tauri-plugin-better-auth 0.0.0-stage → 0.2.0-alpha.0

package/dist/proxy.d.ts

@@ -0,0 +1,124 @@
+import { i as CallbackTarget, t as tauri } from "./index-DfaAtWTX.js";
+import { BetterFetch, BetterFetchOption } from "@better-fetch/fetch";
+//#region src/proxy.d.ts
+/** Options of {@link tauriProxyClient}. */
+export interface TauriProxyClientOptions {
+  /** Custom URI scheme the app registers, e.g. `"com.example.app"`. */
+  scheme: string;
+  /**
+   * Must match the server plugin and the Rust plugin.
+   *
+   * @default "tauri"
+   */
+  clientID?: string | undefined;
+  /**
+   * Path of the app callback, `<scheme>://auth/callback`.
+   *
+   * @default "/auth/callback"
+   */
+  callbackPath?: string | undefined;
+  /**
+   * Social providers the page may start automatically when the app asks for
+   * one (`requestAuth({ provider })`). Other values are ignored.
+   */
+  providers?: string[] | undefined;
+  /**
+   * Seconds a captured request survives in `sessionStorage`, covering OAuth
+   * round trips in the same tab.
+   *
+   * @default 600
+   */
+  requestTTL?: number | undefined;
+}
+/** A desktop sign-in request captured from the hand-off URL. */
+export interface TauriAuthRequest {
+  clientId: string;
+  state: string;
+  codeChallenge: string;
+  /** Loopback redirect chosen by the app, or `null` for the custom scheme. */
+  redirectUri: string | null;
+  /** Allowed social provider the app asked for, or `null`. */
+  provider: string | null;
+  /** Wire protocol version requested by the app. */
+  version: number;
+  /** Epoch milliseconds when the request was captured. */
+  capturedAt: number;
+}
+/** Why a hand-off URL was rejected. */
+export type TauriRequestProblem = 'client_id' | 'state' | 'code_challenge' | 'redirect_uri' | 'version' | 'expired';
+/** Result of {@link TauriProxyActions.getRequest}. */
+export type TauriRequestResult = {
+  status: 'ok';
+  request: TauriAuthRequest;
+} | {
+  status: 'none';
+} | {
+  status: 'invalid';
+  problem: TauriRequestProblem;
+};
+/** Result of {@link TauriProxyActions.handoff}. */
+export type TauriHandoffResult = {
+  data: {
+    code: string;
+    redirectTo: string;
+  };
+  error: null;
+} | {
+  data: null;
+  error: {
+    status: number;
+    code?: string | undefined;
+    message: string;
+  };
+};
+/** Actions added under `authClient.tauri`. */
+export interface TauriProxyActions {
+  /**
+   * Reads the desktop sign-in request from the current URL (and stores it in
+   * `sessionStorage`, then removes it from the address bar), or from storage
+   * on later page loads in the same tab.
+   */
+  getRequest(): TauriRequestResult;
+  /**
+   * After the user has signed in **and consented**, mints a single-use code
+   * for the app and returns the URL that hands it back. Call it from a click
+   * handler, then pass `redirectTo` to {@link openApp}.
+   */
+  handoff(fetchOptions?: BetterFetchOption | undefined): Promise<TauriHandoffResult>;
+  /**
+   * The URL that tells the app the user cancelled (`error=access_denied`),
+   * or `null` when there is no request. Clears the request.
+   */
+  cancelLink(): string | null;
+  /** Navigates to a URL returned by {@link handoff} or {@link cancelLink}. */
+  openApp(url: string): void;
+  /** Forgets the stored request. */
+  clear(): void;
+}
+/**
+ * Better Auth client plugin for the web page that hands a sign-in to a Tauri
+ * app. Add it to the auth client used by that page.
+ *
+ * @example
+ * ```ts
+ * const authClient = createAuthClient({
+ *   plugins: [tauriProxyClient({ scheme: 'com.example.app', clientID: 'com.example.app' })],
+ * });
+ * const result = authClient.tauri.getRequest();
+ * // …after sign-in and the user's click on "Continue":
+ * const { data } = await authClient.tauri.handoff();
+ * if (data) authClient.tauri.openApp(data.redirectTo);
+ * ```
+ */
+export declare const tauriProxyClient: (options: TauriProxyClientOptions) => {
+  id: "tauri-proxy";
+  $InferServerPlugin: ReturnType<typeof tauri>;
+  pathMethods: {
+    '/tauri/authorize': "POST";
+  };
+  getActions: ($fetch: BetterFetch) => {
+    tauri: TauriProxyActions;
+  };
+};
+//#endregion
+export type { CallbackTarget };

package/dist/proxy.js

@@ -0,0 +1,217 @@
+import { _ as normalizeCallbackPath, f as assertClientId, h as isLoopbackRedirectUri, l as PROVIDER_PATTERN, m as buildCallbackUrl, n as CODE_CHALLENGE_PATTERN, p as assertScheme, t as CLIENT_ID_PATTERN, u as STATE_PATTERN } from "./protocol-Fcr7NzIh.js";
+//#region src/proxy.ts
+const QUERY_KEYS = [
+	"client_id",
+	"state",
+	"code_challenge",
+	"code_challenge_method",
+	"redirect_uri",
+	"provider",
+	"v"
+];
+function resolve(options) {
+	const clientID = assertClientId(options.clientID ?? "tauri");
+	return {
+		scheme: assertScheme(options.scheme),
+		clientID,
+		callbackPath: normalizeCallbackPath(options.callbackPath ?? "/auth/callback"),
+		providers: new Set(options.providers ?? []),
+		requestTTL: options.requestTTL ?? 600,
+		storageKey: `tauri-plugin-better-auth:request:${clientID}`
+	};
+}
+/** Parses the hand-off query string. Pure: safe to call anywhere. */
+function parseRequest(search, opts, now) {
+	const params = new URLSearchParams(search);
+	if (!params.has("client_id")) return { status: "none" };
+	const clientId = params.get("client_id") ?? "";
+	if (!CLIENT_ID_PATTERN.test(clientId) || clientId !== opts.clientID) return {
+		status: "invalid",
+		problem: "client_id"
+	};
+	const version = Number(params.get("v") ?? 1);
+	if (version !== 1) return {
+		status: "invalid",
+		problem: "version"
+	};
+	const state = params.get("state") ?? "";
+	if (!STATE_PATTERN.test(state)) return {
+		status: "invalid",
+		problem: "state"
+	};
+	const codeChallenge = params.get("code_challenge") ?? "";
+	const method = params.get("code_challenge_method");
+	if (!CODE_CHALLENGE_PATTERN.test(codeChallenge) || method !== null && method !== "S256") return {
+		status: "invalid",
+		problem: "code_challenge"
+	};
+	const redirectUri = params.get("redirect_uri");
+	if (redirectUri !== null && !isLoopbackRedirectUri(redirectUri, opts.callbackPath)) return {
+		status: "invalid",
+		problem: "redirect_uri"
+	};
+	const rawProvider = params.get("provider");
+	return {
+		status: "ok",
+		request: {
+			clientId,
+			state,
+			codeChallenge,
+			redirectUri,
+			provider: rawProvider !== null && PROVIDER_PATTERN.test(rawProvider) && opts.providers.has(rawProvider) ? rawProvider : null,
+			version,
+			capturedAt: now
+		}
+	};
+}
+function storage() {
+	try {
+		return typeof window === "undefined" ? null : window.sessionStorage;
+	} catch {
+		return null;
+	}
+}
+function readStored(opts, now) {
+	const raw = storage()?.getItem(opts.storageKey);
+	if (!raw) return { status: "none" };
+	let request;
+	try {
+		request = JSON.parse(raw);
+	} catch {
+		storage()?.removeItem(opts.storageKey);
+		return { status: "none" };
+	}
+	if (now - request.capturedAt > opts.requestTTL * 1e3) {
+		storage()?.removeItem(opts.storageKey);
+		return {
+			status: "invalid",
+			problem: "expired"
+		};
+	}
+	const parsed = parseRequest(new URLSearchParams({
+		client_id: request.clientId,
+		state: request.state,
+		code_challenge: request.codeChallenge,
+		v: String(request.version),
+		...request.redirectUri ? { redirect_uri: request.redirectUri } : {},
+		...request.provider ? { provider: request.provider } : {}
+	}).toString(), opts, request.capturedAt);
+	if (parsed.status !== "ok") storage()?.removeItem(opts.storageKey);
+	return parsed;
+}
+function stripQuery() {
+	if (typeof window === "undefined") return;
+	const url = new URL(window.location.href);
+	for (const key of QUERY_KEYS) url.searchParams.delete(key);
+	window.history.replaceState(window.history.state, "", url.toString());
+}
+function callbackTarget(request, opts) {
+	return request.redirectUri ? {
+		kind: "loopback",
+		redirectUri: request.redirectUri
+	} : {
+		kind: "scheme",
+		scheme: opts.scheme,
+		callbackPath: opts.callbackPath
+	};
+}
+/**
+* Better Auth client plugin for the web page that hands a sign-in to a Tauri
+* app. Add it to the auth client used by that page.
+*
+* @example
+* ```ts
+* const authClient = createAuthClient({
+*   plugins: [tauriProxyClient({ scheme: 'com.example.app', clientID: 'com.example.app' })],
+* });
+* const result = authClient.tauri.getRequest();
+* // …after sign-in and the user's click on "Continue":
+* const { data } = await authClient.tauri.handoff();
+* if (data) authClient.tauri.openApp(data.redirectTo);
+* ```
+*/
+const tauriProxyClient = (options) => {
+	const opts = resolve(options);
+	return {
+		id: "tauri-proxy",
+		$InferServerPlugin: {},
+		pathMethods: { "/tauri/authorize": "POST" },
+		getActions: ($fetch) => {
+			const getRequest = () => {
+				if (typeof window === "undefined") return { status: "none" };
+				const now = Date.now();
+				const fromUrl = parseRequest(window.location.search, opts, now);
+				if (fromUrl.status === "none") return readStored(opts, now);
+				if (fromUrl.status === "ok") storage()?.setItem(opts.storageKey, JSON.stringify(fromUrl.request));
+				stripQuery();
+				return fromUrl;
+			};
+			return { tauri: {
+				getRequest,
+				async handoff(fetchOptions) {
+					const current = getRequest();
+					if (current.status !== "ok") return {
+						data: null,
+						error: {
+							status: 400,
+							code: "NO_DESKTOP_REQUEST",
+							message: current.status === "invalid" ? `The desktop sign-in request is invalid (${current.problem}). Start again from the app.` : "There is no desktop sign-in request. Start again from the app."
+						}
+					};
+					const { request } = current;
+					const res = await $fetch("/tauri/authorize", {
+						...fetchOptions,
+						method: "POST",
+						body: {
+							client_id: request.clientId,
+							state: request.state,
+							code_challenge: request.codeChallenge,
+							code_challenge_method: "S256"
+						}
+					});
+					if (res.error || !res.data) {
+						const error = res.error;
+						return {
+							data: null,
+							error: {
+								status: error?.status ?? 500,
+								code: error?.code,
+								message: error?.message ?? "Authorization failed"
+							}
+						};
+					}
+					storage()?.removeItem(opts.storageKey);
+					return {
+						data: {
+							code: res.data.code,
+							redirectTo: buildCallbackUrl(callbackTarget(request, opts), {
+								code: res.data.code,
+								state: request.state
+							})
+						},
+						error: null
+					};
+				},
+				cancelLink() {
+					const current = getRequest();
+					if (current.status !== "ok") return null;
+					storage()?.removeItem(opts.storageKey);
+					return buildCallbackUrl(callbackTarget(current.request, opts), {
+						error: "access_denied",
+						state: current.request.state
+					});
+				},
+				openApp(url) {
+					if (typeof window === "undefined") return;
+					if (!(url.startsWith(`${opts.scheme}://`) || url.startsWith("http://127.0.0.1:") || url.startsWith("http://[::1]:"))) throw new Error("openApp only navigates to the app callback returned by handoff() or cancelLink().");
+					window.location.href = url;
+				},
+				clear() {
+					storage()?.removeItem(opts.storageKey);
+				}
+			} };
+		}
+	};
+};
+//#endregion
+export { tauriProxyClient };

package/package.json

@@ -1,6 +1,96 @@
 {
   "name": "tauri-plugin-better-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0-alpha.0",
+  "description": "Better Auth for Tauri 3: browser sign-in with PKCE, a Rust-held session and a token-free webview.",
+  "keywords": [
+    "auth",
+    "authentication",
+    "better-auth",
+    "deep-link",
+    "desktop",
+    "pkce",
+    "tauri",
+    "tauri-plugin"
+  ],
+  "homepage": "https://github.com/laakal/tauri-plugin-better-auth#readme",
+  "bugs": {
+    "url": "https://github.com/laakal/tauri-plugin-better-auth/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/laakal/tauri-plugin-better-auth.git",
+    "directory": "packages/tauri-plugin-better-auth"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./proxy": {
+      "types": "./dist/proxy.d.ts",
+      "default": "./dist/proxy.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "default": "./dist/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true,
+    "tag": "next"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "lint:package": "publint --strict && attw --pack . --profile esm-only",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "dependencies": {
+    "zod": "4.6.7"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "0.18.5",
+    "@better-auth/core": "1.7.11",
+    "@better-fetch/fetch": "1.3.2",
+    "@tauri-apps/api": "3.0.0-alpha.3",
+    "@types/node": "24.19.2",
+    "@types/pg": "8.23.1",
+    "better-auth": "1.7.11",
+    "better-call": "1.4.2",
+    "happy-dom": "21.0.3",
+    "pg": "8.23.1",
+    "publint": "0.3.25",
+    "tsdown": "0.23.1",
+    "typescript": "7.0.2",
+    "vitest": "5.0.5"
+  },
+  "peerDependencies": {
+    "@better-auth/core": ">=1.7.4 <2",
+    "@better-fetch/fetch": "^1.3.1",
+    "@tauri-apps/api": ">=3.0.0-alpha.0 <4",
+    "better-auth": ">=1.7.4 <2",
+    "better-call": "^1.4.0"
+  },
+  "peerDependenciesMeta": {
+    "@tauri-apps/api": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=22"
+  }
+}