better-near-auth 0.3.1 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-near-auth",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Sign in with NEAR (SIWN) plugin for Better Auth",
   "main": "src/index.ts",
   "module": "src/index.ts",
@@ -20,8 +20,13 @@
     "test": "vitest",
     "test:watch": "vitest --watch",
     "lint": "tsc --noEmit",
-    "dev": "bun run src/index.ts"
+    "start:b2s": "cd examples/browser-2-server && bun run dev",
+    "typecheck": "tsc --noEmit"
   },
+  "workspaces": [
+    "examples/browser-2-server",
+    "examples/browser-2-server/apps/*"
+  ],
   "keywords": [
     "better-auth",
     "near",
@@ -42,21 +47,29 @@
     "url": "https://github.com/elliotBraem/better-near-auth/issues"
   },
   "homepage": "https://github.com/elliotBraem/better-near-auth#readme",
+  "catalog": {
+    "better-auth": "^1.4.4",
+    "typescript": "^5.9.3",
+    "zod": "^4.1.12",
+    "@types/node": "^22.17.2",
+    "@orpc/server": "^1.13.2",
+    "@orpc/client": "^1.13.2"
+  },
   "peerDependencies": {
-    "better-auth": "^1.0.0",
-    "typescript": "^5.7.0"
+    "better-auth": "^1.4.4",
+    "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@hot-labs/near-connect": "^latest",
-    "nanostores": "^1.0.1",
-    "near-kit": "^latest",
+    "@hot-labs/near-connect": "^0.8.1",
+    "nanostores": "^1.1.0",
+    "near-kit": "^0.7.0",
     "near-sign-verify": "^0.4.5",
-    "zod": "^4.1.12"
+    "zod": "^4.2.1"
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "@types/node": "^24.9.2",
-    "better-auth": "^1.4.4",
+    "@types/node": "^22.19.3",
+    "better-auth": "^1.4.9",
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"
   },

package/src/client.ts

@@ -151,7 +151,7 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 		id: "siwn",
 		$InferServerPlugin: {} as ReturnType<typeof siwn>,
 
-		getAtoms: ($fetch) => ({
+		getAtoms: (_$fetch) => ({
 			nearState,
 			cachedNonce,
 		}),
@@ -303,11 +303,10 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 				},
 				requestSignIn: {
 					near: async (
-						params: { recipient: string },
+						_params: { recipient: string },
 						callbacks?: AuthCallbacks
 					): Promise<void> => {
 						try {
-							const { recipient } = params;
 
 							clearNonce();
 

package/src/index.ts

@@ -1,7 +1,7 @@
 import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
 import type { Account, BetterAuthPlugin, User } from "better-auth/types";
-import { generateNonce, parseAuthToken, verify, type VerificationResult, type VerifyOptions } from "near-sign-verify";
+import { generateNonce, verify, type VerificationResult, type VerifyOptions } from "near-sign-verify";
 import { bytesToBase64 } from "./utils";
 import z from "zod";
 import { defaultGetProfile, getImageUrl, getNetworkFromAccountId } from "./profile";
@@ -115,7 +115,7 @@ export const siwn = (options: SIWNPluginOptions) =>
 					requireRequest: true,
 				},
 				async (ctx) => {
-					const { authToken, accountId, email } = ctx.body;
+					const { authToken, accountId } = ctx.body;
 					const network = getNetworkFromAccountId(accountId);
 					const session = ctx.context.session;
 
@@ -126,33 +126,34 @@ export const siwn = (options: SIWNPluginOptions) =>
 						});
 					}
 
-					try {
-						const verification = await ctx.context.internalAdapter.findVerificationValue(
-							`siwn:${accountId}:${network}`,
-						);
-
-						if (!verification || new Date() > verification.expiresAt) {
-							throw new APIError("UNAUTHORIZED", {
-								message: "Unauthorized: Invalid or expired nonce",
-								status: 401,
-							});
-						}
-
-						// Build verify options using plugin configuration
-						const requireFullAccessKey = options.requireFullAccessKey ?? true;
-						const verifyOptions: VerifyOptions = {
-							requireFullAccessKey: requireFullAccessKey,
-							...(options.validateNonce
-								? { validateNonce: options.validateNonce }
-								: { nonceMaxAge: 15 * 60 * 1000 }),
-							...(options.validateRecipient
-								? { validateRecipient: options.validateRecipient }
-								: { expectedRecipient: options.recipient }),
-							...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
-						} as VerifyOptions;
-
-						// Verify the signature using near-sign-verify
-						const result: VerificationResult = await verify(authToken, verifyOptions);
+				try {
+					// First, verify the signature to get the publicKey
+					const requireFullAccessKey = options.requireFullAccessKey ?? true;
+					const verifyOptions: VerifyOptions = {
+						requireFullAccessKey: requireFullAccessKey,
+						...(options.validateNonce
+							? { validateNonce: options.validateNonce }
+							: { nonceMaxAge: 15 * 60 * 1000 }),
+						...(options.validateRecipient
+							? { validateRecipient: options.validateRecipient }
+							: { expectedRecipient: options.recipient }),
+						...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
+					} as VerifyOptions;
+
+					// Verify the signature using near-sign-verify to extract publicKey
+					const result: VerificationResult = await verify(authToken, verifyOptions);
+
+					// Now retrieve the nonce using accountId, network, AND publicKey
+					const verification = await ctx.context.internalAdapter.findVerificationValue(
+						`siwn:${accountId}:${network}:${result.publicKey}`,
+					);
+
+					if (!verification || new Date() > verification.expiresAt) {
+						throw new APIError("UNAUTHORIZED", {
+							message: "Unauthorized: Invalid or expired nonce",
+							status: 401,
+						});
+					}
 
 						if (result.accountId !== accountId) {
 							throw new APIError("UNAUTHORIZED", {
@@ -370,30 +371,31 @@ export const siwn = (options: SIWNPluginOptions) =>
 					method: "POST",
 					body: NonceRequest,
 				},
-				async (ctx) => {
-					const { accountId, publicKey, networkId } = ctx.body;
-					const network = getNetworkFromAccountId(accountId);
-
-					if (networkId !== network) {
-						throw new APIError("BAD_REQUEST", {
-							message: "Network ID mismatch with account ID",
-							status: 400,
-						});
-					}
+			async (ctx) => {
+				const { accountId, networkId, publicKey } = ctx.body;
+				const network = getNetworkFromAccountId(accountId);
+
+				if (networkId !== network) {
+					throw new APIError("BAD_REQUEST", {
+						message: "Network ID mismatch with account ID",
+						status: 400,
+					});
+				}
 
-					const nonce = options.getNonce ? await options.getNonce() : generateNonce();
+				const nonce = options.getNonce ? await options.getNonce() : generateNonce();
 
-					// Store nonce as base64 string for database compatibility
-					const nonceString = bytesToBase64(nonce);
+				// Store nonce as base64 string for database compatibility
+				const nonceString = bytesToBase64(nonce);
 
-					await ctx.context.internalAdapter.createVerificationValue({
-						identifier: `siwn:${accountId}:${network}`,
-						value: nonceString!,
-						expiresAt: new Date(Date.now() + 15 * 60 * 1000),
-					});
+				// Store nonce with accountId, network, and publicKey for unique identification
+				await ctx.context.internalAdapter.createVerificationValue({
+					identifier: `siwn:${accountId}:${network}:${publicKey}`,
+					value: nonceString!,
+					expiresAt: new Date(Date.now() + 15 * 60 * 1000),
+				});
 
-					return ctx.json(NonceResponse.parse({ nonce: nonceString }));
-				},
+				return ctx.json(NonceResponse.parse({ nonce: nonceString }));
+			},
 			),
 			getSiwnProfile: createAuthEndpoint(
 				"/near/profile",
@@ -463,35 +465,36 @@ export const siwn = (options: SIWNPluginOptions) =>
 						});
 					}
 
-					try {
-						const verification =
-							await ctx.context.internalAdapter.findVerificationValue(
-								`siwn:${accountId}:${network}`,
-							);
-
-						if (!verification || new Date() > verification.expiresAt) {
-							throw new APIError("UNAUTHORIZED", {
-								message: "Unauthorized: Invalid or expired nonce",
-								status: 401,
-								code: "UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE",
-							});
-						}
+				try {
+					// First, verify the signature to get the publicKey
+					const requireFullAccessKey = options.requireFullAccessKey ?? true;
+					const verifyOptions: VerifyOptions = {
+						requireFullAccessKey: requireFullAccessKey,
+						...(options.validateNonce
+							? { validateNonce: options.validateNonce }
+							: { nonceMaxAge: 15 * 60 * 1000 }),
+						...(options.validateRecipient
+							? { validateRecipient: options.validateRecipient }
+							: { expectedRecipient: options.recipient }),
+						...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
+					} as VerifyOptions;
+
+					// Verify the signature using near-sign-verify to extract publicKey
+					const result: VerificationResult = await verify(authToken, verifyOptions);
+
+					// Now retrieve the nonce using accountId, network, AND publicKey
+					const verification =
+						await ctx.context.internalAdapter.findVerificationValue(
+							`siwn:${accountId}:${network}:${result.publicKey}`,
+						);
 
-						// Build verify options using plugin configuration
-						const requireFullAccessKey = options.requireFullAccessKey ?? true;
-						const verifyOptions: VerifyOptions = {
-							requireFullAccessKey: requireFullAccessKey,
-							...(options.validateNonce
-								? { validateNonce: options.validateNonce }
-								: { nonceMaxAge: 15 * 60 * 1000 }),
-							...(options.validateRecipient
-								? { validateRecipient: options.validateRecipient }
-								: { expectedRecipient: options.recipient }),
-							...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
-						} as VerifyOptions;
-
-						// Verify the signature using near-sign-verify
-						const result: VerificationResult = await verify(authToken, verifyOptions);
+					if (!verification || new Date() > verification.expiresAt) {
+						throw new APIError("UNAUTHORIZED", {
+							message: "Unauthorized: Invalid or expired nonce",
+							status: 401,
+							code: "UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE",
+						});
+					}
 
 						if (result.accountId !== accountId) {
 							throw new APIError("UNAUTHORIZED", {