better_auth 0.3.0 → 0.4.0

data/lib/better_auth/oauth2.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require "base64"
+require "net/http"
+require "uri"
+require "jwt"
+
+module BetterAuth
+  module OAuth2
+    module_function
+
+    def validate_token(token, jwks:, audience: nil, issuer: nil)
+      header = JWT.decode(token, nil, false).last
+      kid = header["kid"]
+      raise APIError.new("UNAUTHORIZED", message: "Missing jwt kid") if kid.to_s.empty?
+
+      key_data = Array(jwks["keys"] || jwks[:keys]).find { |key| (key["kid"] || key[:kid]).to_s == kid.to_s }
+      raise APIError.new("UNAUTHORIZED", message: "kid doesn't match any key") unless key_data
+
+      public_key = JWT::JWK.import(stringify_keys(key_data)).public_key
+      algorithm = header["alg"] || key_data["alg"] || key_data[:alg]
+      options = {algorithm: algorithm}
+      options[:aud] = audience if audience
+      options[:verify_aud] = true if audience
+      options[:iss] = issuer if issuer
+      options[:verify_iss] = true if issuer
+      JWT.decode(token, public_key, true, **options).first
+    rescue JWT::DecodeError => error
+      raise APIError.new("UNAUTHORIZED", message: error.message)
+    end
+
+    def refresh_access_token(refresh_token:, token_endpoint:, options:, authentication: nil, extra_params: nil, resource: nil, fetcher: nil)
+      request = create_refresh_access_token_request(
+        refresh_token: refresh_token,
+        options: options,
+        authentication: authentication,
+        extra_params: extra_params,
+        resource: resource
+      )
+      data = fetcher ? fetcher.call(token_endpoint, request) : post_form(token_endpoint, request)
+      now = Time.now
+      tokens = {
+        access_token: data["access_token"] || data[:access_token],
+        refresh_token: data["refresh_token"] || data[:refresh_token],
+        token_type: data["token_type"] || data[:token_type],
+        scopes: (data["scope"] || data[:scope])&.split(" "),
+        id_token: data["id_token"] || data[:id_token]
+      }.compact
+
+      expires_in = data["expires_in"] || data[:expires_in]
+      tokens[:access_token_expires_at] = now + expires_in.to_i if expires_in
+
+      refresh_expires_in = data["refresh_token_expires_in"] || data[:refresh_token_expires_in]
+      tokens[:refresh_token_expires_at] = now + refresh_expires_in.to_i if refresh_expires_in
+      tokens
+    end
+
+    def create_refresh_access_token_request(refresh_token:, options:, authentication: nil, extra_params: nil, resource: nil)
+      body = {
+        "grant_type" => "refresh_token",
+        "refresh_token" => refresh_token
+      }
+      headers = {
+        "content-type" => "application/x-www-form-urlencoded",
+        "accept" => "application/json"
+      }
+      client_id = Array(options[:client_id] || options["client_id"] || options[:clientId] || options["clientId"]).first
+      client_secret = options[:client_secret] || options["client_secret"] || options[:clientSecret] || options["clientSecret"]
+
+      if authentication.to_s == "basic"
+        headers["authorization"] = "Basic #{Base64.strict_encode64("#{client_id}:#{client_secret}")}"
+      else
+        body["client_id"] = client_id if client_id
+        body["client_secret"] = client_secret if client_secret
+      end
+
+      Array(resource).each { |entry| (body["resource"] ||= []) << entry } if resource
+      extra_params&.each { |key, value| body[key.to_s] = value }
+      {body: body, headers: headers}
+    end
+
+    def post_form(token_endpoint, request)
+      uri = URI.parse(token_endpoint)
+      response = Net::HTTP.post(uri, URI.encode_www_form(request[:body]), request[:headers])
+      JSON.parse(response.body)
+    end
+
+    def stringify_keys(hash)
+      hash.each_with_object({}) do |(key, value), result|
+        result[key.to_s] = value.is_a?(Hash) ? stringify_keys(value) : value
+      end
+    end
+  end
+end

data/lib/better_auth/plugins/email_otp.rb

@@ -193,9 +193,9 @@ module BetterAuth
         user = if found
           found[:user]
         else
-          raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["USER_NOT_FOUND"]) if config[:disable_sign_up]
+          raise APIError.new("BAD_REQUEST", message: EMAIL_OTP_ERROR_CODES["INVALID_OTP"]) if config[:disable_sign_up]
 
-          ctx.context.internal_adapter.create_user(email_otp_sign_up_user_data(body, email))
+          ctx.context.internal_adapter.create_user(email_otp_sign_up_user_data(ctx, body, email))
         end
 
         unless user["emailVerified"]
@@ -419,10 +419,21 @@ module BetterAuth
       Array.new(config[:otp_length].to_i) { SecureRandom.random_number(10).to_s }.join
     end
 
-    def email_otp_sign_up_user_data(body, email)
+    def email_otp_sign_up_user_data(ctx, body, email)
       reserved = %i[email otp name image callback_url callbackURL callbackUrl]
-      additional = body.reject { |key, _value| reserved.include?(key.to_sym) }
-      additional = additional.each_with_object({}) { |(key, value), result| result[Schema.storage_key(key)] = value }
+      user_fields = Schema.auth_tables(ctx.context.options).fetch("user").fetch(:fields)
+      core_fields = %w[id name email emailVerified image createdAt updatedAt]
+      additional = body.each_with_object({}) do |(key, value), result|
+        next if reserved.include?(key.to_sym)
+
+        field = Schema.storage_key(key)
+        attributes = user_fields[field]
+        next unless attributes
+        next if core_fields.include?(field)
+        next if attributes[:input] == false
+
+        result[field] = value
+      end
       additional.merge(
         "email" => email,
         "emailVerified" => true,

data/lib/better_auth/plugins/generic_oauth.rb

@@ -52,19 +52,7 @@ module BetterAuth
         data,
         provider_id: "auth0",
         discovery_url: "https://#{domain}/.well-known/openid-configuration",
-        scopes: ["openid", "profile", "email"],
-        get_user_info: ->(tokens) {
-          profile = generic_oauth_fetch_json("https://#{domain}/userinfo", authorization: "Bearer #{fetch_value(tokens, "accessToken")}")
-          return nil unless profile
-
-          {
-            id: fetch_value(profile, "sub"),
-            name: fetch_value(profile, "name") || fetch_value(profile, "nickname"),
-            email: fetch_value(profile, "email"),
-            image: fetch_value(profile, "picture"),
-            emailVerified: fetch_value(profile, "email_verified") || false
-          }
-        }
+        scopes: ["openid", "profile", "email"]
       )
     end
 
@@ -688,24 +676,12 @@ module BetterAuth
       nil
     end
 
-    def generic_oidc_helper_provider(options, provider_id, issuer, discovery_url, user_info_url)
+    def generic_oidc_helper_provider(options, provider_id, issuer, discovery_url, _user_info_url)
       generic_oauth_provider_config(
         options,
         provider_id: provider_id,
         discovery_url: discovery_url,
-        scopes: ["openid", "profile", "email"],
-        get_user_info: ->(tokens) {
-          profile = generic_oauth_fetch_json(user_info_url, authorization: "Bearer #{fetch_value(tokens, "accessToken")}")
-          return nil unless profile
-
-          {
-            id: fetch_value(profile, "sub"),
-            name: fetch_value(profile, "name") || fetch_value(profile, "preferred_username"),
-            email: fetch_value(profile, "email"),
-            image: fetch_value(profile, "picture"),
-            emailVerified: fetch_value(profile, "email_verified") || false
-          }
-        }
+        scopes: ["openid", "profile", "email"]
       )
     end
 
@@ -730,12 +706,22 @@ module BetterAuth
         result[provider_id.to_sym] = {
           id: provider_id,
           name: provider_id,
-          get_user_info: ->(tokens) { generic_oauth_user_info(provider, tokens) },
+          get_user_info: ->(tokens) { generic_oauth_provider_user_info(provider, tokens) },
           refresh_access_token: ->(refresh_token) { generic_oauth_refresh_access_token(context, provider, refresh_token) }
         }
       end
     end
 
+    def generic_oauth_provider_user_info(provider, tokens)
+      user_info = generic_oauth_user_info(provider, tokens)
+      return nil unless user_info
+
+      {
+        user: generic_oauth_map_user(provider, user_info),
+        data: user_info
+      }
+    end
+
     def generic_oauth_refresh_access_token(ctx, provider, refresh_token)
       token_url = provider[:token_url] || generic_oauth_discovery(provider)["token_endpoint"]
       raise APIError.new("BAD_REQUEST", message: GENERIC_OAUTH_ERROR_CODES["TOKEN_URL_NOT_FOUND"]) if token_url.to_s.empty?

data/lib/better_auth/plugins/oauth_protocol.rb

@@ -63,13 +63,15 @@ module BetterAuth
       def loopback_redirect_match?(redirects, redirect_uri)
         requested = URI.parse(redirect_uri.to_s)
         return false unless ["http", "https"].include?(requested.scheme)
-        return false unless loopback_host?(requested.host)
+        requested_host = requested.hostname || requested.host
+        return false unless loopback_host?(requested_host)
 
         redirects.any? do |allowed|
           allowed_uri = URI.parse(allowed.to_s)
+          allowed_host = allowed_uri.hostname || allowed_uri.host
           allowed_uri.scheme == requested.scheme &&
-            loopback_host?(allowed_uri.host) &&
-            allowed_uri.host == requested.host &&
+            loopback_host?(allowed_host) &&
+            allowed_host == requested_host &&
             allowed_uri.path == requested.path &&
             allowed_uri.query == requested.query
         rescue URI::InvalidURIError
@@ -97,7 +99,7 @@ module BetterAuth
         value.to_s.split(",").map(&:strip).reject(&:empty?)
       end
 
-      def create_client(ctx, model:, body:, owner_session: nil, default_auth_method: "client_secret_basic", store_client_secret: "plain", unauthenticated: false, default_scopes: nil, allowed_scopes: nil, prefix: {}, dynamic_registration: false, admin: false)
+      def create_client(ctx, model:, body:, owner_session: nil, default_auth_method: "client_secret_basic", store_client_secret: "plain", unauthenticated: false, default_scopes: nil, allowed_scopes: nil, prefix: {}, dynamic_registration: false, admin: false, pairwise_secret: nil, strip_client_metadata: false, reference_id: nil)
         body = stringify_keys(body || {})
         requested_auth_method = body["token_endpoint_auth_method"] || default_auth_method
         validate_client_metadata_enums!(requested_auth_method, body)
@@ -108,10 +110,13 @@ module BetterAuth
         client_secret = public_client ? nil : Crypto.random_string(32)
         redirects = Array(body["redirect_uris"]).map(&:to_s)
         raise APIError.new("BAD_REQUEST", message: "redirect_uris is required") if redirects.empty?
+        redirects.each { |uri| validate_safe_url!(uri, field: "redirect_uris") }
+        Array(body["post_logout_redirect_uris"]).map(&:to_s).each { |uri| validate_safe_url!(uri, field: "post_logout_redirect_uris") }
 
         grant_types = Array(body["grant_types"] || [AUTH_CODE_GRANT]).map(&:to_s)
         response_types = Array(body["response_types"] || ["code"]).map(&:to_s)
         validate_client_registration!(auth_method, grant_types, response_types, body, unauthenticated: unauthenticated, dynamic_registration: dynamic_registration)
+        validate_pairwise_client!(body, redirects, pairwise_secret)
 
         scopes = parse_scopes(body["scope"] || body["scopes"])
         scopes = parse_scopes(default_scopes) if scopes.empty? && default_scopes
@@ -120,7 +125,7 @@ module BetterAuth
           raise APIError.new("BAD_REQUEST", message: "invalid_scope")
         end
 
-        metadata = stringify_keys(body["metadata"] || {})
+        metadata = client_metadata(body, strip_unknown: strip_client_metadata)
         metadata["software_id"] = body["software_id"] if body["software_id"]
         metadata["software_version"] = body["software_version"] if body["software_version"]
         metadata["software_statement"] = body["software_statement"] if body["software_statement"]
@@ -163,7 +168,8 @@ module BetterAuth
           "metadata" => metadata,
           "disabled" => false
         }
-        data["userId"] = owner_session[:user]["id"] if owner_session
+        data["referenceId"] = reference_id if reference_id
+        data["userId"] = owner_session[:user]["id"] if owner_session && !reference_id
         created = ctx.context.adapter.create(model: model, data: data)
         response = client_response(created).merge(
           client_secret: client_secret ? apply_prefix(client_secret, prefix, :client_secret) : nil,
@@ -192,7 +198,7 @@ module BetterAuth
           type: data["type"],
           user_id: data["userId"],
           reference_id: data["referenceId"],
-          require_pkce: data["requirePKCE"],
+          require_pkce: client_require_pkce(data),
           subject_type: data["subjectType"],
           metadata: metadata,
           contacts: data["contacts"] || [],
@@ -214,6 +220,9 @@ module BetterAuth
         if dynamic_registration && (body["require_pkce"] == false || body["requirePKCE"] == false)
           raise APIError.new("BAD_REQUEST", message: "pkce is required for registered clients")
         end
+        if dynamic_registration && (body["enable_end_session"] || body["enableEndSession"])
+          raise APIError.new("BAD_REQUEST", message: "enable_end_session is not allowed during dynamic client registration")
+        end
         if public_client && grant_types.include?(CLIENT_CREDENTIALS_GRANT)
           raise APIError.new("BAD_REQUEST", message: "public clients cannot use client_credentials")
         end
@@ -228,6 +237,53 @@ module BetterAuth
         end
       end
 
+      def validate_pairwise_client!(body, redirects, pairwise_secret)
+        subject_type = body["subject_type"] || body["subjectType"]
+        return unless subject_type == "pairwise"
+
+        raise APIError.new("BAD_REQUEST", message: "pairwise subject_type requires pairwise_secret") if pairwise_secret.to_s.empty?
+
+        hosts = redirects.map { |uri| URI.parse(uri).host }.uniq
+        raise APIError.new("BAD_REQUEST", message: "pairwise redirect_uris must share the same host") if hosts.length > 1
+      rescue URI::InvalidURIError
+        raise APIError.new("BAD_REQUEST", message: "invalid redirect_uris")
+      end
+
+      def validate_safe_url!(value, field:)
+        raise APIError.new("BAD_REQUEST", message: "#{field} is invalid") if value.to_s.empty?
+
+        uri = URI.parse(value.to_s)
+        scheme = uri.scheme.to_s.downcase
+        raise APIError.new("BAD_REQUEST", message: "#{field} is invalid") if scheme.empty?
+        raise APIError.new("BAD_REQUEST", message: "#{field} is invalid") if %w[javascript data vbscript].include?(scheme)
+
+        if scheme == "http"
+          raise APIError.new("BAD_REQUEST", message: "#{field} is invalid") unless ["localhost", "127.0.0.1", "::1"].include?(uri.hostname || uri.host)
+        end
+        true
+      rescue URI::InvalidURIError
+        raise APIError.new("BAD_REQUEST", message: "#{field} is invalid")
+      end
+
+      def client_metadata(body, strip_unknown: false)
+        metadata = stringify_keys(body["metadata"] || {})
+        metadata = metadata.slice("software_id", "software_version", "software_statement", "tos_uri", "policy_uri") if strip_unknown
+        metadata["software_id"] = body["software_id"] if body["software_id"]
+        metadata["software_version"] = body["software_version"] if body["software_version"]
+        metadata["software_statement"] = body["software_statement"] if body["software_statement"]
+        metadata["tos_uri"] = body["tos_uri"] if body["tos_uri"]
+        metadata["policy_uri"] = body["policy_uri"] if body["policy_uri"]
+        metadata
+      end
+
+      def client_require_pkce(data)
+        data = stringify_keys(data || {})
+        return data["requirePKCE"] if data.key?("requirePKCE")
+        return data["requirePkce"] if data.key?("requirePkce")
+
+        nil
+      end
+
       def validate_client_metadata_enums!(auth_method, body)
         unless ["client_secret_basic", "client_secret_post", "none"].include?(auth_method)
           raise APIError.new("BAD_REQUEST", message: "invalid token_endpoint_auth_method")
@@ -309,7 +365,11 @@ module BetterAuth
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") if data[:expires_at] <= Time.now
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data[:client_id] == client_id.to_s
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data[:redirect_uri] == redirect_uri.to_s
-        verify_pkce!(data, code_verifier) if data[:code_challenge]
+        if data[:code_challenge]
+          verify_pkce!(data, code_verifier)
+        elsif !code_verifier.to_s.empty?
+          raise APIError.new("BAD_REQUEST", message: "invalid_grant")
+        end
 
         data
       end
@@ -337,12 +397,13 @@ module BetterAuth
       def pkce_required?(client, scopes)
         data = stringify_keys(client)
         return true if parse_scopes(scopes).include?("offline_access")
-        return data["requirePKCE"] unless data["requirePKCE"].nil?
+        require_pkce = client_require_pkce(data)
+        return require_pkce unless require_pkce.nil?
 
         true
       end
 
-      def issue_tokens(ctx, store, model:, client:, session:, scopes:, include_refresh: false, issuer: nil, jwt_audience: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_signer: nil, prefix: {}, audience: nil, grant_type: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, jwt_access_token: false, pairwise_secret: nil, nonce: nil, auth_time: nil, reference_id: nil)
+      def issue_tokens(ctx, store, model:, client:, session:, scopes:, include_refresh: false, issuer: nil, jwt_audience: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_signer: nil, prefix: {}, audience: nil, grant_type: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, pairwise_secret: nil, nonce: nil, auth_time: nil, reference_id: nil, filter_id_token_claims_by_scope: false)
         data = stringify_keys(session || {})
         user = stringify_keys(data["user"] || data[:user] || {})
         session_data = stringify_keys(data["session"] || data[:session] || {})
@@ -372,7 +433,11 @@ module BetterAuth
             "expiresAt" => Time.now + refresh_token_expires_in.to_i,
             "createdAt" => Time.now,
             "revoked" => nil,
-            "scopes" => parse_scopes(scope)
+            "scopes" => parse_scopes(scope),
+            "subject" => subject,
+            "audience" => audience,
+            "issuer" => issuer || issuer(ctx),
+            "issuedAt" => Time.now
           }
           created_refresh = schema_model?(ctx, "oauthRefreshToken") ? ctx.context.adapter.create(model: "oauthRefreshToken", data: refresh_record) : nil
           refresh_record = refresh_record.merge("id" => stringify_keys(created_refresh || {})["id"], "user" => user, "session" => session_data, "client" => client_data, "scope" => scope)
@@ -392,7 +457,9 @@ module BetterAuth
             "referenceId" => token_reference_id,
             "authTime" => token_auth_time,
             "refreshId" => refresh_record && refresh_record["id"],
-            "audience" => audience
+            "audience" => audience,
+            "issuer" => issuer || issuer(ctx),
+            "issuedAt" => Time.now
           }
           ctx.context.adapter.create(model: model, data: record)
           stored_record = record.merge("user" => user, "session" => session_data, "client" => client_data)
@@ -404,19 +471,20 @@ module BetterAuth
           access_token: access_token,
           token_type: "Bearer",
           expires_in: access_token_expires_in.to_i,
+          expires_at: expires_at.to_i,
           scope: scope
         }
         response[:audience] = audience if audience
         response[:refresh_token] = refresh_token if refresh_token
-        response[:id_token] = id_token(user.merge("id" => subject), client_data["clientId"], issuer || issuer(ctx), jwt_audience || client_data["clientId"], ctx: ctx, signer: id_token_signer, session_id: session_data["id"], include_sid: !!client_data["enableEndSession"], nonce: nonce, auth_time: token_auth_time) if parse_scopes(scope).include?("openid")
+        response[:id_token] = id_token(user.merge("id" => subject), client_data["clientId"], issuer || issuer(ctx), jwt_audience || client_data["clientId"], ctx: ctx, signer: id_token_signer, session_id: session_data["id"], include_sid: !!client_data["enableEndSession"], nonce: nonce, auth_time: token_auth_time, custom_claims: custom_id_token_claims, scopes: parse_scopes(scope), client: client_data, filter_claims_by_scope: filter_id_token_claims_by_scope) if parse_scopes(scope).include?("openid")
         if custom_token_response_fields.respond_to?(:call)
           extra = custom_token_response_fields.call({grant_type: grant_type, user: user.empty? ? nil : user, scopes: parse_scopes(scope), metadata: stringify_keys(client_data["metadata"] || {})})
-          response.merge!(extra) if extra.is_a?(Hash)
+          response.merge!(stringify_keys(extra).reject { |key, _value| standard_token_response_field?(key) }.transform_keys(&:to_sym)) if extra.is_a?(Hash)
         end
         response
       end
 
-      def refresh_tokens(ctx, store, model:, client:, refresh_token:, scopes: nil, issuer: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_signer: nil, prefix: {}, audience: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, jwt_access_token: false, pairwise_secret: nil)
+      def refresh_tokens(ctx, store, model:, client:, refresh_token:, scopes: nil, issuer: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_signer: nil, prefix: {}, audience: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, pairwise_secret: nil, filter_id_token_claims_by_scope: false)
         refresh_token_value = strip_prefix(refresh_token, prefix, :refresh_token)
         data = refresh_token_value ? store[:refresh_tokens][refresh_token_value] : nil
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data
@@ -450,10 +518,12 @@ module BetterAuth
           grant_type: REFRESH_GRANT,
           custom_token_response_fields: custom_token_response_fields,
           custom_access_token_claims: custom_access_token_claims,
+          custom_id_token_claims: custom_id_token_claims,
           jwt_access_token: jwt_access_token,
           pairwise_secret: pairwise_secret,
           auth_time: data["authTime"],
-          reference_id: data["referenceId"]
+          reference_id: data["referenceId"],
+          filter_id_token_claims_by_scope: filter_id_token_claims_by_scope
         )
       end
 
@@ -478,6 +548,9 @@ module BetterAuth
           "azp" => client["clientId"],
           "scope" => scope,
           "sid" => session["id"],
+          "name" => user["name"],
+          "email" => user["email"],
+          "email_verified" => user["emailVerified"],
           "iss" => issuer_value,
           "iat" => Time.now.to_i,
           "exp" => expires_at.to_i
@@ -485,13 +558,20 @@ module BetterAuth
         ::JWT.encode(payload, ctx.context.secret, "HS256")
       end
 
-      def userinfo(store, authorization, additional_claim: nil, prefix: {})
+      def userinfo(store, authorization, additional_claim: nil, prefix: {}, jwt_secret: nil)
+        if authorization.to_s.strip.empty?
+          raise APIError.new(
+            "UNAUTHORIZED",
+            message: "authorization header not found",
+            body: {error: "invalid_request", error_description: "authorization header not found"}
+          )
+        end
         token = authorization.to_s.delete_prefix("Bearer ").strip
         record = token_record(store, token, prefix: prefix)
-        raise APIError.new("UNAUTHORIZED", message: "invalid_token") unless record
+        return jwt_userinfo(token, jwt_secret, additional_claim: additional_claim) unless record
         user = stringify_keys(record["user"])
         scopes = parse_scopes(record["scopes"])
-        raise APIError.new("FORBIDDEN", message: "openid scope is required") unless scopes.include?("openid")
+        raise userinfo_openid_scope_error unless scopes.include?("openid")
 
         response = {sub: record["subject"] || user["id"]}
         response[:name] = user["name"] if scopes.include?("profile")
@@ -513,6 +593,38 @@ module BetterAuth
         response
       end
 
+      def jwt_userinfo(token, jwt_secret, additional_claim: nil)
+        payload = ::JWT.decode(token, jwt_secret.to_s, true, algorithm: "HS256").first
+        scopes = parse_scopes(payload["scope"])
+        raise userinfo_openid_scope_error unless scopes.include?("openid")
+
+        response = {sub: payload["sub"]}
+        if scopes.include?("profile")
+          response[:name] = payload["name"] if payload["name"]
+          response[:given_name] = payload["name"].to_s.split(/\s+/, 2).first if payload["name"]
+          response[:family_name] = payload["name"].to_s.split(/\s+/, 2).last if payload["name"].to_s.include?(" ")
+        end
+        if scopes.include?("email")
+          response[:email] = payload["email"]
+          response[:email_verified] = !!payload["email_verified"]
+        end
+        if additional_claim.respond_to?(:call)
+          extra = additional_claim.call({user: payload, scopes: scopes, jwt: payload, client: {}})
+          response.merge!(extra) if extra.is_a?(Hash)
+        end
+        response
+      rescue ::JWT::DecodeError
+        raise APIError.new("UNAUTHORIZED", message: "invalid_token")
+      end
+
+      def userinfo_openid_scope_error
+        APIError.new(
+          "BAD_REQUEST",
+          message: "openid scope is required",
+          body: {error: "invalid_request", error_description: "openid scope is required"}
+        )
+      end
+
       def find_token_by_hint(store, token, hint, prefix: {})
         access = -> { (value = strip_prefix(token, prefix, :access_token)) && store[:tokens][value] }
         refresh = -> { (value = strip_prefix(token, prefix, :refresh_token)) && store[:refresh_tokens][value] }
@@ -588,18 +700,30 @@ module BetterAuth
         end
       end
 
-      def id_token(user, client_id, issuer_value, audience, ctx: nil, signer: nil, session_id: nil, include_sid: false, nonce: nil, auth_time: nil)
+      def id_token(user, client_id, issuer_value, audience, ctx: nil, signer: nil, session_id: nil, include_sid: false, nonce: nil, auth_time: nil, custom_claims: nil, scopes: [], client: {}, filter_claims_by_scope: false)
+        requested_scopes = parse_scopes(scopes)
         payload = {
           sub: user["id"],
           iss: issuer_value,
-          aud: audience || client_id,
-          email: user["email"],
-          email_verified: !!user["emailVerified"],
-          name: user["name"]
+          aud: audience || client_id
         }
+        include_profile_claims = !filter_claims_by_scope || requested_scopes.include?("profile")
+        include_email_claims = !filter_claims_by_scope || requested_scopes.include?("email")
+        payload[:name] = user["name"] if include_profile_claims
+        if include_email_claims
+          payload[:email] = user["email"]
+          payload[:email_verified] = !!user["emailVerified"]
+        end
         payload[:sid] = session_id if include_sid && session_id
         payload[:nonce] = nonce if nonce
         payload[:auth_time] = timestamp_seconds(auth_time) if auth_time
+        if custom_claims.respond_to?(:call)
+          extra = custom_claims.call({user: user, scopes: requested_scopes, client: client})
+          if extra.is_a?(Hash)
+            pinned = %w[sub iss aud exp iat nonce sid]
+            payload.merge!(stringify_keys(extra).except(*pinned).transform_keys(&:to_sym))
+          end
+        end
         return signer.call(ctx, payload) if signer.respond_to?(:call)
 
         Crypto.sign_jwt(
@@ -609,6 +733,10 @@ module BetterAuth
         )
       end
 
+      def standard_token_response_field?(key)
+        %w[access_token token_type expires_in scope refresh_token id_token audience].include?(key.to_s)
+      end
+
       def subject_identifier(user_id, client, pairwise_secret)
         data = stringify_keys(client)
         return user_id unless data["subjectType"] == "pairwise" && pairwise_secret && user_id
@@ -633,12 +761,27 @@ module BetterAuth
       end
 
       def timestamp_seconds(value)
-        return value.to_i if value.is_a?(Integer)
-        return value.to_i if value.is_a?(Float)
-        return value.to_i if value.respond_to?(:to_i) && !value.is_a?(String)
+        if value.is_a?(Numeric)
+          return nil unless value.finite?
+          return nil if value.abs > 8_640_000_000_000_000
+
+          return (value / 1000.0).floor if value.abs >= 100_000_000_000
+
+          return value.to_i
+        end
+        if value.is_a?(String) && value.match?(/\A[-+]?(?:\d+(?:\.\d+)?|\.\d+)(?:e[-+]?\d+)?\z/i)
+          numeric = value.to_f
+          return nil unless numeric.finite?
+          return nil if numeric.abs > 8_640_000_000_000_000
+
+          return (numeric / 1000.0).floor if numeric.abs >= 100_000_000_000
+
+          return numeric.to_i
+        end
+        return timestamp_seconds(value.to_i) if value.respond_to?(:to_i) && !value.is_a?(String)
 
         Time.parse(value.to_s).to_i
-      rescue ArgumentError, TypeError
+      rescue ArgumentError, TypeError, FloatDomainError
         nil
       end
 

data/lib/better_auth/plugins/organization/schema.rb

@@ -10,6 +10,7 @@ module BetterAuth
           organization: {
             model_name: "organizations",
             fields: {
+              id: {type: "string", required: true},
               name: {type: "string", required: true, sortable: true},
               slug: {type: "string", required: true, unique: true, sortable: true, index: true},
               logo: {type: "string", required: false},
@@ -21,6 +22,7 @@ module BetterAuth
           member: {
             model_name: "members",
             fields: {
+              id: {type: "string", required: true},
               organizationId: {type: "string", required: true, references: {model: "organization", field: "id"}, index: true},
               userId: {type: "string", required: true, references: {model: "user", field: "id"}, index: true},
               role: {type: "string", required: true, default_value: "member", sortable: true},
@@ -30,6 +32,7 @@ module BetterAuth
           invitation: {
             model_name: "invitations",
             fields: {
+              id: {type: "string", required: true},
               organizationId: {type: "string", required: true, references: {model: "organization", field: "id"}, index: true},
               email: {type: "string", required: true, sortable: true, index: true},
               role: {type: "string", required: true, sortable: true},
@@ -50,6 +53,7 @@ module BetterAuth
           schema[:team] = {
             model_name: "teams",
             fields: {
+              id: {type: "string", required: true},
               name: {type: "string", required: true},
               organizationId: {type: "string", required: true, references: {model: "organization", field: "id"}, index: true},
               createdAt: {type: "date", required: true, default_value: -> { Time.now }},
@@ -59,6 +63,7 @@ module BetterAuth
           schema[:teamMember] = {
             model_name: "team_members",
             fields: {
+              id: {type: "string", required: true},
               teamId: {type: "string", required: true, references: {model: "team", field: "id"}, index: true},
               userId: {type: "string", required: true, references: {model: "user", field: "id"}, index: true},
               createdAt: {type: "date", required: false, default_value: -> { Time.now }}
@@ -72,6 +77,7 @@ module BetterAuth
           schema[:organizationRole] = {
             model_name: "organization_roles",
             fields: {
+              id: {type: "string", required: true},
               organizationId: {type: "string", required: true, references: {model: "organization", field: "id"}, index: true},
               role: {type: "string", required: true, index: true},
               permission: {type: "string", required: true},