better_auth 0.10.0 → 0.11.0

data/lib/better_auth/schema.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "time"
+
 module BetterAuth
   module Schema
     module_function
@@ -22,6 +24,40 @@ module BetterAuth
       tables.sort_by { |_name, table| table[:order] || Float::INFINITY }.to_h
     end
 
+    def migration_tables(options)
+      tables = auth_tables(options)
+      grouped = {}
+
+      tables.each_with_index do |(logical_name, table), index|
+        table_name = table.fetch(:model_name)
+        target = grouped[table_name] ||= {
+          model_name: table_name,
+          fields: {},
+          order: table[:order] || Float::INFINITY,
+          source_order: index,
+          logical_names: [],
+          disable_migration: false
+        }
+        target[:order] = [target[:order], table[:order] || Float::INFINITY].min
+        target[:source_order] = [target[:source_order], index].min
+        target[:logical_names] << logical_name
+        target[:disable_migration] ||= table[:disable_migration] == true
+
+        table.fetch(:fields).each do |logical_field, attributes|
+          column = attributes[:field_name] || physical_name(logical_field)
+          physical_attributes = physical_field_attributes(logical_field, attributes, tables)
+          merge_physical_field!(target, column, physical_attributes)
+        end
+      end
+
+      grouped
+        .reject { |_name, table| table[:disable_migration] }
+        .sort_by { |_name, table| [table[:order], table[:source_order]] }
+        .to_h do |name, table|
+          [name, table.except(:source_order, :disable_migration)]
+        end
+    end
+
     def storage_model_name(options, model)
       table = auth_tables(options).fetch(model.to_s)
       table[:model_name]
@@ -49,10 +85,48 @@ module BetterAuth
       data
     end
 
+    def parse_provider_profile_user_input(options, profile, action:)
+      action = action.to_sym
+      raise ArgumentError, "action must be :create or :update" unless [:create, :update].include?(action)
+
+      input = (profile || {}).each_with_object({}) do |(key, value), result|
+        result[storage_key(key)] = value
+      end
+      core_fields = %w[id email emailVerified name image createdAt updatedAt]
+      fields = auth_tables(options).fetch("user").fetch(:fields).except(*core_fields)
+
+      fields.each_with_object({}) do |(field, attributes), result|
+        provider_value_allowed = attributes[:input] != false && input.key?(field)
+        if provider_value_allowed
+          value = coerce_provider_profile_value(input[field], attributes)
+          transform = attributes[:transform]
+          value = transform.call(value) if transform.respond_to?(:call)
+          validator = attributes[:validator]
+          if validator.respond_to?(:call) && !validator.call(value)
+            raise APIError.new("BAD_REQUEST", message: "#{field} is invalid")
+          end
+          result[field] = value
+        elsif action == :create && attributes.key?(:default_value)
+          default = attributes[:default_value]
+          result[field] = default.respond_to?(:call) ? default.call : default
+        elsif action == :create && attributes[:required]
+          raise APIError.new("BAD_REQUEST", message: "#{field} is required")
+        end
+      end
+    end
+
+    private_class_method def self.coerce_provider_profile_value(value, attributes)
+      return value if value.nil?
+      return Time.parse(value) if attributes[:type] == "date" && value.is_a?(String)
+
+      value
+    end
+
     private_class_method def self.user_table(options, plugin_table)
       table(
         model_name: model_option(options, :user, :model_name) || "users",
         order: 1,
+        disable_migration: plugin_table&.fetch(:disable_migration, false),
         fields: id_field.merge(
           "name" => field("string", required: true, sortable: true, field_name: mapped_field(options, :user, "name")),
           "email" => field("string", required: true, unique: true, sortable: true, field_name: mapped_field(options, :user, "email")),
@@ -67,6 +141,7 @@ module BetterAuth
       table(
         model_name: model_option(options, :session, :model_name) || "sessions",
         order: 2,
+        disable_migration: plugin_table&.fetch(:disable_migration, false),
         fields: base_fields.merge(
           "expiresAt" => field("date", required: true, field_name: mapped_field(options, :session, "expiresAt")),
           "token" => field("string", required: true, unique: true, field_name: mapped_field(options, :session, "token")),
@@ -82,6 +157,7 @@ module BetterAuth
       table(
         model_name: model_option(options, :account, :model_name) || "accounts",
         order: 3,
+        disable_migration: plugin_table&.fetch(:disable_migration, false),
         fields: base_fields.merge(
           "accountId" => field("string", required: true, field_name: mapped_field(options, :account, "accountId")),
           "providerId" => field("string", required: true, field_name: mapped_field(options, :account, "providerId")),
@@ -102,6 +178,7 @@ module BetterAuth
       table(
         model_name: model_option(options, :verification, :model_name) || "verifications",
         order: 4,
+        disable_migration: plugin_table&.fetch(:disable_migration, false),
         fields: base_fields.merge(
           "identifier" => field("string", required: true, index: true, field_name: mapped_field(options, :verification, "identifier")),
           "value" => field("string", required: true, field_name: mapped_field(options, :verification, "value")),
@@ -131,6 +208,49 @@ module BetterAuth
       end
     end
 
+    private_class_method def self.physical_field_attributes(logical_field, attributes, tables)
+      column = attributes[:field_name] || physical_name(logical_field)
+      physical_attributes = attributes.merge(field_name: column, logical_name: logical_field.to_s)
+      reference = attributes[:references]
+      return physical_attributes unless reference
+
+      physical_attributes.merge(references: physical_reference(reference, tables))
+    end
+
+    private_class_method def self.physical_reference(reference, tables)
+      model = reference.fetch(:model).to_s
+      target_table = tables.fetch(model, nil) || tables.each_value.find { |table| table.fetch(:model_name).to_s == model }
+      return reference unless target_table
+
+      field = reference.fetch(:field).to_s
+      target_field = target_table.fetch(:fields).fetch(field, nil)
+      physical_field = if target_field
+        target_field[:field_name] || physical_name(field)
+      elsif target_table.fetch(:fields).each_value.any? { |attributes| attributes[:field_name].to_s == field }
+        field
+      else
+        physical_name(field)
+      end
+      reference.merge(model: target_table.fetch(:model_name), field: physical_field)
+    end
+
+    private_class_method def self.merge_physical_field!(table, column, attributes)
+      existing = table.fetch(:fields)[column]
+      unless existing
+        table.fetch(:fields)[column] = attributes
+        return
+      end
+
+      return if compatible_physical_field?(existing, attributes)
+
+      raise BetterAuth::Error, "Conflicting schema metadata for #{table.fetch(:model_name)}.#{column}"
+    end
+
+    private_class_method def self.compatible_physical_field?(left, right)
+      keys = [:type, :required, :references, :index, :unique, :sortable, :bigint]
+      keys.all? { |key| left[key] == right[key] }
+    end
+
     private_class_method def self.base_fields
       id_field.merge(timestamp_fields)
     end
@@ -148,12 +268,12 @@ module BetterAuth
       }
     end
 
-    private_class_method def self.table(model_name:, fields:, extra_fields:, order:)
+    private_class_method def self.table(model_name:, fields:, extra_fields:, order:, disable_migration: false)
       {
         model_name: model_name,
         fields: merge_fields(fields, *extra_fields),
         order: order
-      }
+      }.tap { |data| data[:disable_migration] = true if disable_migration == true }
     end
 
     private_class_method def self.merge_fields(base, *extras)
@@ -175,6 +295,7 @@ module BetterAuth
           existing = tables[key] || {model_name: table_data[:model_name] || physical_table_name(key), fields: {}}
           existing[:model_name] = table_data[:model_name] || existing[:model_name] || physical_table_name(key)
           existing[:fields] = existing[:fields].merge(normalize_fields(table_data[:fields] || {}))
+          existing[:disable_migration] = true if table_data[:disable_migration] == true
           existing[:fields] = id_field.merge(existing[:fields]) unless core_table?(key) || existing[:fields].key?("id")
           tables[key] = existing
         end
@@ -319,6 +440,6 @@ module BetterAuth
       (Time.now.to_f * 1000).to_i
     end
 
-    public_class_method :storage_key
+    public_class_method :physical_name, :storage_key
   end
 end

data/lib/better_auth/session.rb

@@ -7,15 +7,21 @@ module BetterAuth
     module_function
 
     def find_current(ctx, disable_cookie_cache: false, disable_refresh: false, sensitive: false)
-      if ctx.context.current_session
+      authoritative = sensitive && stateful?(ctx)
+      if ctx.context.current_session && !authoritative
         return ctx.context.current_session
       end
 
       token_cookie = ctx.context.auth_cookies[:session_token]
       token = ctx.get_signed_cookie(token_cookie.name, ctx.context.secret)
-      return nil unless token
+      unless token
+        present = ctx.get_cookie(token_cookie.name)
+        return missing_session(ctx) if present && !present.empty?
 
-      cached = cached_session(ctx, token, disable_cookie_cache: disable_cookie_cache, sensitive: sensitive)
+        return nil
+      end
+
+      cached = cached_session(ctx, token, disable_cookie_cache: disable_cookie_cache, sensitive: authoritative)
       if cached
         ctx.context.set_current_session(cached) if ctx.context.respond_to?(:set_current_session)
         return cached
@@ -57,10 +63,16 @@ module BetterAuth
     end
 
     def missing_session(ctx)
+      ctx.context.set_current_session(nil) if ctx.context.respond_to?(:set_current_session)
       Cookies.delete_session_cookie(ctx)
       nil
     end
 
+    def stateful?(ctx)
+      options = ctx.context.options
+      !options.database.nil? || !options.secondary_storage.nil?
+    end
+
     def expired?(session)
       expires_at = normalize_time(session["expiresAt"])
       expires_at && expires_at <= Time.now
@@ -84,7 +96,12 @@ module BetterAuth
         "expiresAt" => expires_at,
         "updatedAt" => now
       )
-      session = stringify_keys(updated || result[:session]).merge("expiresAt" => expires_at, "updatedAt" => now)
+      unless updated
+        missing_session(ctx)
+        raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["FAILED_TO_GET_SESSION"])
+      end
+
+      session = stringify_keys(updated)
       refreshed = {session: session, user: result[:user]}
       Cookies.set_session_cookie(ctx, refreshed, Cookies.dont_remember?(ctx))
       refreshed
@@ -92,12 +109,13 @@ module BetterAuth
 
     def refresh_cached_session(ctx, result)
       now = Time.now
-      session = stringify_keys(result[:session]).merge(
-        "expiresAt" => now + ctx.context.session_config[:expires_in].to_i,
-        "updatedAt" => now
-      )
+      session = stringify_keys(result[:session])
+      expires_at = normalize_time(session["expiresAt"])
+      return missing_session(ctx) if expires_at && expires_at <= now
+
+      remaining = expires_at && [(expires_at - now).floor, 0].max
       refreshed = {session: session, user: result[:user]}
-      Cookies.set_session_cookie(ctx, refreshed, Cookies.dont_remember?(ctx))
+      Cookies.set_session_cookie(ctx, refreshed, Cookies.dont_remember?(ctx), max_age: remaining)
       refreshed
     end
 

data/lib/better_auth/session_store.rb

@@ -6,7 +6,7 @@ module BetterAuth
     ESTIMATED_EMPTY_COOKIE_SIZE = 200
     CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE
 
-    CookieValue = Struct.new(:name, :value, :attributes, keyword_init: true)
+    CookieValue = Struct.new(:name, :value, :attributes)
 
     attr_reader :cookie_name, :cookie_options, :context, :chunks
 

data/lib/better_auth/social_providers/apple.rb

@@ -45,8 +45,13 @@ module BetterAuth
             algorithms: ["RS256"],
             issuers: "https://appleid.apple.com",
             audience: audiences,
-            nonce: nonce
+            nonce: nil
           )
+          if nonce
+            token_nonce = profile&.fetch("nonce", nil)
+            expected_nonces = [nonce, OpenSSL::Digest::SHA256.hexdigest(nonce.to_s)]
+            return false unless token_nonce.is_a?(String) && expected_nonces.include?(token_nonce)
+          end
           !!profile&.fetch("sub", nil)
         end,
         get_user_info: lambda do |tokens|

data/lib/better_auth/social_providers/atlassian.rb

@@ -15,6 +15,7 @@ module BetterAuth
         user_info_endpoint: "https://api.atlassian.com/me",
         scopes: scopes,
         pkce: true,
+        require_code_verifier: true,
         auth_params: {audience: "api.atlassian.com"},
         profile_map: ->(profile) {
           {

data/lib/better_auth/social_providers/base.rb

@@ -26,8 +26,9 @@ module BetterAuth
         uri.to_s
       end
 
-      def oauth_provider(id:, name:, client_id:, authorization_endpoint:, token_endpoint:, profile_map:, client_secret: nil, user_info_endpoint: nil, scopes: [], scope_separator: " ", pkce: false, auth_params: {}, token_params: {}, user_info_method: :get, user_info_headers: {}, user_info_body: nil, **options)
+      def oauth_provider(id:, name:, client_id:, authorization_endpoint:, token_endpoint:, profile_map:, client_secret: nil, user_info_endpoint: nil, scopes: [], scope_separator: " ", pkce: false, require_code_verifier: false, auth_params: {}, token_params: {}, token_authentication: :post, user_info_method: :get, user_info_headers: {}, user_info_body: nil, **options)
         opts = normalize_options(options.merge(client_id: client_id, client_secret: client_secret))
+        primary_id = primary_client_id(client_id)
         {
           id: id,
           name: name,
@@ -36,9 +37,11 @@ module BetterAuth
           options: opts,
           create_authorization_url: lambda do |data|
             verifier = value(data, :code_verifier, :codeVerifier)
+            raise Error, "codeVerifier is required for #{name}" if require_code_verifier && verifier.to_s.empty?
+
             selected_scopes = selected_scopes(scopes, opts, data)
             params = {
-              client_id: primary_client_id(client_id),
+              client_id: primary_id,
               redirect_uri: opts[:redirect_uri] || value(data, :redirect_uri, :redirectURI),
               response_type: "code",
               scope: selected_scopes.empty? ? nil : selected_scopes.join(scope_separator),
@@ -51,21 +54,27 @@ module BetterAuth
             authorization_url(option(opts, :authorization_endpoint, :authorizationEndpoint) || authorization_endpoint, params)
           end,
           validate_authorization_code: lambda do |data|
-            post_form_json(option(opts, :token_endpoint, :tokenEndpoint) || token_endpoint, {
-              client_id: primary_client_id(client_id),
-              client_secret: client_secret,
+            token_form = {
               code: value(data, :code),
               code_verifier: value(data, :code_verifier, :codeVerifier),
               grant_type: "authorization_code",
               redirect_uri: opts[:redirect_uri] || value(data, :redirect_uri, :redirectURI)
-            }.merge(resolve_hash(token_params, data, opts)))
+            }.merge(resolve_hash(token_params, data, opts))
+            post_token_form(
+              option(opts, :token_endpoint, :tokenEndpoint) || token_endpoint,
+              token_form,
+              client_id: primary_id,
+              client_secret: client_secret,
+              authentication: token_authentication
+            )
           end,
           refresh_access_token: opts[:refresh_access_token] || lambda do |refresh_token|
             refresh_access_token(
               option(opts, :token_endpoint, :tokenEndpoint) || token_endpoint,
               refresh_token,
-              client_id: primary_client_id(client_id),
-              client_secret: client_secret
+              client_id: primary_id,
+              client_secret: client_secret,
+              authentication: token_authentication
             )
           end,
           verify_id_token: opts[:verify_id_token],
@@ -138,13 +147,27 @@ module BetterAuth
         (method == :post) ? post_json(endpoint, resolved_body, resolved_headers) : get_json(endpoint, resolved_headers)
       end
 
-      def refresh_access_token(token_endpoint, refresh_token, client_id:, client_secret: nil, extra_params: {})
-        normalize_tokens(post_form_json(token_endpoint, {
-          client_id: client_id,
-          client_secret: client_secret,
+      def refresh_access_token(token_endpoint, refresh_token, client_id:, client_secret: nil, extra_params: {}, authentication: :post)
+        normalize_tokens(post_token_form(token_endpoint, {
           grant_type: "refresh_token",
           refresh_token: refresh_token
-        }.merge(extra_params || {})))
+        }.merge(extra_params || {}), client_id: client_id, client_secret: client_secret, authentication: authentication))
+      end
+
+      def post_token_form(token_endpoint, form, client_id:, client_secret: nil, authentication: :post, headers: {})
+        case authentication&.to_sym
+        when :basic
+          post_form_json(token_endpoint, form.compact, basic_auth_headers(client_id, client_secret).merge(headers))
+        else
+          post_form_json(token_endpoint, {
+            client_id: client_id,
+            client_secret: client_secret
+          }.merge(form), headers)
+        end
+      end
+
+      def basic_auth_headers(client_id, client_secret)
+        {"Authorization" => "Basic #{Base64.strict_encode64("#{client_id}:#{client_secret}")}"}
       end
 
       def normalize_tokens(tokens, now: Time.now)
@@ -211,7 +234,11 @@ module BetterAuth
           appBundleIdentifier: :app_bundle_identifier,
           profilePhotoSize: :profile_photo_size,
           disableProfilePhoto: :disable_profile_photo,
-          tenantId: :tenant_id
+          tenantId: :tenant_id,
+          userPoolId: :user_pool_id,
+          requireClientSecret: :require_client_secret,
+          configId: :config_id,
+          loginUrl: :login_url
         }.each do |camel, snake|
           normalized[snake] = normalized[camel] if normalized.key?(camel) && !normalized.key?(snake)
         end

data/lib/better_auth/social_providers/cognito.rb

@@ -5,15 +5,25 @@ module BetterAuth
     module_function
 
     def cognito(client_id:, client_secret: nil, scopes: ["openid", "profile", "email"], **options)
-      domain = (options[:domain] || options[:issuer] || "https://cognito-idp.#{options[:region] || "us-east-1"}.amazonaws.com").to_s.sub(%r{/+\z}, "")
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      domain = normalized[:domain]
+      region = normalized[:region]
+      user_pool_id = normalized[:user_pool_id]
+      raise Error, "DOMAIN_AND_REGION_REQUIRED" if domain.to_s.empty? || region.to_s.empty? || user_pool_id.to_s.empty?
+
+      if normalized[:require_client_secret] && client_secret.to_s.empty?
+        raise Error, "CLIENT_SECRET_REQUIRED"
+      end
+
+      clean_domain = domain.to_s.sub(%r{\Ahttps?://}, "").sub(%r{/+\z}, "")
+      provider = Base.oauth_provider(
         id: "cognito",
         name: "Cognito",
         client_id: client_id,
         client_secret: client_secret,
-        authorization_endpoint: "#{domain}/oauth2/authorize",
-        token_endpoint: "#{domain}/oauth2/token",
-        user_info_endpoint: "#{domain}/oauth2/userinfo",
+        authorization_endpoint: "https://#{clean_domain}/oauth2/authorize",
+        token_endpoint: "https://#{clean_domain}/oauth2/token",
+        user_info_endpoint: "https://#{clean_domain}/oauth2/userinfo",
         scopes: scopes,
         pkce: true,
         profile_map: ->(profile) {
@@ -27,6 +37,66 @@ module BetterAuth
         },
         **options
       )
+      create_authorization_url = provider.fetch(:create_authorization_url)
+      provider[:create_authorization_url] = lambda do |data|
+        create_authorization_url.call(data).sub(/scope=([^&]+)/) { "scope=#{$1.gsub("+", "%20")}" }
+      end
+      provider[:verify_id_token] ||= lambda do |token, nonce = nil|
+        return false if normalized[:disable_id_token_sign_in]
+
+        profile = Base.verify_jwt_with_jwks(
+          token,
+          jwks: normalized[:jwks],
+          jwks_endpoint: normalized[:jwks_endpoint] || "https://cognito-idp.#{region}.amazonaws.com/#{user_pool_id}/.well-known/jwks.json",
+          algorithms: ["RS256"],
+          issuers: "https://cognito-idp.#{region}.amazonaws.com/#{user_pool_id}",
+          audience: Array(client_id),
+          nonce: nonce,
+          max_age: 3600
+        )
+        !!profile&.fetch("sub", nil)
+      end
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        if Base.id_token(tokens)
+          profile = Base.decode_jwt_payload(Base.id_token(tokens))
+          unless profile.empty?
+            name = profile["name"] || profile["given_name"] || profile["username"] || ""
+            enriched = profile.merge("name" => name)
+            user = Base.apply_profile_mapping(
+              {
+                id: profile["sub"],
+                name: name,
+                email: profile["email"],
+                image: profile["picture"],
+                emailVerified: !!profile["email_verified"]
+              },
+              enriched,
+              normalized
+            )
+            next({user: user, data: enriched})
+          end
+        end
+
+        profile = Base.fetch_user_info("https://#{clean_domain}/oauth2/userinfo", tokens)
+        next nil unless profile
+
+        user = Base.apply_profile_mapping(
+          {
+            id: profile["sub"],
+            name: profile["name"] || profile["given_name"] || profile["username"] || "",
+            email: profile["email"],
+            image: profile["picture"],
+            emailVerified: !!profile["email_verified"]
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/facebook.rb

@@ -5,6 +5,7 @@ module BetterAuth
     module_function
 
     def facebook(client_id:, client_secret:, scopes: ["email", "public_profile"], **options)
+      normalized = Base.normalize_options(options)
       fields = Array(options[:fields] || %w[id name email picture email_verified]).join(",")
       provider = Base.oauth_provider(
         id: "facebook",
@@ -28,7 +29,100 @@ module BetterAuth
         },
         **options
       )
-      provider.delete(:verify_id_token) unless provider[:verify_id_token]
+      verify_access_token = lambda do |access_token|
+        primary_client_id = Base.primary_client_id(client_id)
+        next nil if access_token.to_s.empty? || client_secret.to_s.empty?
+
+        response = Base.get_json(Base.authorization_url("https://graph.facebook.com/debug_token", {
+          input_token: access_token,
+          access_token: "#{primary_client_id}|#{client_secret}"
+        }))
+        data = response.is_a?(Hash) ? response["data"] : nil
+        next nil unless data.is_a?(Hash)
+        next nil unless data["is_valid"] == true
+        next nil unless Array(client_id).map(&:to_s).include?(data["app_id"].to_s)
+        next nil if data["app_id"].to_s.empty? || data["user_id"].to_s.empty?
+
+        data["user_id"]
+      rescue
+        nil
+      end
+      provider[:verify_id_token] = lambda do |token, nonce = nil|
+        return false if normalized[:disable_id_token_sign_in]
+
+        custom = normalized[:verify_id_token]
+        next custom.call(token, nonce) if custom
+
+        begin
+          unless token.to_s.split(".").length == 3
+            next !!verify_access_token.call(token)
+          end
+
+          profile = Base.verify_jwt_with_jwks(
+            token,
+            jwks: normalized[:jwks],
+            jwks_endpoint: normalized[:jwks_endpoint] || "https://limited.facebook.com/.well-known/oauth/openid/jwks/",
+            algorithms: ["RS256"],
+            issuers: "https://www.facebook.com",
+            audience: Array(client_id),
+            nonce: nonce
+          )
+          !!profile
+        rescue
+          false
+        end
+      end
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        begin
+          token = Base.id_token(tokens)
+          if token && token.split(".").length == 3
+            profile = Base.decode_jwt_payload(token)
+            next nil if profile["sub"].to_s.empty?
+
+            user = Base.apply_profile_mapping(
+              {
+                id: profile["sub"],
+                name: profile["name"],
+                email: profile["email"],
+                image: profile["picture"],
+                emailVerified: false
+              },
+              profile.merge("email_verified" => false),
+              normalized
+            )
+            next({user: user, data: profile})
+          end
+
+          access_token = Base.access_token(tokens)
+          next nil if access_token.to_s.empty?
+
+          token_user_id = verify_access_token.call(access_token)
+          next nil unless token_user_id
+
+          profile = Base.fetch_user_info("https://graph.facebook.com/me?fields=#{URI.encode_www_form_component(fields)}", tokens)
+          next nil unless profile.is_a?(Hash)
+          next nil unless profile["id"] == token_user_id
+
+          picture = profile.dig("picture", "data", "url") || profile["picture"]
+          user = Base.apply_profile_mapping(
+            {
+              id: profile["id"] || profile["sub"],
+              name: profile["name"],
+              email: profile["email"],
+              image: picture,
+              emailVerified: !!profile["email_verified"]
+            },
+            profile,
+            normalized
+          )
+          {user: user, data: profile}
+        rescue
+          nil
+        end
+      end
       provider
     end
   end

data/lib/better_auth/social_providers/figma.rb

@@ -15,6 +15,8 @@ module BetterAuth
         user_info_endpoint: "https://api.figma.com/v1/me",
         scopes: scopes,
         pkce: true,
+        require_code_verifier: true,
+        token_authentication: :basic,
         profile_map: ->(profile) {
           {
             id: profile["id"],

data/lib/better_auth/social_providers/google.rb

@@ -4,6 +4,14 @@ module BetterAuth
   module SocialProviders
     module_function
 
+    def google_hosted_domain_allowed?(configured_hosted_domain, token_hosted_domain)
+      return true if configured_hosted_domain.nil? || configured_hosted_domain.to_s.empty?
+      return false unless token_hosted_domain.is_a?(String) && !token_hosted_domain.strip.empty?
+      return true if configured_hosted_domain == "*"
+
+      token_hosted_domain == configured_hosted_domain
+    end
+
     def google(client_id:, client_secret:, scopes: ["openid", "email", "profile"], **options)
       normalized = Base.normalize_options(options)
       primary_client_id = Base.primary_client_id(client_id)
@@ -12,6 +20,7 @@ module BetterAuth
         name: "Google",
         client_id: client_id,
         client_secret: client_secret,
+        options: normalized,
         create_authorization_url: lambda do |data|
           verifier = data[:code_verifier] || data[:codeVerifier]
           raise Error, "codeVerifier is required for Google" if verifier.to_s.empty?
@@ -57,7 +66,7 @@ module BetterAuth
             audience: audiences,
             nonce: nonce
           )
-          !!profile&.fetch("sub", nil)
+          !!profile&.fetch("sub", nil) && google_hosted_domain_allowed?(normalized[:hd], profile["hd"])
         end,
         get_user_info: lambda do |tokens|
           custom = normalized[:get_user_info]
@@ -65,6 +74,8 @@ module BetterAuth
           next nil unless Base.id_token(tokens)
 
           profile = Base.decode_jwt_payload(Base.id_token(tokens))
+          next nil unless google_hosted_domain_allowed?(normalized[:hd], profile["hd"])
+
           user = Base.apply_profile_mapping(
             {
               id: profile["sub"],