better-near-auth 0.3.2 → 0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-near-auth",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Sign in with NEAR (SIWN) plugin for Better Auth",
   "main": "src/index.ts",
   "module": "src/index.ts",
@@ -20,9 +20,13 @@
     "test": "vitest",
     "test:watch": "vitest --watch",
     "lint": "tsc --noEmit",
-    "dev": "bun run src/index.ts",
+    "start:b2s": "cd examples/browser-2-server && bun run dev",
     "typecheck": "tsc --noEmit"
   },
+  "workspaces": [
+    "examples/browser-2-server",
+    "examples/browser-2-server/apps/*"
+  ],
   "keywords": [
     "better-auth",
     "near",
@@ -43,23 +47,31 @@
     "url": "https://github.com/elliotBraem/better-near-auth/issues"
   },
   "homepage": "https://github.com/elliotBraem/better-near-auth#readme",
+  "catalog": {
+    "better-auth": "^1.4.4",
+    "typescript": "^5.9.3",
+    "zod": "^4.1.12",
+    "@types/node": "^22.17.2",
+    "@orpc/server": "^1.13.2",
+    "@orpc/client": "^1.13.2"
+  },
   "peerDependencies": {
-    "better-auth": "^1.0.0",
-    "typescript": "^5.7.0"
+    "better-auth": "^1.4.4",
+    "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@hot-labs/near-connect": "^latest",
-    "nanostores": "^1.0.1",
-    "near-kit": "^latest",
+    "@hot-labs/near-connect": "^0.8.2",
+    "nanostores": "^1.1.0",
+    "near-kit": "^0.7.0",
     "near-sign-verify": "^0.4.5",
-    "zod": "^4.1.12"
+    "zod": "^4.3.5"
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "@types/node": "^24.9.2",
-    "better-auth": "^1.4.4",
+    "@types/node": "^25.0.9",
+    "better-auth": "^1.4.13",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "vitest": "^4.0.17"
   },
   "files": [
     "src/",

package/src/client.ts

@@ -1,5 +1,7 @@
 import { NearConnector } from "@hot-labs/near-connect";
-import type { Account, NearWalletBase } from "@hot-labs/near-connect/build/types/wallet";
+import type { NearWalletBase } from "@hot-labs/near-connect";
+
+type Account = Awaited<ReturnType<NearWalletBase["getAccounts"]>>[number];
 import type { BetterAuthClientPlugin, BetterFetch, BetterFetchOption, BetterFetchResponse } from "better-auth/client";
 import { atom } from "nanostores";
 import { Near, fromHotConnect } from "near-kit";
@@ -22,7 +24,7 @@ export interface SIWNClientConfig {
 export interface CachedNonceData {
 	nonce: string;
 	accountId: string;
-	publicKey: string;
+	publicKey?: string | null;
 	networkId: string;
 	timestamp: number;
 }
@@ -92,10 +94,9 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 			const accountId = accounts?.[0]?.accountId;
 			if (!accountId) return;
 
-			// Create Near instance with Hot Connect wallet adapter
 			nearInstance = new Near({
 				network,
-				wallet: fromHotConnect(connector),
+				wallet: fromHotConnect(connector as Parameters<typeof fromHotConnect>[0]),
 			});
 
 			// Update state with account info
@@ -217,10 +218,8 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 								throw error;
 							}
 
-							// Get nonce first
 							const nonceRequest: NonceRequestT = {
 								accountId,
-								publicKey: state.publicKey || "",
 								networkId: (state.networkId || network) as "mainnet" | "testnet"
 							};
 
@@ -330,18 +329,8 @@ export const siwnClient = (config: SIWNClientConfig): SIWNClientPlugin => {
 
 							const { accountId, networkId, publicKey } = state;
 
-							if (!publicKey) {
-								throw new Error("Failed to get public key from wallet");
-							}
-
-							nearState.set({
-								...state,
-								publicKey,
-							});
-
 							const nonceRequest: NonceRequestT = {
 								accountId,
-								publicKey: publicKey,
 								networkId: networkId as "mainnet" | "testnet"
 							};
 

package/src/index.ts

@@ -126,33 +126,32 @@ export const siwn = (options: SIWNPluginOptions) =>
 						});
 					}
 
-					try {
-						const verification = await ctx.context.internalAdapter.findVerificationValue(
-							`siwn:${accountId}:${network}`,
-						);
-
-						if (!verification || new Date() > verification.expiresAt) {
-							throw new APIError("UNAUTHORIZED", {
-								message: "Unauthorized: Invalid or expired nonce",
-								status: 401,
-							});
-						}
-
-						// Build verify options using plugin configuration
-						const requireFullAccessKey = options.requireFullAccessKey ?? true;
-						const verifyOptions: VerifyOptions = {
-							requireFullAccessKey: requireFullAccessKey,
-							...(options.validateNonce
-								? { validateNonce: options.validateNonce }
-								: { nonceMaxAge: 15 * 60 * 1000 }),
-							...(options.validateRecipient
-								? { validateRecipient: options.validateRecipient }
-								: { expectedRecipient: options.recipient }),
-							...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
-						} as VerifyOptions;
-
-						// Verify the signature using near-sign-verify
-						const result: VerificationResult = await verify(authToken, verifyOptions);
+				try {
+					// First, verify the signature to get the publicKey
+					const requireFullAccessKey = options.requireFullAccessKey ?? true;
+					const verifyOptions: VerifyOptions = {
+						requireFullAccessKey: requireFullAccessKey,
+						...(options.validateNonce
+							? { validateNonce: options.validateNonce }
+							: { nonceMaxAge: 15 * 60 * 1000 }),
+						...(options.validateRecipient
+							? { validateRecipient: options.validateRecipient }
+							: { expectedRecipient: options.recipient }),
+						...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
+					} as VerifyOptions;
+
+					const result: VerificationResult = await verify(authToken, verifyOptions);
+
+					const verification = await ctx.context.internalAdapter.findVerificationValue(
+						`siwn:${accountId}:${network}`,
+					);
+
+					if (!verification || new Date() > verification.expiresAt) {
+						throw new APIError("UNAUTHORIZED", {
+							message: "Unauthorized: Invalid or expired nonce",
+							status: 401,
+						});
+					}
 
 						if (result.accountId !== accountId) {
 							throw new APIError("UNAUTHORIZED", {
@@ -370,30 +369,29 @@ export const siwn = (options: SIWNPluginOptions) =>
 					method: "POST",
 					body: NonceRequest,
 				},
-				async (ctx) => {
-					const { accountId, networkId } = ctx.body;
-					const network = getNetworkFromAccountId(accountId);
-
-					if (networkId !== network) {
-						throw new APIError("BAD_REQUEST", {
-							message: "Network ID mismatch with account ID",
-							status: 400,
-						});
-					}
+			async (ctx) => {
+				const { accountId, networkId } = ctx.body;
+				const network = getNetworkFromAccountId(accountId);
+
+				if (networkId !== network) {
+					throw new APIError("BAD_REQUEST", {
+						message: "Network ID mismatch with account ID",
+						status: 400,
+					});
+				}
 
-					const nonce = options.getNonce ? await options.getNonce() : generateNonce();
+				const nonce = options.getNonce ? await options.getNonce() : generateNonce();
 
-					// Store nonce as base64 string for database compatibility
-					const nonceString = bytesToBase64(nonce);
+				const nonceString = bytesToBase64(nonce);
 
-					await ctx.context.internalAdapter.createVerificationValue({
-						identifier: `siwn:${accountId}:${network}`,
-						value: nonceString!,
-						expiresAt: new Date(Date.now() + 15 * 60 * 1000),
-					});
+				await ctx.context.internalAdapter.createVerificationValue({
+					identifier: `siwn:${accountId}:${network}`,
+					value: nonceString!,
+					expiresAt: new Date(Date.now() + 15 * 60 * 1000),
+				});
 
-					return ctx.json(NonceResponse.parse({ nonce: nonceString }));
-				},
+				return ctx.json(NonceResponse.parse({ nonce: nonceString }));
+			},
 			),
 			getSiwnProfile: createAuthEndpoint(
 				"/near/profile",
@@ -463,35 +461,34 @@ export const siwn = (options: SIWNPluginOptions) =>
 						});
 					}
 
-					try {
-						const verification =
-							await ctx.context.internalAdapter.findVerificationValue(
-								`siwn:${accountId}:${network}`,
-							);
-
-						if (!verification || new Date() > verification.expiresAt) {
-							throw new APIError("UNAUTHORIZED", {
-								message: "Unauthorized: Invalid or expired nonce",
-								status: 401,
-								code: "UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE",
-							});
-						}
+				try {
+					// First, verify the signature to get the publicKey
+					const requireFullAccessKey = options.requireFullAccessKey ?? true;
+					const verifyOptions: VerifyOptions = {
+						requireFullAccessKey: requireFullAccessKey,
+						...(options.validateNonce
+							? { validateNonce: options.validateNonce }
+							: { nonceMaxAge: 15 * 60 * 1000 }),
+						...(options.validateRecipient
+							? { validateRecipient: options.validateRecipient }
+							: { expectedRecipient: options.recipient }),
+						...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
+					} as VerifyOptions;
+
+					const result: VerificationResult = await verify(authToken, verifyOptions);
+
+					const verification =
+						await ctx.context.internalAdapter.findVerificationValue(
+							`siwn:${accountId}:${network}`,
+						);
 
-						// Build verify options using plugin configuration
-						const requireFullAccessKey = options.requireFullAccessKey ?? true;
-						const verifyOptions: VerifyOptions = {
-							requireFullAccessKey: requireFullAccessKey,
-							...(options.validateNonce
-								? { validateNonce: options.validateNonce }
-								: { nonceMaxAge: 15 * 60 * 1000 }),
-							...(options.validateRecipient
-								? { validateRecipient: options.validateRecipient }
-								: { expectedRecipient: options.recipient }),
-							...(options.validateMessage ? { validateMessage: options.validateMessage } : {}),
-						} as VerifyOptions;
-
-						// Verify the signature using near-sign-verify
-						const result: VerificationResult = await verify(authToken, verifyOptions);
+					if (!verification || new Date() > verification.expiresAt) {
+						throw new APIError("UNAUTHORIZED", {
+							message: "Unauthorized: Invalid or expired nonce",
+							status: 401,
+							code: "UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE",
+						});
+					}
 
 						if (result.accountId !== accountId) {
 							throw new APIError("UNAUTHORIZED", {

package/src/types.ts

@@ -36,7 +36,7 @@ export type Profile = z.infer<typeof profileSchema>;
 
 export const NonceRequest = z.object({
 	accountId: accountIdSchema,
-	publicKey: z.string(),
+	publicKey: z.string().optional(),
 	networkId: z.union([z.literal("mainnet"), z.literal("testnet")])
 });
 export const VerifyRequest = z.object({