better_auth 0.10.0 → 0.11.0

data/lib/better_auth/context.rb

@@ -18,7 +18,8 @@ module BetterAuth
 
     def initialize(configuration)
       @app_name = configuration.app_name
-      @base_url = configuration.context_base_url
+      @canonical_base_url = configuration.context_base_url
+      @base_url = @canonical_base_url
       @version = BetterAuth::VERSION
       @options = configuration
       @social_providers = configuration.social_providers
@@ -30,6 +31,7 @@ module BetterAuth
       @session_config = configuration.session
       @rate_limit_config = configuration.rate_limit
       @trusted_origins = configuration.trusted_origins
+      @explicit_trusted_origins = configuration.explicit_trusted_origins
       @secret = configuration.secret
       @secret_config = configuration.secret_config
       @current_session = nil
@@ -46,10 +48,20 @@ module BetterAuth
       runtime_fetch(:base_url, @base_url)
     end
 
+    def token_link_base_url
+      base_url
+    end
+
+    attr_reader :canonical_base_url
+
     def trusted_origins
       runtime_fetch(:trusted_origins, @trusted_origins)
     end
 
+    def explicit_trusted_origins
+      runtime_fetch(:explicit_trusted_origins, @explicit_trusted_origins)
+    end
+
     def auth_cookies
       runtime_fetch(:auth_cookies, @auth_cookies)
     end
@@ -131,6 +143,7 @@ module BetterAuth
       @session_config = options.session
       @rate_limit_config = options.rate_limit
       @trusted_origins = options.trusted_origins
+      @explicit_trusted_origins = options.explicit_trusted_origins
       @secret = options.secret
       @secret_config = options.secret_config
     end
@@ -150,12 +163,7 @@ module BetterAuth
       runtime = request_runtime
       runtime[:current_session] = nil
       runtime[:new_session] = nil
-      if options.dynamic_base_url?
-        runtime[:base_url] = resolved_dynamic_base_url(request)
-        refresh_cookies!
-      elsif options.base_url.to_s.empty?
-        runtime[:base_url] = inferred_base_url(request)
-      end
+      runtime[:base_url] = serving_base_url(request)
       runtime[:trusted_origins] = current_trusted_origins(request)
     end
 
@@ -163,61 +171,30 @@ module BetterAuth
       runtime = request_runtime
       runtime[:current_session] = nil
       runtime[:new_session] = nil
-      if options.dynamic_base_url?
-        runtime[:base_url] = resolved_dynamic_base_url(source)
-        refresh_cookies!
-      end
+      runtime[:base_url] = serving_base_url(source)
       runtime[:trusted_origins] = current_trusted_origins(request_for_callbacks(source))
     end
 
     def reset_runtime!
       Thread.current[runtime_key] = nil if request_runtime?
-      options.clear_runtime_base_url! if options.respond_to?(:clear_runtime_base_url!)
       @current_session = nil
       @new_session = nil
     end
 
     def clear_runtime!
       Thread.current[runtime_key] = nil
-      options.clear_runtime_base_url! if options.respond_to?(:clear_runtime_base_url!)
-    end
-
-    def refresh_cookies!
-      cookies = Cookies.get_cookies(options)
-      if request_runtime?
-        runtime_store(:auth_cookies, cookies)
-        runtime_store(:cookies, cookies)
-      else
-        @auth_cookies = cookies
-        @cookies = cookies
-      end
     end
 
     private
 
-    def inferred_base_url(request)
-      origin = inferred_origin(request)
-      path = options.base_path
-      path.empty? ? origin : "#{origin}#{path}"
-    end
-
-    def resolved_dynamic_base_url(request)
-      resolved = URLHelpers.resolve_base_url(
-        options.base_url_config,
-        options.base_path,
-        request,
-        load_env: true,
-        trusted_proxy_headers: dynamic_trusted_proxy_headers?
-      )
-      origin = Configuration.origin_for(URI.parse(resolved))
-      options.set_runtime_base_url(origin) if options.respond_to?(:set_runtime_base_url)
-      resolved
-    end
-
-    def dynamic_trusted_proxy_headers?
-      return true unless options.advanced.key?(:trusted_proxy_headers)
+    def serving_base_url(source)
+      candidate = inferred_origin(source)
+      return canonical_base_url unless candidate
+      return canonical_base_url if candidate == options.base_url
+      return canonical_base_url unless options.serving_origins.any? { |pattern| Configuration.matches_origin_pattern?(candidate, pattern) }
 
-      !!options.advanced[:trusted_proxy_headers]
+      path = options.base_path
+      path.empty? ? candidate : "#{candidate}#{path}"
     end
 
     def request_for_callbacks(source)
@@ -230,6 +207,7 @@ module BetterAuth
       Thread.current[runtime_key] ||= {
         base_url: @base_url,
         trusted_origins: @trusted_origins,
+        explicit_trusted_origins: @explicit_trusted_origins,
         auth_cookies: @auth_cookies,
         cookies: @cookies,
         current_session: nil,
@@ -256,26 +234,25 @@ module BetterAuth
       :"better_auth_context_runtime_#{object_id}"
     end
 
-    def inferred_origin(request)
-      forwarded_host = request.get_header("HTTP_X_FORWARDED_HOST")
-      forwarded_proto = request.get_header("HTTP_X_FORWARDED_PROTO")
-      if options.advanced[:trusted_proxy_headers] && valid_forwarded?(forwarded_host, forwarded_proto)
+    def inferred_origin(source)
+      return nil unless source
+
+      trusted_proxy_headers = options.advanced[:trusted_proxy_headers] == true
+      forwarded_host = URLHelpers.header_value(URLHelpers.headers_from_source(source), "x-forwarded-host")
+      if trusted_proxy_headers && forwarded_host
+        forwarded_proto = URLHelpers.header_value(URLHelpers.headers_from_source(source), "x-forwarded-proto")
+        return nil unless valid_proxy_host?(forwarded_host.to_s) && valid_proxy_proto?(forwarded_proto.to_s)
+
         return "#{forwarded_proto}://#{forwarded_host}"
       end
 
-      scheme = request.get_header("rack.url_scheme") || request.scheme
-      scheme = "https" unless valid_proxy_proto?(scheme.to_s)
-      host_header = request.get_header("HTTP_HOST")
-      return "#{scheme}://#{host_header}" if host_header && valid_proxy_host?(host_header.to_s)
+      host = URLHelpers.host_from_source(source, trusted_proxy_headers: false)
+      return nil unless host && valid_proxy_host?(host)
 
-      host = request.get_header("SERVER_NAME") || request.host
-      port = (request.get_header("SERVER_PORT") || request.port).to_i
-      default_port = (scheme == "http" && port == 80) || (scheme == "https" && port == 443)
-      default_port ? "#{scheme}://#{host}" : "#{scheme}://#{host}:#{port}"
-    end
+      protocol = URLHelpers.protocol_from_source(source, trusted_proxy_headers: false)
+      return nil unless valid_proxy_proto?(protocol)
 
-    def valid_forwarded?(host, proto)
-      valid_proxy_proto?(proto.to_s) && valid_proxy_host?(host.to_s)
+      "#{protocol}://#{host}"
     end
 
     def valid_proxy_proto?(proto)
@@ -315,16 +292,15 @@ module BetterAuth
     end
 
     def current_trusted_origins(request)
-      origins = []
-      origins << Configuration.origin_for(URI.parse(base_url)) unless base_url.to_s.empty?
-      origins.concat(options.trusted_origins)
+      origins = options.trusted_origins.dup
+      dynamic_origins = []
       if options.trusted_origins_callback
-        origins.concat(Array(options.trusted_origins_callback.call(request)).compact)
+        dynamic_origins.concat(Array(options.trusted_origins_callback.call(request)).compact)
       end
+      origins.concat(dynamic_origins)
       origins.concat(Env.csv("BETTER_AUTH_TRUSTED_ORIGINS"))
+      runtime_store(:explicit_trusted_origins, (options.explicit_trusted_origins + dynamic_origins.map(&:to_s)).uniq)
       origins.map(&:to_s).reject(&:empty?).uniq
-    rescue URI::InvalidURIError
-      options.trusted_origins
     end
 
     def normalize_context(value)

data/lib/better_auth/cookies.rb

@@ -8,8 +8,10 @@ module BetterAuth
   module Cookies
     SECURE_COOKIE_PREFIX = "__Secure-"
     HOST_COOKIE_PREFIX = "__Host-"
+    COOKIE_NAME_PATTERN = /\A[\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E\x5F\x60\x61-\x7A\x7C\x7E]+\z/
+    COOKIE_VALUE_PATTERN = /\A[\x20\x21\x23-\x3A\x3C-\x5B\x5D-\x7E]*\z/
 
-    Cookie = Struct.new(:name, :attributes, keyword_init: true) do
+    Cookie = Struct.new(:name, :attributes) do
       alias_method :options, :attributes
     end
 
@@ -40,8 +42,6 @@ module BetterAuth
           uri.host unless uri.host.to_s.empty?
         end
       end
-      raise Error, "base_url is required when cross_subdomain_cookies are enabled" if cross_subdomain && domain.to_s.empty? && !options.dynamic_base_url?
-
       custom = advanced.dig(:cookies, cookie_name.to_sym) || {}
       prefix = advanced[:cookie_prefix] || "better-auth"
       name = custom[:name] || "#{prefix}.#{cookie_name}"
@@ -63,14 +63,51 @@ module BetterAuth
     end
 
     def parse_cookies(cookie_header)
-      cookie_header.to_s.split(/;\s*/).each_with_object({}) do |pair, result|
-        name, value = pair.split("=", 2)
-        next if name.to_s.empty? || value.nil?
+      header = cookie_header.to_s
+      return {} if header.length < 2
+
+      header.split(";", -1).each_with_object({}) do |pair, result|
+        separator = pair.index("=")
+        next unless separator
+
+        name = trim_cookie_ows(pair[0...separator])
+        value = unquote_cookie_value(trim_cookie_ows(pair[(separator + 1)..]))
+        next unless COOKIE_NAME_PATTERN.match?(name) && COOKIE_VALUE_PATTERN.match?(value)
 
-        result[name.strip] = decode_cookie_value(value.strip)
+        result[name] = decode_cookie_value(value)
       end
     end
 
+    def split_set_cookie_header(header)
+      Array(header).flat_map do |value|
+        value.to_s.lines(chomp: true).flat_map do |line|
+          line.split(/,(?=[ \t]*[!#$%&'*+\-.^_`|~0-9A-Za-z]+=)/).map(&:strip)
+        end
+      end.reject(&:empty?)
+    end
+
+    def parse_set_cookie(line)
+      first, *attributes = line.to_s.split(";").map(&:strip)
+      name, value = first.split("=", 2)
+      return unless name && value
+
+      {
+        name: name,
+        value: value,
+        attributes: attributes.each_with_object({}) do |attribute, result|
+          key, attribute_value = attribute.split("=", 2)
+          result[key.to_s.downcase] = attribute_value || true unless key.to_s.empty?
+        end
+      }
+    end
+
+    def set_request_cookie(cookie_header, name, value)
+      cookies = parse_cookies(cookie_header)
+      cookie_name = name.to_s
+      cookies[cookie_name] = value.to_s if COOKIE_NAME_PATTERN.match?(cookie_name)
+      cookies.map { |key, semantic_value| "#{key}=#{encode_cookie_value(semantic_value)}" }.join("; ")
+    end
+
     def strip_secure_cookie_prefix(name)
       name.to_s.delete_prefix(SECURE_COOKIE_PREFIX).delete_prefix(HOST_COOKIE_PREFIX)
     end
@@ -83,10 +120,10 @@ module BetterAuth
       cookie_name = config[:cookie_name] || "session_token"
       cookie_prefix = config[:cookie_prefix] || "better-auth"
       candidates = [
-        "#{cookie_prefix}.#{cookie_name}",
         "#{SECURE_COOKIE_PREFIX}#{cookie_prefix}.#{cookie_name}",
-        "#{cookie_prefix}-#{cookie_name}",
-        "#{SECURE_COOKIE_PREFIX}#{cookie_prefix}-#{cookie_name}"
+        "#{cookie_prefix}.#{cookie_name}",
+        "#{SECURE_COOKIE_PREFIX}#{cookie_prefix}-#{cookie_name}",
+        "#{cookie_prefix}-#{cookie_name}"
       ]
       candidates.lazy.filter_map { |candidate| parsed[candidate] }.first
     end
@@ -101,16 +138,23 @@ module BetterAuth
         ctx.set_signed_cookie(dont_remember_cookie.name, "true", ctx.context.secret, dont_remember_cookie.attributes)
       end
 
-      set_cookie_cache(ctx, session, dont_remember_me)
+      set_cookie_cache(ctx, session, dont_remember_me, max_age: overrides&.fetch(:max_age, nil))
       ctx.context.set_new_session(session) if ctx.context.respond_to?(:set_new_session)
     end
 
-    def set_cookie_cache(ctx, session, dont_remember_me)
+    def set_cookie_cache(ctx, session, dont_remember_me, max_age: nil)
       config = ctx.context.session_config[:cookie_cache] || {}
       return unless config[:enabled]
 
       cookie = ctx.context.auth_cookies[:session_data]
-      max_age = dont_remember_me ? nil : cookie.attributes[:max_age]
+      configured_max_age = cookie.attributes[:max_age]
+      max_age = if dont_remember_me
+        nil
+      elsif max_age
+        [configured_max_age, max_age].compact.map(&:to_i).min
+      else
+        configured_max_age
+      end
       data = filtered_cache_data(ctx, session)
       strategy = config[:strategy] || "compact"
       secret = (strategy.to_s == "jwe") ? ctx.context.secret_config : ctx.context.secret
@@ -168,6 +212,7 @@ module BetterAuth
 
       payload = decode_cookie_cache(raw, secret, strategy: strategy)
       return nil unless payload && payload["session"] && payload["user"]
+      return nil if embedded_session_expired?(payload["session"])
 
       expected_version = cookie_cache_version(version, payload["session"], payload["user"])
       return nil if version && (payload["version"] || "1") != expected_version
@@ -176,6 +221,7 @@ module BetterAuth
     end
 
     def expire_cookie(ctx, cookie)
+      remove_set_cookie_entries(ctx, cookie.name)
       ctx.set_cookie(cookie.name, "", cookie.attributes.merge(max_age: 0))
     end
 
@@ -184,6 +230,11 @@ module BetterAuth
       expire_cookie(ctx, ctx.context.auth_cookies[:session_data])
       expire_cookie(ctx, ctx.context.auth_cookies[:account_data]) if ctx.context.options.account[:store_account_cookie]
 
+      if ctx.context.options.account[:store_account_cookie]
+        account_store = SessionStore.new(ctx.context.auth_cookies[:account_data].name, ctx.context.auth_cookies[:account_data].attributes, ctx)
+        account_store.set_cookies(account_store.clean)
+      end
+
       store = SessionStore.new(ctx.context.auth_cookies[:session_data].name, ctx.context.auth_cookies[:session_data].attributes, ctx)
       store.set_cookies(store.clean)
       expire_cookie(ctx, ctx.context.auth_cookies[:dont_remember]) unless skip_dont_remember_me
@@ -250,12 +301,57 @@ module BetterAuth
       chunks.sort_by(&:first).map(&:last).join
     end
 
+    def embedded_session_expired?(session)
+      expires_at = session["expiresAt"] || session[:expiresAt] || session["expires_at"] || session[:expires_at]
+      normalized = Session.normalize_time(expires_at)
+      normalized && normalized <= Time.now
+    rescue ArgumentError
+      true
+    end
+
+    def remove_set_cookie_entries(ctx, cookie_name)
+      header = ctx.response_headers["set-cookie"]
+      return unless header
+
+      exact = "#{cookie_name}="
+      chunk = "#{cookie_name}."
+      survivors = header.to_s.lines(chomp: true).reject do |entry|
+        entry.start_with?(exact, chunk)
+      end
+      if survivors.empty?
+        ctx.response_headers.delete("set-cookie")
+      else
+        ctx.response_headers["set-cookie"] = survivors.join("\n")
+      end
+    end
+
     def decode_cookie_value(value)
-      URI.decode_uri_component(value)
+      decoded = URI.decode_uri_component(value)
+      decoded.valid_encoding? ? decoded : value
     rescue ArgumentError
       value
     end
 
+    def trim_cookie_ows(value)
+      value.sub(/\A[ \t]*/, "").sub(/[ \t]*\z/, "")
+    end
+
+    def unquote_cookie_value(value)
+      return value unless value.length >= 2 && value.start_with?("\"") && value.end_with?("\"")
+
+      value[1...-1]
+    end
+
+    def encode_cookie_value(value)
+      value.to_s.encode(Encoding::UTF_8).bytes.map do |byte|
+        if byte.between?(48, 57) || byte.between?(65, 90) || byte.between?(97, 122) || [33, 39, 40, 41, 42, 45, 46, 95, 126].include?(byte)
+          byte.chr
+        else
+          "%#{byte.to_s(16).upcase.rjust(2, "0")}"
+        end
+      end.join
+    end
+
     def header_value(request_or_cookie_header)
       return request_or_cookie_header.headers["cookie"] if request_or_cookie_header.respond_to?(:headers)
       return request_or_cookie_header.get_header("HTTP_COOKIE") if request_or_cookie_header.respond_to?(:get_header)

data/lib/better_auth/core.rb

@@ -32,9 +32,7 @@ module BetterAuth
         delete_user: Routes.delete_user,
         delete_user_callback: Routes.delete_user_callback,
         list_accounts: Routes.list_accounts,
-        list_user_accounts: Routes.list_accounts,
         link_social: Routes.link_social,
-        link_social_account: Routes.link_social,
         unlink_account: Routes.unlink_account,
         get_access_token: Routes.get_access_token,
         refresh_token: Routes.refresh_token,

data/lib/better_auth/crypto.rb

@@ -9,7 +9,8 @@ require_relative "crypto/jwe"
 
 module BetterAuth
   module Crypto
-    URL_SAFE_ALPHABET = [*"a".."z", *"A".."Z", *"0".."9", "-", "_"].freeze
+    ALPHABETIC_ALPHABET = [*"a".."z", *"A".."Z"].freeze
+    URL_SAFE_ALPHABET = [*ALPHABETIC_ALPHABET, *"0".."9", "-", "_"].freeze
     MASK_64 = (1 << 64) - 1
     KECCAK_ROUND_CONSTANTS = [
       0x0000000000000001, 0x0000000000008082, 0x800000000000808a, 0x8000000080008000,
@@ -29,8 +30,8 @@ module BetterAuth
 
     module_function
 
-    def random_string(length = 32)
-      Array.new(length) { URL_SAFE_ALPHABET[SecureRandom.random_number(URL_SAFE_ALPHABET.length)] }.join
+    def random_string(length = 32, alphabet: URL_SAFE_ALPHABET)
+      Array.new(length) { alphabet[SecureRandom.random_number(alphabet.length)] }.join
     end
 
     def uuid

data/lib/better_auth/doctor.rb

@@ -4,7 +4,7 @@ require "better_auth/sql_migration"
 
 module BetterAuth
   module Doctor
-    Result = Struct.new(:ok, :warnings, :errors, keyword_init: true) do
+    Result = Struct.new(:ok, :warnings, :errors) do
       def success?
         errors.empty?
       end
@@ -31,6 +31,15 @@ module BetterAuth
       result.success? ? 0 : 1
     end
 
+    def as_json(result)
+      {
+        "ok" => result.ok,
+        "warnings" => result.warnings,
+        "errors" => result.errors,
+        "success" => result.success?
+      }
+    end
+
     def check_secret(config, result)
       secret = config.secret.to_s
       if secret.empty?
@@ -49,7 +58,7 @@ module BetterAuth
     def check_base_url(config, result)
       base_url = config.base_url.to_s
       if base_url.empty?
-        result.warnings << "base_url is not configured; set it explicitly in production"
+        result.errors << "base_url is not configured"
       elsif !base_url.start_with?("https://")
         result.warnings << "base_url is not HTTPS"
       else
@@ -71,7 +80,9 @@ module BetterAuth
       auth = BetterAuth.auth(config.to_h)
       adapter = auth.context.adapter
       unless adapter.respond_to?(:dialect) && adapter.respond_to?(:connection)
-        result.warnings << "database adapter does not expose SQL migration introspection; schema drift check skipped"
+        warning = "database adapter does not expose SQL migration introspection; schema drift check skipped"
+        warning += "; run `better-auth mongo indexes` to ensure MongoDB indexes" if adapter.respond_to?(:ensure_indexes!)
+        result.warnings << warning
         return
       end
 

data/lib/better_auth/error.rb

@@ -17,6 +17,7 @@ module BetterAuth
     "PROVIDER_NOT_FOUND" => "Provider not found",
     "INVALID_TOKEN" => "Invalid token",
     "TOKEN_EXPIRED" => "Token expired",
+    "TOKEN_ALREADY_USED" => "Token has already been used",
     "ID_TOKEN_NOT_SUPPORTED" => "id_token not supported",
     "FAILED_TO_GET_USER_INFO" => "Failed to get user info",
     "USER_EMAIL_NOT_FOUND" => "User email not found",
@@ -54,6 +55,7 @@ module BetterAuth
     "PASSWORD_ALREADY_SET" => "User already has a password set",
     "RESET_PASSWORD_DISABLED" => "Reset password isn't enabled",
     "EMAIL_PASSWORD_DISABLED" => "Email and password is not enabled",
-    "EMAIL_PASSWORD_SIGN_UP_DISABLED" => "Email and password sign up is not enabled"
+    "EMAIL_PASSWORD_SIGN_UP_DISABLED" => "Email and password sign up is not enabled",
+    "CHANGE_EMAIL_DISABLED" => "Change email is disabled"
   }.freeze
 end

data/lib/better_auth/logger.rb

@@ -4,7 +4,7 @@ module BetterAuth
   module Logger
     LEVELS = [:debug, :info, :success, :warn, :error].freeze
 
-    Internal = Struct.new(:level, :disabled, :handler, keyword_init: true) do
+    Internal = Struct.new(:level, :disabled, :handler) do
       LEVELS.each do |log_level|
         define_method(log_level) do |message, *args|
           return if disabled || !Logger.should_publish?(level, log_level)

data/lib/better_auth/middleware/origin_check.rb

@@ -55,7 +55,11 @@ module BetterAuth
         mode = headers["sec-fetch-mode"]
         dest = headers["sec-fetch-dest"]
         has_metadata = [site, mode, dest].any? { |value| value && !value.to_s.strip.empty? }
-        return unless has_metadata
+        unless has_metadata
+          origin = headers["origin"] || headers["referer"]
+          validate_origin(endpoint_context, force: true) if login_or_signup_path?(endpoint_context.path) && origin && !origin.to_s.empty?
+          return
+        end
 
         if site == "cross-site" && mode == "navigate"
           log(endpoint_context.context, :error, "Blocked cross-site navigation login attempt (CSRF protection)")
@@ -109,6 +113,10 @@ module BetterAuth
         skip.any? { |path| endpoint_context.path.start_with?(path.to_s) }
       end
 
+      def login_or_signup_path?(path)
+        path.to_s.match?(%r{/(?:sign-in|sign-up)(?:/|$)})
+      end
+
       def fetch_data(data, key)
         return unless data.is_a?(Hash)
 

data/lib/better_auth/migration_plan.rb

@@ -2,11 +2,11 @@
 
 module BetterAuth
   module MigrationPlan
-    TableChange = Struct.new(:logical_name, :table_name, :table, :order, keyword_init: true)
-    FieldChange = Struct.new(:logical_name, :table_name, :fields, :table, :order, keyword_init: true)
-    IndexChange = Struct.new(:table_name, :field_name, :name, :unique, :field, keyword_init: true)
+    TableChange = Struct.new(:logical_name, :table_name, :table, :order)
+    FieldChange = Struct.new(:logical_name, :table_name, :fields, :table, :order)
+    IndexChange = Struct.new(:table_name, :field_name, :name, :unique, :field)
 
-    Plan = Struct.new(:to_create, :to_add, :to_index, :warnings, :dialect, :tables, keyword_init: true) do
+    Plan = Struct.new(:to_create, :to_add, :to_index, :warnings, :dialect, :tables) do
       def empty?
         to_create.empty? && to_add.empty? && to_index.empty?
       end