better_auth 0.8.0 → 0.11.0

data/lib/better_auth/plugins/oauth_protocol.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "base64"
+require "json"
 require "jwt"
 require "openssl"
 require "time"
@@ -29,12 +30,18 @@ module BetterAuth
         parse_scopes(value).join(" ")
       end
 
+      def request_body!(value)
+        return stringify_keys(value || {}) if value.nil? || value.is_a?(Hash)
+
+        raise APIError.new("BAD_REQUEST", message: "request body must be an object")
+      end
+
       def issuer(ctx)
-        ctx.context.options.base_url.to_s.empty? ? origin_for(ctx.context.base_url) : ctx.context.options.base_url
+        origin_for(ctx.context.canonical_base_url)
       end
 
       def endpoint_base(ctx)
-        ctx.context.base_url
+        ctx.context.canonical_base_url
       end
 
       def origin_for(url)
@@ -53,6 +60,7 @@ module BetterAuth
       end
 
       def validate_redirect_uri!(client, redirect_uri)
+        validate_safe_url!(redirect_uri, field: "redirect_uri")
         redirects = client_redirect_uris(client)
         return if redirects.include?(redirect_uri.to_s)
         return if loopback_redirect_match?(redirects, redirect_uri)
@@ -99,15 +107,19 @@ module BetterAuth
         value.to_s.split(",").map(&:strip).reject(&:empty?)
       end
 
-      def create_client(ctx, model:, body:, owner_session: nil, default_auth_method: "client_secret_basic", store_client_secret: "plain", unauthenticated: false, default_scopes: nil, allowed_scopes: nil, prefix: {}, dynamic_registration: false, admin: false, pairwise_secret: nil, strip_client_metadata: false, reference_id: nil)
-        body = stringify_keys(body || {})
+      def create_client(ctx, model:, body:, owner_session: nil, default_auth_method: "client_secret_basic", store_client_secret: "plain", unauthenticated: false, default_scopes: nil, allowed_scopes: nil, prefix: {}, dynamic_registration: false, admin: false, pairwise_secret: nil, strip_client_metadata: false, reference_id: nil, generate_client_id: nil, generate_client_secret: nil, client_registration_client_secret_expiration: nil)
+        body = request_body!(body || {})
         requested_auth_method = body["token_endpoint_auth_method"] || default_auth_method
         validate_client_metadata_enums!(requested_auth_method, body)
         validate_admin_only_fields!(body, admin: admin)
         auth_method = unauthenticated ? "none" : requested_auth_method
         public_client = auth_method == "none"
-        client_id = Crypto.random_string(32)
-        client_secret = public_client ? nil : Crypto.random_string(32)
+        client_id = generate_client_id.respond_to?(:call) ? generate_client_id.call : Crypto.random_string(32)
+        client_secret = if public_client
+          nil
+        else
+          generate_client_secret.respond_to?(:call) ? generate_client_secret.call : Crypto.random_string(32)
+        end
         redirects = Array(body["redirect_uris"]).map(&:to_s)
         raise APIError.new("BAD_REQUEST", message: "redirect_uris is required") if redirects.empty?
         redirects.each { |uri| validate_safe_url!(uri, field: "redirect_uris") }
@@ -116,6 +128,7 @@ module BetterAuth
         grant_types = Array(body["grant_types"] || [AUTH_CODE_GRANT]).map(&:to_s)
         response_types = Array(body["response_types"] || ["code"]).map(&:to_s)
         validate_client_registration!(auth_method, grant_types, response_types, body, unauthenticated: unauthenticated, dynamic_registration: dynamic_registration)
+        validate_redirect_scheme_for_client!(auth_method, body, redirects)
         validate_pairwise_client!(body, redirects, pairwise_secret)
 
         scopes = parse_scopes(body["scope"] || body["scopes"])
@@ -139,6 +152,12 @@ module BetterAuth
         else
           body["type"] || (public_client ? nil : "web")
         end
+        issued_at = Time.now.to_i
+        secret_expires_at = if client_secret && dynamic_registration && !client_registration_client_secret_expiration.nil?
+          resolve_client_secret_expires_at(client_registration_client_secret_expiration, issued_at)
+        elsif admin
+          body["client_secret_expires_at"] || 0
+        end
         data = {
           "clientId" => client_id,
           "clientSecret" => client_secret ? store_client_secret_value(ctx, client_secret, store_client_secret) : nil,
@@ -156,7 +175,7 @@ module BetterAuth
           "redirectUris" => redirects,
           "redirectUrls" => redirects.join(","),
           "postLogoutRedirectUris" => Array(body["post_logout_redirect_uris"]).map(&:to_s),
-          "clientSecretExpiresAt" => admin ? (body["client_secret_expires_at"] || 0) : nil,
+          "clientSecretExpiresAt" => secret_expires_at,
           "tokenEndpointAuthMethod" => auth_method,
           "grantTypes" => grant_types,
           "responseTypes" => response_types,
@@ -176,7 +195,10 @@ module BetterAuth
           client_id_issued_at: Time.now.to_i
         ).compact
         response[:require_pkce] = require_pkce unless require_pkce.nil?
-        response[:client_secret_expires_at] = 0 if client_secret
+        if client_secret
+          expires = stringify_keys(created || {})["clientSecretExpiresAt"] || secret_expires_at
+          response[:client_secret_expires_at] = timestamp_seconds(expires) || 0
+        end
         response
       end
 
@@ -237,6 +259,20 @@ module BetterAuth
         end
       end
 
+      def validate_redirect_scheme_for_client!(auth_method, body, redirects)
+        return if auth_method == "none" && body["type"] != "web"
+
+        redirects.each do |value|
+          uri = URI.parse(value.to_s)
+          next if uri.scheme == "https"
+          next if uri.scheme == "http" && loopback_host?(uri.hostname || uri.host)
+
+          raise APIError.new("BAD_REQUEST", message: "redirect_uris is invalid")
+        end
+      rescue URI::InvalidURIError
+        raise APIError.new("BAD_REQUEST", message: "redirect_uris is invalid")
+      end
+
       def validate_pairwise_client!(body, redirects, pairwise_secret)
         subject_type = body["subject_type"] || body["subjectType"]
         return unless subject_type == "pairwise"
@@ -244,7 +280,12 @@ module BetterAuth
         raise APIError.new("BAD_REQUEST", message: "pairwise subject_type requires pairwise_secret") if pairwise_secret.to_s.empty?
 
         hosts = redirects.map { |uri| URI.parse(uri).host }.uniq
-        raise APIError.new("BAD_REQUEST", message: "pairwise redirect_uris must share the same host") if hosts.length > 1
+        if hosts.length > 1
+          raise APIError.new(
+            "BAD_REQUEST",
+            message: "pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host."
+          )
+        end
       rescue URI::InvalidURIError
         raise APIError.new("BAD_REQUEST", message: "invalid redirect_uris")
       end
@@ -266,7 +307,11 @@ module BetterAuth
       end
 
       def client_metadata(body, strip_unknown: false)
-        metadata = stringify_keys(body["metadata"] || {})
+        raw_metadata = body["metadata"]
+        unless raw_metadata.nil? || raw_metadata.is_a?(Hash)
+          raise APIError.new("BAD_REQUEST", message: "metadata must be an object")
+        end
+        metadata = stringify_keys(raw_metadata || {})
         metadata = metadata.slice("software_id", "software_version", "software_statement", "tos_uri", "policy_uri") if strip_unknown
         metadata["software_id"] = body["software_id"] if body["software_id"]
         metadata["software_version"] = body["software_version"] if body["software_version"]
@@ -309,19 +354,36 @@ module BetterAuth
         end
       end
 
-      def find_client(ctx, model, client_id)
-        ctx.context.adapter.find_one(model: model, where: [{field: "clientId", value: client_id.to_s}])
+      def find_client(ctx, model, client_id, cached_trusted_clients: nil)
+        client_id = client_id.to_s
+        if (cached = trusted_client_cache[client_id])
+          return cached
+        end
+
+        client = ctx.context.adapter.find_one(model: model, where: [{field: "clientId", value: client_id}])
+        if client && cached_trusted_clients&.include?(client_id)
+          trusted_client_cache[client_id] = client
+        end
+        client
       end
 
-      def authenticate_client!(ctx, model, store_client_secret: "plain", prefix: {})
-        body = stringify_keys(ctx.body || {})
+      def authenticate_client!(ctx, model, store_client_secret: "plain", prefix: {}, require_confidential: false)
+        body = request_body!(ctx.body || {})
         client_id = body["client_id"]
         client_secret = strip_prefix(body["client_secret"], prefix, :client_secret) || body["client_secret"]
 
         authorization = ctx.headers["authorization"]
-        if authorization.to_s.start_with?("Basic ") && client_id.to_s.empty?
-          decoded = Base64.decode64(authorization.delete_prefix("Basic "))
+        auth_method_used = client_secret.to_s.empty? ? nil : "client_secret_post"
+        if authorization.to_s.start_with?("Basic ")
+          decoded = Base64.strict_decode64(authorization.delete_prefix("Basic "))
+          unless decoded.include?(":")
+            raise APIError.new("BAD_REQUEST", message: "invalid authorization header format", body: {error: "invalid_client", error_description: "invalid authorization header format"})
+          end
           client_id, client_secret = decoded.split(":", 2)
+          if client_id.to_s.empty? || client_secret.to_s.empty?
+            raise APIError.new("BAD_REQUEST", message: "invalid authorization header format", body: {error: "invalid_client", error_description: "invalid authorization header format"})
+          end
+          auth_method_used = "client_secret_basic"
         end
 
         client = find_client(ctx, model, client_id)
@@ -332,20 +394,35 @@ module BetterAuth
 
         method = client_data["tokenEndpointAuthMethod"] || "client_secret_basic"
         if method == "none"
+          raise APIError.new("UNAUTHORIZED", message: "invalid_client") if require_confidential
           raise APIError.new("UNAUTHORIZED", message: "invalid_client") unless client_secret.to_s.empty?
           return client
         end
+        expected_method = (method == "client_secret_post") ? "client_secret_post" : "client_secret_basic"
+        raise APIError.new("UNAUTHORIZED", message: "invalid_client") unless auth_method_used == expected_method
+        if client_secret_expired?(client_data["clientSecretExpiresAt"])
+          raise APIError.new("UNAUTHORIZED", message: "invalid_client")
+        end
         if method != "none" && !verify_client_secret(ctx, stringify_keys(client)["clientSecret"], client_secret, store_client_secret)
           raise APIError.new("UNAUTHORIZED", message: "invalid_client")
         end
 
-        client
+        client.merge("__providedClientSecret" => client_secret)
       rescue ArgumentError
-        raise APIError.new("UNAUTHORIZED", message: "invalid_client")
+        raise APIError.new("BAD_REQUEST", message: "invalid authorization header format", body: {error: "invalid_client", error_description: "invalid authorization header format"})
       end
 
-      def store_code(store, code:, client_id:, redirect_uri:, session:, scopes:, code_challenge: nil, code_challenge_method: nil, nonce: nil, reference_id: nil, auth_time: nil, expires_in: 600)
-        store[:codes][code] = {
+      def client_secret_expired?(value)
+        return false if value.nil? || value.to_i == 0
+
+        seconds = timestamp_seconds(value)
+        seconds && seconds <= Time.now.to_i
+      end
+
+      def store_code(internal_adapter, code:, client_id:, redirect_uri:, session:, scopes:, code_challenge: nil, code_challenge_method: nil, nonce: nil, reference_id: nil, auth_time: nil, expires_in: 600, store_tokens: "hashed")
+        stored_code = get_stored_token(store_tokens, code, "authorization_code")
+        expires_at = Time.now + expires_in.to_i
+        data = {
           client_id: client_id,
           redirect_uri: redirect_uri,
           session: session,
@@ -355,14 +432,19 @@ module BetterAuth
           nonce: nonce,
           reference_id: reference_id,
           auth_time: auth_time || session_auth_time(session),
-          expires_at: Time.now + expires_in.to_i
+          expires_at: expires_at.iso8601(6)
         }
+        internal_adapter.create_verification_value(identifier: stored_code, value: JSON.generate(data), expiresAt: expires_at)
       end
 
-      def consume_code!(store, code, client_id:, redirect_uri:, code_verifier: nil)
-        data = store[:codes].delete(code.to_s)
-        raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data
-        raise APIError.new("BAD_REQUEST", message: "invalid_grant") if data[:expires_at] <= Time.now
+      def consume_code!(internal_adapter, code, client_id:, redirect_uri:, code_verifier: nil, store_tokens: "hashed")
+        stored_code = get_stored_token(store_tokens, code.to_s, "authorization_code")
+        verification = internal_adapter.consume_verification_value(stored_code)
+        verification ||= internal_adapter.consume_verification_value(code.to_s) if stored_code != code.to_s
+        data = verification && JSON.parse(verification.fetch("value"), symbolize_names: true)
+        unless data.is_a?(Hash) && !data[:client_id].to_s.empty? && !data[:redirect_uri].to_s.empty? && data[:session].is_a?(Hash) && data[:scopes].is_a?(Array)
+          raise APIError.new("BAD_REQUEST", message: "invalid_grant")
+        end
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data[:client_id] == client_id.to_s
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data[:redirect_uri] == redirect_uri.to_s
         if data[:code_challenge]
@@ -372,6 +454,8 @@ module BetterAuth
         end
 
         data
+      rescue JSON::ParserError, KeyError, TypeError
+        raise APIError.new("BAD_REQUEST", message: "invalid_grant")
       end
 
       def verify_pkce!(code_data, verifier)
@@ -396,6 +480,7 @@ module BetterAuth
 
       def pkce_required?(client, scopes)
         data = stringify_keys(client)
+        return true if data["public"] || data["tokenEndpointAuthMethod"] == "none" || ["native", "user-agent-based"].include?(data["type"])
         return true if parse_scopes(scopes).include?("offline_access")
         require_pkce = client_require_pkce(data)
         return require_pkce unless require_pkce.nil?
@@ -403,7 +488,7 @@ module BetterAuth
         true
       end
 
-      def issue_tokens(ctx, store, model:, client:, session:, scopes:, include_refresh: false, issuer: nil, jwt_audience: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_expires_in: 3600, id_token_signer: nil, prefix: {}, audience: nil, grant_type: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, use_jwt_plugin: false, pairwise_secret: nil, nonce: nil, auth_time: nil, reference_id: nil, filter_id_token_claims_by_scope: false)
+      def issue_tokens(ctx, store, model:, client:, session:, scopes:, include_refresh: false, issuer: nil, jwt_audience: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_expires_in: 3600, id_token_signer: nil, prefix: {}, audience: nil, grant_type: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, use_jwt_plugin: false, pairwise_secret: nil, nonce: nil, auth_time: nil, reference_id: nil, filter_id_token_claims_by_scope: false, store_tokens: "hashed", generate_opaque_access_token: nil, generate_refresh_token: nil, format_refresh_token: nil)
         data = stringify_keys(session || {})
         user = stringify_keys(data["user"] || data[:user] || {})
         session_data = stringify_keys(data["session"] || data[:session] || {})
@@ -411,9 +496,11 @@ module BetterAuth
         subject = subject_identifier(user["id"], client_data, pairwise_secret)
         token_auth_time = auth_time || session_auth_time({"session" => session_data})
         token_reference_id = reference_id || client_data["referenceId"]
-        access_token_value = Crypto.random_string(32)
-        refresh_token_value = include_refresh ? Crypto.random_string(32) : nil
-        refresh_token = refresh_token_value ? apply_prefix(refresh_token_value, prefix, :refresh_token) : nil
+        access_token_value = generate_opaque_access_token.respond_to?(:call) ? generate_opaque_access_token.call : Crypto.random_string(32)
+        refresh_token_value = if include_refresh
+          generate_refresh_token.respond_to?(:call) ? generate_refresh_token.call : Crypto.random_string(32)
+        end
+        refresh_token = refresh_token_value ? encode_refresh_token(refresh_token_value, prefix: prefix, format_refresh_token: format_refresh_token, session_id: session_data["id"]) : nil
         scope = scope_string(scopes)
         expires_at = Time.now + access_token_expires_in.to_i
         access_token = if jwt_access_token && audience
@@ -424,7 +511,7 @@ module BetterAuth
         refresh_record = nil
         if refresh_token_value
           refresh_record = {
-            "token" => refresh_token_value,
+            "token" => store_token_value(store_tokens, refresh_token_value, "refresh_token"),
             "clientId" => client_data["clientId"],
             "sessionId" => session_data["id"],
             "userId" => user["id"],
@@ -440,13 +527,13 @@ module BetterAuth
             "issuedAt" => Time.now
           }
           created_refresh = schema_model?(ctx, "oauthRefreshToken") ? ctx.context.adapter.create(model: "oauthRefreshToken", data: refresh_record) : nil
-          refresh_record = refresh_record.merge("id" => stringify_keys(created_refresh || {})["id"], "user" => user, "session" => session_data, "client" => client_data, "scope" => scope)
+          refresh_record = refresh_record.merge("id" => stringify_keys(created_refresh || {})["id"], "token" => refresh_token_value, "user" => user, "session" => session_data, "client" => client_data, "scope" => scope)
           store[:refresh_tokens][refresh_token_value] = refresh_record
           store[:refresh_tokens][refresh_token] = refresh_record
         end
         unless jwt_access_token && audience
           record = {
-            "token" => access_token_value,
+            "token" => store_token_value(store_tokens, access_token_value, "access_token"),
             "expiresAt" => expires_at,
             "clientId" => client_data["clientId"],
             "userId" => user["id"],
@@ -464,7 +551,7 @@ module BetterAuth
           created_access = ctx.context.adapter.create(model: model, data: record)
           created = stringify_keys(created_access || {})
           record = record.merge("id" => created["id"]) if created["id"]
-          stored_record = record.merge("user" => user, "session" => session_data, "client" => client_data)
+          stored_record = record.merge("token" => access_token_value, "user" => user, "session" => session_data, "client" => client_data)
           store[:tokens][access_token_value] = stored_record
           store[:tokens][access_token] = stored_record
         end
@@ -478,7 +565,8 @@ module BetterAuth
         }
         response[:audience] = audience if audience
         response[:refresh_token] = refresh_token if refresh_token
-        response[:id_token] = id_token(user.merge("id" => subject), client_data["clientId"], issuer || issuer(ctx), jwt_audience || client_data["clientId"], ctx: ctx, signer: id_token_signer, session_id: session_data["id"], include_sid: !!client_data["enableEndSession"], nonce: nonce, auth_time: token_auth_time, custom_claims: custom_id_token_claims, scopes: parse_scopes(scope), client: client_data, filter_claims_by_scope: filter_id_token_claims_by_scope, expires_in: id_token_expires_in, use_jwt_plugin: use_jwt_plugin) if parse_scopes(scope).include?("openid")
+        id_token_client_data = client_data.merge("clientSecret" => client_data["__providedClientSecret"] || client_data["clientSecret"])
+        response[:id_token] = id_token(user.merge("id" => subject), client_data["clientId"], issuer || issuer(ctx), jwt_audience || client_data["clientId"], ctx: ctx, signer: id_token_signer, session_id: session_data["id"], include_sid: !!client_data["enableEndSession"], nonce: nonce, auth_time: token_auth_time, custom_claims: custom_id_token_claims, scopes: parse_scopes(scope), client: id_token_client_data, filter_claims_by_scope: filter_id_token_claims_by_scope, expires_in: id_token_expires_in, use_jwt_plugin: use_jwt_plugin) if parse_scopes(scope).include?("openid")
         if custom_token_response_fields.respond_to?(:call)
           extra = custom_token_response_fields.call({grant_type: grant_type, user: user.empty? ? nil : user, scopes: parse_scopes(scope), metadata: stringify_keys(client_data["metadata"] || {})})
           response.merge!(stringify_keys(extra).reject { |key, _value| standard_token_response_field?(key) }.transform_keys(&:to_sym)) if extra.is_a?(Hash)
@@ -486,9 +574,10 @@ module BetterAuth
         response
       end
 
-      def refresh_tokens(ctx, store, model:, client:, refresh_token:, scopes: nil, issuer: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_expires_in: 3600, id_token_signer: nil, prefix: {}, audience: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, use_jwt_plugin: false, pairwise_secret: nil, filter_id_token_claims_by_scope: false)
-        refresh_token_value = strip_prefix(refresh_token, prefix, :refresh_token)
-        data = refresh_token_value ? store[:refresh_tokens][refresh_token_value] : nil
+      def refresh_tokens(ctx, store, model:, client:, refresh_token:, scopes: nil, issuer: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_expires_in: 3600, id_token_signer: nil, prefix: {}, audience: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, use_jwt_plugin: false, pairwise_secret: nil, filter_id_token_claims_by_scope: false, store_tokens: "hashed", generate_opaque_access_token: nil, generate_refresh_token: nil, format_refresh_token: nil)
+        refresh_token_value = decode_refresh_token(refresh_token, prefix: prefix, format_refresh_token: format_refresh_token)
+        raise APIError.new("BAD_REQUEST", message: "invalid_grant") if refresh_token_value.to_s.empty?
+        data = store[:refresh_tokens][refresh_token_value]
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data
         if data["revoked"]
           revoke_refresh_family!(ctx, store, data)
@@ -532,7 +621,11 @@ module BetterAuth
           id_token_expires_in: id_token_expires_in,
           auth_time: data["authTime"],
           reference_id: data["referenceId"],
-          filter_id_token_claims_by_scope: filter_id_token_claims_by_scope
+          filter_id_token_claims_by_scope: filter_id_token_claims_by_scope,
+          store_tokens: store_tokens,
+          generate_opaque_access_token: generate_opaque_access_token,
+          generate_refresh_token: generate_refresh_token,
+          format_refresh_token: format_refresh_token
         )
       end
 
@@ -565,8 +658,7 @@ module BetterAuth
           "exp" => expires_at.to_i
         ).compact
         if use_jwt_plugin
-          signed = sign_oauth_jwt(ctx, payload, issuer: issuer_value, audience: audience)
-          return signed if signed
+          return sign_oauth_jwt!(ctx, payload, issuer: issuer_value, audience: audience)
         end
 
         ::JWT.encode(payload, ctx.context.secret, "HS256")
@@ -643,9 +735,12 @@ module BetterAuth
         )
       end
 
-      def find_token_by_hint(store, token, hint, prefix: {})
+      def find_token_by_hint(store, token, hint, prefix: {}, format_refresh_token: nil)
         access = -> { (value = strip_prefix(token, prefix, :access_token)) && store[:tokens][value] }
-        refresh = -> { (value = strip_prefix(token, prefix, :refresh_token)) && store[:refresh_tokens][value] }
+        refresh = lambda {
+          value = decode_refresh_token(token, prefix: prefix, format_refresh_token: format_refresh_token)
+          value && store[:refresh_tokens][value]
+        }
 
         case hint.to_s
         when "access_token"
@@ -695,6 +790,65 @@ module BetterAuth
         "#{token_prefix(prefix, kind)}#{value}"
       end
 
+      def encode_refresh_token(token_value, prefix:, format_refresh_token: nil, session_id: nil)
+        formatted = if format_refresh_token.is_a?(Hash) && format_refresh_token[:encrypt].respond_to?(:call)
+          format_refresh_token[:encrypt].call(token_value, session_id)
+        else
+          token_value
+        end
+        apply_prefix(formatted, prefix, :refresh_token)
+      end
+
+      def decode_refresh_token(token, prefix:, format_refresh_token: nil)
+        value = strip_prefix(token, prefix, :refresh_token)
+        return nil if value.nil?
+
+        if format_refresh_token.is_a?(Hash) && format_refresh_token[:decrypt].respond_to?(:call)
+          decrypted = format_refresh_token[:decrypt].call(value)
+          if decrypted.is_a?(Hash)
+            decrypted[:token] || decrypted["token"]
+          else
+            decrypted.to_s
+          end
+        else
+          value
+        end
+      end
+
+      def trusted_client_cache
+        @trusted_client_cache ||= {}
+      end
+
+      def resolve_client_secret_expires_at(value, issued_at)
+        return value.to_i if value.is_a?(Numeric)
+        return value.to_i if value.is_a?(Time)
+
+        seconds = timestamp_seconds(value)
+        return seconds if seconds && !value.is_a?(String)
+
+        issued_at.to_i + parse_duration(value.to_s)
+      rescue TypeError
+        0
+      end
+
+      def parse_duration(value)
+        match = value.strip.match(/\A(-?\d+)\s*(s|sec|secs|second|seconds|m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days|w|week|weeks|y|yr|yrs|year|years)(?:\s+from now|\s+ago)?\z/i)
+        raise TypeError, "Invalid time string" unless match
+
+        amount = match[1].to_i
+        amount = -amount if value.include?("ago")
+        unit = match[2].downcase
+        multiplier = case unit
+        when "s", "sec", "secs", "second", "seconds" then 1
+        when "m", "min", "mins", "minute", "minutes" then 60
+        when "h", "hr", "hrs", "hour", "hours" then 3600
+        when "d", "day", "days" then 86_400
+        when "w", "week", "weeks" then 604_800
+        else 31_557_600
+        end
+        amount * multiplier
+      end
+
       def strip_prefix(value, prefix, kind)
         token = value.to_s
         expected = token_prefix(prefix, kind)
@@ -745,8 +899,7 @@ module BetterAuth
         return signer.call(ctx, payload) if signer.respond_to?(:call)
 
         if use_jwt_plugin && ctx
-          signed = sign_oauth_jwt(ctx, payload, issuer: issuer_value, audience: audience)
-          return signed if signed
+          return sign_oauth_jwt!(ctx, payload, issuer: issuer_value, audience: audience)
         end
 
         Crypto.sign_jwt(
@@ -757,6 +910,11 @@ module BetterAuth
       end
 
       def id_token_hs256_key(ctx, client_id, client_secret = nil)
+        oauth_provider = ctx&.context&.options&.plugins&.find { |plugin| plugin.id == "oauth-provider" }
+        if oauth_provider&.options&.fetch(:store_client_secret, nil).to_s == "hashed"
+          label = client_id.to_s.empty? ? "better-auth" : client_id.to_s
+          return OpenSSL::HMAC.hexdigest("SHA256", ctx.context.secret.to_s, "oidc.id_token.#{label}")
+        end
         return client_secret.to_s unless client_secret.to_s.empty?
 
         label = client_id.to_s.empty? ? "better-auth" : client_id.to_s
@@ -782,6 +940,15 @@ module BetterAuth
         BetterAuth::Plugins.sign_jwt_payload(ctx, stringify_keys(payload), config)
       end
 
+      def sign_oauth_jwt!(ctx, payload, issuer:, audience:)
+        raise BetterAuth::Error, "jwt_config" unless jwt_plugin_options(ctx)
+
+        signed = sign_oauth_jwt(ctx, payload, issuer: issuer, audience: audience)
+        raise BetterAuth::Error, "jwt_config" unless signed
+
+        signed
+      end
+
       def verify_oauth_jwt(ctx, token, issuer:, hs256_secret:)
         payload = ::JWT.decode(token.to_s, nil, false).first
         audience = payload["aud"]
@@ -857,10 +1024,29 @@ module BetterAuth
         secret
       end
 
+      def store_token_value(storage_method, token, type)
+        case storage_method
+        when "hashed", :hashed
+          Crypto.sha256(token.to_s, encoding: :base64url)
+        else
+          mode = normalize_secret_storage_mode(storage_method)
+          return mode[:hash].call(token.to_s, type) if mode.is_a?(Hash) && mode[:hash].respond_to?(:call)
+
+          raise Error, "storeToken: unsupported storageMethod type '#{storage_method}'"
+        end
+      end
+
+      def get_stored_token(storage_method, token, type)
+        store_token_value(storage_method, token, type)
+      end
+
       def verify_client_secret(ctx, stored_secret, provided_secret, mode)
         mode = normalize_secret_storage_mode(mode)
         return Crypto.constant_time_compare(Crypto.sha256(provided_secret, encoding: :base64url), stored_secret.to_s) if mode == "hashed"
-        return Crypto.constant_time_compare(Crypto.symmetric_decrypt(key: ctx.context.secret_config, data: stored_secret).to_s, provided_secret.to_s) if mode == "encrypted"
+        if mode == "encrypted"
+          decrypted = Crypto.symmetric_decrypt(key: ctx.context.secret_config, data: stored_secret)
+          return Crypto.constant_time_compare(decrypted.to_s, provided_secret.to_s)
+        end
 
         if mode.is_a?(Hash)
           return Crypto.constant_time_compare(mode[:hash].call(provided_secret).to_s, stored_secret.to_s) if mode[:hash].respond_to?(:call)
@@ -868,6 +1054,8 @@ module BetterAuth
         end
 
         Crypto.constant_time_compare(stored_secret.to_s, provided_secret.to_s)
+      rescue Error, ArgumentError
+        false
       end
 
       def normalize_secret_storage_mode(mode)
@@ -878,7 +1066,6 @@ module BetterAuth
 
       def stores
         {
-          codes: {},
           tokens: {},
           refresh_tokens: {},
           consents: {}

data/lib/better_auth/plugins/oauth_provider.rb

@@ -1,16 +1,13 @@
 # frozen_string_literal: true
 
+return if defined?(BetterAuth::Plugins::OAUTH_PROVIDER_PLUGIN_IMPLEMENTATION)
+
 module BetterAuth
   module Plugins
     module_function
 
-    def oauth_provider(*args)
-      Kernel.require "better_auth/oauth_provider"
-      BetterAuth::Plugins.oauth_provider(*args)
-    rescue LoadError => error
-      raise if error.path && error.path != "better_auth/oauth_provider"
-
-      raise LoadError, "BetterAuth::Plugins.oauth_provider requires the better_auth-oauth-provider gem. Add `gem \"better_auth-oauth-provider\"` and `require \"better_auth/oauth_provider\"`."
+    def oauth_provider(*args, &block)
+      call_external_plugin!(:oauth_provider, *args, implementation_constant: :OAUTH_PROVIDER_PLUGIN_IMPLEMENTATION, gem_name: "better_auth-oauth-provider", entry: "lib/better_auth/oauth_provider.rb", &block)
     end
   end
 end

data/lib/better_auth/plugins/oauth_proxy.rb

@@ -14,7 +14,7 @@ module BetterAuth
       Plugin.new(
         id: "oauth-proxy",
         endpoints: {
-          o_auth_proxy: oauth_proxy_endpoint(config)
+          oauth_proxy: oauth_proxy_endpoint(config)
         },
         hooks: {
           before: [