better_auth 0.8.0 → 0.11.0

data/lib/better_auth/plugins/one_tap.rb

@@ -32,6 +32,14 @@ module BetterAuth
             operationId: "oneTapCallback",
             summary: "One tap callback",
             description: "Use this endpoint to authenticate with Google One Tap",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  id_token: {type: "string", description: "Google One Tap ID token"}
+                },
+                required: ["id_token"]
+              )
+            ),
             responses: {
               "200" => OpenAPI.json_response("Success", OpenAPI.session_response_schema_pair)
             }
@@ -42,36 +50,32 @@ module BetterAuth
         id_token = body[:id_token].to_s
         payload = one_tap_verify_id_token(ctx, config, id_token)
         email = fetch_value(payload, "email").to_s.downcase
+        raise APIError.new("BAD_REQUEST", message: "invalid id token") if Routes.blank_remote_id?(fetch_value(payload, "sub"))
 
         if email.empty?
           next ctx.json({error: "Email not available in token"})
         end
 
-        user = ctx.context.internal_adapter.find_user_by_email(email)
-        if user
-          one_tap_link_account_unless_present!(ctx, config, user, payload, id_token)
-          session_data = one_tap_create_session(ctx, user[:user])
-        else
-          raise APIError.new("BAD_GATEWAY", message: "User not found") if config[:disable_signup]
-
-          created = ctx.context.internal_adapter.create_oauth_user(
-            {
-              email: email,
-              emailVerified: one_tap_boolean_value(fetch_value(payload, "email_verified")),
-              name: fetch_value(payload, "name").to_s,
-              image: fetch_value(payload, "picture")
-            },
-            {
-              providerId: "google",
-              accountId: fetch_value(payload, "sub").to_s,
-              idToken: id_token
-            },
-            context: ctx
-          )
-          raise APIError.new("INTERNAL_SERVER_ERROR", message: "Could not create user") unless created
-
-          session_data = one_tap_create_session(ctx, created[:user])
-        end
+        sub = fetch_value(payload, "sub").to_s
+        session_data = Routes.persist_social_user(
+          ctx,
+          "google",
+          {
+            id: sub,
+            email: email,
+            emailVerified: one_tap_boolean_value(fetch_value(payload, "email_verified")),
+            name: fetch_value(payload, "name").to_s,
+            image: fetch_value(payload, "picture")
+          },
+          {
+            providerId: "google",
+            accountId: sub,
+            idToken: id_token,
+            scope: "openid,profile,email"
+          },
+          disable_sign_up: config[:disable_signup]
+        )
+        one_tap_raise_persistence_error!(session_data[:error]) if session_data[:error]
 
         Cookies.set_session_cookie(ctx, session_data)
         ctx.json({
@@ -82,16 +86,35 @@ module BetterAuth
     end
 
     def one_tap_verify_id_token(ctx, config, id_token)
-      verifier = config[:verify_id_token]
-      audience = config[:client_id] || ctx.context.options.social_providers.dig(:google, :client_id)
-      payload = if verifier.respond_to?(:call)
-        verifier.call(id_token, ctx, audience: audience)
-      else
-        one_tap_verify_google_id_token(id_token, audience)
+      google_provider = ctx.context.options.social_providers[:google] || {}
+      google_options = fetch_value(google_provider, "options") || {}
+      audience = config[:client_id]
+      audience = fetch_value(google_provider, "client_id") if one_tap_blank_audience?(audience)
+      if one_tap_blank_audience?(audience)
+        raise APIError.new(
+          "BAD_REQUEST",
+          message: "Google client ID is required for One Tap. Set it on the one_tap plugin (client_id) or on social_providers.google."
+        )
+      end
+
+      begin
+        verifier = config[:verify_id_token]
+        payload = if verifier.respond_to?(:call)
+          verifier.call(id_token, ctx, audience: audience)
+        else
+          one_tap_verify_google_id_token(id_token, audience)
+        end
+        payload = one_tap_stringify_payload(payload)
+        hosted_domain = fetch_value(google_provider, "hd")
+        hosted_domain = fetch_value(google_options, "hd") if hosted_domain.nil?
+        unless SocialProviders.google_hosted_domain_allowed?(hosted_domain, payload["hd"])
+          raise "Invalid Google hosted domain"
+        end
+
+        payload
+      rescue
+        raise APIError.new("BAD_REQUEST", message: "invalid id token")
       end
-      one_tap_stringify_payload(payload)
-    rescue
-      raise APIError.new("BAD_REQUEST", message: "invalid id token")
     end
 
     def one_tap_verify_google_id_token(id_token, audience)
@@ -101,47 +124,37 @@ module BetterAuth
         iss: ["https://accounts.google.com", "accounts.google.com"],
         verify_iss: true
       }
-      if audience
-        options[:aud] = audience
-        options[:verify_aud] = true
-      end
-      payload, = JWT.decode(id_token, nil, true, options.merge(jwks: jwks))
+      options[:aud] = audience
+      options[:verify_aud] = true
+      payload, = ::JWT.decode(id_token, nil, true, options.merge(jwks: jwks))
       payload
     end
 
     def one_tap_google_jwks
-      uri = URI("https://www.googleapis.com/oauth2/v3/certs")
-      response = Net::HTTP.get_response(uri)
-      raise "Unable to fetch Google JWKS" unless response.is_a?(Net::HTTPSuccess)
+      cached = @one_tap_google_jwks_cache
+      return cached[:jwks] if cached && cached[:expires_at] > Time.now
+
+      payload = HTTPClient.get_json("https://www.googleapis.com/oauth2/v3/certs")
+      raise "Unable to fetch Google JWKS" unless payload
 
-      JWT::JWK::Set.new(JSON.parse(response.body))
+      jwks = ::JWT::JWK::Set.new(payload)
+      @one_tap_google_jwks_cache = {jwks: jwks, expires_at: Time.now + 300}
+      jwks
     end
 
-    def one_tap_link_account_unless_present!(ctx, _config, user, payload, id_token)
-      sub = fetch_value(payload, "sub").to_s
-      account = ctx.context.internal_adapter.find_account(sub)
-      return if account
+    def one_tap_blank_audience?(audience)
+      Array(audience).empty? || Array(audience).all? { |value| value.to_s.strip.empty? }
+    end
 
-      account_linking = ctx.context.options.account[:account_linking] || {}
-      trusted = Array(account_linking[:trusted_providers]).map(&:to_s).include?("google")
-      enabled = account_linking.fetch(:enabled, true)
-      should_link_account = enabled != false && (trusted || one_tap_boolean_value(fetch_value(payload, "email_verified")))
-      unless should_link_account
+    def one_tap_raise_persistence_error!(error)
+      case error
+      when "signup disabled"
+        raise APIError.new("BAD_GATEWAY", message: "User not found")
+      when "account not linked", "banned"
         raise APIError.new("UNAUTHORIZED", message: "Google sub doesn't match")
+      else
+        raise APIError.new("INTERNAL_SERVER_ERROR", message: "Could not create user")
       end
-
-      ctx.context.internal_adapter.link_account(
-        userId: user[:user]["id"],
-        providerId: "google",
-        accountId: sub,
-        scope: "openid,profile,email",
-        idToken: id_token
-      )
-    end
-
-    def one_tap_create_session(ctx, user)
-      session = ctx.context.internal_adapter.create_session(user["id"])
-      {session: session, user: user}
     end
 
     def one_tap_stringify_payload(payload)

data/lib/better_auth/plugins/one_time_token.rb

@@ -85,12 +85,9 @@ module BetterAuth
         body = normalize_hash(ctx.body)
         token = body[:token].to_s
         stored_token = one_time_token_stored_value(config, token)
-        verification = ctx.context.internal_adapter.find_verification_value("one-time-token:#{stored_token}")
+        verification = ctx.context.internal_adapter.consume_verification_value("one-time-token:#{stored_token}")
         raise APIError.new("BAD_REQUEST", message: "Invalid token") unless verification
 
-        ctx.context.internal_adapter.delete_verification_value(verification["id"])
-        raise APIError.new("BAD_REQUEST", message: "Token expired") if Routes.expired_time?(verification["expiresAt"])
-
         session = ctx.context.internal_adapter.find_session(verification["value"])
         raise APIError.new("BAD_REQUEST", message: "Session not found") unless session
         raise APIError.new("BAD_REQUEST", message: "Session expired") if Routes.expired_time?(session[:session]["expiresAt"])

data/lib/better_auth/plugins/open_api.rb

@@ -2,6 +2,10 @@
 
 module BetterAuth
   module OpenAPI
+    # Better Auth action endpoints advertise upstream camelCase JSON field names in
+    # OpenAPI and generated inventories. Runtime may still accept Ruby snake_case
+    # aliases via normalize_hash and route validation.
+
     module_function
 
     def object_schema(properties, required: [])
@@ -128,6 +132,21 @@ module BetterAuth
       }
     end
 
+    def default_request_body
+      {
+        required: true,
+        content: {
+          "application/json" => {
+            schema: {
+              type: "object",
+              properties: {},
+              additionalProperties: true
+            }
+          }
+        }
+      }
+    end
+
     def responses(responses = nil)
       {"200" => success_response}.merge(default_error_responses).merge(responses || {})
     end
@@ -142,6 +161,17 @@ module BetterAuth
       )
     end
 
+    def default_success_response
+      json_response(
+        "Success",
+        {
+          type: "object",
+          properties: {},
+          additionalProperties: true
+        }
+      )
+    end
+
     def default_error_responses
       {
         "400" => error_response("Bad Request. Usually due to missing parameters, or invalid parameters.", required: true),
@@ -168,10 +198,16 @@ module BetterAuth
 
     def default_metadata(path, methods)
       method = Array(methods).reject { |value| value.to_s == "*" }.first.to_s.upcase
-      {
+      metadata = {
         operationId: operation_id(path, method),
-        description: "#{method} #{path}"
+        description: "Execute the #{operation_id(path, method)} endpoint.",
+        parameters: default_path_parameters(path),
+        responses: {
+          "200" => default_success_response
+        }
       }
+      metadata[:requestBody] = default_request_body if %w[POST PUT PATCH].include?(method)
+      metadata
     end
 
     def operation_id(path, method)
@@ -183,6 +219,14 @@ module BetterAuth
 
       "#{method.to_s.downcase}#{base}"
     end
+
+    def default_path_parameters(path)
+      path.to_s.split("/").filter_map do |part|
+        next unless part.start_with?(":")
+
+        path_parameter(part.delete_prefix(":"))
+      end
+    end
   end
 
   module Plugins
@@ -194,7 +238,7 @@ module BetterAuth
       Plugin.new(
         id: "open-api",
         endpoints: {
-          generate_open_api_schema: Endpoint.new(path: "/open-api/generate-schema", method: "GET") do |ctx|
+          generate_openapi_schema: Endpoint.new(path: "/open-api/generate-schema", method: "GET") do |ctx|
             ctx.json(open_api_schema(ctx.context))
           end,
           open_api_reference: Endpoint.new(path: config[:path], method: "GET", metadata: {hide: true}) do |ctx|
@@ -227,7 +271,7 @@ module BetterAuth
         ],
         servers: [
           {
-            url: context.base_url
+            url: context.canonical_base_url
           }
         ],
         tags: [
@@ -268,6 +312,7 @@ module BetterAuth
 
     def open_api_paths(endpoints, options)
       disabled_paths = Array(options.disabled_paths).map(&:to_s)
+      used_operation_ids = Set.new
       endpoints.each_with_object({}) do |(key, endpoint, tag), paths|
         next unless endpoint.path
         next if endpoint.metadata[:exclude_from_openapi] || endpoint.metadata[:SERVER_ONLY] || endpoint.metadata[:server_only]
@@ -278,7 +323,7 @@ module BetterAuth
         path = open_api_path(endpoint.path)
         paths[path] ||= {}
         endpoint.methods.reject { |method| method == "*" }.each do |method|
-          paths[path][method.downcase.to_sym] = open_api_operation(endpoint, method, tag)
+          paths[path][method.downcase.to_sym] = open_api_operation(endpoint, method, tag, used_operation_ids)
         end
       end
     end
@@ -291,12 +336,12 @@ module BetterAuth
       tag == "Default" && [:ok, :error].include?(key) && endpoint.metadata[:openapi]
     end
 
-    def open_api_operation(endpoint, method, tag)
+    def open_api_operation(endpoint, method, tag, used_operation_ids)
       metadata = endpoint.metadata[:openapi] || {}
       operation = {
         tags: Array(metadata[:tags] || [tag]),
         description: metadata[:description],
-        operationId: metadata[:operationId],
+        operationId: open_api_operation_id(metadata[:operationId], method, used_operation_ids),
         security: [
           {
             bearerAuth: []
@@ -313,6 +358,26 @@ module BetterAuth
       operation
     end
 
+    def open_api_operation_id(base_id, method, used_operation_ids)
+      return if base_id.to_s.empty?
+
+      operation_id = base_id.to_s
+      unless used_operation_ids.include?(operation_id)
+        used_operation_ids << operation_id
+        return operation_id
+      end
+
+      suffix = method.to_s.downcase.capitalize
+      candidate = "#{operation_id}#{suffix}"
+      duplicate_index = 2
+      while used_operation_ids.include?(candidate)
+        candidate = "#{operation_id}#{suffix}#{duplicate_index}"
+        duplicate_index += 1
+      end
+      used_operation_ids << candidate
+      candidate
+    end
+
     def open_api_components(options)
       Schema.auth_tables(options).each_with_object({}) do |(model, table), schemas|
         name = model.to_s.split(/[_-]/).map(&:capitalize).join
@@ -321,11 +386,14 @@ module BetterAuth
     end
 
     def schema_for_table(table)
-      required = []
+      required = ["id"]
       properties = table[:fields].each_with_object({}) do |(field, attributes), result|
+        next if field.to_s == "id"
+
         result[field.to_sym] = field_schema(attributes)
-        required << field if attributes[:required] && attributes[:input] != false && field != "id"
+        required << field if attributes[:required] && attributes[:returned] != false
       end
+      properties = {id: {type: "string", readOnly: true}}.merge(properties)
       {type: "object", properties: properties, required: required}
     end