better_auth 0.10.0 → 0.11.0

data/lib/better_auth/adapters/sql.rb

@@ -36,6 +36,34 @@ module BetterAuth
         lookup ? find_one(model: model, where: [lookup]) : input
       end
 
+      def create_if_absent(model:, data:, conflict_field: "id", force_allow_id: true)
+        model = model.to_s
+        field = atomic_schema_field(schema_for(model).fetch(:fields), conflict_field)
+        input = transform_input(model, data, "create", force_allow_id)
+        raise APIError.new("BAD_REQUEST", message: "Missing conflict field #{conflict_field}") unless input.key?(field)
+
+        columns = input.keys.map { |key| storage_field(model, key) }
+        params = input.values
+        values = params.each_index.map { |index| placeholder(index + 1) }.join(", ")
+        table = quote(table_for(model))
+        conflict_column = quote(storage_field(model, field))
+        quoted_columns = columns.map { |column| quote(column) }.join(", ")
+
+        case dialect
+        when :postgres, :sqlite
+          sql = "INSERT INTO #{table} (#{quoted_columns}) VALUES (#{values}) ON CONFLICT (#{conflict_column}) DO NOTHING RETURNING #{conflict_column}"
+          !execute(sql, params).empty?
+        when :mysql
+          transaction { create_if_absent_mysql(model, field, input, table, quoted_columns, values, params) }
+        when :mssql
+          sql = "INSERT INTO #{table} (#{quoted_columns}) OUTPUT inserted.#{conflict_column} " \
+            "SELECT #{values} WHERE NOT EXISTS (SELECT 1 FROM #{table} WITH (UPDLOCK, HOLDLOCK) WHERE #{conflict_column} = #{placeholder(params.length + 1)})"
+          !execute(sql, params + [input.fetch(field)]).empty?
+        else
+          raise NotImplementedError, "create_if_absent is unsupported for #{dialect}"
+        end
+      end
+
       def find_one(model:, where: [], select: nil, join: nil)
         if collection_join?(model.to_s, join)
           find_many(model: model, where: where, select: select, join: join).first
@@ -64,6 +92,8 @@ module BetterAuth
 
       def update(model:, where:, update:)
         model = model.to_s
+        return nil if Array(where).empty?
+
         ensure_update_input_has_fields!(model, update)
         if dialect == :postgres
           records = update_many(model: model, where: where, update: update, returning: true)
@@ -73,7 +103,9 @@ module BetterAuth
         existing = find_one(model: model, where: where)
         return nil unless existing
 
-        update_many(model: model, where: where, update: update)
+        updated_count = update_many(model: model, where: where, update: update)
+        return nil unless updated_count.to_i.positive?
+
         lookup = record_lookup(model, existing)
         lookup ? find_one(model: model, where: [lookup]) : find_one(model: model, where: where)
       end
@@ -106,13 +138,14 @@ module BetterAuth
         nil
       end
 
-      def delete_many(model:, where:)
+      def delete_many(model:, where:, limit: nil)
         model = model.to_s
         params = []
         where_sql = build_where(model, where || [], params)
         sql = +"DELETE FROM "
         sql << quote(table_for(model))
         sql << " WHERE #{where_sql}" unless where_sql.empty?
+        sql << " LIMIT #{Integer(limit)}" if limit && dialect == :mysql
         result = execute(sql, params, affected_rows_result: true)
         affected_rows(result)
       end
@@ -128,10 +161,37 @@ module BetterAuth
         (row["count"] || row[:count] || 0).to_i
       end
 
+      def consume_one(model:, where:)
+        model = model.to_s
+        case dialect
+        when :postgres, :sqlite
+          consume_one_with_returning(model, where)
+        when :mssql
+          consume_one_with_output(model, where)
+        else
+          transaction { consume_one_with_lock(model, where) }
+        end
+      end
+
+      def increment_one(model:, where:, increment:, set: nil, allow_server_managed: false)
+        model = model.to_s
+        increments, assignments = normalize_atomic_update(model, increment, set, allow_server_managed)
+        case dialect
+        when :postgres, :sqlite
+          increment_one_with_returning(model, where, increments, assignments)
+        when :mssql
+          increment_one_with_output(model, where, increments, assignments)
+        else
+          transaction { increment_one_with_lock(model, where, increments, assignments) }
+        end
+      end
+
       def transaction
+        return yield active_transaction_adapter if active_transaction_adapter
+
         @connection_lock.synchronize do
           execute("BEGIN", [])
-          result = yield self
+          result = with_transaction_context(self) { yield self }
           execute("COMMIT", [])
           result
         rescue
@@ -142,6 +202,176 @@ module BetterAuth
 
       private
 
+      def consume_one_with_returning(model, where)
+        params = []
+        where_sql = build_where(model, where || [], params)
+        lookup = quote(storage_field(model, atomic_lookup_field(model)))
+        lock = (dialect == :postgres) ? " FOR UPDATE" : ""
+        table = quote(table_for(model))
+        sql = "DELETE FROM #{table} WHERE #{lookup} IN (SELECT #{lookup} FROM #{table}"
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        sql << " LIMIT 1#{lock}) RETURNING *"
+        normalize_record(model, execute(sql, params).first)
+      end
+
+      def consume_one_with_output(model, where)
+        params = []
+        where_sql = build_where(model, where || [], params)
+        sql = "DELETE TOP (1) FROM #{quote(table_for(model))} OUTPUT deleted.*"
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        normalize_record(model, execute(sql, params).first)
+      end
+
+      def consume_one_with_lock(model, where)
+        target = select_atomic_target(model, where)
+        return nil unless target
+
+        lookup = record_lookup(model, target)
+        raise Error, "#{self.class} cannot atomically identify a #{model} row" unless lookup
+
+        deleted = delete_many(model: model, where: [lookup], limit: 1)
+        ensure_numeric_affected_rows!(deleted, "delete_many")
+        deleted.positive? ? target : nil
+      end
+
+      def increment_one_with_returning(model, where, increments, assignments)
+        params = []
+        assignment_sql = atomic_assignments_sql(model, increments, assignments, params)
+        where_sql = build_where(model, where || [], params)
+        lookup = quote(storage_field(model, atomic_lookup_field(model)))
+        lock = (dialect == :postgres) ? " FOR UPDATE" : ""
+        table = quote(table_for(model))
+        sql = "UPDATE #{table} SET #{assignment_sql} WHERE #{lookup} IN (SELECT #{lookup} FROM #{table}"
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        sql << " LIMIT 1#{lock}) RETURNING *"
+        normalize_record(model, execute(sql, params).first)
+      end
+
+      def increment_one_with_output(model, where, increments, assignments)
+        params = []
+        assignment_sql = atomic_assignments_sql(model, increments, assignments, params)
+        where_sql = build_where(model, where || [], params)
+        sql = "UPDATE TOP (1) #{quote(table_for(model))} SET #{assignment_sql} OUTPUT inserted.*"
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        normalize_record(model, execute(sql, params).first)
+      end
+
+      def increment_one_with_lock(model, where, increments, assignments)
+        target = select_atomic_target(model, where)
+        return nil unless target
+
+        lookup = record_lookup(model, target)
+        raise Error, "#{self.class} cannot atomically identify a #{model} row" unless lookup
+
+        params = []
+        assignment_sql = atomic_assignments_sql(model, increments, assignments, params)
+        guarded_where = Array(where) + [lookup.merge(connector: "AND")]
+        where_sql = build_where(model, guarded_where, params)
+        sql = "UPDATE #{quote(table_for(model))} SET #{assignment_sql} WHERE #{where_sql} LIMIT 1"
+        affected = affected_rows(execute(sql, params, affected_rows_result: true))
+        ensure_numeric_affected_rows!(affected, "update")
+        find_one(model: model, where: [lookup])
+      end
+
+      def select_atomic_target(model, where)
+        params = []
+        where_sql = build_where(model, where || [], params)
+        sql = "SELECT #{select_sql(model, nil, nil)} FROM #{quote(table_for(model))}"
+        sql << " WHERE #{where_sql}" unless where_sql.empty?
+        sql << " LIMIT 1 FOR UPDATE"
+        normalize_record(model, execute(sql, params).first)
+      end
+
+      def normalize_atomic_update(model, increment, set, allow_server_managed)
+        raise APIError.new("BAD_REQUEST", message: "increment must be a Hash") unless increment.is_a?(Hash)
+
+        fields = schema_for(model).fetch(:fields)
+        increments = increment.each_with_object({}) do |(field, delta), result|
+          logical_field = atomic_schema_field(fields, field)
+          attributes = fields[logical_field]
+          valid_field = attributes && logical_field != "id" && attributes[:type] == "number"
+          valid_field = false if attributes && attributes[:input] == false && allow_server_managed != true
+          unless valid_field
+            raise APIError.new("BAD_REQUEST", message: "Invalid increment field #{field}; expected a mutable numeric field")
+          end
+          if !delta.is_a?(Numeric) || (delta.respond_to?(:finite?) && !delta.finite?)
+            raise APIError.new("BAD_REQUEST", message: "Increment delta for #{field} must be numeric")
+          end
+
+          result[logical_field] = delta
+        end
+        assignments = if set.nil? || set.empty?
+          {}
+        else
+          ensure_update_input_has_fields!(model, set)
+          transform_input(model, set, "update", true)
+        end
+        increments.reject! { |field, _delta| assignments.key?(field) }
+        if increments.empty? && assignments.empty?
+          raise APIError.new("BAD_REQUEST", message: "increment_one requires a non-empty increment or set")
+        end
+
+        [increments, assignments]
+      end
+
+      def atomic_assignments_sql(model, increments, assignments, params)
+        increment_sql = increments.map do |field, delta|
+          column = quote(storage_field(model, field))
+          params << delta
+          "#{column} = COALESCE(#{column}, 0) + #{placeholder(params.length)}"
+        end
+        set_sql = assignments.map do |field, value|
+          params << value
+          "#{quote(storage_field(model, field))} = #{placeholder(params.length)}"
+        end
+        (increment_sql + set_sql).join(", ")
+      end
+
+      def atomic_schema_field(fields, field)
+        candidate = storage_key(field)
+        return candidate if fields.key?(candidate)
+
+        fields.find { |logical, attributes| storage_key(attributes[:field_name] || logical) == candidate }&.first
+      end
+
+      def create_if_absent_mysql(model, field, input, table, columns, values, params)
+        savepoint = "better_auth_create_if_absent"
+        execute("SAVEPOINT #{savepoint}", [])
+        begin
+          execute("INSERT INTO #{table} (#{columns}) VALUES (#{values})", params)
+          execute("RELEASE SAVEPOINT #{savepoint}", [])
+          true
+        rescue => error
+          execute("ROLLBACK TO SAVEPOINT #{savepoint}", [])
+          execute("RELEASE SAVEPOINT #{savepoint}", [])
+          existing = find_one(model: model, where: [{field: field, value: input.fetch(field)}])
+          return false if mysql_duplicate_error?(error) && existing
+
+          raise error
+        end
+      end
+
+      def mysql_duplicate_error?(error)
+        (error.respond_to?(:error_number) && error.error_number == 1062) ||
+          (error.respond_to?(:errno) && error.errno == 1062)
+      end
+
+      def atomic_lookup_field(model)
+        fields = schema_for(model).fetch(:fields)
+        return "id" if fields.key?("id")
+
+        unique = fields.find { |_field, attributes| attributes[:unique] }
+        return unique.first if unique
+
+        raise Error, "#{self.class} cannot atomically identify a #{model} row without an id or unique field"
+      end
+
+      def ensure_numeric_affected_rows!(value, operation)
+        return value if value.is_a?(Numeric)
+
+        raise Error, "#{self.class} returned a non-numeric affected-row result from #{operation}"
+      end
+
       def transform_input(model, data, action, force_allow_id)
         fields = Schema.auth_tables(options).fetch(model).fetch(:fields)
         input = stringify_keys(data)
@@ -266,46 +496,51 @@ module BetterAuth
       end
 
       def build_where(model, where, params)
-        Array(where).each_with_index.map do |clause, index|
-          field = storage_key(fetch_key(clause, :field))
-          column = "#{quote(table_for(model))}.#{quote(storage_field(model, field))}"
-          operator = (fetch_key(clause, :operator) || "eq").to_s
-          value = fetch_key(clause, :value)
-          attributes = schema_for(model).fetch(:fields).fetch(field)
-          insensitive = insensitive_string_predicate?(clause, attributes)
-          predicate_column = insensitive ? "LOWER(#{column})" : column
-
-          expression = if value.nil? && %w[eq ne].include?(operator)
-            null_operator = (operator == "ne") ? "IS NOT NULL" : "IS NULL"
-            "#{column} #{null_operator}"
-          else
-            case operator
-            when "in", "not_in"
-              values = Array(value).map { |entry| insensitive ? entry.to_s.downcase : coerce_where_value(entry, attributes) }
-              placeholders = values.map do |entry|
-                params << entry
-                placeholder(params.length)
-              end.join(", ")
-              sql_operator = (operator == "not_in") ? "NOT IN" : "IN"
-              "#{predicate_column} #{sql_operator} (#{placeholders})"
-            when "contains", "starts_with", "ends_with"
-              escaped = escape_like(insensitive ? value.to_s.downcase : value)
-              pattern = case operator
-              when "starts_with" then "#{escaped}%"
-              when "ends_with" then "%#{escaped}"
-              else "%#{escaped}%"
-              end
-              params << pattern
-              "#{predicate_column} LIKE #{placeholder(params.length)} ESCAPE #{escape_literal}"
-            else
-              params << (insensitive ? value.to_s.downcase : coerce_where_value(value, attributes))
-              "#{predicate_column} #{sql_operator(operator)} #{placeholder(params.length)}"
+        and_clauses, or_clauses = grouped_where_clauses(where)
+        and_sql = and_clauses.map { |clause| build_where_clause(model, clause, params) }
+        or_sql = or_clauses.map { |clause| build_where_clause(model, clause, params) }
+        return and_sql.join(" AND ") if or_sql.empty?
+        return or_sql.join(" OR ") if and_sql.empty?
+
+        "(#{and_sql.join(" AND ")}) AND (#{or_sql.join(" OR ")})"
+      end
+
+      def build_where_clause(model, clause, params)
+        field = storage_key(fetch_key(clause, :field))
+        column = "#{quote(table_for(model))}.#{quote(storage_field(model, field))}"
+        operator = (fetch_key(clause, :operator) || "eq").to_s
+        value = fetch_key(clause, :value)
+        attributes = schema_for(model).fetch(:fields).fetch(field)
+        insensitive = insensitive_string_predicate?(clause, attributes)
+        predicate_column = insensitive ? "LOWER(#{column})" : column
+
+        if value.nil? && %w[eq ne].include?(operator)
+          null_operator = (operator == "ne") ? "IS NOT NULL" : "IS NULL"
+          "#{column} #{null_operator}"
+        else
+          case operator
+          when "in", "not_in"
+            values = Array(value).map { |entry| insensitive ? entry.to_s.downcase : coerce_where_value(entry, attributes) }
+            placeholders = values.map do |entry|
+              params << entry
+              placeholder(params.length)
+            end.join(", ")
+            sql_operator = (operator == "not_in") ? "NOT IN" : "IN"
+            "#{predicate_column} #{sql_operator} (#{placeholders})"
+          when "contains", "starts_with", "ends_with"
+            escaped = escape_like(insensitive ? value.to_s.downcase : value)
+            pattern = case operator
+            when "starts_with" then "#{escaped}%"
+            when "ends_with" then "%#{escaped}"
+            else "%#{escaped}%"
             end
+            params << pattern
+            "#{predicate_column} LIKE #{placeholder(params.length)} ESCAPE #{escape_literal}"
+          else
+            params << (insensitive ? value.to_s.downcase : coerce_where_value(value, attributes))
+            "#{predicate_column} #{sql_operator(operator)} #{placeholder(params.length)}"
           end
-
-          connector = (index.positive? && fetch_key(clause, :connector).to_s.upcase == "OR") ? "OR" : "AND"
-          index.zero? ? expression : "#{connector} #{expression}"
-        end.join(" ")
+        end
       end
 
       def order_sql(model, sort_by)
@@ -387,13 +622,18 @@ module BetterAuth
       end
 
       def affected_rows(result)
-        return result.cmd_tuples if result.respond_to?(:cmd_tuples)
-        return result.affected_rows if result.respond_to?(:affected_rows)
-        return result.to_i if result.respond_to?(:to_i)
-        return connection.affected_rows if connection.respond_to?(:affected_rows)
-        return connection.changes if connection.respond_to?(:changes)
-
-        0
+        value = if result.respond_to?(:cmd_tuples)
+          result.cmd_tuples
+        elsif result.respond_to?(:affected_rows)
+          result.affected_rows
+        elsif result.is_a?(Numeric)
+          result
+        elsif connection.respond_to?(:affected_rows)
+          connection.affected_rows
+        elsif connection.respond_to?(:changes)
+          connection.changes
+        end
+        ensure_numeric_affected_rows!(value, "SQL mutation")
       end
 
       def normalize_record(model, row, join: nil)
@@ -440,6 +680,8 @@ module BetterAuth
             if config[:relation] == "one-to-one" || config[:unique] == true
               grouped[key][join_model] = joined
             else
+              next if grouped[key][join_model].length >= join_limit(config)
+
               grouped[key][join_model] << joined
             end
           end
@@ -500,7 +742,10 @@ module BetterAuth
       def coerce_value(value, attributes)
         return value if value.nil?
         return value ? 1 : 0 if dialect == :sqlite && attributes[:type] == "boolean"
-        return value.iso8601(6) if dialect == :sqlite && attributes[:type] == "date" && value.respond_to?(:iso8601)
+        if dialect == :sqlite && attributes[:type] == "date"
+          value = Time.parse(value) if value.is_a?(String)
+          return value.iso8601(6) if value.respond_to?(:iso8601)
+        end
         return Time.parse(value) if attributes[:type] == "date" && value.is_a?(String)
         return JSON.generate(value) if json_like?(attributes) && !value.is_a?(String)
         return value.encode(Encoding::UTF_8) if attributes[:type] == "string" && value.is_a?(String) && value.encoding == Encoding::ASCII_8BIT

data/lib/better_auth/api.rb

@@ -70,15 +70,7 @@ module BetterAuth
     def prepare_context_for_call!(request, headers)
       return unless context.respond_to?(:prepare_for_api_call!)
 
-      source = direct_call_source(request, headers)
-      if context.options.dynamic_base_url? && source.nil? && !dynamic_base_url_fallback?
-        raise APIError.new(
-          "INTERNAL_SERVER_ERROR",
-          message: "Dynamic baseURL could not be resolved for this direct auth.api call. Pass `headers: request.headers` (or `request`) to the call, or add `fallback` to your baseURL config."
-        )
-      end
-
-      context.prepare_for_api_call!(source)
+      context.prepare_for_api_call!(direct_call_source(request, headers))
     end
 
     def direct_call_source(request, headers)
@@ -88,13 +80,6 @@ module BetterAuth
       nil
     end
 
-    def dynamic_base_url_fallback?
-      config = context.options.base_url_config
-      return false unless config.is_a?(Hash)
-
-      !!(config[:fallback] || config["fallback"])
-    end
-
     def run_endpoint_with_hooks(endpoint, endpoint_context)
       before = run_before_hooks(endpoint_context)
       return normalize_short_circuit(before, endpoint_context) if before
@@ -114,11 +99,7 @@ module BetterAuth
       endpoint_context.returned = result.response
       endpoint_context.response_headers = result.headers.dup
 
-      after_result = run_after_hooks(endpoint_context)
-      result.response = after_result.response
-      result.headers = after_result.headers
-      result.status = after_result.status if after_result.status
-      result
+      run_after_hooks(endpoint_context)
     rescue APIError => error
       Endpoint::Result.new(response: error, status: error.status_code, headers: error.headers)
     end
@@ -163,9 +144,7 @@ module BetterAuth
         next unless hook_result
 
         normalized = Endpoint::Result.from_value(hook_result, endpoint_context)
-        result.response = normalized.response
-        result.status = normalized.status
-        result.headers = normalized.headers
+        result = normalized
         endpoint_context.returned = result.response
         endpoint_context.response_headers = result.headers
       end

data/lib/better_auth/configuration.rb

@@ -31,7 +31,7 @@ module BetterAuth
     }.freeze
 
     attr_reader :app_name,
-      :base_url_config,
+      :base_url,
       :base_path,
       :context_base_url,
       :secret,
@@ -39,6 +39,7 @@ module BetterAuth
       :database,
       :plugins,
       :trusted_origins,
+      :serving_origins,
       :rate_limit,
       :session,
       :account,
@@ -48,6 +49,7 @@ module BetterAuth
       :email_and_password,
       :password_hasher,
       :email_verification,
+      :configured_social_provider_ids,
       :social_providers,
       :experimental,
       :secondary_storage,
@@ -60,6 +62,7 @@ module BetterAuth
       :logger
 
     def initialize(options = {})
+      @configured_social_provider_ids = extract_configured_social_provider_ids(options)
       options = symbolize_keys(options)
       @explicit_options = deep_dup(options)
 
@@ -88,8 +91,8 @@ module BetterAuth
         @secret = legacy_secret || (test_environment? ? DEFAULT_SECRET : nil)
         @secret_config = @secret
       end
-      @base_url_config = options[:base_url]
       @base_url, @context_base_url = normalize_base_url(options[:base_url])
+      @serving_origins = normalize_serving_origins(options[:serving_origins])
       @session = normalize_session(options[:session])
       @account = normalize_account(options[:account])
       @user = symbolize_keys(options[:user] || {})
@@ -110,26 +113,17 @@ module BetterAuth
       end
     end
 
-    def base_url
-      Thread.current[base_url_runtime_key] || @base_url
-    end
-
-    def set_runtime_base_url(value)
-      Thread.current[base_url_runtime_key] = value
-    end
-
-    def clear_runtime_base_url!
-      Thread.current[base_url_runtime_key] = nil
+    def explicit_trusted_origins
+      configured = @explicit_options[:trusted_origins]
+      origins = configured.respond_to?(:call) ? [] : Array(configured).compact
+      origins.concat(env_trusted_origins)
+      origins.map(&:to_s).reject(&:empty?).uniq
     end
 
     def production?
       production_environment?
     end
 
-    def dynamic_base_url?
-      URLHelpers.dynamic_config?(base_url_config)
-    end
-
     def to_h
       {
         app_name: app_name,
@@ -140,6 +134,7 @@ module BetterAuth
         database: database,
         plugins: plugins,
         trusted_origins: trusted_origins,
+        serving_origins: serving_origins,
         rate_limit: rate_limit,
         session: session,
         account: account,
@@ -164,7 +159,7 @@ module BetterAuth
       normalized = symbolize_keys(defaults || {})
       normalized.each do |key, value|
         next unless respond_to?(key)
-        next if key == :database_hooks
+        next if key == :database_hooks || key == :configured_social_provider_ids
 
         if key == :trusted_origins
           merge_trusted_origins_default(value)
@@ -231,15 +226,12 @@ module BetterAuth
 
     def normalize_base_url(value)
       configured = value || env_base_url
-      return ["", ""] unless configured && !configured.empty?
-
-      if URLHelpers.dynamic_config?(configured)
-        validate_dynamic_base_url!(configured)
-        resolved = URLHelpers.resolve_base_url(configured, base_path)
-        return ["", ""] unless resolved
+      if configured.nil? || configured.to_s.empty?
+        raise Error, "base_url is required. Pass a canonical URL to BetterAuth.auth(base_url: ...) or set BETTER_AUTH_URL."
+      end
 
-        uri = URI.parse(resolved)
-        return [self.class.origin_for(uri), resolved.sub(%r{/+\z}, "")]
+      if configured.is_a?(Hash)
+        raise Error, "Dynamic base_url hashes are no longer supported. Configure a canonical base_url and list request-facing origins in serving_origins."
       end
 
       with_path = append_base_path(configured.to_s)
@@ -250,11 +242,6 @@ module BetterAuth
       raise Error, "Invalid base URL: #{configured}. Please provide a valid base URL."
     end
 
-    def validate_dynamic_base_url!(value)
-      allowed_hosts = value[:allowed_hosts] || value["allowed_hosts"] || value[:allowedHosts] || value["allowedHosts"]
-      raise Error, "baseURL.allowedHosts cannot be empty" if allowed_hosts.respond_to?(:empty?) && allowed_hosts.empty?
-    end
-
     def normalize_base_path(value)
       return "" if value.nil? || value == "" || value == "/"
 
@@ -368,7 +355,11 @@ module BetterAuth
     end
 
     def normalize_plugins(value)
-      Array(value).compact.reject { |plugin| plugin == false }.map { |plugin| Plugin.coerce(plugin) }
+      Array(value).compact.reject { |plugin| plugin == false }.map do |plugin|
+        coerced = Plugin.coerce(plugin)
+        Plugins.ensure_plugin_loaded_for!(coerced)
+        coerced
+      end
     end
 
     def normalize_social_providers(value)
@@ -377,24 +368,32 @@ module BetterAuth
       end
     end
 
+    def extract_configured_social_provider_ids(options)
+      return [].freeze unless options.is_a?(Hash)
+
+      options.each_with_object([]) do |(key, providers), ids|
+        next unless normalize_key(key) == :social_providers && providers.is_a?(Hash)
+
+        ids.concat(providers.keys.map { |provider_id| provider_id.to_s.dup.freeze })
+      end.uniq.freeze
+    end
+
     def normalize_trusted_origins(value)
-      origins = []
-      origins << base_url unless base_url.nil? || base_url.empty?
-      origins.concat(dynamic_base_url_trusted_origins)
+      origins = serving_origins.dup
       origins.concat(Array(value).compact) unless value.respond_to?(:call)
       origins.concat(env_trusted_origins)
       origins.map(&:to_s).reject(&:empty?).uniq
     end
 
-    def dynamic_base_url_trusted_origins
-      return [] unless URLHelpers.dynamic_config?(base_url_config)
+    def normalize_serving_origins(value)
+      ([base_url] + Array(value).compact).map do |origin|
+        normalized = origin.to_s.sub(%r{/+\z}, "")
+        unless normalized.match?(%r{\Ahttps?://[^/?#@]+\z}i)
+          raise Error, "Invalid serving origin: #{origin}. serving_origins entries must be full http(s) origins without a path."
+        end
 
-      protocol = base_url_config[:protocol] || base_url_config["protocol"] || "https"
-      allowed_hosts = base_url_config[:allowed_hosts] || base_url_config["allowed_hosts"] || base_url_config[:allowedHosts] || base_url_config["allowedHosts"] || []
-      Array(allowed_hosts).map do |host|
-        host = host.to_s
-        host.match?(%r{\Ahttps?://}i) ? host : "#{protocol}://#{host}"
-      end
+        normalized
+      end.uniq
     end
 
     def merge_trusted_origins_default(value)
@@ -479,10 +478,6 @@ module BetterAuth
       end
     end
 
-    def base_url_runtime_key
-      :"better_auth_configuration_base_url_#{object_id}"
-    end
-
     def test_environment?
       ENV["RACK_ENV"] == "test" || ENV["RAILS_ENV"] == "test" || ENV["APP_ENV"] == "test"
     end