better_auth-rails 0.6.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0e6c26cdbe7f5e5bd981dafe3b71be1c3d3b05c892aff5093854f4e352ce1a4f
-  data.tar.gz: 62264362e911e4042dc2d460e9fbaec7b5247328d418f52dfb7b8181244b05d4
+  metadata.gz: a5ac4180d1fa72d73ecb4012f0d8d329eb92eccc2dabebef9cd5e7e91d8e1736
+  data.tar.gz: 9c99354b9834f28e26edbfcbf257aa932ac298e64f961c812fb2d63cd998b601
 SHA512:
-  metadata.gz: 247ba4311b4eeb07dd0e7a8dc4dc7e7d9d9d3bacfbffb6e9e3e2e8abbaccf954c7d58b5381f8a70d3cf955df9428003d5dcf79234af92b2cc7864ccd668b9b18
-  data.tar.gz: fe225c023f7f6ca485df3506106e77ff0e1ff61b7b2c162abe667e5d8c6e500230c2394111c8dcf809abbb54a30da573ca6d8691b484b878a50d7adda786d714
+  metadata.gz: ad8e38bc663f50f09af94f5d2a2353aed49eb61818bbd2e7b2067313ec51faa49155b24aad88885f80be8cca13840be7c4b6bf22a9a40d24cb0b7fecbf0543f4
+  data.tar.gz: 7455aaa5b30a2a1d8c9227e84afb53426cb3797d321803a846f39966e8f9de9e7ec691fb9abb3c18b4aabd207078ca15f99d64021251719f5d33d27aac15af74

data/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-05-05
+
+### Fixed
+
+- Aligned Active Record adapter filtering, joins, falsey values, and lookup semantics with core adapter behavior.
+- Hardened controller helper and trusted-origin behavior and passed versioned secrets through Rails configuration.
+- Added MySQL and PostgreSQL integration coverage for the adapter changes.
+
 ## [0.2.1] - 2026-04-29
 
 ### Fixed

data/README.md

@@ -122,6 +122,30 @@ Rails configuration is a thin option builder for the core Rack auth object. The
 
 Rails uses `BetterAuth::Rails::ActiveRecordAdapter` by default. The adapter uses whichever database adapter the Rails app is already configured with, including PostgreSQL and MySQL. To be explicit, set `config.database_adapter = :active_record`; for custom adapters, assign `config.database` directly.
 
+#### Secret rotation
+
+Rails can pass Better Auth secret rotation entries through the same `secrets` option as core:
+
+```ruby
+BetterAuth::Rails.configure do |config|
+  config.secret = Rails.application.secret_key_base
+  config.secrets = [
+    {version: 2, value: Rails.application.credentials.dig(:better_auth, :secret_v2)},
+    {version: 1, value: Rails.application.credentials.dig(:better_auth, :secret_v1)}
+  ].compact
+end
+```
+
+Core Better Auth also reads `BETTER_AUTH_SECRETS` when `secrets` is not configured directly.
+
+#### Trusted origins
+
+The generated initializer derives `trusted_origins` from `ENV["BETTER_AUTH_URL"]`. If that environment variable is unset, Rails passes an empty list. Browser clients should set trusted origins explicitly in deployment so origin checks and callback URLs do not depend on an empty environment value. See [`host-app-responsibilities.md`](../../.docs/features/host-app-responsibilities.md) for the boundary between Better Auth origin checks, browser CORS headers, and host-app CSRF policy.
+
+#### Option builder keys
+
+The Rails option builder accepts unknown keys so plugin and custom options can flow through to core Better Auth. That also means typos become option keys silently. Validate configuration names against the core docs or the Ruby option names when adding new settings.
+
 ### JavaScript Client
 
 Ruby Better Auth exposes the same HTTP route surface. Frontend apps should use the upstream Better Auth JavaScript client and point it at the Ruby server:
@@ -199,6 +223,8 @@ end
 - `authenticated?` - Returns true when a user is present
 - `require_authentication` - Halts with `head :unauthorized` and returns `false` when no user is present
 
+`ControllerHelpers` prepare the Better Auth context for the current Rails request before reading the session. Custom Rack middleware or controller code that bypasses `BetterAuth::Router` and reads sessions directly should call `prepare_for_request!` on the auth context first.
+
 ## Development
 
 Full documentation is being adapted in the root [`docs/`](/Users/sebastiansala/projects/better-auth/docs/README.md) app. The Rails guide lives at `docs/content/docs/integrations/rails.mdx`; pages with a Ruby port warning still contain upstream TypeScript examples for reference.

data/lib/better_auth/rails/active_record_adapter.rb

@@ -1,8 +1,14 @@
 # frozen_string_literal: true
 
+require "securerandom"
+require "json"
+require "time"
+
 module BetterAuth
   module Rails
     class ActiveRecordAdapter < BetterAuth::Adapters::Base
+      include BetterAuth::Adapters::JoinSupport
+
       begin
         require "active_record" unless defined?(::ActiveRecord)
       rescue LoadError
@@ -45,16 +51,16 @@ module BetterAuth
         model = model.to_s
         relation = relation_for(model, where: where, sort_by: sort_by, limit: limit, offset: offset, select: select, join: join)
         records = relation.map { |record| normalize_record(model, record, join: join) }
-        collection_join?(model, join) ? aggregate_collection_joins(records) : records
+        collection_join?(model, join) ? aggregate_collection_joins(model, records, join) : records
       end
 
       def update(model:, where:, update:)
         model = model.to_s
-        record = relation_for(model, where: where).first
-        return nil unless record
+        existing = find_one(model: model, where: where, select: ["id"])
+        return nil unless existing
 
-        record.update!(physical_attributes(model, transform_input(model, update, "update", true)))
-        normalize_record(model, record)
+        update_many(model: model, where: where, update: update)
+        find_one(model: model, where: [{field: "id", value: existing.fetch("id")}])
       end
 
       def update_many(model:, where:, update:, returning: false)
@@ -72,9 +78,7 @@ module BetterAuth
       end
 
       def delete(model:, where:)
-        model = model.to_s
-        record = relation_for(model, where: where).first
-        record&.destroy!
+        delete_many(model: model, where: where)
         nil
       end
 
@@ -117,12 +121,19 @@ module BetterAuth
       end
 
       def apply_where(model, relation, where)
-        Array(where).reduce(relation) do |scope, clause|
-          field = storage_key(fetch_key(clause, :field))
-          column = storage_field(model, field)
-          operator = (fetch_key(clause, :operator) || "eq").to_s
-          value = fetch_key(clause, :value)
-          apply_operator(scope, column, operator, value)
+        clauses = Array(where)
+        return relation if clauses.empty?
+
+        if model_class(model).respond_to?(:arel_table)
+          expression = clauses.each_with_index.reduce(nil) do |combined, (clause, index)|
+            current = where_expression(model, clause)
+            next current if index.zero?
+
+            (fetch_key(clause, :connector).to_s.upcase == "OR") ? combined.or(current) : combined.and(current)
+          end
+          relation.where(expression)
+        else
+          apply_where_with_relation_or(model, relation, clauses)
         end
       end
 
@@ -135,13 +146,52 @@ module BetterAuth
         when "gte" then scope.where("#{column} >= ?", value)
         when "lt" then scope.where("#{column} < ?", value)
         when "lte" then scope.where("#{column} <= ?", value)
-        when "contains" then scope.where("#{column} LIKE ?", "%#{value}%")
-        when "starts_with" then scope.where("#{column} LIKE ?", "#{value}%")
-        when "ends_with" then scope.where("#{column} LIKE ?", "%#{value}")
+        when "contains" then scope.where("#{column} LIKE ? ESCAPE ?", "%#{escape_like(value)}%", "\\")
+        when "starts_with" then scope.where("#{column} LIKE ? ESCAPE ?", "#{escape_like(value)}%", "\\")
+        when "ends_with" then scope.where("#{column} LIKE ? ESCAPE ?", "%#{escape_like(value)}", "\\")
         else scope.where(column => value)
         end
       end
 
+      def apply_where_with_relation_or(model, relation, clauses)
+        clauses.each_with_index.reduce(nil) do |combined, (clause, index)|
+          field = storage_key(fetch_key(clause, :field))
+          column = storage_field(model, field)
+          operator = (fetch_key(clause, :operator) || "eq").to_s
+          value = fetch_key(clause, :value)
+          current = apply_operator(relation, column, operator, value)
+          next current if index.zero?
+
+          (fetch_key(clause, :connector).to_s.upcase == "OR") ? combined.or(current) : apply_operator(combined, column, operator, value)
+        end
+      end
+
+      def where_expression(model, clause)
+        field = storage_key(fetch_key(clause, :field))
+        attributes = schema_for(model).fetch(:fields).fetch(field)
+        column = model_class(model).arel_table[storage_field(model, field)]
+        operator = (fetch_key(clause, :operator) || "eq").to_s
+        value = fetch_key(clause, :value)
+        mode = (fetch_key(clause, :mode) || "sensitive").to_s
+        insensitive = mode == "insensitive" && attributes[:type] == "string" && !value.nil?
+        predicate_column = insensitive ? lower(column) : column
+        predicate_value = insensitive ? lower_value(value) : value
+
+        case operator
+        when "in" then predicate_column.in(Array(predicate_value))
+        when "not_in" then predicate_column.not_in(Array(predicate_value))
+        when "ne" then predicate_column.not_eq(predicate_value)
+        when "gt" then column.gt(value)
+        when "gte" then column.gteq(value)
+        when "lt" then column.lt(value)
+        when "lte" then column.lteq(value)
+        when "contains" then predicate_column.matches("%#{escape_like(predicate_value)}%", "\\")
+        when "starts_with" then predicate_column.matches("#{escape_like(predicate_value)}%", "\\")
+        when "ends_with" then predicate_column.matches("%#{escape_like(predicate_value)}", "\\")
+        else predicate_column.eq(predicate_value)
+        end
+      end
+
       def apply_select(model, relation, select)
         columns = Array(select).map { |field| storage_field(model, storage_key(field)) }
         relation.select(*columns)
@@ -162,6 +212,10 @@ module BetterAuth
 
           value_provided = input.key?(field)
           value = input[field]
+          if value_provided && attributes[:input] == false && value && !force_allow_id
+            raise APIError.new("BAD_REQUEST", message: "#{field} is not allowed to be set")
+          end
+
           if !value_provided && action == "create" && attributes.key?(:default_value)
             value = resolve_default(attributes[:default_value])
             value_provided = true
@@ -169,9 +223,12 @@ module BetterAuth
             value = resolve_default(attributes[:on_update])
             value_provided = true
           end
-          output[field] = value if value_provided
+          if !value_provided && action == "create" && attributes[:required]
+            raise APIError.new("BAD_REQUEST", message: "#{field} is required") unless field == "id"
+          end
+          output[field] = coerce_value(value, attributes) if value_provided
         end
-        output["id"] = SecureRandom.urlsafe_base64(16) if action == "create" && !output.key?("id")
+        output["id"] = generated_id if action == "create" && !output.key?("id")
         output
       end
 
@@ -187,7 +244,7 @@ module BetterAuth
         attributes = record.respond_to?(:attributes) ? record.attributes : record
         normalized = schema_for(model).fetch(:fields).each_with_object({}) do |(field, config), output|
           column = config[:field_name] || physical_name(field)
-          output[field] = attributes[column] if attributes.key?(column)
+          output[field] = coerce_output_value(attributes[column], config) if attributes.key?(column)
         end
         attach_joins(model, normalized, record, join)
       end
@@ -289,7 +346,9 @@ module BetterAuth
             from: reference.fetch(:field).to_s,
             to: foreign_key,
             collection: !unique,
-            owner: :base
+            owner: :base,
+            relation: unique ? "one-to-one" : "one-to-many",
+            unique: unique
           }
         end
 
@@ -306,18 +365,12 @@ module BetterAuth
           from: foreign_key,
           to: reference.fetch(:field).to_s,
           collection: false,
-          owner: :join
+          owner: :join,
+          relation: "one-to-one",
+          unique: true
         }
       end
 
-      def reference_model_matches?(attributes, model)
-        reference = attributes[:references]
-        return false unless reference
-
-        reference_model = reference[:model] || reference["model"]
-        reference_model.to_s == model.to_s || reference_model.to_s == table_for(model)
-      end
-
       def association_defined?(klass, association)
         klass.respond_to?(:reflect_on_association) && klass.reflect_on_association(association)
       end
@@ -334,11 +387,7 @@ module BetterAuth
         physical_name(model).split("_").map(&:capitalize).join
       end
 
-      def collection_join?(model, join)
-        model == "user" && join&.keys&.any? { |join_model| join_model.to_s == "account" }
-      end
-
-      def aggregate_collection_joins(records)
+      def aggregate_collection_joins(_model, records, _join)
         records
       end
 
@@ -378,6 +427,62 @@ module BetterAuth
       def resolve_default(value)
         value.respond_to?(:call) ? value.call : value
       end
+
+      def coerce_value(value, attributes)
+        return value if value.nil?
+        return Time.parse(value) if attributes[:type] == "date" && value.is_a?(String)
+
+        value
+      end
+
+      def coerce_output_value(value, attributes)
+        return value if value.nil?
+        return coerce_boolean(value) if attributes[:type] == "boolean"
+        return Time.parse(value) if attributes[:type] == "date" && value.is_a?(String)
+        return parse_json_value(value) if json_like?(attributes) && value.is_a?(String)
+
+        value
+      end
+
+      def coerce_boolean(value)
+        return value if value == true || value == false
+        return false if value == 0 || value.to_s == "0" || value.to_s.downcase == "f" || value.to_s.downcase == "false"
+        return true if value == 1 || value.to_s == "1" || value.to_s.downcase == "t" || value.to_s.downcase == "true"
+
+        value
+      end
+
+      def json_like?(attributes)
+        %w[json string[] number[]].include?(attributes[:type])
+      end
+
+      def parse_json_value(value)
+        JSON.parse(value)
+      rescue JSON::ParserError
+        value
+      end
+
+      def lower(node)
+        Arel::Nodes::NamedFunction.new("LOWER", [node])
+      end
+
+      def lower_value(value)
+        return value.map { |entry| entry.nil? ? entry : entry.to_s.downcase } if value.is_a?(Array)
+
+        value.to_s.downcase
+      end
+
+      def generated_id
+        generator = options.advanced.dig(:database, :generate_id) || options.advanced.dig(:database, :generateId)
+        return generator.call.to_s if generator.respond_to?(:call)
+        return SecureRandom.uuid if generator.to_s == "uuid"
+
+        SecureRandom.hex(16)
+      end
+
+      def escape_like(value)
+        value.to_s.gsub(/[\\%_]/) { |match| "\\#{match}" }
+      end
     end
   end
 end

data/lib/better_auth/rails/configuration.rb

@@ -8,6 +8,7 @@ module BetterAuth
         base_url
         base_path
         secret
+        secrets
         database
         plugins
         trusted_origins

data/lib/better_auth/rails/controller_helpers.rb

@@ -33,6 +33,8 @@ module BetterAuth
       end
 
       def resolve_better_auth_session
+        auth_context = BetterAuth::Rails.auth.context
+        auth_context.prepare_for_request!(request) if auth_context.respond_to?(:prepare_for_request!)
         context = BetterAuth::Endpoint::Context.new(
           path: request.path,
           method: request.request_method,
@@ -40,7 +42,7 @@ module BetterAuth
           body: {},
           params: {},
           headers: {"cookie" => request.get_header("HTTP_COOKIE")},
-          context: BetterAuth::Rails.auth.context,
+          context: auth_context,
           request: request
         )
         BetterAuth::Session.find_current(context, disable_refresh: true)

data/lib/better_auth/rails/version.rb

@@ -2,6 +2,6 @@
 
 module BetterAuth
   module Rails
-    VERSION = "0.6.2"
+    VERSION = "0.7.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: better_auth-rails
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.7.0
 platform: ruby
 authors:
 - Sebastian Sala