better_auth 0.7.0 → 0.10.0

data/lib/better_auth/plugins/oidc_provider.rb

@@ -441,6 +441,8 @@ module BetterAuth
           openapi: {
             operationId: "oauth2EndSession",
             description: "RP-Initiated Logout endpoint",
+            parameters: oidc_end_session_schema[:properties].keys.map { |name| OpenAPI.query_parameter(name.to_s, schema: oidc_end_session_schema[:properties][name]) },
+            requestBody: OpenAPI.json_request_body(oidc_end_session_schema, required: false),
             responses: {
               "302" => {description: "Redirects after clearing the session cookie"}
             }
@@ -470,6 +472,7 @@ module BetterAuth
         openapi: {
           operationId: operation_id,
           description: description,
+          requestBody: oidc_request_body_for(operation_id),
           responses: {
             "200" => OpenAPI.json_response(response_description, response_schema)
           }
@@ -477,6 +480,62 @@ module BetterAuth
       }
     end
 
+    def oidc_request_body_for(operation_id)
+      schema = case operation_id
+      when "registerOAuthApplication", "updateOAuthApplication"
+        oidc_client_registration_schema
+      when "rotateOAuthApplicationSecret"
+        OpenAPI.empty_request_body.dig(:content, "application/json", :schema)
+      when "oauth2Consent"
+        OpenAPI.object_schema({consent_code: {type: "string"}, accept: {type: "boolean"}}, required: ["consent_code"])
+      when "oauth2Token"
+        OpenAPI.object_schema(
+          {
+            grant_type: {type: "string", enum: [OAuthProtocol::AUTH_CODE_GRANT, OAuthProtocol::REFRESH_GRANT]},
+            code: {type: "string"},
+            redirect_uri: {type: "string", format: "uri"},
+            code_verifier: {type: "string"},
+            client_id: {type: "string"},
+            client_secret: {type: "string"},
+            refresh_token: {type: "string"},
+            scope: {type: "string"}
+          },
+          required: ["grant_type"]
+        )
+      when "oauth2Introspect", "oauth2Revoke"
+        OpenAPI.object_schema({token: {type: "string"}, token_type_hint: {type: "string", enum: ["access_token", "refresh_token"]}}, required: ["token"])
+      end
+      schema ? OpenAPI.json_request_body(schema) : nil
+    end
+
+    def oidc_client_registration_schema
+      OpenAPI.object_schema(
+        {
+          redirect_uris: {type: "array", items: {type: "string", format: "uri"}},
+          post_logout_redirect_uris: {type: "array", items: {type: "string", format: "uri"}},
+          client_name: {type: "string"},
+          client_uri: {type: "string", format: "uri"},
+          logo_uri: {type: "string", format: "uri"},
+          grant_types: {type: "array", items: {type: "string"}},
+          response_types: {type: "array", items: {type: "string"}},
+          scope: {type: "string"},
+          scopes: {type: "array", items: {type: "string"}},
+          metadata: {type: "object", additionalProperties: true}
+        }
+      )
+    end
+
+    def oidc_end_session_schema
+      OpenAPI.object_schema(
+        {
+          id_token_hint: {type: "string"},
+          client_id: {type: "string"},
+          post_logout_redirect_uri: {type: "string", format: "uri"},
+          state: {type: "string"}
+        }
+      )
+    end
+
     def oidc_client_schema
       OpenAPI.object_schema(
         {
@@ -541,7 +600,7 @@ module BetterAuth
     def oidc_provider_schema
       {
         oauthApplication: {
-          modelName: "oauthApplication",
+          model_name: "oauth_applications",
           fields: {
             name: {type: "string"},
             icon: {type: "string", required: false},
@@ -565,7 +624,7 @@ module BetterAuth
           }
         },
         oauthAccessToken: {
-          modelName: "oauthAccessToken",
+          model_name: "oauth_access_tokens",
           fields: {
             accessToken: {type: "string", unique: true, required: false},
             token: {type: "string", unique: true, required: false},
@@ -583,7 +642,7 @@ module BetterAuth
           }
         },
         oauthConsent: {
-          modelName: "oauthConsent",
+          model_name: "oauth_consents",
           fields: {
             clientId: {type: "string", required: true},
             userId: {type: "string", required: true},

data/lib/better_auth/plugins/one_tap.rb

@@ -32,6 +32,14 @@ module BetterAuth
             operationId: "oneTapCallback",
             summary: "One tap callback",
             description: "Use this endpoint to authenticate with Google One Tap",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  id_token: {type: "string", description: "Google One Tap ID token"}
+                },
+                required: ["id_token"]
+              )
+            ),
             responses: {
               "200" => OpenAPI.json_response("Success", OpenAPI.session_response_schema_pair)
             }
@@ -105,16 +113,20 @@ module BetterAuth
         options[:aud] = audience
         options[:verify_aud] = true
       end
-      payload, = JWT.decode(id_token, nil, true, options.merge(jwks: jwks))
+      payload, = ::JWT.decode(id_token, nil, true, options.merge(jwks: jwks))
       payload
     end
 
     def one_tap_google_jwks
-      uri = URI("https://www.googleapis.com/oauth2/v3/certs")
-      response = Net::HTTP.get_response(uri)
-      raise "Unable to fetch Google JWKS" unless response.is_a?(Net::HTTPSuccess)
+      cached = @one_tap_google_jwks_cache
+      return cached[:jwks] if cached && cached[:expires_at] > Time.now
 
-      JWT::JWK::Set.new(JSON.parse(response.body))
+      payload = HTTPClient.get_json("https://www.googleapis.com/oauth2/v3/certs")
+      raise "Unable to fetch Google JWKS" unless payload
+
+      jwks = ::JWT::JWK::Set.new(payload)
+      @one_tap_google_jwks_cache = {jwks: jwks, expires_at: Time.now + 300}
+      jwks
     end
 
     def one_tap_link_account_unless_present!(ctx, _config, user, payload, id_token)

data/lib/better_auth/plugins/open_api.rb

@@ -128,6 +128,21 @@ module BetterAuth
       }
     end
 
+    def default_request_body
+      {
+        required: true,
+        content: {
+          "application/json" => {
+            schema: {
+              type: "object",
+              properties: {},
+              additionalProperties: true
+            }
+          }
+        }
+      }
+    end
+
     def responses(responses = nil)
       {"200" => success_response}.merge(default_error_responses).merge(responses || {})
     end
@@ -142,6 +157,17 @@ module BetterAuth
       )
     end
 
+    def default_success_response
+      json_response(
+        "Success",
+        {
+          type: "object",
+          properties: {},
+          additionalProperties: true
+        }
+      )
+    end
+
     def default_error_responses
       {
         "400" => error_response("Bad Request. Usually due to missing parameters, or invalid parameters.", required: true),
@@ -168,10 +194,16 @@ module BetterAuth
 
     def default_metadata(path, methods)
       method = Array(methods).reject { |value| value.to_s == "*" }.first.to_s.upcase
-      {
+      metadata = {
         operationId: operation_id(path, method),
-        description: "#{method} #{path}"
+        description: "Execute the #{operation_id(path, method)} endpoint.",
+        parameters: default_path_parameters(path),
+        responses: {
+          "200" => default_success_response
+        }
       }
+      metadata[:requestBody] = default_request_body if %w[POST PUT PATCH].include?(method)
+      metadata
     end
 
     def operation_id(path, method)
@@ -183,6 +215,14 @@ module BetterAuth
 
       "#{method.to_s.downcase}#{base}"
     end
+
+    def default_path_parameters(path)
+      path.to_s.split("/").filter_map do |part|
+        next unless part.start_with?(":")
+
+        path_parameter(part.delete_prefix(":"))
+      end
+    end
   end
 
   module Plugins

data/lib/better_auth/plugins/organization.rb

@@ -527,14 +527,14 @@ module BetterAuth
       end
     end
 
-    def organization_list_members_endpoint(_config)
+    def organization_list_members_endpoint(config)
       Endpoint.new(path: "/organization/list-members", method: "GET", metadata: organization_openapi("listOrganizationMembers", "List organization members", response: organization_members_response_schema)) do |ctx|
         session = Routes.current_session(ctx)
         query = normalize_hash(ctx.query)
         organization_id = query[:organization_id] || organization_by_slug(ctx, query[:organization_slug])&.fetch("id") || session[:session]["activeOrganizationId"]
         raise APIError.new("BAD_REQUEST", message: ORGANIZATION_ERROR_CODES.fetch("NO_ACTIVE_ORGANIZATION")) unless organization_id
         require_member!(ctx, session[:user]["id"], organization_id)
-        ctx.json(list_members_for(ctx, organization_id, query))
+        ctx.json(list_members_for(ctx, organization_id, query, config, session[:user]))
       end
     end
 
@@ -768,6 +768,7 @@ module BetterAuth
     end
 
     def organization_openapi(operation_id, description, response:, response_description: "Success", request: nil, required: [], parameters: nil)
+      request ||= organization_request_schema(operation_id)
       openapi = {
         operationId: operation_id,
         description: description,
@@ -781,6 +782,68 @@ module BetterAuth
       {openapi: openapi}
     end
 
+    def organization_request_schema(operation_id)
+      string = {type: "string"}
+      boolean = {type: "boolean"}
+      array = ->(items = string) { {type: "array", items: items} }
+      object = {type: "object", additionalProperties: true}
+      {
+        "createOrganization" => {
+          name: string,
+          slug: string,
+          logo: string,
+          metadata: object,
+          userId: string,
+          user_id: string,
+          keepCurrentActiveOrganization: boolean,
+          keep_current_active_organization: boolean
+        },
+        "checkOrganizationSlug" => {slug: string},
+        "updateOrganization" => {
+          organizationId: string,
+          organization_id: string,
+          organizationSlug: string,
+          organization_slug: string,
+          data: object,
+          name: string,
+          slug: string,
+          logo: string,
+          metadata: object
+        },
+        "deleteOrganization" => {organizationId: string, organization_id: string, organizationSlug: string, organization_slug: string},
+        "setActiveOrganization" => {organizationId: string, organization_id: string, organizationSlug: string, organization_slug: string},
+        "createOrganizationInvitation" => {
+          organizationId: string,
+          organization_id: string,
+          organizationSlug: string,
+          organization_slug: string,
+          email: {type: "string", format: "email"},
+          role: {oneOf: [string, array.call]},
+          teamId: string,
+          team_id: string,
+          teamIds: array.call,
+          team_ids: array.call
+        },
+        "acceptOrganizationInvitation" => {invitationId: string, invitation_id: string, id: string},
+        "rejectOrganizationInvitation" => {invitationId: string, invitation_id: string},
+        "cancelOrganizationInvitation" => {invitationId: string, invitation_id: string},
+        "addOrganizationMember" => {organizationId: string, organization_id: string, userId: string, user_id: string, role: {oneOf: [string, array.call]}},
+        "removeOrganizationMember" => {memberId: string, member_id: string, userId: string, user_id: string, organizationId: string, organization_id: string},
+        "updateOrganizationMemberRole" => {memberId: string, member_id: string, userId: string, user_id: string, organizationId: string, organization_id: string, role: {oneOf: [string, array.call]}},
+        "leaveOrganization" => {organizationId: string, organization_id: string},
+        "hasOrganizationPermission" => {organizationId: string, organization_id: string, permission: object, permissions: object},
+        "createOrganizationTeam" => {organizationId: string, organization_id: string, name: string},
+        "updateOrganizationTeam" => {teamId: string, team_id: string, name: string},
+        "removeOrganizationTeam" => {teamId: string, team_id: string},
+        "setActiveOrganizationTeam" => {teamId: string, team_id: string},
+        "addTeamMember" => {teamId: string, team_id: string, userId: string, user_id: string},
+        "removeTeamMember" => {teamId: string, team_id: string, userId: string, user_id: string},
+        "createOrganizationRole" => {organizationId: string, organization_id: string, role: string, roleName: string, role_name: string, permission: object, permissions: object},
+        "updateOrganizationRole" => {organizationId: string, organization_id: string, roleId: string, role_id: string, role: string, roleName: string, role_name: string, permission: object, permissions: object, data: object},
+        "deleteOrganizationRole" => {organizationId: string, organization_id: string, roleId: string, role_id: string, role: string, roleName: string, role_name: string}
+      }[operation_id]
+    end
+
     def organization_ref_schema(name)
       {
         type: "object",
@@ -969,7 +1032,7 @@ module BetterAuth
       ctx.context.adapter.find_one(model: "organizationRole", where: [{field: "organizationId", value: organization_id}, {field: "role", value: role}])
     end
 
-    def list_members_for(ctx, organization_id, query = {})
+    def list_members_for(ctx, organization_id, query = {}, config = nil, user = nil)
       where = [{field: "organizationId", value: organization_id}]
       if query[:filter_field]
         where << {field: query[:filter_field], value: query[:filter_value], operator: query[:filter_operator]}
@@ -977,19 +1040,48 @@ module BetterAuth
         filter = normalize_hash(query[:filter])
         where << {field: filter[:field], value: filter[:value], operator: filter[:operator]}
       end
+      limit = member_list_limit(ctx, organization_id, query, config, user)
       members = ctx.context.adapter.find_many(
         model: "member",
         where: where,
-        limit: query[:limit],
+        limit: limit,
         offset: query[:offset],
         sort_by: query[:sort_by] ? {field: query[:sort_by], direction: query[:sort_direction] || query[:sort_order] || "asc"} : nil
       )
+      users_by_id = member_users_by_id(ctx, members)
       {
-        members: members.map { |entry| member_wire(ctx, entry) },
+        members: members.map { |entry| member_wire(ctx, entry, users_by_id: users_by_id) },
         total: ctx.context.adapter.count(model: "member", where: where)
       }
     end
 
+    def member_list_limit(ctx, organization_id, query, config, user)
+      configured = config && config[:membership_limit]
+      configured = 100 if configured.nil?
+      default = numeric_member_limit(configured)
+      default = 100 unless default.positive?
+      requested = query[:limit].to_i if query.key?(:limit) && !query[:limit].to_s.empty?
+      return default unless requested&.positive?
+
+      [requested, default].min
+    end
+
+    def numeric_member_limit(value)
+      return value.to_i if value.is_a?(Numeric)
+      return value.to_i if value.to_s.match?(/\A\d+\z/)
+
+      100
+    end
+
+    def member_users_by_id(ctx, members)
+      user_ids = members.map { |member| member["userId"] }.compact.uniq
+      return {} if user_ids.empty?
+
+      ctx.context.adapter.find_many(model: "user", where: [{field: "id", operator: "in", value: user_ids}]).each_with_object({}) do |user, result|
+        result[user["id"]] = user
+      end
+    end
+
     def ensure_team_member_capacity!(ctx, config, team_ids)
       max_members = config.dig(:teams, :maximum_members_per_team)
       return unless max_members && team_ids.any?
@@ -1002,9 +1094,9 @@ module BetterAuth
       end
     end
 
-    def member_wire(ctx, member)
+    def member_wire(ctx, member, users_by_id: nil)
       data = Schema.parse_output(ctx.context.options, "member", member)
-      user = ctx.context.internal_adapter.find_user_by_id(member["userId"])
+      user = users_by_id ? users_by_id[member["userId"]] : ctx.context.internal_adapter.find_user_by_id(member["userId"])
       data["user"] = user.slice("id", "name", "email", "image") if user
       data
     end
@@ -1034,8 +1126,11 @@ module BetterAuth
     def ensure_not_last_owner!(ctx, member)
       return unless member["role"].to_s.split(",").include?("owner")
 
-      owners = ctx.context.adapter.find_many(model: "member", where: [{field: "organizationId", value: member["organizationId"]}]).select { |entry| entry["role"].to_s.split(",").include?("owner") }
-      raise APIError.new("BAD_REQUEST", message: ORGANIZATION_ERROR_CODES.fetch("YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER")) if owners.length <= 1
+      owner_count = 0
+      organization_each_adapter_record(ctx.context.adapter, "member", where: [{field: "organizationId", value: member["organizationId"]}]) do |entry|
+        owner_count += 1 if entry["role"].to_s.split(",").include?("owner")
+      end
+      raise APIError.new("BAD_REQUEST", message: ORGANIZATION_ERROR_CODES.fetch("YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER")) if owner_count <= 1
     end
 
     def create_default_team(ctx, config, organization, session)
@@ -1053,8 +1148,24 @@ module BetterAuth
     end
 
     def organization_created_count(ctx, user_id)
-      members = ctx.context.adapter.find_many(model: "member", where: [{field: "userId", value: user_id}])
-      members.count { |member| member["role"].to_s.split(",").include?("owner") }
+      count = 0
+      organization_each_adapter_record(ctx.context.adapter, "member", where: [{field: "userId", value: user_id}]) do |member|
+        count += 1 if member["role"].to_s.split(",").include?("owner")
+      end
+      count
+    end
+
+    def organization_each_adapter_record(adapter, model, where:, page_size: 100)
+      offset = 0
+      loop do
+        records = adapter.find_many(model: model, where: where, limit: page_size, offset: offset)
+        break if records.empty?
+
+        records.each { |record| yield record }
+        break if records.length < page_size
+
+        offset += records.length
+      end
     end
 
     def run_org_hook(config, key, data, ctx)

data/lib/better_auth/plugins/phone_number.rb

@@ -55,7 +55,7 @@ module BetterAuth
         rate_limit: [
           {
             path_matcher: ->(path) { path.start_with?("/phone-number") },
-            window: 60_000,
+            window: 60,
             max: 10
           }
         ],

data/lib/better_auth/plugins/two_factor.rb

@@ -300,6 +300,7 @@ module BetterAuth
         openapi: {
           operationId: operation_id,
           description: description,
+          requestBody: two_factor_request_body(operation_id),
           responses: {
             "200" => OpenAPI.json_response("Success", response_schema)
           }
@@ -307,6 +308,26 @@ module BetterAuth
       }
     end
 
+    def two_factor_request_body(operation_id)
+      schema = case operation_id
+      when "enableTwoFactor"
+        OpenAPI.object_schema({password: {type: "string"}, issuer: {type: "string"}})
+      when "disableTwoFactor", "getTOTPURI", "generateBackupCodes"
+        OpenAPI.object_schema({password: {type: "string"}})
+      when "generateTOTP"
+        OpenAPI.object_schema({secret: {type: "string"}}, required: ["secret"])
+      when "verifyTOTP", "verifyTwoFactorOTP"
+        OpenAPI.object_schema({code: {type: "string"}, trustDevice: {type: "boolean"}, trust_device: {type: "boolean"}}, required: ["code"])
+      when "verifyBackupCode"
+        OpenAPI.object_schema({code: {type: "string"}, disableSession: {type: "boolean"}, disable_session: {type: "boolean"}, trustDevice: {type: "boolean"}, trust_device: {type: "boolean"}}, required: ["code"])
+      when "sendTwoFactorOTP"
+        OpenAPI.empty_request_body.dig(:content, "application/json", :schema)
+      else
+        {type: "object", properties: {}}
+      end
+      OpenAPI.json_request_body(schema)
+    end
+
     def two_factor_enable_response_schema
       OpenAPI.object_schema(
         {

data/lib/better_auth/rate_limiter.rb

@@ -121,9 +121,14 @@ module BetterAuth
     end
 
     def default_special_rule(path)
-      return unless path.start_with?("/sign-in", "/sign-up", "/change-password", "/change-email")
+      return {window: 10, max: 3} if path.start_with?("/sign-in", "/sign-up", "/change-password", "/change-email")
+      return {window: 60, max: 3} if path == "/request-password-reset" ||
+        path == "/send-verification-email" ||
+        path.start_with?("/forget-password") ||
+        path == "/email-otp/send-verification-otp" ||
+        path == "/email-otp/request-password-reset"
 
-      {window: 10, max: 3}
+      nil
     end
 
     def matching_custom_rule(config, path)

data/lib/better_auth/routes/account.rb

@@ -118,6 +118,8 @@ module BetterAuth
       ) do |ctx|
         session = current_session(ctx, allow_nil: true)
         body = normalize_hash(ctx.body)
+        raise APIError.new("UNAUTHORIZED") if ctx.request && !session
+
         user_id = session&.dig(:user, "id") || body["userId"] || body["user_id"]
         raise APIError.new("UNAUTHORIZED") if user_id.to_s.empty?
 
@@ -174,6 +176,8 @@ module BetterAuth
       ) do |ctx|
         session = current_session(ctx, allow_nil: true)
         body = normalize_hash(ctx.body)
+        raise APIError.new("UNAUTHORIZED") if ctx.request && !session
+
         user_id = session&.dig(:user, "id") || body["userId"] || body["user_id"]
         raise APIError.new("BAD_REQUEST", message: "Either userId or session is required") if user_id.to_s.empty?
 

data/lib/better_auth/routes/email_verification.rb

@@ -184,7 +184,11 @@ module BetterAuth
 
     def self.set_verified_session_cookie(ctx, user)
       session = current_session(ctx, allow_nil: true)
-      session_data = session ? session[:session] : ctx.context.internal_adapter.create_session(user["id"])
+      session_data = if session && session[:user]["id"] == user["id"]
+        session[:session]
+      else
+        ctx.context.internal_adapter.create_session(user["id"])
+      end
       Cookies.set_session_cookie(ctx, {session: session_data, user: user})
     end
 

data/lib/better_auth/routes/password.rb

@@ -179,6 +179,7 @@ module BetterAuth
         path: "/verify-password",
         method: "POST",
         metadata: {
+          scope: "server",
           openapi: {
             operationId: "verifyPassword",
             description: "Verify the current user's password",

data/lib/better_auth/routes/social.rb

@@ -2,6 +2,7 @@
 
 require "uri"
 require "json"
+require "net/http"
 require "securerandom"
 
 module BetterAuth
@@ -92,6 +93,7 @@ module BetterAuth
           ctx.context.secret,
           expires_in: 600
         )
+        store_oauth_state_cookie(ctx, state)
         url = call_provider(provider, :create_authorization_url, {
           state: state,
           codeVerifier: code_verifier,
@@ -148,6 +150,7 @@ module BetterAuth
         raise ctx.redirect(oauth_error_url(error_url, data["error"], data["errorDescription"] || data["error_description"])) if data["error"]
         raise ctx.redirect(oauth_error_url(error_url, "oauth_provider_not_found")) unless provider
         raise ctx.redirect(oauth_error_url(error_url, "state_not_found")) unless state_data
+        raise ctx.redirect(oauth_error_url(error_url, "state_mismatch")) unless valid_oauth_state_cookie?(ctx, state)
         raise ctx.redirect(oauth_error_url(error_url, "no_code")) if data["code"].to_s.empty?
 
         tokens = call_provider(provider, :validate_authorization_code, {
@@ -161,7 +164,11 @@ module BetterAuth
 
         token_data = token_hash(tokens)
         token_data["user"] = parse_json_hash(data["user"]) if data["user"]
-        user_info = call_provider(provider, :get_user_info, token_data)
+        user_info = begin
+          call_provider(provider, :get_user_info, token_data)
+        rescue Net::OpenTimeout, Net::ReadTimeout, SocketError, SystemCallError
+          nil
+        end
         user = user_info[:user] || user_info["user"] if user_info
         raise ctx.redirect(oauth_error_url(error_url, "unable_to_get_user_info")) unless user
         raise ctx.redirect(oauth_error_url(error_url, "email_not_found")) if fetch_value(user, "email").to_s.empty?
@@ -269,6 +276,7 @@ module BetterAuth
           }
         }.merge(safe_additional_state(body))
         state = Crypto.sign_jwt(state_data, ctx.context.secret, expires_in: 600)
+        store_oauth_state_cookie(ctx, state)
         url = call_provider(provider, :create_authorization_url, {
           state: state,
           codeVerifier: code_verifier,
@@ -285,6 +293,10 @@ module BetterAuth
 
     def self.social_user_from_id_token!(ctx, provider, id_token)
       token = fetch_value(id_token, "token").to_s
+      unless provider_callable(provider, :verify_id_token)
+        raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES["ID_TOKEN_NOT_SUPPORTED"])
+      end
+
       valid = call_provider(provider, :verify_id_token, token, fetch_value(id_token, "nonce"))
       raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["INVALID_TOKEN"]) unless valid
 
@@ -360,6 +372,22 @@ module BetterAuth
       {session: session, user: user, new_user: new_user}
     end
 
+    def self.store_oauth_state_cookie(ctx, state)
+      return unless ctx.request
+
+      cookie = ctx.context.create_auth_cookie("state", max_age: 600)
+      ctx.set_signed_cookie(cookie.name, state, ctx.context.secret, cookie.attributes)
+    end
+
+    def self.valid_oauth_state_cookie?(ctx, state)
+      return true unless ctx.request
+
+      cookie = ctx.context.create_auth_cookie("state", max_age: 600)
+      stored = ctx.get_signed_cookie(cookie.name, ctx.context.secret)
+      Cookies.expire_cookie(ctx, cookie)
+      stored == state
+    end
+
     def self.oauth_error_url(base_url, error, description = nil)
       uri = URI.parse(base_url.to_s)
       query = URI.decode_www_form(uri.query.to_s)

data/lib/better_auth/routes/user.rb

@@ -80,7 +80,9 @@ module BetterAuth
         current_password = body["currentPassword"] || body["current_password"]
         validate_password_length!(new_password, ctx.context.options.email_and_password)
         account = credential_account(ctx, session[:user]["id"])
-        unless account && account["password"] && verify_password_value(ctx, current_password.to_s, account["password"])
+        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["CREDENTIAL_ACCOUNT_NOT_FOUND"]) unless account && account["password"]
+
+        unless verify_password_value(ctx, current_password.to_s, account["password"])
           raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_PASSWORD"])
         end
 
@@ -176,7 +178,9 @@ module BetterAuth
         sender = ctx.context.options.user.dig(:delete_user, :send_delete_account_verification)
         if body["password"]
           account = credential_account(ctx, session[:user]["id"])
-          unless account && account["password"] && verify_password_value(ctx, body["password"], account["password"])
+          raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["CREDENTIAL_ACCOUNT_NOT_FOUND"]) unless account && account["password"]
+
+          unless verify_password_value(ctx, body["password"], account["password"])
             raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_PASSWORD"])
           end
         end