better_auth 0.4.0 → 0.5.0

data/lib/better_auth/routes/user.rb

@@ -1,12 +1,36 @@
 # frozen_string_literal: true
 
+require "securerandom"
+require "uri"
+
 module BetterAuth
   module Routes
     def self.update_user
-      Endpoint.new(path: "/update-user", method: "POST") do |ctx|
+      Endpoint.new(
+        path: "/update-user",
+        method: "POST",
+        metadata: {
+          openapi: {
+            operationId: "updateUser",
+            description: "Update the current user's profile",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  name: {type: ["string", "null"], description: "The user's name"},
+                  image: {type: ["string", "null"], description: "The user's profile image URL"}
+                }
+              )
+            ),
+            responses: {
+              "200" => OpenAPI.json_response("User updated", OpenAPI.status_response_schema)
+            }
+          }
+        }
+      ) do |ctx|
         session = current_session(ctx)
+        raise APIError.new("BAD_REQUEST", code: "BODY_MUST_BE_AN_OBJECT", message: BASE_ERROR_CODES["BODY_MUST_BE_AN_OBJECT"]) unless ctx.body.is_a?(Hash)
+
         body = normalize_hash(ctx.body)
-        raise APIError.new("BAD_REQUEST", message: "Body must be an object") unless body.is_a?(Hash)
         raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["EMAIL_CAN_NOT_BE_UPDATED"]) if body.key?("email")
         update = parse_declared_input(ctx, "user", body, allowed_base: ["name", "image"])
         raise APIError.new("BAD_REQUEST", message: "No fields to update") if update.empty?
@@ -18,7 +42,38 @@ module BetterAuth
     end
 
     def self.change_password
-      Endpoint.new(path: "/change-password", method: "POST") do |ctx|
+      Endpoint.new(
+        path: "/change-password",
+        method: "POST",
+        metadata: {
+          openapi: {
+            description: "Change the password of the user",
+            operationId: "changePassword",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  newPassword: {type: "string", description: "The new password to set"},
+                  currentPassword: {type: "string", description: "The current password is required"},
+                  revokeOtherSessions: {type: ["boolean", "null"], description: "Must be a boolean value"}
+                },
+                required: ["newPassword", "currentPassword"]
+              )
+            ),
+            responses: {
+              "200" => OpenAPI.json_response(
+                "Password successfully changed",
+                OpenAPI.object_schema(
+                  {
+                    token: {type: "string", nullable: true, description: "New session token if other sessions were revoked"},
+                    user: OpenAPI.user_response_schema
+                  },
+                  required: ["user"]
+                )
+              )
+            }
+          }
+        }
+      ) do |ctx|
         session = current_session(ctx, sensitive: true)
         body = normalize_hash(ctx.body)
         new_password = body["newPassword"] || body["new_password"]
@@ -42,13 +97,33 @@ module BetterAuth
     end
 
     def self.set_password
-      Endpoint.new(path: "/set-password", method: "POST") do |ctx|
+      Endpoint.new(
+        path: "/set-password",
+        method: "POST",
+        metadata: {
+          openapi: {
+            operationId: "setPassword",
+            description: "Set a password for the current user",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  newPassword: {type: "string", description: "The password to set"}
+                },
+                required: ["newPassword"]
+              )
+            ),
+            responses: {
+              "200" => OpenAPI.json_response("Password set", OpenAPI.status_response_schema)
+            }
+          }
+        }
+      ) do |ctx|
         session = current_session(ctx, sensitive: true)
         body = normalize_hash(ctx.body)
         new_password = body["newPassword"] || body["new_password"]
         validate_password_length!(new_password, ctx.context.options.email_and_password)
         account = credential_account(ctx, session[:user]["id"])
-        raise APIError.new("BAD_REQUEST", message: "user already has a password") if account && account["password"]
+        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["PASSWORD_ALREADY_SET"]) if account && account["password"]
 
         ctx.context.internal_adapter.link_account(
           userId: session[:user]["id"],
@@ -61,7 +136,37 @@ module BetterAuth
     end
 
     def self.delete_user
-      Endpoint.new(path: "/delete-user", method: "POST") do |ctx|
+      Endpoint.new(
+        path: "/delete-user",
+        method: "POST",
+        metadata: {
+          openapi: {
+            operationId: "deleteUser",
+            description: "Delete the current user",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  password: {type: ["string", "null"], description: "The user's password"},
+                  token: {type: ["string", "null"], description: "Delete account verification token"},
+                  callbackURL: {type: ["string", "null"], description: "The URL to redirect to after deletion"}
+                }
+              )
+            ),
+            responses: {
+              "200" => OpenAPI.json_response(
+                "User deleted or verification email sent",
+                OpenAPI.object_schema(
+                  {
+                    success: {type: "boolean"},
+                    message: {type: "string"}
+                  },
+                  required: ["success", "message"]
+                )
+              )
+            }
+          }
+        }
+      ) do |ctx|
         enabled = ctx.context.options.user.dig(:delete_user, :enabled)
         raise APIError.new("NOT_FOUND") unless enabled
 
@@ -80,12 +185,14 @@ module BetterAuth
         elsif sender
           token = SecureRandom.hex(16)
           expires_in = ctx.context.options.user.dig(:delete_user, :delete_token_expires_in) || 3600
+          callback_url = body["callbackURL"] || body["callbackUrl"] || body["callback_url"] || "/"
+          url = "#{ctx.context.base_url}/delete-user/callback?token=#{URI.encode_www_form_component(token)}&callbackURL=#{URI.encode_www_form_component(callback_url)}"
           ctx.context.internal_adapter.create_verification_value(
             identifier: "delete-account-#{token}",
             value: session[:user]["id"],
             expiresAt: Time.now + expires_in.to_i
           )
-          sender.call({user: session[:user], token: token}, ctx.request)
+          sender.call({user: session[:user], url: url, token: token}, ctx.request)
           next ctx.json({success: true, message: "Verification email sent"})
         elsif !body["password"]
           require_fresh_session!(ctx, session)
@@ -97,14 +204,49 @@ module BetterAuth
     end
 
     def self.delete_user_callback
-      Endpoint.new(path: "/delete-user/callback", method: "GET") do |ctx|
+      Endpoint.new(
+        path: "/delete-user/callback",
+        method: "GET",
+        metadata: {
+          openapi: {
+            operationId: "deleteUserCallback",
+            description: "Delete the current user using a verification token",
+            parameters: [
+              {
+                name: "token",
+                in: "query",
+                required: true,
+                schema: {type: "string"}
+              },
+              {
+                name: "callbackURL",
+                in: "query",
+                required: false,
+                schema: {type: "string"}
+              }
+            ],
+            responses: {
+              "200" => OpenAPI.json_response(
+                "User deleted",
+                OpenAPI.object_schema(
+                  {
+                    success: {type: "boolean"},
+                    message: {type: "string"}
+                  },
+                  required: ["success", "message"]
+                )
+              )
+            }
+          }
+        }
+      ) do |ctx|
         enabled = ctx.context.options.user.dig(:delete_user, :enabled)
         raise APIError.new("NOT_FOUND") unless enabled
         session = current_session(ctx)
         token = fetch_value(ctx.query, "token")
-        delete_user_by_token!(ctx, session, token)
         callback_url = fetch_value(ctx.query, "callbackURL")
         validate_callback_url!(ctx.context, callback_url)
+        delete_user_by_token!(ctx, session, token)
         delete_current_user!(ctx, session)
         raise ctx.redirect(callback_url) if callback_url
 
@@ -113,7 +255,43 @@ module BetterAuth
     end
 
     def self.change_email
-      Endpoint.new(path: "/change-email", method: "POST") do |ctx|
+      Endpoint.new(
+        path: "/change-email",
+        method: "POST",
+        metadata: {
+          openapi: {
+            operationId: "changeEmail",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  callbackURL: {type: ["string", "null"], description: "The URL to redirect to after email verification"},
+                  newEmail: {type: "string", description: "The new email address to set must be a valid email address"}
+                },
+                required: ["newEmail"]
+              )
+            ),
+            responses: {
+              "200" => OpenAPI.json_response(
+                "Email change request processed successfully",
+                OpenAPI.object_schema(
+                  {
+                    message: {
+                      type: "string",
+                      nullable: true,
+                      enum: ["Email updated", "Verification email sent"],
+                      description: "Status message of the email change process"
+                    },
+                    status: {type: "boolean", description: "Indicates if the request was successful"},
+                    user: {type: "object", "$ref": "#/components/schemas/User"}
+                  },
+                  required: ["status"]
+                )
+              ),
+              "422" => OpenAPI.error_response("Unprocessable Entity. Email already exists")
+            }
+          }
+        }
+      ) do |ctx|
         enabled = ctx.context.options.user.dig(:change_email, :enabled)
         raise APIError.new("BAD_REQUEST", message: "Change email is disabled") unless enabled
         session = current_session(ctx, sensitive: true)
@@ -121,26 +299,48 @@ module BetterAuth
         new_email = (body["newEmail"] || body["new_email"]).to_s.downcase
         raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_EMAIL"]) unless EMAIL_PATTERN.match?(new_email)
         raise APIError.new("BAD_REQUEST", message: "Email is the same") if new_email == session[:user]["email"]
-        existing_target = ctx.context.internal_adapter.find_user_by_email(new_email)
+        sender = ctx.context.options.email_verification[:send_verification_email]
+        confirmation_sender = ctx.context.options.user.dig(:change_email, :send_change_email_confirmation)
+        can_update_without_verification = !session[:user]["emailVerified"] && ctx.context.options.user.dig(:change_email, :update_email_without_verification)
+        can_send_confirmation = session[:user]["emailVerified"] && confirmation_sender.respond_to?(:call)
+        can_send_verification = sender.respond_to?(:call)
+        unless can_update_without_verification || can_send_confirmation || can_send_verification
+          raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["VERIFICATION_EMAIL_NOT_ENABLED"])
+        end
 
-        if !session[:user]["emailVerified"] && ctx.context.options.user.dig(:change_email, :update_email_without_verification)
-          next ctx.json({status: true}) if existing_target
+        existing_target = ctx.context.internal_adapter.find_user_by_email(new_email)
+        next ctx.json({status: true}) if existing_target
 
+        if can_update_without_verification
           updated = ctx.context.internal_adapter.update_user_by_email(session[:user]["email"], email: new_email)
           Cookies.set_session_cookie(ctx, {session: session[:session], user: updated})
+          send_verification_email_payload(ctx, updated, body["callbackURL"] || body["callbackUrl"] || body["callback_url"]) if can_send_verification
           next ctx.json({status: true})
         end
 
-        sender = ctx.context.options.email_verification[:send_verification_email]
-        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["VERIFICATION_EMAIL_NOT_ENABLED"]) unless sender.respond_to?(:call)
-        next ctx.json({status: true}) if existing_target
+        if can_send_confirmation
+          callback_url = body["callbackURL"] || body["callbackUrl"] || body["callback_url"]
+          token = create_email_verification_token(ctx, session[:user]["email"], update_to: new_email, extra: {"requestType" => "change-email-confirmation"})
+          url = email_verification_url(ctx, token, callback_url)
+          confirmation_sender.call({user: session[:user], new_email: new_email, url: url, token: token}, ctx.request)
+          next ctx.json({status: true})
+        end
 
-        token = create_email_verification_token(ctx, session[:user]["email"], update_to: new_email, extra: {"requestType" => "change-email-verification"})
-        sender.call({user: session[:user].merge("email" => new_email), token: token}, ctx.request)
+        send_change_email_verification(ctx, sender, session[:user], session[:user]["email"], new_email, body["callbackURL"] || body["callbackUrl"] || body["callback_url"])
         ctx.json({status: true})
       end
     end
 
+    def self.send_change_email_verification(ctx, sender, user, current_email, new_email, callback_url)
+      token = create_email_verification_token(ctx, current_email, update_to: new_email, extra: {"requestType" => "change-email-verification"})
+      sender.call({user: user.merge("email" => new_email), url: email_verification_url(ctx, token, callback_url), token: token}, ctx.request)
+    end
+
+    def self.email_verification_url(ctx, token, callback_url)
+      callback = URI.encode_www_form_component(callback_url || "/")
+      "#{ctx.context.base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
+    end
+
     def self.delete_user_by_token!(ctx, session, token)
       verification = ctx.context.internal_adapter.find_verification_value("delete-account-#{token}")
       unless verification && verification["value"] == session[:user]["id"] && !expired_time?(verification["expiresAt"])
@@ -164,8 +364,10 @@ module BetterAuth
       fresh_age = ctx.context.session_config[:fresh_age].to_i
       return if fresh_age <= 0
 
-      updated_at = Session.normalize_time(session[:session]["updatedAt"] || session[:session]["updated_at"] || session[:session]["createdAt"] || session[:session]["created_at"])
-      raise APIError.new("UNAUTHORIZED") unless updated_at && updated_at + fresh_age > Time.now
+      created_at = Session.normalize_time(session[:session]["createdAt"] || session[:session]["created_at"])
+      return if created_at && created_at + fresh_age > Time.now
+
+      raise APIError.new("BAD_REQUEST", code: "SESSION_EXPIRED", message: BASE_ERROR_CODES["SESSION_EXPIRED"])
     end
 
     def self.parse_declared_input(ctx, model, data, allowed_base: [])

data/lib/better_auth/routes/validation.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Routes
+    REQUEST_EMAIL_PATTERN = /\A[^@\s]+@[^@\s]+\.[^@\s]+\z/
+
+    def self.request_body_schema(required_strings: [], required_nonempty_strings: [], email_strings: [], optional_strings: [])
+      ->(body) {
+        data = request_validation_hash(body)
+        return false unless required_strings.all? { |key| request_string?(data, key) }
+        return false unless required_nonempty_strings.all? { |key| request_string?(data, key) && !data[request_storage_key(key)].empty? }
+        return false unless email_strings.all? { |key| request_string?(data, key) && REQUEST_EMAIL_PATTERN.match?(data[request_storage_key(key)]) }
+        return false unless optional_strings.all? { |key| !data.key?(request_storage_key(key)) || request_string?(data, key) }
+
+        data
+      }
+    end
+
+    def self.request_query_schema(required_strings: [], optional_strings: [])
+      ->(query) {
+        data = request_validation_hash(query)
+        return false unless required_strings.all? { |key| request_string?(data, key) }
+        return false unless optional_strings.all? { |key| !data.key?(request_storage_key(key)) || request_string?(data, key) }
+
+        data
+      }
+    end
+
+    def self.request_validation_hash(value)
+      return {} unless value.is_a?(Hash)
+
+      value.each_with_object({}) do |(key, object_value), result|
+        result[request_storage_key(key)] = object_value
+      end
+    end
+
+    def self.request_string?(data, key)
+      data[request_storage_key(key)].is_a?(String)
+    end
+
+    def self.request_storage_key(key)
+      key.to_s
+        .gsub(/([a-z\d])([A-Z])/, "\\1_\\2")
+        .tr("-", "_")
+        .downcase
+        .split("_")
+        .then { |parts| ([parts.first] + parts.drop(1).map(&:capitalize)).join }
+    end
+  end
+end

data/lib/better_auth/secret_config.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  class SecretConfig
+    ENVELOPE_PREFIX = "$ba$"
+
+    attr_reader :keys, :current_version, :legacy_secret
+
+    def initialize(keys:, current_version:, legacy_secret: nil)
+      normalized_keys = keys.each_with_object({}) do |(version, value), result|
+        result[normalize_version!(version)] = value.to_s
+      end
+      @keys = normalized_keys.freeze
+      @current_version = normalize_version!(current_version)
+      @legacy_secret = legacy_secret unless legacy_secret.to_s.empty?
+    end
+
+    def current_secret
+      keys.fetch(current_version) do
+        raise Error, "Secret version #{current_version} not found in keys"
+      end
+    end
+
+    def all_secrets
+      entries = keys.map { |version, value| [version, value] }
+      entries << [-1, legacy_secret] if legacy_secret && !keys.value?(legacy_secret)
+      entries
+    end
+
+    def self.parse_env(value)
+      return nil if value.to_s.empty?
+
+      value.to_s.split(",").map do |entry|
+        entry = entry.strip
+        colon_index = entry.index(":")
+        raise Error, "Invalid BETTER_AUTH_SECRETS entry: \"#{entry}\". Expected format: \"<version>:<secret>\"" unless colon_index
+
+        version = entry[0...colon_index].strip
+        secret = entry[(colon_index + 1)..].to_s.strip
+        raise Error, "Empty secret value for version #{version} in BETTER_AUTH_SECRETS." if secret.empty?
+
+        {version: parse_version!(version, source: "BETTER_AUTH_SECRETS"), value: secret}
+      end
+    end
+
+    def self.validate_secrets!(secrets, logger: nil)
+      entries = Array(secrets)
+      raise Error, "`secrets` array must contain at least one entry." if entries.empty?
+
+      seen = {}
+      entries.each do |entry|
+        data = normalize_entry(entry)
+        version = parse_version!(data.fetch(:version), source: "`secrets`")
+        value = data.fetch(:value, nil).to_s
+        raise Error, "Empty secret value for version #{version} in `secrets`." if value.empty?
+        raise Error, "Duplicate version #{version} in `secrets`. Each version must be unique." if seen[version]
+
+        seen[version] = true
+      end
+
+      current = normalize_entry(entries.first)
+      current_version = parse_version!(current.fetch(:version), source: "`secrets`")
+      current_value = current.fetch(:value).to_s
+      warn(logger, "[better-auth] Warning: the current secret (version #{current_version}) should be at least 32 characters long for adequate security.") if current_value.length < 32
+      warn(logger, "[better-auth] Warning: the current secret appears low-entropy. Use a randomly generated secret for production.") if entropy(current_value) < 120
+    end
+
+    def self.build(secrets, legacy_secret, logger: nil)
+      validate_secrets!(secrets, logger: logger)
+      entries = Array(secrets).map { |entry| normalize_entry(entry) }
+      keys = entries.each_with_object({}) do |entry, result|
+        result[parse_version!(entry.fetch(:version), source: "`secrets`")] = entry.fetch(:value).to_s
+      end
+      current_version = parse_version!(entries.first.fetch(:version), source: "`secrets`")
+      legacy = (legacy_secret && legacy_secret != Configuration::DEFAULT_SECRET) ? legacy_secret : nil
+      new(keys: keys, current_version: current_version, legacy_secret: legacy)
+    end
+
+    def self.normalize_entry(entry)
+      raise Error, "Invalid `secrets` entry. Expected a hash with `version` and `value`." unless entry.is_a?(Hash)
+
+      entry.each_with_object({}) do |(key, value), result|
+        result[key.to_s.tr("-", "_").to_sym] = value
+      end
+    end
+
+    def self.parse_version!(value, source:)
+      text = value.to_s.strip
+      unless text.match?(/\A(?:0|[1-9]\d*)\z/)
+        raise Error, "Invalid version #{value} in #{source}. Version must be a non-negative integer."
+      end
+
+      text.to_i
+    end
+
+    def self.entropy(value)
+      unique = value.to_s.chars.uniq.length
+      return 0 if unique.zero?
+
+      Math.log2(unique**value.to_s.length)
+    end
+
+    def self.warn(logger, message)
+      if logger.respond_to?(:call)
+        logger.call(:warn, message)
+      elsif logger.respond_to?(:warn)
+        logger.warn(message)
+      end
+    end
+
+    def normalize_version!(version)
+      self.class.parse_version!(version, source: "`secrets`")
+    end
+  end
+end

data/lib/better_auth/session.rb

@@ -108,7 +108,7 @@ module BetterAuth
       update_age = if refresh_cache.is_a?(Hash)
         (refresh_cache[:update_age] || refresh_cache["updateAge"] || refresh_cache["update_age"]).to_i
       else
-        (max_age * 0.8).to_i
+        (max_age * 0.2).to_i
       end
       updated_at = payload["updatedAt"].to_i
       updated_at.positive? && updated_at + (update_age * 1000) <= (Time.now.to_f * 1000).to_i

data/lib/better_auth/url_helpers.rb

@@ -153,6 +153,7 @@ module BetterAuth
     def headers_from_source(source)
       return {} unless source
       return source.headers if source.respond_to?(:headers)
+      return rack_request_headers(source) if source.respond_to?(:get_header)
       return source if source.is_a?(Hash)
 
       {}
@@ -167,7 +168,9 @@ module BetterAuth
     end
 
     def source_url(source)
-      source.url if source.respond_to?(:url)
+      return source.url if source.respond_to?(:url)
+
+      source.get_header("REQUEST_URI") if source.respond_to?(:get_header)
     end
 
     def dynamic_config?(config)
@@ -191,5 +194,13 @@ module BetterAuth
 
       port.to_i.between?(1, 65_535)
     end
+
+    def rack_request_headers(source)
+      {
+        "x-forwarded-host" => source.get_header("HTTP_X_FORWARDED_HOST"),
+        "x-forwarded-proto" => source.get_header("HTTP_X_FORWARDED_PROTO"),
+        "host" => source.get_header("HTTP_HOST")
+      }.compact
+    end
   end
 end

data/lib/better_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BetterAuth
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/lib/better_auth.rb

@@ -4,10 +4,12 @@ require_relative "better_auth/version"
 require_relative "better_auth/core"
 require_relative "better_auth/error"
 require_relative "better_auth/api_error"
+require_relative "better_auth/secret_config"
 require_relative "better_auth/crypto"
 require_relative "better_auth/host"
 require_relative "better_auth/url_helpers"
 require_relative "better_auth/request_state"
+require_relative "better_auth/response"
 require_relative "better_auth/async"
 require_relative "better_auth/deprecate"
 require_relative "better_auth/logger"
@@ -48,6 +50,7 @@ require_relative "better_auth/plugins/one_time_token"
 require_relative "better_auth/plugins/one_tap"
 require_relative "better_auth/plugins/siwe"
 require_relative "better_auth/plugins/generic_oauth"
+require_relative "better_auth/plugins/dub"
 require_relative "better_auth/plugins/oauth_proxy"
 require_relative "better_auth/plugins/passkey"
 require_relative "better_auth/plugins/organization/schema"
@@ -76,6 +79,7 @@ require_relative "better_auth/session_store"
 require_relative "better_auth/cookies"
 require_relative "better_auth/session"
 require_relative "better_auth/endpoint"
+require_relative "better_auth/routes/validation"
 require_relative "better_auth/routes/ok"
 require_relative "better_auth/routes/error"
 require_relative "better_auth/routes/sign_up"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: better_auth
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Sebastian Sala
@@ -300,6 +300,7 @@ files:
 - lib/better_auth/plugins/captcha.rb
 - lib/better_auth/plugins/custom_session.rb
 - lib/better_auth/plugins/device_authorization.rb
+- lib/better_auth/plugins/dub.rb
 - lib/better_auth/plugins/email_otp.rb
 - lib/better_auth/plugins/expo.rb
 - lib/better_auth/plugins/generic_oauth.rb
@@ -308,6 +309,16 @@ files:
 - lib/better_auth/plugins/last_login_method.rb
 - lib/better_auth/plugins/magic_link.rb
 - lib/better_auth/plugins/mcp.rb
+- lib/better_auth/plugins/mcp/authorization.rb
+- lib/better_auth/plugins/mcp/config.rb
+- lib/better_auth/plugins/mcp/consent.rb
+- lib/better_auth/plugins/mcp/legacy_aliases.rb
+- lib/better_auth/plugins/mcp/metadata.rb
+- lib/better_auth/plugins/mcp/registration.rb
+- lib/better_auth/plugins/mcp/resource_handler.rb
+- lib/better_auth/plugins/mcp/schema.rb
+- lib/better_auth/plugins/mcp/token.rb
+- lib/better_auth/plugins/mcp/userinfo.rb
 - lib/better_auth/plugins/multi_session.rb
 - lib/better_auth/plugins/oauth_protocol.rb
 - lib/better_auth/plugins/oauth_provider.rb
@@ -329,6 +340,7 @@ files:
 - lib/better_auth/rate_limiter.rb
 - lib/better_auth/request_ip.rb
 - lib/better_auth/request_state.rb
+- lib/better_auth/response.rb
 - lib/better_auth/router.rb
 - lib/better_auth/routes/account.rb
 - lib/better_auth/routes/email_verification.rb
@@ -341,8 +353,10 @@ files:
 - lib/better_auth/routes/sign_up.rb
 - lib/better_auth/routes/social.rb
 - lib/better_auth/routes/user.rb
+- lib/better_auth/routes/validation.rb
 - lib/better_auth/schema.rb
 - lib/better_auth/schema/sql.rb
+- lib/better_auth/secret_config.rb
 - lib/better_auth/session.rb
 - lib/better_auth/session_store.rb
 - lib/better_auth/social_providers.rb