mirror of
https://github.com/better-auth/better-auth.git
synced 2026-07-26 02:16:23 -05:00
Gustavo Valverde
027a10c566
Re-applies two main fixes onto next's refactored metadata layer. - #9448: registration_endpoint is now advertised only when dynamic client registration is enabled. With DCR off, the field was still advertised in authorization-server and OpenID metadata while the endpoint itself was disabled, so clients attempted a registration that failed. - #9668: the authorization-server and OpenID discovery documents are served again at their path-prefixed (RFC 8414 path-insertion and issuer-appended) aliases via an onRequest handler, with HEAD support and a 405 for non-GET/HEAD. next's refactor kept the server-only metadata endpoints but dropped the request handler that exposes them over HTTP. The handler is adapted to next's metadata (CIMD-aware public-client flag and merged discovery metadata) and metadataResponse is exported for it. #9601 (preserve colons in Basic Auth secret) is already covered: next routes Basic parsing through @better-auth/core decodeBasicCredentials, which splits on the first colon, so no change to utils/index.ts. The merged metadata test suite (union of next and main, including the DCR-conditional and alias cases) passes. (cherry picked from commit 66a7b0b62d76e36474ebdca189f59200daa3ec76)