better_auth 0.10.0 → 0.11.0

data/lib/better_auth/adapters/internal_adapter.rb

@@ -3,6 +3,7 @@
 require "json"
 require "securerandom"
 require "time"
+require "monitor"
 
 module BetterAuth
   module Adapters
@@ -13,6 +14,8 @@ module BetterAuth
         @adapter = adapter
         @options = options
         @hooks = DatabaseHooks.new(adapter, options)
+        @verification_locks_guard = Mutex.new
+        @verification_locks = {}
       end
 
       def create_oauth_user(user, account, context: nil)
@@ -63,7 +66,7 @@ module BetterAuth
         return false if deleted == false
 
         hooks.delete_many([{field: "userId", value: user_id}], "account")
-        delete_sessions(user_id) if !secondary_storage || options.session[:store_session_in_database]
+        delete_user_sessions(user_id)
         deleted
       end
 
@@ -143,20 +146,24 @@ module BetterAuth
         hooks.delete([{field: "token", value: token}], "session")
       end
 
-      def delete_sessions(user_id_or_tokens)
+      def delete_user_sessions(user_id)
         if secondary_storage
-          if user_id_or_tokens.is_a?(Array)
-            user_id_or_tokens.each { |token| secondary_storage.delete(token) }
-          else
-            active_session_entries(user_id_or_tokens).each { |entry| secondary_storage.delete(entry["token"]) }
-            secondary_storage.delete(active_key(user_id_or_tokens))
-          end
+          active_session_entries(user_id).each { |entry| secondary_storage.delete(entry["token"]) }
+          secondary_storage.delete(active_key(user_id))
+          return if !options.session[:store_session_in_database] || options.session[:preserve_session_in_database]
+        end
+
+        hooks.delete_many([{field: "userId", value: user_id}], "session")
+      end
+
+      def delete_sessions(tokens)
+        session_tokens = Array(tokens)
+        if secondary_storage
+          session_tokens.each { |token| secondary_storage.delete(token) }
           return if !options.session[:store_session_in_database] || options.session[:preserve_session_in_database]
         end
 
-        field = user_id_or_tokens.is_a?(Array) ? "token" : "userId"
-        operator = user_id_or_tokens.is_a?(Array) ? "in" : nil
-        hooks.delete_many([{field: field, value: user_id_or_tokens, operator: operator}], "session")
+        hooks.delete_many([{field: "token", value: session_tokens, operator: "in"}], "session")
       end
 
       def delete_accounts(user_id)
@@ -167,6 +174,26 @@ module BetterAuth
         hooks.delete([{field: "id", value: account_id}], "account")
       end
 
+      # Removes access established before control of an email address was proven.
+      # The user is intentionally left unverified until the caller completes the
+      # proof transition and may safely mint a replacement session.
+      def revoke_unproven_account_access(user_id)
+        adapter.transaction do
+          user = find_user_by_id(user_id)
+          next unless user && !user["emailVerified"]
+
+          find_accounts(user_id).each do |account|
+            next unless account["providerId"] == "credential"
+
+            deleted = delete_account(account.fetch("id"))
+            raise Error, "Credential account revocation was vetoed" if deleted == false
+          end
+
+          deleted_sessions = delete_user_sessions(user_id)
+          raise Error, "Session revocation was vetoed" if deleted_sessions == false
+        end
+      end
+
       def find_oauth_user(email, account_id, provider_id)
         account = find_account_with_user(account_id, provider_id)
         if account
@@ -277,6 +304,56 @@ module BetterAuth
         values.first
       end
 
+      def consume_verification_value(identifier)
+        identifiers = verification_identifiers(identifier)
+        consumed = if secondary_storage && !verification_store_in_database?
+          consume_secondary_verification(identifiers)
+        else
+          consume_database_verification(identifiers)
+        end
+
+        invalidate_secondary_verification(identifiers, consumed) if consumed && secondary_storage && verification_store_in_database?
+        return nil unless consumed
+
+        expires_at = normalize_time(consumed["expiresAt"] || consumed[:expiresAt])
+        (expires_at > Time.now) ? normalize_verification_dates(consumed) : nil
+      rescue ArgumentError, TypeError
+        nil
+      end
+
+      def reserve_verification_value(data)
+        payload = stringify_keys(data)
+        identifier = payload.fetch("identifier")
+        stored_identifier = processed_verification_identifier(identifier)
+        reservation_id = Crypto.sha256("reserve:#{identifier}", encoding: :base64url)
+        verification = timestamps.merge(
+          "id" => reservation_id,
+          "identifier" => stored_identifier,
+          "value" => payload.fetch("value"),
+          "expiresAt" => normalize_time(payload.fetch("expiresAt"))
+        )
+
+        if secondary_storage && !verification_store_in_database?
+          return reserve_secondary_verification(verification)
+        end
+
+        adapter.consume_one(
+          model: "verification",
+          where: [
+            {field: "id", value: reservation_id},
+            {field: "expiresAt", value: Time.now, operator: "lt"}
+          ]
+        )
+        created = adapter.create_if_absent(
+          model: "verification",
+          data: verification,
+          conflict_field: "id",
+          force_allow_id: true
+        )
+        store_reserved_verification(verification) if created && secondary_storage
+        created
+      end
+
       def delete_verification_value(id)
         if secondary_storage
           stored_identifier = secondary_storage.get(verification_id_key(id))
@@ -325,6 +402,106 @@ module BetterAuth
 
       private
 
+      def verification_identifiers(identifier)
+        stored_identifier = processed_verification_identifier(identifier)
+        storage_option = verification_storage_option(identifier)
+        if storage_option && storage_option.to_s != "plain" && stored_identifier != identifier.to_s
+          [stored_identifier, identifier.to_s]
+        else
+          [stored_identifier]
+        end
+      end
+
+      def consume_secondary_verification(identifiers)
+        identifiers.each do |stored_identifier|
+          key = verification_key(stored_identifier)
+          raw = if secondary_storage.respond_to?(:get_and_delete)
+            secondary_storage.get_and_delete(key)
+          elsif secondary_storage.respond_to?(:getAndDelete)
+            secondary_storage.getAndDelete(key)
+          else
+            raise Error, "Secondary storage must implement atomic `get_and_delete`/`getAndDelete`, or verification values must be database-backed"
+          end
+          consumed = begin
+            parsed = parse_storage(raw)
+            parsed ? normalize_verification_dates(parsed) : nil
+          rescue ArgumentError, TypeError
+            nil
+          end
+          next unless consumed
+
+          invalidate_secondary_verification(identifiers, consumed)
+          return consumed
+        end
+        nil
+      end
+
+      def reserve_secondary_verification(verification)
+        key = verification_key(verification.fetch("identifier"))
+        ttl_seconds = ttl(millis(verification.fetch("expiresAt")))
+        return false unless ttl_seconds.positive?
+
+        value = JSON.generate(normalize_verification_dates(verification))
+        created = if secondary_storage.respond_to?(:set_if_absent)
+          secondary_storage.set_if_absent(key, value, ttl_seconds)
+        elsif secondary_storage.respond_to?(:setIfAbsent)
+          secondary_storage.setIfAbsent(key, value, ttl_seconds)
+        else
+          raise Error, "Secondary storage must implement atomic `set_if_absent`/`setIfAbsent`, or verification values must be database-backed"
+        end
+        return false unless created
+        true
+      end
+
+      def consume_database_verification(identifiers)
+        identifiers.each do |stored_identifier|
+          consumed = with_verification_lock(verification_key(stored_identifier)) do
+            adapter.transaction do |transaction_adapter|
+              where = [{field: "identifier", value: stored_identifier}]
+              latest = transaction_adapter.find_many(
+                model: "verification",
+                where: where,
+                sort_by: {field: "createdAt", direction: "desc"},
+                limit: 1
+              ).first
+              next nil unless latest
+              next nil if verification_delete_vetoed?(latest)
+
+              row = transaction_adapter.consume_one(
+                model: "verification",
+                where: [{field: "id", value: latest.fetch("id")}]
+              )
+              next nil unless row
+
+              transaction_adapter.delete_many(model: "verification", where: where)
+              run_verification_delete_after(row)
+              row
+            end
+          end
+          return consumed if consumed
+        end
+        nil
+      end
+
+      def invalidate_secondary_verification(identifiers, consumed)
+        identifiers.each { |stored_identifier| secondary_storage.delete(verification_key(stored_identifier)) }
+        id = consumed && (consumed["id"] || consumed[:id])
+        secondary_storage.delete(verification_id_key(id)) if id
+      end
+
+      def verification_delete_vetoed?(entity)
+        hooks.send(:before_hooks, "verification", :delete).any? { |hook| hook.call(entity, nil) == false }
+      end
+
+      def run_verification_delete_after(entity)
+        hooks.send(:after_hooks, "verification", :delete).each { |hook| hook.call(entity, nil) }
+      end
+
+      def with_verification_lock(key)
+        lock = @verification_locks_guard.synchronize { @verification_locks[key] ||= Monitor.new }
+        lock.synchronize { yield }
+      end
+
       def secondary_storage
         options.secondary_storage
       end
@@ -527,6 +704,15 @@ module BetterAuth
         normalized
       end
 
+      def store_reserved_verification(verification)
+        normalized = normalize_verification_dates(verification)
+        ttl_seconds = ttl(millis(normalized["expiresAt"]))
+        return normalized unless ttl_seconds.positive?
+
+        secondary_storage.set(verification_key(normalized["identifier"]), JSON.generate(normalized), ttl_seconds)
+        normalized
+      end
+
       def read_verification(identifier)
         normalize_verification_dates(parse_storage(secondary_storage.get(verification_key(identifier))))
       end

data/lib/better_auth/adapters/join_support.rb

@@ -58,6 +58,16 @@ module BetterAuth
           end
         end
       end
+
+      def join_limit(config)
+        value = config[:limit]
+        return 100 if value.nil?
+
+        parsed = Integer(value)
+        parsed.positive? ? parsed : 100
+      rescue ArgumentError, TypeError
+        100
+      end
     end
   end
 end

data/lib/better_auth/adapters/memory.rb

@@ -2,23 +2,52 @@
 
 require "securerandom"
 require "time"
+require "monitor"
 
 module BetterAuth
   module Adapters
     class Memory < Base
       include JoinSupport
 
+      LOCK_REGISTRY_GUARD = Mutex.new
+      LOCKS_BY_DATABASE = {}
+
+      class << self
+        def lock_for(database)
+          LOCK_REGISTRY_GUARD.synchronize do
+            LOCKS_BY_DATABASE[database.object_id] ||= Monitor.new
+          end
+        end
+      end
+
       attr_reader :db
 
       def initialize(options, db = nil)
         super(options)
         @db = db || build_db
+        @lock = self.class.lock_for(@db)
       end
 
       def create(model:, data:, force_allow_id: false)
-        model = model.to_s
-        table_for(model) << transform_input(model, data, "create", force_allow_id)
-        table_for(model).last
+        @lock.synchronize do
+          model = model.to_s
+          table_for(model) << transform_input(model, data, "create", force_allow_id)
+          table_for(model).last
+        end
+      end
+
+      def create_if_absent(model:, data:, conflict_field: "id", force_allow_id: true)
+        @lock.synchronize do
+          model = model.to_s
+          fields = Schema.auth_tables(options).fetch(model).fetch(:fields)
+          field = atomic_schema_field(fields, conflict_field)
+          input = transform_input(model, data, "create", force_allow_id)
+          raise APIError.new("BAD_REQUEST", message: "Missing conflict field #{conflict_field}") unless input.key?(field)
+          next false if table_for(model).any? { |record| record[field] == input[field] }
+
+          table_for(model) << input
+          true
+        end
       end
 
       def find_one(model:, where: [], select: nil, join: nil)
@@ -26,34 +55,42 @@ module BetterAuth
       end
 
       def find_many(model:, where: [], sort_by: nil, limit: nil, offset: nil, select: nil, join: nil)
-        model = model.to_s
-        records = table_for(model).select { |record| matches_where?(record, where || []) }.map(&:dup)
-        records = records.map { |record| apply_join(model, record, join) } if join
-        records = sort_records(model, records, sort_by) if sort_by
-        records = records.drop(offset.to_i) if offset
-        records = records.first(limit.to_i) if limit
-        records = records.map { |record| select_fields(model, record, select) } if select && !select.empty?
-        records
+        @lock.synchronize do
+          model = model.to_s
+          records = table_for(model).select { |record| matches_where?(record, where || []) }.map(&:dup)
+          records = records.map { |record| apply_join(model, record, join) } if join
+          records = sort_records(model, records, sort_by) if sort_by
+          records = records.drop(offset.to_i) if offset
+          records = records.first(limit.to_i) if limit
+          records = records.map { |record| select_fields(model, record, select, join: join) } if select && !select.empty?
+          records
+        end
       end
 
       def update(model:, where:, update:)
-        model = model.to_s
-        ensure_update_input_has_fields!(model, update)
-        records = table_for(model).select { |record| matches_where?(record, where || []) }
-        data = transform_input(model, update, "update", true)
-        ensure_update_data!(data)
-        records.each { |record| record.merge!(data) }
-        records.first
+        @lock.synchronize do
+          model = model.to_s
+          next nil if Array(where).empty?
+
+          ensure_update_input_has_fields!(model, update)
+          records = table_for(model).select { |record| matches_where?(record, where) }
+          data = transform_input(model, update, "update", true)
+          ensure_update_data!(data)
+          records.each { |record| record.merge!(data) }
+          records.first
+        end
       end
 
       def update_many(model:, where:, update:)
-        model = model.to_s
-        ensure_update_input_has_fields!(model, update)
-        records = table_for(model).select { |record| matches_where?(record, where || []) }
-        data = transform_input(model, update, "update", true)
-        ensure_update_data!(data)
-        records.each { |record| record.merge!(data) }
-        records.length
+        @lock.synchronize do
+          model = model.to_s
+          ensure_update_input_has_fields!(model, update)
+          records = table_for(model).select { |record| matches_where?(record, where || []) }
+          data = transform_input(model, update, "update", true)
+          ensure_update_data!(data)
+          records.each { |record| record.merge!(data) }
+          records.length
+        end
       end
 
       def delete(model:, where:)
@@ -62,26 +99,103 @@ module BetterAuth
       end
 
       def delete_many(model:, where:)
-        table = table_for(model)
-        matches = table.select { |record| matches_where?(record, where || []) }
-        @db[model.to_s] = table.reject { |record| matches.include?(record) }
-        matches.length
+        @lock.synchronize do
+          table = table_for(model)
+          matches = table.select { |record| matches_where?(record, where || []) }
+          @db[model.to_s] = table.reject { |record| matches.include?(record) }
+          matches.length
+        end
       end
 
       def count(model:, where: nil)
         find_many(model: model, where: where || []).length
       end
 
+      def consume_one(model:, where:)
+        @lock.synchronize do
+          table = table_for(model)
+          index = table.index { |record| matches_where?(record, where || []) }
+          index ? table.delete_at(index) : nil
+        end
+      end
+
+      def increment_one(model:, where:, increment:, set: nil, allow_server_managed: false)
+        @lock.synchronize do
+          model = model.to_s
+          increments = normalized_increments(model, increment, allow_server_managed)
+          assignments = normalized_increment_set(model, set)
+          raise APIError.new("BAD_REQUEST", message: "increment_one requires a non-empty increment or set") if increments.empty? && assignments.empty?
+
+          target = table_for(model).find { |record| matches_where?(record, where || []) }
+          next nil unless target
+
+          increments.each do |field, delta|
+            current = target[field]
+            target[field] = (current.is_a?(Numeric) ? current : 0) + delta
+          end
+          target.merge!(assignments)
+          target
+        end
+      end
+
       def transaction
-        snapshot = Marshal.load(Marshal.dump(db))
-        yield self
-      rescue
-        @db = snapshot
-        raise
+        return yield active_transaction_adapter if active_transaction_adapter
+
+        @lock.synchronize do
+          snapshot = transaction_snapshot(db)
+          begin
+            with_transaction_context(self) { yield self }
+          rescue
+            db.replace(snapshot)
+            raise
+          end
+        end
       end
 
       private
 
+      def transaction_snapshot(value, copies = {})
+        object_id = value.object_id
+        return copies.fetch(object_id) if copies.key?(object_id)
+
+        copy = case value
+        when Hash
+          value.dup.tap do |hash|
+            hash.clear
+            copies[object_id] = hash
+            if value.default_proc
+              hash.default_proc = value.default_proc
+            else
+              hash.default = transaction_snapshot(value.default, copies)
+            end
+            value.each do |key, child|
+              hash[transaction_snapshot(key, copies)] = transaction_snapshot(child, copies)
+            end
+          end
+        when Array
+          value.dup.tap do |array|
+            array.clear
+            copies[object_id] = array
+            value.each { |child| array << transaction_snapshot(child, copies) }
+          end
+        when Struct
+          value.dup.tap do |struct|
+            copies[object_id] = struct
+            value.each_pair do |member, child|
+              struct[member] = transaction_snapshot(child, copies)
+            end
+          end
+        when String, Time
+          value.dup.tap { |object| copies[object_id] = object }
+        when Proc, Method, UnboundMethod, NilClass, TrueClass, FalseClass, Symbol, Numeric
+          return value
+        else
+          raise TypeError, "Unsupported Memory transaction snapshot value: #{value.class}"
+        end
+        copy.freeze if value.frozen?
+        copy
+      end
+
       def build_db
         Schema.auth_tables(options).keys.to_h { |model| [model, []] }
       end
@@ -141,6 +255,40 @@ module BetterAuth
         raise APIError.new("BAD_REQUEST", message: "No fields to update") unless has_updatable_field
       end
 
+      def normalized_increments(model, increment, allow_server_managed)
+        raise APIError.new("BAD_REQUEST", message: "increment must be a Hash") unless increment.is_a?(Hash)
+
+        fields = Schema.auth_tables(options).fetch(model).fetch(:fields)
+        increment.each_with_object({}) do |(field, delta), result|
+          logical_field = atomic_schema_field(fields, field)
+          attributes = fields[logical_field]
+          valid_field = attributes && logical_field != "id" && attributes[:type] == "number"
+          valid_field = false if attributes && attributes[:input] == false && allow_server_managed != true
+          unless valid_field
+            raise APIError.new("BAD_REQUEST", message: "Invalid increment field #{field}; expected a mutable numeric field")
+          end
+          if !delta.is_a?(Numeric) || (delta.respond_to?(:finite?) && !delta.finite?)
+            raise APIError.new("BAD_REQUEST", message: "Increment delta for #{field} must be numeric")
+          end
+
+          result[logical_field] = delta
+        end
+      end
+
+      def normalized_increment_set(model, set)
+        return {} if set.nil? || set.empty?
+
+        ensure_update_input_has_fields!(model, set)
+        transform_input(model, set, "update", true)
+      end
+
+      def atomic_schema_field(fields, field)
+        candidate = Schema.storage_key(field)
+        return candidate if fields.key?(candidate)
+
+        fields.find { |logical, attributes| Schema.storage_key(attributes[:field_name] || logical) == candidate }&.first
+      end
+
       def generated_id(model)
         generator = options.advanced.dig(:database, :generate_id)
         return generator.call.to_s if generator.respond_to?(:call)
@@ -166,16 +314,9 @@ module BetterAuth
         clauses = Array(where)
         return true if clauses.empty?
 
-        result = evaluate_clause(record, clauses.first)
-        clauses.each do |clause|
-          clause_result = evaluate_clause(record, clause)
-          if fetch_key(clause, :connector).to_s.upcase == "OR"
-            result ||= clause_result
-          else
-            result &&= clause_result
-          end
-        end
-        result
+        and_clauses, or_clauses = grouped_where_clauses(clauses)
+        and_clauses.all? { |clause| evaluate_clause(record, clause) } &&
+          (or_clauses.empty? || or_clauses.any? { |clause| evaluate_clause(record, clause) })
       end
 
       def evaluate_clause(record, clause)
@@ -301,9 +442,13 @@ module BetterAuth
         value.nil? ? "" : value
       end
 
-      def select_fields(_model, record, select)
+      def select_fields(model, record, select, join: nil)
         fields = Array(select).map { |field| Schema.storage_key(field) }
-        record.slice(*fields)
+        selected = record.slice(*fields)
+        normalized_join(model, join).each_key do |join_model|
+          selected[join_model] = record[join_model] if record.key?(join_model)
+        end
+        selected
       end
 
       def apply_join(model, record, join)
@@ -326,16 +471,6 @@ module BetterAuth
         config[:relation] == "one-to-one" || config[:unique] == true
       end
 
-      def join_limit(config)
-        value = config[:limit]
-        return 100 if value.nil?
-
-        parsed = Integer(value)
-        parsed.positive? ? parsed : 100
-      rescue ArgumentError, TypeError
-        100
-      end
-
       def inferred_join_config(model, join_model)
         foreign_keys = schema_for(join_model).fetch(:fields).select do |_field, attributes|
           reference_model_matches?(attributes, model)

data/lib/better_auth/adapters/mssql.rb

@@ -17,16 +17,20 @@ module BetterAuth
       end
 
       def transaction
+        return yield active_transaction_adapter if active_transaction_adapter
         return super unless connection.respond_to?(:transaction)
 
-        connection.transaction { yield self }
+        connection.transaction { with_transaction_context(self) { yield self } }
       end
 
       private
 
-      def execute(sql, params)
+      def execute(sql, params, affected_rows_result: false)
         if connection.respond_to?(:fetch)
-          connection.fetch(sql, *params).all.map { |row| stringify_row(row) }
+          dataset = connection.fetch(sql, *params)
+          return dataset.delete if affected_rows_result
+
+          dataset.all.map { |row| stringify_row(row) }
         else
           super
         end