better_auth 0.4.0 → 0.5.0

data/lib/better_auth/context.rb

@@ -5,21 +5,16 @@ require "uri"
 module BetterAuth
   class Context
     attr_reader :app_name,
-      :base_url,
       :version,
       :options,
       :social_providers,
-      :cookies,
-      :auth_cookies,
       :adapter,
       :internal_adapter,
       :logger,
       :session_config,
       :rate_limit_config,
-      :trusted_origins,
       :secret,
-      :current_session,
-      :new_session
+      :secret_config
 
     def initialize(configuration)
       @app_name = configuration.app_name
@@ -36,6 +31,7 @@ module BetterAuth
       @rate_limit_config = configuration.rate_limit
       @trusted_origins = configuration.trusted_origins
       @secret = configuration.secret
+      @secret_config = configuration.secret_config
       @current_session = nil
       @new_session = nil
     end
@@ -46,12 +42,36 @@ module BetterAuth
       end
     end
 
+    def base_url
+      runtime_fetch(:base_url, @base_url)
+    end
+
+    def trusted_origins
+      runtime_fetch(:trusted_origins, @trusted_origins)
+    end
+
+    def auth_cookies
+      runtime_fetch(:auth_cookies, @auth_cookies)
+    end
+
+    def cookies
+      runtime_fetch(:cookies, @cookies)
+    end
+
+    def current_session
+      runtime_fetch(:current_session, @current_session)
+    end
+
+    def new_session
+      runtime_fetch(:new_session, @new_session)
+    end
+
     def set_new_session(session)
-      @new_session = session
+      runtime_store(:new_session, session) || @new_session = session
     end
 
     def set_current_session(session)
-      @current_session = session
+      runtime_store(:current_session, session) || @current_session = session
     end
 
     def run_in_background(task)
@@ -63,6 +83,31 @@ module BetterAuth
       end
     end
 
+    def password
+      config = {
+        min_password_length: options.email_and_password[:min_password_length],
+        max_password_length: options.email_and_password[:max_password_length]
+      }
+      password_config = options.email_and_password[:password] || {}
+
+      {
+        config: config,
+        hash: ->(value) { Password.hash(value, hasher: password_config[:hash], algorithm: options.password_hasher) },
+        verify: lambda do |password:, hash:|
+          Password.verify(
+            password: password,
+            hash: hash,
+            verifier: password_config[:verify],
+            algorithm: options.password_hasher
+          )
+        end,
+        check_password: lambda do |value|
+          length = value.to_s.length
+          length.between?(config[:min_password_length].to_i, config[:max_password_length].to_i)
+        end
+      }
+    end
+
     def create_auth_cookie(cookie_name, override_attributes = {})
       Cookies.create_cookie(options, cookie_name.to_s, override_attributes)
     end
@@ -87,6 +132,7 @@ module BetterAuth
       @rate_limit_config = options.rate_limit
       @trusted_origins = options.trusted_origins
       @secret = options.secret
+      @secret_config = options.secret_config
     end
 
     def method_missing(name, *arguments, &block)
@@ -101,17 +147,52 @@ module BetterAuth
     end
 
     def prepare_for_request!(request)
-      @current_session = nil
-      @new_session = nil
-      @base_url = inferred_base_url(request) if options.base_url.to_s.empty?
-      @trusted_origins = current_trusted_origins(request)
+      runtime = request_runtime
+      runtime[:current_session] = nil
+      runtime[:new_session] = nil
+      if options.dynamic_base_url?
+        runtime[:base_url] = resolved_dynamic_base_url(request)
+        refresh_cookies!
+      elsif options.base_url.to_s.empty?
+        runtime[:base_url] = inferred_base_url(request)
+      end
+      runtime[:trusted_origins] = current_trusted_origins(request)
+    end
+
+    def prepare_for_api_call!(source)
+      runtime = request_runtime
+      runtime[:current_session] = nil
+      runtime[:new_session] = nil
+      if options.dynamic_base_url?
+        runtime[:base_url] = resolved_dynamic_base_url(source)
+        refresh_cookies!
+      end
+      runtime[:trusted_origins] = current_trusted_origins(request_for_callbacks(source))
     end
 
     def reset_runtime!
+      Thread.current[runtime_key] = nil if request_runtime?
+      options.clear_runtime_base_url! if options.respond_to?(:clear_runtime_base_url!)
       @current_session = nil
       @new_session = nil
     end
 
+    def clear_runtime!
+      Thread.current[runtime_key] = nil
+      options.clear_runtime_base_url! if options.respond_to?(:clear_runtime_base_url!)
+    end
+
+    def refresh_cookies!
+      cookies = Cookies.get_cookies(options)
+      if request_runtime?
+        runtime_store(:auth_cookies, cookies)
+        runtime_store(:cookies, cookies)
+      else
+        @auth_cookies = cookies
+        @cookies = cookies
+      end
+    end
+
     private
 
     def inferred_base_url(request)
@@ -120,6 +201,61 @@ module BetterAuth
       path.empty? ? origin : "#{origin}#{path}"
     end
 
+    def resolved_dynamic_base_url(request)
+      resolved = URLHelpers.resolve_base_url(
+        options.base_url_config,
+        options.base_path,
+        request,
+        load_env: true,
+        trusted_proxy_headers: dynamic_trusted_proxy_headers?
+      )
+      origin = Configuration.origin_for(URI.parse(resolved))
+      options.set_runtime_base_url(origin) if options.respond_to?(:set_runtime_base_url)
+      resolved
+    end
+
+    def dynamic_trusted_proxy_headers?
+      return true unless options.advanced.key?(:trusted_proxy_headers)
+
+      !!options.advanced[:trusted_proxy_headers]
+    end
+
+    def request_for_callbacks(source)
+      return source if source.respond_to?(:get_header)
+
+      DirectAPIRequest.new(source, base_url) if source.is_a?(Hash)
+    end
+
+    def request_runtime
+      Thread.current[runtime_key] ||= {
+        base_url: @base_url,
+        trusted_origins: @trusted_origins,
+        auth_cookies: @auth_cookies,
+        cookies: @cookies,
+        current_session: nil,
+        new_session: nil
+      }
+    end
+
+    def request_runtime?
+      !!Thread.current[runtime_key]
+    end
+
+    def runtime_fetch(key, fallback)
+      request_runtime? ? Thread.current[runtime_key].fetch(key, fallback) : fallback
+    end
+
+    def runtime_store(key, value)
+      return false unless request_runtime?
+
+      Thread.current[runtime_key][key] = value
+      true
+    end
+
+    def runtime_key
+      :"better_auth_context_runtime_#{object_id}"
+    end
+
     def inferred_origin(request)
       forwarded_host = request.get_header("HTTP_X_FORWARDED_HOST")
       forwarded_proto = request.get_header("HTTP_X_FORWARDED_PROTO")
@@ -207,5 +343,22 @@ module BetterAuth
     def plugin_context_attribute?(key)
       ![:options, :adapter, :internal_adapter].include?(key)
     end
+
+    class DirectAPIRequest
+      attr_reader :headers, :url
+
+      def initialize(headers, url)
+        @headers = headers.transform_keys { |key| key.to_s.downcase }
+        @url = url
+      end
+
+      def get_header(key)
+        normalized = key.to_s
+          .sub(/\AHTTP_/, "")
+          .downcase
+          .tr("_", "-")
+        headers[normalized] || headers[key.to_s] || headers[key.to_s.downcase]
+      end
+    end
   end
 end

data/lib/better_auth/cookies.rb

@@ -40,7 +40,7 @@ module BetterAuth
           uri.host unless uri.host.to_s.empty?
         end
       end
-      raise Error, "base_url is required when cross_subdomain_cookies are enabled" if cross_subdomain && domain.to_s.empty?
+      raise Error, "base_url is required when cross_subdomain_cookies are enabled" if cross_subdomain && domain.to_s.empty? && !options.dynamic_base_url?
 
       custom = advanced.dig(:cookies, cookie_name.to_sym) || {}
       prefix = advanced[:cookie_prefix] || "better-auth"
@@ -112,7 +112,9 @@ module BetterAuth
       cookie = ctx.context.auth_cookies[:session_data]
       max_age = dont_remember_me ? nil : cookie.attributes[:max_age]
       data = filtered_cache_data(ctx, session)
-      value = encode_cookie_cache(data, ctx.context.secret, strategy: config[:strategy] || "compact", max_age: max_age || 60 * 5)
+      strategy = config[:strategy] || "compact"
+      secret = (strategy.to_s == "jwe") ? ctx.context.secret_config : ctx.context.secret
+      value = encode_cookie_cache(data, secret, strategy: strategy, max_age: max_age || 60 * 5)
       attributes = cookie.attributes.merge(max_age: max_age)
       store = SessionStore.new(cookie.name, attributes, ctx)
 
@@ -129,7 +131,7 @@ module BetterAuth
 
       cookie = ctx.context.auth_cookies[:account_data]
       attributes = cookie.attributes.merge(max_age: cookie.attributes[:max_age] || 60 * 5)
-      value = Crypto.symmetric_encode_jwt(stringify_keys(account_data), ctx.context.secret, "better-auth-account", expires_in: attributes[:max_age])
+      value = Crypto.symmetric_encode_jwt(stringify_keys(account_data), ctx.context.secret_config, "better-auth-account", expires_in: attributes[:max_age])
       store = SessionStore.new(cookie.name, attributes, ctx)
 
       if value.length > SessionStore::CHUNK_SIZE
@@ -145,7 +147,7 @@ module BetterAuth
       value = SessionStore.get_chunked_cookie(ctx, cookie.name)
       return nil unless value
 
-      Crypto.symmetric_decode_jwt(value, ctx.context.secret, "better-auth-account")
+      Crypto.symmetric_decode_jwt(value, ctx.context.secret_config, "better-auth-account")
     end
 
     def get_cookie_cache(request_or_cookie_header, secret:, strategy: "compact", version: nil, cookie_prefix: "better-auth", cookie_name: "session_data", is_secure: nil)

data/lib/better_auth/core.rb

@@ -32,7 +32,9 @@ module BetterAuth
         delete_user: Routes.delete_user,
         delete_user_callback: Routes.delete_user_callback,
         list_accounts: Routes.list_accounts,
+        list_user_accounts: Routes.list_accounts,
         link_social: Routes.link_social,
+        link_social_account: Routes.link_social,
         unlink_account: Routes.unlink_account,
         get_access_token: Routes.get_access_token,
         refresh_token: Routes.refresh_token,

data/lib/better_auth/crypto/jwe.rb

@@ -26,7 +26,7 @@ module BetterAuth
           "exp" => Time.now.to_i + expires_in.to_i,
           "jti" => SecureRandom.uuid
         )
-        key = encryption_key(secret, salt)
+        key = encryption_key(current_secret(secret), salt)
         ::JWE.encrypt(JSON.generate(claims), key, alg: ALG, enc: ENC, kid: thumbprint(key))
       end
 
@@ -35,12 +35,17 @@ module BetterAuth
 
         header = protected_header(token)
         return nil unless valid_header?(header)
-        return nil unless header["kid"].nil? || header["kid"] == thumbprint(encryption_key(secret, salt))
 
-        payload = JSON.parse(::JWE.decrypt(token.to_s, encryption_key(secret, salt)))
-        return nil if expired?(payload)
+        decryption_keys(secret, salt, header["kid"]).each do |key|
+          payload = JSON.parse(::JWE.decrypt(token.to_s, key))
+          return nil if expired?(payload)
 
-        payload
+          return payload
+        rescue JSON::ParserError, ::JWE::DecodeError, ::JWE::InvalidData, ::JWE::BadCEK
+          next
+        end
+
+        nil
       rescue JSON::ParserError, ArgumentError, ::JWE::DecodeError, ::JWE::InvalidData, ::JWE::BadCEK
         nil
       end
@@ -57,6 +62,23 @@ module BetterAuth
         Crypto.base64url_encode(OpenSSL::Digest.digest("SHA256", JSON.generate(jwk)))
       end
 
+      def current_secret(secret)
+        secret.is_a?(SecretConfig) ? secret.current_secret : secret
+      end
+
+      def all_secrets(secret)
+        return [[0, secret]] unless secret.is_a?(SecretConfig)
+
+        secret.all_secrets
+      end
+
+      def decryption_keys(secret, salt, kid)
+        keys = all_secrets(secret).map { |_version, value| encryption_key(value, salt) }
+        return keys if kid.nil?
+
+        keys.select { |key| thumbprint(key) == kid }
+      end
+
       def protected_header(token)
         first_segment = token.to_s.split(".", 2).first
         JSON.parse(Crypto.base64url_decode(first_segment))

data/lib/better_auth/crypto.rb

@@ -73,6 +73,11 @@ module BetterAuth
     end
 
     def symmetric_encrypt(key:, data:)
+      if key.is_a?(SecretConfig)
+        ciphertext = symmetric_encrypt(key: key.current_secret, data: data)
+        return "#{SecretConfig::ENVELOPE_PREFIX}#{key.current_version}$#{ciphertext}"
+      end
+
       cipher = OpenSSL::Cipher.new("aes-256-gcm")
       cipher.encrypt
       cipher.key = OpenSSL::Digest.digest("SHA256", key.to_s)
@@ -88,6 +93,20 @@ module BetterAuth
     end
 
     def symmetric_decrypt(key:, data:)
+      if key.is_a?(SecretConfig)
+        envelope = parse_envelope(data)
+        if envelope
+          secret = key.keys[envelope[:version]]
+          return nil unless secret
+
+          return symmetric_decrypt(key: secret, data: envelope[:ciphertext])
+        end
+
+        return nil unless key.legacy_secret
+
+        return symmetric_decrypt(key: key.legacy_secret, data: data)
+      end
+
       payload = JSON.parse(base64url_decode(data.to_s))
       cipher = OpenSSL::Cipher.new("aes-256-gcm")
       cipher.decrypt
@@ -137,6 +156,19 @@ module BetterAuth
       value
     end
 
+    def parse_envelope(data)
+      value = data.to_s
+      return nil unless value.start_with?(SecretConfig::ENVELOPE_PREFIX)
+
+      rest = value.delete_prefix(SecretConfig::ENVELOPE_PREFIX)
+      version, ciphertext = rest.split("$", 2)
+      return nil if version.to_s.empty? || ciphertext.to_s.empty?
+
+      {version: SecretConfig.parse_version!(version, source: "encrypted envelope"), ciphertext: ciphertext}
+    rescue Error
+      nil
+    end
+
     def keccak256_bytes(input)
       rate = 136
       state = Array.new(25, 0)

data/lib/better_auth/database_hooks.rb

@@ -12,7 +12,7 @@ module BetterAuth
     def create(data, model, custom: nil, context: nil)
       run_before(model, :create, data, context) do |actual_data|
         created = custom ? custom.call(actual_data) : adapter.create(model: model, data: actual_data, force_allow_id: true)
-        run_after(model, :create, created)
+        run_after(model, :create, created, context)
         created
       end
     end
@@ -20,7 +20,7 @@ module BetterAuth
     def update(data, where, model, custom: nil, context: nil)
       run_before(model, :update, data, context) do |actual_data|
         updated = custom ? custom.call(actual_data) : adapter.update(model: model, where: where, update: actual_data)
-        run_after(model, :update, updated) if updated
+        run_after(model, :update, updated, context) if updated
         updated
       end
     end
@@ -28,7 +28,7 @@ module BetterAuth
     def update_many(data, where, model, custom: nil, context: nil)
       run_before(model, :update, data, context) do |actual_data|
         updated = custom ? custom.call(actual_data) : adapter.update_many(model: model, where: where, update: actual_data)
-        run_after(model, :update, updated) if updated
+        run_after(model, :update, updated, context) if updated
         updated
       end
     end
@@ -68,8 +68,8 @@ module BetterAuth
       yield actual_data
     end
 
-    def run_after(model, action, data)
-      after_hooks(model, action).each { |hook| hook.call(data, nil) }
+    def run_after(model, action, data, context)
+      after_hooks(model, action).each { |hook| hook.call(data, context) }
     end
 
     def before_hooks(model, action)

data/lib/better_auth/endpoint.rb

@@ -10,6 +10,7 @@ module BetterAuth
       :params_schema,
       :headers_schema,
       :metadata,
+      :options,
       :use,
       :handler
 
@@ -21,6 +22,9 @@ module BetterAuth
       @params_schema = params_schema
       @headers_schema = headers_schema
       @metadata = metadata || {}
+      apply_default_open_api_metadata!
+      apply_open_api_schemas!
+      @options = endpoint_options
       @use = Array(use)
       @handler = handler || ->(_ctx) {}
     end
@@ -46,6 +50,34 @@ module BetterAuth
 
     private
 
+    def endpoint_options
+      {
+        method: (methods.length == 1) ? methods.first : methods,
+        body: body_schema,
+        query: query_schema,
+        params: params_schema,
+        headers: headers_schema,
+        metadata: metadata
+      }.compact
+    end
+
+    def apply_default_open_api_metadata!
+      return unless path
+      return if metadata[:openapi] || metadata[:hide] || metadata[:SERVER_ONLY] || metadata[:server_only]
+      return unless defined?(BetterAuth::OpenAPI)
+
+      metadata[:openapi] = BetterAuth::OpenAPI.default_metadata(path, methods)
+    end
+
+    def apply_open_api_schemas!
+      openapi = fetch_key(metadata, :openapi)
+      return unless openapi.is_a?(Hash)
+
+      @body_schema ||= schema_for_open_api_request_body(openapi)
+      @query_schema ||= schema_for_open_api_parameters(openapi, "query")
+      @headers_schema ||= schema_for_open_api_parameters(openapi, "header")
+    end
+
     def apply_schemas!(context)
       context.body = validate_schema(:body, body_schema, context.body)
       context.query = validate_schema(:query, query_schema, context.query)
@@ -86,6 +118,54 @@ module BetterAuth
       result
     end
 
+    def schema_for_open_api_request_body(openapi)
+      schema = fetch_key(fetch_key(fetch_key(fetch_key(openapi, :requestBody), :content), "application/json"), :schema)
+      required = Array(fetch_key(schema, :required)).map(&:to_s)
+      return nil if required.empty?
+
+      ->(value) { validate_required_open_api_fields(value, required) }
+    end
+
+    def schema_for_open_api_parameters(openapi, location)
+      required = Array(fetch_key(openapi, :parameters))
+        .select { |parameter| parameter.is_a?(Hash) && fetch_key(parameter, :in).to_s == location && fetch_key(parameter, :required) == true }
+        .filter_map { |parameter| fetch_key(parameter, :name) }
+        .map(&:to_s)
+      return nil if required.empty?
+
+      ->(value) { validate_required_open_api_fields(value, required) }
+    end
+
+    def validate_required_open_api_fields(value, required)
+      data = normalize_open_api_input(value)
+      return false unless required.all? { |key| data.key?(open_api_storage_key(key)) && !data[open_api_storage_key(key)].nil? }
+
+      value
+    end
+
+    def normalize_open_api_input(value)
+      return {} unless value.is_a?(Hash)
+
+      value.each_with_object({}) do |(key, object_value), result|
+        result[open_api_storage_key(key)] = object_value
+      end
+    end
+
+    def open_api_storage_key(key)
+      key.to_s
+        .gsub(/([a-z\d])([A-Z])/, "\\1_\\2")
+        .tr("-", "_")
+        .downcase
+        .split("_")
+        .then { |parts| ([parts.first] + parts.drop(1).map(&:capitalize)).join }
+    end
+
+    def fetch_key(hash, key)
+      return nil unless hash.respond_to?(:[])
+
+      hash[key] || hash[key.to_s]
+    end
+
     class Result
       attr_accessor :response, :status, :headers
 
@@ -100,7 +180,7 @@ module BetterAuth
         return value if value.is_a?(self)
 
         if value.is_a?(APIError)
-          return new(response: value, status: value.status_code, headers: value.headers)
+          return new(response: value, status: value.status_code, headers: merge_headers(context.response_headers, value.headers))
         end
 
         if rack_response?(value)
@@ -136,7 +216,11 @@ module BetterAuth
       end
 
       def to_rack_response
-        return @raw_response if raw_response?
+        to_response.to_a
+      end
+
+      def to_response
+        return Response.from_rack(@raw_response) if raw_response?
 
         body = if response.nil?
           [JSON.generate(nil)]
@@ -146,7 +230,7 @@ module BetterAuth
           [JSON.generate(response)]
         end
         response_headers = {"content-type" => "application/json"}.merge(headers)
-        [status, response_headers, body]
+        Response.new(status: status, headers: response_headers, body: body)
       end
 
       private

data/lib/better_auth/error.rb

@@ -16,6 +16,7 @@ module BetterAuth
     "SOCIAL_ACCOUNT_ALREADY_LINKED" => "Social account already linked",
     "PROVIDER_NOT_FOUND" => "Provider not found",
     "INVALID_TOKEN" => "Invalid token",
+    "TOKEN_EXPIRED" => "Token expired",
     "ID_TOKEN_NOT_SUPPORTED" => "id_token not supported",
     "FAILED_TO_GET_USER_INFO" => "Failed to get user info",
     "USER_EMAIL_NOT_FOUND" => "User email not found",
@@ -47,6 +48,12 @@ module BetterAuth
     "FIELD_NOT_ALLOWED" => "Field not allowed to be set",
     "ASYNC_VALIDATION_NOT_SUPPORTED" => "Async validation is not supported",
     "VALIDATION_ERROR" => "Validation Error",
-    "MISSING_FIELD" => "Field is required"
+    "MISSING_FIELD" => "Field is required",
+    "BODY_MUST_BE_AN_OBJECT" => "Body must be an object",
+    "METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED" => "POST method requires deferSessionRefresh to be enabled in session config",
+    "PASSWORD_ALREADY_SET" => "User already has a password set",
+    "RESET_PASSWORD_DISABLED" => "Reset password isn't enabled",
+    "EMAIL_PASSWORD_DISABLED" => "Email and password is not enabled",
+    "EMAIL_PASSWORD_SIGN_UP_DISABLED" => "Email and password sign up is not enabled"
   }.freeze
 end

data/lib/better_auth/plugins/admin/schema.rb

@@ -11,8 +11,8 @@ module BetterAuth
             fields: {
               role: {type: "string", required: false, input: false},
               banned: {type: "boolean", required: false, input: false, default_value: false},
-              banReason: {type: "string", required: false, input: false},
-              banExpires: {type: "date", required: false, input: false}
+              banReason: {type: "string", required: false, input: false, default_value: nil},
+              banExpires: {type: "date", required: false, input: false, default_value: nil}
             }
           },
           session: {