better-near-auth 0.1.1 → 0.1.2

package/README.md

@@ -111,7 +111,7 @@ The SIWN plugin accepts the following configuration options:
 * **validateRecipient**: Function to validate recipients. Optional, uses exact match by default
 * **validateMessage**: Function to validate messages. Optional, no validation by default
 * **getProfile**: Function to fetch user profiles. Optional, uses NEAR Social by default
-* **validateFunctionCallKey**: Function to validate function call access keys when `requireFullAccessKey` is false
+* **validateLimitedAccessKey**: Function to validate function call access keys when `requireFullAccessKey` is false
 
 ### Client Options
 
@@ -166,7 +166,6 @@ export const auth = betterAuth({
       // Optional: Custom profile lookup
       getProfile: async (accountId) => {
         // Custom profile logic, falls back to NEAR Social
-        return null; // Use default NEAR Social lookup
       },
     }),
   ],
@@ -296,7 +295,7 @@ export const auth = betterAuth({
       },
       
       // Validate function call keys against allowed contracts
-      validateFunctionCallKey: async ({ accountId, publicKey, contractId }) => {
+      validateLimitedAccessKey: async ({ accountId, publicKey, contractId }) => {
         const allowedContracts = ["myapp.near", "social.near"];
         return contractId ? allowedContracts.includes(contractId) : true;
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-near-auth",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Sign in with NEAR (SIWN) plugin for Better Auth",
   "main": "index.ts",
   "module": "index.ts",

package/src/client.ts

@@ -3,6 +3,7 @@ import type { BetterAuthClientPlugin, BetterFetchOption, BetterFetchResponse } f
 import { sign, type WalletInterface } from "near-sign-verify";
 import type { siwn } from ".";
 import { type AccountId, type NonceRequestT, type NonceResponseT, type ProfileResponseT, type VerifyRequestT, type VerifyResponseT } from "./types";
+import type { User } from "better-auth";
 
 export interface Signer {
 	accountId(): string | null;
@@ -25,7 +26,7 @@ export interface SIWNClientActions {
 		getProfile: (accountId?: AccountId) => Promise<BetterFetchResponse<ProfileResponseT>>;
 	};
 	signIn: {
-		near: (params: { recipient: string, signer: Signer }, callbacks?: AuthCallbacks) => Promise<VerifyResponseT>;
+		near: (params: { recipient: string, signer: Signer }, callbacks?: AuthCallbacks) => Promise<void>;
 	};
 }
 
@@ -66,7 +67,10 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 					},
 				},
 				signIn: {
-					near: async (params: { recipient: string, signer: Signer }, callbacks?: AuthCallbacks): Promise<VerifyResponseT> => {
+					near: async (
+						params: { recipient: string, signer: Signer },
+						callbacks?: AuthCallbacks
+					): Promise<void> => {
 						try {
 							const { signer, recipient } = params;
 
@@ -74,32 +78,30 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 								throw new Error("NEAR signer not available");
 							}
 
-							// Must be already connected
 							const accountId = signer.accountId();
 							if (!accountId) {
 								throw new Error("Wallet not connected. Please connect your wallet first.");
 							}
 
-							// Get nonce for signature
 							const nonceResponse: BetterFetchResponse<NonceResponseT> = await $fetch("/near/nonce", {
 								method: "POST",
 								body: { accountId }
 							});
 
+							if (nonceResponse.error) {
+								throw new Error(nonceResponse.error.message || "Failed to get nonce");
+							}
+
 							const nonce = nonceResponse?.data?.nonce;
 							const message = `Sign in to ${recipient}\n\nAccount ID: ${accountId}\nNonce: ${nonce}`;
-
-							// Convert base64 nonce to Uint8Array for signing
 							const nonceBytes = base64ToBytes(nonce!);
 
-							// Sign message
 							const authToken = await sign(message, {
 								signer,
 								recipient,
 								nonce: nonceBytes,
 							});
 
-							// Verify signature with backend
 							const verifyResponse: BetterFetchResponse<VerifyResponseT> = await $fetch("/near/verify", {
 								method: "POST",
 								body: {
@@ -108,17 +110,18 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 								}
 							});
 
+							if (verifyResponse.error) {
+								throw new Error(verifyResponse.error.message || "Failed to verify signature");
+							}
+
 							if (!verifyResponse?.data?.success) {
 								throw new Error("Authentication verification failed");
 							}
 
 							callbacks?.onSuccess?.();
-							return verifyResponse.data;
-
 						} catch (error) {
 							const err = error instanceof Error ? error : new Error(String(error));
 							callbacks?.onError?.(err);
-							throw err;
 						}
 					}
 				}

package/src/index.ts

@@ -38,10 +38,10 @@ export type SIWNPluginOptions =
 		validateRecipient?: (recipient: string) => boolean;
 		validateMessage?: (message: string) => boolean;
 		getProfile?: (accountId: AccountId) => Promise<Profile | null>;
-		validateFunctionCallKey?: (args: {
+		validateLimitedAccessKey?: (args: {
 			accountId: AccountId;
 			publicKey: string;
-			contractId?: string;
+			recipient?: string;
 		}) => Promise<boolean>;
 	}
 	| {
@@ -54,10 +54,10 @@ export type SIWNPluginOptions =
 		validateRecipient?: (recipient: string) => boolean;
 		validateMessage?: (message: string) => boolean;
 		getProfile?: (accountId: AccountId) => Promise<Profile | null>;
-		validateFunctionCallKey?: (args: {
+		validateLimitedAccessKey?: (args: {
 			accountId: AccountId;
 			publicKey: string;
-			contractId?: string;
+			recipient: string;
 		}) => Promise<boolean>;
 	};
 
@@ -194,13 +194,14 @@ export const siwn = (options: SIWNPluginOptions) =>
 							});
 						}
 
-						if (!options.requireFullAccessKey && options.validateFunctionCallKey) {
-							const isValidFunctionKey = await options.validateFunctionCallKey({
+						if (!options.requireFullAccessKey && options.validateLimitedAccessKey) {
+							const isValidKey = await options.validateLimitedAccessKey({
 								accountId: result.accountId,
 								publicKey: result.publicKey,
-							}); // we can validate against an access control contract
+								recipient: options.recipient
+							}); // we could validate against some access control contract
 
-							if (!isValidFunctionKey) {
+							if (!isValidKey) {
 								throw new APIError("UNAUTHORIZED", {
 									message: "Unauthorized: Invalid function call access key",
 									status: 401,

package/src/near.test.ts

@@ -156,7 +156,7 @@
 // 						async verifyMessage({ authToken, expectedRecipient, accountId }) {
 // 							return authToken === "valid_token" && expectedRecipient === domain;
 // 						},
-// 						async validateFunctionCallKey({ accountId, publicKey }) {
+// 						async validateLimitedAccessKey({ accountId, publicKey }) {
 // 							return accountId === "test.near" && publicKey !== "";
 // 						},
 // 					}),