github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7587] [CLOSED] feat(plugins): agentAuth plugin PoC with async auth #33023

New Issue
Closed
opened 2026-04-17 23:42:21 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 23:42:21 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7587
Author: @Paola3stefania
Created: 1/24/2026
Status: ❌ Closed

Base: canary ← Head: feat/ciba

📝 Commits (10+)

📊 Changes

23 files changed (+3327 additions, -29 deletions)

View changed files

📝 demo/nextjs/.env.example (+7 -0)
➕ demo/nextjs/app/(auth)/ciba/approve/page.tsx (+226 -0)
📝 demo/nextjs/lib/auth.ts (+85 -22)
📝 demo/nextjs/package.json (+2 -0)
➕ docs/content/docs/plugins/async-auth.mdx (+623 -0)
📝 packages/better-auth/src/client/plugins/index.ts (+2 -0)
➕ packages/better-auth/src/plugins/agent-auth/client.ts (+16 -0)
➕ packages/better-auth/src/plugins/agent-auth/index.ts (+119 -0)
➕ packages/better-auth/src/plugins/agent-auth/types.ts (+81 -0)
➕ packages/better-auth/src/plugins/ciba/ciba.test.ts (+657 -0)
➕ packages/better-auth/src/plugins/ciba/client.ts (+18 -0)
➕ packages/better-auth/src/plugins/ciba/error-codes.ts (+27 -0)
➕ packages/better-auth/src/plugins/ciba/index.ts (+144 -0)
➕ packages/better-auth/src/plugins/ciba/routes.ts (+589 -0)
➕ packages/better-auth/src/plugins/ciba/storage.ts (+154 -0)
➕ packages/better-auth/src/plugins/ciba/token-handler.ts (+365 -0)
➕ packages/better-auth/src/plugins/ciba/types.ts (+96 -0)
📝 packages/better-auth/src/plugins/index.ts (+2 -0)
📝 packages/better-auth/src/plugins/oidc-provider/utils.ts (+92 -1)
📝 packages/oauth-provider/src/oauth.ts (+1 -0)

...and 3 more files

📄 Description

Summary by cubic

Adds a new agent-auth plugin that enables async authentication for agents using CIBA. Includes backchannel endpoints, token issuance, and a simple approval flow where users approve or reject requests.

  • New Features

    • Agent Auth plugin with async auth (CIBA) and internal OIDC provider.
    • CIBA plugin: bcAuthorize, verify, authorize, reject endpoints.
    • Token handler: intercepts token endpoint for the CIBA grant; issues access/id tokens and refresh tokens only with offline_access; includes at_hash.
    • Storage for CIBA requests via Redis (if available) or verification table.
    • Client plugins: agent-auth and ciba with pathMethods for UI and agents, plus Async Auth docs and a Next.js approval UI demo.
    • Error codes for common CIBA flows.
    • Client credentials: supports Basic auth and verifies secrets stored as plain, hashed, or encrypted.
    • Spec compliance: slow_down rate limiting on polling.
    • OAuth provider: adds CIBA grant type to client registration and updates.

  • Migration

    • Add agentAuth({ sendNotification, requestLifetime?, pollingInterval?, approvalUri?, resolveUser? }) to your plugins; configure your notification transporter (demo uses Gmail App Password).
    • Ensure oidcProvider is enabled; agentAuth includes an internal one by default.
    • Build an approval UI at approvalUri that calls /ciba/verify, /ciba/authorize, /ciba/reject.

Written for commit f573afcafb. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7587 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 1/24/2026 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `feat/ciba` --- ### 📝 Commits (10+) - [`4504981`](https://github.com/better-auth/better-auth/commit/4504981e105bb81fe3f826565f161271bb3a179d) ciba poc - [`af137e2`](https://github.com/better-auth/better-auth/commit/af137e229fa9286da55266267ea44d3808fd954b) todo for alter - [`a6f311b`](https://github.com/better-auth/better-auth/commit/a6f311ba691c5211c427a1e2fc7602777ca3e2fb) feat: aegent auth - [`9af4791`](https://github.com/better-auth/better-auth/commit/9af479190ab49f3cd606b01fe9e9b747ce5a2a42) Merge branch 'canary' into feat/ciba - [`c6c9a3d`](https://github.com/better-auth/better-auth/commit/c6c9a3d9679d018f1ee86158e44080f5d5a35580) Merge branch 'canary' into feat/ciba - [`db207f6`](https://github.com/better-auth/better-auth/commit/db207f62fa6153d5470a7d686fc4980113613f96) Merge branch 'canary' into feat/ciba - [`63d4042`](https://github.com/better-auth/better-auth/commit/63d4042a438cdb1a16a5da6379842207771e64af) make lint happy and fix types - [`fce7c81`](https://github.com/better-auth/better-auth/commit/fce7c81d63772bfbe6f7c771866f20d2b7659714) Merge branch 'feat/ciba' of https://github.com/better-auth/better-auth into feat/ciba - [`b17a31e`](https://github.com/better-auth/better-auth/commit/b17a31e02650d8074d3a35397534d9276ea17173) security and spec complaince fixes - [`c4155e9`](https://github.com/better-auth/better-auth/commit/c4155e9dbd3258fef7a9b43ae6c120947cce6f71) Merge branch 'canary' into feat/ciba ### 📊 Changes **23 files changed** (+3327 additions, -29 deletions) <details> <summary>View changed files</summary> 📝 `demo/nextjs/.env.example` (+7 -0) ➕ `demo/nextjs/app/(auth)/ciba/approve/page.tsx` (+226 -0) 📝 `demo/nextjs/lib/auth.ts` (+85 -22) 📝 `demo/nextjs/package.json` (+2 -0) ➕ `docs/content/docs/plugins/async-auth.mdx` (+623 -0) 📝 `packages/better-auth/src/client/plugins/index.ts` (+2 -0) ➕ `packages/better-auth/src/plugins/agent-auth/client.ts` (+16 -0) ➕ `packages/better-auth/src/plugins/agent-auth/index.ts` (+119 -0) ➕ `packages/better-auth/src/plugins/agent-auth/types.ts` (+81 -0) ➕ `packages/better-auth/src/plugins/ciba/ciba.test.ts` (+657 -0) ➕ `packages/better-auth/src/plugins/ciba/client.ts` (+18 -0) ➕ `packages/better-auth/src/plugins/ciba/error-codes.ts` (+27 -0) ➕ `packages/better-auth/src/plugins/ciba/index.ts` (+144 -0) ➕ `packages/better-auth/src/plugins/ciba/routes.ts` (+589 -0) ➕ `packages/better-auth/src/plugins/ciba/storage.ts` (+154 -0) ➕ `packages/better-auth/src/plugins/ciba/token-handler.ts` (+365 -0) ➕ `packages/better-auth/src/plugins/ciba/types.ts` (+96 -0) 📝 `packages/better-auth/src/plugins/index.ts` (+2 -0) 📝 `packages/better-auth/src/plugins/oidc-provider/utils.ts` (+92 -1) 📝 `packages/oauth-provider/src/oauth.ts` (+1 -0) _...and 3 more files_ </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Adds a new agent-auth plugin that enables async authentication for agents using CIBA. Includes backchannel endpoints, token issuance, and a simple approval flow where users approve or reject requests. - New Features - Agent Auth plugin with async auth (CIBA) and internal OIDC provider. - CIBA plugin: bcAuthorize, verify, authorize, reject endpoints. - Token handler: intercepts token endpoint for the CIBA grant; issues access/id tokens and refresh tokens only with offline_access; includes at_hash. - Storage for CIBA requests via Redis (if available) or verification table. - Client plugins: agent-auth and ciba with pathMethods for UI and agents, plus Async Auth docs and a Next.js approval UI demo. - Error codes for common CIBA flows. - Client credentials: supports Basic auth and verifies secrets stored as plain, hashed, or encrypted. - Spec compliance: slow_down rate limiting on polling. - OAuth provider: adds CIBA grant type to client registration and updates. - Migration - Add agentAuth({ sendNotification, requestLifetime?, pollingInterval?, approvalUri?, resolveUser? }) to your plugins; configure your notification transporter (demo uses Gmail App Password). - Ensure oidcProvider is enabled; agentAuth includes an internal one by default. - Build an approval UI at approvalUri that calls /ciba/verify, /ciba/authorize, /ciba/reject. <sup>Written for commit f573afcafbeb03a6fb9030995b14f8aabc41ed28. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-17 23:42:21 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#33023
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?