better-near-auth 0.3.2 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-near-auth",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Sign in with NEAR (SIWN) plugin for Better Auth",
   "main": "src/index.ts",
   "module": "src/index.ts",
@@ -20,9 +20,13 @@
     "test": "vitest",
     "test:watch": "vitest --watch",
     "lint": "tsc --noEmit",
-    "dev": "bun run src/index.ts",
+    "start:b2s": "cd examples/browser-2-server && bun run dev",
     "typecheck": "tsc --noEmit"
   },
+  "workspaces": [
+    "examples/browser-2-server",
+    "examples/browser-2-server/apps/*"
+  ],
   "keywords": [
     "better-auth",
     "near",
@@ -43,21 +47,29 @@
     "url": "https://github.com/elliotBraem/better-near-auth/issues"
   },
   "homepage": "https://github.com/elliotBraem/better-near-auth#readme",
+  "catalog": {
+    "better-auth": "^1.4.4",
+    "typescript": "^5.9.3",
+    "zod": "^4.1.12",
+    "@types/node": "^22.17.2",
+    "@orpc/server": "^1.13.2",
+    "@orpc/client": "^1.13.2"
+  },
   "peerDependencies": {
-    "better-auth": "^1.0.0",
-    "typescript": "^5.7.0"
+    "better-auth": "^1.4.4",
+    "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@hot-labs/near-connect": "^latest",
-    "nanostores": "^1.0.1",
-    "near-kit": "^latest",
+    "@hot-labs/near-connect": "^0.8.1",
+    "nanostores": "^1.1.0",
+    "near-kit": "^0.7.0",
     "near-sign-verify": "^0.4.5",
-    "zod": "^4.1.12"
+    "zod": "^4.2.1"
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "@types/node": "^24.9.2",
-    "better-auth": "^1.4.4",
+    "@types/node": "^22.19.3",
+    "better-auth": "^1.4.9",
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"
   },

package/src/index.ts

@@ -126,33 +126,34 @@ export const siwn = (options: SIWNPluginOptions) =>
 						});
 					}
 
-					try {
-						const verification = await ctx.context.internalAdapter.findVerificationValue(
-							`siwn:${accountId}:${network}`,
-						);
-
-						if (!verification || new Date() > verification.expiresAt) {
-							throw new APIError("UNAUTHORIZED", {
-								message: "Unauthorized: Invalid or expired nonce",
-								status: 401,
-							});
-						}
-
-						// Build verify options using plugin configuration
-						const requireFullAccessKey = options.requireFullAccessKey ?? true;
-						const verifyOptions: VerifyOptions = {
-							requireFullAccessKey: requireFullAccessKey,
-							...(options.validateNonce
-								? { validateNonce: options.validateNonce }
-								: { nonceMaxAge: 15 * 60 * 1000 }),
-							...(options.validateRecipient
-								? { validateRecipient: options.validateRecipient }
-								: { expectedRecipient: options.recipient }),
-							...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
-						} as VerifyOptions;
-
-						// Verify the signature using near-sign-verify
-						const result: VerificationResult = await verify(authToken, verifyOptions);
+				try {
+					// First, verify the signature to get the publicKey
+					const requireFullAccessKey = options.requireFullAccessKey ?? true;
+					const verifyOptions: VerifyOptions = {
+						requireFullAccessKey: requireFullAccessKey,
+						...(options.validateNonce
+							? { validateNonce: options.validateNonce }
+							: { nonceMaxAge: 15 * 60 * 1000 }),
+						...(options.validateRecipient
+							? { validateRecipient: options.validateRecipient }
+							: { expectedRecipient: options.recipient }),
+						...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
+					} as VerifyOptions;
+
+					// Verify the signature using near-sign-verify to extract publicKey
+					const result: VerificationResult = await verify(authToken, verifyOptions);
+
+					// Now retrieve the nonce using accountId, network, AND publicKey
+					const verification = await ctx.context.internalAdapter.findVerificationValue(
+						`siwn:${accountId}:${network}:${result.publicKey}`,
+					);
+
+					if (!verification || new Date() > verification.expiresAt) {
+						throw new APIError("UNAUTHORIZED", {
+							message: "Unauthorized: Invalid or expired nonce",
+							status: 401,
+						});
+					}
 
 						if (result.accountId !== accountId) {
 							throw new APIError("UNAUTHORIZED", {
@@ -370,30 +371,31 @@ export const siwn = (options: SIWNPluginOptions) =>
 					method: "POST",
 					body: NonceRequest,
 				},
-				async (ctx) => {
-					const { accountId, networkId } = ctx.body;
-					const network = getNetworkFromAccountId(accountId);
-
-					if (networkId !== network) {
-						throw new APIError("BAD_REQUEST", {
-							message: "Network ID mismatch with account ID",
-							status: 400,
-						});
-					}
+			async (ctx) => {
+				const { accountId, networkId, publicKey } = ctx.body;
+				const network = getNetworkFromAccountId(accountId);
+
+				if (networkId !== network) {
+					throw new APIError("BAD_REQUEST", {
+						message: "Network ID mismatch with account ID",
+						status: 400,
+					});
+				}
 
-					const nonce = options.getNonce ? await options.getNonce() : generateNonce();
+				const nonce = options.getNonce ? await options.getNonce() : generateNonce();
 
-					// Store nonce as base64 string for database compatibility
-					const nonceString = bytesToBase64(nonce);
+				// Store nonce as base64 string for database compatibility
+				const nonceString = bytesToBase64(nonce);
 
-					await ctx.context.internalAdapter.createVerificationValue({
-						identifier: `siwn:${accountId}:${network}`,
-						value: nonceString!,
-						expiresAt: new Date(Date.now() + 15 * 60 * 1000),
-					});
+				// Store nonce with accountId, network, and publicKey for unique identification
+				await ctx.context.internalAdapter.createVerificationValue({
+					identifier: `siwn:${accountId}:${network}:${publicKey}`,
+					value: nonceString!,
+					expiresAt: new Date(Date.now() + 15 * 60 * 1000),
+				});
 
-					return ctx.json(NonceResponse.parse({ nonce: nonceString }));
-				},
+				return ctx.json(NonceResponse.parse({ nonce: nonceString }));
+			},
 			),
 			getSiwnProfile: createAuthEndpoint(
 				"/near/profile",
@@ -463,35 +465,36 @@ export const siwn = (options: SIWNPluginOptions) =>
 						});
 					}
 
-					try {
-						const verification =
-							await ctx.context.internalAdapter.findVerificationValue(
-								`siwn:${accountId}:${network}`,
-							);
-
-						if (!verification || new Date() > verification.expiresAt) {
-							throw new APIError("UNAUTHORIZED", {
-								message: "Unauthorized: Invalid or expired nonce",
-								status: 401,
-								code: "UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE",
-							});
-						}
+				try {
+					// First, verify the signature to get the publicKey
+					const requireFullAccessKey = options.requireFullAccessKey ?? true;
+					const verifyOptions: VerifyOptions = {
+						requireFullAccessKey: requireFullAccessKey,
+						...(options.validateNonce
+							? { validateNonce: options.validateNonce }
+							: { nonceMaxAge: 15 * 60 * 1000 }),
+						...(options.validateRecipient
+							? { validateRecipient: options.validateRecipient }
+							: { expectedRecipient: options.recipient }),
+						...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
+					} as VerifyOptions;
+
+					// Verify the signature using near-sign-verify to extract publicKey
+					const result: VerificationResult = await verify(authToken, verifyOptions);
+
+					// Now retrieve the nonce using accountId, network, AND publicKey
+					const verification =
+						await ctx.context.internalAdapter.findVerificationValue(
+							`siwn:${accountId}:${network}:${result.publicKey}`,
+						);
 
-						// Build verify options using plugin configuration
-						const requireFullAccessKey = options.requireFullAccessKey ?? true;
-						const verifyOptions: VerifyOptions = {
-							requireFullAccessKey: requireFullAccessKey,
-							...(options.validateNonce
-								? { validateNonce: options.validateNonce }
-								: { nonceMaxAge: 15 * 60 * 1000 }),
-							...(options.validateRecipient
-								? { validateRecipient: options.validateRecipient }
-								: { expectedRecipient: options.recipient }),
-							...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
-						} as VerifyOptions;
-
-						// Verify the signature using near-sign-verify
-						const result: VerificationResult = await verify(authToken, verifyOptions);
+					if (!verification || new Date() > verification.expiresAt) {
+						throw new APIError("UNAUTHORIZED", {
+							message: "Unauthorized: Invalid or expired nonce",
+							status: 401,
+							code: "UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE",
+						});
+					}
 
 						if (result.accountId !== accountId) {
 							throw new APIError("UNAUTHORIZED", {