create-croissant 0.1.0 → 0.1.1

package/template/apps/web/node_modules/@better-auth/core/src/social-providers/twitter.ts

@@ -0,0 +1,199 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface TwitterProfile {
+	data: {
+		/**
+		 * Unique identifier of this user. This is returned as a string in order to avoid complications with languages and tools
+		 * that cannot handle large integers.
+		 */
+		id: string;
+		/** The friendly name of this user, as shown on their profile. */
+		name: string;
+		/** The email address of this user. */
+		email?: string | undefined;
+		/** The Twitter handle (screen name) of this user. */
+		username: string;
+		/**
+		 * The location specified in the user's profile, if the user provided one.
+		 * As this is a freeform value, it may not indicate a valid location, but it may be fuzzily evaluated when performing searches with location queries.
+		 *
+		 * To return this field, add `user.fields=location` in the authorization request's query parameter.
+		 */
+		location?: string | undefined;
+		/**
+		 * This object and its children fields contain details about text that has a special meaning in the user's description.
+		 *
+		 *To return this field, add `user.fields=entities` in the authorization request's query parameter.
+		 */
+		entities?:
+			| {
+					/** Contains details about the user's profile website. */
+					url: {
+						/** Contains details about the user's profile website. */
+						urls: Array<{
+							/** The start position (zero-based) of the recognized user's profile website. All start indices are inclusive. */
+							start: number;
+							/** The end position (zero-based) of the recognized user's profile website. This end index is exclusive. */
+							end: number;
+							/** The URL in the format entered by the user. */
+							url: string;
+							/** The fully resolved URL. */
+							expanded_url: string;
+							/** The URL as displayed in the user's profile. */
+							display_url: string;
+						}>;
+					};
+					/** Contains details about URLs, Hashtags, Cashtags, or mentions located within a user's description. */
+					description: {
+						hashtags: Array<{
+							start: number;
+							end: number;
+							tag: string;
+						}>;
+					};
+			  }
+			| undefined;
+		/**
+		 * Indicate if this user is a verified Twitter user.
+		 *
+		 * To return this field, add `user.fields=verified` in the authorization request's query parameter.
+		 */
+		verified?: boolean | undefined;
+		/**
+		 * The text of this user's profile description (also known as bio), if the user provided one.
+		 *
+		 * To return this field, add `user.fields=description` in the authorization request's query parameter.
+		 */
+		description?: string | undefined;
+		/**
+		 * The URL specified in the user's profile, if present.
+		 *
+		 * To return this field, add `user.fields=url` in the authorization request's query parameter.
+		 */
+		url?: string | undefined;
+		/** The URL to the profile image for this user, as shown on the user's profile. */
+		profile_image_url?: string | undefined;
+		protected?: boolean | undefined;
+		/**
+		 * Unique identifier of this user's pinned Tweet.
+		 *
+		 *  You can obtain the expanded object in `includes.tweets` by adding `expansions=pinned_tweet_id` in the authorization request's query parameter.
+		 */
+		pinned_tweet_id?: string | undefined;
+		created_at?: string | undefined;
+	};
+	includes?:
+		| {
+				tweets?: Array<{
+					id: string;
+					text: string;
+				}>;
+		  }
+		| undefined;
+	[claims: string]: unknown;
+}
+
+export interface TwitterOption extends ProviderOptions<TwitterProfile> {
+	clientId: string;
+}
+
+export const twitter = (options: TwitterOption) => {
+	const tokenEndpoint = "https://api.x.com/2/oauth2/token";
+	return {
+		id: "twitter",
+		name: "Twitter",
+		createAuthorizationURL(data) {
+			const _scopes = options.disableDefaultScope
+				? []
+				: ["users.read", "tweet.read", "offline.access", "users.email"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (data.scopes) _scopes.push(...data.scopes);
+			return createAuthorizationURL({
+				id: "twitter",
+				options,
+				authorizationEndpoint: "https://x.com/i/oauth2/authorize",
+				scopes: _scopes,
+				state: data.state,
+				codeVerifier: data.codeVerifier,
+				redirectURI: data.redirectURI,
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				authentication: "basic",
+				redirectURI,
+				options,
+				tokenEndpoint,
+			});
+		},
+
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						authentication: "basic",
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error: profileError } =
+				await betterFetch<TwitterProfile>(
+					"https://api.x.com/2/users/me?user.fields=profile_image_url",
+					{
+						method: "GET",
+						headers: {
+							Authorization: `Bearer ${token.accessToken}`,
+						},
+					},
+				);
+
+			if (profileError) {
+				return null;
+			}
+
+			const { data: emailData, error: emailError } = await betterFetch<{
+				data: { confirmed_email: string };
+			}>("https://api.x.com/2/users/me?user.fields=confirmed_email", {
+				method: "GET",
+				headers: {
+					Authorization: `Bearer ${token.accessToken}`,
+				},
+			});
+			let emailVerified = false;
+			if (!emailError && emailData?.data?.confirmed_email) {
+				profile.data.email = emailData.data.confirmed_email;
+				emailVerified = true;
+			}
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.data.id,
+					name: profile.data.name,
+					email: profile.data.email || profile.data.username || null,
+					image: profile.data.profile_image_url,
+					emailVerified: emailVerified,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<TwitterProfile>;
+};

package/template/apps/web/node_modules/@better-auth/core/src/social-providers/vercel.ts

@@ -0,0 +1,87 @@
+import { betterFetch } from "@better-fetch/fetch";
+import { BetterAuthError } from "../error";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import { createAuthorizationURL, validateAuthorizationCode } from "../oauth2";
+
+export interface VercelProfile {
+	sub: string;
+	name?: string;
+	preferred_username?: string;
+	email?: string;
+	email_verified?: boolean;
+	picture?: string;
+}
+
+export interface VercelOptions extends ProviderOptions<VercelProfile> {
+	clientId: string;
+}
+
+export const vercel = (options: VercelOptions) => {
+	return {
+		id: "vercel",
+		name: "Vercel",
+		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			if (!codeVerifier) {
+				throw new BetterAuthError("codeVerifier is required for Vercel");
+			}
+
+			let _scopes: string[] | undefined = undefined;
+			if (options.scope !== undefined || scopes !== undefined) {
+				_scopes = [];
+				if (options.scope) _scopes.push(...options.scope);
+				if (scopes) _scopes.push(...scopes);
+			}
+
+			return createAuthorizationURL({
+				id: "vercel",
+				options,
+				authorizationEndpoint: "https://vercel.com/oauth/authorize",
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint: "https://api.vercel.com/login/oauth/token",
+			});
+		},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+
+			const { data: profile, error } = await betterFetch<VercelProfile>(
+				"https://api.vercel.com/login/oauth/userinfo",
+				{
+					headers: {
+						Authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+
+			if (error || !profile) {
+				return null;
+			}
+
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.sub,
+					name: profile.name ?? profile.preferred_username ?? "",
+					email: profile.email,
+					image: profile.picture,
+					emailVerified: profile.email_verified ?? false,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<VercelProfile>;
+};

package/template/apps/web/node_modules/@better-auth/core/src/social-providers/vk.ts

@@ -0,0 +1,125 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface VkProfile {
+	user: {
+		user_id: string;
+		first_name: string;
+		last_name: string;
+		email?: string | undefined;
+		phone?: number | undefined;
+		avatar?: string | undefined;
+		sex?: number | undefined;
+		verified?: boolean | undefined;
+		birthday: string;
+	};
+}
+
+export interface VkOption extends ProviderOptions {
+	clientId: string;
+	scheme?: ("light" | "dark") | undefined;
+}
+
+export const vk = (options: VkOption) => {
+	const tokenEndpoint = "https://id.vk.com/oauth2/auth";
+	return {
+		id: "vk",
+		name: "VK",
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["email", "phone"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			const authorizationEndpoint = "https://id.vk.com/authorize";
+
+			return createAuthorizationURL({
+				id: "vk",
+				options,
+				authorizationEndpoint,
+				scopes: _scopes,
+				state,
+				redirectURI,
+				codeVerifier,
+			});
+		},
+		validateAuthorizationCode: async ({
+			code,
+			codeVerifier,
+			redirectURI,
+			deviceId,
+		}) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI: options.redirectURI || redirectURI,
+				options,
+				deviceId,
+				tokenEndpoint,
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint,
+					});
+				},
+		async getUserInfo(data) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(data);
+			}
+			if (!data.accessToken) {
+				return null;
+			}
+			const formBody = new URLSearchParams({
+				access_token: data.accessToken,
+				client_id: options.clientId,
+			}).toString();
+			const { data: profile, error } = await betterFetch<VkProfile>(
+				"https://id.vk.com/oauth2/user_info",
+				{
+					method: "POST",
+					headers: {
+						"Content-Type": "application/x-www-form-urlencoded",
+					},
+					body: formBody,
+				},
+			);
+			if (error) {
+				return null;
+			}
+
+			const userMap = await options.mapProfileToUser?.(profile);
+			if (!profile.user.email && !userMap?.email) {
+				return null;
+			}
+
+			return {
+				user: {
+					id: profile.user.user_id,
+					first_name: profile.user.first_name,
+					last_name: profile.user.last_name,
+					email: profile.user.email,
+					image: profile.user.avatar,
+					emailVerified: false,
+					birthday: profile.user.birthday,
+					sex: profile.user.sex,
+					name: `${profile.user.first_name} ${profile.user.last_name}`,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<VkProfile>;
+};

package/template/apps/web/node_modules/@better-auth/core/src/social-providers/wechat.ts

@@ -0,0 +1,213 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuth2Tokens, OAuthProvider, ProviderOptions } from "../oauth2";
+
+/**
+ * WeChat user profile information
+ * @see https://developers.weixin.qq.com/doc/oplatform/en/Website_App/WeChat_Login/Wechat_Login.html
+ */
+export interface WeChatProfile extends Record<string, any> {
+	/**
+	 * User's unique OpenID
+	 */
+	openid: string;
+	/**
+	 * User's nickname
+	 */
+	nickname: string;
+	/**
+	 * User's avatar image URL
+	 */
+	headimgurl: string;
+	/**
+	 * User's privileges
+	 */
+	privilege: string[];
+	/**
+	 * User's UnionID (unique across the developer's various applications)
+	 */
+	unionid?: string;
+	/** @note Email is currently unsupported by WeChat */
+	email?: string;
+}
+
+export interface WeChatOptions extends ProviderOptions<WeChatProfile> {
+	/**
+	 * WeChat App ID
+	 */
+	clientId: string;
+	/**
+	 * WeChat App Secret
+	 */
+	clientSecret: string;
+	/**
+	 * Platform type for WeChat login
+	 * - Currently only supports "WebsiteApp" for WeChat Website Application (网站应用)
+	 * @default "WebsiteApp"
+	 */
+	platformType?: "WebsiteApp";
+
+	/**
+	 * UI language for the WeChat login page
+	 * cn for Simplified Chinese, en for English
+	 * @default "cn" if left undefined
+	 */
+	lang?: "cn" | "en";
+}
+
+export const wechat = (options: WeChatOptions) => {
+	return {
+		id: "wechat",
+		name: "WeChat",
+		createAuthorizationURL({ state, scopes, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["snsapi_login"];
+			options.scope && _scopes.push(...options.scope);
+			scopes && _scopes.push(...scopes);
+
+			// WeChat uses non-standard OAuth2 parameters (appid instead of client_id)
+			// and requires a fragment (#wechat_redirect), so we construct the URL manually.
+			const url = new URL("https://open.weixin.qq.com/connect/qrconnect");
+			url.searchParams.set("scope", _scopes.join(","));
+			url.searchParams.set("response_type", "code");
+			url.searchParams.set("appid", options.clientId);
+			url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+			url.searchParams.set("state", state);
+			url.searchParams.set("lang", options.lang || "cn");
+			url.hash = "wechat_redirect";
+
+			return url;
+		},
+
+		// WeChat uses non-standard token exchange (appid/secret instead of
+		// client_id/client_secret, GET instead of POST), so shared helpers
+		// like validateAuthorizationCode/getOAuth2Tokens cannot be used directly.
+		validateAuthorizationCode: async ({ code }) => {
+			const params = new URLSearchParams({
+				appid: options.clientId,
+				secret: options.clientSecret,
+				code: code,
+				grant_type: "authorization_code",
+			});
+
+			const { data: tokenData, error } = await betterFetch<{
+				access_token: string;
+				expires_in: number;
+				refresh_token: string;
+				openid: string;
+				scope: string;
+				unionid?: string;
+				errcode?: number;
+				errmsg?: string;
+			}>(
+				"https://api.weixin.qq.com/sns/oauth2/access_token?" +
+					params.toString(),
+				{
+					method: "GET",
+				},
+			);
+
+			if (error || !tokenData || tokenData.errcode) {
+				throw new Error(
+					`Failed to validate authorization code: ${tokenData?.errmsg || error?.message || "Unknown error"}`,
+				);
+			}
+
+			return {
+				tokenType: "Bearer" as const,
+				accessToken: tokenData.access_token,
+				refreshToken: tokenData.refresh_token,
+				accessTokenExpiresAt: new Date(
+					Date.now() + tokenData.expires_in * 1000,
+				),
+				scopes: tokenData.scope.split(","),
+				// WeChat requires openid for the userinfo endpoint, which is
+				// returned alongside the access token.
+				openid: tokenData.openid,
+				unionid: tokenData.unionid,
+			};
+		},
+
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					const params = new URLSearchParams({
+						appid: options.clientId,
+						grant_type: "refresh_token",
+						refresh_token: refreshToken,
+					});
+
+					const { data: tokenData, error } = await betterFetch<{
+						access_token: string;
+						expires_in: number;
+						refresh_token: string;
+						openid: string;
+						scope: string;
+						errcode?: number;
+						errmsg?: string;
+					}>(
+						"https://api.weixin.qq.com/sns/oauth2/refresh_token?" +
+							params.toString(),
+						{
+							method: "GET",
+						},
+					);
+
+					if (error || !tokenData || tokenData.errcode) {
+						throw new Error(
+							`Failed to refresh access token: ${tokenData?.errmsg || error?.message || "Unknown error"}`,
+						);
+					}
+
+					return {
+						tokenType: "Bearer" as const,
+						accessToken: tokenData.access_token,
+						refreshToken: tokenData.refresh_token,
+						accessTokenExpiresAt: new Date(
+							Date.now() + tokenData.expires_in * 1000,
+						),
+						scopes: tokenData.scope.split(","),
+					};
+				},
+
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+
+			const openid = (token as OAuth2Tokens & { openid?: string }).openid;
+
+			if (!openid) {
+				return null;
+			}
+
+			const params = new URLSearchParams({
+				access_token: token.accessToken || "",
+				openid: openid,
+				lang: "zh_CN",
+			});
+
+			const { data: profile, error } = await betterFetch<
+				WeChatProfile & { errcode?: number; errmsg?: string }
+			>("https://api.weixin.qq.com/sns/userinfo?" + params.toString(), {
+				method: "GET",
+			});
+
+			if (error || !profile || profile.errcode) {
+				return null;
+			}
+
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.unionid || profile.openid || openid,
+					name: profile.nickname,
+					email: profile.email || null,
+					image: profile.headimgurl,
+					emailVerified: false,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<WeChatProfile, WeChatOptions>;
+};