better_auth 0.10.0 → 0.11.0

data/lib/better_auth/plugins/api_key.rb

@@ -1,16 +1,13 @@
 # frozen_string_literal: true
 
+return if defined?(BetterAuth::Plugins::API_KEY_PLUGIN_IMPLEMENTATION)
+
 module BetterAuth
   module Plugins
     module_function
 
-    def api_key(*args)
-      Kernel.require "better_auth/api_key"
-      BetterAuth::Plugins.api_key(*args)
-    rescue LoadError => error
-      raise if error.path && error.path != "better_auth/api_key"
-
-      raise LoadError, "BetterAuth::Plugins.api_key requires the better_auth-api-key gem. Add `gem \"better_auth-api-key\"` and `require \"better_auth/api_key\"`."
+    def api_key(*args, &block)
+      call_external_plugin!(:api_key, *args, implementation_constant: :API_KEY_PLUGIN_IMPLEMENTATION, gem_name: "better_auth-api-key", entry: "lib/better_auth/api_key.rb", &block)
     end
   end
 end

data/lib/better_auth/plugins/bearer.rb

@@ -50,7 +50,7 @@ module BetterAuth
       return unless signed_token && valid_signed_token?(ctx, signed_token)
 
       cookie_name = ctx.context.auth_cookies[:session_token].name
-      cookie = [ctx.headers["cookie"], "#{cookie_name}=#{signed_token}"].compact.reject(&:empty?).join("; ")
+      cookie = Cookies.set_request_cookie(ctx.headers["cookie"], cookie_name, signed_token)
       {context: {headers: ctx.headers.merge("cookie" => cookie)}}
     end
 
@@ -86,37 +86,23 @@ module BetterAuth
       token.to_s
     end
 
-    def bearer_session_cookie(line)
-      first, *attributes = line.to_s.split(";").map(&:strip)
-      name, value = first.split("=", 2)
-      return unless name && value
-
-      {
-        name: name,
-        value: value,
-        attributes: attributes.each_with_object({}) do |attribute, result|
-          key, attribute_value = attribute.split("=", 2)
-          result[key.to_s.downcase] = attribute_value || true unless key.to_s.empty?
-        end
-      }
-    end
-
     def expired_bearer_cookie?(cookie)
       max_age = cookie[:attributes]["max-age"]
       max_age.to_s.strip.match?(/\A[+-]?\d+\z/) && max_age.to_i == 0
     end
 
     def expose_auth_token(ctx)
-      set_cookie = ctx.response_headers["set-cookie"].to_s
       token_name = ctx.context.auth_cookies[:session_token].name
-      token = set_cookie.lines.filter_map do |line|
-        cookie = bearer_session_cookie(line)
+      session_cookie = Cookies.split_set_cookie_header(ctx.response_headers["set-cookie"]).reverse_each.filter_map do |line|
+        cookie = Cookies.parse_set_cookie(line)
         next unless cookie && cookie[:name] == token_name
-        next if cookie[:value].empty? || expired_bearer_cookie?(cookie)
 
-        cookie[:value]
+        cookie
       end.first
-      return unless token
+      return unless session_cookie
+      return if session_cookie[:value].empty? || expired_bearer_cookie?(session_cookie)
+
+      token = session_cookie[:value]
 
       exposed = ctx.response_headers["access-control-expose-headers"].to_s.split(",").map(&:strip).reject(&:empty?)
       exposed << "set-auth-token"

data/lib/better_auth/plugins/captcha.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "net/http"
+require "timeout"
 require "uri"
 
 module BetterAuth
@@ -22,6 +23,7 @@ module BetterAuth
       "/sign-in/email",
       "/request-password-reset"
     ].freeze
+    CAPTCHA_VERIFY_TIMEOUT_SECONDS = 10
 
     CAPTCHA_SITE_VERIFY_URLS = {
       "cloudflare-turnstile" => "https://challenges.cloudflare.com/turnstile/v0/siteverify",
@@ -46,7 +48,11 @@ module BetterAuth
 
     def captcha_on_request(request, context, config)
       endpoints = Array(config[:endpoints]).empty? ? CAPTCHA_DEFAULT_ENDPOINTS : Array(config[:endpoints])
-      return nil unless endpoints.any? { |endpoint| request.path_info.include?(endpoint.to_s) || request.url.include?(endpoint.to_s) }
+      path = request.path_info.to_s
+      email_otp_path = "/sign-in/email-otp"
+      email_otp_is_explicit = Array(config[:endpoints]).map(&:to_s).include?(email_otp_path)
+      return nil if path.include?(email_otp_path) && !email_otp_is_explicit
+      return nil unless endpoints.any? { |endpoint| path.include?(endpoint.to_s) }
 
       raise CAPTCHA_INTERNAL_ERROR_CODES["MISSING_SECRET_KEY"] if config[:secret_key].to_s.empty?
 
@@ -76,9 +82,13 @@ module BetterAuth
         min_score: config[:min_score],
         provider: provider
       }
-      return captcha_normalize_verifier_response(config[:verifier].call(captcha_verifier_params(params))) if config[:verifier].respond_to?(:call)
-
-      captcha_http_verify(params)
+      Timeout.timeout(CAPTCHA_VERIFY_TIMEOUT_SECONDS) do
+        if config[:verifier].respond_to?(:call)
+          captcha_normalize_verifier_response(config[:verifier].call(captcha_verifier_params(params)))
+        else
+          captcha_http_verify(params)
+        end
+      end
     end
 
     def captcha_verifier_params(params)
@@ -103,7 +113,7 @@ module BetterAuth
       else
         URI.encode_www_form(verifier[:payload])
       end
-      response = HTTPClient.request(uri, request)
+      response = HTTPClient.request(uri, request, open_timeout: CAPTCHA_VERIFY_TIMEOUT_SECONDS, read_timeout: CAPTCHA_VERIFY_TIMEOUT_SECONDS)
       raise CAPTCHA_INTERNAL_ERROR_CODES["SERVICE_UNAVAILABLE"] unless response.is_a?(Net::HTTPSuccess)
 
       JSON.parse(response.body.to_s)
@@ -127,7 +137,15 @@ module BetterAuth
       return false unless result && result["success"]
 
       if config[:provider].to_s == "google-recaptcha" && result.key?("score")
-        return result["score"].to_f >= (config[:min_score] || 0.5).to_f
+        return false if result["score"].to_f < (config[:min_score] || 0.5).to_f
+      end
+
+      if ["google-recaptcha", "cloudflare-turnstile"].include?(config[:provider].to_s)
+        expected_action = config[:expected_action].to_s
+        return false if !expected_action.empty? && result["action"] != expected_action
+
+        allowed_hostnames = Array(config[:allowed_hostnames]).map(&:to_s)
+        return false if allowed_hostnames.any? && !allowed_hostnames.include?(result["hostname"].to_s)
       end
 
       true

data/lib/better_auth/plugins/device_authorization.rb

@@ -15,6 +15,7 @@ module BetterAuth
       "ACCESS_DENIED" => "Access denied",
       "INVALID_USER_CODE" => "Invalid user code",
       "DEVICE_CODE_ALREADY_PROCESSED" => "Device code already processed",
+      "DEVICE_CODE_NOT_CLAIMED" => "Device code has not been claimed by a verifying session; call `GET /device` with the `user_code` while signed in before approving or denying",
       "POLLING_TOO_FREQUENTLY" => "Polling too frequently",
       "USER_NOT_FOUND" => "User not found",
       "FAILED_TO_CREATE_SESSION" => "Failed to create session",
@@ -58,6 +59,7 @@ module BetterAuth
               OpenAPI.object_schema(
                 {
                   client_id: {type: "string", description: "OAuth client ID"},
+                  user_id: {type: "string", description: "Optional user ID to pre-bind to the device code"},
                   scope: {type: "string", description: "Requested scopes"}
                 }
               )
@@ -85,6 +87,7 @@ module BetterAuth
           data: {
             "deviceCode" => device_code,
             "userCode" => user_code,
+            "userId" => body["user_id"].to_s.empty? ? nil : body["user_id"],
             "expiresAt" => Time.now + expires_in,
             "status" => "pending",
             "pollingInterval" => interval * 1000,
@@ -162,6 +165,18 @@ module BetterAuth
           ctx.context.adapter.delete(model: "deviceCode", where: [{field: "id", value: record["id"]}])
           raise device_authorization_error("BAD_REQUEST", "access_denied", DEVICE_AUTHORIZATION_ERROR_CODES["ACCESS_DENIED"])
         when "approved"
+          claimed = ctx.context.adapter.consume_one(
+            model: "deviceCode",
+            where: [
+              {field: "deviceCode", value: body["device_code"].to_s},
+              {field: "status", value: "approved"}
+            ]
+          )
+          unless claimed && claimed["userId"]
+            raise device_authorization_error("BAD_REQUEST", "invalid_grant", DEVICE_AUTHORIZATION_ERROR_CODES["INVALID_DEVICE_CODE"])
+          end
+
+          record = OAuthProtocol.stringify_keys(claimed)
           user = ctx.context.internal_adapter.find_user_by_id(record["userId"])
           raise device_authorization_error("INTERNAL_SERVER_ERROR", "server_error", DEVICE_AUTHORIZATION_ERROR_CODES["USER_NOT_FOUND"]) unless user
 
@@ -170,7 +185,6 @@ module BetterAuth
 
           session_data = {session: session, user: user}
           ctx.context.set_new_session(session_data) if ctx.context.respond_to?(:set_new_session)
-          ctx.context.adapter.delete(model: "deviceCode", where: [{field: "id", value: record["id"]}])
           ctx.json({
             access_token: session["token"],
             token_type: "Bearer",
@@ -203,6 +217,21 @@ module BetterAuth
         record = OAuthProtocol.stringify_keys(record)
         raise device_authorization_error("BAD_REQUEST", "expired_token", DEVICE_AUTHORIZATION_ERROR_CODES["EXPIRED_USER_CODE"]) if device_authorization_time(record["expiresAt"]) <= Time.now
 
+        session = Routes.current_session(ctx, allow_nil: true)
+        if session && !record["userId"] && record["status"] == "pending"
+          claimed = ctx.context.adapter.increment_one(
+            model: "deviceCode",
+            where: [
+              {field: "id", value: record["id"]},
+              {field: "status", value: "pending"},
+              {field: "userId", value: nil}
+            ],
+            increment: {},
+            set: {"userId" => session[:user]["id"]}
+          )
+          record = OAuthProtocol.stringify_keys(claimed) if claimed
+        end
+
         ctx.json({user_code: code, status: record["status"]})
       end
     end
@@ -218,9 +247,9 @@ module BetterAuth
             requestBody: OpenAPI.json_request_body(
               OpenAPI.object_schema(
                 {
-                  user_code: {type: "string", description: "User code shown on the device"},
                   userCode: {type: "string", description: "User code shown on the device"}
-                }
+                },
+                required: ["userCode"]
               )
             ),
             responses: {
@@ -247,9 +276,9 @@ module BetterAuth
             requestBody: OpenAPI.json_request_body(
               OpenAPI.object_schema(
                 {
-                  user_code: {type: "string", description: "User code shown on the device"},
                   userCode: {type: "string", description: "User code shown on the device"}
-                }
+                },
+                required: ["userCode"]
               )
             ),
             responses: {
@@ -274,15 +303,24 @@ module BetterAuth
       record = OAuthProtocol.stringify_keys(record)
       raise device_authorization_error("BAD_REQUEST", "expired_token", DEVICE_AUTHORIZATION_ERROR_CODES["EXPIRED_USER_CODE"]) if device_authorization_time(record["expiresAt"]) <= Time.now
       raise device_authorization_error("BAD_REQUEST", "invalid_request", DEVICE_AUTHORIZATION_ERROR_CODES["DEVICE_CODE_ALREADY_PROCESSED"]) unless record["status"] == "pending"
-      if record["userId"] && record["userId"] != session[:user]["id"]
+      unless record["userId"]
+        raise device_authorization_error("BAD_REQUEST", "invalid_request", DEVICE_AUTHORIZATION_ERROR_CODES["DEVICE_CODE_NOT_CLAIMED"])
+      end
+      if record["userId"] != session[:user]["id"]
         raise device_authorization_error("FORBIDDEN", "access_denied", "You are not authorized to #{action} this device authorization")
       end
 
-      ctx.context.adapter.update(
+      updated = ctx.context.adapter.increment_one(
         model: "deviceCode",
-        where: [{field: "id", value: record["id"]}],
-        update: {"status" => status, "userId" => record["userId"] || session[:user]["id"]}
+        where: [
+          {field: "id", value: record["id"]},
+          {field: "status", value: "pending"},
+          {field: "userId", value: session[:user]["id"]}
+        ],
+        increment: {},
+        set: {"status" => status, "userId" => session[:user]["id"]}
       )
+      raise device_authorization_error("BAD_REQUEST", "invalid_request", DEVICE_AUTHORIZATION_ERROR_CODES["DEVICE_CODE_ALREADY_PROCESSED"]) unless updated
       ctx.json({success: true})
     end
 

data/lib/better_auth/plugins/dub.rb

@@ -8,7 +8,7 @@ module BetterAuth
       config = normalize_hash(options)
       oauth_plugin = dub_oauth_plugin(config[:oauth])
       endpoints = {dub_link: dub_link_endpoint(oauth_plugin)}
-      endpoints[:dub_o_auth2_callback] = oauth_plugin.endpoints.fetch(:o_auth2_callback) if oauth_plugin
+      endpoints[:dub_oauth2_callback] = oauth_plugin.endpoints.fetch(:oauth2_callback) if oauth_plugin
 
       Plugin.new(
         id: "dub",
@@ -73,7 +73,7 @@ module BetterAuth
         Routes.validate_auth_callback_url!(ctx.context, callback_url, "callbackURL")
 
         ctx.body = body.merge(provider_id: "dub", callback_url: callback_url)
-        oauth_plugin.endpoints.fetch(:o_auth2_link_account).call(ctx)
+        oauth_plugin.endpoints.fetch(:oauth2_link_account).call(ctx)
       end
     end
 

data/lib/better_auth/plugins/email_otp.rb

@@ -29,7 +29,6 @@ module BetterAuth
           verify_email_otp: verify_email_otp_endpoint(config),
           sign_in_email_otp: sign_in_email_otp_endpoint(config),
           request_password_reset_email_otp: request_password_reset_email_otp_endpoint(config),
-          forget_password_email_otp: forget_password_email_otp_endpoint(config),
           reset_password_email_otp: reset_password_email_otp_endpoint(config),
           request_email_change_email_otp: request_email_change_email_otp_endpoint(config),
           change_email_email_otp: change_email_email_otp_endpoint(config)
@@ -119,7 +118,7 @@ module BetterAuth
     end
 
     def create_verification_otp_endpoint(config)
-      Endpoint.new(method: "POST") do |ctx|
+      Endpoint.new(method: "POST", metadata: {server_only: true}) do |ctx|
         body = normalize_hash(ctx.body)
         email = body[:email].to_s.downcase
         type = body[:type].to_s
@@ -133,9 +132,9 @@ module BetterAuth
 
     def get_verification_otp_endpoint(config)
       Endpoint.new(
-        path: "/email-otp/get-verification-otp",
         method: "GET",
         metadata: {
+          server_only: true,
           openapi: {
             operationId: "getVerificationOTP",
             description: "Get a stored verification OTP when storage allows plaintext access",
@@ -326,7 +325,13 @@ module BetterAuth
         end
 
         unless user["emailVerified"]
-          user = ctx.context.internal_adapter.update_user(user["id"], emailVerified: true)
+          user = ctx.context.adapter.transaction do
+            ctx.context.internal_adapter.revoke_unproven_account_access(user["id"])
+            updated = ctx.context.internal_adapter.update_user(user["id"], emailVerified: true)
+            raise Error, "Failed to verify email-OTP user" unless updated
+
+            updated
+          end
         end
 
         session = ctx.context.internal_adapter.create_session(user["id"])
@@ -453,32 +458,6 @@ module BetterAuth
       end
     end
 
-    def forget_password_email_otp_endpoint(config)
-      Endpoint.new(
-        path: "/forget-password/email-otp",
-        method: "POST",
-        metadata: {
-          openapi: {
-            operationId: "forgetPasswordEmailOTP",
-            description: "Request a password reset OTP by email",
-            requestBody: OpenAPI.json_request_body(
-              OpenAPI.object_schema(
-                {
-                  email: {type: "string"}
-                },
-                required: ["email"]
-              )
-            ),
-            responses: {
-              "200" => OpenAPI.json_response("Password reset OTP requested", OpenAPI.status_response_schema)
-            }
-          }
-        }
-      ) do |ctx|
-        email_otp_password_reset_request(ctx, config)
-      end
-    end
-
     def reset_password_email_otp_endpoint(config)
       Endpoint.new(
         path: "/email-otp/reset-password",
@@ -524,7 +503,7 @@ module BetterAuth
         ctx.context.internal_adapter.update_user(found[:user]["id"], emailVerified: true) unless found[:user]["emailVerified"]
         callback = ctx.context.options.email_and_password[:on_password_reset]
         callback.call({user: found[:user]}, ctx.request) if callback.respond_to?(:call)
-        ctx.context.internal_adapter.delete_sessions(found[:user]["id"]) if ctx.context.options.email_and_password[:revoke_sessions_on_password_reset]
+        ctx.context.internal_adapter.delete_user_sessions(found[:user]["id"]) if ctx.context.options.email_and_password[:revoke_sessions_on_password_reset]
         ctx.json({success: true})
       end
     end
@@ -610,35 +589,40 @@ module BetterAuth
     end
 
     def email_otp_verify!(ctx, config, email:, type:, otp:, consume: true)
-      verification = ctx.context.internal_adapter.find_verification_value(email_otp_identifier(email, type))
-      raise APIError.new("BAD_REQUEST", message: EMAIL_OTP_ERROR_CODES["INVALID_OTP"]) unless verification
+      identifier = email_otp_identifier(email, type)
+      existing = ctx.context.internal_adapter.find_verification_value(identifier)
 
-      if Routes.expired_time?(verification["expiresAt"])
-        ctx.context.internal_adapter.delete_verification_value(verification["id"])
+      if existing && Routes.expired_time?(existing["expiresAt"])
+        ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
         raise APIError.new("BAD_REQUEST", message: EMAIL_OTP_ERROR_CODES["OTP_EXPIRED"])
       end
 
+      verification = ctx.context.internal_adapter.consume_verification_value(identifier)
+      raise APIError.new("BAD_REQUEST", message: EMAIL_OTP_ERROR_CODES["INVALID_OTP"]) unless verification
+
       otp_value, attempts = email_otp_split(verification["value"])
       attempts_count = attempts.to_i
       if attempts_count >= config[:allowed_attempts].to_i
-        ctx.context.internal_adapter.delete_verification_value(verification["id"])
         raise APIError.new("FORBIDDEN", message: EMAIL_OTP_ERROR_CODES["TOO_MANY_ATTEMPTS"])
       end
 
-      ctx.context.internal_adapter.delete_verification_value(verification["id"]) if consume
       unless email_otp_matches?(ctx, config, otp_value, otp)
-        if consume
-          ctx.context.internal_adapter.create_verification_value(
-            identifier: email_otp_identifier(email, type),
-            value: "#{otp_value}:#{attempts_count + 1}",
-            expiresAt: verification["expiresAt"]
-          )
-        else
-          ctx.context.internal_adapter.update_verification_value(verification["id"], value: "#{otp_value}:#{attempts_count + 1}")
-        end
+        ctx.context.internal_adapter.create_verification_value(
+          identifier: identifier,
+          value: "#{otp_value}:#{attempts_count + 1}",
+          expiresAt: verification["expiresAt"]
+        )
         raise APIError.new("BAD_REQUEST", message: EMAIL_OTP_ERROR_CODES["INVALID_OTP"])
       end
 
+      unless consume
+        ctx.context.internal_adapter.create_verification_value(
+          identifier: identifier,
+          value: verification["value"],
+          expiresAt: verification["expiresAt"]
+        )
+      end
+
       true
     end
 
@@ -763,7 +747,6 @@ module BetterAuth
         /sign-in/email-otp
         /email-otp/request-password-reset
         /email-otp/reset-password
-        /forget-password/email-otp
         /email-otp/request-email-change
         /email-otp/change-email
       ].map do |path|