better_auth 0.10.0 → 0.11.0

data/lib/better_auth/request_ip.rb

@@ -8,24 +8,60 @@ module BetterAuth
 
     module_function
 
-    def client_ip(request, options)
+    def client_ip(source, options)
       ip_options = options.advanced[:ip_address] || {}
       return nil if ip_options[:disable_ip_tracking]
 
-      Array(ip_options[:ip_address_headers] || ["x-forwarded-for"]).each do |header|
-        value = header_value(request, header)
-        next unless value.is_a?(String)
-
-        ip = value.split(",").first.to_s.strip
-        return normalize_ip(ip, ipv6_subnet: ip_options[:ipv6_subnet]) if valid_ip?(ip)
+      request = unwrap_request(source)
+      configured_headers = ip_options[:ip_address_headers]
+      if configured_headers
+        Array(configured_headers).each do |header|
+          value = header_value(source, header)
+          next unless value.is_a?(String)
+
+          ip = ip_from_header(
+            value,
+            trusted_proxies: ip_options[:trusted_proxies],
+            peer_ip: peer_ip(request),
+            ipv6_subnet: ip_options[:ipv6_subnet]
+          )
+          return ip if ip
+        end
       end
 
-      ip = fallback_ip(request)
+      ip = fallback_ip(request, allow_forwarded_headers: configured_headers.nil?)
       return normalize_ip(ip, ipv6_subnet: ip_options[:ipv6_subnet]) if valid_ip?(ip)
 
       LOCALHOST_IP if test_or_development?
     end
 
+    def ip_from_header(value, trusted_proxies: nil, peer_ip: nil, ipv6_subnet: nil)
+      forwarded_ips = value.split(",").map(&:strip).reject(&:empty?)
+      return nil if forwarded_ips.empty?
+
+      proxy_entries = Array(trusted_proxies).map(&:to_s).reject(&:empty?)
+      if proxy_entries.any?
+        proxies = proxy_entries.map { |entry| parse_trusted_proxy(entry) }
+        return nil if proxies.any?(&:nil?)
+
+        peer_address = parse_ip(peer_ip)
+        return nil unless peer_address && proxies.any? { |proxy| proxy.include?(native_address(peer_address)) }
+
+        forwarded_ips.reverse_each do |ip|
+          address = parse_ip(ip)
+          return nil unless address
+          next if proxies.any? { |proxy| proxy.include?(native_address(address)) }
+
+          return normalize_ip(ip, ipv6_subnet: ipv6_subnet)
+        end
+        return nil
+      end
+
+      return nil unless forwarded_ips.one? && valid_ip?(forwarded_ips.first)
+
+      normalize_ip(forwarded_ips.first, ipv6_subnet: ipv6_subnet)
+    end
+
     def header_value(request, header)
       return request.get_header(rack_header_name(header)) if request.respond_to?(:get_header)
       return request.headers[header.to_s.downcase] if request.respond_to?(:headers)
@@ -34,12 +70,55 @@ module BetterAuth
       nil
     end
 
-    def fallback_ip(request)
-      return request.ip.to_s if request.respond_to?(:ip)
+    def fallback_ip(request, allow_forwarded_headers:)
+      return nil unless request
+
+      remote_ip = request.remote_ip.to_s if request.respond_to?(:remote_ip)
+      return remote_ip if valid_ip?(remote_ip)
+
+      direct_peer_ip = peer_ip(request)
+      return nil unless valid_ip?(direct_peer_ip)
+
+      if allow_forwarded_headers && request.respond_to?(:ip)
+        ip = request.ip.to_s
+        return ip if valid_ip?(ip)
+      end
+
+      direct_peer_ip
+    end
+
+    def peer_ip(request)
+      if request.respond_to?(:get_header)
+        value = request.get_header("REMOTE_ADDR")
+        return value.to_s unless value.nil?
+      end
+      if request.respond_to?(:env)
+        value = request.env["REMOTE_ADDR"]
+        return value.to_s unless value.nil?
+      end
+      if request.is_a?(Hash)
+        value = request["REMOTE_ADDR"] || request[:REMOTE_ADDR] || request[:remote_addr]
+        return value.to_s unless value.nil?
+      end
 
       nil
     end
 
+    def unwrap_request(source)
+      current = source
+      seen = {}
+      while current&.respond_to?(:request)
+        break if seen[current.object_id]
+
+        seen[current.object_id] = true
+        nested = current.request
+        break unless nested && !nested.equal?(current)
+
+        current = nested
+      end
+      current
+    end
+
     def rack_header_name(header)
       "HTTP_#{header.to_s.upcase.tr("-", "_")}"
     end
@@ -47,10 +126,41 @@ module BetterAuth
     def valid_ip?(ip)
       return false if ip.to_s.empty? || ip.to_s.match?(/\s/)
 
+      !parse_ip(ip).nil?
+    end
+
+    def parse_ip(ip)
       IPAddr.new(ip)
-      true
-    rescue ArgumentError
-      false
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+      nil
+    end
+
+    def parse_trusted_proxy(entry)
+      value = entry.to_s
+      return nil if value.empty? || value.match?(/\s/)
+
+      if value.include?("/")
+        address, prefix = value.split("/", -1)
+        return nil unless value.count("/") == 1 && prefix.match?(/\A\d+\z/)
+
+        parsed_address = parse_ip(address)
+        return nil unless parsed_address
+
+        max_prefix = parsed_address.ipv4? ? 32 : 128
+        return nil if prefix.to_i > max_prefix
+      end
+
+      IPAddr.new(value)
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+      nil
+    end
+
+    def native_address(address)
+      if address.respond_to?(:ipv4_mapped?) && address.ipv4_mapped?
+        address.native
+      else
+        address
+      end
     end
 
     def normalize_ip(ip, ipv6_subnet: nil)

data/lib/better_auth/router.rb

@@ -75,12 +75,12 @@ module BetterAuth
 
       return run_on_response_chain(not_found) if disabled_path?(route_path)
 
-      request = run_on_request_chain(request)
-      return run_on_response_chain(request) if rack_response?(request)
-
       response = rate_limiter.call(request, context, route_path)
       return run_on_response_chain(response) if response
 
+      request = run_on_request_chain(request)
+      return run_on_response_chain(request) if rack_response?(request)
+
       endpoint_context = rebuild_endpoint_context(endpoint_context, request, route_path, params, endpoint)
       result = API.new(context, endpoints).execute(endpoint, endpoint_context)
       response = result.response.is_a?(APIError) ? error_response(result.response, headers: result.headers) : result.to_rack_response

data/lib/better_auth/routes/account.rb

@@ -230,6 +230,18 @@ module BetterAuth
                 in: "query",
                 required: false,
                 schema: {type: "string"}
+              },
+              {
+                name: "providerId",
+                in: "query",
+                required: false,
+                schema: {type: "string"}
+              },
+              {
+                name: "userId",
+                in: "query",
+                required: false,
+                schema: {type: "string"}
               }
             ],
             responses: {
@@ -260,23 +272,43 @@ module BetterAuth
           }
         }
       ) do |ctx|
-        session = current_session(ctx)
+        session = current_session(ctx, allow_nil: true)
+        raise APIError.new("UNAUTHORIZED") if !session && (ctx.request || !ctx.headers.empty?)
+
+        user_id = session&.dig(:user, "id") || fetch_value(ctx.query, "userId")
+        raise APIError.new("BAD_REQUEST", code: "USER_ID_OR_SESSION_REQUIRED", message: "Either userId or session is required") if user_id.to_s.empty?
+
         account_id = fetch_value(ctx.query, "accountId")
-        account = if account_id
-          ctx.context.internal_adapter.find_accounts(session[:user]["id"]).find do |entry|
-            entry["id"] == account_id || entry["accountId"] == account_id
+        provider_id = fetch_value(ctx.query, "providerId")
+        account = if !account_id.to_s.empty?
+          matching_accounts = ctx.context.internal_adapter.find_accounts(user_id).select do |entry|
+            entry["accountId"] == account_id && (provider_id.to_s.empty? || entry["providerId"] == provider_id)
+          end
+          if matching_accounts.length > 1
+            raise APIError.new(
+              "BAD_REQUEST",
+              code: "AMBIGUOUS_ACCOUNT",
+              message: "Multiple accounts share this account ID. Pass a providerId to disambiguate."
+            )
           end
+          matching_accounts.first
         else
-          account_cookie(ctx, nil, nil, session[:user]["id"])
+          account_cookie(ctx, provider_id, nil, user_id)
         end
-        raise APIError.new("BAD_REQUEST", message: "Account not found") unless account && account["userId"] == session[:user]["id"]
+        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["ACCOUNT_NOT_FOUND"]) unless account && account["userId"] == user_id
 
         provider = social_provider(ctx.context, account["providerId"])
-        raise APIError.new("INTERNAL_SERVER_ERROR", message: "Provider account provider is #{account["providerId"]} but it is not configured") unless provider
+        unless provider && provider_callable(provider, :get_user_info)
+          raise APIError.new(
+            "BAD_REQUEST",
+            code: "PROVIDER_NOT_CONFIGURED",
+            message: "Account is not associated with a configured social provider."
+          )
+        end
 
         tokens = access_token_response(
           ctx,
-          user_id: session[:user]["id"],
+          user_id: user_id,
           provider_id: account["providerId"],
           account_id: account["accountId"],
           provider: provider

data/lib/better_auth/routes/email_verification.rb

@@ -29,6 +29,7 @@ module BetterAuth
       ) do |ctx|
         sender = ctx.context.options.email_verification[:send_verification_email]
         raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["VERIFICATION_EMAIL_NOT_ENABLED"]) unless sender.respond_to?(:call)
+        ctx.context.token_link_base_url
 
         body = normalize_hash(ctx.body)
         email = body["email"].to_s.downcase
@@ -42,16 +43,37 @@ module BetterAuth
           next ctx.json({status: true})
         end
 
+        start = verification_email_monotonic_clock
         found = ctx.context.internal_adapter.find_user_by_email(email)
         if found && !found[:user]["emailVerified"]
-          send_verification_email_payload(ctx, found[:user], body["callbackURL"] || body["callbackUrl"] || body["callback_url"])
+          begin
+            send_verification_email_payload(ctx, found[:user], body["callbackURL"] || body["callbackUrl"] || body["callback_url"])
+          rescue => error
+            enforce_verification_email_floor(start)
+            raise error
+          end
         else
           create_email_verification_token(ctx, email)
         end
+        enforce_verification_email_floor(start)
+
         ctx.json({status: true})
       end
     end
 
+    def self.verification_email_monotonic_clock
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+
+    def self.verification_email_sleep(seconds)
+      sleep(seconds)
+    end
+
+    def self.enforce_verification_email_floor(start)
+      remaining = 0.5 - (verification_email_monotonic_clock - start)
+      verification_email_sleep(remaining) if remaining.positive?
+    end
+
     def self.verify_email
       Endpoint.new(
         path: "/verify-email",
@@ -93,8 +115,10 @@ module BetterAuth
         callback_url = fetch_value(ctx.query, "callbackURL")
         validate_callback_url!(ctx.context, callback_url)
         payload = verify_email_token(ctx, token, callback_url)
+        change_email_token_identifier = validate_change_email_token!(ctx, token, payload, callback_url)
         email = payload["email"].to_s.downcase
         update_to = payload["updateTo"] || payload["update_to"]
+        preflight_follow_up_verification_token_link!(ctx, payload, update_to)
         user_data = ctx.context.internal_adapter.find_user_by_email(email)
         return redirect_or_error(ctx, callback_url, "user_not_found") unless user_data
 
@@ -103,22 +127,25 @@ module BetterAuth
           session = current_session(ctx, allow_nil: true)
           return redirect_or_error(ctx, callback_url, "invalid_user") if session && session[:user]["email"] != email
 
+          consume_change_email_token!(ctx, change_email_token_identifier, callback_url)
           request_type = payload["requestType"] || payload["request_type"]
           case request_type
           when "change-email-confirmation"
             send_change_email_verification_payload(ctx, user, update_to, callback_url)
             next redirect_or_json(ctx, callback_url, {status: true})
           when "change-email-verification"
+            session_data = email_change_session_data(ctx, session, user)
             updated = ctx.context.internal_adapter.update_user_by_email(email, email: update_to, emailVerified: true)
             updated_user = updated || user.merge("email" => update_to, "emailVerified" => true)
             call_option(ctx.context.options.email_verification[:after_email_verification], updated_user, ctx.request)
-            set_verified_session_cookie(ctx, updated_user)
+            Cookies.set_session_cookie(ctx, {session: session_data, user: updated_user})
             next redirect_or_json(ctx, callback_url, {status: true, user: Schema.parse_output(ctx.context.options, "user", updated_user)})
           else
+            session_data = email_change_session_data(ctx, session, user)
             updated = ctx.context.internal_adapter.update_user_by_email(email, email: update_to, emailVerified: false)
             updated_user = updated || user.merge("email" => update_to, "emailVerified" => false)
             send_verification_email_payload(ctx, updated_user, callback_url) if ctx.context.options.email_verification[:send_verification_email].respond_to?(:call)
-            set_verified_session_cookie(ctx, updated_user)
+            Cookies.set_session_cookie(ctx, {session: session_data, user: updated_user})
             next redirect_or_json(ctx, callback_url, {status: true, user: Schema.parse_output(ctx.context.options, "user", updated)})
           end
         end
@@ -139,7 +166,7 @@ module BetterAuth
     def self.send_verification_email_payload(ctx, user, callback_url)
       token = create_email_verification_token(ctx, user["email"])
       callback = URI.encode_www_form_component(callback_url || "/")
-      url = "#{ctx.context.base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
+      url = "#{ctx.context.token_link_base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
       ctx.context.options.email_verification[:send_verification_email].call({user: user, url: url, token: token}, ctx.request)
     end
 
@@ -148,11 +175,20 @@ module BetterAuth
       return unless sender.respond_to?(:call)
 
       token = create_email_verification_token(ctx, user["email"], update_to: update_to, extra: {"requestType" => "change-email-verification"})
+      register_change_email_token!(ctx, token)
       callback = URI.encode_www_form_component(callback_url || "/")
-      url = "#{ctx.context.base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
+      url = "#{ctx.context.token_link_base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
       sender.call({user: user.merge("email" => update_to), url: url, token: token}, ctx.request)
     end
 
+    def self.preflight_follow_up_verification_token_link!(ctx, payload, update_to)
+      return unless update_to
+      return unless ctx.context.options.email_verification[:send_verification_email].respond_to?(:call)
+
+      request_type = payload["requestType"] || payload["request_type"]
+      ctx.context.token_link_base_url unless request_type == "change-email-verification"
+    end
+
     def self.create_email_verification_token(ctx, email, update_to: nil, extra: {})
       payload = {"email" => email.to_s.downcase}.merge(extra)
       payload["updateTo"] = update_to if update_to
@@ -168,6 +204,43 @@ module BetterAuth
       redirect_or_error(ctx, callback_url, BASE_ERROR_CODES["INVALID_TOKEN"], code: "INVALID_TOKEN")
     end
 
+    # Ruby hardening adaptation of upstream PR #9519. This is intentionally
+    # stricter than the pinned Better Auth v1.6.23 behavior, and hashes the JWT
+    # before storage so the verification table never contains the bearer token.
+    def self.register_change_email_token!(ctx, token)
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: change_email_token_identifier(token),
+        value: "issued",
+        expiresAt: Time.now + (ctx.context.options.email_verification[:expires_in] || 3600)
+      )
+    end
+
+    def self.validate_change_email_token!(ctx, token, payload, callback_url)
+      update_to = payload["updateTo"] || payload["update_to"]
+      request_type = payload["requestType"] || payload["request_type"]
+      return unless update_to && ["change-email-confirmation", "change-email-verification"].include?(request_type)
+
+      identifier = change_email_token_identifier(token)
+      verification = ctx.context.internal_adapter.find_verification_value(identifier)
+      unless verification && !expired_time?(verification["expiresAt"])
+        redirect_or_error(ctx, callback_url, BASE_ERROR_CODES["TOKEN_ALREADY_USED"], code: "TOKEN_ALREADY_USED")
+      end
+      identifier
+    end
+
+    def self.consume_change_email_token!(ctx, identifier, callback_url)
+      return unless identifier
+
+      verification = ctx.context.internal_adapter.consume_verification_value(identifier)
+      unless verification
+        redirect_or_error(ctx, callback_url, BASE_ERROR_CODES["TOKEN_ALREADY_USED"], code: "TOKEN_ALREADY_USED")
+      end
+    end
+
+    def self.change_email_token_identifier(token)
+      "change-email:#{Crypto.sha256(token, encoding: :base64url)}"
+    end
+
     def self.redirect_or_error(ctx, callback_url, error, code: nil)
       if callback_url
         separator = callback_url.include?("?") ? "&" : "?"
@@ -192,6 +265,16 @@ module BetterAuth
       Cookies.set_session_cookie(ctx, {session: session_data, user: user})
     end
 
+    def self.email_change_session_data(ctx, session, user)
+      return session[:session] if session && session[:user]["id"] == user["id"]
+
+      session_data = ctx.context.internal_adapter.create_session(user["id"])
+      unless session_data
+        raise APIError.new("INTERNAL_SERVER_ERROR", message: BASE_ERROR_CODES["FAILED_TO_CREATE_SESSION"])
+      end
+      session_data
+    end
+
     def self.call_option(callback, user, request)
       callback.call(user, request) if callback.respond_to?(:call)
     end

data/lib/better_auth/routes/password.rb

@@ -43,6 +43,7 @@ module BetterAuth
         unless sender.respond_to?(:call)
           raise APIError.new("BAD_REQUEST", code: "RESET_PASSWORD_DISABLED", message: BASE_ERROR_CODES["RESET_PASSWORD_DISABLED"])
         end
+        token_link_base_url = ctx.context.token_link_base_url
 
         body = normalize_hash(ctx.body)
         email = body["email"].to_s.downcase
@@ -64,7 +65,7 @@ module BetterAuth
         )
 
         callback = redirect_to ? URI.encode_www_form_component(redirect_to) : ""
-        url = "#{ctx.context.base_url}/reset-password/#{token}?callbackURL=#{callback}"
+        url = "#{token_link_base_url}/reset-password/#{token}?callbackURL=#{callback}"
         begin
           sender.call({user: found[:user], url: url, token: token}, ctx.request)
         rescue => error
@@ -151,8 +152,8 @@ module BetterAuth
         password = body["newPassword"] || body["new_password"]
         validate_password_length!(password, ctx.context.options.email_and_password)
 
-        verification = ctx.context.internal_adapter.find_verification_value("reset-password:#{token}")
-        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_TOKEN"]) unless verification && !expired_time?(verification["expiresAt"])
+        verification = ctx.context.internal_adapter.consume_verification_value("reset-password:#{token}")
+        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_TOKEN"]) unless verification
 
         user_id = verification["value"]
         hashed = hash_password(ctx, password)
@@ -162,13 +163,11 @@ module BetterAuth
         else
           ctx.context.internal_adapter.create_account(userId: user_id, providerId: "credential", accountId: user_id, password: hashed)
         end
-        ctx.context.internal_adapter.delete_verification_value(verification["id"])
-
         if (callback = ctx.context.options.email_and_password[:on_password_reset])
           user = ctx.context.internal_adapter.find_user_by_id(user_id)
           callback.call({user: user}, ctx.request) if user
         end
-        ctx.context.internal_adapter.delete_sessions(user_id) if ctx.context.options.email_and_password[:revoke_sessions_on_password_reset]
+        ctx.context.internal_adapter.delete_user_sessions(user_id) if ctx.context.options.email_and_password[:revoke_sessions_on_password_reset]
 
         ctx.json({status: true})
       end

data/lib/better_auth/routes/session.rb

@@ -56,7 +56,7 @@ module BetterAuth
           }
         }
       ) do |ctx|
-        session = current_session(ctx)
+        session = current_session(ctx, sensitive: true, fresh: true)
         sessions = ctx.context.internal_adapter.list_sessions(session[:user]["id"])
         active = sessions
           .map { |entry| stringify_keys(entry) }
@@ -88,6 +88,11 @@ module BetterAuth
 
         update = body.merge("updatedAt" => Time.now)
         updated = ctx.context.internal_adapter.update_session(session[:session]["token"], update)
+        if !updated && Session.stateful?(ctx)
+          Cookies.delete_session_cookie(ctx)
+          raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["FAILED_TO_GET_SESSION"])
+        end
+
         merged = session[:session].merge(updated || update)
         Cookies.set_session_cookie(ctx, {session: merged, user: session[:user]}, Cookies.dont_remember?(ctx))
         ctx.json({session: Schema.parse_output(ctx.context.options, "session", merged)})
@@ -144,7 +149,7 @@ module BetterAuth
         }
       ) do |ctx|
         session = current_session(ctx, sensitive: true)
-        ctx.context.internal_adapter.delete_sessions(session[:user]["id"])
+        ctx.context.internal_adapter.delete_user_sessions(session[:user]["id"])
         Cookies.delete_session_cookie(ctx)
         ctx.json({status: true})
       end

data/lib/better_auth/routes/sign_in.rb

@@ -50,6 +50,7 @@ module BetterAuth
         remember_me = body.key?("rememberMe") ? body["rememberMe"] : body["remember_me"]
 
         validate_auth_callback_url!(ctx.context, callback_url, "callbackURL")
+        preflight_sign_in_token_link!(ctx)
 
         unless EMAIL_PATTERN.match?(email)
           raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_EMAIL"])
@@ -107,8 +108,16 @@ module BetterAuth
         expires_in: verification[:expires_in] || 3600
       )
       callback = URI.encode_www_form_component(callback_url || "/")
-      url = "#{ctx.context.base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
+      url = "#{ctx.context.token_link_base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
       sender.call({user: user, url: url, token: token}, ctx.request)
     end
+
+    def self.preflight_sign_in_token_link!(ctx)
+      verification = ctx.context.options.email_verification
+      password_config = ctx.context.options.email_and_password
+      if password_config[:require_email_verification] && verification[:send_on_sign_in] && verification[:send_verification_email].respond_to?(:call)
+        ctx.context.token_link_base_url
+      end
+    end
   end
 end

data/lib/better_auth/routes/sign_up.rb

@@ -58,6 +58,7 @@ module BetterAuth
         if email_config[:enabled] != true || email_config[:disable_sign_up]
           raise APIError.new("BAD_REQUEST", code: "EMAIL_PASSWORD_SIGN_UP_DISABLED", message: BASE_ERROR_CODES["EMAIL_PASSWORD_SIGN_UP_DISABLED"])
         end
+        preflight_sign_up_token_link!(ctx)
 
         body = normalize_hash(ctx.body)
         name = body["name"].to_s
@@ -69,14 +70,16 @@ module BetterAuth
 
         validate_auth_callback_url!(ctx.context, callback_url, "callbackURL")
         validate_sign_up_input!(email, password, email_config)
+        reserved = %w[email password name image callbackURL callbackUrl callback_url rememberMe remember_me]
+        additional_user_fields = parse_sign_up_additional_user_fields(ctx, body.except(*reserved))
 
         ctx.context.adapter.transaction do
           existing = ctx.context.internal_adapter.find_user_by_email(email)
           if existing
-            if email_config[:require_email_verification]
+            if email_config[:require_email_verification] || email_config[:auto_sign_in] == false
               hash_password(ctx, password)
               call_existing_sign_up_callback(ctx, email_config, existing)
-              synthetic_user = synthetic_sign_up_user(ctx, body, email, name, image)
+              synthetic_user = synthetic_sign_up_user(ctx, additional_user_fields, email, name, image)
               next ctx.json({token: nil, user: Schema.parse_output(options, "user", synthetic_user)})
             end
 
@@ -87,7 +90,7 @@ module BetterAuth
           end
 
           hashed_password = hash_password(ctx, password)
-          created_user = create_sign_up_user(ctx, body, email, name, image)
+          created_user = create_sign_up_user(ctx, additional_user_fields, email, name, image)
           raise APIError.new("UNPROCESSABLE_ENTITY", message: BASE_ERROR_CODES["FAILED_TO_CREATE_USER"]) unless created_user
 
           ctx.context.internal_adapter.link_account(
@@ -144,9 +147,7 @@ module BetterAuth
       raise APIError.new("FORBIDDEN", message: "Invalid #{label}")
     end
 
-    def self.create_sign_up_user(ctx, body, email, name, image)
-      reserved = %w[email password name image callbackURL callbackUrl callback_url rememberMe remember_me]
-      additional = parse_declared_input(ctx, "user", body.except(*reserved), allowed_base: [])
+    def self.create_sign_up_user(ctx, additional, email, name, image)
       ctx.context.internal_adapter.create_user(
         additional.merge(
           "email" => email.downcase,
@@ -175,7 +176,7 @@ module BetterAuth
       end
     end
 
-    def self.synthetic_sign_up_user(ctx, body, email, name, image)
+    def self.synthetic_sign_up_user(ctx, additional, email, name, image)
       now = Time.now
       core_fields = {
         "id" => SecureRandom.hex(16),
@@ -186,8 +187,6 @@ module BetterAuth
         "createdAt" => now,
         "updatedAt" => now
       }
-      reserved = %w[email password name image callbackURL callbackUrl callback_url rememberMe remember_me]
-      additional = synthetic_additional_user_fields(ctx, body.except(*reserved))
       custom = ctx.context.options.email_and_password[:custom_synthetic_user]
       return core_fields.merge(additional) unless custom.respond_to?(:call)
 
@@ -201,20 +200,37 @@ module BetterAuth
       stringify_synthetic_user(custom.call(value))
     end
 
-    def self.synthetic_additional_user_fields(ctx, data)
-      additional = parse_declared_input(ctx, "user", data, allowed_base: [])
-      configured = ctx.context.options.user[:additional_fields] || {}
-      configured.each do |field, attributes|
-        storage_field = Schema.storage_key(field)
-        next if additional.key?(storage_field)
-
-        field_attributes = normalize_hash(attributes || {})
-        next unless field_attributes.key?("defaultValue") || field_attributes.key?("default_value")
+    def self.parse_sign_up_additional_user_fields(ctx, data)
+      input = normalize_hash(data || {})
+      fields = Schema.auth_tables(ctx.context.options).fetch("user").fetch(:fields)
+        .except(*core_model_fields("user"))
+
+      fields.each_with_object({}) do |(field, attributes), result|
+        if input.key?(field)
+          if attributes[:input] == false
+            if attributes.key?(:default_value)
+              result[field] = resolve_default(attributes[:default_value])
+            elsif js_truthy_input?(input[field])
+              raise APIError.new("BAD_REQUEST", message: "#{field} is not allowed to be set")
+            end
+            next
+          end
 
-        default = field_attributes.key?("defaultValue") ? field_attributes["defaultValue"] : field_attributes["default_value"]
-        additional[storage_field] = resolve_default(default)
+          result[field] = coerce_input_value(input[field], attributes)
+        elsif attributes.key?(:default_value)
+          result[field] = resolve_default(attributes[:default_value])
+        elsif attributes[:required]
+          raise APIError.new("BAD_REQUEST", message: "#{field} is required")
+        end
       end
-      additional
+    end
+
+    def self.js_truthy_input?(value)
+      return false if value.nil? || value == false
+      return false if value.is_a?(Numeric) && (value.zero? || (value.respond_to?(:nan?) && value.nan?))
+      return false if value.is_a?(String) && value.empty?
+
+      true
     end
 
     def self.resolve_default(value)
@@ -242,10 +258,17 @@ module BetterAuth
         expires_in: verification[:expires_in] || 3600
       )
       callback = URI.encode_www_form_component(callback_url || "/")
-      url = "#{ctx.context.base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
+      url = "#{ctx.context.token_link_base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
       sender.call({user: user, url: url, token: token}, ctx.request)
     end
 
+    def self.preflight_sign_up_token_link!(ctx)
+      verification = ctx.context.options.email_verification
+      password_config = ctx.context.options.email_and_password
+      send_on_sign_up = verification.key?(:send_on_sign_up) ? verification[:send_on_sign_up] : password_config[:require_email_verification]
+      ctx.context.token_link_base_url if send_on_sign_up && verification[:send_verification_email].respond_to?(:call)
+    end
+
     def self.session_overrides(ctx)
       {
         ipAddress: RequestIP.client_ip(ctx, ctx.context.options).to_s,