better_auth 0.10.0 → 0.11.0

data/lib/better_auth/social_providers/line.rb

@@ -5,6 +5,7 @@ module BetterAuth
     module_function
 
     def line(client_id:, client_secret:, scopes: ["openid", "profile", "email"], **options)
+      normalized = Base.normalize_options(options)
       provider = Base.oauth_provider(
         id: "line",
         name: "LINE",
@@ -26,7 +27,40 @@ module BetterAuth
         },
         **options
       )
-      provider.delete(:verify_id_token) unless provider[:verify_id_token]
+      provider[:verify_id_token] ||= lambda do |token, nonce = nil|
+        return false if normalized[:disable_id_token_sign_in]
+
+        profile = Base.post_form_json(
+          normalized[:verify_id_token_endpoint] || "https://api.line.me/oauth2/v2.1/verify",
+          {id_token: token, client_id: client_id, nonce: nonce}
+        )
+        next false unless profile
+        next false unless profile["aud"] == client_id
+        next false if profile["nonce"] && profile["nonce"] != nonce
+
+        true
+      end
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        profile = Base.id_token(tokens) ? Base.decode_jwt_payload(Base.id_token(tokens)) : {}
+        profile = Base.fetch_user_info("https://api.line.me/oauth2/v2.1/userinfo", tokens) if profile.empty?
+        next nil unless profile && !profile.empty?
+
+        user = Base.apply_profile_mapping(
+          {
+            id: profile["sub"] || profile["userId"],
+            name: profile["name"] || profile["displayName"] || "",
+            email: profile["email"],
+            image: profile["picture"] || profile["pictureUrl"],
+            emailVerified: false
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
       provider
     end
   end

data/lib/better_auth/social_providers/linear.rb

@@ -33,6 +33,7 @@ module BetterAuth
           "Authorization" => "Bearer #{Base.access_token(tokens)}"
         )
         return profile if Base.provider_user_info?(profile)
+        return nil unless profile
 
         mapped = provider[:options][:map_profile_to_user]&.call(profile) || {}
         viewer = profile.dig("data", "viewer") || {}

data/lib/better_auth/social_providers/microsoft_entra_id.rb

@@ -2,6 +2,9 @@
 
 module BetterAuth
   module SocialProviders
+    MICROSOFT_CONSUMER_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad"
+    private_constant :MICROSOFT_CONSUMER_TENANT_ID
+
     module_function
 
     def microsoft_entra_id(client_id:, client_secret:, tenant_id: "common", scopes: ["openid", "profile", "email", "User.Read", "offline_access"], **options)
@@ -81,6 +84,12 @@ module BetterAuth
             nonce: nonce
           )
 
+          tid = profile&.fetch("tid", nil)
+          next false unless tid.is_a?(String)
+          next false unless profile["iss"] == "#{authority.to_s.sub(%r{/+\z}, "")}/#{tid}/v2.0"
+          next false if tenant_id.to_s == "organizations" && tid == MICROSOFT_CONSUMER_TENANT_ID
+          next false if tenant_id.to_s == "consumers" && tid != MICROSOFT_CONSUMER_TENANT_ID
+
           !!(profile&.fetch("sub", nil) || profile&.fetch("oid", nil))
         end,
         get_user_info: lambda do |tokens|

data/lib/better_auth/social_providers/naver.rb

@@ -5,7 +5,8 @@ module BetterAuth
     module_function
 
     def naver(client_id:, client_secret:, scopes: ["profile", "email"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      provider = Base.oauth_provider(
         id: "naver",
         name: "Naver",
         client_id: client_id,
@@ -26,6 +27,28 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        profile = Base.fetch_user_info("https://openapi.naver.com/v1/nid/me", tokens)
+        next nil unless profile && profile["resultcode"] == "00"
+
+        data = profile["response"] || {}
+        user = Base.apply_profile_mapping(
+          {
+            id: data["id"],
+            name: data["name"] || data["nickname"] || "",
+            email: data["email"],
+            image: data["profile_image"],
+            emailVerified: false
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/notion.rb

@@ -15,6 +15,7 @@ module BetterAuth
         user_info_endpoint: "https://api.notion.com/v1/users/me",
         scopes: scopes,
         auth_params: {owner: "user"},
+        token_authentication: :basic,
         user_info_headers: {"Notion-Version" => "2022-06-28"},
         profile_map: ->(profile) {
           user = profile.dig("bot", "owner", "user") || profile

data/lib/better_auth/social_providers/paybin.rb

@@ -5,8 +5,9 @@ module BetterAuth
     module_function
 
     def paybin(client_id:, client_secret:, scopes: ["openid", "email", "profile"], **options)
+      normalized = Base.normalize_options(options)
       issuer = (options[:issuer] || "https://idp.paybin.io").to_s.sub(%r{/+\z}, "")
-      Base.oauth_provider(
+      provider = Base.oauth_provider(
         id: "paybin",
         name: "Paybin",
         client_id: client_id,
@@ -15,6 +16,7 @@ module BetterAuth
         token_endpoint: "#{issuer}/oauth2/token",
         scopes: scopes,
         pkce: true,
+        require_code_verifier: true,
         profile_map: ->(profile) {
           {
             id: profile["sub"],
@@ -26,6 +28,28 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+        next nil unless Base.id_token(tokens)
+
+        profile = Base.decode_jwt_payload(Base.id_token(tokens))
+        next nil if profile.empty?
+
+        user = Base.apply_profile_mapping(
+          {
+            id: profile["sub"],
+            name: profile["name"] || profile["preferred_username"] || "",
+            email: profile["email"],
+            image: profile["picture"],
+            emailVerified: !!profile["email_verified"]
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/paypal.rb

@@ -5,19 +5,24 @@ module BetterAuth
     module_function
 
     def paypal(client_id:, client_secret:, scopes: [], **options)
+      normalized = Base.normalize_options(options)
       sandbox = (options[:environment] || "sandbox").to_s == "sandbox"
       auth_host = sandbox ? "https://www.sandbox.paypal.com" : "https://www.paypal.com"
       api_host = sandbox ? "https://api-m.sandbox.paypal.com" : "https://api-m.paypal.com"
+      token_endpoint = normalized[:token_endpoint] || "#{api_host}/v1/oauth2/token"
+      issuer = sandbox ? "https://www.sandbox.paypal.com" : "https://www.paypal.com"
+      jwks_endpoint = normalized[:jwks_endpoint] || (sandbox ? "https://api.sandbox.paypal.com/v1/oauth2/certs" : "https://api.paypal.com/v1/oauth2/certs")
       provider = Base.oauth_provider(
         id: "paypal",
         name: "PayPal",
         client_id: client_id,
         client_secret: client_secret,
         authorization_endpoint: "#{auth_host}/signin/authorize",
-        token_endpoint: "#{api_host}/v1/oauth2/token",
+        token_endpoint: token_endpoint,
         user_info_endpoint: "#{api_host}/v1/identity/oauth2/userinfo?schema=paypalv1.1",
         scopes: scopes,
         pkce: true,
+        token_authentication: :basic,
         profile_map: ->(profile) {
           {
             id: profile["user_id"],
@@ -29,7 +34,118 @@ module BetterAuth
         },
         **options
       )
-      provider.delete(:verify_id_token) unless provider[:verify_id_token]
+      provider[:validate_authorization_code] = lambda do |data|
+        Base.normalize_tokens(Base.post_token_form(
+          token_endpoint,
+          {
+            code: data[:code] || data["code"],
+            grant_type: "authorization_code",
+            redirect_uri: data[:redirect_uri] || data[:redirectURI] || data["redirect_uri"] || data["redirectURI"]
+          },
+          client_id: Base.primary_client_id(client_id),
+          client_secret: client_secret,
+          authentication: :basic,
+          headers: {"Accept-Language" => "en_US"}
+        ))
+      end
+      provider[:refresh_access_token] = lambda do |refresh_token|
+        Base.normalize_tokens(Base.post_token_form(
+          token_endpoint,
+          {
+            grant_type: "refresh_token",
+            refresh_token: refresh_token
+          },
+          client_id: Base.primary_client_id(client_id),
+          client_secret: client_secret,
+          authentication: :basic,
+          headers: {"Accept-Language" => "en_US"}
+        ))
+      end
+      provider[:verify_id_token] = lambda do |token, nonce = nil|
+        return false if normalized[:disable_id_token_sign_in]
+
+        custom = normalized[:verify_id_token]
+        next custom.call(token, nonce) if custom
+
+        begin
+          encoded_header, _encoded_payload, signature = token.to_s.split(".", 3)
+          next false if encoded_header.to_s.empty? || signature.to_s.empty?
+
+          header = JSON.parse(Base64.urlsafe_decode64(Base.padded_base64(encoded_header)))
+          algorithm = header["alg"]
+          profile = case algorithm
+          when "RS256"
+            Base.verify_jwt_with_jwks(
+              token,
+              jwks: normalized[:jwks],
+              jwks_endpoint: jwks_endpoint,
+              algorithms: ["RS256"],
+              issuers: issuer,
+              audience: Array(client_id),
+              nonce: nonce,
+              max_age: 3600
+            )
+          when "HS256"
+            next false if client_secret.to_s.empty?
+
+            claims, = JWT.decode(token.to_s, client_secret, true, {
+              algorithm: "HS256",
+              aud: Array(client_id),
+              verify_aud: true,
+              iss: issuer,
+              verify_iss: true
+            })
+            next false if nonce && claims["nonce"] != nonce
+
+            claims
+          else
+            next false
+          end
+
+          issued_at = Integer(profile.fetch("iat"))
+          token_age = Time.now.to_i - issued_at
+          next false if token_age.negative? || token_age > 3600
+
+          !!profile.fetch("sub", nil)
+        rescue
+          false
+        end
+      end
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        begin
+          access_token = Base.access_token(tokens)
+          next nil if access_token.to_s.empty?
+
+          profile = Base.fetch_user_info("#{api_host}/v1/identity/oauth2/userinfo?schema=paypalv1.1", tokens)
+          next nil unless profile.is_a?(Hash)
+          next nil if profile["user_id"].to_s.empty?
+
+          id_token = Base.id_token(tokens)
+          if id_token
+            id_token_subject = Base.decode_jwt_payload(id_token)["sub"]
+            profile_subject = profile["sub"] || profile["user_id"]
+            next nil if id_token_subject.to_s.empty? || profile_subject.to_s.empty? || id_token_subject != profile_subject
+          end
+
+          user = Base.apply_profile_mapping(
+            {
+              id: profile["user_id"],
+              name: profile["name"],
+              email: profile["email"],
+              image: profile["picture"],
+              emailVerified: !!profile["email_verified"]
+            },
+            profile,
+            normalized
+          )
+          {user: user, data: profile}
+        rescue
+          nil
+        end
+      end
       provider
     end
   end

data/lib/better_auth/social_providers/reddit.rb

@@ -5,28 +5,49 @@ module BetterAuth
     module_function
 
     def reddit(client_id:, client_secret:, scopes: ["identity"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      token_endpoint = normalized[:token_endpoint] || "https://www.reddit.com/api/v1/access_token"
+      provider = Base.oauth_provider(
         id: "reddit",
         name: "Reddit",
         client_id: client_id,
         client_secret: client_secret,
         authorization_endpoint: "https://www.reddit.com/api/v1/authorize",
-        token_endpoint: "https://www.reddit.com/api/v1/access_token",
+        token_endpoint: token_endpoint,
         user_info_endpoint: "https://oauth.reddit.com/api/v1/me",
         user_info_headers: {"User-Agent" => "better-auth"},
         scopes: scopes,
         auth_params: ->(_data, opts) { {duration: opts[:duration]} },
+        token_authentication: :basic,
         profile_map: ->(profile) {
           {
             id: profile["id"],
             name: profile["name"],
-            email: profile["oauth_client_id"],
+            email: "#{profile["id"]}@reddit.invalid",
             image: profile["icon_img"].to_s.split("?").first,
-            emailVerified: !!profile["has_verified_email"]
+            emailVerified: false
           }
         },
         **options
       )
+      provider[:validate_authorization_code] = lambda do |data|
+        Base.post_token_form(
+          token_endpoint,
+          {
+            code: data[:code] || data["code"],
+            grant_type: "authorization_code",
+            redirect_uri: data[:redirect_uri] || data[:redirectURI] || data["redirect_uri"] || data["redirectURI"]
+          },
+          client_id: Base.primary_client_id(client_id),
+          client_secret: client_secret,
+          authentication: :basic,
+          headers: {
+            "accept" => "text/plain",
+            "user-agent" => "better-auth"
+          }
+        )
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/salesforce.rb

@@ -22,6 +22,7 @@ module BetterAuth
         user_info_endpoint: "#{host}/services/oauth2/userinfo",
         scopes: scopes,
         pkce: true,
+        require_code_verifier: true,
         profile_map: ->(profile) {
           {
             id: profile["user_id"],

data/lib/better_auth/social_providers/twitch.rb

@@ -5,7 +5,8 @@ module BetterAuth
     module_function
 
     def twitch(client_id:, client_secret:, scopes: ["user:read:email", "openid"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      provider = Base.oauth_provider(
         id: "twitch",
         name: "Twitch",
         client_id: client_id,
@@ -34,6 +35,28 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+        next nil unless Base.id_token(tokens)
+
+        profile = Base.decode_jwt_payload(Base.id_token(tokens))
+        next nil if profile.empty?
+
+        user = Base.apply_profile_mapping(
+          {
+            id: profile["sub"],
+            name: profile["preferred_username"],
+            email: profile["email"],
+            image: profile["picture"],
+            emailVerified: !!profile["email_verified"]
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/twitter.rb

@@ -5,7 +5,8 @@ module BetterAuth
     module_function
 
     def twitter(client_id:, client_secret:, scopes: ["users.read", "tweet.read", "offline.access", "users.email"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      provider = Base.oauth_provider(
         id: "twitter",
         name: "Twitter",
         client_id: client_id,
@@ -15,6 +16,7 @@ module BetterAuth
         user_info_endpoint: "https://api.x.com/2/users/me?user.fields=profile_image_url,verified",
         scopes: scopes,
         pkce: true,
+        token_authentication: :basic,
         profile_map: ->(profile) {
           data = profile["data"] || profile
           {
@@ -27,6 +29,39 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        profile = Base.get_json(
+          "https://api.x.com/2/users/me?user.fields=profile_image_url",
+          "Authorization" => "Bearer #{Base.access_token(tokens)}"
+        )
+        next nil unless profile
+
+        email_data = Base.get_json(
+          "https://api.x.com/2/users/me?user.fields=confirmed_email",
+          "Authorization" => "Bearer #{Base.access_token(tokens)}"
+        )
+        data = profile["data"] || profile
+        confirmed_email = email_data&.dig("data", "confirmed_email")
+        data["email"] = confirmed_email if confirmed_email
+        data["confirmed_email"] = true if confirmed_email
+
+        user = Base.apply_profile_mapping(
+          {
+            id: data["id"],
+            name: data["name"],
+            email: data["email"] || data["username"],
+            image: data["profile_image_url"],
+            emailVerified: !!data["confirmed_email"]
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/vk.rb

@@ -5,7 +5,8 @@ module BetterAuth
     module_function
 
     def vk(client_id:, client_secret:, scopes: ["email", "phone"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      provider = Base.oauth_provider(
         id: "vk",
         name: "VK",
         client_id: client_id,
@@ -29,6 +30,38 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        access_token = Base.access_token(tokens)
+        next nil unless access_token
+
+        profile = Base.post_json(
+          "https://id.vk.com/oauth2/user_info",
+          {access_token: access_token, client_id: client_id},
+          "Content-Type" => "application/x-www-form-urlencoded"
+        )
+        next nil unless profile
+
+        user_profile = profile["user"] || profile
+        user_map = normalized[:map_profile_to_user]&.call(profile) || {}
+        next nil if user_profile["email"].to_s.empty? && user_map[:email].to_s.empty? && user_map["email"].to_s.empty?
+
+        user = {
+          id: user_profile["user_id"],
+          first_name: user_profile["first_name"],
+          last_name: user_profile["last_name"],
+          name: [user_profile["first_name"], user_profile["last_name"]].compact.join(" "),
+          email: user_profile["email"],
+          image: user_profile["avatar"],
+          emailVerified: false,
+          birthday: user_profile["birthday"],
+          sex: user_profile["sex"]
+        }.merge(user_map)
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/wechat.rb

@@ -17,10 +17,11 @@ module BetterAuth
         scopes: scopes,
         scope_separator: ",",
         profile_map: ->(profile) {
+          id = profile["unionid"] || profile["openid"]
           {
-            id: profile["unionid"] || profile["openid"],
+            id: id,
             name: profile["nickname"],
-            email: profile["email"],
+            email: profile["email"] || "#{id}@wechat.invalid",
             image: profile["headimgurl"],
             emailVerified: false
           }
@@ -85,11 +86,12 @@ module BetterAuth
         profile = Base.get_json(url)
         next nil if !profile || profile["errcode"]
 
+        id = profile["unionid"] || profile["openid"] || openid
         user = Base.apply_profile_mapping(
           {
-            id: profile["unionid"] || profile["openid"] || openid,
+            id: id,
             name: profile["nickname"],
-            email: profile["email"],
+            email: profile["email"] || "#{id}@wechat.invalid",
             image: profile["headimgurl"],
             emailVerified: false
           },

data/lib/better_auth/sql_migration.rb

@@ -39,7 +39,7 @@ module BetterAuth
     def plan_from_existing(options, existing:, dialect:)
       dialect = normalize_dialect(dialect)
       config = configuration_for(options)
-      desired = BetterAuth::Schema.auth_tables(config)
+      desired = BetterAuth::Schema.migration_tables(config)
       to_create = []
       to_add = []
       to_index = []
@@ -219,14 +219,14 @@ module BetterAuth
     def execute_sql(connection, sql)
       statements(sql).each_with_object([]) do |statement, results|
         result =
-          if connection.respond_to?(:exec)
-            connection.exec(statement)
-          elsif connection.respond_to?(:execute)
+          if connection.respond_to?(:execute)
             connection.execute(statement)
+          elsif connection.respond_to?(:exec)
+            connection.exec(statement)
           elsif connection.respond_to?(:query)
             connection.query(statement)
           else
-            raise UnsupportedAdapterError, "SQL connection does not support exec, execute, or query"
+            raise UnsupportedAdapterError, "SQL connection does not support execute, exec, or query"
           end
         results.concat(result.to_a) if result.respond_to?(:to_a)
       end

data/lib/better_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BetterAuth
-  VERSION = "0.10.0"
+  VERSION = "0.11.0"
 end

data/lib/better_auth.rb

@@ -38,50 +38,11 @@ require_relative "better_auth/context"
 require_relative "better_auth/plugin_context"
 require_relative "better_auth/plugin_registry"
 require_relative "better_auth/plugins"
-require_relative "better_auth/plugins/additional_fields"
-require_relative "better_auth/plugins/custom_session"
-require_relative "better_auth/plugins/multi_session"
-require_relative "better_auth/plugins/last_login_method"
-require_relative "better_auth/plugins/bearer"
-require_relative "better_auth/plugins/jwt"
-require_relative "better_auth/plugins/open_api"
-require_relative "better_auth/plugins/access"
-require_relative "better_auth/plugins/username"
-require_relative "better_auth/plugins/anonymous"
-require_relative "better_auth/plugins/magic_link"
-require_relative "better_auth/plugins/email_otp"
-require_relative "better_auth/plugins/phone_number"
-require_relative "better_auth/plugins/one_time_token"
-require_relative "better_auth/plugins/one_tap"
-require_relative "better_auth/plugins/siwe"
-require_relative "better_auth/plugins/generic_oauth"
-require_relative "better_auth/plugins/dub"
-require_relative "better_auth/plugins/oauth_proxy"
-require_relative "better_auth/plugins/passkey"
-require_relative "better_auth/plugins/organization/schema"
-require_relative "better_auth/plugins/organization"
-require_relative "better_auth/plugins/admin/schema"
-require_relative "better_auth/plugins/admin"
-require_relative "better_auth/plugins/oauth_protocol"
-require_relative "better_auth/plugins/oidc_provider"
-require_relative "better_auth/plugins/oauth_provider"
-require_relative "better_auth/plugins/device_authorization"
-require_relative "better_auth/plugins/mcp"
-require_relative "better_auth/plugins/two_factor"
-require_relative "better_auth/plugins/captcha"
-require_relative "better_auth/plugins/have_i_been_pwned"
-require_relative "better_auth/plugins/api_key"
-require_relative "better_auth/plugins/sso"
-require_relative "better_auth/plugins/scim"
+BetterAuth::Plugins.load_boot_plugins!
 require_relative "better_auth/social_providers"
-%w[
-  better_auth/plugins/stripe
-  better_auth/plugins/expo
-].each do |optional_plugin|
-  require_relative optional_plugin if File.file?(File.expand_path("#{optional_plugin}.rb", __dir__))
-end
 require_relative "better_auth/session_store"
 require_relative "better_auth/cookies"
+require_relative "better_auth/oauth_state"
 require_relative "better_auth/session"
 require_relative "better_auth/endpoint"
 require_relative "better_auth/routes/validation"
@@ -107,4 +68,13 @@ module BetterAuth
   def self.auth(options = {})
     Auth.new(options)
   end
+
+  def self.const_missing(name)
+    if name == :OpenAPI
+      Plugins.load_plugin!(:open_api)
+      return const_get(:OpenAPI) if const_defined?(:OpenAPI, false)
+    end
+
+    super
+  end
 end