better-auth
Version:
The most comprehensive authentication framework for TypeScript.
249 lines (248 loc) • 8.74 kB
JavaScript
import { isAPIError } from "../../utils/is-api-error.mjs";
import { getOrigin } from "../../utils/url.mjs";
import { mergeSchema } from "../../db/schema.mjs";
import { setSessionCookie } from "../../cookies/index.mjs";
import { APIError } from "../../api/index.mjs";
import { PACKAGE_VERSION } from "../../version.mjs";
import { toChecksumAddress } from "../../utils/hashing.mjs";
import { normalizeSiweDomain, parseSiweMessage } from "./parse-message.mjs";
import { schema } from "./schema.mjs";
import { createAuthEndpoint } from "@better-auth/core/api";
import * as z from "zod";
//#region src/plugins/siwe/index.ts
const walletAddressInputSchema = z.string().regex(/^0[xX][a-fA-F0-9]{40}$/i).length(42);
const getSiweNonceBodySchema = z.object({
walletAddress: walletAddressInputSchema.optional(),
address: walletAddressInputSchema.optional(),
chainId: z.number().int().positive().optional().default(1)
}).refine((body) => body.walletAddress || body.address, {
message: "walletAddress or address is required",
path: ["walletAddress"]
});
const siwe = (options) => {
const createSiweNonceEndpoint = (path) => createAuthEndpoint(path, {
method: "POST",
body: getSiweNonceBodySchema
}, async (ctx) => {
const rawWalletAddress = ctx.body.walletAddress ?? ctx.body.address;
if (!rawWalletAddress) throw APIError.fromStatus("BAD_REQUEST", {
message: "walletAddress or address is required",
status: 400
});
const { chainId } = ctx.body;
const walletAddress = toChecksumAddress(rawWalletAddress);
const nonce = await options.getNonce();
await ctx.context.internalAdapter.createVerificationValue({
identifier: `siwe:${walletAddress}:${chainId}`,
value: nonce,
expiresAt: new Date(Date.now() + 900 * 1e3)
});
return ctx.json({ nonce });
});
return {
id: "siwe",
version: PACKAGE_VERSION,
schema: mergeSchema(schema, options?.schema),
endpoints: {
getSiweNonce: createSiweNonceEndpoint("/siwe/nonce"),
getNonce: createSiweNonceEndpoint("/siwe/get-nonce"),
verifySiweMessage: createAuthEndpoint("/siwe/verify", {
method: "POST",
body: z.object({
message: z.string().min(1),
signature: z.string().min(1),
walletAddress: z.string().regex(/^0[xX][a-fA-F0-9]{40}$/i).length(42),
chainId: z.number().int().positive().optional().default(1),
email: z.email().optional()
}).refine((data) => options.anonymous !== false || !!data.email, {
message: "Email is required when the anonymous plugin option is disabled.",
path: ["email"]
}),
requireRequest: true
}, async (ctx) => {
const { message, signature, walletAddress: rawWalletAddress, chainId, email } = ctx.body;
const walletAddress = toChecksumAddress(rawWalletAddress);
const isAnon = options.anonymous ?? true;
if (!isAnon && !email) throw APIError.fromStatus("BAD_REQUEST", {
message: "Email is required when anonymous is disabled.",
status: 400
});
try {
const verification = await ctx.context.internalAdapter.consumeVerificationValue(`siwe:${walletAddress}:${chainId}`);
if (!verification) throw APIError.fromStatus("UNAUTHORIZED", {
message: "Unauthorized: Invalid or expired nonce",
status: 401,
code: "UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE"
});
const { value: nonce } = verification;
const parsedMessage = parseSiweMessage(message);
const nonceMatches = parsedMessage.nonce === nonce;
const addressMatches = !!parsedMessage.address && parsedMessage.address.toLowerCase() === walletAddress.toLowerCase();
const chainMatches = parsedMessage.chainId === chainId;
const domainMatches = !!parsedMessage.domain && normalizeSiweDomain(parsedMessage.domain) === normalizeSiweDomain(options.domain);
if (!nonceMatches || !addressMatches || !chainMatches || !domainMatches) throw APIError.fromStatus("UNAUTHORIZED", {
message: "Unauthorized: SIWE message does not match the expected nonce, domain, address, or chain ID",
status: 401,
code: "UNAUTHORIZED_SIWE_MESSAGE_MISMATCH"
});
const now = Date.now();
if (parsedMessage.expirationTime) {
const expiresAt = Date.parse(parsedMessage.expirationTime);
if (!Number.isNaN(expiresAt) && now >= expiresAt) throw APIError.fromStatus("UNAUTHORIZED", {
message: "Unauthorized: SIWE message has expired",
status: 401,
code: "UNAUTHORIZED_SIWE_MESSAGE_EXPIRED"
});
}
if (parsedMessage.notBefore) {
const notBefore = Date.parse(parsedMessage.notBefore);
if (!Number.isNaN(notBefore) && now < notBefore) throw APIError.fromStatus("UNAUTHORIZED", {
message: "Unauthorized: SIWE message is not yet valid",
status: 401,
code: "UNAUTHORIZED_SIWE_MESSAGE_NOT_YET_VALID"
});
}
if (!await options.verifyMessage({
message,
signature,
address: walletAddress,
chainId,
cacao: {
h: { t: "caip122" },
p: {
domain: options.domain,
aud: options.domain,
nonce,
iss: options.domain,
version: "1"
},
s: {
t: "eip191",
s: signature
}
}
})) throw APIError.fromStatus("UNAUTHORIZED", {
message: "Unauthorized: Invalid SIWE signature",
status: 401
});
let user = null;
const existingWalletAddress = await ctx.context.adapter.findOne({
model: "walletAddress",
where: [{
field: "address",
operator: "eq",
value: walletAddress
}, {
field: "chainId",
operator: "eq",
value: chainId
}]
});
if (existingWalletAddress) user = await ctx.context.adapter.findOne({
model: "user",
where: [{
field: "id",
operator: "eq",
value: existingWalletAddress.userId
}]
});
else {
const anyWalletAddress = await ctx.context.adapter.findOne({
model: "walletAddress",
where: [{
field: "address",
operator: "eq",
value: walletAddress
}]
});
if (anyWalletAddress) user = await ctx.context.adapter.findOne({
model: "user",
where: [{
field: "id",
operator: "eq",
value: anyWalletAddress.userId
}]
});
}
if (!user) {
const domain = options.emailDomainName ?? getOrigin(ctx.context.baseURL);
const normalizedEmail = email?.toLowerCase();
let userEmail = `${walletAddress}@${domain}`;
if (!isAnon && normalizedEmail) {
if (!await ctx.context.internalAdapter.findUserByEmail(normalizedEmail)) userEmail = normalizedEmail;
}
const { name, avatar } = await options.ensLookup?.({ walletAddress }) ?? {};
user = await ctx.context.internalAdapter.createUser({
name: name ?? walletAddress,
email: userEmail,
image: avatar ?? ""
});
await ctx.context.adapter.create({
model: "walletAddress",
data: {
userId: user.id,
address: walletAddress,
chainId,
isPrimary: true,
createdAt: /* @__PURE__ */ new Date()
}
});
await ctx.context.internalAdapter.createAccount({
userId: user.id,
providerId: "siwe",
accountId: `${walletAddress}:${chainId}`,
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date()
});
} else if (!existingWalletAddress) {
await ctx.context.adapter.create({
model: "walletAddress",
data: {
userId: user.id,
address: walletAddress,
chainId,
isPrimary: false,
createdAt: /* @__PURE__ */ new Date()
}
});
await ctx.context.internalAdapter.createAccount({
userId: user.id,
providerId: "siwe",
accountId: `${walletAddress}:${chainId}`,
createdAt: /* @__PURE__ */ new Date(),
updatedAt: /* @__PURE__ */ new Date()
});
}
const session = await ctx.context.internalAdapter.createSession(user.id);
if (!session) throw APIError.fromStatus("INTERNAL_SERVER_ERROR", {
message: "Internal Server Error",
status: 500
});
await setSessionCookie(ctx, {
session,
user
});
return ctx.json({
token: session.token,
success: true,
user: {
id: user.id,
walletAddress,
chainId
}
});
} catch (error) {
if (isAPIError(error)) throw error;
throw APIError.fromStatus("UNAUTHORIZED", {
message: "Something went wrong. Please try again later.",
error: error instanceof Error ? error.message : "Unknown error",
status: 401
});
}
})
},
options
};
};
//#endregion
export { siwe };