better_auth 0.10.0 → 0.11.0

data/lib/better_auth/plugins/passkey.rb

@@ -1,16 +1,13 @@
 # frozen_string_literal: true
 
+return if defined?(BetterAuth::Plugins::PASSKEY_PLUGIN_IMPLEMENTATION)
+
 module BetterAuth
   module Plugins
     module_function
 
-    def passkey(*args)
-      Kernel.require "better_auth/passkey"
-      BetterAuth::Plugins.passkey(*args)
-    rescue LoadError => error
-      raise if error.path && error.path != "better_auth/passkey"
-
-      raise LoadError, "BetterAuth::Plugins.passkey requires the better_auth-passkey gem. Add `gem \"better_auth-passkey\"` and `require \"better_auth/passkey\"`."
+    def passkey(*args, &block)
+      call_external_plugin!(:passkey, *args, implementation_constant: :PASSKEY_PLUGIN_IMPLEMENTATION, gem_name: "better_auth-passkey", entry: "lib/better_auth/passkey.rb", &block)
     end
   end
 end

data/lib/better_auth/plugins/phone_number.rb

@@ -110,7 +110,7 @@ module BetterAuth
 
         if config[:require_verification] && !found["phoneNumberVerified"]
           code = phone_number_generate_code(config)
-          phone_number_store_code(ctx, config, phone_number, code)
+          phone_number_store_code(ctx, config, phone_number, code) unless config[:verify_otp].respond_to?(:call)
           phone_number_deliver_otp(config, {phone_number: phone_number, code: code}, ctx)
           raise APIError.new("UNAUTHORIZED", message: PHONE_NUMBER_ERROR_CODES["PHONE_NUMBER_NOT_VERIFIED"])
         end
@@ -170,7 +170,7 @@ module BetterAuth
         phone_number = body[:phone_number].to_s
         validate_phone_number!(config, phone_number)
         code = phone_number_generate_code(config)
-        phone_number_store_code(ctx, config, phone_number, code)
+        phone_number_store_code(ctx, config, phone_number, code) unless config[:verify_otp].respond_to?(:call)
         phone_number_deliver_otp(config, {phone_number: phone_number, code: code}, ctx)
         ctx.json({message: "code sent"})
       end
@@ -280,7 +280,7 @@ module BetterAuth
         phone_number = body[:phone_number].to_s
         user = ctx.context.adapter.find_one(model: "user", where: [{field: "phoneNumber", value: phone_number}])
         code = phone_number_generate_code(config)
-        phone_number_store_code(ctx, config, "#{phone_number}-request-password-reset", code)
+        phone_number_store_code(ctx, config, "#{phone_number}-request-password-reset", code) unless config[:verify_otp].respond_to?(:call)
 
         if user && config[:send_password_reset_otp].respond_to?(:call)
           config[:send_password_reset_otp].call({phone_number: phone_number, code: code}, ctx)
@@ -319,14 +319,13 @@ module BetterAuth
         otp = body[:otp].to_s
         new_password = body[:new_password]
 
-        verification = phone_number_verify_code!(ctx, config, "#{phone_number}-request-password-reset", otp, consume: false)
         user = ctx.context.adapter.find_one(model: "user", where: [{field: "phoneNumber", value: phone_number}])
         raise APIError.new("BAD_REQUEST", message: PHONE_NUMBER_ERROR_CODES["UNEXPECTED_ERROR"]) unless user
 
         Routes.validate_password_length!(new_password, ctx.context.options.email_and_password)
+        phone_number_verify_code!(ctx, config, "#{phone_number}-request-password-reset", otp)
         ctx.context.internal_adapter.update_password(user["id"], Routes.hash_password(ctx, new_password))
-        ctx.context.internal_adapter.delete_verification_value(verification["id"])
-        ctx.context.internal_adapter.delete_sessions(user["id"]) if ctx.context.options.email_and_password[:revoke_sessions_on_password_reset]
+        ctx.context.internal_adapter.delete_user_sessions(user["id"]) if ctx.context.options.email_and_password[:revoke_sessions_on_password_reset]
         ctx.json({status: true})
       end
     end
@@ -367,43 +366,52 @@ module BetterAuth
     def phone_number_verify_code!(ctx, config, identifier, code, consume: true)
       verifier = config[:verify_otp]
       if verifier.respond_to?(:call)
+        # Custom verify_otp owns single-use and expiry state completely.
         valid = verifier.call({phone_number: identifier.delete_suffix("-request-password-reset"), code: code}, ctx)
         raise APIError.new("BAD_REQUEST", message: PHONE_NUMBER_ERROR_CODES["INVALID_OTP"]) unless valid
 
-        verification = ctx.context.internal_adapter.find_verification_value(identifier)
-        ctx.context.internal_adapter.delete_verification_value(verification["id"]) if consume && verification
-        return verification || true
+        return true
       end
 
-      verification = ctx.context.internal_adapter.find_verification_value(identifier)
-      raise APIError.new("BAD_REQUEST", message: PHONE_NUMBER_ERROR_CODES["OTP_NOT_FOUND"]) unless verification
+      existing = ctx.context.internal_adapter.find_verification_value(identifier)
+      raise APIError.new("BAD_REQUEST", message: PHONE_NUMBER_ERROR_CODES["OTP_NOT_FOUND"]) unless existing
 
-      if Routes.expired_time?(verification["expiresAt"])
+      if Routes.expired_time?(existing["expiresAt"])
+        ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
         raise APIError.new("BAD_REQUEST", message: PHONE_NUMBER_ERROR_CODES["OTP_EXPIRED"])
       end
 
+      _, existing_attempts = phone_number_split_code(existing["value"])
+      if existing_attempts.to_i >= config[:allowed_attempts].to_i
+        ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
+        raise APIError.new("FORBIDDEN", message: PHONE_NUMBER_ERROR_CODES["TOO_MANY_ATTEMPTS"])
+      end
+
+      verification = ctx.context.internal_adapter.consume_verification_value(identifier)
+      raise APIError.new("BAD_REQUEST", message: PHONE_NUMBER_ERROR_CODES["INVALID_OTP"]) unless verification
+
       stored_code, attempts = phone_number_split_code(verification["value"])
       attempts_count = attempts.to_i
       if attempts_count >= config[:allowed_attempts].to_i
-        ctx.context.internal_adapter.delete_verification_value(verification["id"])
         raise APIError.new("FORBIDDEN", message: PHONE_NUMBER_ERROR_CODES["TOO_MANY_ATTEMPTS"])
       end
 
       unless stored_code == code
-        ctx.context.internal_adapter.update_verification_value(verification["id"], value: "#{stored_code}:#{attempts_count + 1}")
+        ctx.context.internal_adapter.create_verification_value(identifier: identifier, value: "#{stored_code}:#{attempts_count + 1}", expiresAt: verification["expiresAt"])
         raise APIError.new("BAD_REQUEST", message: PHONE_NUMBER_ERROR_CODES["INVALID_OTP"])
       end
 
-      ctx.context.internal_adapter.delete_verification_value(verification["id"]) if consume
+      ctx.context.internal_adapter.create_verification_value(identifier: identifier, value: verification["value"], expiresAt: verification["expiresAt"]) unless consume
       verification
     end
 
     def phone_number_store_code(ctx, config, identifier, code)
       ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
+      expires_at = Time.now + config[:expires_in].to_i
       ctx.context.internal_adapter.create_verification_value(
         identifier: identifier,
         value: "#{code}:0",
-        expiresAt: Time.now + config[:expires_in].to_i
+        expiresAt: expires_at
       )
     end
 
@@ -442,15 +450,5 @@ module BetterAuth
     def truthy?(value)
       value == true || value.to_s == "true"
     end
-
-    def deep_merge_hashes(base, override)
-      base.merge(override) do |_key, old_value, new_value|
-        if old_value.is_a?(Hash) && new_value.is_a?(Hash)
-          deep_merge_hashes(old_value, new_value)
-        else
-          new_value
-        end
-      end
-    end
   end
 end

data/lib/better_auth/plugins/scim.rb

@@ -1,16 +1,13 @@
 # frozen_string_literal: true
 
+return if defined?(BetterAuth::Plugins::SCIM_PLUGIN_IMPLEMENTATION)
+
 module BetterAuth
   module Plugins
     module_function
 
-    def scim(*args)
-      Kernel.require "better_auth/scim"
-      BetterAuth::Plugins.scim(*args)
-    rescue LoadError => error
-      raise if error.path && error.path != "better_auth/scim"
-
-      raise LoadError, "BetterAuth::Plugins.scim requires the better_auth-scim gem. Add `gem \"better_auth-scim\"` and `require \"better_auth/scim\"`."
+    def scim(*args, &block)
+      call_external_plugin!(:scim, *args, implementation_constant: :SCIM_PLUGIN_IMPLEMENTATION, gem_name: "better_auth-scim", entry: "lib/better_auth/scim.rb", &block)
     end
   end
 end

data/lib/better_auth/plugins/siwe.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "uri"
+require "time"
 
 module BetterAuth
   module Plugins
@@ -8,6 +9,8 @@ module BetterAuth
 
     SIWE_WALLET_PATTERN = /\A0[xX][a-fA-F0-9]{40}\z/
     SIWE_EMAIL_PATTERN = /\A[^@\s]+@[^@\s]+\.[^@\s]+\z/
+    SIWE_HEADER_PATTERN = /\A(?:([a-zA-Z][a-zA-Z0-9+.-]*):\/\/)?(\S+) wants you to sign in with your Ethereum account:\z/
+    SIWE_FIELD_PATTERN = /\A([A-Za-z ]+): (.*)\z/
 
     def siwe(options = {})
       config = normalize_hash(options)
@@ -16,29 +19,30 @@ module BetterAuth
         id: "siwe",
         schema: siwe_schema(config[:schema]),
         endpoints: {
-          get_siwe_nonce: get_siwe_nonce_endpoint(config),
+          get_siwe_nonce: get_siwe_nonce_endpoint(config, path: "/siwe/nonce", operation_id: "getSiweNonce"),
+          get_nonce: get_siwe_nonce_endpoint(config, path: "/siwe/get-nonce", operation_id: "getNonce"),
           verify_siwe_message: verify_siwe_message_endpoint(config)
         },
         options: config
       )
     end
 
-    def get_siwe_nonce_endpoint(config)
+    def get_siwe_nonce_endpoint(config, path:, operation_id:)
       Endpoint.new(
-        path: "/siwe/nonce",
+        path: path,
         method: "POST",
         body_schema: ->(body) { siwe_nonce_body(body) },
         metadata: {
           openapi: {
-            operationId: "getSiweNonce",
+            operationId: operation_id,
             description: "Generate a nonce for Sign-In with Ethereum",
             requestBody: OpenAPI.json_request_body(
               OpenAPI.object_schema(
                 {
+                  address: {type: "string"},
                   walletAddress: {type: "string"},
                   chainId: {type: ["number", "string", "null"]}
-                },
-                required: ["walletAddress"]
+                }
               )
             ),
             responses: {
@@ -56,7 +60,7 @@ module BetterAuth
         }
       ) do |ctx|
         body = normalize_hash(ctx.body)
-        wallet_address = siwe_normalize_wallet!(body[:wallet_address])
+        wallet_address = siwe_normalize_wallet!(body[:wallet_address] || body[:address])
         chain_id = siwe_chain_id(body[:chain_id])
         nonce_callback = config[:get_nonce]
         raise APIError.new("INTERNAL_SERVER_ERROR", message: "SIWE nonce callback is required") unless nonce_callback.respond_to?(:call)
@@ -111,21 +115,21 @@ module BetterAuth
         body = normalize_hash(ctx.body)
         wallet_address = siwe_normalize_wallet!(body[:wallet_address])
         chain_id = siwe_chain_id(body[:chain_id])
-        email = body[:email].to_s
+        email = body[:email].to_s.downcase
         anonymous = config.key?(:anonymous) ? config[:anonymous] : true
         raise APIError.new("BAD_REQUEST", message: "Email is required when anonymous is disabled.") if anonymous == false && email.empty?
         raise APIError.new("BAD_REQUEST", message: "Invalid email address") if !email.empty? && !SIWE_EMAIL_PATTERN.match?(email)
 
-        verification = ctx.context.internal_adapter.find_verification_value(siwe_identifier(wallet_address, chain_id))
-        if !verification || siwe_expired_time?(verification["expiresAt"])
+        verification = ctx.context.internal_adapter.consume_verification_value(siwe_identifier(wallet_address, chain_id))
+        unless verification
           raise APIError.new("UNAUTHORIZED_INVALID_OR_EXPIRED_NONCE", message: "Unauthorized: Invalid or expired nonce")
         end
 
+        siwe_validate_message!(body[:message], config[:domain], wallet_address, chain_id, verification["value"])
+
         verified = siwe_verify_message(config, body, wallet_address, chain_id, verification["value"], ctx)
         raise APIError.new("UNAUTHORIZED", message: "Unauthorized: Invalid SIWE signature") unless verified
 
-        ctx.context.internal_adapter.delete_verification_value(verification["id"])
-
         user = siwe_find_user(ctx, wallet_address, chain_id)
         user ||= siwe_create_user(ctx, config, wallet_address, chain_id, email, anonymous)
         siwe_ensure_wallet_and_account(ctx, user, wallet_address, chain_id)
@@ -188,7 +192,12 @@ module BetterAuth
 
     def siwe_nonce_body(body)
       data = normalize_hash(body)
-      siwe_normalize_wallet!(data[:wallet_address])
+      wallet_address_keys = [:wallet_address, :address].select { |key| data.key?(key) }
+      if wallet_address_keys.empty?
+        raise APIError.new("BAD_REQUEST", message: "walletAddress or address is required")
+      end
+
+      wallet_address_keys.each { |key| siwe_normalize_wallet!(data[key]) }
       data[:chain_id] = siwe_chain_id(data[:chain_id])
       data
     end
@@ -201,10 +210,11 @@ module BetterAuth
       siwe_normalize_wallet!(data[:wallet_address])
       data[:chain_id] = siwe_chain_id(data[:chain_id])
       anonymous = config.key?(:anonymous) ? config[:anonymous] : true
-      email = data[:email].to_s
+      email = data[:email].to_s.downcase
       raise APIError.new("BAD_REQUEST", message: "Email is required when anonymous is disabled.") if anonymous == false && email.empty?
       raise APIError.new("BAD_REQUEST", message: "Invalid email address") if !email.empty? && !SIWE_EMAIL_PATTERN.match?(email)
 
+      data[:email] = email unless email.empty?
       data
     end
 
@@ -226,6 +236,101 @@ module BetterAuth
       "siwe:#{wallet_address}:#{chain_id}"
     end
 
+    def siwe_parse_message(message)
+      result = {}
+      lines = message.to_s.split(/\r?\n/)
+
+      if (header = SIWE_HEADER_PATTERN.match(lines[0].to_s))
+        result[:scheme] = header[1] if header[1]
+        result[:domain] = header[2]
+      end
+
+      address = lines[1].to_s.strip
+      result[:address] = address if SIWE_WALLET_PATTERN.match?(address)
+
+      lines.each do |line|
+        field = SIWE_FIELD_PATTERN.match(line)
+        next unless field
+
+        key = field[1]
+        value = field[2]
+        case key
+        when "URI"
+          result[:uri] = value
+        when "Version"
+          result[:version] = value
+        when "Chain ID"
+          parsed_chain_id = siwe_parse_message_chain_id(value)
+          result[:chain_id] = parsed_chain_id unless parsed_chain_id.nil?
+        when "Nonce"
+          result[:nonce] = value
+        when "Issued At"
+          result[:issued_at] = value
+        when "Expiration Time"
+          result[:expiration_time] = value
+        when "Not Before"
+          result[:not_before] = value
+        when "Request ID"
+          result[:request_id] = value
+        end
+      end
+
+      result
+    rescue
+      {}
+    end
+
+    def siwe_parse_message_chain_id(value)
+      number = Float(value)
+      number.to_i if number.finite? && number == number.to_i
+    rescue ArgumentError, TypeError, RangeError
+      nil
+    end
+
+    def siwe_normalize_domain(domain)
+      normalized = domain.to_s.strip.downcase.sub(/\A[a-z][a-z0-9+.-]*:\/\//, "")
+      path_start = normalized.index("/")
+      path_start ? normalized[0...path_start] : normalized
+    rescue
+      ""
+    end
+
+    def siwe_validate_message!(message, domain, wallet_address, chain_id, nonce)
+      parsed = siwe_parse_message(message)
+      matches = parsed[:nonce] == nonce &&
+        parsed[:address]&.downcase == wallet_address.downcase &&
+        parsed[:chain_id] == chain_id &&
+        parsed[:domain] && siwe_normalize_domain(parsed[:domain]) == siwe_normalize_domain(domain)
+
+      unless matches
+        raise siwe_unauthorized_error(
+          "UNAUTHORIZED_SIWE_MESSAGE_MISMATCH",
+          "Unauthorized: SIWE message does not match the expected nonce, domain, address, or chain ID"
+        )
+      end
+
+      now = Time.now
+      expiration_time = siwe_parse_message_time(parsed[:expiration_time]) if parsed[:expiration_time]
+      if expiration_time && now >= expiration_time
+        raise siwe_unauthorized_error("UNAUTHORIZED_SIWE_MESSAGE_EXPIRED", "Unauthorized: SIWE message has expired")
+      end
+
+      not_before = siwe_parse_message_time(parsed[:not_before]) if parsed[:not_before]
+      if not_before && now < not_before
+        raise siwe_unauthorized_error("UNAUTHORIZED_SIWE_MESSAGE_NOT_YET_VALID", "Unauthorized: SIWE message is not yet valid")
+      end
+    end
+
+    def siwe_parse_message_time(value)
+      Time.parse(value.to_s)
+    rescue ArgumentError, TypeError, RangeError
+      nil
+    end
+
+    def siwe_unauthorized_error(status, message)
+      APIError.new("UNAUTHORIZED", code: status, message: message)
+    end
+
     def siwe_verify_message(config, body, wallet_address, chain_id, nonce, ctx)
       verifier = config[:verify_message]
       raise APIError.new("INTERNAL_SERVER_ERROR", message: "SIWE verify_message callback is required") unless verifier.respond_to?(:call)
@@ -262,12 +367,17 @@ module BetterAuth
     end
 
     def siwe_create_user(ctx, config, wallet_address, _chain_id, email, anonymous)
-      domain = config[:email_domain_name] || URI.parse(ctx.context.base_url).host || ctx.context.base_url
+      domain = config[:email_domain_name] || URI.parse(ctx.context.canonical_base_url).host || ctx.context.canonical_base_url
       lookup = config[:ens_lookup]
       ens = lookup.respond_to?(:call) ? normalize_hash(lookup.call(wallet_address: wallet_address) || {}) : {}
+      normalized_email = email.to_s.downcase
+      user_email = "#{wallet_address}@#{domain}".downcase
+      if anonymous == false && !normalized_email.empty? && !ctx.context.internal_adapter.find_user_by_email(normalized_email)
+        user_email = normalized_email
+      end
       ctx.context.internal_adapter.create_user(
         name: ens[:name] || wallet_address,
-        email: (anonymous == false && !email.empty?) ? email : "#{wallet_address}@#{domain}",
+        email: user_email,
         image: ens[:avatar] || "",
         context: ctx
       )

data/lib/better_auth/plugins/sso.rb

@@ -1,16 +1,13 @@
 # frozen_string_literal: true
 
+return if defined?(BetterAuth::Plugins::SSO_PLUGIN_IMPLEMENTATION)
+
 module BetterAuth
   module Plugins
     module_function
 
-    def sso(*args)
-      Kernel.require "better_auth/sso"
-      BetterAuth::Plugins.sso(*args)
-    rescue LoadError => error
-      raise if error.path && error.path != "better_auth/sso"
-
-      raise LoadError, "BetterAuth::Plugins.sso requires the better_auth-sso gem. Add `gem \"better_auth-sso\"` and `require \"better_auth/sso\"`."
+    def sso(*args, &block)
+      call_external_plugin!(:sso, *args, implementation_constant: :SSO_PLUGIN_IMPLEMENTATION, gem_name: "better_auth-sso", entry: "lib/better_auth/sso.rb", &block)
     end
   end
 end

data/lib/better_auth/plugins/stripe.rb

@@ -1,16 +1,13 @@
 # frozen_string_literal: true
 
+return if defined?(BetterAuth::Plugins::STRIPE_PLUGIN_IMPLEMENTATION)
+
 module BetterAuth
   module Plugins
     module_function
 
-    def stripe(*args)
-      Kernel.require "better_auth/stripe"
-      BetterAuth::Plugins.stripe(*args)
-    rescue LoadError => error
-      raise if error.path && error.path != "better_auth/stripe"
-
-      raise LoadError, "BetterAuth::Plugins.stripe requires the better_auth-stripe gem. Add `gem \"better_auth-stripe\"` and `require \"better_auth/stripe\"`."
+    def stripe(*args, &block)
+      call_external_plugin!(:stripe, *args, implementation_constant: :STRIPE_PLUGIN_IMPLEMENTATION, gem_name: "better_auth-stripe", entry: "lib/better_auth/stripe.rb", &block)
     end
   end
 end