better-auth-api 1.0.0-alpha.5

Plugin implementations for better-auth
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

use super::*;
use better_auth_core::utils::jwt::numeric_date;

pub(super) fn default_expiration(
    expiration: &FieldValue,
    issued: &FieldValue,
    now: i64,
) -> AuthResult<FieldValue> {
    if expiration.is_number() {
        return Ok(expiration.clone());
    }
    if expiration.as_date().is_some() {
        let time = expiration.get_time_method("expirationTime")?;
        return Ok((better_auth_core::query::field_number(&time)? / 1_000.0)
            .floor()
            .into());
    }
    let input = expiration.display_utf16()?;
    let seconds = input
        .to_utf8()
        .ok()
        .and_then(|input| super::overrides::input::relative_seconds(&input).ok());
    let Some(seconds) = seconds else {
        let shown = expiration.display_utf16()?;
        let mut message = "Invalid time string format: \""
            .encode_utf16()
            .collect::<Vec<_>>();
        message.extend_from_slice(shown.as_utf16());
        message.extend("\". Use formats like \"7d\", \"30m\", \"1 hour\", etc.".encode_utf16());
        return Err(AuthError::type_error_native(
            better_auth_core::Utf16String::from_units(message),
        ));
    };
    let issued = if issued.is_null() || issued.is_undefined() {
        now.into()
    } else {
        issued.clone()
    };
    better_auth_core::query::field_add(&issued, &seconds.into())
}

pub(super) fn prepare_local_claims(
    payload: &mut FieldMap,
    original: &FieldValue,
    defaults: &FieldMap,
) -> AuthResult<()> {
    let claim = |name: &str| defaults.get(name).unwrap_or(&FieldValue::Undefined);
    let expiry = numeric_date(claim("exp"), "setExpirationTime")?;
    let _ = payload.insert("exp".into(), expiry);
    let issuer = claim("iss");
    require_string("iss", issuer)?;
    let _ = payload.insert("iss".into(), issuer.clone());
    let audience = claim("aud");
    let valid_audience = match audience {
        FieldValue::String(_) | FieldValue::Utf16String(_) => true,
        FieldValue::Array(values) => values.snapshot()?.iter().all(is_string),
        _ => false,
    };
    if !valid_audience {
        return Err(AuthError::type_error(
            "\"aud\" claim must be a string or an array of strings",
        ));
    }
    let _ = payload.insert("aud".into(), audience.clone());
    let issued = claim("iat");
    if issued.is_truthy() {
        let _ = payload.insert("iat".into(), numeric_date(issued, "setIssuedAt")?);
    }
    for name in ["sub", "nbf", "jti"] {
        if original.model_property(name)?.is_truthy() {
            let value = original.model_property(name)?;
            let value = if name == "nbf" {
                numeric_date(&value, "setNotBefore")?
            } else {
                require_string(name, &value)?;
                value
            };
            let _ = payload.insert(name.into(), value);
        }
    }
    Ok(())
}

fn is_string(value: &FieldValue) -> bool {
    matches!(value, FieldValue::String(_) | FieldValue::Utf16String(_))
}

pub(super) fn require_string(name: &str, value: &FieldValue) -> AuthResult<()> {
    if is_string(value) {
        Ok(())
    } else {
        Err(AuthError::type_error(format!(
            "\"{name}\" claim must be a string"
        )))
    }
}