better_auth 0.10.0 → 0.11.0

data/lib/better_auth/plugins/i18n.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def i18n(options = {})
+      config = normalize_i18n_options(options)
+      validate_i18n_translations!(config)
+
+      Plugin.new(
+        id: "i18n",
+        hooks: {
+          after: [
+            {
+              matcher: ->(_ctx) { true },
+              handler: ->(ctx) { apply_i18n_translation(ctx, config) }
+            }
+          ]
+        },
+        options: config
+      )
+    end
+
+    def normalize_i18n_options(options)
+      return {} unless options.is_a?(Hash)
+
+      translations = normalize_i18n_translations(fetch_i18n_option(options, :translations))
+      default_locale = fetch_i18n_option(options, :default_locale)
+      detection = normalize_i18n_detection(fetch_i18n_option(options, :detection))
+      locale_cookie = fetch_i18n_option(options, :locale_cookie) || "locale"
+      user_locale_field = fetch_i18n_option(options, :user_locale_field) || "locale"
+      get_locale = fetch_i18n_option(options, :get_locale)
+      available_locales = translations.keys
+
+      {
+        translations: translations,
+        default_locale: resolve_i18n_default_locale(default_locale, available_locales),
+        detection: detection,
+        locale_cookie: locale_cookie.to_s,
+        user_locale_field: user_locale_field.to_s,
+        get_locale: get_locale
+      }
+    end
+
+    def fetch_i18n_option(options, name)
+      snake = name.to_s
+      camel = snake.split("_").map.with_index { |part, index| index.zero? ? part : part.capitalize }.join
+      options[snake.to_sym] || options[snake] || options[camel.to_sym] || options[camel]
+    end
+
+    def normalize_i18n_translations(translations)
+      return {} unless translations.is_a?(Hash)
+
+      translations.each_with_object({}) do |(locale, codes), result|
+        locale_key = locale.to_s
+        next if locale_key.empty?
+
+        normalized_codes = {}
+        next unless codes.is_a?(Hash)
+
+        codes.each do |(code, message)|
+          normalized_codes[code.to_s.tr("-", "_").upcase] = message
+        end
+        result[locale_key] = normalized_codes
+      end
+    end
+
+    def normalize_i18n_detection(detection)
+      return ["header"] if detection.nil?
+
+      Array(detection).map { |strategy| strategy.to_s.downcase }
+    end
+
+    def validate_i18n_translations!(config)
+      translations = config[:translations]
+      if translations.nil? || translations.empty?
+        raise BetterAuth::Error, "i18n plugin: translations object is empty"
+      end
+    end
+
+    def resolve_i18n_default_locale(explicit, available_locales)
+      explicit_locale = explicit.to_s
+      return explicit_locale if explicit && available_locales.include?(explicit_locale)
+      return "en" if available_locales.include?("en")
+
+      nil
+    end
+
+    def parse_accept_language(header)
+      return [] if header.nil? || header.to_s.empty?
+
+      header.to_s
+        .split(",")
+        .map do |part|
+          locale_str, quality = part.strip.split(";", 2)
+          q_string = quality ? quality.strip.sub(/\Aq=/i, "") : "1"
+          q = Float(q_string)
+          locale = locale_str.to_s.strip.split("-").first.to_s
+          {locale: locale, q: q}
+        end
+        .select { |item| !item[:locale].empty? }
+        .sort_by { |item| -item[:q] }
+        .map { |item| item[:locale] }
+    end
+
+    def detect_i18n_locale(ctx, config)
+      available_locales = config[:translations].keys
+
+      config[:detection].each do |strategy|
+        locale = case strategy
+        when "header"
+          detect_locale_from_header(ctx, available_locales)
+        when "cookie"
+          detect_locale_from_cookie(ctx, config, available_locales)
+        when "session"
+          detect_locale_from_session(ctx, config, available_locales)
+        when "callback"
+          detect_locale_from_callback(ctx, config, available_locales)
+        end
+        return locale if locale && available_locales.include?(locale)
+      end
+
+      config[:default_locale]
+    end
+
+    def detect_locale_from_header(ctx, available_locales)
+      parse_accept_language(ctx.headers["accept-language"]).find do |locale|
+        available_locales.include?(locale)
+      end
+    end
+
+    def detect_locale_from_cookie(ctx, config, available_locales)
+      value = ctx.get_cookie(config[:locale_cookie])
+      locale = value.to_s
+      locale if value && available_locales.include?(locale)
+    end
+
+    def detect_locale_from_session(ctx, config, available_locales)
+      session = ctx.context.current_session || ctx.context.new_session
+      return nil unless session
+
+      user = session[:user] || session["user"]
+      return nil unless user.is_a?(Hash)
+
+      locale = fetch_value(user, config[:user_locale_field])
+      locale = locale.to_s
+      locale if locale && !locale.empty? && available_locales.include?(locale)
+    end
+
+    def detect_locale_from_callback(ctx, config, available_locales)
+      callback = config[:get_locale]
+      return nil unless callback.respond_to?(:call)
+
+      locale = callback.call(ctx)
+      locale = locale.to_s
+      locale if locale && !locale.empty? && available_locales.include?(locale)
+    end
+
+    def apply_i18n_translation(ctx, config)
+      error = ctx.returned
+      return nil unless error.is_a?(BetterAuth::APIError)
+
+      error_code = resolve_i18n_error_code(error, ctx)
+      return nil unless error_code
+
+      locale = detect_i18n_locale(ctx, config)
+      translation = config.dig(:translations, locale, error_code)
+      return nil unless translation
+
+      raise BetterAuth::APIError.new(
+        error.status,
+        message: translation,
+        headers: error.headers,
+        code: error.code,
+        body: {
+          code: error_code,
+          message: translation,
+          originalMessage: error.message
+        }
+      )
+    end
+
+    def resolve_i18n_error_code(error, ctx)
+      body = error.body
+      if body.is_a?(Hash)
+        code = body[:code] || body["code"]
+        return code.to_s.tr("-", "_").upcase if code
+      end
+
+      unless error.code.to_s.upcase == error.status.to_s.upcase
+        return error.code.to_s.tr("-", "_").upcase
+      end
+
+      reverse_lookup_i18n_error_code(error.message, ctx)
+    end
+
+    def reverse_lookup_i18n_error_code(message, ctx)
+      merged_i18n_error_catalog(ctx).find { |_code, text| text == message }&.first
+    end
+
+    def merged_i18n_error_catalog(ctx)
+      catalog = BetterAuth::BASE_ERROR_CODES.dup
+      ctx.context.options.plugins.each do |plugin|
+        next unless plugin.respond_to?(:error_codes)
+
+        codes = plugin.error_codes
+        next if codes.nil? || codes.empty?
+
+        catalog.merge!(codes)
+      end
+      catalog
+    end
+  end
+end

data/lib/better_auth/plugins/jwt.rb

@@ -8,6 +8,8 @@ module BetterAuth
   module Plugins
     module JWT
       SUPPORTED_ALGORITHMS = %w[EdDSA RS256 PS256 ES256 ES512].freeze
+      LocalJwksCache = Struct.new(:keys, :expires_at)
+      RemoteJwksCache = Struct.new(:entries)
 
       module_function
 
@@ -42,6 +44,10 @@ module BetterAuth
     def jwt(options = {})
       config = normalize_hash(options)
       validate_jwt_options!(config)
+      # Mutable caches are owned by this plugin configuration, which is scoped
+      # to one auth instance even when endpoint overrides are merged.
+      config[:local_jwks_cache] = JWT::LocalJwksCache.new
+      config[:remote_jwks_cache] = JWT::RemoteJwksCache.new({})
       jwks_path = config.dig(:jwks, :jwks_path) || "/jwks"
 
       Plugin.new(
@@ -206,8 +212,8 @@ module BetterAuth
       payload = stringify_payload(payload).dup
       payload["iat"] ||= now
       payload["exp"] ||= jwt_expiration(jwt_config[:expiration_time] || "15m", payload["iat"])
-      payload["iss"] ||= jwt_config[:issuer] || ctx.context.base_url
-      payload["aud"] ||= jwt_config[:audience] || ctx.context.base_url
+      payload["iss"] ||= jwt_config[:issuer] || ctx.context.canonical_base_url
+      payload["aud"] ||= jwt_config[:audience] || ctx.context.canonical_base_url
 
       return jwt_config[:sign].call(payload) if jwt_config[:sign].respond_to?(:call)
 
@@ -227,9 +233,9 @@ module BetterAuth
 
       options = {
         algorithm: key["alg"] || "RS256",
-        iss: config.dig(:jwt, :issuer) || ctx.context.base_url,
+        iss: config.dig(:jwt, :issuer) || ctx.context.canonical_base_url,
         verify_iss: true,
-        aud: config.dig(:jwt, :audience) || ctx.context.base_url,
+        aud: config.dig(:jwt, :audience) || ctx.context.canonical_base_url,
         verify_aud: true
       }
       decoded, = ::JWT.decode(token.to_s, JWT.public_key(key), true, options)
@@ -239,7 +245,7 @@ module BetterAuth
     end
 
     def latest_jwk(ctx, config)
-      all_jwks(ctx, config).max_by { |entry| normalize_time(entry["createdAt"]) || Time.at(0) }
+      all_jwks(ctx, config, force_refresh: true).max_by { |entry| normalize_time(entry["createdAt"]) || Time.at(0) }
     end
 
     def signing_jwk(ctx, config)
@@ -258,13 +264,21 @@ module BetterAuth
       end
     end
 
-    def all_jwks(ctx, config)
-      adapter = config[:adapter]
-      if adapter && adapter[:get_jwks].respond_to?(:call)
-        return Array(adapter[:get_jwks].call(ctx)).map { |entry| stringify_payload(entry) }
+    def all_jwks(ctx, config, force_refresh: false)
+      cache = config[:local_jwks_cache] ||= JWT::LocalJwksCache.new
+      if !force_refresh && cache.expires_at && cache.expires_at > Time.now
+        return cache.keys
       end
 
-      ctx.context.adapter.find_many(model: "jwks")
+      adapter = config[:adapter]
+      keys = if adapter && adapter[:get_jwks].respond_to?(:call)
+        Array(adapter[:get_jwks].call(ctx)).map { |entry| stringify_payload(entry) }
+      else
+        ctx.context.adapter.find_many(model: "jwks")
+      end
+      cache.keys = keys
+      cache.expires_at = Time.now + 300
+      keys
     end
 
     def verification_jwks(ctx, config)
@@ -280,13 +294,13 @@ module BetterAuth
       payload = if fetcher.respond_to?(:call)
         fetcher.call(url)
       else
-        cached = @jwt_remote_jwks_cache ||= {}
-        entry = cached[url.to_s]
+        cached = config[:remote_jwks_cache] ||= JWT::RemoteJwksCache.new({})
+        entry = cached.entries[url.to_s]
         if entry && entry[:expires_at] > Time.now
           entry[:payload]
         else
           fetched = HTTPClient.get_json(url)
-          cached[url.to_s] = {payload: fetched, expires_at: Time.now + 300} if fetched
+          cached.entries[url.to_s] = {payload: fetched, expires_at: Time.now + 300} if fetched
           fetched
         end
       end
@@ -320,11 +334,15 @@ module BetterAuth
       data.merge!(public_key_jwk_fields(public_key, alg))
       data["expiresAt"] = Time.now + config.dig(:jwks, :rotation_interval).to_i if config.dig(:jwks, :rotation_interval)
 
-      if adapter && adapter[:create_jwk].respond_to?(:call)
-        return stringify_payload(adapter[:create_jwk].call(data, ctx))
+      created = if adapter && adapter[:create_jwk].respond_to?(:call)
+        stringify_payload(adapter[:create_jwk].call(data, ctx))
+      else
+        ctx.context.adapter.create(model: "jwks", data: data, force_allow_id: true)
       end
-
-      ctx.context.adapter.create(model: "jwks", data: data, force_allow_id: true)
+      cache = config[:local_jwks_cache]
+      cache.keys = nil if cache
+      cache.expires_at = nil if cache
+      created
     end
 
     def public_jwk(key, _config)
@@ -448,8 +466,8 @@ module BetterAuth
       payload = JSON.parse(Crypto.base64url_decode(payload_segment))
       now = Time.now.to_i
       return nil if payload["exp"] && payload["exp"].to_i <= now
-      issuer = config.dig(:jwt, :issuer) || ctx.context.base_url
-      audience = config.dig(:jwt, :audience) || ctx.context.base_url
+      issuer = config.dig(:jwt, :issuer) || ctx.context.canonical_base_url
+      audience = config.dig(:jwt, :audience) || ctx.context.canonical_base_url
       return nil if issuer && payload["iss"] != issuer
       return nil if audience && Array(payload["aud"]).map(&:to_s).none?(audience.to_s)
       return nil unless jwt_payload_valid?(payload)

data/lib/better_auth/plugins/magic_link.rb

@@ -9,6 +9,9 @@ module BetterAuth
 
     def magic_link(options = {})
       config = {store_token: "plain", allowed_attempts: 1}.merge(normalize_hash(options))
+      if options.key?(:allowed_attempts) && options[:allowed_attempts] != 1
+        warn "[better-auth/magic-link] `allowed_attempts` is ignored: tokens are consumed atomically on the first verification call. Any value other than `1` has no effect; remove the option to silence this warning."
+      end
 
       Plugin.new(
         id: "magic-link",
@@ -54,6 +57,9 @@ module BetterAuth
           }
         }
       ) do |ctx|
+        sender = config[:send_magic_link]
+        link_base_url = ctx.context.base_url
+        link_base_url = ctx.context.token_link_base_url if sender.respond_to?(:call)
         body = normalize_hash(ctx.body)
         email = body[:email].to_s.downcase
         raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_EMAIL"]) unless Routes::EMAIL_PATTERN.match?(email)
@@ -66,8 +72,7 @@ module BetterAuth
           expiresAt: Time.now + (config[:expires_in] || 60 * 5).to_i
         )
 
-        link = magic_link_url(ctx, token, body)
-        sender = config[:send_magic_link]
+        link = magic_link_url(link_base_url, token, body)
         data = {email: email, url: link, token: token}
         data[:metadata] = body[:metadata] if body.key?(:metadata)
         sender.call(data, ctx) if sender.respond_to?(:call)
@@ -129,26 +134,12 @@ module BetterAuth
         end
 
         stored_token = store_magic_link_token(token, config)
-        verification = ctx.context.internal_adapter.find_verification_value(stored_token)
+        verification = ctx.context.internal_adapter.consume_verification_value(stored_token)
         redirect_with_error.call("INVALID_TOKEN") unless verification
 
-        if Routes.expired_time?(verification["expiresAt"])
-          ctx.context.internal_adapter.delete_verification_value(verification["id"])
-          redirect_with_error.call("EXPIRED_TOKEN")
-        end
-
         payload = JSON.parse(verification["value"])
         email = payload.fetch("email").to_s.downcase
         name = payload["name"]
-        attempt = payload["attempt"].to_i
-        if magic_link_attempts_exceeded?(attempt, config)
-          ctx.context.internal_adapter.delete_verification_value(verification["id"])
-          redirect_with_error.call("ATTEMPTS_EXCEEDED")
-        end
-        ctx.context.internal_adapter.update_verification_value(
-          verification["id"],
-          value: JSON.generate(payload.merge("attempt" => attempt + 1))
-        )
         found = ctx.context.internal_adapter.find_user_by_email(email)
         user = found && found[:user]
         new_user = false
@@ -167,7 +158,13 @@ module BetterAuth
         end
 
         unless user["emailVerified"]
-          user = ctx.context.internal_adapter.update_user(user["id"], emailVerified: true)
+          user = ctx.context.adapter.transaction do
+            ctx.context.internal_adapter.revoke_unproven_account_access(user["id"])
+            updated = ctx.context.internal_adapter.update_user(user["id"], emailVerified: true)
+            raise Error, "Failed to verify magic-link user" unless updated
+
+            updated
+          end
         end
 
         session = ctx.context.internal_adapter.create_session(user["id"])
@@ -192,7 +189,7 @@ module BetterAuth
       generator = config[:generate_token]
       return generator.call(email) if generator.respond_to?(:call)
 
-      Array.new(32) { [*"a".."z", *"A".."Z"].sample }.join
+      Crypto.random_string(32, alphabet: Crypto::ALPHABETIC_ALPHABET)
     end
 
     def magic_link_attempts_exceeded?(attempt, config)
@@ -214,14 +211,14 @@ module BetterAuth
       token
     end
 
-    def magic_link_url(ctx, token, body)
+    def magic_link_url(base_url, token, body)
       params = {
         token: token,
         callbackURL: body[:callback_url] || "/"
       }
       params[:newUserCallbackURL] = body[:new_user_callback_url] if body[:new_user_callback_url]
       params[:errorCallbackURL] = body[:error_callback_url] if body[:error_callback_url]
-      "#{ctx.context.base_url}/magic-link/verify?#{URI.encode_www_form(params)}"
+      "#{base_url}/magic-link/verify?#{URI.encode_www_form(params)}"
     end
 
     def validate_magic_link_callback!(ctx, value, label)