better_auth 0.10.0 → 0.11.0

data/lib/better_auth/plugins/oauth_provider.rb

@@ -1,16 +1,13 @@
 # frozen_string_literal: true
 
+return if defined?(BetterAuth::Plugins::OAUTH_PROVIDER_PLUGIN_IMPLEMENTATION)
+
 module BetterAuth
   module Plugins
     module_function
 
-    def oauth_provider(*args)
-      Kernel.require "better_auth/oauth_provider"
-      BetterAuth::Plugins.oauth_provider(*args)
-    rescue LoadError => error
-      raise if error.path && error.path != "better_auth/oauth_provider"
-
-      raise LoadError, "BetterAuth::Plugins.oauth_provider requires the better_auth-oauth-provider gem. Add `gem \"better_auth-oauth-provider\"` and `require \"better_auth/oauth_provider\"`."
+    def oauth_provider(*args, &block)
+      call_external_plugin!(:oauth_provider, *args, implementation_constant: :OAUTH_PROVIDER_PLUGIN_IMPLEMENTATION, gem_name: "better_auth-oauth-provider", entry: "lib/better_auth/oauth_provider.rb", &block)
     end
   end
 end

data/lib/better_auth/plugins/oauth_proxy.rb

@@ -14,7 +14,7 @@ module BetterAuth
       Plugin.new(
         id: "oauth-proxy",
         endpoints: {
-          o_auth_proxy: oauth_proxy_endpoint(config)
+          oauth_proxy: oauth_proxy_endpoint(config)
         },
         hooks: {
           before: [

data/lib/better_auth/plugins/one_tap.rb

@@ -50,36 +50,32 @@ module BetterAuth
         id_token = body[:id_token].to_s
         payload = one_tap_verify_id_token(ctx, config, id_token)
         email = fetch_value(payload, "email").to_s.downcase
+        raise APIError.new("BAD_REQUEST", message: "invalid id token") if Routes.blank_remote_id?(fetch_value(payload, "sub"))
 
         if email.empty?
           next ctx.json({error: "Email not available in token"})
         end
 
-        user = ctx.context.internal_adapter.find_user_by_email(email)
-        if user
-          one_tap_link_account_unless_present!(ctx, config, user, payload, id_token)
-          session_data = one_tap_create_session(ctx, user[:user])
-        else
-          raise APIError.new("BAD_GATEWAY", message: "User not found") if config[:disable_signup]
-
-          created = ctx.context.internal_adapter.create_oauth_user(
-            {
-              email: email,
-              emailVerified: one_tap_boolean_value(fetch_value(payload, "email_verified")),
-              name: fetch_value(payload, "name").to_s,
-              image: fetch_value(payload, "picture")
-            },
-            {
-              providerId: "google",
-              accountId: fetch_value(payload, "sub").to_s,
-              idToken: id_token
-            },
-            context: ctx
-          )
-          raise APIError.new("INTERNAL_SERVER_ERROR", message: "Could not create user") unless created
-
-          session_data = one_tap_create_session(ctx, created[:user])
-        end
+        sub = fetch_value(payload, "sub").to_s
+        session_data = Routes.persist_social_user(
+          ctx,
+          "google",
+          {
+            id: sub,
+            email: email,
+            emailVerified: one_tap_boolean_value(fetch_value(payload, "email_verified")),
+            name: fetch_value(payload, "name").to_s,
+            image: fetch_value(payload, "picture")
+          },
+          {
+            providerId: "google",
+            accountId: sub,
+            idToken: id_token,
+            scope: "openid,profile,email"
+          },
+          disable_sign_up: config[:disable_signup]
+        )
+        one_tap_raise_persistence_error!(session_data[:error]) if session_data[:error]
 
         Cookies.set_session_cookie(ctx, session_data)
         ctx.json({
@@ -90,16 +86,35 @@ module BetterAuth
     end
 
     def one_tap_verify_id_token(ctx, config, id_token)
-      verifier = config[:verify_id_token]
-      audience = config[:client_id] || ctx.context.options.social_providers.dig(:google, :client_id)
-      payload = if verifier.respond_to?(:call)
-        verifier.call(id_token, ctx, audience: audience)
-      else
-        one_tap_verify_google_id_token(id_token, audience)
+      google_provider = ctx.context.options.social_providers[:google] || {}
+      google_options = fetch_value(google_provider, "options") || {}
+      audience = config[:client_id]
+      audience = fetch_value(google_provider, "client_id") if one_tap_blank_audience?(audience)
+      if one_tap_blank_audience?(audience)
+        raise APIError.new(
+          "BAD_REQUEST",
+          message: "Google client ID is required for One Tap. Set it on the one_tap plugin (client_id) or on social_providers.google."
+        )
+      end
+
+      begin
+        verifier = config[:verify_id_token]
+        payload = if verifier.respond_to?(:call)
+          verifier.call(id_token, ctx, audience: audience)
+        else
+          one_tap_verify_google_id_token(id_token, audience)
+        end
+        payload = one_tap_stringify_payload(payload)
+        hosted_domain = fetch_value(google_provider, "hd")
+        hosted_domain = fetch_value(google_options, "hd") if hosted_domain.nil?
+        unless SocialProviders.google_hosted_domain_allowed?(hosted_domain, payload["hd"])
+          raise "Invalid Google hosted domain"
+        end
+
+        payload
+      rescue
+        raise APIError.new("BAD_REQUEST", message: "invalid id token")
       end
-      one_tap_stringify_payload(payload)
-    rescue
-      raise APIError.new("BAD_REQUEST", message: "invalid id token")
     end
 
     def one_tap_verify_google_id_token(id_token, audience)
@@ -109,10 +124,8 @@ module BetterAuth
         iss: ["https://accounts.google.com", "accounts.google.com"],
         verify_iss: true
       }
-      if audience
-        options[:aud] = audience
-        options[:verify_aud] = true
-      end
+      options[:aud] = audience
+      options[:verify_aud] = true
       payload, = ::JWT.decode(id_token, nil, true, options.merge(jwks: jwks))
       payload
     end
@@ -129,31 +142,19 @@ module BetterAuth
       jwks
     end
 
-    def one_tap_link_account_unless_present!(ctx, _config, user, payload, id_token)
-      sub = fetch_value(payload, "sub").to_s
-      account = ctx.context.internal_adapter.find_account(sub)
-      return if account
+    def one_tap_blank_audience?(audience)
+      Array(audience).empty? || Array(audience).all? { |value| value.to_s.strip.empty? }
+    end
 
-      account_linking = ctx.context.options.account[:account_linking] || {}
-      trusted = Array(account_linking[:trusted_providers]).map(&:to_s).include?("google")
-      enabled = account_linking.fetch(:enabled, true)
-      should_link_account = enabled != false && (trusted || one_tap_boolean_value(fetch_value(payload, "email_verified")))
-      unless should_link_account
+    def one_tap_raise_persistence_error!(error)
+      case error
+      when "signup disabled"
+        raise APIError.new("BAD_GATEWAY", message: "User not found")
+      when "account not linked", "banned"
         raise APIError.new("UNAUTHORIZED", message: "Google sub doesn't match")
+      else
+        raise APIError.new("INTERNAL_SERVER_ERROR", message: "Could not create user")
       end
-
-      ctx.context.internal_adapter.link_account(
-        userId: user[:user]["id"],
-        providerId: "google",
-        accountId: sub,
-        scope: "openid,profile,email",
-        idToken: id_token
-      )
-    end
-
-    def one_tap_create_session(ctx, user)
-      session = ctx.context.internal_adapter.create_session(user["id"])
-      {session: session, user: user}
     end
 
     def one_tap_stringify_payload(payload)

data/lib/better_auth/plugins/one_time_token.rb

@@ -85,12 +85,9 @@ module BetterAuth
         body = normalize_hash(ctx.body)
         token = body[:token].to_s
         stored_token = one_time_token_stored_value(config, token)
-        verification = ctx.context.internal_adapter.find_verification_value("one-time-token:#{stored_token}")
+        verification = ctx.context.internal_adapter.consume_verification_value("one-time-token:#{stored_token}")
         raise APIError.new("BAD_REQUEST", message: "Invalid token") unless verification
 
-        ctx.context.internal_adapter.delete_verification_value(verification["id"])
-        raise APIError.new("BAD_REQUEST", message: "Token expired") if Routes.expired_time?(verification["expiresAt"])
-
         session = ctx.context.internal_adapter.find_session(verification["value"])
         raise APIError.new("BAD_REQUEST", message: "Session not found") unless session
         raise APIError.new("BAD_REQUEST", message: "Session expired") if Routes.expired_time?(session[:session]["expiresAt"])

data/lib/better_auth/plugins/open_api.rb

@@ -2,6 +2,10 @@
 
 module BetterAuth
   module OpenAPI
+    # Better Auth action endpoints advertise upstream camelCase JSON field names in
+    # OpenAPI and generated inventories. Runtime may still accept Ruby snake_case
+    # aliases via normalize_hash and route validation.
+
     module_function
 
     def object_schema(properties, required: [])
@@ -234,7 +238,7 @@ module BetterAuth
       Plugin.new(
         id: "open-api",
         endpoints: {
-          generate_open_api_schema: Endpoint.new(path: "/open-api/generate-schema", method: "GET") do |ctx|
+          generate_openapi_schema: Endpoint.new(path: "/open-api/generate-schema", method: "GET") do |ctx|
             ctx.json(open_api_schema(ctx.context))
           end,
           open_api_reference: Endpoint.new(path: config[:path], method: "GET", metadata: {hide: true}) do |ctx|
@@ -267,7 +271,7 @@ module BetterAuth
         ],
         servers: [
           {
-            url: context.base_url
+            url: context.canonical_base_url
           }
         ],
         tags: [
@@ -308,6 +312,7 @@ module BetterAuth
 
     def open_api_paths(endpoints, options)
       disabled_paths = Array(options.disabled_paths).map(&:to_s)
+      used_operation_ids = Set.new
       endpoints.each_with_object({}) do |(key, endpoint, tag), paths|
         next unless endpoint.path
         next if endpoint.metadata[:exclude_from_openapi] || endpoint.metadata[:SERVER_ONLY] || endpoint.metadata[:server_only]
@@ -318,7 +323,7 @@ module BetterAuth
         path = open_api_path(endpoint.path)
         paths[path] ||= {}
         endpoint.methods.reject { |method| method == "*" }.each do |method|
-          paths[path][method.downcase.to_sym] = open_api_operation(endpoint, method, tag)
+          paths[path][method.downcase.to_sym] = open_api_operation(endpoint, method, tag, used_operation_ids)
         end
       end
     end
@@ -331,12 +336,12 @@ module BetterAuth
       tag == "Default" && [:ok, :error].include?(key) && endpoint.metadata[:openapi]
     end
 
-    def open_api_operation(endpoint, method, tag)
+    def open_api_operation(endpoint, method, tag, used_operation_ids)
       metadata = endpoint.metadata[:openapi] || {}
       operation = {
         tags: Array(metadata[:tags] || [tag]),
         description: metadata[:description],
-        operationId: metadata[:operationId],
+        operationId: open_api_operation_id(metadata[:operationId], method, used_operation_ids),
         security: [
           {
             bearerAuth: []
@@ -353,6 +358,26 @@ module BetterAuth
       operation
     end
 
+    def open_api_operation_id(base_id, method, used_operation_ids)
+      return if base_id.to_s.empty?
+
+      operation_id = base_id.to_s
+      unless used_operation_ids.include?(operation_id)
+        used_operation_ids << operation_id
+        return operation_id
+      end
+
+      suffix = method.to_s.downcase.capitalize
+      candidate = "#{operation_id}#{suffix}"
+      duplicate_index = 2
+      while used_operation_ids.include?(candidate)
+        candidate = "#{operation_id}#{suffix}#{duplicate_index}"
+        duplicate_index += 1
+      end
+      used_operation_ids << candidate
+      candidate
+    end
+
     def open_api_components(options)
       Schema.auth_tables(options).each_with_object({}) do |(model, table), schemas|
         name = model.to_s.split(/[_-]/).map(&:capitalize).join
@@ -361,11 +386,14 @@ module BetterAuth
     end
 
     def schema_for_table(table)
-      required = []
+      required = ["id"]
       properties = table[:fields].each_with_object({}) do |(field, attributes), result|
+        next if field.to_s == "id"
+
         result[field.to_sym] = field_schema(attributes)
-        required << field if attributes[:required] && attributes[:input] != false && field != "id"
+        required << field if attributes[:required] && attributes[:returned] != false
       end
+      properties = {id: {type: "string", readOnly: true}}.merge(properties)
       {type: "object", properties: properties, required: required}
     end