better-auth 1.7.11 → 1.7.13

package/dist/integrations/tanstack-start.d.mts

@@ -1,6 +1,3 @@
-import * as _$_better_auth_core0 from "@better-auth/core";
-import * as _$better_call0 from "better-call";
-
 //#region src/integrations/tanstack-start.d.ts
 /**
  * TanStack Start cookie plugin for React.
@@ -19,15 +16,14 @@ import * as _$better_call0 from "better-call";
  * });
  * ```
  */
-declare const tanstackStartCookies: () => {
+export declare const tanstackStartCookies: () => {
   id: "tanstack-start-cookies";
   version: string;
   hooks: {
     after: {
-      matcher(ctx: _$_better_auth_core0.HookEndpointContext): true;
-      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+      matcher(ctx: import("@better-auth/core").HookEndpointContext): true;
+      handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
     }[];
   };
 };
-//#endregion
-export { tanstackStartCookies };
+//#endregion

package/dist/oauth2/callback.mjs

@@ -0,0 +1,68 @@
+import { resolveOAuthAccountKey, toOAuthProfileRecord } from "./account-key.mjs";
+import { OAUTH_CALLBACK_ERROR_CODES } from "./errors.mjs";
+import { getOAuthCallbackPath } from "./utils.mjs";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+//#region src/oauth2/callback.ts
+/**
+* Turns a provider callback into a verified identity. It checks that the
+* callback answers this authorization request, exchanges the code, and
+* resolves the user and account key.
+*
+* Every route that completes a provider callback goes through here, so the
+* routes run the same checks.
+*/
+async function exchangeOAuthCallback(ctx, provider, callback) {
+	if (callback.iss && provider.issuer && callback.iss !== provider.issuer) {
+		ctx.context.logger.error("OAuth issuer mismatch", {
+			expected: provider.issuer,
+			received: callback.iss
+		});
+		return { error: OAUTH_CALLBACK_ERROR_CODES.ISSUER_MISMATCH };
+	}
+	if (provider.requiresIdTokenNonce && !callback.idTokenNonce) {
+		ctx.context.logger.error("OAuth id_token nonce binding required but no expected nonce was found in state", { providerId: provider.id });
+		return { error: OAUTH_CALLBACK_ERROR_CODES.NONCE_BINDING_MISSING };
+	}
+	let tokens;
+	try {
+		tokens = await provider.validateAuthorizationCode({
+			code: callback.code,
+			codeVerifier: callback.codeVerifier,
+			deviceId: callback.deviceId,
+			redirectURI: `${ctx.context.baseURL}${getOAuthCallbackPath(provider)}`
+		});
+	} catch (error) {
+		ctx.context.logger.error("Failed to validate authorization code", error);
+		return { error: OAUTH_CALLBACK_ERROR_CODES.INVALID_CODE };
+	}
+	if (!tokens) return { error: OAUTH_CALLBACK_ERROR_CODES.INVALID_CODE };
+	const result = await provider.getUserInfo({
+		...tokens,
+		expectedIdTokenNonce: callback.idTokenNonce,
+		/**
+		* The user object from the provider
+		* This is only available for some providers like Apple
+		*/
+		user: safeJSONParse(callback.user) ?? void 0
+	});
+	if (!result?.user) {
+		ctx.context.logger.error("Unable to get user info");
+		return { error: OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_GET_USER_INFO };
+	}
+	const accountKey = await resolveOAuthAccountKey(provider, tokens, result.data).catch((error) => {
+		ctx.context.logger.error("Unable to derive provider account identity", {
+			providerId: provider.id,
+			error
+		});
+		return null;
+	});
+	if (!accountKey) return { error: OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_GET_USER_INFO };
+	return {
+		tokens,
+		userInfo: result.user,
+		providerProfile: toOAuthProfileRecord(result.data),
+		accountKey
+	};
+}
+//#endregion
+export { exchangeOAuthCallback };

package/dist/oauth2/link-account.d.mts

@@ -1,6 +1,6 @@
 import { Account, User } from "../types/models.mjs";
+import "../types/index.mjs";
 import { GenericEndpointContext, UserProvisioningSource } from "@better-auth/core";
-
 //#region src/oauth2/link-account.d.ts
 type OAuthAccountData = Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
 /**
@@ -35,14 +35,8 @@ interface LinkOAuthAccountFailure {
 type LinkOAuthAccountResult = {
   linked: true;
 } | LinkOAuthAccountFailure;
-declare function linkOAuthAccount(c: GenericEndpointContext, {
-  link,
-  userInfo,
-  account,
-  profile,
-  scopes
-}: LinkOAuthAccountOptions): Promise<LinkOAuthAccountResult>;
-declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
+export declare function linkOAuthAccount(c: GenericEndpointContext, { link, userInfo, account, profile, scopes }: LinkOAuthAccountOptions): Promise<LinkOAuthAccountResult>;
+export declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
   userInfo: Omit<User, "createdAt" | "updatedAt">;
   account: OAuthAccountData;
   callbackURL?: string | undefined;
@@ -119,6 +113,6 @@ declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
  * cookie cache with the fresh row. Returns `undefined` when the policy is
  * disabled or the update fails: a failed profile sync must not abort the link.
  */
-declare function applyUpdateUserInfoOnLink(c: GenericEndpointContext, userId: string, userInfo: LinkedProviderProfile): Promise<User | undefined>;
+export declare function applyUpdateUserInfoOnLink(c: GenericEndpointContext, userId: string, userInfo: LinkedProviderProfile): Promise<User | undefined>;
 //#endregion
-export { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount };
+export {};

package/dist/oauth2/link-account.mjs

@@ -82,7 +82,8 @@ async function handleOAuthUserInfo(c, opts) {
 		accountId: account.accountId
 	}).catch((e) => {
 		c.context.logger.error("Better auth was unable to query your database.\nError: ", e);
-		redirectOnError(c, c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`, "internal_server_error");
+		const errorURL = c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`;
+		redirectOnError(c, errorURL, "internal_server_error");
 	});
 	if (accountOwner?.kind === "orphaned") {
 		c.context.logger.error("OAuth account references a missing user. Repair the account before retrying authentication.");
@@ -126,7 +127,8 @@ async function handleOAuthUserInfo(c, opts) {
 	})().catch((e) => {
 		if (isAPIError(e)) throw e;
 		c.context.logger.error("Better auth was unable to query your database.\nError: ", e);
-		redirectOnError(c, c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`, "internal_server_error");
+		const errorURL = c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`;
+		redirectOnError(c, errorURL, "internal_server_error");
 	});
 	let user = dbUser?.user;
 	const isRegister = !user;
@@ -175,8 +177,10 @@ async function handleOAuthUserInfo(c, opts) {
 					code: "account_hook_binding_conflict",
 					message: "Account hook changed the selected authentication binding"
 				});
-				if (c.context.options.account?.storeAccountCookie) if (opts.deferNonDatabaseWrites) pendingAccountCookie = createdAccount;
-				else await setAccountCookie(c, createdAccount);
+				if (c.context.options.account?.storeAccountCookie) {
+					if (opts.deferNonDatabaseWrites) pendingAccountCookie = createdAccount;
+					else await setAccountCookie(c, createdAccount);
+				}
 			} catch (e) {
 				if (isAPIError(e)) throw e;
 				c.context.logger.error("Unable to link account", e);
@@ -292,8 +296,10 @@ async function handleOAuthUserInfo(c, opts) {
 				message: "Account hook changed the selected authentication binding"
 			});
 			user = createdUser;
-			if (c.context.options.account?.storeAccountCookie) if (opts.deferNonDatabaseWrites) pendingAccountCookie = createdAccount;
-			else await setAccountCookie(c, createdAccount);
+			if (c.context.options.account?.storeAccountCookie) {
+				if (opts.deferNonDatabaseWrites) pendingAccountCookie = createdAccount;
+				else await setAccountCookie(c, createdAccount);
+			}
 		} catch (e) {
 			if (isAPIError(e)) throw e;
 			c.context.logger.error("Unable to create OAuth user", e);

package/dist/oauth2/state.d.mts

@@ -1,5 +1,4 @@
 import { GenericEndpointContext } from "@better-auth/core";
-
 //#region src/oauth2/state.d.ts
 /**
  * Mint the OIDC `nonce` for the redirect flow, or `undefined` when the provider
@@ -8,14 +7,14 @@ import { GenericEndpointContext } from "@better-auth/core";
  * through this helper, so the value sent on the authorization URL and the value
  * persisted in state are produced one way and cannot drift apart.
  */
-declare function generateIdTokenNonce(provider: {
+export declare function generateIdTokenNonce(provider: {
   requiresIdTokenNonce?: boolean | undefined;
 }): string | undefined;
 /**
  * Inputs for {@link generateState}. Grouped into one object so call sites read
  * by name instead of by position.
  */
-interface GenerateStateOptions {
+export interface GenerateStateOptions {
   /** Link target when this flow links a provider identity to an existing user. */
   link?: {
     email: string;
@@ -30,11 +29,11 @@ interface GenerateStateOptions {
   /** The OIDC nonce already sent as the authorization URL `nonce` parameter. */
   idTokenNonce?: string | undefined;
 }
-declare function generateState(c: GenericEndpointContext, options?: GenerateStateOptions): Promise<{
+export declare function generateState(c: GenericEndpointContext, options?: GenerateStateOptions): Promise<{
   state: string;
   codeVerifier: string;
 }>;
-declare function parseState(c: GenericEndpointContext): Promise<{
+export declare function parseState(c: GenericEndpointContext): Promise<{
   [x: string]: unknown;
   callbackURL: string;
   codeVerifier: string;
@@ -50,5 +49,4 @@ declare function parseState(c: GenericEndpointContext): Promise<{
   idTokenNonce?: string | undefined;
   serverContext?: Record<string, unknown> | undefined;
 }>;
-//#endregion
-export { GenerateStateOptions, generateIdTokenNonce, generateState, parseState };
+//#endregion

package/dist/oauth2/state.mjs

@@ -28,7 +28,7 @@ async function generateState(c, options) {
 		newUserURL: c.body?.newUserCallbackURL,
 		link: options?.link,
 		serverContext,
-		expiresAt: Date.now() + 600 * 1e3,
+		expiresAt: Date.now() + 6e5,
 		requestSignUp: c.body?.requestSignUp,
 		idTokenNonce: options?.idTokenNonce
 	};

package/dist/oauth2/utils.d.mts

@@ -1,11 +1,9 @@
 import { AuthContext, LiteralString } from "@better-auth/core";
-
 //#region src/oauth2/utils.d.ts
-declare function decryptOAuthToken(token: string, ctx: AuthContext): string | Promise<string>;
-declare function setTokenUtil(token: string | null | undefined, ctx: AuthContext): string | Promise<string> | null | undefined;
-declare function getOAuthCallbackPath(provider: {
+export declare function decryptOAuthToken(token: string, ctx: AuthContext): string | Promise<string>;
+export declare function setTokenUtil(token: string | null | undefined, ctx: AuthContext): string | Promise<string> | null | undefined;
+export declare function getOAuthCallbackPath(provider: {
   id: LiteralString;
   callbackPath?: string | undefined;
 }): string;
-//#endregion
-export { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil };
+//#endregion

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.11";
+var version = "1.7.13";
 //#endregion
 export { version };

package/dist/plugins/access/access.d.mts

@@ -1,17 +1,15 @@
 import { ExactRoleStatements, Role, RoleInput, Statements } from "./types.mjs";
-
 //#region src/plugins/access/access.d.ts
-type AuthorizeResponse = {
+export type AuthorizeResponse = {
   success: false;
   error: string;
 } | {
   success: true;
   error?: never | undefined;
 };
-declare function role<const TRoleStatements extends Statements, TAuthorizeStatements extends Statements = TRoleStatements>(statements: TRoleStatements): Role<ExactRoleStatements<TRoleStatements>, TAuthorizeStatements>;
-declare function createAccessControl<const TStatements extends Statements>(s: TStatements): {
+export declare function role<const TRoleStatements extends Statements, TAuthorizeStatements extends Statements = TRoleStatements>(statements: TRoleStatements): Role<ExactRoleStatements<TRoleStatements>, TAuthorizeStatements>;
+export declare function createAccessControl<const TStatements extends Statements>(s: TStatements): {
   newRole<const TRoleStatements extends Statements>(statements: RoleInput<TStatements, TRoleStatements>): Role<ExactRoleStatements<TRoleStatements>, TStatements>;
   statements: TStatements;
 };
-//#endregion
-export { AuthorizeResponse, createAccessControl, role };
+//#endregion

package/dist/plugins/access/index.mjs

@@ -1,2 +1 @@
-import { createAccessControl, role } from "./access.mjs";
-export { createAccessControl, role };
+export { createAccessControl, role } from "./access.mjs";

package/dist/plugins/access/types.d.mts

@@ -1,24 +1,22 @@
 import { AuthorizeResponse, createAccessControl } from "./access.mjs";
 import { LiteralString } from "@better-auth/core";
-
 //#region src/plugins/access/types.d.ts
-type ArrayElement<T> = T extends readonly (infer E)[] ? E : never;
-type SubArray<T extends unknown[] | readonly unknown[] | any[]> = T[number][] | ReadonlyArray<T[number]>;
-type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly string[] | readonly LiteralString[]>> = { [P in K]: SubArray<R[P]> };
-type Statements = {
+export type ArrayElement<T> = T extends readonly (infer E)[] ? E : never;
+export type SubArray<T extends unknown[] | readonly unknown[] | any[]> = T[number][] | ReadonlyArray<T[number]>;
+export type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly string[] | readonly LiteralString[]>> = { [P in K]: SubArray<R[P]>; };
+export type Statements = {
   readonly [resource: string]: readonly LiteralString[];
 };
-type RoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]?: SubArray<TStatements[P]> };
-type RoleInput<TStatements extends Statements, TRoleStatements extends Statements> = TRoleStatements & (string extends keyof TRoleStatements ? {} : RoleStatements<TStatements> & Record<Exclude<keyof TRoleStatements, keyof TStatements>, never>);
-type ExactRoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]: readonly [...TStatements[P]] };
-type AccessControl<TStatements extends Statements = Statements> = ReturnType<typeof createAccessControl<TStatements>>;
-type RoleAuthorizeRequest<TStatements extends Statements> = { [P in keyof TStatements]?: SubArray<TStatements[P]> | {
+export type RoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]?: SubArray<TStatements[P]>; };
+export type RoleInput<TStatements extends Statements, TRoleStatements extends Statements> = TRoleStatements & (string extends keyof TRoleStatements ? {} : RoleStatements<TStatements> & Record<Exclude<keyof TRoleStatements, keyof TStatements>, never>);
+export type ExactRoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]: readonly [...TStatements[P]]; };
+export type AccessControl<TStatements extends Statements = Statements> = ReturnType<typeof createAccessControl<TStatements>>;
+export type RoleAuthorizeRequest<TStatements extends Statements> = { [P in keyof TStatements]?: SubArray<TStatements[P]> | {
   actions: SubArray<TStatements[P]>;
   connector: "OR" | "AND";
-} };
-type Role<TRoleStatements extends Statements = Record<string, any>, TAuthorizeStatements extends Statements = TRoleStatements> = {
+}; };
+export type Role<TRoleStatements extends Statements = Record<string, any>, TAuthorizeStatements extends Statements = TRoleStatements> = {
   authorize: (request: RoleAuthorizeRequest<TAuthorizeStatements>, connector?: ("OR" | "AND") | undefined) => AuthorizeResponse;
   statements: TRoleStatements;
 };
-//#endregion
-export { AccessControl, ArrayElement, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset };
+//#endregion

package/dist/plugins/additional-fields/client.d.mts

@@ -1,8 +1,7 @@
 import { BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { DBFieldAttribute } from "@better-auth/core/db";
-
 //#region src/plugins/additional-fields/client.d.ts
-declare const inferAdditionalFields: <T, S extends {
+export declare const inferAdditionalFields: <T, S extends {
   user?: {
     [key: string]: DBFieldAttribute;
   } | undefined;
@@ -96,5 +95,4 @@ declare const inferAdditionalFields: <T, S extends {
     };
   } : never : undefined;
 };
-//#endregion
-export { inferAdditionalFields };
+//#endregion

package/dist/plugins/admin/access/index.mjs

@@ -1,2 +1 @@
-import { adminAc, defaultAc, defaultRoles, defaultStatements, userAc } from "./statement.mjs";
-export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };
+export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc } from "./statement.mjs";

package/dist/plugins/admin/access/statement.d.mts

@@ -1,10 +1,11 @@
 import { ExactRoleStatements, Role, RoleInput, Statements } from "../../access/types.mjs";
+import "../../index.mjs";
 //#region src/plugins/admin/access/statement.d.ts
-declare const defaultStatements: {
+export declare const defaultStatements: {
   readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 };
-declare const defaultAc: {
+export declare const defaultAc: {
   newRole<const TRoleStatements extends Statements>(statements: RoleInput<{
     readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
@@ -17,21 +18,21 @@ declare const defaultAc: {
     readonly session: readonly ["list", "revoke", "delete"];
   };
 };
-declare const adminAc: Role<ExactRoleStatements<{
+export declare const adminAc: Role<ExactRoleStatements<{
   readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
   readonly session: ["list", "revoke", "delete"];
 }>, {
   readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 }>;
-declare const userAc: Role<ExactRoleStatements<{
+export declare const userAc: Role<ExactRoleStatements<{
   readonly user: [];
   readonly session: [];
 }>, {
   readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 }>;
-declare const defaultRoles: {
+export declare const defaultRoles: {
   admin: Role<ExactRoleStatements<{
     readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
     readonly session: ["list", "revoke", "delete"];
@@ -47,5 +48,4 @@ declare const defaultRoles: {
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
 };
-//#endregion
-export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };
+//#endregion