better-near-auth 0.1.0 → 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Elliot Braem
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -13,7 +13,7 @@
 
 </div>
 
-This [Better Auth](https://better-auth.com) plugin enables secure authentication via NEAR wallets and keypairs by following the [NEP-413 standard](https://github.com/near/NEPs/blob/master/neps/nep-0413.md). It leverages [near-sign-verify](https://github.com/elliotBraem/near-sign-verify) and [fastintear](https://github.com/elliotBraem/fastintear), and provides a complete drop-in solution with secure defaults and automatic profile integration.
+This [Better Auth](https://better-auth.com) plugin enables secure authentication via NEAR wallets and keypairs by following the [NEP-413 standard](https://github.com/near/NEPs/blob/master/neps/nep-0413.md). It leverages [near-sign-verify](https://github.com/elliotBraem/near-sign-verify) and [fastintear](https://github.com/elliotBraem/fastintear), and provides a complete drop-in solution with session management, secure defaults, and automatic profile integration.
 
 ## Installation
 
@@ -30,6 +30,9 @@ npm install better-near-auth
     import { siwn } from "better-near-auth";
 
     export const auth = betterAuth({
+        database: drizzleAdapter(db, {
+          // db configuration
+        }),
         plugins: [
             siwn({
                 recipient: "myapp.com",
@@ -39,7 +42,7 @@ npm install better-near-auth
     });
     ```
 
-3. Migrate the database. Run the migration or generate the schema to add the necessary fields and tables to the database.
+3. Generate the schema to add the necessary fields and tables to the database.
 
   ```bash
   npx @better-auth/cli generate
@@ -85,11 +88,11 @@ Access user profiles from NEAR Social automatically:
 
 ```ts title="profile-usage.ts"
 // Get current user's profile (requires authentication)
-const { data: myProfile } = await authClient.near.getProfile();
+const myProfile = await authClient.near.getProfile();
 console.log("My profile:", myProfile);
 
 // Get specific user's profile (no auth required)
-const { data: aliceProfile } = await authClient.near.getProfile("alice.near");
+const aliceProfile = await authClient.near.getProfile("alice.near");
 console.log("Alice's profile:", aliceProfile);
 ```
 
@@ -108,7 +111,7 @@ The SIWN plugin accepts the following configuration options:
 * **validateRecipient**: Function to validate recipients. Optional, uses exact match by default
 * **validateMessage**: Function to validate messages. Optional, no validation by default
 * **getProfile**: Function to fetch user profiles. Optional, uses NEAR Social by default
-* **validateFunctionCallKey**: Function to validate function call access keys when `requireFullAccessKey` is false
+* **validateLimitedAccessKey**: Function to validate function call access keys when `requireFullAccessKey` is false
 
 ### Client Options
 
@@ -163,7 +166,6 @@ export const auth = betterAuth({
       // Optional: Custom profile lookup
       getProfile: async (accountId) => {
         // Custom profile logic, falls back to NEAR Social
-        return null; // Use default NEAR Social lookup
       },
     }),
   ],
@@ -293,7 +295,7 @@ export const auth = betterAuth({
       },
       
       // Validate function call keys against allowed contracts
-      validateFunctionCallKey: async ({ accountId, publicKey, contractId }) => {
+      validateLimitedAccessKey: async ({ accountId, publicKey, contractId }) => {
         const allowedContracts = ["myapp.near", "social.near"];
         return contractId ? allowedContracts.includes(contractId) : true;
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-near-auth",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Sign in with NEAR (SIWN) plugin for Better Auth",
   "main": "index.ts",
   "module": "index.ts",
@@ -45,7 +45,7 @@
   "dependencies": {
     "@better-auth/utils": "^0.2.6",
     "@fastnear/utils": "^0.9.7",
-    "fastintear": "link:fastintear",
+    "fastintear": "^0.2.3",
     "near-sign-verify": "^0.4.3",
     "zod": "^4.0.17"
   },

package/src/client.ts

@@ -3,6 +3,7 @@ import type { BetterAuthClientPlugin, BetterFetchOption, BetterFetchResponse } f
 import { sign, type WalletInterface } from "near-sign-verify";
 import type { siwn } from ".";
 import { type AccountId, type NonceRequestT, type NonceResponseT, type ProfileResponseT, type VerifyRequestT, type VerifyResponseT } from "./types";
+import type { User } from "better-auth";
 
 export interface Signer {
 	accountId(): string | null;
@@ -25,7 +26,7 @@ export interface SIWNClientActions {
 		getProfile: (accountId?: AccountId) => Promise<BetterFetchResponse<ProfileResponseT>>;
 	};
 	signIn: {
-		near: (params: { recipient: string, signer: Signer }, callbacks?: AuthCallbacks) => Promise<VerifyResponseT>;
+		near: (params: { recipient: string, signer: Signer }, callbacks?: AuthCallbacks) => Promise<void>;
 	};
 }
 
@@ -66,7 +67,10 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 					},
 				},
 				signIn: {
-					near: async (params: { recipient: string, signer: Signer }, callbacks?: AuthCallbacks): Promise<VerifyResponseT> => {
+					near: async (
+						params: { recipient: string, signer: Signer },
+						callbacks?: AuthCallbacks
+					): Promise<void> => {
 						try {
 							const { signer, recipient } = params;
 
@@ -74,32 +78,30 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 								throw new Error("NEAR signer not available");
 							}
 
-							// Must be already connected
 							const accountId = signer.accountId();
 							if (!accountId) {
 								throw new Error("Wallet not connected. Please connect your wallet first.");
 							}
 
-							// Get nonce for signature
 							const nonceResponse: BetterFetchResponse<NonceResponseT> = await $fetch("/near/nonce", {
 								method: "POST",
 								body: { accountId }
 							});
 
+							if (nonceResponse.error) {
+								throw new Error(nonceResponse.error.message || "Failed to get nonce");
+							}
+
 							const nonce = nonceResponse?.data?.nonce;
 							const message = `Sign in to ${recipient}\n\nAccount ID: ${accountId}\nNonce: ${nonce}`;
-
-							// Convert base64 nonce to Uint8Array for signing
 							const nonceBytes = base64ToBytes(nonce!);
 
-							// Sign message
 							const authToken = await sign(message, {
 								signer,
 								recipient,
 								nonce: nonceBytes,
 							});
 
-							// Verify signature with backend
 							const verifyResponse: BetterFetchResponse<VerifyResponseT> = await $fetch("/near/verify", {
 								method: "POST",
 								body: {
@@ -108,17 +110,18 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 								}
 							});
 
+							if (verifyResponse.error) {
+								throw new Error(verifyResponse.error.message || "Failed to verify signature");
+							}
+
 							if (!verifyResponse?.data?.success) {
 								throw new Error("Authentication verification failed");
 							}
 
 							callbacks?.onSuccess?.();
-							return verifyResponse.data;
-
 						} catch (error) {
 							const err = error instanceof Error ? error : new Error(String(error));
 							callbacks?.onError?.(err);
-							throw err;
 						}
 					}
 				}

package/src/index.ts

@@ -38,10 +38,10 @@ export type SIWNPluginOptions =
 		validateRecipient?: (recipient: string) => boolean;
 		validateMessage?: (message: string) => boolean;
 		getProfile?: (accountId: AccountId) => Promise<Profile | null>;
-		validateFunctionCallKey?: (args: {
+		validateLimitedAccessKey?: (args: {
 			accountId: AccountId;
 			publicKey: string;
-			contractId?: string;
+			recipient?: string;
 		}) => Promise<boolean>;
 	}
 	| {
@@ -54,10 +54,10 @@ export type SIWNPluginOptions =
 		validateRecipient?: (recipient: string) => boolean;
 		validateMessage?: (message: string) => boolean;
 		getProfile?: (accountId: AccountId) => Promise<Profile | null>;
-		validateFunctionCallKey?: (args: {
+		validateLimitedAccessKey?: (args: {
 			accountId: AccountId;
 			publicKey: string;
-			contractId?: string;
+			recipient: string;
 		}) => Promise<boolean>;
 	};
 
@@ -194,13 +194,14 @@ export const siwn = (options: SIWNPluginOptions) =>
 							});
 						}
 
-						if (!options.requireFullAccessKey && options.validateFunctionCallKey) {
-							const isValidFunctionKey = await options.validateFunctionCallKey({
+						if (!options.requireFullAccessKey && options.validateLimitedAccessKey) {
+							const isValidKey = await options.validateLimitedAccessKey({
 								accountId: result.accountId,
 								publicKey: result.publicKey,
-							}); // we can validate against an access control contract
+								recipient: options.recipient
+							}); // we could validate against some access control contract
 
-							if (!isValidFunctionKey) {
+							if (!isValidKey) {
 								throw new APIError("UNAUTHORIZED", {
 									message: "Unauthorized: Invalid function call access key",
 									status: 401,

package/src/near.test.ts

@@ -156,7 +156,7 @@
 // 						async verifyMessage({ authToken, expectedRecipient, accountId }) {
 // 							return authToken === "valid_token" && expectedRecipient === domain;
 // 						},
-// 						async validateFunctionCallKey({ accountId, publicKey }) {
+// 						async validateLimitedAccessKey({ accountId, publicKey }) {
 // 							return accountId === "test.near" && publicKey !== "";
 // 						},
 // 					}),