better_auth 0.1.1 → 0.3.0

data/lib/better_auth/adapters/sql.rb

@@ -0,0 +1,441 @@
+# frozen_string_literal: true
+
+require "securerandom"
+require "json"
+require "time"
+
+module BetterAuth
+  module Adapters
+    class SQL < Base
+      attr_reader :connection, :dialect
+
+      def initialize(options, connection:, dialect:)
+        super(options)
+        @connection = connection
+        @dialect = dialect.to_sym
+      end
+
+      def create(model:, data:, force_allow_id: false)
+        model = model.to_s
+        input = transform_input(model, data, "create", force_allow_id)
+        table = table_for(model)
+        columns = input.keys.map { |field| storage_field(model, field) }
+        params = input.keys.map { |field| input[field] }
+        placeholders = params.each_index.map { |index| placeholder(index + 1) }
+        returning = (dialect == :postgres) ? " RETURNING *" : ""
+        sql = "INSERT INTO #{quote(table)} (#{columns.map { |column| quote(column) }.join(", ")}) VALUES (#{placeholders.join(", ")})#{returning}"
+        rows = execute(sql, params)
+        row = rows.first
+        return normalize_record(model, row) if row
+
+        find_one(model: model, where: [{field: "id", value: input.fetch("id")}])
+      end
+
+      def find_one(model:, where: [], select: nil, join: nil)
+        if collection_join?(model.to_s, join)
+          find_many(model: model, where: where, select: select, join: join).first
+        else
+          find_many(model: model, where: where, select: select, join: join, limit: 1).first
+        end
+      end
+
+      def find_many(model:, where: [], sort_by: nil, limit: nil, offset: nil, select: nil, join: nil)
+        model = model.to_s
+        params = []
+        sql = +"SELECT "
+        sql << "TOP (#{Integer(limit)}) " if dialect == :mssql && limit && !offset
+        sql << select_sql(model, select, join)
+        sql << " FROM "
+        sql << quote(table_for(model))
+        sql << join_sql(model, join)
+        where_sql = build_where(model, where || [], params)
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        sql << order_sql(model, sort_by) if sort_by
+        append_pagination_sql(sql, model, sort_by, limit, offset)
+
+        records = execute(sql, params).map { |row| normalize_record(model, row, join: join) }
+        collection_join?(model, join) ? aggregate_collection_joins(model, records, join) : records
+      end
+
+      def update(model:, where:, update:)
+        model = model.to_s
+        if dialect == :postgres
+          records = update_many(model: model, where: where, update: update, returning: true)
+          return records.is_a?(Array) ? records.first : records
+        end
+
+        existing = find_one(model: model, where: where, select: ["id"])
+        return nil unless existing
+
+        update_many(model: model, where: where, update: update)
+        find_one(model: model, where: [{field: "id", value: existing.fetch("id")}])
+      end
+
+      def update_many(model:, where:, update:, returning: false)
+        model = model.to_s
+        data = transform_input(model, update, "update", true)
+        params = []
+        assignments = data.each_key.map do |field|
+          params << data[field]
+          "#{quote(storage_field(model, field))} = #{placeholder(params.length)}"
+        end
+        where_sql = build_where(model, where || [], params)
+        sql = +"UPDATE "
+        sql << quote(table_for(model))
+        sql << " SET "
+        sql << assignments.join(", ")
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        sql << " RETURNING *" if dialect == :postgres
+        rows = execute(sql, params).map { |row| normalize_record(model, row) }
+        return rows if returning || dialect == :postgres
+
+        nil
+      end
+
+      def delete(model:, where:)
+        delete_many(model: model, where: where)
+        nil
+      end
+
+      def delete_many(model:, where:)
+        model = model.to_s
+        params = []
+        where_sql = build_where(model, where || [], params)
+        sql = +"DELETE FROM "
+        sql << quote(table_for(model))
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        result = execute(sql, params)
+        affected_rows(result)
+      end
+
+      def count(model:, where: nil)
+        model = model.to_s
+        params = []
+        where_sql = build_where(model, where || [], params)
+        sql = +"SELECT COUNT(*) AS count FROM "
+        sql << quote(table_for(model))
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        row = execute(sql, params).first || {}
+        (row["count"] || row[:count] || 0).to_i
+      end
+
+      def transaction
+        execute("BEGIN", [])
+        result = yield self
+        execute("COMMIT", [])
+        result
+      rescue
+        execute("ROLLBACK", [])
+        raise
+      end
+
+      private
+
+      def transform_input(model, data, action, force_allow_id)
+        fields = Schema.auth_tables(options).fetch(model).fetch(:fields)
+        input = stringify_keys(data)
+        output = {}
+
+        fields.each do |field, attributes|
+          next if field == "id" && input.key?(field) && !force_allow_id
+
+          value_provided = input.key?(field)
+          value = input[field]
+          if value_provided && attributes[:input] == false && value && !force_allow_id
+            raise APIError.new("BAD_REQUEST", message: "#{field} is not allowed to be set")
+          end
+
+          if !value_provided && action == "create" && attributes.key?(:default_value)
+            value = resolve_default(attributes[:default_value])
+            value_provided = true
+          elsif !value_provided && action == "update" && attributes[:on_update]
+            value = resolve_default(attributes[:on_update])
+            value_provided = true
+          end
+          if !value_provided && action == "create" && attributes[:required]
+            raise APIError.new("BAD_REQUEST", message: "#{field} is required") unless field == "id"
+          end
+          output[field] = coerce_value(value, attributes) if value_provided
+        end
+
+        output["id"] = generated_id if action == "create" && !output.key?("id")
+        output
+      end
+
+      def select_sql(model, select, join)
+        fields = Array(select).empty? ? schema_for(model).fetch(:fields).keys : Array(select).map { |field| storage_key(field) }
+        columns = fields.map do |field|
+          column = storage_field(model, field)
+          "#{quote(table_for(model))}.#{quote(column)} AS #{quote(column)}"
+        end
+        columns.concat(join_select_sql(model, join)) if join
+        columns.join(", ")
+      end
+
+      def join_select_sql(model, join)
+        join.flat_map do |join_model, _enabled|
+          join_model = join_model.to_s
+          schema_for(join_model).fetch(:fields).map do |field, attributes|
+            column = attributes[:field_name] || physical_name(field)
+            "#{quote(join_model)}.#{quote(column)} AS #{quote("#{join_model}__#{column}")}"
+          end
+        end
+      end
+
+      def join_sql(model, join)
+        return "" unless join
+
+        join.map do |join_model, _enabled|
+          join_model = join_model.to_s
+          case [model, join_model]
+          when ["session", "user"], ["account", "user"]
+            " LEFT JOIN #{quote(table_for("user"))} AS #{quote("user")} ON #{quote("user")}.#{quote("id")} = #{quote(table_for(model))}.#{quote("user_id")}"
+          when ["user", "account"]
+            " LEFT JOIN #{quote(table_for("account"))} AS #{quote("account")} ON #{quote("account")}.#{quote("user_id")} = #{quote(table_for(model))}.#{quote("id")}"
+          else
+            ""
+          end
+        end.join
+      end
+
+      def build_where(model, where, params)
+        Array(where).each_with_index.map do |clause, index|
+          field = storage_key(fetch_key(clause, :field))
+          column = "#{quote(table_for(model))}.#{quote(storage_field(model, field))}"
+          operator = (fetch_key(clause, :operator) || "eq").to_s
+          value = fetch_key(clause, :value)
+
+          expression = case operator
+          when "in", "not_in"
+            values = Array(value)
+            placeholders = values.map do |entry|
+              params << entry
+              placeholder(params.length)
+            end.join(", ")
+            sql_operator = (operator == "not_in") ? "NOT IN" : "IN"
+            "#{column} #{sql_operator} (#{placeholders})"
+          when "contains", "starts_with", "ends_with"
+            pattern = case operator
+            when "starts_with" then "#{value}%"
+            when "ends_with" then "%#{value}"
+            else "%#{value}%"
+            end
+            params << pattern
+            "#{column} LIKE #{placeholder(params.length)}"
+          else
+            params << value
+            "#{column} #{sql_operator(operator)} #{placeholder(params.length)}"
+          end
+
+          connector = (index.positive? && fetch_key(clause, :connector).to_s.upcase == "OR") ? "OR" : "AND"
+          index.zero? ? expression : "#{connector} #{expression}"
+        end.join(" ")
+      end
+
+      def order_sql(model, sort_by)
+        field = Schema.storage_key(fetch_key(sort_by, :field))
+        direction = (fetch_key(sort_by, :direction).to_s.downcase == "desc") ? "DESC" : "ASC"
+        " ORDER BY #{quote(table_for(model))}.#{quote(storage_field(model, field))} #{direction}"
+      end
+
+      def append_pagination_sql(sql, model, sort_by, limit, offset)
+        if dialect == :mssql
+          return if limit && !offset
+          return unless offset
+
+          sql << order_sql(model, {field: "id", direction: "asc"}) unless sort_by
+          sql << " OFFSET #{Integer(offset)} ROWS"
+          sql << " FETCH NEXT #{Integer(limit)} ROWS ONLY" if limit
+          return
+        end
+
+        sql << " LIMIT #{Integer(limit)}" if limit
+        sql << " OFFSET #{Integer(offset)}" if offset
+      end
+
+      def sql_operator(operator)
+        {
+          "ne" => "!=",
+          "gt" => ">",
+          "gte" => ">=",
+          "lt" => "<",
+          "lte" => "<="
+        }.fetch(operator, "=")
+      end
+
+      def execute(sql, params)
+        if connection.respond_to?(:exec_params)
+          result = connection.exec_params(sql, params)
+          return result.to_a if result.respond_to?(:to_a)
+
+          result
+        elsif connection.respond_to?(:query) && params.empty?
+          result = connection.query(sql)
+          result.respond_to?(:to_a) ? result.to_a : result
+        elsif connection.respond_to?(:prepare)
+          statement = connection.prepare(sql)
+          result = statement.execute(*params)
+          result.respond_to?(:to_a) ? result.to_a : result
+        elsif connection.respond_to?(:execute)
+          result = connection.execute(sql, params)
+          result.respond_to?(:to_a) ? result.to_a : result
+        else
+          raise Error, "SQL connection must respond to exec_params or prepare"
+        end
+      end
+
+      def affected_rows(result)
+        return result.cmd_tuples if result.respond_to?(:cmd_tuples)
+        return result.affected_rows if result.respond_to?(:affected_rows)
+        return connection.changes if connection.respond_to?(:changes)
+        return result.to_i if result.respond_to?(:to_i)
+
+        0
+      end
+
+      def normalize_record(model, row, join: nil)
+        return nil unless row
+
+        fields = schema_for(model).fetch(:fields)
+        record = fields.each_with_object({}) do |(field, attributes), output|
+          column = attributes[:field_name] || physical_name(field)
+          output[field] = coerce_output_value(fetch_row(row, column), attributes) if row_key?(row, column)
+        end
+
+        join&.each_key do |join_model|
+          join_model = join_model.to_s
+          record[join_model] = normalize_joined_record(join_model, row)
+        end
+
+        record
+      end
+
+      def normalize_joined_record(model, row)
+        schema_for(model).fetch(:fields).each_with_object({}) do |(field, attributes), output|
+          column = attributes[:field_name] || physical_name(field)
+          key = "#{model}__#{column}"
+          output[field] = coerce_output_value(fetch_row(row, key), attributes) if row_key?(row, key)
+        end
+      end
+
+      def collection_join?(model, join)
+        model == "user" && join&.keys&.any? { |join_model| join_model.to_s == "account" }
+      end
+
+      def aggregate_collection_joins(_model, records, _join)
+        grouped = {}
+        records.each do |record|
+          key = record.fetch("id")
+          grouped[key] ||= record.merge("account" => [])
+          account = record["account"]
+          grouped[key]["account"] << account if account&.values&.any?
+        end
+        grouped.values
+      end
+
+      def row_key?(row, key)
+        row.key?(key) || row.key?(key.to_sym)
+      end
+
+      def fetch_row(row, key)
+        return row[key] if row.key?(key)
+
+        row[key.to_sym]
+      end
+
+      def table_for(model)
+        schema_for(model).fetch(:model_name)
+      end
+
+      def schema_for(model)
+        Schema.auth_tables(options).fetch(model.to_s)
+      end
+
+      def storage_field(model, field)
+        schema_for(model).fetch(:fields).fetch(field.to_s).fetch(:field_name, physical_name(field))
+      end
+
+      def quote(identifier)
+        Schema::SQL.quote(identifier, dialect)
+      end
+
+      def placeholder(index)
+        (dialect == :postgres) ? "$#{index}" : "?"
+      end
+
+      def generated_id
+        generator = options.advanced.dig(:database, :generate_id)
+        return generator.call.to_s if generator.respond_to?(:call)
+        return SecureRandom.uuid if generator == "uuid"
+
+        SecureRandom.hex(16)
+      end
+
+      def resolve_default(default)
+        default.respond_to?(:call) ? default.call : default
+      end
+
+      def coerce_value(value, attributes)
+        return value if value.nil?
+        return value ? 1 : 0 if dialect == :sqlite && attributes[:type] == "boolean"
+        return value.iso8601(6) if dialect == :sqlite && attributes[:type] == "date" && value.respond_to?(:iso8601)
+        return Time.parse(value) if attributes[:type] == "date" && value.is_a?(String)
+        return JSON.generate(value) if json_like?(attributes) && !value.is_a?(String)
+
+        value
+      end
+
+      def coerce_output_value(value, attributes)
+        return value if value.nil?
+        return coerce_boolean(value) if attributes[:type] == "boolean"
+        return Time.parse(value) if attributes[:type] == "date" && value.is_a?(String)
+        return parse_json_value(value) if json_like?(attributes) && value.is_a?(String)
+
+        value
+      end
+
+      def json_like?(attributes)
+        %w[json string[] number[]].include?(attributes[:type])
+      end
+
+      def parse_json_value(value)
+        JSON.parse(value)
+      rescue JSON::ParserError
+        value
+      end
+
+      def coerce_boolean(value)
+        return value if value == true || value == false
+        return false if value == 0 || value.to_s == "0" || value.to_s.downcase == "f" || value.to_s.downcase == "false"
+        return true if value == 1 || value.to_s == "1" || value.to_s.downcase == "t" || value.to_s.downcase == "true"
+
+        value
+      end
+
+      def stringify_keys(data)
+        data.each_with_object({}) do |(key, value), result|
+          result[storage_key(key)] = value
+        end
+      end
+
+      def fetch_key(hash, key)
+        [key, key.to_s, storage_key(key), storage_key(key).to_sym].each do |candidate|
+          return hash[candidate] if hash.key?(candidate)
+        end
+        nil
+      end
+
+      def storage_key(value)
+        parts = physical_name(value).split("_")
+        ([parts.first] + parts.drop(1).map(&:capitalize)).join
+      end
+
+      def physical_name(value)
+        value.to_s
+          .gsub(/([a-z\d])([A-Z])/, "\\1_\\2")
+          .tr("-", "_")
+          .downcase
+      end
+    end
+  end
+end

data/lib/better_auth/adapters/sqlite.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Adapters
+    class SQLite < SQL
+      attr_reader :path
+
+      def initialize(options = nil, path: nil, connection: nil)
+        require "sqlite3" unless connection
+
+        config = options || Configuration.new(secret: Configuration::DEFAULT_SECRET, database: :memory)
+        @path = path || ":memory:"
+        connection ||= SQLite3::Database.new(@path)
+        connection.results_as_hash = true if connection.respond_to?(:results_as_hash=)
+        connection.execute("PRAGMA foreign_keys = ON") if connection.respond_to?(:execute)
+        super(config, connection: connection, dialect: :sqlite)
+      end
+    end
+  end
+end

data/lib/better_auth/api.rb

@@ -0,0 +1,226 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  class API
+    attr_reader :context, :endpoints
+
+    def initialize(context, endpoints)
+      @context = context
+      @endpoints = endpoints
+      define_endpoint_methods
+    end
+
+    def call_endpoint(key, input = {})
+      context.reset_runtime! if context.respond_to?(:reset_runtime!)
+      endpoint = endpoints.fetch(key.to_sym)
+      input = symbolize_keys(input || {})
+      endpoint_context = Endpoint::Context.new(
+        path: endpoint.path,
+        method: input[:method] || Array(endpoint.methods).first,
+        query: input[:query] || {},
+        body: input[:body] || {},
+        params: input[:params] || {},
+        headers: input[:headers] || {},
+        context: context
+      )
+
+      result = run_endpoint_with_hooks(endpoint, endpoint_context)
+      format_result(result, input)
+    end
+
+    def execute(endpoint, endpoint_context)
+      run_endpoint_with_hooks(endpoint, endpoint_context)
+    end
+
+    private
+
+    def define_endpoint_methods
+      endpoints.each_key do |key|
+        method_name = normalize_method_name(key)
+        define_singleton_method(method_name) do |input = {}|
+          call_endpoint(key, input || {})
+        end
+      end
+    end
+
+    def normalize_method_name(key)
+      key.to_s
+        .gsub(/([a-z\d])([A-Z])/, "\\1_\\2")
+        .tr("-", "_")
+        .downcase
+        .to_sym
+    end
+
+    def run_endpoint_with_hooks(endpoint, endpoint_context)
+      before = run_before_hooks(endpoint_context)
+      return normalize_short_circuit(before, endpoint_context) if before
+
+      result = begin
+        endpoint.call(endpoint_context)
+      rescue APIError => error
+        Endpoint::Result.new(
+          response: error,
+          status: error.status_code,
+          headers: Endpoint::Result.merge_headers(endpoint_context.response_headers, error.headers)
+        )
+      end
+
+      return result if result.raw_response?
+
+      endpoint_context.returned = result.response
+      endpoint_context.response_headers = result.headers.dup
+
+      after_result = run_after_hooks(endpoint_context)
+      result.response = after_result.response
+      result.headers = after_result.headers
+      result.status = after_result.status if after_result.status
+      result
+    rescue APIError => error
+      Endpoint::Result.new(response: error, status: error.status_code, headers: error.headers)
+    end
+
+    def run_before_hooks(endpoint_context)
+      before_hooks.each do |hook|
+        next unless hook_matches?(hook, endpoint_context)
+
+        result = hook[:handler].call(endpoint_context)
+        next unless result
+
+        context_data = fetch_key(result, :context)
+        if result.is_a?(Hash) && context_data.is_a?(Hash)
+          endpoint_context.merge_context!(context_data)
+          next
+        end
+
+        return result
+      end
+
+      nil
+    end
+
+    def run_after_hooks(endpoint_context)
+      result = Endpoint::Result.new(
+        response: endpoint_context.returned,
+        status: endpoint_context.status,
+        headers: endpoint_context.response_headers
+      )
+
+      after_hooks.each do |hook|
+        next unless hook_matches?(hook, endpoint_context)
+
+        hook_result = begin
+          hook[:handler].call(endpoint_context)
+        rescue APIError => error
+          error
+        end
+
+        result.headers = endpoint_context.response_headers.dup
+
+        next unless hook_result
+
+        normalized = Endpoint::Result.from_value(hook_result, endpoint_context)
+        result.response = normalized.response
+        result.status = normalized.status
+        result.headers = normalized.headers
+        endpoint_context.returned = result.response
+        endpoint_context.response_headers = result.headers
+      end
+
+      result
+    end
+
+    def normalize_short_circuit(value, endpoint_context)
+      Endpoint::Result.from_value(value, endpoint_context)
+    rescue APIError => error
+      Endpoint::Result.new(response: error, status: error.status_code, headers: error.headers)
+    end
+
+    def format_result(result, input)
+      return result.to_rack_response if result.raw_response?
+
+      if result.response.is_a?(APIError)
+        return error_response(result.response, headers: result.headers) if input[:as_response]
+
+        raise result.response
+      end
+
+      return result.to_rack_response if input[:as_response]
+
+      if input[:return_headers]
+        output = {
+          headers: result.headers,
+          response: result.response
+        }
+        output[:status] = result.status if input[:return_status]
+        return output
+      end
+
+      return {response: result.response, status: result.status} if input[:return_status]
+
+      result.response
+    end
+
+    def error_response(error, headers: {})
+      Endpoint::Result.new(
+        response: error.to_h,
+        status: error.status_code,
+        headers: Endpoint::Result.merge_headers(headers, error.headers)
+      ).to_rack_response
+    end
+
+    def before_hooks
+      hooks = []
+      user_before = context.options.hooks&.fetch(:before, nil)
+      hooks << {matcher: ->(_ctx) { true }, handler: user_before} if user_before
+      hooks.concat(plugin_hooks(:before))
+      hooks
+    end
+
+    def after_hooks
+      hooks = []
+      user_after = context.options.hooks&.fetch(:after, nil)
+      hooks << {matcher: ->(_ctx) { true }, handler: user_after} if user_after
+      hooks.concat(plugin_hooks(:after))
+      hooks
+    end
+
+    def plugin_hooks(type)
+      context.options.plugins.flat_map do |plugin|
+        hooks = plugin.dig(:hooks, type)
+        Array(hooks).map do |hook|
+          {
+            matcher: hook[:matcher] || ->(_ctx) { true },
+            handler: hook[:handler]
+          }
+        end
+      end.compact
+    end
+
+    def hook_matches?(hook, endpoint_context)
+      matcher = hook[:matcher] || ->(_ctx) { true }
+      matcher.call(endpoint_context)
+    end
+
+    def fetch_key(hash, key)
+      return unless hash.is_a?(Hash)
+
+      hash[key] || hash[key.to_s]
+    end
+
+    def symbolize_keys(value)
+      return value unless value.is_a?(Hash)
+
+      value.each_with_object({}) do |(key, object_value), result|
+        result[normalize_key(key)] = object_value.is_a?(Hash) ? symbolize_keys(object_value) : object_value
+      end
+    end
+
+    def normalize_key(key)
+      key.to_s
+        .gsub(/([a-z\d])([A-Z])/, "\\1_\\2")
+        .tr("-", "_")
+        .downcase
+        .to_sym
+    end
+  end
+end