\n\t\t\t\tmessage: ERROR_CODES.USAGE_EXCEEDED,\n\t\t\t\tcode: \"USAGE_EXCEEDED\" as const,\n\t\t\t});\n\t\t} else {\n\t\t\tremaining--;\n\t\t}\n\t}\n\n\tconst { message, success, update, tryAgainIn } = isRateLimited(apiKey, opts);\n\n\tif (success === false) {\n\t\tthrow new APIError(\"UNAUTHORIZED\", {\n\t\t\tmessage: message ?? undefined,\n\t\t\tcode: \"RATE_LIMITED\" as const,\n\t\t\tdetails: {\n\t\t\t\ttryAgainIn,\n\t\t\t},\n\t\t});\n\t}\n\n\tconst updated: ApiKey = {\n\t\t...apiKey,\n\t\t...update,\n\t\tremaining,\n\t\tlastRefillAt,\n\t\tupdatedAt: new Date(),\n\t};\n\n\tconst performUpdate = async (): Promise<ApiKey | null> => {\n\t\tif (opts.storage === \"database\") {\n\t\t\treturn ctx.context.adapter.update<ApiKey>({\n\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\tupdate: { ...updated, id: undefined },\n\t\t\t});\n\t\t} else if (\n\t\t\topts.storage === \"secondary-storage\" &&\n\t\t\topts.fallbackToDatabase\n\t\t) {\n\t\t\tconst dbUpdated = await ctx.context.adapter.update<ApiKey>({\n\t\t\t\tmodel: API_KEY_TABLE_NAME,\n\t\t\t\twhere: [{ field: \"id\", value: apiKey.id }],\n\t\t\t\tupdate: { ...updated, id: undefined },\n\t\t\t});\n\t\t\tif (dbUpdated) {\n\t\t\t\tawait setApiKey(ctx, dbUpdated, opts);\n\t\t\t}\n\t\t\treturn dbUpdated;\n\t\t} else {\n\t\t\tawait setApiKey(ctx, updated, opts);\n\t\t\treturn updated;\n\t\t}\n\t};\n\n\tlet newApiKey: ApiKey | null = null;\n\n\tif (opts.deferUpdates) {\n\t\tctx.context.runInBackground(\n\t\t\tperformUpdate().catch((error) => {\n\t\t\t\tctx.context.logger.error(\"Failed to update API key:\", error);\n\t\t\t}),\n\t\t);\n\t\tnewApiKey = updated;\n\t} else {\n\t\tnewApiKey = await performUpdate();\n\t\tif (!newApiKey) {\n\t\t\tthrow new APIError(\"INTERNAL_SERVER_ERROR\", {\n\t\t\t\tmessage: ERROR_CODES.FAILED_TO_UPDATE_API_KEY,\n\t\t\t\tcode: \"INTERNAL_SERVER_ERROR\" as const,\n\t\t\t});\n\t\t}\n\t}\n\n\treturn newApiKey;\n}\n\nconst verifyApiKeyBodySchema = z.object({\n\tkey: z.string().meta({\n\t\tdescription: \"The key to verify\",\n\t}),\n\tpermissions: z\n\t\t.record(z.string(), z.array(z.string()))\n\t\t.meta({\n\t\t\tdescription: \"The permissions to verify.\",\n\t\t})\n\t\t.optional(),\n});\n\nexport function verifyApiKey({\n\topts,\n\tschema,\n\tdeleteAllExpiredApiKeys,\n}: {\n\topts: PredefinedApiKeyOptions;\n\tschema: ReturnType<typeof apiKeySchema>;\n\tdeleteAllExpiredApiKeys(\n\t\tctx: AuthContext,\n\t\tbyPassLastCheckTime?: boolean | undefined,\n\t): Promise<void>;\n}) {\n\treturn createAuthEndpoint(\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tbody: verifyApiKeyBodySchema,\n\t\t},\n\t\tasync (ctx) => {\n\t\t\tconst { key } = ctx.body;\n\n\t\t\tif (opts.customAPIKeyValidator) {\n\t\t\t\tconst isValid = await opts.customAPIKeyValidator({ ctx, key });\n\t\t\t\tif (!isValid) {\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tvalid: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tmessage: ERROR_CODES.INVALID_API_KEY,\n\t\t\t\t\t\t\tcode: \"KEY_NOT_FOUND\" as const,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tkey: null,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst hashed = opts.disableKeyHashing ? key : await defaultKeyHasher(key);\n\n\t\t\tlet apiKey: ApiKey | null = null;\n\n\t\t\ttry {\n\t\t\t\tapiKey = await validateApiKey({\n\t\t\t\t\thashedKey: hashed,\n\t\t\t\t\tpermissions: ctx.body.permissions,\n\t\t\t\t\tctx,\n\t\t\t\t\topts,\n\t\t\t\t\tschema,\n\t\t\t\t});\n\n\t\t\t\tif (opts.deferUpdates) {\n\t\t\t\t\tctx.context.runInBackground(\n\t\t\t\t\t\tdeleteAllExpiredApiKeys(ctx.context).catch((err) => {\n\t\t\t\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\t\t\t\"Failed to delete expired API keys:\",\n\t\t\t\t\t\t\t\terr,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tctx.context.logger.error(\"Failed to validate API key:\", error);\n\t\t\t\tif (error instanceof APIError) {\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tvalid: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t...error.body,\n\t\t\t\t\t\t\tmessage: error.body?.message,\n\t\t\t\t\t\t\tcode: error.body?.code as string,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tkey: null,\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\treturn ctx.json({\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tmessage: ERROR_CODES.INVALID_API_KEY,\n\t\t\t\t\t\tcode: \"INVALID_API_KEY\" as const,\n\t\t\t\t\t},\n\t\t\t\t\tkey: null,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst { key: _, ...returningApiKey } = apiKey ?? {\n\t\t\t\tkey: 1,\n\t\t\t\tpermissions: undefined,\n\t\t\t};\n\n\t\t\t// Migrate legacy double-stringified metadata if needed\n\t\t\tlet migratedMetadata: Record<string, any> | null = null;\n\t\t\tif (apiKey) {\n\t\t\t\tmigratedMetadata = await migrateDoubleStringifiedMetadata(\n\t\t\t\t\tctx,\n\t\t\t\t\tapiKey,\n\t\t\t\t\topts,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturningApiKey.permissions = returningApiKey.permissions\n\t\t\t\t? safeJSONParse<{\n\t\t\t\t\t\t[key: string]: string[];\n\t\t\t\t\t}>(returningApiKey.permissions)\n\t\t\t\t: null;\n\n\t\t\treturn ctx.json({\n\t\t\t\tvalid: true,\n\t\t\t\terror: null,\n\t\t\t\tkey:\n\t\t\t\t\tapiKey === null\n\t\t\t\t\t\t? null\n\t\t\t\t\t\t: ({\n\t\t\t\t\t\t\t\t...returningApiKey,\n\t\t\t\t\t\t\t\tmetadata: migratedMetadata,\n\t\t\t\t\t\t\t} as Omit<ApiKey, \"key\">),\n\t\t\t});\n\t\t},\n\t);\n}\n"],"mappings":";;;;;;;;;;;AAmBA,eAAsB,eAAe,EACpC,WACA,KACA,MACA,QACA,eAOE;CACF,MAAM,SAAS,MAAM,UAAU,KAAK,WAAW,KAAK;AAEpD,KAAI,CAAC,OACJ,OAAM,IAAI,SAAS,gBAAgB,EAClC,SAAS,YAAY,iBACrB,CAAC;AAGH,KAAI,OAAO,YAAY,MACtB,OAAM,IAAI,SAAS,gBAAgB;EAClC,SAAS,YAAY;EACrB,MAAM;EACN,CAAC;AAGH,KAAI,OAAO,WAGV;MAFY,KAAK,KAAK,GACJ,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,EACjC;GACpB,MAAM,mBAAmB,YAAY;AACpC,QAAI,KAAK,YAAY,uBAAuB,KAAK,oBAAoB;AACpE,WAAM,aAAa,KAAK,QAAQ,KAAK;AACrC,WAAM,IAAI,QAAQ,QAAQ,OAAO;MAChC,OAAO;MACP,OAAO,CAAC;OAAE,OAAO;OAAM,OAAO,OAAO;OAAI,CAAC;MAC1C,CAAC;eACQ,KAAK,YAAY,oBAC3B,OAAM,aAAa,KAAK,QAAQ,KAAK;QAErC,OAAM,IAAI,QAAQ,QAAQ,OAAO;KAChC,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAM,OAAO,OAAO;MAAI,CAAC;KAC1C,CAAC;;AAIJ,OAAI,KAAK,aACR,KAAI,QAAQ,gBACX,kBAAkB,CAAC,OAAO,UAAU;AACnC,QAAI,QAAQ,OAAO,MAAM,2BAA2B,MAAM;KACzD,CACF;OAED,OAAM,kBAAkB;AAGzB,SAAM,IAAI,SAAS,gBAAgB;IAClC,SAAS,YAAY;IACrB,MAAM;IACN,CAAC;;;AAIJ,KAAI,aAAa;EAChB,MAAM,oBAAoB,OAAO,cAC9B,cAEE,OAAO,YAAY,GACrB;AAEH,MAAI,CAAC,kBACJ,OAAM,IAAI,SAAS,gBAAgB;GAClC,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;AAIH,MAAI,CAFM,KAAK,kBAAyB,CACvB,UAAU,YAAY,CAC3B,QACX,OAAM,IAAI,SAAS,gBAAgB;GAClC,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;;CAIJ,IAAI,YAAY,OAAO;CACvB,IAAI,eAAe,OAAO;AAE1B,KAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,MAAM;EAC3D,MAAM,qBAAqB,YAAY;AACtC,OAAI,KAAK,YAAY,uBAAuB,KAAK,oBAAoB;AACpE,UAAM,aAAa,KAAK,QAAQ,KAAK;AACrC,UAAM,IAAI,QAAQ,QAAQ,OAAO;KAChC,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAM,OAAO,OAAO;MAAI,CAAC;KAC1C,CAAC;cACQ,KAAK,YAAY,oBAC3B,OAAM,aAAa,KAAK,QAAQ,KAAK;OAErC,OAAM,IAAI,QAAQ,QAAQ,OAAO;IAChC,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAM,OAAO,OAAO;KAAI,CAAC;IAC1C,CAAC;;AAIJ,MAAI,KAAK,aACR,KAAI,QAAQ,gBACX,oBAAoB,CAAC,OAAO,UAAU;AACrC,OAAI,QAAQ,OAAO,MAAM,2BAA2B,MAAM;IACzD,CACF;MAED,OAAM,oBAAoB;AAG3B,QAAM,IAAI,SAAS,qBAAqB;GACvC,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;YACQ,cAAc,MAAM;EAC9B,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,iBAAiB,OAAO;EAC9B,MAAM,eAAe,OAAO;EAC5B,MAAM,WAAW,IAAI,KAAK,gBAAgB,OAAO,UAAU,CAAC,SAAS;AAErE,MAAI,kBAAkB,cAIrB;OAD6B,MAAM,WACR,gBAAgB;AAC1C,gBAAY;AACZ,mCAAe,IAAI,MAAM;;;AAI3B,MAAI,cAAc,EAEjB,OAAM,IAAI,SAAS,qBAAqB;GACvC,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;MAEF;;CAIF,MAAM,EAAE,SAAS,SAAS,QAAQ,eAAe,cAAc,QAAQ,KAAK;AAE5E,KAAI,YAAY,MACf,OAAM,IAAI,SAAS,gBAAgB;EAClC,SAAS,WAAW;EACpB,MAAM;EACN,SAAS,EACR,YACA;EACD,CAAC;CAGH,MAAMA,UAAkB;EACvB,GAAG;EACH,GAAG;EACH;EACA;EACA,2BAAW,IAAI,MAAM;EACrB;CAED,MAAM,gBAAgB,YAAoC;AACzD,MAAI,KAAK,YAAY,WACpB,QAAO,IAAI,QAAQ,QAAQ,OAAe;GACzC,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAM,OAAO,OAAO;IAAI,CAAC;GAC1C,QAAQ;IAAE,GAAG;IAAS,IAAI;IAAW;GACrC,CAAC;WAEF,KAAK,YAAY,uBACjB,KAAK,oBACJ;GACD,MAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,OAAe;IAC1D,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAM,OAAO,OAAO;KAAI,CAAC;IAC1C,QAAQ;KAAE,GAAG;KAAS,IAAI;KAAW;IACrC,CAAC;AACF,OAAI,UACH,OAAM,UAAU,KAAK,WAAW,KAAK;AAEtC,UAAO;SACD;AACN,SAAM,UAAU,KAAK,SAAS,KAAK;AACnC,UAAO;;;CAIT,IAAIC,YAA2B;AAE/B,KAAI,KAAK,cAAc;AACtB,MAAI,QAAQ,gBACX,eAAe,CAAC,OAAO,UAAU;AAChC,OAAI,QAAQ,OAAO,MAAM,6BAA6B,MAAM;IAC3D,CACF;AACD,cAAY;QACN;AACN,cAAY,MAAM,eAAe;AACjC,MAAI,CAAC,UACJ,OAAM,IAAI,SAAS,yBAAyB;GAC3C,SAAS,YAAY;GACrB,MAAM;GACN,CAAC;;AAIJ,QAAO;;AAGR,MAAM,yBAAyB,EAAE,OAAO;CACvC,KAAK,EAAE,QAAQ,CAAC,KAAK,EACpB,aAAa,qBACb,CAAC;CACF,aAAa,EACX,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CACvC,KAAK,EACL,aAAa,8BACb,CAAC,CACD,UAAU;CACZ,CAAC;AAEF,SAAgB,aAAa,EAC5B,MACA,QACA,2BAQE;AACF,QAAO,mBACN;EACC,QAAQ;EACR,MAAM;EACN,EACD,OAAO,QAAQ;EACd,MAAM,EAAE,QAAQ,IAAI;AAEpB,MAAI,KAAK,uBAER;OAAI,CADY,MAAM,KAAK,sBAAsB;IAAE;IAAK;IAAK,CAAC,CAE7D,QAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,SAAS,YAAY;KACrB,MAAM;KACN;IACD,KAAK;IACL,CAAC;;EAIJ,MAAM,SAAS,KAAK,oBAAoB,MAAM,MAAM,iBAAiB,IAAI;EAEzE,IAAIC,SAAwB;AAE5B,MAAI;AACH,YAAS,MAAM,eAAe;IAC7B,WAAW;IACX,aAAa,IAAI,KAAK;IACtB;IACA;IACA;IACA,CAAC;AAEF,OAAI,KAAK,aACR,KAAI,QAAQ,gBACX,wBAAwB,IAAI,QAAQ,CAAC,OAAO,QAAQ;AACnD,QAAI,QAAQ,OAAO,MAClB,sCACA,IACA;KACA,CACF;WAEM,OAAO;AACf,OAAI,QAAQ,OAAO,MAAM,+BAA+B,MAAM;AAC9D,OAAI,iBAAiB,SACpB,QAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,GAAG,MAAM;KACT,SAAS,MAAM,MAAM;KACrB,MAAM,MAAM,MAAM;KAClB;IACD,KAAK;IACL,CAAC;AAGH,UAAO,IAAI,KAAK;IACf,OAAO;IACP,OAAO;KACN,SAAS,YAAY;KACrB,MAAM;KACN;IACD,KAAK;IACL,CAAC;;EAGH,MAAM,EAAE,KAAK,GAAG,GAAG,oBAAoB,UAAU;GAChD,KAAK;GACL,aAAa;GACb;EAGD,IAAIC,mBAA+C;AACnD,MAAI,OACH,oBAAmB,MAAM,iCACxB,KACA,QACA,KACA;AAGF,kBAAgB,cAAc,gBAAgB,cAC3C,cAEE,gBAAgB,YAAY,GAC9B;AAEH,SAAO,IAAI,KAAK;GACf,OAAO;GACP,OAAO;GACP,KACC,WAAW,OACR,OACC;IACD,GAAG;IACH,UAAU;IACV;GACJ,CAAC;GAEH"}

package/dist/plugins/bearer/index.d.mts

@@ -1,5 +1,5 @@
-import * as _better_auth_core3 from "@better-auth/core";
-import * as better_call17 from "better-call";
+import * as _better_auth_core1 from "@better-auth/core";
+import * as better_call8 from "better-call";
 
 //#region src/plugins/bearer/index.d.ts
 interface BearerOptions {
@@ -19,16 +19,16 @@ declare const bearer: (options?: BearerOptions | undefined) => {
   id: "bearer";
   hooks: {
     before: {
-      matcher(context: _better_auth_core3.HookEndpointContext): boolean;
-      handler: (inputContext: better_call17.MiddlewareInputContext<better_call17.MiddlewareOptions>) => Promise<{
+      matcher(context: _better_auth_core1.HookEndpointContext): boolean;
+      handler: (inputContext: better_call8.MiddlewareInputContext<better_call8.MiddlewareOptions>) => Promise<{
         context: {
           headers: Headers;
         };
       } | undefined>;
     }[];
     after: {
-      matcher(context: _better_auth_core3.HookEndpointContext): true;
-      handler: (inputContext: better_call17.MiddlewareInputContext<better_call17.MiddlewareOptions>) => Promise<void>;
+      matcher(context: _better_auth_core1.HookEndpointContext): true;
+      handler: (inputContext: better_call8.MiddlewareInputContext<better_call8.MiddlewareOptions>) => Promise<void>;
     }[];
   };
   options: BearerOptions | undefined;

package/dist/plugins/captcha/index.d.mts

@@ -1,10 +1,10 @@
 import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./types.mjs";
-import * as _better_auth_core5 from "@better-auth/core";
+import * as _better_auth_core3 from "@better-auth/core";
 
 //#region src/plugins/captcha/index.d.ts
 declare const captcha: (options: CaptchaOptions) => {
   id: "captcha";
-  onRequest: (request: Request, ctx: _better_auth_core5.AuthContext) => Promise<{
+  onRequest: (request: Request, ctx: _better_auth_core3.AuthContext) => Promise<{
     response: Response;
   } | undefined>;
   options: CaptchaOptions;

package/dist/plugins/custom-session/index.d.mts

@@ -1,8 +1,8 @@
 import { InferSession, InferUser } from "../../types/models.mjs";
 import "../../types/index.mjs";
-import * as _better_auth_core6 from "@better-auth/core";
+import * as _better_auth_core4 from "@better-auth/core";
 import { BetterAuthOptions, GenericEndpointContext } from "@better-auth/core";
-import * as better_call21 from "better-call";
+import * as better_call12 from "better-call";
 import * as z from "zod";
 
 //#region src/plugins/custom-session/index.d.ts
@@ -20,12 +20,12 @@ declare const customSession: <Returns extends Record<string, any>, O extends Bet
   id: "custom-session";
   hooks: {
     after: {
-      matcher: (ctx: _better_auth_core6.HookEndpointContext) => boolean;
-      handler: (inputContext: better_call21.MiddlewareInputContext<better_call21.MiddlewareOptions>) => Promise<Awaited<Returns>[] | undefined>;
+      matcher: (ctx: _better_auth_core4.HookEndpointContext) => boolean;
+      handler: (inputContext: better_call12.MiddlewareInputContext<better_call12.MiddlewareOptions>) => Promise<Awaited<Returns>[] | undefined>;
     }[];
   };
   endpoints: {
-    getSession: better_call21.StrictEndpoint<"/get-session", {
+    getSession: better_call12.StrictEndpoint<"/get-session", {
       method: "GET";
       query: z.ZodOptional<z.ZodObject<{
         disableCookieCache: z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodPipe<z.ZodString, z.ZodTransform<boolean, string>>]>>;

package/dist/plugins/custom-session/index.mjs

@@ -1,3 +1,4 @@
+import { parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
 import { getSession } from "../../api/routes/session.mjs";
 import "../../api/index.mjs";
 import { getEndpointResponse } from "../../utils/plugin-helper.mjs";
@@ -50,11 +51,18 @@ const customSession = (fn, options, pluginOptions) => {
 			});
 			if (!session?.response) return ctx.json(null);
 			const fnResult = await fn(session.response, ctx);
-			const setCookie = session.headers.get("set-cookie");
-			if (setCookie) {
-				ctx.setHeader("set-cookie", setCookie);
-				session.headers.delete("set-cookie");
-			}
+			for (const cookieStr of session.headers.getSetCookie()) parseSetCookieHeader(cookieStr).forEach((attrs, name) => {
+				ctx.setCookie(name, attrs.value, {
+					maxAge: attrs["max-age"],
+					expires: attrs.expires,
+					domain: attrs.domain,
+					path: attrs.path,
+					secure: attrs.secure,
+					httpOnly: attrs.httponly,
+					sameSite: attrs.samesite
+				});
+			});
+			session.headers.delete("set-cookie");
 			session.headers.forEach((value, key) => {
 				ctx.setHeader(key, value);
 			});

package/dist/plugins/custom-session/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/custom-session/index.ts"],"sourcesContent":["import type {\n\tBetterAuthOptions,\n\tBetterAuthPlugin,\n\tGenericEndpointContext,\n} from \"@better-auth/core\";\nimport {\n\tcreateAuthEndpoint,\n\tcreateAuthMiddleware,\n} from \"@better-auth/core/api\";\nimport * as z from \"zod\";\nimport { getSession } from \"../../api\";\nimport type { InferSession, InferUser } from \"../../types\";\nimport { getEndpointResponse } from \"../../utils/plugin-helper\";\n\nconst getSessionQuerySchema = z.optional(\n\tz.object({\n\t\t/**\n\t\t * If cookie cache is enabled, it will disable the cache\n\t\t * and fetch the session from the database\n\t\t */\n\t\tdisableCookieCache: z\n\t\t\t.boolean()\n\t\t\t.meta({\n\t\t\t\tdescription: \"Disable cookie cache and fetch session from database\",\n\t\t\t})\n\t\t\t.or(z.string().transform((v) => v === \"true\"))\n\t\t\t.optional(),\n\t\tdisableRefresh: z\n\t\t\t.boolean()\n\t\t\t.meta({\n\t\t\t\tdescription:\n\t\t\t\t\t\"Disable session refresh. Useful for checking session status, without updating the session\",\n\t\t\t})\n\t\t\t.optional(),\n\t}),\n);\n\nexport type CustomSessionPluginOptions = {\n\t/**\n\t * This option is used to determine if the list-device-sessions endpoint should be mutated to the custom session data.\n\t * @default false\n\t */\n\tshouldMutateListDeviceSessionsEndpoint?: boolean | undefined;\n};\n\nexport const customSession = <\n\tReturns extends Record<string, any>,\n\tO extends BetterAuthOptions = BetterAuthOptions,\n>(\n\tfn: (\n\t\tsession: {\n\t\t\tuser: InferUser<O>;\n\t\t\tsession: InferSession<O>;\n\t\t},\n\t\tctx: GenericEndpointContext,\n\t) => Promise<Returns>,\n\toptions?: O | undefined,\n\tpluginOptions?: CustomSessionPluginOptions | undefined,\n) => {\n\treturn {\n\t\tid: \"custom-session\",\n\t\thooks: {\n\t\t\tafter: [\n\t\t\t\t{\n\t\t\t\t\tmatcher: (ctx) =>\n\t\t\t\t\t\tctx.path === \"/multi-session/list-device-sessions\" &&\n\t\t\t\t\t\t(pluginOptions?.shouldMutateListDeviceSessionsEndpoint ?? false),\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst response = await getEndpointResponse<[]>(ctx);\n\t\t\t\t\t\tif (!response) return;\n\t\t\t\t\t\tconst newResponse = await Promise.all(\n\t\t\t\t\t\t\tresponse.map(async (v) => await fn(v, ctx)),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn ctx.json(newResponse);\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\tendpoints: {\n\t\t\tgetSession: createAuthEndpoint(\n\t\t\t\t\"/get-session\",\n\t\t\t\t{\n\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\tquery: getSessionQuerySchema,\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tCUSTOM_SESSION: true,\n\t\t\t\t\t\topenapi: {\n\t\t\t\t\t\t\tdescription: \"Get custom session data\",\n\t\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\t\tdescription: \"Success\",\n\t\t\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\t\t\"application/json\": {\n\t\t\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t$ref: \"#/components/schemas/Session\",\n\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\trequireHeaders: true,\n\t\t\t\t},\n\t\t\t\tasync (ctx): Promise<Returns | null> => {\n\t\t\t\t\tconst session = await getSession()({\n\t\t\t\t\t\t...ctx,\n\t\t\t\t\t\tasResponse: false,\n\t\t\t\t\t\theaders: ctx.headers,\n\t\t\t\t\t\treturnHeaders: true,\n\t\t\t\t\t}).catch((e) => {\n\t\t\t\t\t\treturn null;\n\t\t\t\t\t});\n\t\t\t\t\tif (!session?.response) {\n\t\t\t\t\t\treturn ctx.json(null);\n\t\t\t\t\t}\n\t\t\t\t\tconst fnResult = await fn(session.response as any, ctx);\n\n\t\t\t\t\tconst setCookie = session.headers.get(\"set-cookie\");\n\t\t\t\t\tif (setCookie) {\n\t\t\t\t\t\tctx.setHeader(\"set-cookie\", setCookie);\n\t\t\t\t\t\tsession.headers.delete(\"set-cookie\");\n\t\t\t\t\t}\n\n\t\t\t\t\tsession.headers.forEach((value, key) => {\n\t\t\t\t\t\tctx.setHeader(key, value);\n\t\t\t\t\t});\n\t\t\t\t\treturn ctx.json(fnResult);\n\t\t\t\t},\n\t\t\t),\n\t\t},\n\t\t$Infer: {\n\t\t\tSession: {} as Awaited<ReturnType<typeof fn>>,\n\t\t},\n\t\toptions: pluginOptions,\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;AAcA,MAAM,wBAAwB,EAAE,SAC/B,EAAE,OAAO;CAKR,oBAAoB,EAClB,SAAS,CACT,KAAK,EACL,aAAa,wDACb,CAAC,CACD,GAAG,EAAE,QAAQ,CAAC,WAAW,MAAM,MAAM,OAAO,CAAC,CAC7C,UAAU;CACZ,gBAAgB,EACd,SAAS,CACT,KAAK,EACL,aACC,6FACD,CAAC,CACD,UAAU;CACZ,CAAC,CACF;AAUD,MAAa,iBAIZ,IAOA,SACA,kBACI;AACJ,QAAO;EACN,IAAI;EACJ,OAAO,EACN,OAAO,CACN;GACC,UAAU,QACT,IAAI,SAAS,0CACZ,eAAe,0CAA0C;GAC3D,SAAS,qBAAqB,OAAO,QAAQ;IAC5C,MAAM,WAAW,MAAM,oBAAwB,IAAI;AACnD,QAAI,CAAC,SAAU;IACf,MAAM,cAAc,MAAM,QAAQ,IACjC,SAAS,IAAI,OAAO,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,CAC3C;AACD,WAAO,IAAI,KAAK,YAAY;KAC3B;GACF,CACD,EACD;EACD,WAAW,EACV,YAAY,mBACX,gBACA;GACC,QAAQ;GACR,OAAO;GACP,UAAU;IACT,gBAAgB;IAChB,SAAS;KACR,aAAa;KACb,WAAW,EACV,OAAO;MACN,aAAa;MACb,SAAS,EACR,oBAAoB,EACnB,QAAQ;OACP,MAAM;OACN,UAAU;OACV,OAAO,EACN,MAAM,gCACN;OACD,EACD,EACD;MACD,EACD;KACD;IACD;GACD,gBAAgB;GAChB,EACD,OAAO,QAAiC;GACvC,MAAM,UAAU,MAAM,YAAY,CAAC;IAClC,GAAG;IACH,YAAY;IACZ,SAAS,IAAI;IACb,eAAe;IACf,CAAC,CAAC,OAAO,MAAM;AACf,WAAO;KACN;AACF,OAAI,CAAC,SAAS,SACb,QAAO,IAAI,KAAK,KAAK;GAEtB,MAAM,WAAW,MAAM,GAAG,QAAQ,UAAiB,IAAI;GAEvD,MAAM,YAAY,QAAQ,QAAQ,IAAI,aAAa;AACnD,OAAI,WAAW;AACd,QAAI,UAAU,cAAc,UAAU;AACtC,YAAQ,QAAQ,OAAO,aAAa;;AAGrC,WAAQ,QAAQ,SAAS,OAAO,QAAQ;AACvC,QAAI,UAAU,KAAK,MAAM;KACxB;AACF,UAAO,IAAI,KAAK,SAAS;IAE1B,EACD;EACD,QAAQ,EACP,SAAS,EAAE,EACX;EACD,SAAS;EACT"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/custom-session/index.ts"],"sourcesContent":["import type {\n\tBetterAuthOptions,\n\tBetterAuthPlugin,\n\tGenericEndpointContext,\n} from \"@better-auth/core\";\nimport {\n\tcreateAuthEndpoint,\n\tcreateAuthMiddleware,\n} from \"@better-auth/core/api\";\nimport * as z from \"zod\";\nimport { getSession } from \"../../api\";\nimport { parseSetCookieHeader } from \"../../cookies/cookie-utils\";\nimport type { InferSession, InferUser } from \"../../types\";\nimport { getEndpointResponse } from \"../../utils/plugin-helper\";\n\nconst getSessionQuerySchema = z.optional(\n\tz.object({\n\t\t/**\n\t\t * If cookie cache is enabled, it will disable the cache\n\t\t * and fetch the session from the database\n\t\t */\n\t\tdisableCookieCache: z\n\t\t\t.boolean()\n\t\t\t.meta({\n\t\t\t\tdescription: \"Disable cookie cache and fetch session from database\",\n\t\t\t})\n\t\t\t.or(z.string().transform((v) => v === \"true\"))\n\t\t\t.optional(),\n\t\tdisableRefresh: z\n\t\t\t.boolean()\n\t\t\t.meta({\n\t\t\t\tdescription:\n\t\t\t\t\t\"Disable session refresh. Useful for checking session status, without updating the session\",\n\t\t\t})\n\t\t\t.optional(),\n\t}),\n);\n\nexport type CustomSessionPluginOptions = {\n\t/**\n\t * This option is used to determine if the list-device-sessions endpoint should be mutated to the custom session data.\n\t * @default false\n\t */\n\tshouldMutateListDeviceSessionsEndpoint?: boolean | undefined;\n};\n\nexport const customSession = <\n\tReturns extends Record<string, any>,\n\tO extends BetterAuthOptions = BetterAuthOptions,\n>(\n\tfn: (\n\t\tsession: {\n\t\t\tuser: InferUser<O>;\n\t\t\tsession: InferSession<O>;\n\t\t},\n\t\tctx: GenericEndpointContext,\n\t) => Promise<Returns>,\n\toptions?: O | undefined,\n\tpluginOptions?: CustomSessionPluginOptions | undefined,\n) => {\n\treturn {\n\t\tid: \"custom-session\",\n\t\thooks: {\n\t\t\tafter: [\n\t\t\t\t{\n\t\t\t\t\tmatcher: (ctx) =>\n\t\t\t\t\t\tctx.path === \"/multi-session/list-device-sessions\" &&\n\t\t\t\t\t\t(pluginOptions?.shouldMutateListDeviceSessionsEndpoint ?? false),\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst response = await getEndpointResponse<[]>(ctx);\n\t\t\t\t\t\tif (!response) return;\n\t\t\t\t\t\tconst newResponse = await Promise.all(\n\t\t\t\t\t\t\tresponse.map(async (v) => await fn(v, ctx)),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn ctx.json(newResponse);\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\tendpoints: {\n\t\t\tgetSession: createAuthEndpoint(\n\t\t\t\t\"/get-session\",\n\t\t\t\t{\n\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\tquery: getSessionQuerySchema,\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tCUSTOM_SESSION: true,\n\t\t\t\t\t\topenapi: {\n\t\t\t\t\t\t\tdescription: \"Get custom session data\",\n\t\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\t\tdescription: \"Success\",\n\t\t\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\t\t\"application/json\": {\n\t\t\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\titems: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t$ref: \"#/components/schemas/Session\",\n\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\trequireHeaders: true,\n\t\t\t\t},\n\t\t\t\tasync (ctx): Promise<Returns | null> => {\n\t\t\t\t\tconst session = await getSession()({\n\t\t\t\t\t\t...ctx,\n\t\t\t\t\t\tasResponse: false,\n\t\t\t\t\t\theaders: ctx.headers,\n\t\t\t\t\t\treturnHeaders: true,\n\t\t\t\t\t}).catch((e) => {\n\t\t\t\t\t\treturn null;\n\t\t\t\t\t});\n\t\t\t\t\tif (!session?.response) {\n\t\t\t\t\t\treturn ctx.json(null);\n\t\t\t\t\t}\n\t\t\t\t\tconst fnResult = await fn(session.response as any, ctx);\n\n\t\t\t\t\tfor (const cookieStr of session.headers.getSetCookie()) {\n\t\t\t\t\t\tconst parsed = parseSetCookieHeader(cookieStr);\n\t\t\t\t\t\tparsed.forEach((attrs, name) => {\n\t\t\t\t\t\t\tctx.setCookie(name, attrs.value, {\n\t\t\t\t\t\t\t\tmaxAge: attrs[\"max-age\"],\n\t\t\t\t\t\t\t\texpires: attrs.expires,\n\t\t\t\t\t\t\t\tdomain: attrs.domain,\n\t\t\t\t\t\t\t\tpath: attrs.path,\n\t\t\t\t\t\t\t\tsecure: attrs.secure,\n\t\t\t\t\t\t\t\thttpOnly: attrs.httponly,\n\t\t\t\t\t\t\t\tsameSite: attrs.samesite,\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\tsession.headers.delete(\"set-cookie\");\n\n\t\t\t\t\tsession.headers.forEach((value, key) => {\n\t\t\t\t\t\tctx.setHeader(key, value);\n\t\t\t\t\t});\n\t\t\t\t\treturn ctx.json(fnResult);\n\t\t\t\t},\n\t\t\t),\n\t\t},\n\t\t$Infer: {\n\t\t\tSession: {} as Awaited<ReturnType<typeof fn>>,\n\t\t},\n\t\toptions: pluginOptions,\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;;AAeA,MAAM,wBAAwB,EAAE,SAC/B,EAAE,OAAO;CAKR,oBAAoB,EAClB,SAAS,CACT,KAAK,EACL,aAAa,wDACb,CAAC,CACD,GAAG,EAAE,QAAQ,CAAC,WAAW,MAAM,MAAM,OAAO,CAAC,CAC7C,UAAU;CACZ,gBAAgB,EACd,SAAS,CACT,KAAK,EACL,aACC,6FACD,CAAC,CACD,UAAU;CACZ,CAAC,CACF;AAUD,MAAa,iBAIZ,IAOA,SACA,kBACI;AACJ,QAAO;EACN,IAAI;EACJ,OAAO,EACN,OAAO,CACN;GACC,UAAU,QACT,IAAI,SAAS,0CACZ,eAAe,0CAA0C;GAC3D,SAAS,qBAAqB,OAAO,QAAQ;IAC5C,MAAM,WAAW,MAAM,oBAAwB,IAAI;AACnD,QAAI,CAAC,SAAU;IACf,MAAM,cAAc,MAAM,QAAQ,IACjC,SAAS,IAAI,OAAO,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,CAC3C;AACD,WAAO,IAAI,KAAK,YAAY;KAC3B;GACF,CACD,EACD;EACD,WAAW,EACV,YAAY,mBACX,gBACA;GACC,QAAQ;GACR,OAAO;GACP,UAAU;IACT,gBAAgB;IAChB,SAAS;KACR,aAAa;KACb,WAAW,EACV,OAAO;MACN,aAAa;MACb,SAAS,EACR,oBAAoB,EACnB,QAAQ;OACP,MAAM;OACN,UAAU;OACV,OAAO,EACN,MAAM,gCACN;OACD,EACD,EACD;MACD,EACD;KACD;IACD;GACD,gBAAgB;GAChB,EACD,OAAO,QAAiC;GACvC,MAAM,UAAU,MAAM,YAAY,CAAC;IAClC,GAAG;IACH,YAAY;IACZ,SAAS,IAAI;IACb,eAAe;IACf,CAAC,CAAC,OAAO,MAAM;AACf,WAAO;KACN;AACF,OAAI,CAAC,SAAS,SACb,QAAO,IAAI,KAAK,KAAK;GAEtB,MAAM,WAAW,MAAM,GAAG,QAAQ,UAAiB,IAAI;AAEvD,QAAK,MAAM,aAAa,QAAQ,QAAQ,cAAc,CAErD,CADe,qBAAqB,UAAU,CACvC,SAAS,OAAO,SAAS;AAC/B,QAAI,UAAU,MAAM,MAAM,OAAO;KAChC,QAAQ,MAAM;KACd,SAAS,MAAM;KACf,QAAQ,MAAM;KACd,MAAM,MAAM;KACZ,QAAQ,MAAM;KACd,UAAU,MAAM;KAChB,UAAU,MAAM;KAChB,CAAC;KACD;AAEH,WAAQ,QAAQ,OAAO,aAAa;AAEpC,WAAQ,QAAQ,SAAS,OAAO,QAAQ;AACvC,QAAI,UAAU,KAAK,MAAM;KACxB;AACF,UAAO,IAAI,KAAK,SAAS;IAE1B,EACD;EACD,QAAQ,EACP,SAAS,EAAE,EACX;EACD,SAAS;EACT"}

package/dist/plugins/device-authorization/index.d.mts

@@ -1,5 +1,5 @@
 import { TimeString, ms, sec } from "../../utils/time.mjs";
-import * as better_call24 from "better-call";
+import * as better_call15 from "better-call";
 import * as z from "zod";
 
 //#region src/plugins/device-authorization/index.d.ts
@@ -91,7 +91,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
     };
   };
   endpoints: {
-    deviceCode: better_call24.StrictEndpoint<"/device/code", {
+    deviceCode: better_call15.StrictEndpoint<"/device/code", {
       method: "POST";
       body: z.ZodObject<{
         client_id: z.ZodString;
@@ -176,7 +176,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
       expires_in: number;
       interval: number;
     }>;
-    deviceToken: better_call24.StrictEndpoint<"/device/token", {
+    deviceToken: better_call15.StrictEndpoint<"/device/token", {
       method: "POST";
       body: z.ZodObject<{
         grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:device_code">;
@@ -244,7 +244,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
       expires_in: number;
       scope: string;
     }>;
-    deviceVerify: better_call24.StrictEndpoint<"/device", {
+    deviceVerify: better_call15.StrictEndpoint<"/device", {
       method: "GET";
       query: z.ZodObject<{
         user_code: z.ZodString;
@@ -287,7 +287,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
       user_code: string;
       status: string;
     }>;
-    deviceApprove: better_call24.StrictEndpoint<"/device/approve", {
+    deviceApprove: better_call15.StrictEndpoint<"/device/approve", {
       method: "POST";
       body: z.ZodObject<{
         userCode: z.ZodString;
@@ -328,7 +328,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
     }, {
       success: boolean;
     }>;
-    deviceDeny: better_call24.StrictEndpoint<"/device/deny", {
+    deviceDeny: better_call15.StrictEndpoint<"/device/deny", {
       method: "POST";
       body: z.ZodObject<{
         userCode: z.ZodString;