better_auth 0.7.0 → 0.10.0

data/lib/better_auth/auth.rb

@@ -2,7 +2,23 @@
 
 module BetterAuth
   class Auth
-    attr_reader :handler, :api, :options, :context, :error_codes
+    TELEMETRY_ADAPTER_IDS = {
+      "BetterAuth::Adapters::Memory" => "memory",
+      "BetterAuth::Adapters::Postgres" => "postgres",
+      "BetterAuth::Adapters::MySQL" => "mysql",
+      "BetterAuth::Adapters::SQLite" => "sqlite",
+      "BetterAuth::Adapters::MSSQL" => "mssql"
+    }.freeze
+
+    TELEMETRY_DATABASE_IDS = {
+      memory: "memory",
+      postgres: "postgres",
+      mysql: "mysql",
+      sqlite: "sqlite",
+      mssql: "mssql"
+    }.freeze
+
+    attr_reader :handler, :api, :options, :context, :error_codes, :telemetry
 
     def initialize(options = {})
       @options = Configuration.new(options)
@@ -16,6 +32,7 @@ module BetterAuth
       Router.check_endpoint_conflicts(@options, @options.logger)
       @api = API.new(@context, @endpoints)
       @handler = Router.new(@context, @endpoints)
+      @telemetry = build_telemetry_publisher
     end
 
     def call(env)
@@ -38,5 +55,55 @@ module BetterAuth
     def build_endpoints
       Core.base_endpoints.merge(@plugin_registry.endpoints)
     end
+
+    def build_telemetry_publisher
+      require "better_auth/telemetry"
+      BetterAuth::Telemetry.create(@options, telemetry_context)
+    rescue LoadError
+      noop_telemetry_publisher
+    rescue => e
+      log_telemetry_error(e)
+      noop_telemetry_publisher
+    end
+
+    def telemetry_context
+      {
+        database: telemetry_database_id,
+        adapter: telemetry_adapter_id,
+        custom_track: nil,
+        skip_test_check: false
+      }
+    end
+
+    def telemetry_database_id
+      configured = @options.database
+      return "memory" if configured.nil?
+      return TELEMETRY_DATABASE_IDS[configured] if configured.is_a?(Symbol) && TELEMETRY_DATABASE_IDS.key?(configured)
+      return "adapter" if configured.respond_to?(:call)
+
+      TELEMETRY_ADAPTER_IDS[configured.class.name] || "adapter"
+    end
+
+    def telemetry_adapter_id
+      TELEMETRY_ADAPTER_IDS[@context.adapter.class.name] || @context.adapter.class.name
+    end
+
+    def noop_telemetry_publisher
+      Class.new do
+        def publish(_event) = nil
+
+        def enabled? = false
+      end.new
+    end
+
+    def log_telemetry_error(error)
+      logger = @options.logger
+      message = "[better-auth] telemetry creation failed: #{error.class}: #{error.message}"
+      if logger.respond_to?(:error)
+        logger.error(message)
+      else
+        Kernel.warn(message)
+      end
+    end
   end
 end

data/lib/better_auth/configuration.rb

@@ -56,6 +56,7 @@ module BetterAuth
       :on_api_error,
       :disabled_paths,
       :trusted_origins_callback,
+      :telemetry,
       :logger
 
     def initialize(options = {})
@@ -73,12 +74,13 @@ module BetterAuth
       @database_hooks = options[:database_hooks]
       @hooks = options[:hooks]
       @on_api_error = symbolize_keys(options[:on_api_error] || options[:on_apierror] || {})
-      @social_providers = symbolize_keys(options[:social_providers] || {})
+      @telemetry = symbolize_keys(options[:telemetry] || {})
+      @social_providers = normalize_social_providers(options[:social_providers])
       @trusted_origins_callbacks = []
       @trusted_origins_callbacks << options[:trusted_origins] if options[:trusted_origins].respond_to?(:call)
       @trusted_origins_callback = combined_trusted_origins_callback
       legacy_secret = resolve_secret(options, allow_test_default: false)
-      secrets = options.key?(:secrets) ? options[:secrets] : SecretConfig.parse_env(ENV["BETTER_AUTH_SECRETS"])
+      secrets = options.key?(:secrets) ? options[:secrets] : SecretConfig.parse_env(Env.get("BETTER_AUTH_SECRETS"))
       if secrets
         @secret_config = SecretConfig.build(secrets, legacy_secret, logger: logger)
         @secret = @secret_config.current_secret
@@ -153,7 +155,8 @@ module BetterAuth
         database_hooks: database_hooks,
         hooks: hooks,
         on_api_error: on_api_error,
-        disabled_paths: disabled_paths
+        disabled_paths: disabled_paths,
+        telemetry: telemetry
       }
     end
 
@@ -279,17 +282,13 @@ module BetterAuth
     def env_base_url
       base_url = ENV["BASE_URL"]
       [
-        ENV["BETTER_AUTH_URL"],
-        ENV["NEXT_PUBLIC_BETTER_AUTH_URL"],
-        ENV["PUBLIC_BETTER_AUTH_URL"],
-        ENV["NUXT_PUBLIC_BETTER_AUTH_URL"],
-        ENV["NUXT_PUBLIC_AUTH_URL"],
+        Env.get("BETTER_AUTH_URL"),
         (base_url unless base_url == "/")
       ].find { |value| value && !value.empty? }
     end
 
     def resolve_secret(options, allow_test_default: true)
-      [options[:secret], ENV["BETTER_AUTH_SECRET"], ENV["AUTH_SECRET"]].find { |value| value && !value.empty? } ||
+      [options[:secret], Env.get("BETTER_AUTH_SECRET"), ENV["AUTH_SECRET"]].find { |value| value && !value.empty? } ||
         ((allow_test_default && test_environment?) ? DEFAULT_SECRET : nil)
     end
 
@@ -372,6 +371,12 @@ module BetterAuth
       Array(value).compact.reject { |plugin| plugin == false }.map { |plugin| Plugin.coerce(plugin) }
     end
 
+    def normalize_social_providers(value)
+      symbolize_keys(value || {}).reject do |_id, provider|
+        provider.nil? || provider == false || (provider.is_a?(Hash) && provider[:enabled] == false)
+      end
+    end
+
     def normalize_trusted_origins(value)
       origins = []
       origins << base_url unless base_url.nil? || base_url.empty?
@@ -408,7 +413,7 @@ module BetterAuth
     end
 
     def env_trusted_origins
-      ENV.fetch("BETTER_AUTH_TRUSTED_ORIGINS", "").split(",").map(&:strip).reject(&:empty?)
+      Env.csv("BETTER_AUTH_TRUSTED_ORIGINS")
     end
 
     def symbolize_keys(value)

data/lib/better_auth/context.rb

@@ -321,7 +321,7 @@ module BetterAuth
       if options.trusted_origins_callback
         origins.concat(Array(options.trusted_origins_callback.call(request)).compact)
       end
-      origins.concat(ENV.fetch("BETTER_AUTH_TRUSTED_ORIGINS", "").split(",").map(&:strip))
+      origins.concat(Env.csv("BETTER_AUTH_TRUSTED_ORIGINS"))
       origins.map(&:to_s).reject(&:empty?).uniq
     rescue URI::InvalidURIError
       options.trusted_origins

data/lib/better_auth/cookies.rb

@@ -67,7 +67,7 @@ module BetterAuth
         name, value = pair.split("=", 2)
         next if name.to_s.empty? || value.nil?
 
-        result[name.strip] = value.strip
+        result[name.strip] = decode_cookie_value(value.strip)
       end
     end
 
@@ -150,12 +150,14 @@ module BetterAuth
       Crypto.symmetric_decode_jwt(value, ctx.context.secret_config, "better-auth-account")
     end
 
-    def get_cookie_cache(request_or_cookie_header, secret:, strategy: "compact", version: nil, cookie_prefix: "better-auth", cookie_name: "session_data", is_secure: nil)
+    def get_cookie_cache(request_or_cookie_header, secret:, strategy: "compact", version: nil, cookie_prefix: "better-auth", cookie_name: "session_data", is_secure: nil, cookie_full_name: nil)
       cookie_header = header_value(request_or_cookie_header)
       return nil if cookie_header.to_s.empty?
 
       parsed = parse_cookies(cookie_header)
-      name = if is_secure.nil?
+      name = if cookie_full_name
+        cookie_full_name
+      elsif is_secure.nil?
         production_environment? ? "#{SECURE_COOKIE_PREFIX}#{cookie_prefix}.#{cookie_name}" : "#{cookie_prefix}.#{cookie_name}"
       else
         secure_prefix = is_secure ? SECURE_COOKIE_PREFIX : ""
@@ -248,6 +250,12 @@ module BetterAuth
       chunks.sort_by(&:first).map(&:last).join
     end
 
+    def decode_cookie_value(value)
+      URI.decode_uri_component(value)
+    rescue ArgumentError
+      value
+    end
+
     def header_value(request_or_cookie_header)
       return request_or_cookie_header.headers["cookie"] if request_or_cookie_header.respond_to?(:headers)
       return request_or_cookie_header.get_header("HTTP_COOKIE") if request_or_cookie_header.respond_to?(:get_header)

data/lib/better_auth/doctor.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require "better_auth/sql_migration"
+
+module BetterAuth
+  module Doctor
+    Result = Struct.new(:ok, :warnings, :errors, keyword_init: true) do
+      def success?
+        errors.empty?
+      end
+    end
+
+    module_function
+
+    def check(config_or_options)
+      config = BetterAuth::SQLMigration.configuration_for(config_or_options)
+      result = Result.new(ok: ["config loaded"], warnings: [], errors: [])
+
+      check_secret(config, result)
+      check_base_url(config, result)
+      check_rate_limit(config, result)
+      check_database(config, result)
+
+      result
+    end
+
+    def print(result, stdout:, stderr:)
+      result.ok.each { |message| stdout.puts "OK #{message}" }
+      result.warnings.each { |message| stdout.puts "WARN #{message}" }
+      result.errors.each { |message| stderr.puts "ERROR #{message}" }
+      result.success? ? 0 : 1
+    end
+
+    def check_secret(config, result)
+      secret = config.secret.to_s
+      if secret.empty?
+        result.errors << "secret is missing"
+      elsif secret == BetterAuth::Configuration::DEFAULT_SECRET
+        result.errors << "secret uses the default development value"
+      elsif secret.length < 32
+        result.errors << "secret should be at least 32 characters"
+      elsif entropy(secret) < 120
+        result.errors << "secret appears low-entropy; use a random production secret"
+      else
+        result.ok << "secret length and entropy look acceptable"
+      end
+    end
+
+    def check_base_url(config, result)
+      base_url = config.base_url.to_s
+      if base_url.empty?
+        result.warnings << "base_url is not configured; set it explicitly in production"
+      elsif !base_url.start_with?("https://")
+        result.warnings << "base_url is not HTTPS"
+      else
+        result.ok << "base_url uses HTTPS"
+      end
+    end
+
+    def check_rate_limit(config, result)
+      rate_limit = config.rate_limit || {}
+      result.warnings << "rate_limit is disabled" unless rate_limit[:enabled]
+      if rate_limit[:storage].to_s == "memory"
+        result.warnings << "rate_limit uses memory storage; use database or secondary-storage for multi-process production deployments"
+      else
+        result.ok << "rate_limit storage is #{rate_limit[:storage]}"
+      end
+    end
+
+    def check_database(config, result)
+      auth = BetterAuth.auth(config.to_h)
+      adapter = auth.context.adapter
+      unless adapter.respond_to?(:dialect) && adapter.respond_to?(:connection)
+        result.warnings << "database adapter does not expose SQL migration introspection; schema drift check skipped"
+        return
+      end
+
+      result.ok << "database adapter supports SQL migrations"
+      plan = BetterAuth::SQLMigration.plan(config, connection: adapter.connection, dialect: adapter.dialect)
+      if plan.empty?
+        result.ok << "database schema is up to date"
+      else
+        result.warnings << "database has pending Better Auth migrations"
+        plan.warnings.each { |warning| result.warnings << warning }
+      end
+    rescue BetterAuth::SQLMigration::UnsupportedAdapterError => error
+      result.warnings << error.message
+    end
+
+    def entropy(value)
+      unique = value.chars.uniq.length
+      return 0 if unique.zero?
+
+      Math.log2(unique**value.length)
+    end
+  end
+end

data/lib/better_auth/endpoint.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "uri"
 
 module BetterAuth
   class Endpoint
@@ -24,6 +25,7 @@ module BetterAuth
       @headers_schema = headers_schema
       @metadata = metadata || {}
       apply_default_open_api_metadata!
+      apply_open_api_defaults!
       apply_open_api_schemas!
       @options = endpoint_options
       @use = Array(use)
@@ -40,13 +42,12 @@ module BetterAuth
     end
 
     def call(context)
-      apply_schemas!(context)
-
       use.each do |middleware|
         middleware_result = middleware.call(context)
         return Result.from_value(middleware_result, context) if middleware_result
       end
 
+      apply_schemas!(context)
       Result.from_value(handler.call(context), context)
     end
 
@@ -72,6 +73,41 @@ module BetterAuth
       metadata[:openapi] = BetterAuth::OpenAPI.default_metadata(path, methods)
     end
 
+    def apply_open_api_defaults!
+      return unless path
+      return unless defined?(BetterAuth::OpenAPI)
+
+      openapi = fetch_key(metadata, :openapi)
+      return unless openapi.is_a?(Hash)
+
+      defaults = BetterAuth::OpenAPI.default_metadata(path, methods)
+      openapi[:operationId] = defaults[:operationId] if fetch_key(openapi, :operationId).to_s.empty?
+      openapi[:description] = defaults[:description] if default_open_api_description?(fetch_key(openapi, :description))
+      openapi[:parameters] = merge_open_api_parameters(defaults[:parameters], fetch_key(openapi, :parameters))
+      openapi[:responses] = defaults[:responses].merge(fetch_key(openapi, :responses) || {})
+      if request_body_method? && !fetch_key(openapi, :requestBody).is_a?(Hash)
+        openapi[:requestBody] = defaults[:requestBody] || BetterAuth::OpenAPI.default_request_body
+      end
+    end
+
+    def default_open_api_description?(description)
+      methods.any? { |method| description.to_s == "#{method} #{path}" }
+    end
+
+    def request_body_method?
+      methods.any? { |method| %w[POST PUT PATCH].include?(method) }
+    end
+
+    def merge_open_api_parameters(default_parameters, custom_parameters)
+      merged = Array(custom_parameters).dup
+      Array(default_parameters).each do |parameter|
+        next if merged.any? { |entry| fetch_key(entry, :name).to_s == fetch_key(parameter, :name).to_s && fetch_key(entry, :in).to_s == fetch_key(parameter, :in).to_s }
+
+        merged << parameter
+      end
+      merged
+    end
+
     def apply_open_api_schemas!
       openapi = fetch_key(metadata, :openapi)
       return unless openapi.is_a?(Hash)
@@ -172,6 +208,42 @@ module BetterAuth
     class Result
       attr_accessor :response, :status, :headers
 
+      class SetCookieHeader < Array
+        def self.from(value)
+          new(value.lines.map(&:chomp))
+        end
+
+        def include?(value)
+          return super unless value.is_a?(String)
+
+          any? { |line| line.include?(value) }
+        end
+
+        def lines
+          self
+        end
+
+        def match(...)
+          to_s.match(...)
+        end
+
+        def =~(pattern)
+          to_s =~ pattern
+        end
+
+        def split(...)
+          to_s.split(...)
+        end
+
+        def to_s
+          join("\n")
+        end
+
+        def to_str
+          to_s
+        end
+      end
+
       def initialize(response:, status: 200, headers: {}, raw_response: nil)
         @response = response
         @status = status
@@ -223,7 +295,7 @@ module BetterAuth
       end
 
       def to_response
-        return Response.from_rack(@raw_response) if raw_response?
+        return Response.from_rack([@raw_response[0], rack_headers(@raw_response[1]), @raw_response[2]]) if raw_response?
 
         body = if response.nil?
           [JSON.generate(nil)]
@@ -232,12 +304,23 @@ module BetterAuth
         else
           [JSON.generate(response)]
         end
-        response_headers = {"content-type" => "application/json"}.merge(headers)
+        response_headers = rack_headers({"content-type" => "application/json"}.merge(headers))
         Response.new(status: status, headers: response_headers, body: body)
       end
 
       private
 
+      def rack_headers(value)
+        value.each_with_object({}) do |(key, header_value), result|
+          normalized = key.to_s.downcase
+          result[normalized] = if normalized == "set-cookie" && header_value.is_a?(String) && header_value.include?("\n")
+            SetCookieHeader.from(header_value)
+          else
+            header_value
+          end
+        end
+      end
+
       def normalize_headers(headers)
         headers.each_with_object({}) do |(key, value), result|
           result[key.to_s.downcase] = value
@@ -290,7 +373,7 @@ module BetterAuth
 
       def set_cookie(name, value, options = {})
         attributes = cookie_attributes(options)
-        cookie = (["#{name}=#{value}"] + attributes).join("; ")
+        cookie = (["#{name}=#{URI.encode_uri_component(value.to_s)}"] + attributes).join("; ")
         set_header("set-cookie", cookie)
       end
 

data/lib/better_auth/env.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Env
+    module_function
+
+    def get(name)
+      open_auth_name = open_auth_name(name)
+      return nil unless open_auth_name
+
+      value = ENV[open_auth_name]
+      return value if present?(value)
+
+      value = ENV[name]
+      present?(value) ? value : nil
+    end
+
+    def fetch(name, default = nil)
+      value = get(name)
+      value.nil? ? default : value
+    end
+
+    def csv(name)
+      fetch(name, "").split(",").map(&:strip).reject(&:empty?)
+    end
+
+    def open_auth_name(name)
+      text = name.to_s
+      return nil unless text.start_with?("BETTER_AUTH_")
+
+      text.sub(/\ABETTER_AUTH_/, "OPEN_AUTH_")
+    end
+
+    def present?(value)
+      value && !value.empty?
+    end
+  end
+end

data/lib/better_auth/http_client.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "json"
+require "net/http"
+require "uri"
+
+module BetterAuth
+  module HTTPClient
+    DEFAULT_OPEN_TIMEOUT = 5
+    DEFAULT_READ_TIMEOUT = 5
+
+    module_function
+
+    def request(uri, request, open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT)
+      Net::HTTP.start(
+        uri.hostname || uri.host,
+        uri.port,
+        use_ssl: uri.scheme == "https",
+        open_timeout: open_timeout,
+        read_timeout: read_timeout
+      ) do |http|
+        http.request(request)
+      end
+    end
+
+    def get_response(uri, headers = {})
+      request = Net::HTTP::Get.new(uri)
+      headers.each { |key, value| request[key.to_s] = value.to_s }
+      request(uri, request)
+    end
+
+    def post_form(uri, form_body, headers = {})
+      request = Net::HTTP::Post.new(uri)
+      headers.each { |key, value| request[key.to_s] = value.to_s }
+      request["Content-Type"] ||= "application/x-www-form-urlencoded"
+      request.body = form_body
+      request(uri, request)
+    end
+
+    def get_json(url, headers = {})
+      uri = url.is_a?(URI) ? url : URI.parse(url.to_s)
+      response = get_response(uri, headers)
+      response.is_a?(Net::HTTPSuccess) ? JSON.parse(response.body.to_s) : nil
+    end
+  end
+end

data/lib/better_auth/migration_plan.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module MigrationPlan
+    TableChange = Struct.new(:logical_name, :table_name, :table, :order, keyword_init: true)
+    FieldChange = Struct.new(:logical_name, :table_name, :fields, :table, :order, keyword_init: true)
+    IndexChange = Struct.new(:table_name, :field_name, :name, :unique, :field, keyword_init: true)
+
+    Plan = Struct.new(:to_create, :to_add, :to_index, :warnings, :dialect, :tables, keyword_init: true) do
+      def empty?
+        to_create.empty? && to_add.empty? && to_index.empty?
+      end
+    end
+  end
+end

data/lib/better_auth/oauth2.rb

@@ -81,7 +81,7 @@ module BetterAuth
 
     def post_form(token_endpoint, request)
       uri = URI.parse(token_endpoint)
-      response = Net::HTTP.post(uri, URI.encode_www_form(request[:body]), request[:headers])
+      response = HTTPClient.post_form(uri, URI.encode_www_form(request[:body]), request[:headers])
       JSON.parse(response.body)
     end
 

data/lib/better_auth/plugins/admin.rb

@@ -66,7 +66,11 @@ module BetterAuth
           after: [
             {
               matcher: ->(ctx) { ctx.path == "/list-sessions" },
-              handler: ->(ctx) { ctx.json(Array(ctx.returned).reject { |session| session["impersonatedBy"] || session[:impersonatedBy] }) }
+              handler: lambda do |ctx|
+                next unless ctx.returned.is_a?(Array)
+
+                ctx.json(ctx.returned.reject { |session| session["impersonatedBy"] || session[:impersonatedBy] })
+              end
             }
           ]
         },
@@ -436,6 +440,7 @@ module BetterAuth
           openapi: {
             operationId: "stopImpersonating",
             description: "Stop impersonating a user",
+            requestBody: OpenAPI.empty_request_body,
             responses: {
               "200" => OpenAPI.json_response("Impersonation stopped", OpenAPI.session_response_schema_pair)
             }

data/lib/better_auth/plugins/anonymous.rb

@@ -47,6 +47,7 @@ module BetterAuth
           openapi: {
             operationId: "signInAnonymous",
             description: "Sign in anonymously",
+            requestBody: OpenAPI.empty_request_body,
             responses: {
               "200" => OpenAPI.json_response(
                 "Anonymous session created",
@@ -96,6 +97,7 @@ module BetterAuth
           openapi: {
             operationId: "deleteAnonymousUser",
             description: "Delete the current anonymous user",
+            requestBody: OpenAPI.empty_request_body,
             responses: {
               "200" => OpenAPI.json_response("Anonymous user deleted", OpenAPI.success_response_schema)
             }

data/lib/better_auth/plugins/captcha.rb

@@ -103,7 +103,7 @@ module BetterAuth
       else
         URI.encode_www_form(verifier[:payload])
       end
-      response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       raise CAPTCHA_INTERNAL_ERROR_CODES["SERVICE_UNAVAILABLE"] unless response.is_a?(Net::HTTPSuccess)
 
       JSON.parse(response.body.to_s)

data/lib/better_auth/plugins/device_authorization.rb

@@ -54,6 +54,14 @@ module BetterAuth
           openapi: {
             operationId: "requestDeviceCode",
             description: "Request a device and user code",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  client_id: {type: "string", description: "OAuth client ID"},
+                  scope: {type: "string", description: "Requested scopes"}
+                }
+              )
+            ),
             responses: {
               "200" => OpenAPI.json_response("Success", device_code_response_schema)
             }
@@ -106,6 +114,16 @@ module BetterAuth
           openapi: {
             operationId: "exchangeDeviceToken",
             description: "Exchange device code for access token",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  grant_type: {type: "string", enum: [OAuthProtocol::DEVICE_CODE_GRANT]},
+                  device_code: {type: "string"},
+                  client_id: {type: "string"}
+                },
+                required: ["grant_type", "device_code"]
+              )
+            ),
             responses: {
               "200" => OpenAPI.json_response("Success", device_token_response_schema)
             }
@@ -197,6 +215,14 @@ module BetterAuth
           openapi: {
             operationId: "approveDevice",
             description: "Approve a device authorization request",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  user_code: {type: "string", description: "User code shown on the device"},
+                  userCode: {type: "string", description: "User code shown on the device"}
+                }
+              )
+            ),
             responses: {
               "200" => OpenAPI.json_response("Success", OpenAPI.success_response_schema)
             }
@@ -218,6 +244,14 @@ module BetterAuth
           openapi: {
             operationId: "denyDevice",
             description: "Deny a device authorization request",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  user_code: {type: "string", description: "User code shown on the device"},
+                  userCode: {type: "string", description: "User code shown on the device"}
+                }
+              )
+            ),
             responses: {
               "200" => OpenAPI.json_response("Success", OpenAPI.success_response_schema)
             }