better_auth 0.1.1 → 0.3.0

data/lib/better_auth/plugins/one_tap.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def one_tap(options = {})
+      config = normalize_hash(options)
+
+      Plugin.new(
+        id: "one-tap",
+        endpoints: {
+          one_tap_callback: one_tap_callback_endpoint(config)
+        },
+        options: config
+      )
+    end
+
+    def one_tap_callback_endpoint(config)
+      Endpoint.new(
+        path: "/one-tap/callback",
+        method: "POST",
+        body_schema: ->(body) {
+          data = normalize_hash(body)
+          data[:id_token].to_s.empty? ? false : data
+        },
+        metadata: {
+          openapi: {
+            summary: "One tap callback",
+            description: "Use this endpoint to authenticate with Google One Tap"
+          }
+        }
+      ) do |ctx|
+        body = normalize_hash(ctx.body)
+        id_token = body[:id_token].to_s
+        payload = one_tap_verify_id_token(ctx, config, id_token)
+        email = fetch_value(payload, "email").to_s.downcase
+
+        if email.empty?
+          next ctx.json({error: "Email not available in token"})
+        end
+
+        user = ctx.context.internal_adapter.find_user_by_email(email)
+        if user
+          one_tap_link_account_unless_present!(ctx, config, user, payload, id_token)
+          session_data = one_tap_create_session(ctx, user[:user])
+        else
+          raise APIError.new("BAD_GATEWAY", message: "User not found") if config[:disable_signup]
+
+          created = ctx.context.internal_adapter.create_oauth_user(
+            {
+              email: email,
+              emailVerified: one_tap_boolean_value(fetch_value(payload, "email_verified")),
+              name: fetch_value(payload, "name").to_s,
+              image: fetch_value(payload, "picture")
+            },
+            {
+              providerId: "google",
+              accountId: fetch_value(payload, "sub").to_s,
+              idToken: id_token
+            }
+          )
+          raise APIError.new("INTERNAL_SERVER_ERROR", message: "Could not create user") unless created
+
+          session_data = one_tap_create_session(ctx, created[:user])
+        end
+
+        Cookies.set_session_cookie(ctx, session_data)
+        ctx.json({
+          token: session_data[:session]["token"],
+          user: Schema.parse_output(ctx.context.options, "user", session_data[:user])
+        })
+      end
+    end
+
+    def one_tap_verify_id_token(ctx, config, id_token)
+      verifier = config[:verify_id_token]
+      audience = config[:client_id] || ctx.context.options.social_providers.dig(:google, :client_id)
+      payload = if verifier.respond_to?(:call)
+        verifier.call(id_token, ctx, audience: audience)
+      else
+        one_tap_verify_google_id_token(id_token, audience)
+      end
+      one_tap_stringify_payload(payload)
+    rescue
+      raise APIError.new("BAD_REQUEST", message: "invalid id token")
+    end
+
+    def one_tap_verify_google_id_token(id_token, audience)
+      jwks = one_tap_google_jwks
+      options = {
+        algorithms: ["RS256"],
+        iss: ["https://accounts.google.com", "accounts.google.com"],
+        verify_iss: true
+      }
+      if audience
+        options[:aud] = audience
+        options[:verify_aud] = true
+      end
+      payload, = JWT.decode(id_token, nil, true, options.merge(jwks: jwks))
+      payload
+    end
+
+    def one_tap_google_jwks
+      uri = URI("https://www.googleapis.com/oauth2/v3/certs")
+      response = Net::HTTP.get_response(uri)
+      raise "Unable to fetch Google JWKS" unless response.is_a?(Net::HTTPSuccess)
+
+      JWT::JWK::Set.new(JSON.parse(response.body))
+    end
+
+    def one_tap_link_account_unless_present!(ctx, _config, user, payload, id_token)
+      sub = fetch_value(payload, "sub").to_s
+      account = ctx.context.internal_adapter.find_account(sub)
+      return if account
+
+      account_linking = ctx.context.options.account[:account_linking] || {}
+      trusted = Array(account_linking[:trusted_providers]).map(&:to_s).include?("google")
+      enabled = account_linking.fetch(:enabled, true)
+      should_link_account = enabled != false && (trusted || one_tap_boolean_value(fetch_value(payload, "email_verified")))
+      unless should_link_account
+        raise APIError.new("UNAUTHORIZED", message: "Google sub doesn't match")
+      end
+
+      ctx.context.internal_adapter.link_account(
+        userId: user[:user]["id"],
+        providerId: "google",
+        accountId: sub,
+        scope: "openid,profile,email",
+        idToken: id_token
+      )
+    end
+
+    def one_tap_create_session(ctx, user)
+      session = ctx.context.internal_adapter.create_session(user["id"])
+      {session: session, user: user}
+    end
+
+    def one_tap_stringify_payload(payload)
+      raise "Invalid payload" unless payload.is_a?(Hash)
+
+      payload.each_with_object({}) do |(key, value), result|
+        result[key.to_s] = value
+      end
+    end
+
+    def one_tap_boolean_value(value)
+      value == true || value.to_s.downcase == "true"
+    end
+  end
+end

data/lib/better_auth/plugins/one_time_token.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def one_time_token(options = {})
+      config = {
+        expires_in: 3,
+        store_token: "plain"
+      }.merge(normalize_hash(options))
+
+      Plugin.new(
+        id: "one-time-token",
+        endpoints: {
+          generate_one_time_token: generate_one_time_token_endpoint(config),
+          verify_one_time_token: verify_one_time_token_endpoint(config)
+        },
+        hooks: {
+          after: [
+            {
+              matcher: ->(_ctx) { true },
+              handler: ->(ctx) { one_time_token_after_response(ctx, config) }
+            }
+          ]
+        },
+        options: config
+      )
+    end
+
+    def generate_one_time_token_endpoint(config)
+      Endpoint.new(path: "/one-time-token/generate", method: "GET") do |ctx|
+        if config[:disable_client_request] && ctx.request
+          raise APIError.new("BAD_REQUEST", message: "Client requests are disabled")
+        end
+
+        session = Routes.current_session(ctx)
+        token = one_time_token_create(ctx, config, session)
+        ctx.json({token: token})
+      end
+    end
+
+    def verify_one_time_token_endpoint(config)
+      Endpoint.new(path: "/one-time-token/verify", method: "POST") do |ctx|
+        body = normalize_hash(ctx.body)
+        token = body[:token].to_s
+        stored_token = one_time_token_stored_value(config, token)
+        verification = ctx.context.internal_adapter.find_verification_value("one-time-token:#{stored_token}")
+        raise APIError.new("BAD_REQUEST", message: "Invalid token") unless verification
+
+        ctx.context.internal_adapter.delete_verification_value(verification["id"])
+        raise APIError.new("BAD_REQUEST", message: "Token expired") if Routes.expired_time?(verification["expiresAt"])
+
+        session = ctx.context.internal_adapter.find_session(verification["value"])
+        raise APIError.new("BAD_REQUEST", message: "Session not found") unless session
+        raise APIError.new("BAD_REQUEST", message: "Session expired") if Routes.expired_time?(session[:session]["expiresAt"])
+
+        Cookies.set_session_cookie(ctx, session) unless config[:disable_set_session_cookie]
+        ctx.json(session)
+      end
+    end
+
+    def one_time_token_after_response(ctx, config)
+      return unless config[:set_ott_header_on_new_session]
+
+      session = ctx.context.new_session
+      return unless session && session[:session] && session[:user]
+
+      token = one_time_token_create(ctx, config, session)
+      existing = ctx.response_headers["access-control-expose-headers"].to_s
+      exposed = existing.split(",").map(&:strip).reject(&:empty?)
+      exposed << "set-ott"
+      ctx.set_header("set-ott", token)
+      ctx.set_header("access-control-expose-headers", exposed.uniq.join(", "))
+      nil
+    end
+
+    def one_time_token_create(ctx, config, session)
+      generator = config[:generate_token]
+      token = if generator.respond_to?(:call)
+        generator.call(session, ctx)
+      else
+        Crypto.random_string(32)
+      end.to_s
+      stored_token = one_time_token_stored_value(config, token)
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: "one-time-token:#{stored_token}",
+        value: session[:session]["token"],
+        expiresAt: Time.now + config[:expires_in].to_i * 60
+      )
+      token
+    end
+
+    def one_time_token_stored_value(config, token)
+      storage = config[:store_token]
+      return Crypto.sha256(token, encoding: :base64url) if storage.to_s == "hashed"
+
+      if storage.is_a?(Hash) && storage[:type].to_s.tr("_", "-") == "custom-hasher"
+        hasher = storage[:hash]
+        return hasher.call(token) if hasher.respond_to?(:call)
+      end
+
+      token
+    end
+  end
+end