better_auth 0.10.0 → 0.11.0

data/lib/better_auth/oauth_state.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require "json"
+
+module BetterAuth
+  # Shared OAuth state storage matching upstream's opaque-state adaptation.
+  # State data is encrypted client-side for the cookie strategy or consumed
+  # from verification storage for the database strategy. Signed JWT state is
+  # still accepted so in-flight legacy sign-in and link flows keep working.
+  module OAuthState
+    INTERNAL_KEYS = %w[
+      callbackURL codeVerifier errorURL newUserURL expiresAt oauthState link requestSignUp
+    ].freeze
+
+    class Error < BetterAuth::Error
+      attr_reader :code, :error_url
+
+      def initialize(code, error_url: nil)
+        @code = code
+        @error_url = error_url
+        super(code)
+      end
+    end
+
+    module_function
+
+    def generate(ctx, state_data)
+      state = Crypto.random_string(32)
+      payload = stringify_keys(state_data).merge("oauthState" => state)
+
+      if cookie_strategy?(ctx)
+        cookie = ctx.context.create_auth_cookie("oauth_state", max_age: 600)
+        encrypted = Crypto.symmetric_encrypt(
+          key: ctx.context.secret_config,
+          data: JSON.generate(payload)
+        )
+        ctx.set_cookie(cookie.name, encrypted, cookie.attributes)
+      else
+        cookie = ctx.context.create_auth_cookie("state", max_age: 300)
+        ctx.set_signed_cookie(cookie.name, state, ctx.context.secret, cookie.attributes)
+        verification = ctx.context.internal_adapter.create_verification_value(
+          identifier: state,
+          value: JSON.generate(payload),
+          expiresAt: Time.now + 600
+        )
+        raise Error, "state_generation_error" unless verification
+      end
+
+      state
+    end
+
+    def parse(ctx, state)
+      raise Error, "state_not_found" if state.to_s.empty?
+
+      legacy = Crypto.verify_jwt(state.to_s, ctx.context.secret)
+      return parse_legacy(ctx, state, legacy) if legacy
+
+      cookie_strategy?(ctx) ? parse_cookie_state(ctx, state) : parse_database_state(ctx, state)
+    rescue JSON::ParserError
+      raise Error, "state_invalid"
+    end
+
+    def parse_legacy(ctx, state, data)
+      cookie = ctx.context.create_auth_cookie("state", max_age: 600)
+      stored = ctx.get_signed_cookie(cookie.name, ctx.context.secret)
+      Cookies.expire_cookie(ctx, cookie) if ctx.request || stored
+      valid = ctx.request ? stored == state : (stored.nil? || stored == state)
+      return data if valid
+
+      raise Error.new("state_mismatch", error_url: recovered_error_url(data))
+    end
+
+    def parse_cookie_state(ctx, state)
+      cookie = ctx.context.create_auth_cookie("oauth_state")
+      encrypted = ctx.get_cookie(cookie.name)
+      raise Error, "state_mismatch" if encrypted.to_s.empty?
+
+      data = begin
+        decrypted = Crypto.symmetric_decrypt(key: ctx.context.secret_config, data: encrypted)
+        JSON.parse(decrypted)
+      rescue JSON::ParserError, ArgumentError, TypeError
+        raise Error, "state_invalid"
+      end
+
+      expected = data["oauthState"] || data["state"]
+      unless expected == state
+        raise Error.new("state_mismatch", error_url: recovered_error_url(data))
+      end
+
+      Cookies.expire_cookie(ctx, cookie)
+      validate_expiration!(data)
+      data
+    end
+
+    def parse_database_state(ctx, state)
+      preview = ctx.context.internal_adapter.find_verification_value(state)
+      raise Error, "state_mismatch" unless preview
+
+      data = JSON.parse(preview.fetch("value"))
+      error_url = recovered_error_url(data)
+      expected = data["oauthState"] || data["state"]
+      raise Error.new("state_mismatch", error_url: error_url) if expected && expected != state
+
+      cookie = ctx.context.create_auth_cookie("state")
+      stored = ctx.get_signed_cookie(cookie.name, ctx.context.secret)
+      valid = ctx.request ? stored == state : (stored.nil? || stored == state)
+      raise Error.new("state_mismatch", error_url: error_url) unless valid
+
+      consumed = ctx.context.internal_adapter.consume_verification_value(state)
+      Cookies.expire_cookie(ctx, cookie) if ctx.request || stored
+      raise Error.new("state_mismatch", error_url: error_url) unless consumed
+
+      consumed_data = JSON.parse(consumed.fetch("value"))
+      consumed_expected = consumed_data["oauthState"] || consumed_data["state"]
+      same_payload = consumed.fetch("value") == preview.fetch("value")
+      expected_matches = !consumed_expected || consumed_expected == state
+      unless same_payload && expected_matches
+        raise Error.new("state_mismatch", error_url: recovered_error_url(consumed_data) || error_url)
+      end
+
+      validate_expiration!(consumed_data)
+      consumed_data
+    end
+
+    def validate_expiration!(data)
+      expires_at = data["expiresAt"].to_i
+      return data unless expires_at.positive? && expires_at < Time.now.to_i
+
+      raise Error.new("state_mismatch", error_url: recovered_error_url(data))
+    end
+
+    def recovered_error_url(data)
+      data["errorURL"] || data["errorCallbackURL"]
+    end
+
+    def cookie_strategy?(ctx)
+      ctx.context.options.account[:store_state_strategy].to_s == "cookie"
+    end
+
+    def stringify_keys(value)
+      return value.each_with_object({}) { |(key, object), result| result[key.to_s] = stringify_keys(object) } if value.is_a?(Hash)
+      return value.map { |entry| stringify_keys(entry) } if value.is_a?(Array)
+
+      value
+    end
+  end
+end

data/lib/better_auth/plugin_loader.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    # Maps `BetterAuth::Plugins` factory methods and nested modules to source files.
+    PLUGIN_FILES = {
+      additional_fields: "plugins/additional_fields",
+      custom_session: "plugins/custom_session",
+      multi_session: "plugins/multi_session",
+      last_login_method: "plugins/last_login_method",
+      bearer: "plugins/bearer",
+      jwt: "plugins/jwt",
+      open_api: "plugins/open_api",
+      access: "plugins/access",
+      username: "plugins/username",
+      anonymous: "plugins/anonymous",
+      magic_link: "plugins/magic_link",
+      email_otp: "plugins/email_otp",
+      phone_number: "plugins/phone_number",
+      one_time_token: "plugins/one_time_token",
+      one_tap: "plugins/one_tap",
+      siwe: "plugins/siwe",
+      generic_oauth: "plugins/generic_oauth",
+      oauth_popup: "plugins/oauth_popup",
+      dub: "plugins/dub",
+      oauth_proxy: "plugins/oauth_proxy",
+      passkey: "plugins/passkey",
+      organization_schema: "plugins/organization/schema",
+      organization: "plugins/organization",
+      admin_schema: "plugins/admin/schema",
+      admin: "plugins/admin",
+      oauth_protocol: "plugins/oauth_protocol",
+      oauth_provider: "plugins/oauth_provider",
+      device_authorization: "plugins/device_authorization",
+      two_factor: "plugins/two_factor",
+      captcha: "plugins/captcha",
+      have_i_been_pwned: "plugins/have_i_been_pwned",
+      api_key: "plugins/api_key",
+      sso: "plugins/sso",
+      scim: "plugins/scim",
+      stripe: "plugins/stripe",
+      expo: "plugins/expo",
+      i18n: "plugins/i18n"
+    }.freeze
+
+    PLUGIN_DEPENDENCIES = {
+      organization: %i[organization_schema access],
+      admin_schema: %i[organization_schema],
+      admin: %i[admin_schema access],
+      device_authorization: %i[oauth_protocol]
+    }.freeze
+
+    # Core route metadata helpers; loaded at boot because base endpoints reference OpenAPI.
+    BOOT_PLUGINS = %i[open_api].freeze
+
+    PLUGIN_ID_TO_LOADER = {
+      "additional-fields" => :additional_fields,
+      "custom-session" => :custom_session,
+      "multi-session" => :multi_session,
+      "last-login-method" => :last_login_method,
+      "bearer" => :bearer,
+      "jwt" => :jwt,
+      "open-api" => :open_api,
+      "username" => :username,
+      "anonymous" => :anonymous,
+      "magic-link" => :magic_link,
+      "email-otp" => :email_otp,
+      "phone-number" => :phone_number,
+      "one-time-token" => :one_time_token,
+      "one-tap" => :one_tap,
+      "siwe" => :siwe,
+      "generic-oauth" => :generic_oauth,
+      "oauth-popup" => :oauth_popup,
+      "dub" => :dub,
+      "oauth-proxy" => :oauth_proxy,
+      "passkey" => :passkey,
+      "organization" => :organization,
+      "admin" => :admin,
+      "oauth-provider" => :oauth_provider,
+      "device-authorization" => :device_authorization,
+      "two-factor" => :two_factor,
+      "captcha" => :captcha,
+      "have-i-been-pwned" => :have_i_been_pwned,
+      "api-key" => :api_key,
+      "sso" => :sso,
+      "scim" => :scim,
+      "stripe" => :stripe,
+      "expo" => :expo,
+      "i18n" => :i18n
+    }.freeze
+
+    NESTED_MODULE_LOADERS = {
+      OAuthProtocol: :oauth_protocol,
+      JWT: :jwt,
+      OrganizationSchema: :organization_schema,
+      AdminSchema: :admin_schema
+    }.freeze
+
+    LAZY_PLUGIN_METHODS = PLUGIN_FILES.keys.freeze
+
+    @loaded_plugins = {}
+
+    EXTERNAL_PLUGIN_IMPLEMENTATIONS = {
+      sso: :SSO_PLUGIN_IMPLEMENTATION,
+      scim: :SCIM_PLUGIN_IMPLEMENTATION,
+      api_key: :API_KEY_PLUGIN_IMPLEMENTATION,
+      passkey: :PASSKEY_PLUGIN_IMPLEMENTATION,
+      stripe: :STRIPE_PLUGIN_IMPLEMENTATION,
+      oauth_provider: :OAUTH_PROVIDER_PLUGIN_IMPLEMENTATION
+    }.freeze
+
+    module_function
+
+    def ensure_external_plugin_loaded!(gem_name:, entry:, implementation_constant:)
+      return if const_defined?(implementation_constant, false)
+
+      spec = Gem.loaded_specs[gem_name] || Gem::Specification.find_by_name(gem_name)
+      entry_path = File.join(spec.full_gem_path, entry)
+      load entry_path unless $LOADED_FEATURES.include?(entry_path)
+
+      return if const_defined?(implementation_constant, false)
+
+      raise LoadError,
+        "BetterAuth requires the #{gem_name} gem. Add it to your Gemfile and require its entrypoint."
+    rescue Gem::MissingSpecError
+      raise LoadError,
+        "BetterAuth requires the #{gem_name} gem. Add it to your Gemfile and require its entrypoint."
+    end
+
+    def call_external_plugin!(method_name, *args, implementation_constant:, gem_name:, entry:, &block)
+      loader = method(method_name)
+      ensure_external_plugin_loaded!(
+        gem_name: gem_name,
+        entry: entry,
+        implementation_constant: implementation_constant
+      )
+      resolved = method(method_name)
+      if resolved == loader
+        raise LoadError,
+          "BetterAuth::Plugins.#{method_name} requires the #{gem_name} gem. Add it to your Gemfile and require its entrypoint."
+      end
+
+      resolved.call(*args, &block)
+    end
+
+    def load_plugin!(name)
+      name = name.to_sym
+      return true if @loaded_plugins[name]
+      implementation_constant = EXTERNAL_PLUGIN_IMPLEMENTATIONS[name]
+      if implementation_constant && const_defined?(implementation_constant, false)
+        @loaded_plugins[name] = true
+        return true
+      end
+
+      Array(PLUGIN_DEPENDENCIES[name]).each { |dependency| load_plugin!(dependency) }
+
+      relative_path = PLUGIN_FILES.fetch(name) do
+        raise ArgumentError, "Unknown plugin loader: #{name}"
+      end
+
+      absolute_path = File.expand_path(relative_path, __dir__)
+      unless File.file?("#{absolute_path}.rb")
+        @loaded_plugins[name] = true
+        return false
+      end
+
+      require_relative relative_path
+      @loaded_plugins[name] = true
+      true
+    end
+
+    def plugin_loaded?(name)
+      @loaded_plugins.key?(name.to_sym)
+    end
+
+    def ensure_plugin_loaded_for!(plugin)
+      return unless plugin.is_a?(BetterAuth::Plugin)
+
+      loader = PLUGIN_ID_TO_LOADER[plugin.id]
+      load_plugin!(loader) if loader
+    end
+
+    def lazy_plugin_method?(name)
+      !plugin_loader_for_method(name).nil?
+    end
+
+    def plugin_loader_for_method(name)
+      symbol = name.to_sym
+      return symbol if LAZY_PLUGIN_METHODS.include?(symbol)
+
+      PLUGIN_FILES.each_key do |plugin|
+        return plugin if name.to_s.start_with?("#{plugin}_")
+      end
+
+      nil
+    end
+
+    def load_plugin_for_constant!(name)
+      if (loader = NESTED_MODULE_LOADERS[name])
+        return load_plugin!(loader)
+      end
+
+      if name == :OpenAPI
+        return load_plugin!(:open_api)
+      end
+
+      constant = name.to_s
+      if constant.end_with?("_ERROR_CODES")
+        plugin_name = constant.delete_suffix("_ERROR_CODES").downcase.to_sym
+        return load_plugin!(plugin_name) if PLUGIN_FILES.key?(plugin_name)
+      end
+
+      false
+    end
+
+    def load_boot_plugins!
+      BOOT_PLUGINS.each { |plugin| load_plugin!(plugin) }
+    end
+  end
+end

data/lib/better_auth/plugins/access.rb

@@ -10,36 +10,33 @@ module BetterAuth
       end
 
       def authorize(request, connector = "AND")
+        connector = (connector == "OR") ? "OR" : "AND"
         success = false
         stringify_request(request).each do |resource, requested_actions|
           allowed_actions = statements[resource]
           unless allowed_actions
+            next if connector == "OR"
+
             return {success: false, error: "You are not allowed to access resource: #{resource}"}
           end
 
           success = if requested_actions.is_a?(Array)
-            requested_actions.all? { |action| allowed_actions.include?(action.to_s) }
+            requested_actions.any? && requested_actions.all? { |action| action.is_a?(String) && allowed_actions.include?(action) }
           elsif requested_actions.is_a?(Hash)
-            unless requested_actions.key?("actions") || requested_actions.key?(:actions)
-              raise Error, "Invalid access control request"
-            end
-
             raw_actions = requested_actions["actions"] || requested_actions[:actions]
-            raise Error, "Invalid access control request" if raw_actions.nil?
-
-            actions = Array(raw_actions).map(&:to_s)
-            action_connector = (requested_actions["connector"] || requested_actions[:connector] || "AND").to_s.upcase
+            actions = raw_actions.is_a?(Array) ? raw_actions : []
+            action_connector = ((requested_actions["connector"] || requested_actions[:connector]) == "OR") ? "OR" : "AND"
             if action_connector == "OR"
-              actions.any? { |action| allowed_actions.include?(action) }
+              actions.any? { |action| action.is_a?(String) && allowed_actions.include?(action) }
             else
-              actions.all? { |action| allowed_actions.include?(action) }
+              actions.any? && actions.all? { |action| action.is_a?(String) && allowed_actions.include?(action) }
             end
           else
             raise Error, "Invalid access control request"
           end
 
-          return {success: true} if success && connector.to_s.upcase == "OR"
-          return {success: false, error: "unauthorized to access resource \"#{resource}\""} if !success && connector.to_s.upcase == "AND"
+          return {success: true} if success && connector == "OR"
+          return {success: false, error: "unauthorized to access resource \"#{resource}\""} if !success && connector == "AND"
         end
 
         success ? {success: true} : {success: false, error: "Not authorized"}

data/lib/better_auth/plugins/admin.rb

@@ -25,15 +25,17 @@ module BetterAuth
       "YOU_CANNOT_REMOVE_YOURSELF" => "You cannot remove yourself",
       "YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE" => "You are not allowed to set a non-existent role value",
       "YOU_CANNOT_IMPERSONATE_ADMINS" => "You cannot impersonate admins",
-      "INVALID_ROLE_TYPE" => "Invalid role type"
+      "INVALID_ROLE_TYPE" => "Invalid role type",
+      "YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL" => "You are not allowed to update users email",
+      "PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER" => "Password cannot be updated through update-user. Use the set-user-password endpoint instead"
     }.freeze
 
     ADMIN_DEFAULT_STATEMENTS = {
-      user: ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"],
+      user: ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"],
       session: ["list", "revoke", "delete"]
     }.freeze
     ADMIN_DEFAULT_ROLE_STATEMENTS = {
-      user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"],
+      user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"],
       session: ["list", "revoke", "delete"]
     }.freeze
 
@@ -158,6 +160,8 @@ module BetterAuth
         user_id = body[:user_id].to_s
         raise APIError.new("BAD_REQUEST", message: "userId is required") if user_id.empty?
         update = {role: admin_validate_roles!(body[:role], config)}
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
+
         user = ctx.context.internal_adapter.update_user(user_id, update)
         ctx.json({user: Schema.parse_output(ctx.context.options, "user", user || {})})
       end
@@ -189,7 +193,7 @@ module BetterAuth
         elsif query[:email]
           ctx.context.internal_adapter.find_user_by_email(query[:email])&.fetch(:user)
         end
-        raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless user
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless user
         ctx.json(Schema.parse_output(ctx.context.options, "user", user))
       end
     end
@@ -212,10 +216,10 @@ module BetterAuth
           required: ["email", "name"]
         )
       ) do |ctx|
-        session = Routes.current_session(ctx, allow_nil: true)
+        session = Routes.current_session(ctx, allow_nil: true, sensitive: true)
         if session
           unless admin_permission?(session[:user], session[:user]["role"], {user: ["create"]}, config)
-            raise APIError.new("FORBIDDEN", message: ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS"))
+            raise APIError.new("FORBIDDEN", code: "YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS", message: ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS"))
           end
         elsif !ctx.headers.empty?
           raise APIError.new("UNAUTHORIZED")
@@ -223,18 +227,25 @@ module BetterAuth
 
         body = normalize_hash(ctx.body)
         email = body[:email].to_s.downcase
-        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES.fetch("INVALID_EMAIL")) unless Routes::EMAIL_PATTERN.match?(email)
+        raise APIError.new("BAD_REQUEST", code: "INVALID_EMAIL", message: BASE_ERROR_CODES.fetch("INVALID_EMAIL")) unless Routes::EMAIL_PATTERN.match?(email)
 
         if ctx.context.internal_adapter.find_user_by_email(email)
-          raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL"))
+          raise APIError.new("BAD_REQUEST", code: "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL", message: ADMIN_ERROR_CODES.fetch("USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL"))
         end
         data = normalize_hash(body[:data]).each_with_object({}) { |(key, value), result| result[Schema.storage_key(key)] = value }
+        requested_role = body.key?(:role) ? body[:role] : data.delete("role")
+        if !requested_role.nil? && session
+          admin_require_permission!(ctx, config, {user: ["set-role"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE"))
+        end
+        if session && ["banned", "banReason", "banExpires"].any? { |field| data.key?(field) }
+          admin_require_permission!(ctx, config, {user: ["ban"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_BAN_USERS"))
+        end
         user = ctx.context.internal_adapter.create_user(data.merge(
           name: body[:name].to_s,
           email: email,
-          role: admin_validate_roles!(body[:role] || config[:default_role], config)
+          role: requested_role.nil? ? config[:default_role] : admin_validate_roles!(requested_role, config)
         ).merge(body.key?(:image) ? {image: body[:image]} : {}), context: ctx)
-        raise APIError.new("INTERNAL_SERVER_ERROR", message: ADMIN_ERROR_CODES.fetch("FAILED_TO_CREATE_USER")) unless user
+        raise APIError.new("INTERNAL_SERVER_ERROR", code: "FAILED_TO_CREATE_USER", message: ADMIN_ERROR_CODES.fetch("FAILED_TO_CREATE_USER")) unless user
 
         if body[:password].to_s != ""
           ctx.context.internal_adapter.link_account(userId: user["id"], providerId: "credential", accountId: user["id"], password: Routes.hash_password(ctx, body[:password]))
@@ -269,12 +280,38 @@ module BetterAuth
         admin_require_permission!(ctx, config, {user: ["update"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS"))
         body = normalize_hash(ctx.body)
         data = normalize_hash(body[:data] || body).except(:user_id, :data)
-        raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("NO_DATA_TO_UPDATE")) if data.empty?
+        raise APIError.new("BAD_REQUEST", code: "NO_DATA_TO_UPDATE", message: ADMIN_ERROR_CODES.fetch("NO_DATA_TO_UPDATE")) if data.empty?
+        if data.key?(:password)
+          raise APIError.new("BAD_REQUEST", code: "PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER", message: ADMIN_ERROR_CODES.fetch("PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER"))
+        end
         if data.key?(:role)
           admin_require_permission!(ctx, config, {user: ["set-role"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE"))
           data[:role] = admin_validate_roles!(data[:role], config)
         end
-        user = ctx.context.internal_adapter.update_user(body[:user_id], data)
+        if [:banned, :ban_reason, :ban_expires].any? { |field| data.key?(field) }
+          session = admin_require_permission!(ctx, config, {user: ["ban"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_BAN_USERS"))
+          if data[:banned] == true && body[:user_id] == session[:user]["id"]
+            raise APIError.new("BAD_REQUEST", code: "YOU_CANNOT_BAN_YOURSELF", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_BAN_YOURSELF"))
+          end
+        end
+        if data.key?(:email) || data.key?(:email_verified)
+          admin_require_permission!(ctx, config, {user: ["set-email"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL"))
+          if data.key?(:email)
+            email = data[:email].to_s.downcase
+            raise APIError.new("BAD_REQUEST", code: "INVALID_EMAIL", message: BASE_ERROR_CODES.fetch("INVALID_EMAIL")) unless Routes::EMAIL_PATTERN.match?(email)
+
+            existing = ctx.context.internal_adapter.find_user_by_email(email)
+            if existing && existing[:user]["id"] != body[:user_id]
+              raise APIError.new("BAD_REQUEST", code: "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL", message: ADMIN_ERROR_CODES.fetch("USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL"))
+            end
+            data[:email] = email
+          end
+        end
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(body[:user_id])
+
+        stored_data = data.each_with_object({}) { |(key, value), result| result[Schema.storage_key(key)] = value }
+        user = ctx.context.internal_adapter.update_user(body[:user_id], stored_data)
+        ctx.context.internal_adapter.delete_user_sessions(body[:user_id]) if data[:banned] == true
         ctx.json(Schema.parse_output(ctx.context.options, "user", user))
       end
     end
@@ -357,11 +394,11 @@ module BetterAuth
         session = admin_require_permission!(ctx, config, {user: ["ban"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_BAN_USERS"))
         body = normalize_hash(ctx.body)
         found = ctx.context.internal_adapter.find_user_by_id(body[:user_id])
-        raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless found
-        raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_BAN_YOURSELF")) if body[:user_id] == session[:user]["id"]
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless found
+        raise APIError.new("BAD_REQUEST", code: "YOU_CANNOT_BAN_YOURSELF", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_BAN_YOURSELF")) if body[:user_id] == session[:user]["id"]
         expires_in = body[:ban_expires_in] || config[:default_ban_expires_in]
         user = ctx.context.internal_adapter.update_user(body[:user_id], banned: true, banReason: body[:ban_reason] || config[:default_ban_reason] || "No reason", banExpires: expires_in ? Time.now + expires_in.to_i : nil, updatedAt: Time.now)
-        ctx.context.internal_adapter.delete_sessions(body[:user_id])
+        ctx.context.internal_adapter.delete_user_sessions(body[:user_id])
         ctx.json({user: Schema.parse_output(ctx.context.options, "user", user)})
       end
     end
@@ -381,7 +418,10 @@ module BetterAuth
         )
       ) do |ctx|
         admin_require_permission!(ctx, config, {user: ["ban"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_BAN_USERS"))
-        user = ctx.context.internal_adapter.update_user(normalize_hash(ctx.body)[:user_id], banned: false, banReason: nil, banExpires: nil, updatedAt: Time.now)
+        user_id = normalize_hash(ctx.body)[:user_id]
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
+
+        user = ctx.context.internal_adapter.update_user(user_id, banned: false, banReason: nil, banExpires: nil, updatedAt: Time.now)
         ctx.json({user: Schema.parse_output(ctx.context.options, "user", user)})
       end
     end
@@ -411,11 +451,11 @@ module BetterAuth
         session = admin_require_permission!(ctx, config, {user: ["impersonate"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS"))
         body = normalize_hash(ctx.body)
         target = ctx.context.internal_adapter.find_user_by_id(body[:user_id])
-        raise APIError.new("NOT_FOUND", message: "User not found") unless target
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless target
         can_impersonate_admins = config[:allow_impersonating_admins] ||
           admin_permission?(session[:user], session[:user]["role"], {user: ["impersonate-admins"]}, config)
         if !can_impersonate_admins && admin_user?(target, config)
-          raise APIError.new("FORBIDDEN", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_IMPERSONATE_ADMINS"))
+          raise APIError.new("FORBIDDEN", code: "YOU_CANNOT_IMPERSONATE_ADMINS", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_IMPERSONATE_ADMINS"))
         end
         impersonated = ctx.context.internal_adapter.create_session(target["id"], true, {impersonatedBy: session[:user]["id"], expiresAt: Time.now + config[:impersonation_session_duration].to_i}, true, ctx)
         raise APIError.new("INTERNAL_SERVER_ERROR", message: ADMIN_ERROR_CODES.fetch("FAILED_TO_CREATE_USER")) unless impersonated
@@ -524,7 +564,7 @@ module BetterAuth
         }
       ) do |ctx|
         admin_require_permission!(ctx, config, {session: ["revoke"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS"))
-        ctx.context.internal_adapter.delete_sessions(normalize_hash(ctx.body)[:user_id])
+        ctx.context.internal_adapter.delete_user_sessions(normalize_hash(ctx.body)[:user_id])
         ctx.json({success: true})
       end
     end
@@ -553,8 +593,8 @@ module BetterAuth
       ) do |ctx|
         session = admin_require_permission!(ctx, config, {user: ["delete"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS"))
         user_id = normalize_hash(ctx.body)[:user_id]
-        raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_REMOVE_YOURSELF")) if user_id == session[:user]["id"]
-        raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
+        raise APIError.new("BAD_REQUEST", code: "YOU_CANNOT_REMOVE_YOURSELF", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_REMOVE_YOURSELF")) if user_id == session[:user]["id"]
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
         ctx.context.internal_adapter.delete_user(user_id)
         ctx.json({success: true})
       end
@@ -590,9 +630,17 @@ module BetterAuth
         raise APIError.new("BAD_REQUEST", message: "userId is required") if user_id.empty?
         min = ctx.context.options.email_and_password[:min_password_length]
         max = ctx.context.options.email_and_password[:max_password_length]
-        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES.fetch("PASSWORD_TOO_SHORT")) if password.length < min
-        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES.fetch("PASSWORD_TOO_LONG")) if password.length > max
-        ctx.context.internal_adapter.update_password(user_id, Routes.hash_password(ctx, password))
+        raise APIError.new("BAD_REQUEST", code: "PASSWORD_TOO_SHORT", message: BASE_ERROR_CODES.fetch("PASSWORD_TOO_SHORT")) if password.length < min
+        raise APIError.new("BAD_REQUEST", code: "PASSWORD_TOO_LONG", message: BASE_ERROR_CODES.fetch("PASSWORD_TOO_LONG")) if password.length > max
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
+
+        hashed_password = Routes.hash_password(ctx, password)
+        credential_account = ctx.context.internal_adapter.find_accounts(user_id).find { |account| account["providerId"] == "credential" }
+        if credential_account
+          ctx.context.internal_adapter.update_password(user_id, hashed_password)
+        else
+          ctx.context.internal_adapter.create_account(userId: user_id, providerId: "credential", accountId: user_id, password: hashed_password)
+        end
         ctx.json({status: true})
       end
     end
@@ -631,7 +679,7 @@ module BetterAuth
           }
         }
       ) do |ctx|
-        session = Routes.current_session(ctx, allow_nil: true)
+        session = Routes.current_session(ctx, allow_nil: true, sensitive: true)
         body = normalize_hash(ctx.body)
         permissions = body[:permissions] || body[:permission]
         unless permissions
@@ -723,7 +771,10 @@ module BetterAuth
       session = Routes.current_session(ctx, sensitive: true)
       return session if admin_permission?(session[:user], session[:user]["role"], permissions, config)
 
-      raise APIError.new("FORBIDDEN", message: message)
+      code = ADMIN_ERROR_CODES.key(message)
+      raise Error, "Unknown admin permission error: #{message}" unless code
+
+      raise APIError.new("FORBIDDEN", code: code, message: message)
     end
 
     def admin_permission?(user, role_string, permissions, config)
@@ -750,7 +801,7 @@ module BetterAuth
 
     def admin_validate_roles!(roles, config)
       unless Array(roles).all? { |role| role.is_a?(String) || role.is_a?(Symbol) }
-        raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("INVALID_ROLE_TYPE"))
+        raise APIError.new("BAD_REQUEST", code: "INVALID_ROLE_TYPE", message: ADMIN_ERROR_CODES.fetch("INVALID_ROLE_TYPE"))
       end
 
       parsed = admin_parse_roles(roles)
@@ -758,7 +809,7 @@ module BetterAuth
         defined_roles = (config[:roles] || {}).transform_keys(&:to_s)
         invalid = parsed.split(",", -1).reject { |role| admin_role_for(defined_roles, role) }
         if invalid.any?
-          raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE"))
+          raise APIError.new("BAD_REQUEST", code: "YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE", message: ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE"))
         end
       end