import { env, isTest, isDevelopment, logger, createLogger, isProduction, shouldPublishLog } from "@better-auth/core/env";
import { BetterAuthError, BASE_ERROR_CODES } from "@better-auth/core/error";
import { isValidIP, normalizeIP, deprecate, normalizePathname, createRateLimitKey, safeJSONParse, generateId, filterOutputFields, defineErrorCodes } from "@better-auth/core/utils";
import { defineRequestState, getCurrentAuthContext, getCurrentAdapter, runWithTransaction, hasRequestState, runWithRequestState, runWithEndpointContext, runWithAdapter, getBetterAuthVersion } from "@better-auth/core/context";
import { APIError, toResponse, createRouter } from "better-call";
import { createAuthMiddleware, createAuthEndpoint } from "@better-auth/core/api";
import * as import___better_auth_core_db from "@better-auth/core/db";
import { getAuthTables } from "@better-auth/core/db";
import * as z from "zod";
import { Kysely, SqliteDialect, MysqlDialect, PostgresDialect, MssqlDialect, sql } from "kysely";
import { initGetModelName, initGetFieldName, createAdapterFactory } from "@better-auth/core/db/adapter";
import { hkdf } from "@noble/hashes/hkdf.js";
import { sha256 } from "@noble/hashes/sha2.js";
import { jwtDecrypt, calculateJwkThumbprint, base64url, jwtVerify, EncryptJWT, SignJWT, decodeJwt } from "jose";
import { hex } from "@better-auth/utils/hex";
import { createRandomStringGenerator } from "@better-auth/utils/random";
import "@better-auth/utils";
import { createHash } from "@better-auth/utils/hash";
import { base64Url } from "@better-auth/utils/base64";
import { binary } from "@better-auth/utils/binary";
import { createHMAC } from "@better-auth/utils/hmac";
import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
import { hexToBytes as hexToBytes$1, managedNonce, utf8ToBytes, bytesToHex } from "@noble/ciphers/utils.js";
import { SocialProviderListEnum, socialProviders } from "@better-auth/core/social-providers";
import { JWTExpired } from "jose/errors";
import defu$1, { createDefu, defu } from "defu";
import { scryptAsync } from "@noble/hashes/scrypt.js";
import { hexToBytes } from "@noble/hashes/utils.js";
import { createTelemetry } from "@better-auth/telemetry";
import { count, desc, asc, inArray, notInArray, like, lt, lte, ne, gt, gte, eq, and, or, sql as sql$1 } from "drizzle-orm";
import { b as private_env } from "./shared-server.js";
import "./url.js";
import { getRequestEvent } from "@sveltejs/kit/internal/server";
import "./root.js";
import "./utils.js";
import "@sveltejs/kit";
import "@sveltejs/kit/internal";
import "./query.js";
import { d as db, c as team, t as teamMember } from "./index2.js";
import { betterFetch } from "@better-fetch/fetch";
import { createAuthorizationURL, validateAuthorizationCode, refreshAccessToken } from "@better-auth/core/oauth2";
import "@better-auth/utils/otp";
function checkHasPath(url) {
try {
return (new URL(url).pathname.replace(/\/+$/, "") || "/") !== "/";
} catch {
throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`);
}
}
function assertHasProtocol(url) {
try {
const parsedUrl = new URL(url);
if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new BetterAuthError(`Invalid base URL: ${url}. URL must include 'http://' or 'https://'`);
} catch (error2) {
if (error2 instanceof BetterAuthError) throw error2;
throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`, { cause: error2 });
}
}
function withPath(url, path = "/api/auth") {
assertHasProtocol(url);
if (checkHasPath(url)) return url;
const trimmedUrl = url.replace(/\/+$/, "");
if (!path || path === "/") return trimmedUrl;
path = path.startsWith("/") ? path : `/${path}`;
return `${trimmedUrl}${path}`;
}
function validateProxyHeader(header, type) {
if (!header || header.trim() === "") return false;
if (type === "proto") return header === "http" || header === "https";
if (type === "host") {
if ([
/\.\./,
/\0/,
/[\s]/,
/^[.]/,
/[<>'"]/,
/javascript:/i,
/file:/i,
/data:/i
].some((pattern) => pattern.test(header))) return false;
return /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(header) || /^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(header) || /^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(header) || /^localhost(:[0-9]{1,5})?$/i.test(header);
}
return false;
}
function getBaseURL(url, path, request, loadEnv, trustedProxyHeaders) {
if (url) return withPath(url, path);
{
const fromEnv = env.BETTER_AUTH_URL || env.NEXT_PUBLIC_BETTER_AUTH_URL || env.PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_AUTH_URL || (env.BASE_URL !== "/" ? env.BASE_URL : void 0);
if (fromEnv) return withPath(fromEnv, path);
}
const fromRequest = request?.headers.get("x-forwarded-host");
const fromRequestProto = request?.headers.get("x-forwarded-proto");
if (fromRequest && fromRequestProto && trustedProxyHeaders) {
if (validateProxyHeader(fromRequestProto, "proto") && validateProxyHeader(fromRequest, "host")) try {
return withPath(`${fromRequestProto}://${fromRequest}`, path);
} catch (_error) {
}
}
if (request) {
const url$1 = getOrigin(request.url);
if (!url$1) throw new BetterAuthError("Could not get origin from request. Please provide a valid base URL.");
return withPath(url$1, path);
}
if (typeof window !== "undefined" && window.location) return withPath(window.location.origin, path);
}
function getOrigin(url) {
try {
const parsedUrl = new URL(url);
return parsedUrl.origin === "null" ? null : parsedUrl.origin;
} catch {
return null;
}
}
function getProtocol(url) {
try {
return new URL(url).protocol;
} catch {
return null;
}
}
function getHost(url) {
try {
return new URL(url).host;
} catch {
return null;
}
}
const LOCALHOST_IP = "127.0.0.1";
function getIp(req, options) {
if (options.advanced?.ipAddress?.disableIpTracking) return null;
const headers = "headers" in req ? req.headers : req;
const ipHeaders = options.advanced?.ipAddress?.ipAddressHeaders || ["x-forwarded-for"];
for (const key of ipHeaders) {
const value = "get" in headers ? headers.get(key) : headers[key];
if (typeof value === "string") {
const ip = value.split(",")[0].trim();
if (isValidIP(ip)) return normalizeIP(ip, { ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet });
}
}
if (isTest() || isDevelopment()) return LOCALHOST_IP;
return null;
}
const { get: getOAuthState, set: setOAuthState } = defineRequestState(() => null);
function escapeRegExpChar(char) {
if (char === "-" || char === "^" || char === "$" || char === "+" || char === "." || char === "(" || char === ")" || char === "|" || char === "[" || char === "]" || char === "{" || char === "}" || char === "*" || char === "?" || char === "\\") return `\\${char}`;
else return char;
}
function escapeRegExpString(str) {
let result = "";
for (let i = 0; i < str.length; i++) result += escapeRegExpChar(str[i]);
return result;
}
function transform(pattern, separator = true) {
if (Array.isArray(pattern)) return `(?:${pattern.map((p) => `^${transform(p, separator)}$`).join("|")})`;
let separatorSplitter = "";
let separatorMatcher = "";
let wildcard = ".";
if (separator === true) {
separatorSplitter = "/";
separatorMatcher = "[/\\\\]";
wildcard = "[^/\\\\]";
} else if (separator) {
separatorSplitter = separator;
separatorMatcher = escapeRegExpString(separatorSplitter);
if (separatorMatcher.length > 1) {
separatorMatcher = `(?:${separatorMatcher})`;
wildcard = `((?!${separatorMatcher}).)`;
} else wildcard = `[^${separatorMatcher}]`;
}
const requiredSeparator = separator ? `${separatorMatcher}+?` : "";
const optionalSeparator = separator ? `${separatorMatcher}*?` : "";
const segments = separator ? pattern.split(separatorSplitter) : [pattern];
let result = "";
for (let s = 0; s < segments.length; s++) {
const segment = segments[s];
const nextSegment = segments[s + 1];
let currentSeparator = "";
if (!segment && s > 0) continue;
if (separator) if (s === segments.length - 1) currentSeparator = optionalSeparator;
else if (nextSegment !== "**") currentSeparator = requiredSeparator;
else currentSeparator = "";
if (separator && segment === "**") {
if (currentSeparator) {
result += s === 0 ? "" : currentSeparator;
result += `(?:${wildcard}*?${currentSeparator})*?`;
}
continue;
}
for (let c = 0; c < segment.length; c++) {
const char = segment[c];
if (char === "\\") {
if (c < segment.length - 1) {
result += escapeRegExpChar(segment[c + 1]);
c++;
}
} else if (char === "?") result += wildcard;
else if (char === "*") result += `${wildcard}*?`;
else result += escapeRegExpChar(char);
}
result += currentSeparator;
}
return result;
}
function isMatch(regexp, sample) {
if (typeof sample !== "string") throw new TypeError(`Sample must be a string, but ${typeof sample} given`);
return regexp.test(sample);
}
function wildcardMatch(pattern, options) {
if (typeof pattern !== "string" && !Array.isArray(pattern)) throw new TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof pattern} given`);
if (typeof options === "string" || typeof options === "boolean") options = { separator: options };
if (arguments.length === 2 && !(typeof options === "undefined" || typeof options === "object" && options !== null && !Array.isArray(options))) throw new TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof options} given`);
options = options || {};
if (options.separator === "\\") throw new Error("\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead");
const regexpPattern = transform(pattern, options.separator);
const regexp = new RegExp(`^${regexpPattern}$`, options.flags);
const fn = isMatch.bind(null, regexp);
fn.options = options;
fn.pattern = pattern;
fn.regexp = regexp;
return fn;
}
const matchesOriginPattern = (url, pattern, settings) => {
if (url.startsWith("/")) {
if (settings?.allowRelativePaths) return url.startsWith("/") && /^\/(?!\/|\\|%2f|%5c)[\w\-.\+/@]*(?:\?[\w\-.\+/=&%@]*)?$/.test(url);
return false;
}
if (pattern.includes("*") || pattern.includes("?")) {
if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
const host = getHost(url);
if (!host) return false;
return wildcardMatch(pattern)(host);
}
const protocol = getProtocol(url);
return protocol === "http:" || protocol === "https:" || !protocol ? pattern === getOrigin(url) : url.startsWith(pattern);
};
function shouldSkipCSRFForBackwardCompat(ctx) {
return ctx.context.skipOriginCheck === true && ctx.context.options.advanced?.disableCSRFCheck === void 0;
}
const logBackwardCompatWarning = deprecate(function logBackwardCompatWarning$1() {
}, "disableOriginCheck: true currently also disables CSRF checks. In a future version, disableOriginCheck will ONLY disable URL validation. To keep CSRF disabled, add disableCSRFCheck: true to your config.");
const originCheckMiddleware = createAuthMiddleware(async (ctx) => {
if (ctx.request?.method === "GET" || ctx.request?.method === "OPTIONS" || ctx.request?.method === "HEAD" || !ctx.request) return;
await validateOrigin(ctx);
if (ctx.context.skipOriginCheck) return;
const { body, query } = ctx;
const callbackURL = body?.callbackURL || query?.callbackURL;
const redirectURL = body?.redirectTo;
const errorCallbackURL = body?.errorCallbackURL;
const newUserCallbackURL = body?.newUserCallbackURL;
const validateURL = (url, label) => {
if (!url) return;
if (!ctx.context.isTrustedOrigin(url, { allowRelativePaths: label !== "origin" })) {
ctx.context.logger.error(`Invalid ${label}: ${url}`);
ctx.context.logger.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config
`, `Current list of trustedOrigins: ${ctx.context.trustedOrigins}`);
throw new APIError("FORBIDDEN", { message: `Invalid ${label}` });
}
};
callbackURL && validateURL(callbackURL, "callbackURL");
redirectURL && validateURL(redirectURL, "redirectURL");
errorCallbackURL && validateURL(errorCallbackURL, "errorCallbackURL");
newUserCallbackURL && validateURL(newUserCallbackURL, "newUserCallbackURL");
});
const originCheck = (getValue) => createAuthMiddleware(async (ctx) => {
if (!ctx.request) return;
if (ctx.context.skipOriginCheck) return;
const callbackURL = getValue(ctx);
const validateURL = (url, label) => {
if (!url) return;
if (!ctx.context.isTrustedOrigin(url, { allowRelativePaths: label !== "origin" })) {
ctx.context.logger.error(`Invalid ${label}: ${url}`);
ctx.context.logger.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config
`, `Current list of trustedOrigins: ${ctx.context.trustedOrigins}`);
throw new APIError("FORBIDDEN", { message: `Invalid ${label}` });
}
};
const callbacks = Array.isArray(callbackURL) ? callbackURL : [callbackURL];
for (const url of callbacks) validateURL(url, "callbackURL");
});
async function validateOrigin(ctx, forceValidate = false) {
const headers = ctx.request?.headers;
if (!headers || !ctx.request) return;
const originHeader = headers.get("origin") || headers.get("referer") || "";
const useCookies = headers.has("cookie");
if (ctx.context.skipCSRFCheck) return;
if (shouldSkipCSRFForBackwardCompat(ctx)) {
ctx.context.options.advanced?.disableOriginCheck === true && logBackwardCompatWarning();
return;
}
const skipOriginCheck = ctx.context.skipOriginCheck;
if (Array.isArray(skipOriginCheck)) try {
const basePath = new URL(ctx.context.baseURL).pathname;
const currentPath = normalizePathname(ctx.request.url, basePath);
if (skipOriginCheck.some((skipPath) => currentPath.startsWith(skipPath))) return;
} catch {
}
if (!(forceValidate || useCookies)) return;
if (!originHeader || originHeader === "null") throw new APIError("FORBIDDEN", { message: BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN });
const trustedOrigins = Array.isArray(ctx.context.options.trustedOrigins) ? ctx.context.trustedOrigins : [...ctx.context.trustedOrigins, ...(await ctx.context.options.trustedOrigins?.(ctx.request))?.filter((v) => Boolean(v)) || []];
if (!trustedOrigins.some((origin) => matchesOriginPattern(originHeader, origin))) {
ctx.context.logger.error(`Invalid origin: ${originHeader}`);
ctx.context.logger.info(`If it's a valid URL, please add ${originHeader} to trustedOrigins in your auth config
`, `Current list of trustedOrigins: ${trustedOrigins}`);
throw new APIError("FORBIDDEN", { message: "Invalid origin" });
}
}
const formCsrfMiddleware = createAuthMiddleware(async (ctx) => {
if (!ctx.request) return;
await validateFormCsrf(ctx);
});
async function validateFormCsrf(ctx) {
const req = ctx.request;
if (!req) return;
if (ctx.context.skipCSRFCheck) return;
if (shouldSkipCSRFForBackwardCompat(ctx)) return;
const headers = req.headers;
if (headers.has("cookie")) return await validateOrigin(ctx);
const site = headers.get("Sec-Fetch-Site");
const mode = headers.get("Sec-Fetch-Mode");
const dest = headers.get("Sec-Fetch-Dest");
if (Boolean(site && site.trim() || mode && mode.trim() || dest && dest.trim())) {
if (site === "cross-site" && mode === "navigate") {
ctx.context.logger.error("Blocked cross-site navigation login attempt (CSRF protection)", {
secFetchSite: site,
secFetchMode: mode,
secFetchDest: dest
});
throw new APIError("FORBIDDEN", { message: BASE_ERROR_CODES.CROSS_SITE_NAVIGATION_LOGIN_BLOCKED });
}
return await validateOrigin(ctx, true);
}
}
const memory = /* @__PURE__ */ new Map();
function shouldRateLimit(max, window2, rateLimitData) {
const now2 = Date.now();
const windowInMs = window2 * 1e3;
return now2 - rateLimitData.lastRequest < windowInMs && rateLimitData.count >= max;
}
function rateLimitResponse(retryAfter) {
return new Response(JSON.stringify({ message: "Too many requests. Please try again later." }), {
status: 429,
statusText: "Too Many Requests",
headers: { "X-Retry-After": retryAfter.toString() }
});
}
function getRetryAfter(lastRequest, window2) {
const now2 = Date.now();
const windowInMs = window2 * 1e3;
return Math.ceil((lastRequest + windowInMs - now2) / 1e3);
}
function createDatabaseStorageWrapper(ctx) {
const model = "rateLimit";
const db2 = ctx.adapter;
return {
get: async (key) => {
const data = (await db2.findMany({
model,
where: [{
field: "key",
value: key
}]
}))[0];
if (typeof data?.lastRequest === "bigint") data.lastRequest = Number(data.lastRequest);
return data;
},
set: async (key, value, _update) => {
try {
if (_update) await db2.updateMany({
model,
where: [{
field: "key",
value: key
}],
update: {
count: value.count,
lastRequest: value.lastRequest
}
});
else await db2.create({
model,
data: {
key,
count: value.count,
lastRequest: value.lastRequest
}
});
} catch (e) {
ctx.logger.error("Error setting rate limit", e);
}
}
};
}
function getRateLimitStorage(ctx, rateLimitSettings) {
if (ctx.options.rateLimit?.customStorage) return ctx.options.rateLimit.customStorage;
const storage = ctx.rateLimit.storage;
if (storage === "secondary-storage") return {
get: async (key) => {
const data = await ctx.options.secondaryStorage?.get(key);
return data ? safeJSONParse(data) : null;
},
set: async (key, value, _update) => {
const ttl = rateLimitSettings?.window ?? ctx.options.rateLimit?.window ?? 10;
await ctx.options.secondaryStorage?.set?.(key, JSON.stringify(value), ttl);
}
};
else if (storage === "memory") return {
async get(key) {
const entry = memory.get(key);
if (!entry) return null;
if (Date.now() >= entry.expiresAt) {
memory.delete(key);
return null;
}
return entry.data;
},
async set(key, value, _update) {
const ttl = rateLimitSettings?.window ?? ctx.options.rateLimit?.window ?? 10;
const expiresAt = Date.now() + ttl * 1e3;
memory.set(key, {
data: value,
expiresAt
});
}
};
return createDatabaseStorageWrapper(ctx);
}
async function onRequestRateLimit(req, ctx) {
if (!ctx.rateLimit.enabled) return;
const basePath = new URL(ctx.baseURL).pathname;
const path = normalizePathname(req.url, basePath);
let currentWindow = ctx.rateLimit.window;
let currentMax = ctx.rateLimit.max;
const ip = getIp(req, ctx.options);
if (!ip) return;
const key = createRateLimitKey(ip, path);
const specialRule = getDefaultSpecialRules().find((rule) => rule.pathMatcher(path));
if (specialRule) {
currentWindow = specialRule.window;
currentMax = specialRule.max;
}
for (const plugin of ctx.options.plugins || []) if (plugin.rateLimit) {
const matchedRule = plugin.rateLimit.find((rule) => rule.pathMatcher(path));
if (matchedRule) {
currentWindow = matchedRule.window;
currentMax = matchedRule.max;
break;
}
}
if (ctx.rateLimit.customRules) {
const _path = Object.keys(ctx.rateLimit.customRules).find((p) => {
if (p.includes("*")) return wildcardMatch(p)(path);
return p === path;
});
if (_path) {
const customRule = ctx.rateLimit.customRules[_path];
const resolved = typeof customRule === "function" ? await customRule(req, {
window: currentWindow,
max: currentMax
}) : customRule;
if (resolved) {
currentWindow = resolved.window;
currentMax = resolved.max;
}
if (resolved === false) return;
}
}
const storage = getRateLimitStorage(ctx, { window: currentWindow });
const data = await storage.get(key);
const now2 = Date.now();
if (!data) await storage.set(key, {
key,
count: 1,
lastRequest: now2
});
else {
const timeSinceLastRequest = now2 - data.lastRequest;
if (shouldRateLimit(currentMax, currentWindow, data)) return rateLimitResponse(getRetryAfter(data.lastRequest, currentWindow));
else if (timeSinceLastRequest > currentWindow * 1e3) await storage.set(key, {
...data,
count: 1,
lastRequest: now2
}, true);
else await storage.set(key, {
...data,
count: data.count + 1,
lastRequest: now2
}, true);
}
}
function getDefaultSpecialRules() {
return [{
pathMatcher(path) {
return path.startsWith("/sign-in") || path.startsWith("/sign-up") || path.startsWith("/change-password") || path.startsWith("/change-email");
},
window: 10,
max: 3
}];
}
const getDate = (span, unit = "ms") => {
return new Date(Date.now() + (unit === "sec" ? span * 1e3 : span));
};
const cache = /* @__PURE__ */ new WeakMap();
function parseOutputData(data, schema2) {
const fields = schema2.fields;
const parsedData = {};
for (const key in data) {
const field = fields[key];
if (!field) {
parsedData[key] = data[key];
continue;
}
if (field.returned === false && key !== "id") continue;
parsedData[key] = data[key];
}
return parsedData;
}
function getFields(options, table, mode) {
const cacheKey = `${table}:${mode}`;
if (!cache.has(options)) cache.set(options, /* @__PURE__ */ new Map());
const tableCache = cache.get(options);
if (tableCache.has(cacheKey)) return tableCache.get(cacheKey);
const coreSchema = mode === "output" ? getAuthTables(options)[table]?.fields ?? {} : {};
const additionalFields = table === "user" || table === "session" || table === "account" ? options[table]?.additionalFields : void 0;
let schema2 = {
...coreSchema,
...additionalFields ?? {}
};
for (const plugin of options.plugins || []) if (plugin.schema && plugin.schema[table]) schema2 = {
...schema2,
...plugin.schema[table].fields
};
tableCache.set(cacheKey, schema2);
return schema2;
}
function parseUserOutput(options, user) {
return parseOutputData(user, { fields: getFields(options, "user", "output") });
}
function parseSessionOutput(options, session) {
return parseOutputData(session, { fields: getFields(options, "session", "output") });
}
function parseAccountOutput(options, account) {
const { accessToken: _accessToken, refreshToken: _refreshToken, idToken: _idToken, accessTokenExpiresAt: _accessTokenExpiresAt, refreshTokenExpiresAt: _refreshTokenExpiresAt, password: _password, ...rest } = parseOutputData(account, { fields: getFields(options, "account", "output") });
return rest;
}
function parseInputData(data, schema2) {
const action = schema2.action || "create";
const fields = schema2.fields;
const parsedData = Object.assign(/* @__PURE__ */ Object.create(null), null);
for (const key in fields) {
if (key in data) {
if (fields[key].input === false) {
if (fields[key].defaultValue !== void 0) {
if (action !== "update") {
parsedData[key] = fields[key].defaultValue;
continue;
}
}
if (data[key]) throw new APIError("BAD_REQUEST", { message: `${key} is not allowed to be set` });
continue;
}
if (fields[key].validator?.input && data[key] !== void 0) {
const result = fields[key].validator.input["~standard"].validate(data[key]);
if (result instanceof Promise) throw new APIError("INTERNAL_SERVER_ERROR", { message: "Async validation is not supported for additional fields" });
if ("issues" in result && result.issues) throw new APIError("BAD_REQUEST", { message: result.issues[0]?.message || "Validation Error" });
parsedData[key] = result.value;
continue;
}
if (fields[key].transform?.input && data[key] !== void 0) {
parsedData[key] = fields[key].transform?.input(data[key]);
continue;
}
parsedData[key] = data[key];
continue;
}
if (fields[key].defaultValue !== void 0 && action === "create") {
if (typeof fields[key].defaultValue === "function") {
parsedData[key] = fields[key].defaultValue();
continue;
}
parsedData[key] = fields[key].defaultValue;
continue;
}
if (fields[key].required && action === "create") throw new APIError("BAD_REQUEST", { message: `${key} is required` });
}
return parsedData;
}
function parseUserInput(options, user = {}, action) {
return parseInputData(user, {
fields: getFields(options, "user", "input"),
action
});
}
function parseAdditionalUserInput(options, user) {
const schema2 = getFields(options, "user", "input");
return parseInputData(user || {}, { fields: schema2 });
}
function parseAccountInput(options, account) {
return parseInputData(account, { fields: getFields(options, "account", "input") });
}
function parseSessionInput(options, session) {
return parseInputData(session, { fields: getFields(options, "session", "input") });
}
function mergeSchema(schema2, newSchema) {
if (!newSchema) return schema2;
for (const table in newSchema) {
const newModelName = newSchema[table]?.modelName;
if (newModelName) schema2[table].modelName = newModelName;
for (const field in schema2[table].fields) {
const newField = newSchema[table]?.fields?.[field];
if (!newField) continue;
schema2[table].fields[field].fieldName = newField;
}
}
return schema2;
}
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (all, symbols) => {
let target = {};
for (var name in all) {
__defProp(target, name, {
get: all[name],
enumerable: true
});
}
return target;
};
var __copyProps = (to, from, except, desc2) => {
if (from && typeof from === "object" || typeof from === "function") {
for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
key = keys[i];
if (!__hasOwnProp.call(to, key) && key !== except) {
__defProp(to, key, {
get: ((k) => from[k]).bind(null, key),
enumerable: !(desc2 = __getOwnPropDesc(from, key)) || desc2.enumerable
});
}
}
}
return to;
};
var __reExport = (target, mod, secondTarget, symbols) => {
__copyProps(target, mod, "default");
};
async function getBaseAdapter(options, handleDirectDatabase) {
let adapter;
if (!options.database) {
const tables = getAuthTables(options);
const memoryDB = Object.keys(tables).reduce((acc, key) => {
acc[key] = [];
return acc;
}, {});
const { memoryAdapter } = await import("./index5.js");
adapter = memoryAdapter(memoryDB)(options);
} else if (typeof options.database === "function") adapter = options.database(options);
else adapter = await handleDirectDatabase(options);
if (!adapter.transaction) {
logger.warn("Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation.");
adapter.transaction = async (cb) => {
return cb(adapter);
};
}
return adapter;
}
async function getAdapter(options) {
return getBaseAdapter(options, async (opts) => {
const { createKyselyAdapter: createKyselyAdapter2 } = await import("./index6.js");
const { kysely, databaseType, transaction } = await createKyselyAdapter2(opts);
if (!kysely) throw new BetterAuthError("Failed to initialize database adapter");
const { kyselyAdapter } = await import("./index6.js");
return kyselyAdapter(kysely, {
type: databaseType || "sqlite",
debugLogs: opts.database && "debugLogs" in opts.database ? opts.database.debugLogs : false,
transaction
})(opts);
});
}
const createFieldAttribute = (type, config2) => {
return {
type,
...config2
};
};
function convertToDB(fields, values) {
const result = values.id ? { id: values.id } : {};
for (const key in fields) {
const field = fields[key];
const value = values[key];
if (value === void 0) continue;
result[field.fieldName || key] = value;
}
return result;
}
function convertFromDB(fields, values) {
if (!values) return null;
const result = { id: values.id };
for (const [key, value] of Object.entries(fields)) result[key] = values[value.fieldName || key];
return result;
}
function getWithHooks(adapter, ctx) {
const hooks = ctx.hooks;
async function createWithHooks(data, model, customCreateFn) {
const context = await getCurrentAuthContext().catch(() => null);
let actualData = data;
for (const hook of hooks || []) {
const toRun = hook[model]?.create?.before;
if (toRun) {
const result = await toRun(actualData, context);
if (result === false) return null;
if (typeof result === "object" && "data" in result) actualData = {
...actualData,
...result.data
};
}
}
const customCreated = customCreateFn ? await customCreateFn.fn(actualData) : null;
const created = !customCreateFn || customCreateFn.executeMainFn ? await (await getCurrentAdapter(adapter)).create({
model,
data: actualData,
forceAllowId: true
}) : customCreated;
for (const hook of hooks || []) {
const toRun = hook[model]?.create?.after;
if (toRun) await toRun(created, context);
}
return created;
}
async function updateWithHooks(data, where, model, customUpdateFn) {
const context = await getCurrentAuthContext().catch(() => null);
let actualData = data;
for (const hook of hooks || []) {
const toRun = hook[model]?.update?.before;
if (toRun) {
const result = await toRun(data, context);
if (result === false) return null;
if (typeof result === "object" && "data" in result) actualData = {
...actualData,
...result.data
};
}
}
const customUpdated = customUpdateFn ? await customUpdateFn.fn(actualData) : null;
const updated = !customUpdateFn || customUpdateFn.executeMainFn ? await (await getCurrentAdapter(adapter)).update({
model,
update: actualData,
where
}) : customUpdated;
for (const hook of hooks || []) {
const toRun = hook[model]?.update?.after;
if (toRun) await toRun(updated, context);
}
return updated;
}
async function updateManyWithHooks(data, where, model, customUpdateFn) {
const context = await getCurrentAuthContext().catch(() => null);
let actualData = data;
for (const hook of hooks || []) {
const toRun = hook[model]?.update?.before;
if (toRun) {
const result = await toRun(data, context);
if (result === false) return null;
if (typeof result === "object" && "data" in result) actualData = {
...actualData,
...result.data
};
}
}
const customUpdated = customUpdateFn ? await customUpdateFn.fn(actualData) : null;
const updated = !customUpdateFn || customUpdateFn.executeMainFn ? await (await getCurrentAdapter(adapter)).updateMany({
model,
update: actualData,
where
}) : customUpdated;
for (const hook of hooks || []) {
const toRun = hook[model]?.update?.after;
if (toRun) await toRun(updated, context);
}
return updated;
}
async function deleteWithHooks(where, model, customDeleteFn) {
const context = await getCurrentAuthContext().catch(() => null);
let entityToDelete = null;
try {
entityToDelete = (await (await getCurrentAdapter(adapter)).findMany({
model,
where,
limit: 1
}))[0] || null;
} catch {
}
if (entityToDelete) for (const hook of hooks || []) {
const toRun = hook[model]?.delete?.before;
if (toRun) {
if (await toRun(entityToDelete, context) === false) return null;
}
}
const customDeleted = customDeleteFn ? await customDeleteFn.fn(where) : null;
const deleted = !customDeleteFn || customDeleteFn.executeMainFn ? await (await getCurrentAdapter(adapter)).delete({
model,
where
}) : customDeleted;
if (entityToDelete) for (const hook of hooks || []) {
const toRun = hook[model]?.delete?.after;
if (toRun) await toRun(entityToDelete, context);
}
return deleted;
}
async function deleteManyWithHooks(where, model, customDeleteFn) {
const context = await getCurrentAuthContext().catch(() => null);
let entitiesToDelete = [];
try {
entitiesToDelete = await (await getCurrentAdapter(adapter)).findMany({
model,
where
});
} catch {
}
for (const entity of entitiesToDelete) for (const hook of hooks || []) {
const toRun = hook[model]?.delete?.before;
if (toRun) {
if (await toRun(entity, context) === false) return null;
}
}
const customDeleted = customDeleteFn ? await customDeleteFn.fn(where) : null;
const deleted = !customDeleteFn || customDeleteFn.executeMainFn ? await (await getCurrentAdapter(adapter)).deleteMany({
model,
where
}) : customDeleted;
for (const entity of entitiesToDelete) for (const hook of hooks || []) {
const toRun = hook[model]?.delete?.after;
if (toRun) await toRun(entity, context);
}
return deleted;
}
return {
createWithHooks,
updateWithHooks,
updateManyWithHooks,
deleteWithHooks,
deleteManyWithHooks
};
}
const createInternalAdapter = (adapter, ctx) => {
const logger2 = ctx.logger;
const options = ctx.options;
const secondaryStorage = options.secondaryStorage;
const sessionExpiration = options.session?.expiresIn || 3600 * 24 * 7;
const { createWithHooks, updateWithHooks, updateManyWithHooks, deleteWithHooks, deleteManyWithHooks } = getWithHooks(adapter, ctx);
async function refreshUserSessions(user) {
if (!secondaryStorage) return;
const listRaw = await secondaryStorage.get(`active-sessions-${user.id}`);
if (!listRaw) return;
const now2 = Date.now();
const validSessions = (safeJSONParse(listRaw) || []).filter((s) => s.expiresAt > now2);
await Promise.all(validSessions.map(async ({ token }) => {
const cached = await secondaryStorage.get(token);
if (!cached) return;
const parsed = safeJSONParse(cached);
if (!parsed) return;
const sessionTTL = Math.max(Math.floor(new Date(parsed.session.expiresAt).getTime() - now2) / 1e3, 0);
await secondaryStorage.set(token, JSON.stringify({
session: parsed.session,
user
}), Math.floor(sessionTTL));
}));
}
return {
createOAuthUser: async (user, account) => {
return runWithTransaction(adapter, async () => {
const createdUser = await createWithHooks({
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date(),
...user
}, "user", void 0);
return {
user: createdUser,
account: await createWithHooks({
...account,
userId: createdUser.id,
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date()
}, "account", void 0)
};
});
},
createUser: async (user) => {
return await createWithHooks({
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date(),
...user,
email: user.email?.toLowerCase()
}, "user", void 0);
},
createAccount: async (account) => {
return await createWithHooks({
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date(),
...account
}, "account", void 0);
},
listSessions: async (userId) => {
if (secondaryStorage) {
const currentList = await secondaryStorage.get(`active-sessions-${userId}`);
if (!currentList) return [];
const list = safeJSONParse(currentList) || [];
const now2 = Date.now();
const seenTokens = /* @__PURE__ */ new Set();
const sessions = [];
for (const { token, expiresAt } of list) {
if (expiresAt <= now2 || seenTokens.has(token)) continue;
seenTokens.add(token);
const data = await secondaryStorage.get(token);
if (!data) continue;
try {
const parsed = typeof data === "string" ? JSON.parse(data) : data;
if (!parsed?.session) continue;
sessions.push(parseSessionOutput(ctx.options, {
...parsed.session,
expiresAt: new Date(parsed.session.expiresAt)
}));
} catch {
continue;
}
}
return sessions;
}
return await (await getCurrentAdapter(adapter)).findMany({
model: "session",
where: [{
field: "userId",
value: userId
}]
});
},
listUsers: async (limit, offset, sortBy, where) => {
return await (await getCurrentAdapter(adapter)).findMany({
model: "user",
limit,
offset,
sortBy,
where
});
},
countTotalUsers: async (where) => {
const total = await (await getCurrentAdapter(adapter)).count({
model: "user",
where
});
if (typeof total === "string") return parseInt(total);
return total;
},
deleteUser: async (userId) => {
if (!secondaryStorage || options.session?.storeSessionInDatabase) await deleteManyWithHooks([{
field: "userId",
value: userId
}], "session", void 0);
await deleteManyWithHooks([{
field: "userId",
value: userId
}], "account", void 0);
await deleteWithHooks([{
field: "id",
value: userId
}], "user", void 0);
},
createSession: async (userId, dontRememberMe, override, overrideAll) => {
const ctx$1 = await getCurrentAuthContext().catch(() => null);
const headers = ctx$1?.headers || ctx$1?.request?.headers;
const { id: _, ...rest } = override || {};
const defaultAdditionalFields = parseSessionInput(ctx$1?.context.options ?? options, {});
const data = {
ipAddress: ctx$1?.request || ctx$1?.headers ? getIp(ctx$1?.request || ctx$1?.headers, ctx$1?.context.options) || "" : "",
userAgent: headers?.get("user-agent") || "",
...rest,
expiresAt: dontRememberMe ? getDate(3600 * 24, "sec") : getDate(sessionExpiration, "sec"),
userId,
token: generateId(32),
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date(),
...defaultAdditionalFields,
...overrideAll ? rest : {}
};
return await createWithHooks(data, "session", secondaryStorage ? {
fn: async (sessionData) => {
const currentList = await secondaryStorage.get(`active-sessions-${userId}`);
let list = [];
const now2 = Date.now();
if (currentList) {
list = safeJSONParse(currentList) || [];
list = list.filter((session) => session.expiresAt > now2 && session.token !== data.token);
}
const sorted = [...list, {
token: data.token,
expiresAt: data.expiresAt.getTime()
}].sort((a, b) => a.expiresAt - b.expiresAt);
const furthestSessionExp = sorted.at(-1)?.expiresAt ?? data.expiresAt.getTime();
const furthestSessionTTL = Math.max(Math.floor((furthestSessionExp - now2) / 1e3), 0);
if (furthestSessionTTL > 0) await secondaryStorage.set(`active-sessions-${userId}`, JSON.stringify(sorted), furthestSessionTTL);
const user = await (await getCurrentAdapter(adapter)).findOne({
model: "user",
where: [{
field: "id",
value: userId
}]
});
const sessionTTL = Math.max(Math.floor((data.expiresAt.getTime() - now2) / 1e3), 0);
if (sessionTTL > 0) await secondaryStorage.set(data.token, JSON.stringify({
session: sessionData,
user
}), sessionTTL);
return sessionData;
},
executeMainFn: options.session?.storeSessionInDatabase
} : void 0);
},
findSession: async (token) => {
if (secondaryStorage) {
const sessionStringified = await secondaryStorage.get(token);
if (!sessionStringified && !options.session?.storeSessionInDatabase) return null;
if (sessionStringified) {
const s = safeJSONParse(sessionStringified);
if (!s) return null;
return {
session: parseSessionOutput(ctx.options, {
...s.session,
expiresAt: new Date(s.session.expiresAt),
createdAt: new Date(s.session.createdAt),
updatedAt: new Date(s.session.updatedAt)
}),
user: parseUserOutput(ctx.options, {
...s.user,
createdAt: new Date(s.user.createdAt),
updatedAt: new Date(s.user.updatedAt)
})
};
}
}
const result = await (await getCurrentAdapter(adapter)).findOne({
model: "session",
where: [{
value: token,
field: "token"
}],
join: { user: true }
});
if (!result) return null;
const { user, ...session } = result;
if (!user) return null;
return {
session: parseSessionOutput(ctx.options, session),
user: parseUserOutput(ctx.options, user)
};
},
findSessions: async (sessionTokens) => {
if (secondaryStorage) {
const sessions$1 = [];
for (const sessionToken of sessionTokens) {
const sessionStringified = await secondaryStorage.get(sessionToken);
if (sessionStringified) try {
const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
if (!s?.session) continue;
const session = {
session: {
...s.session,
expiresAt: new Date(s.session.expiresAt)
},
user: {
...s.user,
createdAt: new Date(s.user.createdAt),
updatedAt: new Date(s.user.updatedAt)
}
};
sessions$1.push(session);
} catch {
continue;
}
}
return sessions$1;
}
const sessions = await (await getCurrentAdapter(adapter)).findMany({
model: "session",
where: [{
field: "token",
value: sessionTokens,
operator: "in"
}],
join: { user: true }
});
if (!sessions.length) return [];
if (sessions.some((session) => !session.user)) return [];
return sessions.map((_session) => {
const { user, ...session } = _session;
return {
session,
user
};
});
},
updateSession: async (sessionToken, session) => {
return await updateWithHooks(session, [{
field: "token",
value: sessionToken
}], "session", secondaryStorage ? {
async fn(data) {
const currentSession = await secondaryStorage.get(sessionToken);
if (!currentSession) return null;
const parsedSession = safeJSONParse(currentSession);
if (!parsedSession) return null;
const mergedSession = {
...parsedSession.session,
...data,
expiresAt: new Date(data.expiresAt ?? parsedSession.session.expiresAt),
createdAt: new Date(parsedSession.session.createdAt),
updatedAt: new Date(data.updatedAt ?? parsedSession.session.updatedAt)
};
const updatedSession = parseSessionOutput(ctx.options, mergedSession);
const now2 = Date.now();
const expiresMs = new Date(updatedSession.expiresAt).getTime();
const sessionTTL = Math.max(Math.floor((expiresMs - now2) / 1e3), 0);
if (sessionTTL > 0) {
await secondaryStorage.set(sessionToken, JSON.stringify({
session: updatedSession,
user: parsedSession.user
}), sessionTTL);
const listKey = `active-sessions-${updatedSession.userId}`;
const listRaw = await secondaryStorage.get(listKey);
const sorted = (listRaw ? safeJSONParse(listRaw) || [] : []).filter((s) => s.token !== sessionToken && s.expiresAt > now2).concat([{
token: sessionToken,
expiresAt: expiresMs
}]).sort((a, b) => a.expiresAt - b.expiresAt);
const furthestSessionExp = sorted.at(-1)?.expiresAt;
if (furthestSessionExp && furthestSessionExp > now2) await secondaryStorage.set(listKey, JSON.stringify(sorted), Math.floor((furthestSessionExp - now2) / 1e3));
else await secondaryStorage.delete(listKey);
}
return updatedSession;
},
executeMainFn: options.session?.storeSessionInDatabase
} : void 0);
},
deleteSession: async (token) => {
if (secondaryStorage) {
const data = await secondaryStorage.get(token);
if (data) {
const { session } = safeJSONParse(data) ?? {};
if (!session) {
logger2.error("Session not found in secondary storage");
return;
}
const userId = session.userId;
const currentList = await secondaryStorage.get(`active-sessions-${userId}`);
if (currentList) {
const list = safeJSONParse(currentList) || [];
const now2 = Date.now();
const filtered = list.filter((session$1) => session$1.expiresAt > now2 && session$1.token !== token);
const furthestSessionExp = filtered.sort((a, b) => a.expiresAt - b.expiresAt).at(-1)?.expiresAt;
if (filtered.length > 0 && furthestSessionExp && furthestSessionExp > Date.now()) await secondaryStorage.set(`active-sessions-${userId}`, JSON.stringify(filtered), Math.floor((furthestSessionExp - now2) / 1e3));
else await secondaryStorage.delete(`active-sessions-${userId}`);
} else logger2.error("Active sessions list not found in secondary storage");
}
await secondaryStorage.delete(token);
if (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase) return;
}
await deleteWithHooks([{
field: "token",
value: token
}], "session", void 0);
},
deleteAccounts: async (userId) => {
await deleteManyWithHooks([{
field: "userId",
value: userId
}], "account", void 0);
},
deleteAccount: async (accountId) => {
await deleteWithHooks([{
field: "id",
value: accountId
}], "account", void 0);
},
deleteSessions: async (userIdOrSessionTokens) => {
if (secondaryStorage) {
if (typeof userIdOrSessionTokens === "string") {
const activeSession = await secondaryStorage.get(`active-sessions-${userIdOrSessionTokens}`);
const sessions = activeSession ? safeJSONParse(activeSession) : [];
if (!sessions) return;
for (const session of sessions) await secondaryStorage.delete(session.token);
await secondaryStorage.delete(`active-sessions-${userIdOrSessionTokens}`);
} else for (const sessionToken of userIdOrSessionTokens) if (await secondaryStorage.get(sessionToken)) await secondaryStorage.delete(sessionToken);
if (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase) return;
}
await deleteManyWithHooks([{
field: Array.isArray(userIdOrSessionTokens) ? "token" : "userId",
value: userIdOrSessionTokens,
operator: Array.isArray(userIdOrSessionTokens) ? "in" : void 0
}], "session", void 0);
},
findOAuthUser: async (email, accountId, providerId) => {
const account = await (await getCurrentAdapter(adapter)).findOne({
model: "account",
where: [{
value: accountId,
field: "accountId"
}, {
value: providerId,
field: "providerId"
}],
join: { user: true }
});
if (account) if (account.user) return {
user: account.user,
linkedAccount: account,
accounts: [account]
};
else {
const user = await (await getCurrentAdapter(adapter)).findOne({
model: "user",
where: [{
value: email.toLowerCase(),
field: "email"
}]
});
if (user) return {
user,
linkedAccount: account,
accounts: [account]
};
return null;
}
else {
const user = await (await getCurrentAdapter(adapter)).findOne({
model: "user",
where: [{
value: email.toLowerCase(),
field: "email"
}]
});
if (user) return {
user,
linkedAccount: null,
accounts: await (await getCurrentAdapter(adapter)).findMany({
model: "account",
where: [{
value: user.id,
field: "userId"
}]
}) || []
};
else return null;
}
},
findUserByEmail: async (email, options$1) => {
const result = await (await getCurrentAdapter(adapter)).findOne({
model: "user",
where: [{
value: email.toLowerCase(),
field: "email"
}],
join: { ...options$1?.includeAccounts ? { account: true } : {} }
});
if (!result) return null;
const { account: accounts, ...user } = result;
return {
user,
accounts: accounts ?? []
};
},
findUserById: async (userId) => {
if (!userId) return null;
return await (await getCurrentAdapter(adapter)).findOne({
model: "user",
where: [{
field: "id",
value: userId
}]
});
},
linkAccount: async (account) => {
return await createWithHooks({
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date(),
...account
}, "account", void 0);
},
updateUser: async (userId, data) => {
const user = await updateWithHooks(data, [{
field: "id",
value: userId
}], "user", void 0);
await refreshUserSessions(user);
return user;
},
updateUserByEmail: async (email, data) => {
const user = await updateWithHooks(data, [{
field: "email",
value: email.toLowerCase()
}], "user", void 0);
await refreshUserSessions(user);
return user;
},
updatePassword: async (userId, password) => {
await updateManyWithHooks({ password }, [{
field: "userId",
value: userId
}, {
field: "providerId",
value: "credential"
}], "account", void 0);
},
findAccounts: async (userId) => {
return await (await getCurrentAdapter(adapter)).findMany({
model: "account",
where: [{
field: "userId",
value: userId
}]
});
},
findAccount: async (accountId) => {
return await (await getCurrentAdapter(adapter)).findOne({
model: "account",
where: [{
field: "accountId",
value: accountId
}]
});
},
findAccountByProviderId: async (accountId, providerId) => {
return await (await getCurrentAdapter(adapter)).findOne({
model: "account",
where: [{
field: "accountId",
value: accountId
}, {
field: "providerId",
value: providerId
}]
});
},
findAccountByUserId: async (userId) => {
return await (await getCurrentAdapter(adapter)).findMany({
model: "account",
where: [{
field: "userId",
value: userId
}]
});
},
updateAccount: async (id, data) => {
return await updateWithHooks(data, [{
field: "id",
value: id
}], "account", void 0);
},
createVerificationValue: async (data) => {
return await createWithHooks({
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date(),
...data
}, "verification", void 0);
},
findVerificationValue: async (identifier) => {
const verification = await (await getCurrentAdapter(adapter)).findMany({
model: "verification",
where: [{
field: "identifier",
value: identifier
}],
sortBy: {
field: "createdAt",
direction: "desc"
},
limit: 1
});
if (!options.verification?.disableCleanup) await deleteManyWithHooks([{
field: "expiresAt",
value: /* @__PURE__ */ new Date(),
operator: "lt"
}], "verification", void 0);
return verification[0];
},
deleteVerificationValue: async (id) => {
await deleteWithHooks([{
field: "id",
value: id
}], "verification", void 0);
},
deleteVerificationByIdentifier: async (identifier) => {
await deleteWithHooks([{
field: "identifier",
value: identifier
}], "verification", void 0);
},
updateVerificationValue: async (id, data) => {
return await updateWithHooks(data, [{
field: "id",
value: id
}], "verification", void 0);
}
};
};
function toZodSchema({ fields, isClientSide }) {
const zodFields = Object.keys(fields).reduce((acc, key) => {
const field = fields[key];
if (!field) return acc;
if (isClientSide && field.input === false) return acc;
let schema2;
if (field.type === "json") schema2 = z.json ? z.json() : z.any();
else if (field.type === "string[]" || field.type === "number[]") schema2 = z.array(field.type === "string[]" ? z.string() : z.number());
else if (Array.isArray(field.type)) schema2 = z.any();
else schema2 = z[field.type]();
if (field?.required === false) schema2 = schema2.optional();
if (!isClientSide && field?.returned === false) return acc;
return {
...acc,
[key]: schema2
};
}, {});
return z.object(zodFields);
}
function getSchema(config2) {
const tables = (0, db_exports.getAuthTables)(config2);
const schema2 = {};
for (const key in tables) {
const table = tables[key];
const fields = table.fields;
const actualFields = {};
Object.entries(fields).forEach(([key$1, field]) => {
actualFields[field.fieldName || key$1] = field;
if (field.references) {
const refTable = tables[field.references.model];
if (refTable) actualFields[field.fieldName || key$1].references = {
...field.references,
model: refTable.modelName,
field: field.references.field
};
}
});
if (schema2[table.modelName]) {
schema2[table.modelName].fields = {
...schema2[table.modelName].fields,
...actualFields
};
continue;
}
schema2[table.modelName] = {
fields: actualFields,
order: table.order || Infinity
};
}
return schema2;
}
function getKyselyDatabaseType(db2) {
if (!db2) return null;
if ("dialect" in db2) return getKyselyDatabaseType(db2.dialect);
if ("createDriver" in db2) {
if (db2 instanceof SqliteDialect) return "sqlite";
if (db2 instanceof MysqlDialect) return "mysql";
if (db2 instanceof PostgresDialect) return "postgres";
if (db2 instanceof MssqlDialect) return "mssql";
}
if ("aggregate" in db2) return "sqlite";
if ("getConnection" in db2) return "mysql";
if ("connect" in db2) return "postgres";
if ("fileControl" in db2) return "sqlite";
if ("open" in db2 && "close" in db2 && "prepare" in db2) return "sqlite";
return null;
}
const createKyselyAdapter = async (config2) => {
const db2 = config2.database;
if (!db2) return {
kysely: null,
databaseType: null,
transaction: void 0
};
if ("db" in db2) return {
kysely: db2.db,
databaseType: db2.type,
transaction: db2.transaction
};
if ("dialect" in db2) return {
kysely: new Kysely({ dialect: db2.dialect }),
databaseType: db2.type,
transaction: db2.transaction
};
let dialect = void 0;
const databaseType = getKyselyDatabaseType(db2);
if ("createDriver" in db2) dialect = db2;
if ("aggregate" in db2 && !("createSession" in db2)) dialect = new SqliteDialect({ database: db2 });
if ("getConnection" in db2) dialect = new MysqlDialect(db2);
if ("connect" in db2) dialect = new PostgresDialect({ pool: db2 });
if ("fileControl" in db2) {
const { BunSqliteDialect } = await import("./bun-sqlite-dialect.js");
dialect = new BunSqliteDialect({ database: db2 });
}
if ("createSession" in db2) {
let DatabaseSync = void 0;
try {
const nodeSqlite = "node:sqlite";
({ DatabaseSync } = await import(
/* @vite-ignore */
/* webpackIgnore: true */
nodeSqlite
));
} catch (error2) {
if (error2 !== null && typeof error2 === "object" && "code" in error2 && error2.code !== "ERR_UNKNOWN_BUILTIN_MODULE") throw error2;
}
if (DatabaseSync && db2 instanceof DatabaseSync) {
const { NodeSqliteDialect } = await import("./node-sqlite-dialect.js");
dialect = new NodeSqliteDialect({ database: db2 });
}
}
return {
kysely: dialect ? new Kysely({ dialect }) : null,
databaseType,
transaction: void 0
};
};
const map = {
postgres: {
string: [
"character varying",
"varchar",
"text",
"uuid"
],
number: [
"int4",
"integer",
"bigint",
"smallint",
"numeric",
"real",
"double precision"
],
boolean: ["bool", "boolean"],
date: [
"timestamptz",
"timestamp",
"date"
],
json: ["json", "jsonb"]
},
mysql: {
string: [
"varchar",
"text",
"uuid"
],
number: [
"integer",
"int",
"bigint",
"smallint",
"decimal",
"float",
"double"
],
boolean: ["boolean", "tinyint"],
date: [
"timestamp",
"datetime",
"date"
],
json: ["json"]
},
sqlite: {
string: ["TEXT"],
number: ["INTEGER", "REAL"],
boolean: ["INTEGER", "BOOLEAN"],
date: ["DATE", "INTEGER"],
json: ["TEXT"]
},
mssql: {
string: [
"varchar",
"nvarchar",
"uniqueidentifier"
],
number: [
"int",
"bigint",
"smallint",
"decimal",
"float",
"double"
],
boolean: ["bit", "smallint"],
date: [
"datetime2",
"date",
"datetime"
],
json: ["varchar", "nvarchar"]
}
};
function matchType(columnDataType, fieldType, dbType) {
function normalize(type) {
return type.toLowerCase().split("(")[0].trim();
}
if (fieldType === "string[]" || fieldType === "number[]") return columnDataType.toLowerCase().includes("json");
const types2 = map[dbType];
return (Array.isArray(fieldType) ? types2["string"].map((t) => t.toLowerCase()) : types2[fieldType].map((t) => t.toLowerCase())).includes(normalize(columnDataType));
}
async function getPostgresSchema(db2) {
try {
const result = await sql`SHOW search_path`.execute(db2);
if (result.rows[0]?.search_path) return result.rows[0].search_path.split(",").map((s) => s.trim()).map((s) => s.replace(/^["']|["']$/g, "")).filter((s) => !s.startsWith("$"))[0] || "public";
} catch {
}
return "public";
}
async function getMigrations(config2) {
const betterAuthSchema = getSchema(config2);
const logger$1 = createLogger(config2.logger);
let { kysely: db2, databaseType: dbType } = await createKyselyAdapter(config2);
if (!dbType) {
logger$1.warn("Could not determine database type, defaulting to sqlite. Please provide a type in the database options to avoid this.");
dbType = "sqlite";
}
if (!db2) {
logger$1.error("Only kysely adapter is supported for migrations. You can use `generate` command to generate the schema, if you're using a different adapter.");
process.exit(1);
}
let currentSchema = "public";
if (dbType === "postgres") {
currentSchema = await getPostgresSchema(db2);
logger$1.debug(`PostgreSQL migration: Using schema '${currentSchema}' (from search_path)`);
try {
if (!(await sql`
SELECT schema_name
FROM information_schema.schemata
WHERE schema_name = ${currentSchema}
`.execute(db2)).rows[0]) logger$1.warn(`Schema '${currentSchema}' does not exist. Tables will be inspected from available schemas. Consider creating the schema first or checking your database configuration.`);
} catch (error2) {
logger$1.debug(`Could not verify schema existence: ${error2 instanceof Error ? error2.message : String(error2)}`);
}
}
const allTableMetadata = await db2.introspection.getTables();
let tableMetadata = allTableMetadata;
if (dbType === "postgres") try {
const tablesInSchema = await sql`
SELECT table_name
FROM information_schema.tables
WHERE table_schema = ${currentSchema}
AND table_type = 'BASE TABLE'
`.execute(db2);
const tableNamesInSchema = new Set(tablesInSchema.rows.map((row) => row.table_name));
tableMetadata = allTableMetadata.filter((table) => table.schema === currentSchema && tableNamesInSchema.has(table.name));
logger$1.debug(`Found ${tableMetadata.length} table(s) in schema '${currentSchema}': ${tableMetadata.map((t) => t.name).join(", ") || "(none)"}`);
} catch (error2) {
logger$1.warn(`Could not filter tables by schema. Using all discovered tables. Error: ${error2 instanceof Error ? error2.message : String(error2)}`);
}
const toBeCreated = [];
const toBeAdded = [];
for (const [key, value] of Object.entries(betterAuthSchema)) {
const table = tableMetadata.find((t) => t.name === key);
if (!table) {
const tIndex = toBeCreated.findIndex((t) => t.table === key);
const tableData = {
table: key,
fields: value.fields,
order: value.order || Infinity
};
const insertIndex = toBeCreated.findIndex((t) => (t.order || Infinity) > tableData.order);
if (insertIndex === -1) if (tIndex === -1) toBeCreated.push(tableData);
else toBeCreated[tIndex].fields = {
...toBeCreated[tIndex].fields,
...value.fields
};
else toBeCreated.splice(insertIndex, 0, tableData);
continue;
}
const toBeAddedFields = {};
for (const [fieldName, field] of Object.entries(value.fields)) {
const column = table.columns.find((c) => c.name === fieldName);
if (!column) {
toBeAddedFields[fieldName] = field;
continue;
}
if (matchType(column.dataType, field.type, dbType)) continue;
else logger$1.warn(`Field ${fieldName} in table ${key} has a different type in the database. Expected ${field.type} but got ${column.dataType}.`);
}
if (Object.keys(toBeAddedFields).length > 0) toBeAdded.push({
table: key,
fields: toBeAddedFields,
order: value.order || Infinity
});
}
const migrations = [];
const useUUIDs = config2.advanced?.database?.generateId === "uuid";
const useNumberId = config2.advanced?.database?.useNumberId || config2.advanced?.database?.generateId === "serial";
function getType(field, fieldName) {
const type = field.type;
const provider = dbType || "sqlite";
const typeMap = {
string: {
sqlite: "text",
postgres: "text",
mysql: field.unique ? "varchar(255)" : field.references ? "varchar(36)" : field.sortable ? "varchar(255)" : field.index ? "varchar(255)" : "text",
mssql: field.unique || field.sortable ? "varchar(255)" : field.references ? "varchar(36)" : "varchar(8000)"
},
boolean: {
sqlite: "integer",
postgres: "boolean",
mysql: "boolean",
mssql: "smallint"
},
number: {
sqlite: field.bigint ? "bigint" : "integer",
postgres: field.bigint ? "bigint" : "integer",
mysql: field.bigint ? "bigint" : "integer",
mssql: field.bigint ? "bigint" : "integer"
},
date: {
sqlite: "date",
postgres: "timestamptz",
mysql: "timestamp(3)",
mssql: sql`datetime2(3)`
},
json: {
sqlite: "text",
postgres: "jsonb",
mysql: "json",
mssql: "varchar(8000)"
},
id: {
postgres: useNumberId ? sql`integer GENERATED BY DEFAULT AS IDENTITY` : useUUIDs ? "uuid" : "text",
mysql: useNumberId ? "integer" : useUUIDs ? "varchar(36)" : "varchar(36)",
mssql: useNumberId ? "integer" : useUUIDs ? "varchar(36)" : "varchar(36)",
sqlite: useNumberId ? "integer" : "text"
},
foreignKeyId: {
postgres: useNumberId ? "integer" : useUUIDs ? "uuid" : "text",
mysql: useNumberId ? "integer" : useUUIDs ? "varchar(36)" : "varchar(36)",
mssql: useNumberId ? "integer" : useUUIDs ? "varchar(36)" : "varchar(36)",
sqlite: useNumberId ? "integer" : "text"
},
"string[]": {
sqlite: "text",
postgres: "jsonb",
mysql: "json",
mssql: "varchar(8000)"
},
"number[]": {
sqlite: "text",
postgres: "jsonb",
mysql: "json",
mssql: "varchar(8000)"
}
};
if (fieldName === "id" || field.references?.field === "id") {
if (fieldName === "id") return typeMap.id[provider];
return typeMap.foreignKeyId[provider];
}
if (Array.isArray(type)) return "text";
if (!(type in typeMap)) throw new Error(`Unsupported field type '${String(type)}' for field '${fieldName}'. Allowed types are: string, number, boolean, date, string[], number[]. If you need to store structured data, store it as a JSON string (type: "string") or split it into primitive fields. See https://better-auth.com/docs/advanced/schema#additional-fields`);
return typeMap[type][provider];
}
const getModelName = initGetModelName({
schema: getAuthTables(config2),
usePlural: false
});
const getFieldName = initGetFieldName({
schema: getAuthTables(config2),
usePlural: false
});
function getReferencePath(model, field) {
try {
return `${getModelName(model)}.${getFieldName({
model,
field
})}`;
} catch {
return `${model}.${field}`;
}
}
if (toBeAdded.length) for (const table of toBeAdded) for (const [fieldName, field] of Object.entries(table.fields)) {
const type = getType(field, fieldName);
const builder = db2.schema.alterTable(table.table);
if (field.index) {
const index = db2.schema.alterTable(table.table).addIndex(`${table.table}_${fieldName}_idx`);
migrations.push(index);
}
const built = builder.addColumn(fieldName, type, (col) => {
col = field.required !== false ? col.notNull() : col;
if (field.references) col = col.references(getReferencePath(field.references.model, field.references.field)).onDelete(field.references.onDelete || "cascade");
if (field.unique) col = col.unique();
if (field.type === "date" && typeof field.defaultValue === "function" && (dbType === "postgres" || dbType === "mysql" || dbType === "mssql")) if (dbType === "mysql") col = col.defaultTo(sql`CURRENT_TIMESTAMP(3)`);
else col = col.defaultTo(sql`CURRENT_TIMESTAMP`);
return col;
});
migrations.push(built);
}
const toBeIndexed = [];
if (config2.advanced?.database?.useNumberId) logger$1.warn("`useNumberId` is deprecated. Please use `generateId` with `serial` instead.");
if (toBeCreated.length) for (const table of toBeCreated) {
const idType = getType({ type: useNumberId ? "number" : "string" }, "id");
let dbT = db2.schema.createTable(table.table).addColumn("id", idType, (col) => {
if (useNumberId) {
if (dbType === "postgres") return col.primaryKey().notNull();
else if (dbType === "sqlite") return col.primaryKey().notNull();
else if (dbType === "mssql") return col.identity().primaryKey().notNull();
return col.autoIncrement().primaryKey().notNull();
}
if (useUUIDs) {
if (dbType === "postgres") return col.primaryKey().defaultTo(sql`pg_catalog.gen_random_uuid()`).notNull();
return col.primaryKey().notNull();
}
return col.primaryKey().notNull();
});
for (const [fieldName, field] of Object.entries(table.fields)) {
const type = getType(field, fieldName);
dbT = dbT.addColumn(fieldName, type, (col) => {
col = field.required !== false ? col.notNull() : col;
if (field.references) col = col.references(getReferencePath(field.references.model, field.references.field)).onDelete(field.references.onDelete || "cascade");
if (field.unique) col = col.unique();
if (field.type === "date" && typeof field.defaultValue === "function" && (dbType === "postgres" || dbType === "mysql" || dbType === "mssql")) if (dbType === "mysql") col = col.defaultTo(sql`CURRENT_TIMESTAMP(3)`);
else col = col.defaultTo(sql`CURRENT_TIMESTAMP`);
return col;
});
if (field.index) {
const builder = db2.schema.createIndex(`${table.table}_${fieldName}_${field.unique ? "uidx" : "idx"}`).on(table.table).columns([fieldName]);
toBeIndexed.push(field.unique ? builder.unique() : builder);
}
}
migrations.push(dbT);
}
if (toBeIndexed.length) for (const index of toBeIndexed) migrations.push(index);
async function runMigrations() {
for (const migration of migrations) await migration.execute();
}
async function compileMigrations() {
return migrations.map((m) => m.compile().sql).join(";\n\n") + ";";
}
return {
toBeCreated,
toBeAdded,
runMigrations,
compileMigrations
};
}
var db_exports = /* @__PURE__ */ __export({
convertFromDB: () => convertFromDB,
convertToDB: () => convertToDB,
createFieldAttribute: () => createFieldAttribute,
createInternalAdapter: () => createInternalAdapter,
getAdapter: () => getAdapter,
getBaseAdapter: () => getBaseAdapter,
getMigrations: () => getMigrations,
getSchema: () => getSchema,
getWithHooks: () => getWithHooks,
matchType: () => matchType,
mergeSchema: () => mergeSchema,
parseAccountInput: () => parseAccountInput,
parseAccountOutput: () => parseAccountOutput,
parseAdditionalUserInput: () => parseAdditionalUserInput,
parseInputData: () => parseInputData,
parseSessionInput: () => parseSessionInput,
parseSessionOutput: () => parseSessionOutput,
parseUserInput: () => parseUserInput,
parseUserOutput: () => parseUserOutput,
toZodSchema: () => toZodSchema
});
__reExport(db_exports, import___better_auth_core_db);
async function signJWT(payload, secret, expiresIn = 3600) {
return await new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + expiresIn).sign(new TextEncoder().encode(secret));
}
async function verifyJWT(token, secret) {
try {
return (await jwtVerify(token, new TextEncoder().encode(secret))).payload;
} catch {
return null;
}
}
const info = new Uint8Array([
66,
101,
116,
116,
101,
114,
65,
117,
116,
104,
46,
106,
115,
32,
71,
101,
110,
101,
114,
97,
116,
101,
100,
32,
69,
110,
99,
114,
121,
112,
116,
105,
111,
110,
32,
75,
101,
121
]);
const now = () => Date.now() / 1e3 | 0;
const alg = "dir";
const enc = "A256CBC-HS512";
async function symmetricEncodeJWT(payload, secret, salt, expiresIn = 3600) {
const encryptionSecret = hkdf(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(salt), info, 64);
const thumbprint = await calculateJwkThumbprint({
kty: "oct",
k: base64url.encode(encryptionSecret)
}, "sha256");
return await new EncryptJWT(payload).setProtectedHeader({
alg,
enc,
kid: thumbprint
}).setIssuedAt().setExpirationTime(now() + expiresIn).setJti(crypto.randomUUID()).encrypt(encryptionSecret);
}
async function symmetricDecodeJWT(token, secret, salt) {
if (!token) return null;
try {
const { payload } = await jwtDecrypt(token, async ({ kid }) => {
const encryptionSecret = hkdf(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(salt), info, 64);
if (kid === void 0) return encryptionSecret;
if (kid === await calculateJwkThumbprint({
kty: "oct",
k: base64url.encode(encryptionSecret)
}, "sha256")) return encryptionSecret;
throw new Error("no matching decryption secret");
}, {
clockTolerance: 15,
keyManagementAlgorithms: [alg],
contentEncryptionAlgorithms: [enc, "A256GCM"]
});
return payload;
} catch {
return null;
}
}
function constantTimeEqual(a, b) {
if (typeof a === "string") a = new TextEncoder().encode(a);
if (typeof b === "string") b = new TextEncoder().encode(b);
const aBuffer = new Uint8Array(a);
const bBuffer = new Uint8Array(b);
let c = aBuffer.length ^ bBuffer.length;
const length = Math.max(aBuffer.length, bBuffer.length);
for (let i = 0; i < length; i++) c |= (i < aBuffer.length ? aBuffer[i] : 0) ^ (i < bBuffer.length ? bBuffer[i] : 0);
return c === 0;
}
const config = {
N: 16384,
r: 16,
p: 1,
dkLen: 64
};
async function generateKey(password, salt) {
return await scryptAsync(password.normalize("NFKC"), salt, {
N: config.N,
p: config.p,
r: config.r,
dkLen: config.dkLen,
maxmem: 128 * config.N * config.r * 2
});
}
const hashPassword = async (password) => {
const salt = hex.encode(crypto.getRandomValues(new Uint8Array(16)));
const key = await generateKey(password, salt);
return `${salt}:${hex.encode(key)}`;
};
const verifyPassword$1 = async ({ hash, password }) => {
const [salt, key] = hash.split(":");
if (!salt || !key) throw new BetterAuthError("Invalid password hash");
return constantTimeEqual(await generateKey(password, salt), hexToBytes(key));
};
const generateRandomString = createRandomStringGenerator("a-z", "0-9", "A-Z", "-_");
const symmetricEncrypt = async ({ key, data }) => {
const keyAsBytes = await createHash("SHA-256").digest(key);
const dataAsBytes = utf8ToBytes(data);
return bytesToHex(managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes)).encrypt(dataAsBytes));
};
const symmetricDecrypt = async ({ key, data }) => {
const keyAsBytes = await createHash("SHA-256").digest(key);
const dataAsBytes = hexToBytes$1(data);
const chacha = managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes));
return new TextDecoder().decode(chacha.decrypt(dataAsBytes));
};
const ALLOWED_COOKIE_SIZE = 4096;
const ESTIMATED_EMPTY_COOKIE_SIZE = 200;
const CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
function parseCookiesFromContext(ctx) {
const cookieHeader = ctx.headers?.get("cookie");
if (!cookieHeader) return {};
const cookies = {};
const pairs = cookieHeader.split("; ");
for (const pair of pairs) {
const [name, ...valueParts] = pair.split("=");
if (name && valueParts.length > 0) cookies[name] = valueParts.join("=");
}
return cookies;
}
function getChunkIndex(cookieName) {
const parts = cookieName.split(".");
const lastPart = parts[parts.length - 1];
const index = parseInt(lastPart || "0", 10);
return isNaN(index) ? 0 : index;
}
function readExistingChunks(cookieName, ctx) {
const chunks = {};
const cookies = parseCookiesFromContext(ctx);
for (const [name, value] of Object.entries(cookies)) if (name.startsWith(cookieName)) chunks[name] = value;
return chunks;
}
function joinChunks(chunks) {
return Object.keys(chunks).sort((a, b) => {
return getChunkIndex(a) - getChunkIndex(b);
}).map((key) => chunks[key]).join("");
}
function chunkCookie(storeName, cookie, chunks, logger2) {
const chunkCount = Math.ceil(cookie.value.length / CHUNK_SIZE);
if (chunkCount === 1) {
chunks[cookie.name] = cookie.value;
return [cookie];
}
const cookies = [];
for (let i = 0; i < chunkCount; i++) {
const name = `${cookie.name}.${i}`;
const start = i * CHUNK_SIZE;
const value = cookie.value.substring(start, start + CHUNK_SIZE);
cookies.push({
...cookie,
name,
value
});
chunks[name] = value;
}
logger2.debug(`CHUNKING_${storeName.toUpperCase()}_COOKIE`, {
message: `${storeName} cookie exceeds allowed ${ALLOWED_COOKIE_SIZE} bytes.`,
emptyCookieSize: ESTIMATED_EMPTY_COOKIE_SIZE,
valueSize: cookie.value.length,
chunkCount,
chunks: cookies.map((c) => c.value.length + ESTIMATED_EMPTY_COOKIE_SIZE)
});
return cookies;
}
function getCleanCookies(chunks, cookieOptions) {
const cleanedChunks = {};
for (const name in chunks) cleanedChunks[name] = {
name,
value: "",
attributes: {
...cookieOptions,
maxAge: 0
}
};
return cleanedChunks;
}
const storeFactory = (storeName) => (cookieName, cookieOptions, ctx) => {
const chunks = readExistingChunks(cookieName, ctx);
const logger2 = ctx.context.logger;
return {
getValue() {
return joinChunks(chunks);
},
hasChunks() {
return Object.keys(chunks).length > 0;
},
chunk(value, options) {
const cleanedChunks = getCleanCookies(chunks, cookieOptions);
for (const name in chunks) delete chunks[name];
const cookies = cleanedChunks;
const chunked = chunkCookie(storeName, {
name: cookieName,
value,
attributes: {
...cookieOptions,
...options
}
}, chunks, logger2);
for (const chunk of chunked) cookies[chunk.name] = chunk;
return Object.values(cookies);
},
clean() {
const cleanedChunks = getCleanCookies(chunks, cookieOptions);
for (const name in chunks) delete chunks[name];
return Object.values(cleanedChunks);
},
setCookies(cookies) {
for (const cookie of cookies) ctx.setCookie(cookie.name, cookie.value, cookie.attributes);
}
};
};
const createSessionStore = storeFactory("Session");
const createAccountStore = storeFactory("Account");
function getChunkedCookie(ctx, cookieName) {
const value = ctx.getCookie(cookieName);
if (value) return value;
const chunks = [];
const cookieHeader = ctx.headers?.get("cookie");
if (!cookieHeader) return null;
const cookies = {};
const pairs = cookieHeader.split("; ");
for (const pair of pairs) {
const [name, ...valueParts] = pair.split("=");
if (name && valueParts.length > 0) cookies[name] = valueParts.join("=");
}
for (const [name, val] of Object.entries(cookies)) if (name.startsWith(cookieName + ".")) {
const indexStr = name.split(".").at(-1);
const index = parseInt(indexStr || "0", 10);
if (!isNaN(index)) chunks.push({
index,
value: val
});
}
if (chunks.length > 0) {
chunks.sort((a, b) => a.index - b.index);
return chunks.map((c) => c.value).join("");
}
return null;
}
async function setAccountCookie(c, accountData) {
const accountDataCookie = c.context.authCookies.accountData;
const options = {
maxAge: 300,
...accountDataCookie.attributes
};
const data = await symmetricEncodeJWT(accountData, c.context.secret, "better-auth-account", options.maxAge);
if (data.length > ALLOWED_COOKIE_SIZE) {
const accountStore = createAccountStore(accountDataCookie.name, options, c);
const cookies = accountStore.chunk(data, options);
accountStore.setCookies(cookies);
} else {
const accountStore = createAccountStore(accountDataCookie.name, options, c);
if (accountStore.hasChunks()) {
const cleanCookies = accountStore.clean();
accountStore.setCookies(cleanCookies);
}
c.setCookie(accountDataCookie.name, data, options);
}
}
async function getAccountCookie(c) {
const accountCookie = getChunkedCookie(c, c.context.authCookies.accountData.name);
if (accountCookie) {
const accountData = safeJSONParse(await symmetricDecodeJWT(accountCookie, c.context.secret, "better-auth-account"));
if (accountData) return accountData;
}
return null;
}
const getSessionQuerySchema = z.optional(z.object({
disableCookieCache: z.coerce.boolean().meta({ description: "Disable cookie cache and fetch session from database" }).optional(),
disableRefresh: z.coerce.boolean().meta({ description: "Disable session refresh. Useful for checking session status, without updating the session" }).optional()
}));
function isPromise(obj) {
return !!obj && (typeof obj === "object" || typeof obj === "function") && typeof obj.then === "function";
}
const SEC = 1e3;
const MIN = SEC * 60;
const HOUR = MIN * 60;
const DAY = HOUR * 24;
const WEEK = DAY * 7;
const MONTH = DAY * 30;
const YEAR = DAY * 365.25;
const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|months?|mo|years?|yrs?|y)(?: (ago|from now))?$/i;
function parse(value) {
const match = REGEX.exec(value);
if (!match || match[4] && match[1]) throw new TypeError(`Invalid time string format: "${value}". Use formats like "7d", "30m", "1 hour", etc.`);
const n = parseFloat(match[2]);
const unit = match[3].toLowerCase();
let result;
switch (unit) {
case "years":
case "year":
case "yrs":
case "yr":
case "y":
result = n * YEAR;
break;
case "months":
case "month":
case "mo":
result = n * MONTH;
break;
case "weeks":
case "week":
case "w":
result = n * WEEK;
break;
case "days":
case "day":
case "d":
result = n * DAY;
break;
case "hours":
case "hour":
case "hrs":
case "hr":
case "h":
result = n * HOUR;
break;
case "minutes":
case "minute":
case "mins":
case "min":
case "m":
result = n * MIN;
break;
case "seconds":
case "second":
case "secs":
case "sec":
case "s":
result = n * SEC;
break;
default:
throw new TypeError(`Unknown time unit: "${unit}"`);
}
if (match[1] === "-" || match[4] === "ago") return -result;
return result;
}
function ms(value) {
return parse(value);
}
function sec(value) {
return Math.round(parse(value) / 1e3);
}
const SECURE_COOKIE_PREFIX = "__Secure-";
function splitSetCookieHeader(setCookie) {
if (!setCookie) return [];
const result = [];
let current = "";
let i = 0;
while (i < setCookie.length) {
const c = setCookie[i];
if (c === ",") {
const lower = current.toLowerCase();
if (lower.includes("expires=") && !lower.includes("gmt")) {
current += c;
i++;
} else {
const trimmed$1 = current.trim();
if (trimmed$1) result.push(trimmed$1);
current = "";
i++;
if (i < setCookie.length && setCookie[i] === " ") i++;
}
continue;
}
current += c;
i++;
}
const trimmed = current.trim();
if (trimmed) result.push(trimmed);
return result;
}
function parseSetCookieHeader(setCookie) {
const cookies = /* @__PURE__ */ new Map();
splitSetCookieHeader(setCookie).forEach((cookieString) => {
const [nameValue, ...attributes] = cookieString.split(";").map((part) => part.trim());
const [name, ...valueParts] = (nameValue || "").split("=");
const value = valueParts.join("=");
if (!name || value === void 0) return;
const attrObj = { value };
attributes.forEach((attribute) => {
const [attrName, ...attrValueParts] = attribute.split("=");
const attrValue = attrValueParts.join("=");
const normalizedAttrName = attrName.trim().toLowerCase();
switch (normalizedAttrName) {
case "max-age":
attrObj["max-age"] = attrValue ? parseInt(attrValue.trim(), 10) : void 0;
break;
case "expires":
attrObj.expires = attrValue ? new Date(attrValue.trim()) : void 0;
break;
case "domain":
attrObj.domain = attrValue ? attrValue.trim() : void 0;
break;
case "path":
attrObj.path = attrValue ? attrValue.trim() : void 0;
break;
case "secure":
attrObj.secure = true;
break;
case "httponly":
attrObj.httponly = true;
break;
case "samesite":
attrObj.samesite = attrValue ? attrValue.trim().toLowerCase() : void 0;
break;
default:
attrObj[normalizedAttrName] = attrValue ? attrValue.trim() : true;
break;
}
});
cookies.set(name, attrObj);
});
return cookies;
}
function createCookieGetter(options) {
const secureCookiePrefix = (options.advanced?.useSecureCookies !== void 0 ? options.advanced?.useSecureCookies : options.baseURL ? options.baseURL.startsWith("https://") ? true : false : isProduction) ? SECURE_COOKIE_PREFIX : "";
const crossSubdomainEnabled = !!options.advanced?.crossSubDomainCookies?.enabled;
const domain = crossSubdomainEnabled ? options.advanced?.crossSubDomainCookies?.domain || (options.baseURL ? new URL(options.baseURL).hostname : void 0) : void 0;
if (crossSubdomainEnabled && !domain) throw new BetterAuthError("baseURL is required when crossSubdomainCookies are enabled");
function createCookie(cookieName, overrideAttributes = {}) {
const prefix = options.advanced?.cookiePrefix || "better-auth";
const name = options.advanced?.cookies?.[cookieName]?.name || `${prefix}.${cookieName}`;
const attributes = options.advanced?.cookies?.[cookieName]?.attributes;
return {
name: `${secureCookiePrefix}${name}`,
attributes: {
secure: !!secureCookiePrefix,
sameSite: "lax",
path: "/",
httpOnly: true,
...crossSubdomainEnabled ? { domain } : {},
...options.advanced?.defaultCookieAttributes,
...overrideAttributes,
...attributes
}
};
}
return createCookie;
}
function getCookies(options) {
const createCookie = createCookieGetter(options);
const sessionToken = createCookie("session_token", { maxAge: options.session?.expiresIn || sec("7d") });
const sessionData = createCookie("session_data", { maxAge: options.session?.cookieCache?.maxAge || 300 });
const accountData = createCookie("account_data", { maxAge: options.session?.cookieCache?.maxAge || 300 });
const dontRememberToken = createCookie("dont_remember");
return {
sessionToken: {
name: sessionToken.name,
attributes: sessionToken.attributes
},
sessionData: {
name: sessionData.name,
attributes: sessionData.attributes
},
dontRememberToken: {
name: dontRememberToken.name,
attributes: dontRememberToken.attributes
},
accountData: {
name: accountData.name,
attributes: accountData.attributes
}
};
}
async function setCookieCache(ctx, session, dontRememberMe) {
if (!ctx.context.options.session?.cookieCache?.enabled) return;
const filteredSession = filterOutputFields(session.session, ctx.context.options.session?.additionalFields);
const filteredUser = parseUserOutput(ctx.context.options, session.user);
const versionConfig = ctx.context.options.session?.cookieCache?.version;
let version = "1";
if (versionConfig) {
if (typeof versionConfig === "string") version = versionConfig;
else if (typeof versionConfig === "function") {
const result = versionConfig(session.session, session.user);
version = isPromise(result) ? await result : result;
}
}
const sessionData = {
session: filteredSession,
user: filteredUser,
updatedAt: Date.now(),
version
};
const options = {
...ctx.context.authCookies.sessionData.attributes,
maxAge: dontRememberMe ? void 0 : ctx.context.authCookies.sessionData.attributes.maxAge
};
const expiresAtDate = getDate(options.maxAge || 60, "sec").getTime();
const strategy = ctx.context.options.session?.cookieCache?.strategy || "compact";
let data;
if (strategy === "jwe") data = await symmetricEncodeJWT(sessionData, ctx.context.secret, "better-auth-session", options.maxAge || 300);
else if (strategy === "jwt") data = await signJWT(sessionData, ctx.context.secret, options.maxAge || 300);
else data = base64Url.encode(JSON.stringify({
session: sessionData,
expiresAt: expiresAtDate,
signature: await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, JSON.stringify({
...sessionData,
expiresAt: expiresAtDate
}))
}), { padding: false });
if (data.length > 4093) {
const sessionStore = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
const cookies = sessionStore.chunk(data, options);
sessionStore.setCookies(cookies);
} else {
const sessionStore = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
if (sessionStore.hasChunks()) {
const cleanCookies = sessionStore.clean();
sessionStore.setCookies(cleanCookies);
}
ctx.setCookie(ctx.context.authCookies.sessionData.name, data, options);
}
if (ctx.context.options.account?.storeAccountCookie) {
const accountData = await getAccountCookie(ctx);
if (accountData) await setAccountCookie(ctx, accountData);
}
}
async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
const dontRememberMeCookie = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);
dontRememberMe = dontRememberMe !== void 0 ? dontRememberMe : !!dontRememberMeCookie;
const options = ctx.context.authCookies.sessionToken.attributes;
const maxAge = dontRememberMe ? void 0 : ctx.context.sessionConfig.expiresIn;
await ctx.setSignedCookie(ctx.context.authCookies.sessionToken.name, session.session.token, ctx.context.secret, {
...options,
maxAge,
...overrides
});
if (dontRememberMe) await ctx.setSignedCookie(ctx.context.authCookies.dontRememberToken.name, "true", ctx.context.secret, ctx.context.authCookies.dontRememberToken.attributes);
await setCookieCache(ctx, session, dontRememberMe);
ctx.context.setNewSession(session);
}
function expireCookie(ctx, cookie) {
ctx.setCookie(cookie.name, "", {
...cookie.attributes,
maxAge: 0
});
}
function deleteSessionCookie(ctx, skipDontRememberMe) {
expireCookie(ctx, ctx.context.authCookies.sessionToken);
expireCookie(ctx, ctx.context.authCookies.sessionData);
if (ctx.context.options.account?.storeAccountCookie) {
expireCookie(ctx, ctx.context.authCookies.accountData);
const accountStore = createAccountStore(ctx.context.authCookies.accountData.name, ctx.context.authCookies.accountData.attributes, ctx);
const cleanCookies$1 = accountStore.clean();
accountStore.setCookies(cleanCookies$1);
}
if (ctx.context.oauthConfig.storeStateStrategy === "cookie") expireCookie(ctx, ctx.context.createAuthCookie("oauth_state"));
const sessionStore = createSessionStore(ctx.context.authCookies.sessionData.name, ctx.context.authCookies.sessionData.attributes, ctx);
const cleanCookies = sessionStore.clean();
sessionStore.setCookies(cleanCookies);
expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
}
const getSession = () => createAuthEndpoint("/get-session", {
method: "GET",
operationId: "getSession",
query: getSessionQuerySchema,
requireHeaders: true,
metadata: { openapi: {
operationId: "getSession",
description: "Get the current session",
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
nullable: true,
properties: {
session: { $ref: "#/components/schemas/Session" },
user: { $ref: "#/components/schemas/User" }
},
required: ["session", "user"]
} } }
} }
} }
}, async (ctx) => {
try {
const sessionCookieToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
if (!sessionCookieToken) return null;
const sessionDataCookie = getChunkedCookie(ctx, ctx.context.authCookies.sessionData.name);
let sessionDataPayload = null;
if (sessionDataCookie) {
const strategy = ctx.context.options.session?.cookieCache?.strategy || "compact";
if (strategy === "jwe") {
const payload = await symmetricDecodeJWT(sessionDataCookie, ctx.context.secret, "better-auth-session");
if (payload && payload.session && payload.user) sessionDataPayload = {
session: {
session: payload.session,
user: payload.user,
updatedAt: payload.updatedAt,
version: payload.version
},
expiresAt: payload.exp ? payload.exp * 1e3 : Date.now()
};
else {
expireCookie(ctx, ctx.context.authCookies.sessionData);
return ctx.json(null);
}
} else if (strategy === "jwt") {
const payload = await verifyJWT(sessionDataCookie, ctx.context.secret);
if (payload && payload.session && payload.user) sessionDataPayload = {
session: {
session: payload.session,
user: payload.user,
updatedAt: payload.updatedAt,
version: payload.version
},
expiresAt: payload.exp ? payload.exp * 1e3 : Date.now()
};
else {
expireCookie(ctx, ctx.context.authCookies.sessionData);
return ctx.json(null);
}
} else {
const parsed = safeJSONParse(binary.decode(base64Url.decode(sessionDataCookie)));
if (parsed) if (await createHMAC("SHA-256", "base64urlnopad").verify(ctx.context.secret, JSON.stringify({
...parsed.session,
expiresAt: parsed.expiresAt
}), parsed.signature)) sessionDataPayload = parsed;
else {
expireCookie(ctx, ctx.context.authCookies.sessionData);
return ctx.json(null);
}
}
}
const dontRememberMe = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);
if (sessionDataPayload?.session && ctx.context.options.session?.cookieCache?.enabled && !ctx.query?.disableCookieCache) {
const session$1 = sessionDataPayload.session;
const versionConfig = ctx.context.options.session?.cookieCache?.version;
let expectedVersion = "1";
if (versionConfig) {
if (typeof versionConfig === "string") expectedVersion = versionConfig;
else if (typeof versionConfig === "function") {
const result = versionConfig(session$1.session, session$1.user);
expectedVersion = result instanceof Promise ? await result : result;
}
}
if ((session$1.version || "1") !== expectedVersion) expireCookie(ctx, ctx.context.authCookies.sessionData);
else {
const cachedSessionExpiresAt = new Date(session$1.session.expiresAt);
if (sessionDataPayload.expiresAt < Date.now() || cachedSessionExpiresAt < /* @__PURE__ */ new Date()) expireCookie(ctx, ctx.context.authCookies.sessionData);
else {
const cookieRefreshCache = ctx.context.sessionConfig.cookieRefreshCache;
if (cookieRefreshCache === false) {
ctx.context.session = session$1;
const parsedSession$2 = parseSessionOutput(ctx.context.options, {
...session$1.session,
expiresAt: new Date(session$1.session.expiresAt),
createdAt: new Date(session$1.session.createdAt),
updatedAt: new Date(session$1.session.updatedAt)
});
const parsedUser$2 = parseUserOutput(ctx.context.options, {
...session$1.user,
createdAt: new Date(session$1.user.createdAt),
updatedAt: new Date(session$1.user.updatedAt)
});
return ctx.json({
session: parsedSession$2,
user: parsedUser$2
});
}
if (sessionDataPayload.expiresAt - Date.now() < cookieRefreshCache.updateAge * 1e3) {
const newExpiresAt = getDate(ctx.context.options.session?.cookieCache?.maxAge || 300, "sec");
const refreshedSession = {
session: {
...session$1.session,
expiresAt: newExpiresAt
},
user: session$1.user,
updatedAt: Date.now()
};
await setCookieCache(ctx, refreshedSession, false);
const parsedRefreshedSession = parseSessionOutput(ctx.context.options, {
...refreshedSession.session,
expiresAt: new Date(refreshedSession.session.expiresAt),
createdAt: new Date(refreshedSession.session.createdAt),
updatedAt: new Date(refreshedSession.session.updatedAt)
});
const parsedRefreshedUser = parseUserOutput(ctx.context.options, {
...refreshedSession.user,
createdAt: new Date(refreshedSession.user.createdAt),
updatedAt: new Date(refreshedSession.user.updatedAt)
});
ctx.context.session = {
session: parsedRefreshedSession,
user: parsedRefreshedUser
};
return ctx.json({
session: parsedRefreshedSession,
user: parsedRefreshedUser
});
}
const parsedSession$1 = parseSessionOutput(ctx.context.options, {
...session$1.session,
expiresAt: new Date(session$1.session.expiresAt),
createdAt: new Date(session$1.session.createdAt),
updatedAt: new Date(session$1.session.updatedAt)
});
const parsedUser$1 = parseUserOutput(ctx.context.options, {
...session$1.user,
createdAt: new Date(session$1.user.createdAt),
updatedAt: new Date(session$1.user.updatedAt)
});
ctx.context.session = {
session: parsedSession$1,
user: parsedUser$1
};
return ctx.json({
session: parsedSession$1,
user: parsedUser$1
});
}
}
}
const session = await ctx.context.internalAdapter.findSession(sessionCookieToken);
ctx.context.session = session;
if (!session || session.session.expiresAt < /* @__PURE__ */ new Date()) {
deleteSessionCookie(ctx);
if (session)
await ctx.context.internalAdapter.deleteSession(session.session.token);
return ctx.json(null);
}
if (dontRememberMe || ctx.query?.disableRefresh) {
const parsedSession$1 = parseSessionOutput(ctx.context.options, session.session);
const parsedUser$1 = parseUserOutput(ctx.context.options, session.user);
return ctx.json({
session: parsedSession$1,
user: parsedUser$1
});
}
const expiresIn = ctx.context.sessionConfig.expiresIn;
const updateAge = ctx.context.sessionConfig.updateAge;
if (session.session.expiresAt.valueOf() - expiresIn * 1e3 + updateAge * 1e3 <= Date.now() && (!ctx.query?.disableRefresh || !ctx.context.options.session?.disableSessionRefresh)) {
const updatedSession = await ctx.context.internalAdapter.updateSession(session.session.token, {
expiresAt: getDate(ctx.context.sessionConfig.expiresIn, "sec"),
updatedAt: /* @__PURE__ */ new Date()
});
if (!updatedSession) {
deleteSessionCookie(ctx);
return ctx.json(null, { status: 401 });
}
const maxAge = (updatedSession.expiresAt.valueOf() - Date.now()) / 1e3;
await setSessionCookie(ctx, {
session: updatedSession,
user: session.user
}, false, { maxAge });
const parsedUpdatedSession = parseSessionOutput(ctx.context.options, updatedSession);
const parsedUser$1 = parseUserOutput(ctx.context.options, session.user);
return ctx.json({
session: parsedUpdatedSession,
user: parsedUser$1
});
}
await setCookieCache(ctx, session, !!dontRememberMe);
const parsedSession = parseSessionOutput(ctx.context.options, session.session);
const parsedUser = parseUserOutput(ctx.context.options, session.user);
return ctx.json({
session: parsedSession,
user: parsedUser
});
} catch (error2) {
ctx.context.logger.error("INTERNAL_SERVER_ERROR", error2);
throw new APIError("INTERNAL_SERVER_ERROR", { message: BASE_ERROR_CODES.FAILED_TO_GET_SESSION });
}
});
const getSessionFromCtx = async (ctx, config2) => {
if (ctx.context.session) return ctx.context.session;
const session = await getSession()({
...ctx,
asResponse: false,
headers: ctx.headers,
returnHeaders: false,
returnStatus: false,
query: {
...config2,
...ctx.query
}
}).catch((e) => {
return null;
});
ctx.context.session = session;
return session;
};
const sessionMiddleware = createAuthMiddleware(async (ctx) => {
const session = await getSessionFromCtx(ctx);
if (!session?.session) throw new APIError("UNAUTHORIZED");
return { session };
});
const sensitiveSessionMiddleware = createAuthMiddleware(async (ctx) => {
const session = await getSessionFromCtx(ctx, { disableCookieCache: true });
if (!session?.session) throw new APIError("UNAUTHORIZED");
return { session };
});
createAuthMiddleware(async (ctx) => {
const session = await getSessionFromCtx(ctx);
if (!session?.session && (ctx.request || ctx.headers)) throw new APIError("UNAUTHORIZED");
return { session };
});
const freshSessionMiddleware = createAuthMiddleware(async (ctx) => {
const session = await getSessionFromCtx(ctx);
if (!session?.session) throw new APIError("UNAUTHORIZED");
if (ctx.context.sessionConfig.freshAge === 0) return { session };
const freshAge = ctx.context.sessionConfig.freshAge;
const lastUpdated = new Date(session.session.updatedAt || session.session.createdAt).getTime();
if (!(Date.now() - lastUpdated < freshAge * 1e3)) throw new APIError("FORBIDDEN", { message: "Session is not fresh" });
return { session };
});
const listSessions = () => createAuthEndpoint("/list-sessions", {
method: "GET",
operationId: "listUserSessions",
use: [sessionMiddleware],
requireHeaders: true,
metadata: { openapi: {
operationId: "listUserSessions",
description: "List all active sessions for the user",
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "array",
items: { $ref: "#/components/schemas/Session" }
} } }
} }
} }
}, async (ctx) => {
try {
const activeSessions = (await ctx.context.internalAdapter.listSessions(ctx.context.session.user.id)).filter((session) => {
return session.expiresAt > /* @__PURE__ */ new Date();
});
return ctx.json(activeSessions.map((session) => parseSessionOutput(ctx.context.options, session)));
} catch (e) {
ctx.context.logger.error(e);
throw ctx.error("INTERNAL_SERVER_ERROR");
}
});
const revokeSession = createAuthEndpoint("/revoke-session", {
method: "POST",
body: z.object({ token: z.string().meta({ description: "The token to revoke" }) }),
use: [sensitiveSessionMiddleware],
requireHeaders: true,
metadata: { openapi: {
description: "Revoke a single session",
requestBody: { content: { "application/json": { schema: {
type: "object",
properties: { token: {
type: "string",
description: "The token to revoke"
} },
required: ["token"]
} } } },
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
properties: { status: {
type: "boolean",
description: "Indicates if the session was revoked successfully"
} },
required: ["status"]
} } }
} }
} }
}, async (ctx) => {
const token = ctx.body.token;
if ((await ctx.context.internalAdapter.findSession(token))?.session.userId === ctx.context.session.user.id) try {
await ctx.context.internalAdapter.deleteSession(token);
} catch (error2) {
ctx.context.logger.error(error2 && typeof error2 === "object" && "name" in error2 ? error2.name : "", error2);
throw new APIError("INTERNAL_SERVER_ERROR");
}
return ctx.json({ status: true });
});
const revokeSessions = createAuthEndpoint("/revoke-sessions", {
method: "POST",
use: [sensitiveSessionMiddleware],
requireHeaders: true,
metadata: { openapi: {
description: "Revoke all sessions for the user",
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
properties: { status: {
type: "boolean",
description: "Indicates if all sessions were revoked successfully"
} },
required: ["status"]
} } }
} }
} }
}, async (ctx) => {
try {
await ctx.context.internalAdapter.deleteSessions(ctx.context.session.user.id);
} catch (error2) {
ctx.context.logger.error(error2 && typeof error2 === "object" && "name" in error2 ? error2.name : "", error2);
throw new APIError("INTERNAL_SERVER_ERROR");
}
return ctx.json({ status: true });
});
const revokeOtherSessions = createAuthEndpoint("/revoke-other-sessions", {
method: "POST",
requireHeaders: true,
use: [sensitiveSessionMiddleware],
metadata: { openapi: {
description: "Revoke all other sessions for the user except the current one",
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
properties: { status: {
type: "boolean",
description: "Indicates if all other sessions were revoked successfully"
} },
required: ["status"]
} } }
} }
} }
}, async (ctx) => {
const session = ctx.context.session;
if (!session.user) throw new APIError("UNAUTHORIZED");
const otherSessions = (await ctx.context.internalAdapter.listSessions(session.user.id)).filter((session$1) => {
return session$1.expiresAt > /* @__PURE__ */ new Date();
}).filter((session$1) => session$1.token !== ctx.context.session.session.token);
await Promise.all(otherSessions.map((session$1) => ctx.context.internalAdapter.deleteSession(session$1.token)));
return ctx.json({ status: true });
});
const stateDataSchema = z.looseObject({
callbackURL: z.string(),
codeVerifier: z.string(),
errorURL: z.string().optional(),
newUserURL: z.string().optional(),
expiresAt: z.number(),
link: z.object({
email: z.string(),
userId: z.coerce.string()
}).optional(),
requestSignUp: z.boolean().optional()
});
var StateError = class extends BetterAuthError {
code;
details;
constructor(message, options) {
super(message, options);
this.code = options.code;
this.details = options.details;
}
};
async function generateGenericState(c, stateData, settings) {
const state = generateRandomString(32);
if (c.context.oauthConfig.storeStateStrategy === "cookie") {
const encryptedData = await symmetricEncrypt({
key: c.context.secret,
data: JSON.stringify(stateData)
});
const stateCookie$1 = c.context.createAuthCookie("oauth_state", { maxAge: 600 });
c.setCookie(stateCookie$1.name, encryptedData, stateCookie$1.attributes);
return {
state,
codeVerifier: stateData.codeVerifier
};
}
const stateCookie = c.context.createAuthCookie("state", { maxAge: 300 });
await c.setSignedCookie(stateCookie.name, state, c.context.secret, stateCookie.attributes);
const expiresAt = /* @__PURE__ */ new Date();
expiresAt.setMinutes(expiresAt.getMinutes() + 10);
const verification = await c.context.internalAdapter.createVerificationValue({
value: JSON.stringify(stateData),
identifier: state,
expiresAt
});
if (!verification) throw new StateError("Unable to create verification. Make sure the database adapter is properly working and there is a verification table in the database", { code: "state_generation_error" });
return {
state: verification.identifier,
codeVerifier: stateData.codeVerifier
};
}
async function parseGenericState(c, state, settings) {
const storeStateStrategy = c.context.oauthConfig.storeStateStrategy;
let parsedData;
if (storeStateStrategy === "cookie") {
const stateCookie = c.context.createAuthCookie("oauth_state");
const encryptedData = c.getCookie(stateCookie.name);
if (!encryptedData) throw new StateError("State mismatch: auth state cookie not found", {
code: "state_mismatch",
details: { state }
});
try {
const decryptedData = await symmetricDecrypt({
key: c.context.secret,
data: encryptedData
});
parsedData = stateDataSchema.parse(JSON.parse(decryptedData));
} catch (error2) {
throw new StateError("State invalid: Failed to decrypt or parse auth state", {
code: "state_invalid",
details: { state },
cause: error2
});
}
expireCookie(c, stateCookie);
} else {
const data = await c.context.internalAdapter.findVerificationValue(state);
if (!data) throw new StateError("State mismatch: verification not found", {
code: "state_mismatch",
details: { state }
});
parsedData = stateDataSchema.parse(JSON.parse(data.value));
const stateCookie = c.context.createAuthCookie("state");
const stateCookieValue = await c.getSignedCookie(stateCookie.name, c.context.secret);
if (!c.context.oauthConfig.skipStateCookieCheck && (!stateCookieValue || stateCookieValue !== state)) throw new StateError("State mismatch: State not persisted correctly", {
code: "state_security_mismatch",
details: { state }
});
expireCookie(c, stateCookie);
await c.context.internalAdapter.deleteVerificationValue(data.id);
}
if (parsedData.expiresAt < Date.now()) throw new StateError("Invalid state: request expired", {
code: "state_mismatch",
details: { expiresAt: parsedData.expiresAt }
});
return parsedData;
}
async function generateState(c, link, additionalData) {
const callbackURL = c.body?.callbackURL || c.context.options.baseURL;
if (!callbackURL) throw new APIError("BAD_REQUEST", { message: "callbackURL is required" });
const codeVerifier = generateRandomString(128);
const stateData = {
...additionalData ? additionalData : {},
callbackURL,
codeVerifier,
errorURL: c.body?.errorCallbackURL,
newUserURL: c.body?.newUserCallbackURL,
link,
expiresAt: Date.now() + 600 * 1e3,
requestSignUp: c.body?.requestSignUp
};
await setOAuthState(stateData);
try {
return generateGenericState(c, stateData);
} catch (error2) {
c.context.logger.error("Failed to create verification", error2);
throw new APIError("INTERNAL_SERVER_ERROR", {
message: "Unable to create verification",
cause: error2
});
}
}
async function parseState(c) {
const state = c.query.state || c.body.state;
const errorURL = c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`;
let parsedData;
try {
parsedData = await parseGenericState(c, state);
} catch (error2) {
c.context.logger.error("Failed to parse state", error2);
if (error2 instanceof StateError && error2.code === "state_security_mismatch") throw c.redirect(`${errorURL}?error=state_mismatch`);
throw c.redirect(`${errorURL}?error=please_restart_the_process`);
}
if (!parsedData.errorURL) parsedData.errorURL = errorURL;
if (parsedData) await setOAuthState(parsedData);
return parsedData;
}
function decryptOAuthToken(token, ctx) {
if (!token) return token;
if (ctx.options.account?.encryptOAuthTokens) return symmetricDecrypt({
key: ctx.secret,
data: token
});
return token;
}
function setTokenUtil(token, ctx) {
if (ctx.options.account?.encryptOAuthTokens && token) return symmetricEncrypt({
key: ctx.secret,
data: token
});
return token;
}
const listUserAccounts = createAuthEndpoint("/list-accounts", {
method: "GET",
use: [sessionMiddleware],
metadata: { openapi: {
operationId: "listUserAccounts",
description: "List all accounts linked to the user",
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "array",
items: {
type: "object",
properties: {
id: { type: "string" },
providerId: { type: "string" },
createdAt: {
type: "string",
format: "date-time"
},
updatedAt: {
type: "string",
format: "date-time"
},
accountId: { type: "string" },
userId: { type: "string" },
scopes: {
type: "array",
items: { type: "string" }
}
},
required: [
"id",
"providerId",
"createdAt",
"updatedAt",
"accountId",
"userId",
"scopes"
]
}
} } }
} }
} }
}, async (c) => {
const session = c.context.session;
const accounts = await c.context.internalAdapter.findAccounts(session.user.id);
return c.json(accounts.map((a) => {
const { scope, ...parsed } = parseAccountOutput(c.context.options, a);
return {
...parsed,
scopes: scope?.split(",") || []
};
}));
});
const linkSocialAccount = createAuthEndpoint("/link-social", {
method: "POST",
requireHeaders: true,
body: z.object({
callbackURL: z.string().meta({ description: "The URL to redirect to after the user has signed in" }).optional(),
provider: SocialProviderListEnum,
idToken: z.object({
token: z.string(),
nonce: z.string().optional(),
accessToken: z.string().optional(),
refreshToken: z.string().optional(),
scopes: z.array(z.string()).optional()
}).optional(),
requestSignUp: z.boolean().optional(),
scopes: z.array(z.string()).meta({ description: "Additional scopes to request from the provider" }).optional(),
errorCallbackURL: z.string().meta({ description: "The URL to redirect to if there is an error during the link process" }).optional(),
disableRedirect: z.boolean().meta({ description: "Disable automatic redirection to the provider. Useful for handling the redirection yourself" }).optional(),
additionalData: z.record(z.string(), z.any()).optional()
}),
use: [sessionMiddleware],
metadata: { openapi: {
description: "Link a social account to the user",
operationId: "linkSocialAccount",
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
properties: {
url: {
type: "string",
description: "The authorization URL to redirect the user to"
},
redirect: {
type: "boolean",
description: "Indicates if the user should be redirected to the authorization URL"
},
status: { type: "boolean" }
},
required: ["redirect"]
} } }
} }
} }
}, async (c) => {
const session = c.context.session;
const provider = c.context.socialProviders.find((p) => p.id === c.body.provider);
if (!provider) {
c.context.logger.error("Provider not found. Make sure to add the provider in your auth config", { provider: c.body.provider });
throw new APIError("NOT_FOUND", { message: BASE_ERROR_CODES.PROVIDER_NOT_FOUND });
}
if (c.body.idToken) {
if (!provider.verifyIdToken) {
c.context.logger.error("Provider does not support id token verification", { provider: c.body.provider });
throw new APIError("NOT_FOUND", { message: BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED });
}
const { token, nonce } = c.body.idToken;
if (!await provider.verifyIdToken(token, nonce)) {
c.context.logger.error("Invalid id token", { provider: c.body.provider });
throw new APIError("UNAUTHORIZED", { message: BASE_ERROR_CODES.INVALID_TOKEN });
}
const linkingUserInfo = await provider.getUserInfo({
idToken: token,
accessToken: c.body.idToken.accessToken,
refreshToken: c.body.idToken.refreshToken
});
if (!linkingUserInfo || !linkingUserInfo?.user) {
c.context.logger.error("Failed to get user info", { provider: c.body.provider });
throw new APIError("UNAUTHORIZED", { message: BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO });
}
const linkingUserId = String(linkingUserInfo.user.id);
if (!linkingUserInfo.user.email) {
c.context.logger.error("User email not found", { provider: c.body.provider });
throw new APIError("UNAUTHORIZED", { message: BASE_ERROR_CODES.USER_EMAIL_NOT_FOUND });
}
if ((await c.context.internalAdapter.findAccounts(session.user.id)).find((a) => a.providerId === provider.id && a.accountId === linkingUserId)) return c.json({
url: "",
status: true,
redirect: false
});
if (!c.context.options.account?.accountLinking?.trustedProviders?.includes(provider.id) && !linkingUserInfo.user.emailVerified || c.context.options.account?.accountLinking?.enabled === false) throw new APIError("UNAUTHORIZED", { message: "Account not linked - linking not allowed" });
if (linkingUserInfo.user.email?.toLowerCase() !== session.user.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) throw new APIError("UNAUTHORIZED", { message: "Account not linked - different emails not allowed" });
try {
await c.context.internalAdapter.createAccount({
userId: session.user.id,
providerId: provider.id,
accountId: linkingUserId,
accessToken: c.body.idToken.accessToken,
idToken: token,
refreshToken: c.body.idToken.refreshToken,
scope: c.body.idToken.scopes?.join(",")
});
} catch {
throw new APIError("EXPECTATION_FAILED", { message: "Account not linked - unable to create account" });
}
if (c.context.options.account?.accountLinking?.updateUserInfoOnLink === true) try {
await c.context.internalAdapter.updateUser(session.user.id, {
name: linkingUserInfo.user?.name,
image: linkingUserInfo.user?.image
});
} catch (e) {
console.warn("Could not update user - " + e.toString());
}
return c.json({
url: "",
status: true,
redirect: false
});
}
const state = await generateState(c, {
userId: session.user.id,
email: session.user.email
}, c.body.additionalData);
const url = await provider.createAuthorizationURL({
state: state.state,
codeVerifier: state.codeVerifier,
redirectURI: `${c.context.baseURL}/callback/${provider.id}`,
scopes: c.body.scopes
});
if (!c.body.disableRedirect) c.setHeader("Location", url.toString());
return c.json({
url: url.toString(),
redirect: !c.body.disableRedirect
});
});
const unlinkAccount = createAuthEndpoint("/unlink-account", {
method: "POST",
body: z.object({
providerId: z.string(),
accountId: z.string().optional()
}),
use: [freshSessionMiddleware],
metadata: { openapi: {
description: "Unlink an account",
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
properties: { status: { type: "boolean" } }
} } }
} }
} }
}, async (ctx) => {
const { providerId, accountId } = ctx.body;
const accounts = await ctx.context.internalAdapter.findAccounts(ctx.context.session.user.id);
if (accounts.length === 1 && !ctx.context.options.account?.accountLinking?.allowUnlinkingAll) throw new APIError("BAD_REQUEST", { message: BASE_ERROR_CODES.FAILED_TO_UNLINK_LAST_ACCOUNT });
const accountExist = accounts.find((account) => accountId ? account.accountId === accountId && account.providerId === providerId : account.providerId === providerId);
if (!accountExist) throw new APIError("BAD_REQUEST", { message: BASE_ERROR_CODES.ACCOUNT_NOT_FOUND });
await ctx.context.internalAdapter.deleteAccount(accountExist.id);
return ctx.json({ status: true });
});
const getAccessToken = createAuthEndpoint("/get-access-token", {
method: "POST",
body: z.object({
providerId: z.string().meta({ description: "The provider ID for the OAuth provider" }),
accountId: z.string().meta({ description: "The account ID associated with the refresh token" }).optional(),
userId: z.string().meta({ description: "The user ID associated with the account" }).optional()
}),
metadata: { openapi: {
description: "Get a valid access token, doing a refresh if needed",
responses: {
200: {
description: "A Valid access token",
content: { "application/json": { schema: {
type: "object",
properties: {
tokenType: { type: "string" },
idToken: { type: "string" },
accessToken: { type: "string" },
accessTokenExpiresAt: {
type: "string",
format: "date-time"
}
}
} } }
},
400: { description: "Invalid refresh token or provider configuration" }
}
} }
}, async (ctx) => {
const { providerId, accountId, userId } = ctx.body || {};
const req = ctx.request;
const session = await getSessionFromCtx(ctx);
if (req && !session) throw ctx.error("UNAUTHORIZED");
const resolvedUserId = session?.user?.id || userId;
if (!resolvedUserId) throw ctx.error("UNAUTHORIZED");
if (!ctx.context.socialProviders.find((p) => p.id === providerId)) throw new APIError("BAD_REQUEST", { message: `Provider ${providerId} is not supported.` });
const accountData = await getAccountCookie(ctx);
let account = void 0;
if (accountData && providerId === accountData.providerId && (!accountId || accountData.id === accountId)) account = accountData;
else account = (await ctx.context.internalAdapter.findAccounts(resolvedUserId)).find((acc) => accountId ? acc.id === accountId && acc.providerId === providerId : acc.providerId === providerId);
if (!account) throw new APIError("BAD_REQUEST", { message: "Account not found" });
const provider = ctx.context.socialProviders.find((p) => p.id === providerId);
if (!provider) throw new APIError("BAD_REQUEST", { message: `Provider ${providerId} not found.` });
try {
let newTokens = null;
const accessTokenExpired = account.accessTokenExpiresAt && new Date(account.accessTokenExpiresAt).getTime() - Date.now() < 5e3;
if (account.refreshToken && accessTokenExpired && provider.refreshAccessToken) {
const refreshToken$1 = await decryptOAuthToken(account.refreshToken, ctx.context);
newTokens = await provider.refreshAccessToken(refreshToken$1);
const updatedData = {
accessToken: await setTokenUtil(newTokens.accessToken, ctx.context),
accessTokenExpiresAt: newTokens.accessTokenExpiresAt,
refreshToken: await setTokenUtil(newTokens.refreshToken, ctx.context),
refreshTokenExpiresAt: newTokens.refreshTokenExpiresAt
};
let updatedAccount = null;
if (account.id) updatedAccount = await ctx.context.internalAdapter.updateAccount(account.id, updatedData);
if (ctx.context.options.account?.storeAccountCookie) await setAccountCookie(ctx, {
...account,
...updatedAccount ?? updatedData
});
}
const accessTokenExpiresAt = (() => {
if (newTokens?.accessTokenExpiresAt) {
if (typeof newTokens.accessTokenExpiresAt === "string") return new Date(newTokens.accessTokenExpiresAt);
return newTokens.accessTokenExpiresAt;
}
if (account.accessTokenExpiresAt) {
if (typeof account.accessTokenExpiresAt === "string") return new Date(account.accessTokenExpiresAt);
return account.accessTokenExpiresAt;
}
})();
const tokens = {
accessToken: newTokens?.accessToken ?? await decryptOAuthToken(account.accessToken ?? "", ctx.context),
accessTokenExpiresAt,
scopes: account.scope?.split(",") ?? [],
idToken: newTokens?.idToken ?? account.idToken ?? void 0
};
return ctx.json(tokens);
} catch (error2) {
throw new APIError("BAD_REQUEST", {
message: "Failed to get a valid access token",
cause: error2
});
}
});
const refreshToken = createAuthEndpoint("/refresh-token", {
method: "POST",
body: z.object({
providerId: z.string().meta({ description: "The provider ID for the OAuth provider" }),
accountId: z.string().meta({ description: "The account ID associated with the refresh token" }).optional(),
userId: z.string().meta({ description: "The user ID associated with the account" }).optional()
}),
metadata: { openapi: {
description: "Refresh the access token using a refresh token",
responses: {
200: {
description: "Access token refreshed successfully",
content: { "application/json": { schema: {
type: "object",
properties: {
tokenType: { type: "string" },
idToken: { type: "string" },
accessToken: { type: "string" },
refreshToken: { type: "string" },
accessTokenExpiresAt: {
type: "string",
format: "date-time"
},
refreshTokenExpiresAt: {
type: "string",
format: "date-time"
}
}
} } }
},
400: { description: "Invalid refresh token or provider configuration" }
}
} }
}, async (ctx) => {
const { providerId, accountId, userId } = ctx.body;
const req = ctx.request;
const session = await getSessionFromCtx(ctx);
if (req && !session) throw ctx.error("UNAUTHORIZED");
const resolvedUserId = session?.user?.id || userId;
if (!resolvedUserId) throw new APIError("BAD_REQUEST", { message: `Either userId or session is required` });
const provider = ctx.context.socialProviders.find((p) => p.id === providerId);
if (!provider) throw new APIError("BAD_REQUEST", { message: `Provider ${providerId} not found.` });
if (!provider.refreshAccessToken) throw new APIError("BAD_REQUEST", { message: `Provider ${providerId} does not support token refreshing.` });
let account = void 0;
const accountData = await getAccountCookie(ctx);
if (accountData && (!providerId || providerId === accountData?.providerId)) account = accountData;
else account = (await ctx.context.internalAdapter.findAccounts(resolvedUserId)).find((acc) => accountId ? acc.id === accountId && acc.providerId === providerId : acc.providerId === providerId);
if (!account) throw new APIError("BAD_REQUEST", { message: "Account not found" });
let refreshToken$1 = void 0;
if (accountData && providerId === accountData.providerId) refreshToken$1 = accountData.refreshToken ?? void 0;
else refreshToken$1 = account.refreshToken ?? void 0;
if (!refreshToken$1) throw new APIError("BAD_REQUEST", { message: "Refresh token not found" });
try {
const decryptedRefreshToken = await decryptOAuthToken(refreshToken$1, ctx.context);
const tokens = await provider.refreshAccessToken(decryptedRefreshToken);
if (account.id) {
const updateData = {
...account || {},
accessToken: await setTokenUtil(tokens.accessToken, ctx.context),
refreshToken: await setTokenUtil(tokens.refreshToken, ctx.context),
accessTokenExpiresAt: tokens.accessTokenExpiresAt,
refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
scope: tokens.scopes?.join(",") || account.scope,
idToken: tokens.idToken || account.idToken
};
await ctx.context.internalAdapter.updateAccount(account.id, updateData);
}
if (accountData && providerId === accountData.providerId && ctx.context.options.account?.storeAccountCookie) await setAccountCookie(ctx, {
...accountData,
accessToken: await setTokenUtil(tokens.accessToken, ctx.context),
refreshToken: await setTokenUtil(tokens.refreshToken, ctx.context),
accessTokenExpiresAt: tokens.accessTokenExpiresAt,
refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
scope: tokens.scopes?.join(",") || accountData.scope,
idToken: tokens.idToken || accountData.idToken
});
return ctx.json({
accessToken: tokens.accessToken,
refreshToken: tokens.refreshToken,
accessTokenExpiresAt: tokens.accessTokenExpiresAt,
refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
scope: tokens.scopes?.join(",") || account.scope,
idToken: tokens.idToken || account.idToken,
providerId: account.providerId,
accountId: account.accountId
});
} catch (error2) {
throw new APIError("BAD_REQUEST", {
message: "Failed to refresh access token",
cause: error2
});
}
});
const accountInfoQuerySchema = z.optional(z.object({ accountId: z.string().meta({ description: "The provider given account id for which to get the account info" }).optional() }));
const accountInfo = createAuthEndpoint("/account-info", {
method: "GET",
use: [sessionMiddleware],
metadata: { openapi: {
description: "Get the account info provided by the provider",
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
properties: {
user: {
type: "object",
properties: {
id: { type: "string" },
name: { type: "string" },
email: { type: "string" },
image: { type: "string" },
emailVerified: { type: "boolean" }
},
required: ["id", "emailVerified"]
},
data: {
type: "object",
properties: {},
additionalProperties: true
}
},
required: ["user", "data"],
additionalProperties: false
} } }
} }
} },
query: accountInfoQuerySchema
}, async (ctx) => {
const providedAccountId = ctx.query?.accountId;
let account = void 0;
if (!providedAccountId) {
if (ctx.context.options.account?.storeAccountCookie) {
const accountData = await getAccountCookie(ctx);
if (accountData) account = accountData;
}
} else {
const accountData = await ctx.context.internalAdapter.findAccount(providedAccountId);
if (accountData) account = accountData;
}
if (!account || account.userId !== ctx.context.session.user.id) throw new APIError("BAD_REQUEST", { message: "Account not found" });
const provider = ctx.context.socialProviders.find((p) => p.id === account.providerId);
if (!provider) throw new APIError("INTERNAL_SERVER_ERROR", { message: `Provider account provider is ${account.providerId} but it is not configured` });
const tokens = await getAccessToken({
...ctx,
method: "POST",
body: {
accountId: account.id,
providerId: account.providerId
},
returnHeaders: false,
returnStatus: false
});
if (!tokens.accessToken) throw new APIError("BAD_REQUEST", { message: "Access token not found" });
const info2 = await provider.getUserInfo({
...tokens,
accessToken: tokens.accessToken
});
return ctx.json(info2);
});
async function createEmailVerificationToken(secret, email, updateTo, expiresIn = 3600, extraPayload) {
return await signJWT({
email: email.toLowerCase(),
updateTo,
...extraPayload
}, secret, expiresIn);
}
async function sendVerificationEmailFn(ctx, user) {
if (!ctx.context.options.emailVerification?.sendVerificationEmail) {
ctx.context.logger.error("Verification email isn't enabled.");
throw new APIError("BAD_REQUEST", { message: "Verification email isn't enabled" });
}
const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
user,
url,
token
}, ctx.request));
}
const sendVerificationEmail = createAuthEndpoint("/send-verification-email", {
method: "POST",
operationId: "sendVerificationEmail",
body: z.object({
email: z.email().meta({ description: "The email to send the verification email to" }),
callbackURL: z.string().meta({ description: "The URL to use for email verification callback" }).optional()
}),
metadata: { openapi: {
operationId: "sendVerificationEmail",
description: "Send a verification email to the user",
requestBody: { content: { "application/json": { schema: {
type: "object",
properties: {
email: {
type: "string",
description: "The email to send the verification email to",
example: "user@example.com"
},
callbackURL: {
type: "string",
description: "The URL to use for email verification callback",
example: "https://example.com/callback",
nullable: true
}
},
required: ["email"]
} } } },
responses: {
"200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
properties: { status: {
type: "boolean",
description: "Indicates if the email was sent successfully",
example: true
} }
} } }
},
"400": {
description: "Bad Request",
content: { "application/json": { schema: {
type: "object",
properties: { message: {
type: "string",
description: "Error message",
example: "Verification email isn't enabled"
} }
} } }
}
}
} }
}, async (ctx) => {
if (!ctx.context.options.emailVerification?.sendVerificationEmail) {
ctx.context.logger.error("Verification email isn't enabled.");
throw new APIError("BAD_REQUEST", { message: "Verification email isn't enabled" });
}
const { email } = ctx.body;
const session = await getSessionFromCtx(ctx);
if (!session) {
const user = await ctx.context.internalAdapter.findUserByEmail(email);
if (!user || user.user.emailVerified) {
await createEmailVerificationToken(ctx.context.secret, email, void 0, ctx.context.options.emailVerification?.expiresIn);
return ctx.json({ status: true });
}
await sendVerificationEmailFn(ctx, user.user);
return ctx.json({ status: true });
}
if (session?.user.email !== email) throw new APIError("BAD_REQUEST", { message: BASE_ERROR_CODES.EMAIL_MISMATCH });
if (session?.user.emailVerified) throw new APIError("BAD_REQUEST", { message: BASE_ERROR_CODES.EMAIL_ALREADY_VERIFIED });
await sendVerificationEmailFn(ctx, session.user);
return ctx.json({ status: true });
});
const verifyEmail = createAuthEndpoint("/verify-email", {
method: "GET",
operationId: "verifyEmail",
query: z.object({
token: z.string().meta({ description: "The token to verify the email" }),
callbackURL: z.string().meta({ description: "The URL to redirect to after email verification" }).optional()
}),
use: [originCheck((ctx) => ctx.query.callbackURL)],
metadata: { openapi: {
description: "Verify the email of the user",
parameters: [{
name: "token",
in: "query",
description: "The token to verify the email",
required: true,
schema: { type: "string" }
}, {
name: "callbackURL",
in: "query",
description: "The URL to redirect to after email verification",
required: false,
schema: { type: "string" }
}],
responses: { "200": {
description: "Success",
content: { "application/json": { schema: {
type: "object",
properties: {
user: {
type: "object",
$ref: "#/components/schemas/User"
},
status: {
type: "boolean",
description: "Indicates if the email was verified successfully"
}
},
required: ["user", "status"]
} } }
} }
} }
}, async (ctx) => {
function redirectOnError(error2) {
if (ctx.query.callbackURL) {
if (ctx.query.callbackURL.includes("?")) throw ctx.redirect(`${ctx.query.callbackURL}&error=${error2}`);
throw ctx.redirect(`${ctx.query.callbackURL}?error=${error2}`);
}
throw new APIError("UNAUTHORIZED", { message: error2 });
}
const { token } = ctx.query;
let jwt;
try {
jwt = await jwtVerify(token, new TextEncoder().encode(ctx.context.secret), { algorithms: ["HS256"] });
} catch (e) {
if (e instanceof JWTExpired) return redirectOnError("token_expired");
return redirectOnError("invalid_token");
}
const parsed = z.object({
email: z.email(),
updateTo: z.string().optional(),
requestType: z.string().optional()
}).parse(jwt.payload);
const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
if (!user) return redirectOnError("user_not_found");
if (parsed.updateTo) {
const session = await getSessionFromCtx(ctx);
if (session && session.user.email !== parsed.email) return redirectOnError("unauthorized");
switch (parsed.requestType) {
case "change-email-confirmation": {
const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
const url = `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`;
if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
user: {
...user.user,
email: parsed.updateTo
},
url,
token: newToken
}, ctx.request));
if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
return ctx.json({ status: true });
}
case "change-email-verification": {
let activeSession = session;
if (!activeSession) {
const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
if (!newSession) throw new APIError("INTERNAL_SERVER_ERROR", { message: BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION });
activeSession = {
session: newSession,
user: user.user
};
}
if (ctx.context.options.emailVerification?.onEmailVerification) await ctx.context.options.emailVerification.onEmailVerification(user.user, ctx.request);
const updatedUser$1 = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
email: parsed.updateTo,
emailVerified: true
});
if (ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser$1, ctx.request);
await setSessionCookie(ctx, {
session: activeSession.session,
user: {
...activeSession.user,
email: parsed.updateTo,
emailVerified: true
}
});
if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
return ctx.json({
status: true,
user: parseUserOutput(ctx.context.options, updatedUser$1)
});
}
default: {
let activeSession = session;
if (!activeSession) {
const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
if (!newSession) throw new APIError("INTERNAL_SERVER_ERROR", { message: BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION });
activeSession = {
session: newSession,
user: user.user
};
}
const updatedUser$1 = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
email: parsed.updateTo,
emailVerified: false
});
const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo);
const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
user: updatedUser$1,
url: `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`,
token: newToken
}, ctx.request));
await setSessionCookie(ctx, {
session: activeSession.session,
user: {
...activeSession.user,
email: parsed.updateTo,
emailVerified: false
}
});
if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
return ctx.json({
status: true,
user: parseUserOutput(ctx.context.options, updatedUser$1)
});
}
}
}
if (user.user.emailVerified) {
if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
return ctx.json({
status: true,
user: null
});
}
if (ctx.context.options.emailVerification?.beforeEmailVerification) await ctx.context.options.emailVerification.beforeEmailVerification(user.user, ctx.request);
if (ctx.context.options.emailVerification?.onEmailVerification) await ctx.context.options.emailVerification.onEmailVerification(user.user, ctx.request);
const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, { emailVerified: true });
if (ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
if (ctx.context.options.emailVerification?.autoSignInAfterVerification) {
const currentSession = await getSessionFromCtx(ctx);
if (!currentSession || currentSession.user.email !== parsed.email) {
const session = await ctx.context.internalAdapter.createSession(user.user.id);
if (!session) throw new APIError("INTERNAL_SERVER_ERROR", { message: "Failed to create session" });
await setSessionCookie(ctx, {
session,
user: {
...user.user,
emailVerified: true
}
});
} else await setSessionCookie(ctx, {
session: currentSession.session,
user: {
...currentSession.user,
emailVerified: true
}
});
}
if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
return ctx.json({
status: true,
user: null
});
});
async function handleOAuthUserInfo(c, opts) {
const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
const dbUser = await c.context.internalAdapter.findOAuthUser(userInfo.email.toLowerCase(), account.accountId, account.providerId).catch((e) => {
logger.error("Better auth was unable to query your database.\nError: ", e);
const errorURL = c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`;
throw c.redirect(`${errorURL}?error=internal_server_error`);
});
let user = dbUser?.user;
const isRegister = !user;
if (dbUser) {
const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.providerId === account.providerId && acc.accountId === account.accountId);
if (!linkedAccount) {
const accountLinking = c.context.options.account?.accountLinking;
const trustedProviders = c.context.options.account?.accountLinking?.trustedProviders;
if (!(opts.isTrustedProvider || trustedProviders?.includes(account.providerId)) && !userInfo.emailVerified || accountLinking?.enabled === false || accountLinking?.disableImplicitLinking === true) {
if (isDevelopment()) logger.warn(`User already exist but account isn't linked to ${account.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`);
return {
error: "account not linked",
data: null
};
}
try {
await c.context.internalAdapter.linkAccount({
providerId: account.providerId,
accountId: userInfo.id.toString(),
userId: dbUser.user.id,
accessToken: await setTokenUtil(account.accessToken, c.context),
refreshToken: await setTokenUtil(account.refreshToken, c.context),
idToken: account.idToken,
accessTokenExpiresAt: account.accessTokenExpiresAt,
refreshTokenExpiresAt: account.refreshTokenExpiresAt,
scope: account.scope
});
} catch (e) {
logger.error("Unable to link account", e);
return {
error: "unable to link account",
data: null
};
}
if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
} else {
const freshTokens = c.context.options.account?.updateAccountOnSignIn !== false ? Object.fromEntries(Object.entries({
idToken: account.idToken,
accessToken: await setTokenUtil(account.accessToken, c.context),
refreshToken: await setTokenUtil(account.refreshToken, c.context),
accessTokenExpiresAt: account.accessTokenExpiresAt,
refreshTokenExpiresAt: account.refreshTokenExpiresAt,
scope: account.scope
}).filter(([_, value]) => value !== void 0)) : {};
if (c.context.options.account?.storeAccountCookie) await setAccountCookie(c, {
...linkedAccount,
...freshTokens
});
if (Object.keys(freshTokens).length > 0) await c.context.internalAdapter.updateAccount(linkedAccount.id, freshTokens);
if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
}
if (overrideUserInfo) {
const { id: _, ...restUserInfo } = userInfo;
user = await c.context.internalAdapter.updateUser(dbUser.user.id, {
...restUserInfo,
email: userInfo.email.toLowerCase(),
emailVerified: userInfo.email.toLowerCase() === dbUser.user.email ? dbUser.user.emailVerified || userInfo.emailVerified : userInfo.emailVerified
});
}
} else {
if (disableSignUp) return {
error: "signup disabled",
data: null,
isRegister: false
};
try {
const { id: _, ...restUserInfo } = userInfo;
const accountData = {
accessToken: await setTokenUtil(account.accessToken, c.context),
refreshToken: await setTokenUtil(account.refreshToken, c.context),
idToken: account.idToken,
accessTokenExpiresAt: account.accessTokenExpiresAt,
refreshTokenExpiresAt: account.refreshTokenExpiresAt,
scope: account.scope,
providerId: account.providerId,
accountId: userInfo.id.toString()
};
const { user: createdUser, account: createdAccount } = await c.context.internalAdapter.createOAuthUser({
...restUserInfo,
email: userInfo.email.toLowerCase()
}, accountData);
user = createdUser;
if (c.context.options.account?.storeAccountCookie) await setAccountCookie(c, createdAccount);
if (!userInfo.emailVerified && user && c.context.options.emailVerification?.sendOnSignUp && c.context.options.emailVerification?.sendVerificationEmail) {
const token = await createEmailVerificationToken(c.context.secret, user.email, void 0, c.context.options.emailVerification?.expiresIn);
const url = `${c.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
await c.context.runInBackgroundOrAwait(c.context.options.emailVerification.sendVerificationEmail({
user,
url,
token
}, c.request));
}
} catch (e) {
logger.error(e);
if (e instanceof APIError) return {
error: e.message,
data: null,
isRegister: false
};
return {
error: "unable to create user",
data: null,
isRegister: false
};
}
}
if (!user) return {
error: "unable to create user",
data: null,
isRegister: false
};
const session = await c.context.internalAdapter.createSession(user.id);
if (!session) return {
error: "unable to create session",
data: null,
isRegister: false
};
return {
data: {
session,
user
},
error: null,
isRegister
};
}
const HIDE_METADATA = { scope: "server" };
const schema = z.object({
code: z.string().optional(),
error: z.string().optional(),
device_id: z.string().optional(),
error_description: z.string().optional(),
state: z.string().optional(),
user: z.string().optional()
});
const callbackOAuth = createAuthEndpoint("/callback/:id", {
method: ["GET", "POST"],
operationId: "handleOAuthCallback",
body: schema.optional(),
query: schema.optional(),
metadata: {
...HIDE_METADATA,
allowedMediaTypes: ["application/x-www-form-urlencoded", "application/json"]
}
}, async (c) => {
let queryOrBody;
const defaultErrorURL = c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`;
if (c.method === "POST") {
const postData = c.body ? schema.parse(c.body) : {};
const queryData = c.query ? schema.parse(c.query) : {};
const mergedData = schema.parse({
...postData,
...queryData
});
const params = new URLSearchParams();
for (const [key, value] of Object.entries(mergedData)) if (value !== void 0 && value !== null) params.set(key, String(value));
const redirectURL = `${c.context.baseURL}/callback/${c.params.id}?${params.toString()}`;
throw c.redirect(redirectURL);
}
try {
if (c.method === "GET") queryOrBody = schema.parse(c.query);
else if (c.method === "POST") queryOrBody = schema.parse(c.body);
else throw new Error("Unsupported method");
} catch (e) {
c.context.logger.error("INVALID_CALLBACK_REQUEST", e);
throw c.redirect(`${defaultErrorURL}?error=invalid_callback_request`);
}
const { code, error: error2, state, error_description, device_id, user: userData } = queryOrBody;
if (!state) {
c.context.logger.error("State not found", error2);
const url = `${defaultErrorURL}${defaultErrorURL.includes("?") ? "&" : "?"}state=state_not_found`;
throw c.redirect(url);
}
const { codeVerifier, callbackURL, link, errorURL, newUserURL, requestSignUp } = await parseState(c);
function redirectOnError(error$1, description) {
const baseURL = errorURL ?? defaultErrorURL;
const params = new URLSearchParams({ error: error$1 });
if (description) params.set("error_description", description);
const url = `${baseURL}${baseURL.includes("?") ? "&" : "?"}${params.toString()}`;
throw c.redirect(url);
}
if (error2) redirectOnError(error2, error_description);
if (!code) {
c.context.logger.error("Code not found");
throw redirectOnError("no_code");
}
const provider = c.context.socialProviders.find((p) => p.id === c.params.id);
if (!provider) {
c.context.logger.error("Oauth provider with id", c.params.id, "not found");
throw redirectOnError("oauth_provider_not_found");
}
let tokens;
try {
tokens = await provider.validateAuthorizationCode({
code,
codeVerifier,
deviceId: device_id,
redirectURI: `${c.context.baseURL}/callback/${provider.id}`
});
} catch (e) {
c.context.logger.error("", e);
throw redirectOnError("invalid_code");
}
if (!tokens) throw redirectOnError("invalid_code");
const parsedUserData = userData ? safeJSONParse(userData) : null;
const userInfo = await provider.getUserInfo({
...tokens,
user: parsedUserData ?? void 0
}).then((res) => res?.user);
if (!userInfo) {
c.context.logger.error("Unable to get user info");
return redirectOnError("unable_to_get_user_info");
}
if (!callbackURL) {
c.context.logger.error("No callback URL found");
throw redirectOnError("no_callback_url");
}
if (link) {
if (!c.context.options.account?.accountLinking?.trustedProviders?.includes(provider.id) && !userInfo.emailVerified || c.context.options.account?.accountLinking?.enabled === false) {
c.context.logger.error("Unable to link account - untrusted provider");
return redirectOnError("unable_to_link_account");
}
if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return redirectOnError("email_doesn't_match");
const existingAccount = await c.context.internalAdapter.findAccount(String(userInfo.id));
if (existingAccount) {
if (existingAccount.userId.toString() !== link.userId.toString()) return redirectOnError("account_already_linked_to_different_user");
const updateData = Object.fromEntries(Object.entries({
accessToken: await setTokenUtil(tokens.accessToken, c.context),
refreshToken: await setTokenUtil(tokens.refreshToken, c.context),
idToken: tokens.idToken,
accessTokenExpiresAt: tokens.accessTokenExpiresAt,
refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
scope: tokens.scopes?.join(",")
}).filter(([_, value]) => value !== void 0));
await c.context.internalAdapter.updateAccount(existingAccount.id, updateData);
} else if (!await c.context.internalAdapter.createAccount({
userId: link.userId,
providerId: provider.id,
accountId: String(userInfo.id),
...tokens,
accessToken: await setTokenUtil(tokens.accessToken, c.context),
refreshToken: await setTokenUtil(tokens.refreshToken, c.context),
scope: tokens.scopes?.join(",")
})) return redirectOnError("unable_to_link_account");
let toRedirectTo$1;
try {
toRedirectTo$1 = callbackURL.toString();
} catch {
toRedirectTo$1 = callbackURL;
}
throw c.redirect(toRedirectTo$1);
}
if (!userInfo.email) {
c.context.logger.error("Provider did not return email. This could be due to misconfiguration in the provider settings.");
return redirectOnError("email_not_found");
}
const accountData = {
providerId: provider.id,
accountId: String(userInfo.id),
...tokens,
scope: tokens.scopes?.join(",")
};
const result = await handleOAuthUserInfo(c, {
userInfo: {
...userInfo,
id: String(userInfo.id),
email: userInfo.email,
name: userInfo.name || userInfo.email
},
account: accountData,
callbackURL,
disableSignUp: provider.disableImplicitSignUp && !requestSignUp || provider.options?.disableSignUp,
overrideUserInfo: provider.options?.overrideUserInfoOnSignIn
});
if (result.error) {
c.context.logger.error(result.error.split(" ").join("_"));
return redirectOnError(result.error.split(" ").join("_"));
}
const { session, user } = result.data;
await setSessionCookie(c, {
session,
user
});
let toRedirectTo;
try {
toRedirectTo = (result.isRegister ? newUserURL || callbackURL : callbackURL).toString();
} catch {
toRedirectTo = result.isRegister ? newUserURL || callbackURL : callbackURL;
}
throw c.redirect(toRedirectTo);
});
function sanitize(input) {
return input.replace(//g, ">").replace(/"/g, """).replace(/'/g, "'").replace(/&(?!amp;|lt;|gt;|quot;|#39;|#x[0-9a-fA-F]+;|#[0-9]+;)/g, "&");
}
const html = (options, code = "Unknown", description = null) => {
const custom = options.onAPIError?.customizeDefaultErrorPage;
return `
Error
${custom?.disableBackgroundGrid ? "" : `
`}
${custom?.disableCornerDecorations ? "" : `
`}
ERROR
Something went wrong
CODE:
${sanitize(code)}
${!description ? `We encountered an unexpected error. Please try again or return to the home page. If you're a developer, you can find more information about the error here.` : description}