better_auth 0.10.0 → 0.11.0

data/lib/better_auth/routes/social.rb

@@ -98,8 +98,8 @@ module BetterAuth
           state: state,
           codeVerifier: code_verifier,
           code_verifier: code_verifier,
-          redirectURI: "#{ctx.context.base_url}/callback/#{provider_id}",
-          redirect_uri: "#{ctx.context.base_url}/callback/#{provider_id}",
+          redirectURI: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
+          redirect_uri: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
           scopes: body["scopes"],
           loginHint: body["loginHint"] || body["login_hint"]
         })
@@ -135,31 +135,43 @@ module BetterAuth
         if ctx.method == "POST"
           merged = normalize_hash(ctx.query).merge(normalize_hash(ctx.body))
           query = URI.encode_www_form(merged.reject { |_key, value| value.nil? || value.to_s.empty? })
-          target = "#{ctx.context.base_url}/callback/#{provider_id}"
+          target = "#{ctx.context.canonical_base_url}/callback/#{provider_id}"
           target = "#{target}?#{query}" unless query.empty?
           raise ctx.redirect(target)
         end
 
         source = ctx.query
         data = normalize_hash(source)
-        provider = social_provider(ctx.context, provider_id)
         state = data["state"].to_s
-        state_data = state.empty? ? nil : Crypto.verify_jwt(state, ctx.context.secret)
-        error_url = state_data ? (state_data["errorCallbackURL"] || "#{ctx.context.base_url}/error") : "#{ctx.context.base_url}/error"
+        default_error_url = ctx.context.options.on_api_error[:error_url] || "#{ctx.context.base_url}/error"
+        state_data = begin
+          OAuthState.parse(ctx, state)
+        rescue OAuthState::Error => error
+          raise ctx.redirect(oauth_error_url(error.error_url || default_error_url, error.code))
+        end
+        error_url = state_data["errorURL"] || state_data["errorCallbackURL"] || default_error_url
 
         raise ctx.redirect(oauth_error_url(error_url, data["error"], data["errorDescription"] || data["error_description"])) if data["error"]
-        raise ctx.redirect(oauth_error_url(error_url, "oauth_provider_not_found")) unless provider
-        raise ctx.redirect(oauth_error_url(error_url, "state_not_found")) unless state_data
-        raise ctx.redirect(oauth_error_url(error_url, "state_mismatch")) unless valid_oauth_state_cookie?(ctx, state)
         raise ctx.redirect(oauth_error_url(error_url, "no_code")) if data["code"].to_s.empty?
+        provider = social_provider(ctx.context, provider_id)
+        raise ctx.redirect(oauth_error_url(error_url, "oauth_provider_not_found")) unless provider
 
-        tokens = call_provider(provider, :validate_authorization_code, {
-          code: data["code"],
-          codeVerifier: state_data["codeVerifier"],
-          code_verifier: state_data["codeVerifier"],
-          redirectURI: "#{ctx.context.base_url}/callback/#{provider_id}",
-          redirect_uri: "#{ctx.context.base_url}/callback/#{provider_id}"
-        })
+        tokens = begin
+          call_provider(provider, :validate_authorization_code, {
+            code: data["code"],
+            codeVerifier: state_data["codeVerifier"],
+            code_verifier: state_data["codeVerifier"],
+            redirectURI: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
+            redirect_uri: "#{ctx.context.canonical_base_url}/callback/#{provider_id}"
+          })
+        rescue APIError => error
+          raise if error.status == "FOUND"
+
+          nil
+        rescue => error
+          social_log(ctx.context, :error, "OAuth code validation failed: #{error.message}")
+          nil
+        end
         raise ctx.redirect(oauth_error_url(error_url, "invalid_code")) unless tokens
 
         token_data = token_hash(tokens)
@@ -172,6 +184,7 @@ module BetterAuth
         user = user_info[:user] || user_info["user"] if user_info
         raise ctx.redirect(oauth_error_url(error_url, "unable_to_get_user_info")) unless user
         raise ctx.redirect(oauth_error_url(error_url, "email_not_found")) if fetch_value(user, "email").to_s.empty?
+        raise ctx.redirect(oauth_error_url(error_url, "unable_to_get_user_info")) if blank_remote_id?(fetch_value(user, "id"))
 
         link = state_data["link"] || state_data[:link]
         if link
@@ -192,7 +205,7 @@ module BetterAuth
         )
         raise ctx.redirect(oauth_error_url(error_url, session_data[:error].tr(" ", "_"))) if session_data[:error]
         Cookies.set_session_cookie(ctx, session_data)
-        callback_url = session_data[:new_user] ? (state_data["newUserCallbackURL"] || state_data["callbackURL"] || "/") : (state_data["callbackURL"] || "/")
+        callback_url = session_data[:new_user] ? (state_data["newUserURL"] || state_data["newUserCallbackURL"] || state_data["callbackURL"] || "/") : (state_data["callbackURL"] || "/")
         raise ctx.redirect(callback_url)
       end
     end
@@ -258,8 +271,15 @@ module BetterAuth
             account["providerId"] == provider_id && account["accountId"] == account_id
           end
           unless existing
-            ctx.context.internal_adapter.create_account(token_hash_for_storage(ctx, data[:account]).merge("userId" => session[:user]["id"]))
+            begin
+              account = ctx.context.internal_adapter.create_account(token_hash_for_storage(ctx, data[:account]).merge("userId" => session[:user]["id"]))
+              raise BetterAuth::Error, "Unable to link social account" unless account
+            rescue
+              social_log(ctx.context, :error, "Unable to link social account")
+              raise APIError.new("INTERNAL_SERVER_ERROR", message: "Unable to link social account")
+            end
           end
+          update_social_user_info_on_link(ctx, session[:user]["id"], data[:user])
           update_verified_email_on_link(ctx, session[:user]["id"], session[:user]["email"], data[:user])
           next ctx.json({url: "", status: true, redirect: false})
         end
@@ -281,8 +301,8 @@ module BetterAuth
           state: state,
           codeVerifier: code_verifier,
           code_verifier: code_verifier,
-          redirectURI: "#{ctx.context.base_url}/callback/#{provider_id}",
-          redirect_uri: "#{ctx.context.base_url}/callback/#{provider_id}",
+          redirectURI: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
+          redirect_uri: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
           scopes: body["scopes"],
           loginHint: body["loginHint"] || body["login_hint"]
         })
@@ -313,6 +333,7 @@ module BetterAuth
       user = user_info[:user] || user_info["user"] if user_info
       raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["FAILED_TO_GET_USER_INFO"]) unless user
       raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["USER_EMAIL_NOT_FOUND"]) if fetch_value(user, "email").to_s.empty?
+      raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["FAILED_TO_GET_USER_INFO"]) if blank_remote_id?(fetch_value(user, "id"))
 
       {
         user: user,
@@ -327,46 +348,84 @@ module BetterAuth
       }
     end
 
-    def self.persist_social_user(ctx, provider_id, user_info, account_info, callback_url: nil, disable_sign_up: false)
+    def self.persist_social_user(ctx, provider_id, user_info, account_info, callback_url: nil, disable_sign_up: false, override_user_info: false)
       email = fetch_value(user_info, "email").to_s.downcase
       account_id = (account_info["accountId"] || account_info[:accountId] || account_info[:account_id] || fetch_value(user_info, "id")).to_s
-      existing = ctx.context.internal_adapter.find_oauth_user(email, account_id, provider_id)
+      return {error: "unable to get user info"} if blank_remote_id?(account_id)
+
+      existing = begin
+        ctx.context.internal_adapter.find_oauth_user(email, account_id, provider_id)
+      rescue
+        social_log(ctx.context, :error, "Unable to query social user")
+        raise APIError.new("INTERNAL_SERVER_ERROR", message: "internal server error")
+      end
 
       if existing && existing[:linked_account]
         user = existing[:user]
         if ctx.context.options.account[:update_account_on_sign_in] != false
           update_data = account_storage_fields(account_info)
-          ctx.context.internal_adapter.update_account(existing[:linked_account]["id"], update_data) unless update_data.empty?
+          unless update_data.empty?
+            begin
+              ctx.context.internal_adapter.update_account(existing[:linked_account]["id"], update_data)
+            rescue
+              social_log(ctx.context, :error, "Unable to link social account")
+              raise
+            end
+          end
         end
         verified_user = update_verified_email_on_link(ctx, user["id"], user["email"], user_info)
         user = verified_user if verified_user
         new_user = false
       elsif existing
-        unless linkable_provider?(ctx, provider_id, user_info, implicit: true)
-          return {error: "account not linked"}
+        linkable = linkable_provider?(ctx, provider_id, user_info, implicit: true, local_user: existing[:user])
+        unless linkable
+          return {error: existing[:user]["banned"] ? "banned" : "account not linked"}
         end
         user = existing[:user]
-        ctx.context.internal_adapter.create_account(account_info.merge("providerId" => provider_id, "accountId" => account_id, "userId" => user["id"]))
-        verified_user = update_verified_email_on_link(ctx, user["id"], user["email"], user_info)
-        user = verified_user if verified_user
+        user = ctx.context.adapter.transaction do
+          account = begin
+            ctx.context.internal_adapter.create_account(account_info.merge("providerId" => provider_id, "accountId" => account_id, "userId" => user["id"]))
+          rescue
+            social_log(ctx.context, :error, "Unable to link social account")
+            raise
+          end
+          unless account
+            social_log(ctx.context, :error, "Unable to link social account")
+            raise BetterAuth::Error, "Failed to link social account"
+          end
+
+          promoted = promote_verified_email_on_link!(ctx, user, user_info)
+          linked_user = promoted || user
+          update_social_user_info_on_link(ctx, linked_user["id"], user_info) || linked_user
+        end
         new_user = false
       else
         return {error: "signup disabled"} if disable_sign_up
 
-        created = ctx.context.internal_adapter.create_oauth_user(
-          {
-            email: email,
-            name: fetch_value(user_info, "name").to_s,
-            image: fetch_value(user_info, "image"),
-            emailVerified: !!fetch_value(user_info, "emailVerified")
-          },
-          account_info.merge("providerId" => provider_id, "accountId" => account_id),
-          context: ctx
-        )
+        begin
+          provider_fields = Schema.parse_provider_profile_user_input(ctx.context.options, user_info, action: :create)
+          created = ctx.context.internal_adapter.create_oauth_user(
+            provider_fields.merge(
+              email: email,
+              name: fetch_value(user_info, "name").to_s,
+              image: fetch_value(user_info, "image"),
+              emailVerified: !!fetch_value(user_info, "emailVerified")
+            ),
+            account_info.merge("providerId" => provider_id, "accountId" => account_id),
+            context: ctx
+          )
+          raise BetterAuth::Error, "Failed to create social user" unless created
+        rescue
+          social_log(ctx.context, :error, "Unable to create social user")
+          return {error: "unable to create user"}
+        end
         user = created[:user]
         new_user = true
       end
-      user = override_social_user_info(ctx, user, user_info) if existing && provider_override_user_info_on_sign_in?(provider_id, ctx.context)
+      if existing && (override_user_info || provider_override_user_info_on_sign_in?(provider_id, ctx.context))
+        user = override_social_user_info(ctx, user, user_info)
+      end
+      return {error: "unable to create user"} unless user
 
       session = ctx.context.internal_adapter.create_session(user["id"], false, session_overrides(ctx), true, ctx)
       {session: session, user: user, new_user: new_user}
@@ -405,17 +464,32 @@ module BetterAuth
       !!(fetch_value(provider, "disableSignUp") || fetch_value(fetch_value(provider, "options") || {}, "disableSignUp"))
     end
 
-    def self.linkable_provider?(ctx, provider_id, user_info, implicit: false)
+    def self.linkable_provider?(ctx, provider_id, user_info, implicit: false, local_user: nil)
       linking = ctx.context.options.account[:account_linking] || {}
       return false if linking[:enabled] == false
       return false if implicit && linking[:disable_implicit_linking] == true
+      if implicit && linking.fetch(:require_local_email_verified, true) && !local_user&.fetch("emailVerified", false)
+        return false
+      end
 
       trusted = Array(linking[:trusted_providers]).map(&:to_s).include?(provider_id.to_s)
       trusted || !!fetch_value(user_info, "emailVerified")
     end
 
+    def self.implicit_link_allowed?(ctx, local_user)
+      linking = ctx.context.options.account[:account_linking] || {}
+      return false if linking[:enabled] == false || linking[:disable_implicit_linking] == true
+
+      linking[:require_local_email_verified] == false || !!local_user["emailVerified"]
+    end
+
+    def self.blank_remote_id?(value)
+      value.nil? || value.to_s.strip.empty?
+    end
+
     def self.link_social_account_from_callback(ctx, provider_id, user_info, tokens, link)
       return {error: "unable_to_link_account"} unless linkable_provider?(ctx, provider_id, user_info)
+      return {error: "unable_to_link_account"} if blank_remote_id?(fetch_value(user_info, "id"))
 
       email = fetch_value(user_info, "email").to_s.downcase
       link_email = fetch_value(link, "email").to_s.downcase
@@ -431,20 +505,21 @@ module BetterAuth
         "userId" => user_id
       )
       existing = ctx.context.internal_adapter.find_account_by_provider_id(account_id, provider_id)
-      if existing
-        return {error: "account_already_linked_to_different_user"} if existing["userId"].to_s != user_id
+      begin
+        account = if existing
+          return {error: "account_already_linked_to_different_user"} if existing["userId"].to_s != user_id
 
-        ctx.context.internal_adapter.update_account(existing["id"], account_info)
-      else
-        ctx.context.internal_adapter.create_account(account_info)
+          ctx.context.internal_adapter.update_account(existing["id"], account_info)
+        else
+          ctx.context.internal_adapter.create_account(account_info)
+        end
+        raise BetterAuth::Error, "Unable to link social account" unless account
+      rescue
+        social_log(ctx.context, :error, "Unable to link social account")
+        return {error: "unable_to_link_account"}
       end
 
-      if ctx.context.options.account.dig(:account_linking, :update_user_info_on_link)
-        ctx.context.internal_adapter.update_user(user_id, {
-          name: fetch_value(user_info, "name"),
-          image: fetch_value(user_info, "image")
-        }.compact)
-      end
+      update_social_user_info_on_link(ctx, user_id, user_info)
       update_verified_email_on_link(ctx, user_id, link_email, user_info)
 
       {status: true}
@@ -462,13 +537,33 @@ module BetterAuth
       else
         !!fetch_value(user_info, "emailVerified")
       end
-      update = {
+      provider_fields = Schema.parse_provider_profile_user_input(ctx.context.options, user_info, action: :update)
+      update = provider_fields.merge(
         "email" => email,
         "name" => fetch_value(user_info, "name").to_s,
         "image" => fetch_value(user_info, "image"),
         "emailVerified" => email_verified
-      }.reject { |_key, value| value.nil? }
-      ctx.context.internal_adapter.update_user(user["id"], update) || user
+      ).reject { |_key, value| value.nil? }
+      ctx.context.internal_adapter.update_user(user["id"], update)
+    rescue
+      social_log(ctx.context, :warn, "Could not override social user info")
+      raise
+    end
+
+    def self.update_social_user_info_on_link(ctx, user_id, user_info)
+      return unless ctx.context.options.account.dig(:account_linking, :update_user_info_on_link)
+
+      provider_fields = Schema.parse_provider_profile_user_input(ctx.context.options, user_info, action: :update)
+      update = provider_fields.merge(
+        "name" => fetch_value(user_info, "name"),
+        "image" => fetch_value(user_info, "image")
+      ).reject { |_key, value| value.nil? }
+      return if update.empty?
+
+      ctx.context.internal_adapter.update_user(user_id, update)
+    rescue
+      social_log(ctx.context, :warn, "Could not update user info on account link")
+      nil
     end
 
     def self.safe_additional_state(body)
@@ -507,6 +602,17 @@ module BetterAuth
       ctx.context.internal_adapter.update_user(user_id, {"emailVerified" => true})
     end
 
+    def self.promote_verified_email_on_link!(ctx, local_user, social_user)
+      return if local_user["emailVerified"] == true
+      return unless fetch_value(social_user, "emailVerified")
+      return unless fetch_value(social_user, "email").to_s.strip.downcase == local_user["email"].to_s.strip.downcase
+
+      updated = ctx.context.internal_adapter.update_user(local_user.fetch("id"), {"emailVerified" => true})
+      raise BetterAuth::Error, "Failed to promote verified email" unless updated
+
+      updated
+    end
+
     def self.parse_json_hash(value)
       return value if value.is_a?(Hash)
       return {} if value.nil? || value.to_s.empty?
@@ -516,5 +622,14 @@ module BetterAuth
     rescue JSON::ParserError
       {}
     end
+
+    def self.social_log(context, level, message)
+      logger = context.logger
+      if logger.respond_to?(:call)
+        logger.call(level, message)
+      elsif logger.respond_to?(level)
+        logger.public_send(level, message)
+      end
+    end
   end
 end

data/lib/better_auth/routes/user.rb

@@ -89,7 +89,7 @@ module BetterAuth
         ctx.context.internal_adapter.update_account(account["id"], password: hash_password(ctx, new_password))
         token = nil
         if body["revokeOtherSessions"] || body["revoke_other_sessions"]
-          ctx.context.internal_adapter.delete_sessions(session[:user]["id"])
+          ctx.context.internal_adapter.delete_user_sessions(session[:user]["id"])
           new_session = ctx.context.internal_adapter.create_session(session[:user]["id"])
           Cookies.set_session_cookie(ctx, {session: new_session, user: session[:user]})
           token = new_session["token"]
@@ -176,6 +176,7 @@ module BetterAuth
         session = current_session(ctx, sensitive: true)
         body = normalize_hash(ctx.body)
         sender = ctx.context.options.user.dig(:delete_user, :send_delete_account_verification)
+        token_link_base_url = ctx.context.token_link_base_url if !body["token"] && sender.respond_to?(:call)
         if body["password"]
           account = credential_account(ctx, session[:user]["id"])
           raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["CREDENTIAL_ACCOUNT_NOT_FOUND"]) unless account && account["password"]
@@ -191,7 +192,7 @@ module BetterAuth
           token = SecureRandom.hex(16)
           expires_in = ctx.context.options.user.dig(:delete_user, :delete_token_expires_in) || 3600
           callback_url = body["callbackURL"] || body["callbackUrl"] || body["callback_url"] || "/"
-          url = "#{ctx.context.base_url}/delete-user/callback?token=#{URI.encode_www_form_component(token)}&callbackURL=#{URI.encode_www_form_component(callback_url)}"
+          url = "#{token_link_base_url}/delete-user/callback?token=#{URI.encode_www_form_component(token)}&callbackURL=#{URI.encode_www_form_component(callback_url)}"
           ctx.context.internal_adapter.create_verification_value(
             identifier: "delete-account-#{token}",
             value: session[:user]["id"],
@@ -298,7 +299,7 @@ module BetterAuth
         }
       ) do |ctx|
         enabled = ctx.context.options.user.dig(:change_email, :enabled)
-        raise APIError.new("BAD_REQUEST", message: "Change email is disabled") unless enabled
+        raise APIError.new("BAD_REQUEST", code: "CHANGE_EMAIL_DISABLED", message: BASE_ERROR_CODES["CHANGE_EMAIL_DISABLED"]) unless enabled
         session = current_session(ctx, sensitive: true)
         body = normalize_hash(ctx.body)
         new_email = (body["newEmail"] || body["new_email"]).to_s.downcase
@@ -312,6 +313,7 @@ module BetterAuth
         unless can_update_without_verification || can_send_confirmation || can_send_verification
           raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["VERIFICATION_EMAIL_NOT_ENABLED"])
         end
+        ctx.context.token_link_base_url if can_send_confirmation || can_send_verification
 
         existing_target = ctx.context.internal_adapter.find_user_by_email(new_email)
         next ctx.json({status: true}) if existing_target
@@ -326,6 +328,7 @@ module BetterAuth
         if can_send_confirmation
           callback_url = body["callbackURL"] || body["callbackUrl"] || body["callback_url"]
           token = create_email_verification_token(ctx, session[:user]["email"], update_to: new_email, extra: {"requestType" => "change-email-confirmation"})
+          register_change_email_token!(ctx, token)
           url = email_verification_url(ctx, token, callback_url)
           confirmation_sender.call({user: session[:user], new_email: new_email, url: url, token: token}, ctx.request)
           next ctx.json({status: true})
@@ -338,20 +341,20 @@ module BetterAuth
 
     def self.send_change_email_verification(ctx, sender, user, current_email, new_email, callback_url)
       token = create_email_verification_token(ctx, current_email, update_to: new_email, extra: {"requestType" => "change-email-verification"})
+      register_change_email_token!(ctx, token)
       sender.call({user: user.merge("email" => new_email), url: email_verification_url(ctx, token, callback_url), token: token}, ctx.request)
     end
 
     def self.email_verification_url(ctx, token, callback_url)
       callback = URI.encode_www_form_component(callback_url || "/")
-      "#{ctx.context.base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
+      "#{ctx.context.token_link_base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
     end
 
     def self.delete_user_by_token!(ctx, session, token)
-      verification = ctx.context.internal_adapter.find_verification_value("delete-account-#{token}")
-      unless verification && verification["value"] == session[:user]["id"] && !expired_time?(verification["expiresAt"])
+      verification = ctx.context.internal_adapter.consume_verification_value("delete-account-#{token}")
+      unless verification && verification["value"] == session[:user]["id"]
         raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES["INVALID_TOKEN"])
       end
-      ctx.context.internal_adapter.delete_verification_value(verification["id"])
     end
 
     def self.delete_current_user!(ctx, session)
@@ -360,7 +363,7 @@ module BetterAuth
       deleted = ctx.context.internal_adapter.delete_user(session[:user]["id"])
       raise APIError.new("BAD_REQUEST", message: "User delete aborted") if deleted == false
 
-      ctx.context.internal_adapter.delete_sessions(session[:user]["id"])
+      ctx.context.internal_adapter.delete_user_sessions(session[:user]["id"])
       Cookies.delete_session_cookie(ctx)
       call_option(config[:after_delete], session[:user], ctx.request)
     end

data/lib/better_auth/schema/sql.rb

@@ -7,18 +7,22 @@ module BetterAuth
 
       def create_statements(options, dialect:)
         dialect = dialect.to_sym
-        tables = Schema.auth_tables(options)
-        statements = tables.map { |logical_name, table| create_table_statement(logical_name, table, dialect, tables) }
+        tables = Schema.migration_tables(options)
+        delete_actions = mssql_delete_actions(tables, dialect)
+        statements = tables.map do |logical_name, table|
+          create_table_statement(logical_name, table, dialect, tables, delete_actions: delete_actions)
+        end
         statements.concat(tables.flat_map { |_logical_name, table| index_statements(table, dialect) })
       end
 
       def pending_statements(plan)
+        delete_actions = mssql_delete_actions(plan.tables, plan.dialect)
         statements = plan.to_create.map do |change|
-          create_table_statement(change.logical_name, change.table, plan.dialect, plan.tables)
+          create_table_statement(change.logical_name, change.table, plan.dialect, plan.tables, delete_actions: delete_actions)
         end
         statements.concat(plan.to_add.flat_map do |change|
           change.fields.map do |logical_field, attributes|
-            if logical_field.to_s == "id" && plan.dialect == :postgres
+            if logical_name(logical_field, attributes) == "id" && plan.dialect == :postgres
               add_postgres_id_column_statements(change.table_name)
             else
               add_column_statement(change.table_name, logical_field, attributes, plan.dialect)
@@ -37,13 +41,13 @@ module BetterAuth
         end)
       end
 
-      def create_table_statement(logical_name, table, dialect, tables = nil)
+      def create_table_statement(logical_name, table, dialect, tables = nil, delete_actions: nil)
         table_name = table.fetch(:model_name)
         columns = table.fetch(:fields).map do |logical_field, attributes|
           column_definition(table_name, logical_field, attributes, dialect)
         end
         constraints = table.fetch(:fields).flat_map do |logical_field, attributes|
-          field_constraints(table_name, logical_field, attributes, dialect, tables)
+          field_constraints(table_name, logical_field, attributes, dialect, tables, delete_actions: delete_actions)
         end
         body = (columns + constraints).join(",\n  ")
 
@@ -61,8 +65,8 @@ module BetterAuth
 
       def column_definition(table_name, logical_field, attributes, dialect)
         column = quote(attributes[:field_name] || physical_name(logical_field), dialect)
-        parts = [column, sql_type(logical_field, attributes, dialect)]
-        parts << "PRIMARY KEY" if logical_field == "id"
+        parts = [column, sql_type(logical_name(logical_field, attributes), attributes, dialect)]
+        parts << "PRIMARY KEY" if logical_name(logical_field, attributes) == "id"
         if attributes[:required]
           parts << "NOT NULL"
         elsif dialect == :mssql
@@ -73,17 +77,17 @@ module BetterAuth
         parts.join(" ")
       end
 
-      def field_constraints(table_name, logical_field, attributes, dialect, tables = nil)
+      def field_constraints(table_name, logical_field, attributes, dialect, tables = nil, delete_actions: nil)
         constraints = []
         column = attributes[:field_name] || physical_name(logical_field)
 
-        if attributes[:unique] && logical_field != "id" && !(dialect == :mssql && !attributes[:required])
+        if attributes[:unique] && logical_name(logical_field, attributes) != "id" && !(dialect == :mssql && !attributes[:required])
           constraints << unique_constraint(table_name, column, dialect)
         end
 
         reference = attributes[:references]
         if reference
-          constraints << foreign_key_constraint(table_name, column, reference, dialect, tables)
+          constraints << foreign_key_constraint(table_name, column, reference, dialect, tables, delete_actions: delete_actions)
         end
 
         constraints
@@ -92,7 +96,7 @@ module BetterAuth
       def index_statements(table, dialect)
         table_name = table.fetch(:model_name)
         table.fetch(:fields).filter_map do |logical_field, attributes|
-          nullable_unique_mssql = dialect == :mssql && attributes[:unique] && logical_field != "id" && !attributes[:required]
+          nullable_unique_mssql = dialect == :mssql && attributes[:unique] && logical_name(logical_field, attributes) != "id" && !attributes[:required]
           next if attributes[:unique] && !nullable_unique_mssql
           next unless attributes[:index] || nullable_unique_mssql
 
@@ -149,7 +153,8 @@ module BetterAuth
       end
 
       def sql_type(logical_field, attributes, dialect)
-        case attributes[:type]
+        type = attributes[:type] || "string"
+        case type
         when "boolean"
           case dialect
           when :mysql
@@ -185,16 +190,22 @@ module BetterAuth
           else
             "text"
           end
+        when "string"
+          indexed_string_sql_type(logical_field, attributes, dialect)
         else
-          if dialect == :mysql
-            indexed = logical_field == "id" || attributes[:unique] || attributes[:index] || attributes[:references] || attributes[:sortable] || attributes.key?(:default_value)
-            indexed ? "varchar(191)" : "text"
-          elsif dialect == :mssql
-            indexed = logical_field == "id" || attributes[:unique] || attributes[:index] || attributes[:references] || attributes[:sortable]
-            indexed ? "varchar(255)" : "varchar(8000)"
-          else
-            "text"
-          end
+          raise BetterAuth::Error, "Unsupported field type: #{type}"
+        end
+      end
+
+      def indexed_string_sql_type(logical_field, attributes, dialect)
+        if dialect == :mysql
+          indexed = logical_field == "id" || attributes[:unique] || attributes[:index] || attributes[:references] || attributes[:sortable] || attributes.key?(:default_value)
+          indexed ? "varchar(191)" : "text"
+        elsif dialect == :mssql
+          indexed = logical_field == "id" || attributes[:unique] || attributes[:index] || attributes[:references] || attributes[:sortable]
+          indexed ? "varchar(255)" : "varchar(8000)"
+        else
+          "text"
         end
       end
 
@@ -229,11 +240,12 @@ module BetterAuth
         end
       end
 
-      def foreign_key_constraint(table_name, column, reference, dialect, tables = nil)
+      def foreign_key_constraint(table_name, column, reference, dialect, tables = nil, delete_actions: nil)
         target_table = foreign_key_target_table(reference, tables)
         target_model = target_table&.fetch(:model_name) || reference.fetch(:model)
         target_field = foreign_key_target_field(reference, target_table)
-        on_delete = reference[:on_delete] ? " ON DELETE #{reference[:on_delete].to_s.upcase}" : ""
+        delete_action = delete_actions&.fetch([table_name.to_s, column.to_s], reference[:on_delete]) || reference[:on_delete]
+        on_delete = delete_action ? " ON DELETE #{delete_action.to_s.upcase}" : ""
 
         case dialect
         when :postgres, :sqlite
@@ -245,6 +257,56 @@ module BetterAuth
         end
       end
 
+      def mssql_delete_actions(tables, dialect)
+        return unless dialect.to_sym == :mssql
+
+        graph = {}
+        tables.each_with_object({}) do |(_logical_name, table), actions|
+          child = table.fetch(:model_name).to_s
+          table.fetch(:fields).each do |logical_field, attributes|
+            reference = attributes[:references]
+            next unless reference
+
+            column = (attributes[:field_name] || physical_name(logical_field)).to_s
+            action = reference[:on_delete]&.to_s
+            key = [child, column]
+            unless mssql_cascading_action?(action)
+              actions[key] = action
+              next
+            end
+
+            target_table = foreign_key_target_table(reference, tables)
+            parent = (target_table&.fetch(:model_name) || reference.fetch(:model)).to_s
+            if mssql_cascade_conflict?(graph, parent, child)
+              actions[key] = "no action"
+            else
+              graph[parent] ||= []
+              graph[parent] << child unless graph[parent].include?(child)
+              actions[key] = action
+            end
+          end
+        end
+      end
+
+      def mssql_cascading_action?(action)
+        %w[cascade set\ null set\ default].include?(action.to_s.downcase.tr("_", " "))
+      end
+
+      def mssql_cascade_conflict?(graph, parent, child)
+        nodes = (graph.keys + graph.values.flatten + [parent, child]).uniq
+        nodes.any? do |source|
+          mssql_reachable?(graph, source, parent) && mssql_reachable?(graph, source, child)
+        end
+      end
+
+      def mssql_reachable?(graph, source, target, visited = {})
+        return true if source == target
+        return false if visited[source]
+
+        visited[source] = true
+        Array(graph[source]).any? { |child| mssql_reachable?(graph, child, target, visited) }
+      end
+
       def foreign_key_target_table(reference, tables)
         return unless tables
 
@@ -286,6 +348,10 @@ module BetterAuth
           .tr("-", "_")
           .downcase
       end
+
+      def logical_name(logical_field, attributes)
+        (attributes[:logical_name] || logical_field).to_s
+      end
     end
   end
 end