github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #4057] [CLOSED] refactor/merge-oidc-and-mcp #5156

New Issue
Closed
opened 2026-03-13 12:12:29 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:12:29 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/4057
Author: @frectonz
Created: 8/17/2025
Status: ❌ Closed

Base: canary ← Head: refactor/merge-oidc-and-mcp

📝 Commits (10+)

  • 597bbb9 feat: setup makeOidcPlugin
  • e91ceee feat(oidc): generalized authorize function
  • b3009ff fix: use MakePluginOpts instead of updating OIDCOptions
  • f200730 feat(oidc): add oidc configuration endpoint
  • 91aef55 feat(oidc): add separate functions to resolve options and metadata
  • b6e69a3 chore(oidc): refactor authorize function
  • d1d9169 feat(oidc): refactor oAuth2authorize endpoint
  • 7e56592 feat(oidc): refactor oAuthConsent endpoint
  • deeec26 feat(oidc): refactor oAuth2token endpoint
  • ec66f4f feat(oidc): refactor oAuth2userInfo endpoint

📊 Changes

36 files changed (+2280 additions, -2981 deletions)

View changed files

➖ packages/better-auth/src/plugins/mcp/authorize.ts (+0 -229)
📝 packages/better-auth/src/plugins/mcp/index.ts (+50 -942)
📝 packages/better-auth/src/plugins/mcp/mcp.test.ts (+20 -21)
➕ packages/better-auth/src/plugins/mcp/with-mcp-auth.ts (+50 -0)
➖ packages/better-auth/src/plugins/oidc-provider/authorize.ts (+0 -305)
📝 packages/better-auth/src/plugins/oidc-provider/index.ts (+44 -1462)
📝 packages/better-auth/src/plugins/oidc-provider/oidc.test.ts (+13 -13)
➕ packages/better-auth/src/plugins/oidc/authorize/create-verification.ts (+47 -0)
➕ packages/better-auth/src/plugins/oidc/authorize/handle-consent-flow.ts (+73 -0)
➕ packages/better-auth/src/plugins/oidc/authorize/index.ts (+49 -0)
➕ packages/better-auth/src/plugins/oidc/authorize/resolve-client.ts (+29 -0)
➕ packages/better-auth/src/plugins/oidc/authorize/resolve-inputs.ts (+26 -0)
➕ packages/better-auth/src/plugins/oidc/authorize/resolve-query.ts (+125 -0)
➕ packages/better-auth/src/plugins/oidc/authorize/resolve-session.ts (+35 -0)
➕ packages/better-auth/src/plugins/oidc/endpoints/oauth2-access-token-data.ts (+37 -0)
➕ packages/better-auth/src/plugins/oidc/endpoints/oauth2-authorize.ts (+42 -0)
➕ packages/better-auth/src/plugins/oidc/endpoints/oauth2-client.ts (+64 -0)
➕ packages/better-auth/src/plugins/oidc/endpoints/oauth2-consent.ts (+163 -0)
➕ packages/better-auth/src/plugins/oidc/endpoints/oauth2-openid-config.ts (+23 -0)
➕ packages/better-auth/src/plugins/oidc/endpoints/oauth2-register.ts (+365 -0)

...and 16 more files

📄 Description

Summary by cubic

Replaces the legacy OIDC provider with a modular OIDC plugin that unifies authorization, consent, token, userinfo, discovery, and client registration. Simplifies MCP integration, adds stronger PKCE/JWT handling, and standardizes error/redirect behavior.

  • New Features

    • New endpoints: authorize, token, userinfo, client lookup, dynamic client registration, and .well-known/openid-configuration.
    • Consent flow supports cookie- and URL-based flows, with an after-login consent hook to resume the authorize request.
    • Configurable plugin via makeOidcPlugin (id, pathPrefix, alwaysSkipConsent, disableCors) and resolveOIDCOptions (scopes, PKCE, trusted clients, metadata).
    • Security: PKCE required by default (plain optional), public vs confidential client handling, Basic auth header support, and client secret storage strategies (plain, hashed, encrypted, or custom).
    • ID Token signing via JWT plugin (RS256/EdDSA) or HS256 fallback with client secret.
    • Unified error/redirect helpers and optional CORS headers when disableCors is enabled.

  • Migration

    • Replace oidcProvider usage with makeOidcPlugin({...})(oidcOptions); set a pathPrefix and update integrations accordingly.
    • Provide loginPage and either consentPage or getConsentHTML for the consent experience.
    • Enable the jwt plugin and set useJWTPlugin: true if you want JWKS-signed ID tokens; otherwise HS256 with client secret is used.
    • Choose a storeClientSecret strategy (plain/hashed/encrypted/custom) and configure related hooks if custom.
    • Models remain the same (oauthApplication, oauthAccessToken, oauthConsent), so no schema changes are required.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/4057 **Author:** [@frectonz](https://github.com/frectonz) **Created:** 8/17/2025 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `refactor/merge-oidc-and-mcp` --- ### 📝 Commits (10+) - [`597bbb9`](https://github.com/better-auth/better-auth/commit/597bbb975fa87667ac0ecb93964418cd72322952) feat: setup `makeOidcPlugin` - [`e91ceee`](https://github.com/better-auth/better-auth/commit/e91ceee5856dd56a06b82360faef6146cfca2498) feat(oidc): generalized authorize function - [`b3009ff`](https://github.com/better-auth/better-auth/commit/b3009ff9becf1bedde81f79d60b7db0402a2e3bd) fix: use `MakePluginOpts` instead of updating `OIDCOptions` - [`f200730`](https://github.com/better-auth/better-auth/commit/f200730448e1125b93cee9dd457eeb87baac3779) feat(oidc): add oidc configuration endpoint - [`91aef55`](https://github.com/better-auth/better-auth/commit/91aef553536d613a7f4a1b4eb6a0bec57625d286) feat(oidc): add separate functions to resolve options and metadata - [`b6e69a3`](https://github.com/better-auth/better-auth/commit/b6e69a370e7d915e8d6f1f34754055f72d62c3e1) chore(oidc): refactor authorize function - [`d1d9169`](https://github.com/better-auth/better-auth/commit/d1d916924f4c984a34eb94a227ad093076493f56) feat(oidc): refactor `oAuth2authorize` endpoint - [`7e56592`](https://github.com/better-auth/better-auth/commit/7e56592ede4613972d104ff60a2436bafb46ec37) feat(oidc): refactor `oAuthConsent` endpoint - [`deeec26`](https://github.com/better-auth/better-auth/commit/deeec26456eb2e9caa3a4faf67b5bb7ccd26b3f6) feat(oidc): refactor `oAuth2token` endpoint - [`ec66f4f`](https://github.com/better-auth/better-auth/commit/ec66f4f9dec50cf1bad787086219e5bc8ac6fde2) feat(oidc): refactor `oAuth2userInfo` endpoint ### 📊 Changes **36 files changed** (+2280 additions, -2981 deletions) <details> <summary>View changed files</summary> ➖ `packages/better-auth/src/plugins/mcp/authorize.ts` (+0 -229) 📝 `packages/better-auth/src/plugins/mcp/index.ts` (+50 -942) 📝 `packages/better-auth/src/plugins/mcp/mcp.test.ts` (+20 -21) ➕ `packages/better-auth/src/plugins/mcp/with-mcp-auth.ts` (+50 -0) ➖ `packages/better-auth/src/plugins/oidc-provider/authorize.ts` (+0 -305) 📝 `packages/better-auth/src/plugins/oidc-provider/index.ts` (+44 -1462) 📝 `packages/better-auth/src/plugins/oidc-provider/oidc.test.ts` (+13 -13) ➕ `packages/better-auth/src/plugins/oidc/authorize/create-verification.ts` (+47 -0) ➕ `packages/better-auth/src/plugins/oidc/authorize/handle-consent-flow.ts` (+73 -0) ➕ `packages/better-auth/src/plugins/oidc/authorize/index.ts` (+49 -0) ➕ `packages/better-auth/src/plugins/oidc/authorize/resolve-client.ts` (+29 -0) ➕ `packages/better-auth/src/plugins/oidc/authorize/resolve-inputs.ts` (+26 -0) ➕ `packages/better-auth/src/plugins/oidc/authorize/resolve-query.ts` (+125 -0) ➕ `packages/better-auth/src/plugins/oidc/authorize/resolve-session.ts` (+35 -0) ➕ `packages/better-auth/src/plugins/oidc/endpoints/oauth2-access-token-data.ts` (+37 -0) ➕ `packages/better-auth/src/plugins/oidc/endpoints/oauth2-authorize.ts` (+42 -0) ➕ `packages/better-auth/src/plugins/oidc/endpoints/oauth2-client.ts` (+64 -0) ➕ `packages/better-auth/src/plugins/oidc/endpoints/oauth2-consent.ts` (+163 -0) ➕ `packages/better-auth/src/plugins/oidc/endpoints/oauth2-openid-config.ts` (+23 -0) ➕ `packages/better-auth/src/plugins/oidc/endpoints/oauth2-register.ts` (+365 -0) _...and 16 more files_ </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Replaces the legacy OIDC provider with a modular OIDC plugin that unifies authorization, consent, token, userinfo, discovery, and client registration. Simplifies MCP integration, adds stronger PKCE/JWT handling, and standardizes error/redirect behavior. - **New Features** - New endpoints: authorize, token, userinfo, client lookup, dynamic client registration, and .well-known/openid-configuration. - Consent flow supports cookie- and URL-based flows, with an after-login consent hook to resume the authorize request. - Configurable plugin via makeOidcPlugin (id, pathPrefix, alwaysSkipConsent, disableCors) and resolveOIDCOptions (scopes, PKCE, trusted clients, metadata). - Security: PKCE required by default (plain optional), public vs confidential client handling, Basic auth header support, and client secret storage strategies (plain, hashed, encrypted, or custom). - ID Token signing via JWT plugin (RS256/EdDSA) or HS256 fallback with client secret. - Unified error/redirect helpers and optional CORS headers when disableCors is enabled. - **Migration** - Replace oidcProvider usage with makeOidcPlugin({...})(oidcOptions); set a pathPrefix and update integrations accordingly. - Provide loginPage and either consentPage or getConsentHTML for the consent experience. - Enable the jwt plugin and set useJWTPlugin: true if you want JWKS-signed ID tokens; otherwise HS256 with client secret is used. - Choose a storeClientSecret strategy (plain/hashed/encrypted/custom) and configure related hooks if custom. - Models remain the same (oauthApplication, oauthAccessToken, oauthConsent), so no schema changes are required. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:12:29 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5156
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?