better_auth 0.8.0 → 0.11.0

data/lib/better_auth/routes/sign_up.rb

@@ -58,6 +58,7 @@ module BetterAuth
         if email_config[:enabled] != true || email_config[:disable_sign_up]
           raise APIError.new("BAD_REQUEST", code: "EMAIL_PASSWORD_SIGN_UP_DISABLED", message: BASE_ERROR_CODES["EMAIL_PASSWORD_SIGN_UP_DISABLED"])
         end
+        preflight_sign_up_token_link!(ctx)
 
         body = normalize_hash(ctx.body)
         name = body["name"].to_s
@@ -69,14 +70,16 @@ module BetterAuth
 
         validate_auth_callback_url!(ctx.context, callback_url, "callbackURL")
         validate_sign_up_input!(email, password, email_config)
+        reserved = %w[email password name image callbackURL callbackUrl callback_url rememberMe remember_me]
+        additional_user_fields = parse_sign_up_additional_user_fields(ctx, body.except(*reserved))
 
         ctx.context.adapter.transaction do
           existing = ctx.context.internal_adapter.find_user_by_email(email)
           if existing
-            if email_config[:require_email_verification]
+            if email_config[:require_email_verification] || email_config[:auto_sign_in] == false
               hash_password(ctx, password)
               call_existing_sign_up_callback(ctx, email_config, existing)
-              synthetic_user = synthetic_sign_up_user(ctx, body, email, name, image)
+              synthetic_user = synthetic_sign_up_user(ctx, additional_user_fields, email, name, image)
               next ctx.json({token: nil, user: Schema.parse_output(options, "user", synthetic_user)})
             end
 
@@ -87,7 +90,7 @@ module BetterAuth
           end
 
           hashed_password = hash_password(ctx, password)
-          created_user = create_sign_up_user(ctx, body, email, name, image)
+          created_user = create_sign_up_user(ctx, additional_user_fields, email, name, image)
           raise APIError.new("UNPROCESSABLE_ENTITY", message: BASE_ERROR_CODES["FAILED_TO_CREATE_USER"]) unless created_user
 
           ctx.context.internal_adapter.link_account(
@@ -144,9 +147,7 @@ module BetterAuth
       raise APIError.new("FORBIDDEN", message: "Invalid #{label}")
     end
 
-    def self.create_sign_up_user(ctx, body, email, name, image)
-      reserved = %w[email password name image callbackURL callbackUrl callback_url rememberMe remember_me]
-      additional = parse_declared_input(ctx, "user", body.except(*reserved), allowed_base: [])
+    def self.create_sign_up_user(ctx, additional, email, name, image)
       ctx.context.internal_adapter.create_user(
         additional.merge(
           "email" => email.downcase,
@@ -175,7 +176,7 @@ module BetterAuth
       end
     end
 
-    def self.synthetic_sign_up_user(ctx, body, email, name, image)
+    def self.synthetic_sign_up_user(ctx, additional, email, name, image)
       now = Time.now
       core_fields = {
         "id" => SecureRandom.hex(16),
@@ -186,8 +187,6 @@ module BetterAuth
         "createdAt" => now,
         "updatedAt" => now
       }
-      reserved = %w[email password name image callbackURL callbackUrl callback_url rememberMe remember_me]
-      additional = synthetic_additional_user_fields(ctx, body.except(*reserved))
       custom = ctx.context.options.email_and_password[:custom_synthetic_user]
       return core_fields.merge(additional) unless custom.respond_to?(:call)
 
@@ -201,20 +200,37 @@ module BetterAuth
       stringify_synthetic_user(custom.call(value))
     end
 
-    def self.synthetic_additional_user_fields(ctx, data)
-      additional = parse_declared_input(ctx, "user", data, allowed_base: [])
-      configured = ctx.context.options.user[:additional_fields] || {}
-      configured.each do |field, attributes|
-        storage_field = Schema.storage_key(field)
-        next if additional.key?(storage_field)
-
-        field_attributes = normalize_hash(attributes || {})
-        next unless field_attributes.key?("defaultValue") || field_attributes.key?("default_value")
+    def self.parse_sign_up_additional_user_fields(ctx, data)
+      input = normalize_hash(data || {})
+      fields = Schema.auth_tables(ctx.context.options).fetch("user").fetch(:fields)
+        .except(*core_model_fields("user"))
+
+      fields.each_with_object({}) do |(field, attributes), result|
+        if input.key?(field)
+          if attributes[:input] == false
+            if attributes.key?(:default_value)
+              result[field] = resolve_default(attributes[:default_value])
+            elsif js_truthy_input?(input[field])
+              raise APIError.new("BAD_REQUEST", message: "#{field} is not allowed to be set")
+            end
+            next
+          end
 
-        default = field_attributes.key?("defaultValue") ? field_attributes["defaultValue"] : field_attributes["default_value"]
-        additional[storage_field] = resolve_default(default)
+          result[field] = coerce_input_value(input[field], attributes)
+        elsif attributes.key?(:default_value)
+          result[field] = resolve_default(attributes[:default_value])
+        elsif attributes[:required]
+          raise APIError.new("BAD_REQUEST", message: "#{field} is required")
+        end
       end
-      additional
+    end
+
+    def self.js_truthy_input?(value)
+      return false if value.nil? || value == false
+      return false if value.is_a?(Numeric) && (value.zero? || (value.respond_to?(:nan?) && value.nan?))
+      return false if value.is_a?(String) && value.empty?
+
+      true
     end
 
     def self.resolve_default(value)
@@ -242,10 +258,17 @@ module BetterAuth
         expires_in: verification[:expires_in] || 3600
       )
       callback = URI.encode_www_form_component(callback_url || "/")
-      url = "#{ctx.context.base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
+      url = "#{ctx.context.token_link_base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
       sender.call({user: user, url: url, token: token}, ctx.request)
     end
 
+    def self.preflight_sign_up_token_link!(ctx)
+      verification = ctx.context.options.email_verification
+      password_config = ctx.context.options.email_and_password
+      send_on_sign_up = verification.key?(:send_on_sign_up) ? verification[:send_on_sign_up] : password_config[:require_email_verification]
+      ctx.context.token_link_base_url if send_on_sign_up && verification[:send_verification_email].respond_to?(:call)
+    end
+
     def self.session_overrides(ctx)
       {
         ipAddress: RequestIP.client_ip(ctx, ctx.context.options).to_s,

data/lib/better_auth/routes/social.rb

@@ -2,6 +2,7 @@
 
 require "uri"
 require "json"
+require "net/http"
 require "securerandom"
 
 module BetterAuth
@@ -92,12 +93,13 @@ module BetterAuth
           ctx.context.secret,
           expires_in: 600
         )
+        store_oauth_state_cookie(ctx, state)
         url = call_provider(provider, :create_authorization_url, {
           state: state,
           codeVerifier: code_verifier,
           code_verifier: code_verifier,
-          redirectURI: "#{ctx.context.base_url}/callback/#{provider_id}",
-          redirect_uri: "#{ctx.context.base_url}/callback/#{provider_id}",
+          redirectURI: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
+          redirect_uri: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
           scopes: body["scopes"],
           loginHint: body["loginHint"] || body["login_hint"]
         })
@@ -133,38 +135,56 @@ module BetterAuth
         if ctx.method == "POST"
           merged = normalize_hash(ctx.query).merge(normalize_hash(ctx.body))
           query = URI.encode_www_form(merged.reject { |_key, value| value.nil? || value.to_s.empty? })
-          target = "#{ctx.context.base_url}/callback/#{provider_id}"
+          target = "#{ctx.context.canonical_base_url}/callback/#{provider_id}"
           target = "#{target}?#{query}" unless query.empty?
           raise ctx.redirect(target)
         end
 
         source = ctx.query
         data = normalize_hash(source)
-        provider = social_provider(ctx.context, provider_id)
         state = data["state"].to_s
-        state_data = state.empty? ? nil : Crypto.verify_jwt(state, ctx.context.secret)
-        error_url = state_data ? (state_data["errorCallbackURL"] || "#{ctx.context.base_url}/error") : "#{ctx.context.base_url}/error"
+        default_error_url = ctx.context.options.on_api_error[:error_url] || "#{ctx.context.base_url}/error"
+        state_data = begin
+          OAuthState.parse(ctx, state)
+        rescue OAuthState::Error => error
+          raise ctx.redirect(oauth_error_url(error.error_url || default_error_url, error.code))
+        end
+        error_url = state_data["errorURL"] || state_data["errorCallbackURL"] || default_error_url
 
         raise ctx.redirect(oauth_error_url(error_url, data["error"], data["errorDescription"] || data["error_description"])) if data["error"]
-        raise ctx.redirect(oauth_error_url(error_url, "oauth_provider_not_found")) unless provider
-        raise ctx.redirect(oauth_error_url(error_url, "state_not_found")) unless state_data
         raise ctx.redirect(oauth_error_url(error_url, "no_code")) if data["code"].to_s.empty?
+        provider = social_provider(ctx.context, provider_id)
+        raise ctx.redirect(oauth_error_url(error_url, "oauth_provider_not_found")) unless provider
 
-        tokens = call_provider(provider, :validate_authorization_code, {
-          code: data["code"],
-          codeVerifier: state_data["codeVerifier"],
-          code_verifier: state_data["codeVerifier"],
-          redirectURI: "#{ctx.context.base_url}/callback/#{provider_id}",
-          redirect_uri: "#{ctx.context.base_url}/callback/#{provider_id}"
-        })
+        tokens = begin
+          call_provider(provider, :validate_authorization_code, {
+            code: data["code"],
+            codeVerifier: state_data["codeVerifier"],
+            code_verifier: state_data["codeVerifier"],
+            redirectURI: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
+            redirect_uri: "#{ctx.context.canonical_base_url}/callback/#{provider_id}"
+          })
+        rescue APIError => error
+          raise if error.status == "FOUND"
+
+          nil
+        rescue => error
+          social_log(ctx.context, :error, "OAuth code validation failed: #{error.message}")
+          nil
+        end
         raise ctx.redirect(oauth_error_url(error_url, "invalid_code")) unless tokens
 
         token_data = token_hash(tokens)
         token_data["user"] = parse_json_hash(data["user"]) if data["user"]
-        user_info = call_provider(provider, :get_user_info, token_data)
+        user_info = begin
+          call_provider(provider, :get_user_info, token_data)
+        rescue Net::OpenTimeout, Net::ReadTimeout, SocketError, SystemCallError
+          nil
+        end
         user = user_info[:user] || user_info["user"] if user_info
         raise ctx.redirect(oauth_error_url(error_url, "unable_to_get_user_info")) unless user
         raise ctx.redirect(oauth_error_url(error_url, "email_not_found")) if fetch_value(user, "email").to_s.empty?
+        raise ctx.redirect(oauth_error_url(error_url, "unable_to_get_user_info")) if blank_remote_id?(fetch_value(user, "id"))
 
         link = state_data["link"] || state_data[:link]
         if link
@@ -185,7 +205,7 @@ module BetterAuth
         )
         raise ctx.redirect(oauth_error_url(error_url, session_data[:error].tr(" ", "_"))) if session_data[:error]
         Cookies.set_session_cookie(ctx, session_data)
-        callback_url = session_data[:new_user] ? (state_data["newUserCallbackURL"] || state_data["callbackURL"] || "/") : (state_data["callbackURL"] || "/")
+        callback_url = session_data[:new_user] ? (state_data["newUserURL"] || state_data["newUserCallbackURL"] || state_data["callbackURL"] || "/") : (state_data["callbackURL"] || "/")
         raise ctx.redirect(callback_url)
       end
     end
@@ -251,8 +271,15 @@ module BetterAuth
             account["providerId"] == provider_id && account["accountId"] == account_id
           end
           unless existing
-            ctx.context.internal_adapter.create_account(token_hash_for_storage(ctx, data[:account]).merge("userId" => session[:user]["id"]))
+            begin
+              account = ctx.context.internal_adapter.create_account(token_hash_for_storage(ctx, data[:account]).merge("userId" => session[:user]["id"]))
+              raise BetterAuth::Error, "Unable to link social account" unless account
+            rescue
+              social_log(ctx.context, :error, "Unable to link social account")
+              raise APIError.new("INTERNAL_SERVER_ERROR", message: "Unable to link social account")
+            end
           end
+          update_social_user_info_on_link(ctx, session[:user]["id"], data[:user])
           update_verified_email_on_link(ctx, session[:user]["id"], session[:user]["email"], data[:user])
           next ctx.json({url: "", status: true, redirect: false})
         end
@@ -269,12 +296,13 @@ module BetterAuth
           }
         }.merge(safe_additional_state(body))
         state = Crypto.sign_jwt(state_data, ctx.context.secret, expires_in: 600)
+        store_oauth_state_cookie(ctx, state)
         url = call_provider(provider, :create_authorization_url, {
           state: state,
           codeVerifier: code_verifier,
           code_verifier: code_verifier,
-          redirectURI: "#{ctx.context.base_url}/callback/#{provider_id}",
-          redirect_uri: "#{ctx.context.base_url}/callback/#{provider_id}",
+          redirectURI: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
+          redirect_uri: "#{ctx.context.canonical_base_url}/callback/#{provider_id}",
           scopes: body["scopes"],
           loginHint: body["loginHint"] || body["login_hint"]
         })
@@ -285,6 +313,10 @@ module BetterAuth
 
     def self.social_user_from_id_token!(ctx, provider, id_token)
       token = fetch_value(id_token, "token").to_s
+      unless provider_callable(provider, :verify_id_token)
+        raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES["ID_TOKEN_NOT_SUPPORTED"])
+      end
+
       valid = call_provider(provider, :verify_id_token, token, fetch_value(id_token, "nonce"))
       raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["INVALID_TOKEN"]) unless valid
 
@@ -301,6 +333,7 @@ module BetterAuth
       user = user_info[:user] || user_info["user"] if user_info
       raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["FAILED_TO_GET_USER_INFO"]) unless user
       raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["USER_EMAIL_NOT_FOUND"]) if fetch_value(user, "email").to_s.empty?
+      raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["FAILED_TO_GET_USER_INFO"]) if blank_remote_id?(fetch_value(user, "id"))
 
       {
         user: user,
@@ -315,51 +348,105 @@ module BetterAuth
       }
     end
 
-    def self.persist_social_user(ctx, provider_id, user_info, account_info, callback_url: nil, disable_sign_up: false)
+    def self.persist_social_user(ctx, provider_id, user_info, account_info, callback_url: nil, disable_sign_up: false, override_user_info: false)
       email = fetch_value(user_info, "email").to_s.downcase
       account_id = (account_info["accountId"] || account_info[:accountId] || account_info[:account_id] || fetch_value(user_info, "id")).to_s
-      existing = ctx.context.internal_adapter.find_oauth_user(email, account_id, provider_id)
+      return {error: "unable to get user info"} if blank_remote_id?(account_id)
+
+      existing = begin
+        ctx.context.internal_adapter.find_oauth_user(email, account_id, provider_id)
+      rescue
+        social_log(ctx.context, :error, "Unable to query social user")
+        raise APIError.new("INTERNAL_SERVER_ERROR", message: "internal server error")
+      end
 
       if existing && existing[:linked_account]
         user = existing[:user]
         if ctx.context.options.account[:update_account_on_sign_in] != false
           update_data = account_storage_fields(account_info)
-          ctx.context.internal_adapter.update_account(existing[:linked_account]["id"], update_data) unless update_data.empty?
+          unless update_data.empty?
+            begin
+              ctx.context.internal_adapter.update_account(existing[:linked_account]["id"], update_data)
+            rescue
+              social_log(ctx.context, :error, "Unable to link social account")
+              raise
+            end
+          end
         end
         verified_user = update_verified_email_on_link(ctx, user["id"], user["email"], user_info)
         user = verified_user if verified_user
         new_user = false
       elsif existing
-        unless linkable_provider?(ctx, provider_id, user_info, implicit: true)
-          return {error: "account not linked"}
+        linkable = linkable_provider?(ctx, provider_id, user_info, implicit: true, local_user: existing[:user])
+        unless linkable
+          return {error: existing[:user]["banned"] ? "banned" : "account not linked"}
         end
         user = existing[:user]
-        ctx.context.internal_adapter.create_account(account_info.merge("providerId" => provider_id, "accountId" => account_id, "userId" => user["id"]))
-        verified_user = update_verified_email_on_link(ctx, user["id"], user["email"], user_info)
-        user = verified_user if verified_user
+        user = ctx.context.adapter.transaction do
+          account = begin
+            ctx.context.internal_adapter.create_account(account_info.merge("providerId" => provider_id, "accountId" => account_id, "userId" => user["id"]))
+          rescue
+            social_log(ctx.context, :error, "Unable to link social account")
+            raise
+          end
+          unless account
+            social_log(ctx.context, :error, "Unable to link social account")
+            raise BetterAuth::Error, "Failed to link social account"
+          end
+
+          promoted = promote_verified_email_on_link!(ctx, user, user_info)
+          linked_user = promoted || user
+          update_social_user_info_on_link(ctx, linked_user["id"], user_info) || linked_user
+        end
         new_user = false
       else
         return {error: "signup disabled"} if disable_sign_up
 
-        created = ctx.context.internal_adapter.create_oauth_user(
-          {
-            email: email,
-            name: fetch_value(user_info, "name").to_s,
-            image: fetch_value(user_info, "image"),
-            emailVerified: !!fetch_value(user_info, "emailVerified")
-          },
-          account_info.merge("providerId" => provider_id, "accountId" => account_id),
-          context: ctx
-        )
+        begin
+          provider_fields = Schema.parse_provider_profile_user_input(ctx.context.options, user_info, action: :create)
+          created = ctx.context.internal_adapter.create_oauth_user(
+            provider_fields.merge(
+              email: email,
+              name: fetch_value(user_info, "name").to_s,
+              image: fetch_value(user_info, "image"),
+              emailVerified: !!fetch_value(user_info, "emailVerified")
+            ),
+            account_info.merge("providerId" => provider_id, "accountId" => account_id),
+            context: ctx
+          )
+          raise BetterAuth::Error, "Failed to create social user" unless created
+        rescue
+          social_log(ctx.context, :error, "Unable to create social user")
+          return {error: "unable to create user"}
+        end
         user = created[:user]
         new_user = true
       end
-      user = override_social_user_info(ctx, user, user_info) if existing && provider_override_user_info_on_sign_in?(provider_id, ctx.context)
+      if existing && (override_user_info || provider_override_user_info_on_sign_in?(provider_id, ctx.context))
+        user = override_social_user_info(ctx, user, user_info)
+      end
+      return {error: "unable to create user"} unless user
 
       session = ctx.context.internal_adapter.create_session(user["id"], false, session_overrides(ctx), true, ctx)
       {session: session, user: user, new_user: new_user}
     end
 
+    def self.store_oauth_state_cookie(ctx, state)
+      return unless ctx.request
+
+      cookie = ctx.context.create_auth_cookie("state", max_age: 600)
+      ctx.set_signed_cookie(cookie.name, state, ctx.context.secret, cookie.attributes)
+    end
+
+    def self.valid_oauth_state_cookie?(ctx, state)
+      return true unless ctx.request
+
+      cookie = ctx.context.create_auth_cookie("state", max_age: 600)
+      stored = ctx.get_signed_cookie(cookie.name, ctx.context.secret)
+      Cookies.expire_cookie(ctx, cookie)
+      stored == state
+    end
+
     def self.oauth_error_url(base_url, error, description = nil)
       uri = URI.parse(base_url.to_s)
       query = URI.decode_www_form(uri.query.to_s)
@@ -377,17 +464,32 @@ module BetterAuth
       !!(fetch_value(provider, "disableSignUp") || fetch_value(fetch_value(provider, "options") || {}, "disableSignUp"))
     end
 
-    def self.linkable_provider?(ctx, provider_id, user_info, implicit: false)
+    def self.linkable_provider?(ctx, provider_id, user_info, implicit: false, local_user: nil)
       linking = ctx.context.options.account[:account_linking] || {}
       return false if linking[:enabled] == false
       return false if implicit && linking[:disable_implicit_linking] == true
+      if implicit && linking.fetch(:require_local_email_verified, true) && !local_user&.fetch("emailVerified", false)
+        return false
+      end
 
       trusted = Array(linking[:trusted_providers]).map(&:to_s).include?(provider_id.to_s)
       trusted || !!fetch_value(user_info, "emailVerified")
     end
 
+    def self.implicit_link_allowed?(ctx, local_user)
+      linking = ctx.context.options.account[:account_linking] || {}
+      return false if linking[:enabled] == false || linking[:disable_implicit_linking] == true
+
+      linking[:require_local_email_verified] == false || !!local_user["emailVerified"]
+    end
+
+    def self.blank_remote_id?(value)
+      value.nil? || value.to_s.strip.empty?
+    end
+
     def self.link_social_account_from_callback(ctx, provider_id, user_info, tokens, link)
       return {error: "unable_to_link_account"} unless linkable_provider?(ctx, provider_id, user_info)
+      return {error: "unable_to_link_account"} if blank_remote_id?(fetch_value(user_info, "id"))
 
       email = fetch_value(user_info, "email").to_s.downcase
       link_email = fetch_value(link, "email").to_s.downcase
@@ -403,20 +505,21 @@ module BetterAuth
         "userId" => user_id
       )
       existing = ctx.context.internal_adapter.find_account_by_provider_id(account_id, provider_id)
-      if existing
-        return {error: "account_already_linked_to_different_user"} if existing["userId"].to_s != user_id
+      begin
+        account = if existing
+          return {error: "account_already_linked_to_different_user"} if existing["userId"].to_s != user_id
 
-        ctx.context.internal_adapter.update_account(existing["id"], account_info)
-      else
-        ctx.context.internal_adapter.create_account(account_info)
+          ctx.context.internal_adapter.update_account(existing["id"], account_info)
+        else
+          ctx.context.internal_adapter.create_account(account_info)
+        end
+        raise BetterAuth::Error, "Unable to link social account" unless account
+      rescue
+        social_log(ctx.context, :error, "Unable to link social account")
+        return {error: "unable_to_link_account"}
       end
 
-      if ctx.context.options.account.dig(:account_linking, :update_user_info_on_link)
-        ctx.context.internal_adapter.update_user(user_id, {
-          name: fetch_value(user_info, "name"),
-          image: fetch_value(user_info, "image")
-        }.compact)
-      end
+      update_social_user_info_on_link(ctx, user_id, user_info)
       update_verified_email_on_link(ctx, user_id, link_email, user_info)
 
       {status: true}
@@ -434,13 +537,33 @@ module BetterAuth
       else
         !!fetch_value(user_info, "emailVerified")
       end
-      update = {
+      provider_fields = Schema.parse_provider_profile_user_input(ctx.context.options, user_info, action: :update)
+      update = provider_fields.merge(
         "email" => email,
         "name" => fetch_value(user_info, "name").to_s,
         "image" => fetch_value(user_info, "image"),
         "emailVerified" => email_verified
-      }.reject { |_key, value| value.nil? }
-      ctx.context.internal_adapter.update_user(user["id"], update) || user
+      ).reject { |_key, value| value.nil? }
+      ctx.context.internal_adapter.update_user(user["id"], update)
+    rescue
+      social_log(ctx.context, :warn, "Could not override social user info")
+      raise
+    end
+
+    def self.update_social_user_info_on_link(ctx, user_id, user_info)
+      return unless ctx.context.options.account.dig(:account_linking, :update_user_info_on_link)
+
+      provider_fields = Schema.parse_provider_profile_user_input(ctx.context.options, user_info, action: :update)
+      update = provider_fields.merge(
+        "name" => fetch_value(user_info, "name"),
+        "image" => fetch_value(user_info, "image")
+      ).reject { |_key, value| value.nil? }
+      return if update.empty?
+
+      ctx.context.internal_adapter.update_user(user_id, update)
+    rescue
+      social_log(ctx.context, :warn, "Could not update user info on account link")
+      nil
     end
 
     def self.safe_additional_state(body)
@@ -479,6 +602,17 @@ module BetterAuth
       ctx.context.internal_adapter.update_user(user_id, {"emailVerified" => true})
     end
 
+    def self.promote_verified_email_on_link!(ctx, local_user, social_user)
+      return if local_user["emailVerified"] == true
+      return unless fetch_value(social_user, "emailVerified")
+      return unless fetch_value(social_user, "email").to_s.strip.downcase == local_user["email"].to_s.strip.downcase
+
+      updated = ctx.context.internal_adapter.update_user(local_user.fetch("id"), {"emailVerified" => true})
+      raise BetterAuth::Error, "Failed to promote verified email" unless updated
+
+      updated
+    end
+
     def self.parse_json_hash(value)
       return value if value.is_a?(Hash)
       return {} if value.nil? || value.to_s.empty?
@@ -488,5 +622,14 @@ module BetterAuth
     rescue JSON::ParserError
       {}
     end
+
+    def self.social_log(context, level, message)
+      logger = context.logger
+      if logger.respond_to?(:call)
+        logger.call(level, message)
+      elsif logger.respond_to?(level)
+        logger.public_send(level, message)
+      end
+    end
   end
 end

data/lib/better_auth/routes/user.rb

@@ -80,14 +80,16 @@ module BetterAuth
         current_password = body["currentPassword"] || body["current_password"]
         validate_password_length!(new_password, ctx.context.options.email_and_password)
         account = credential_account(ctx, session[:user]["id"])
-        unless account && account["password"] && verify_password_value(ctx, current_password.to_s, account["password"])
+        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["CREDENTIAL_ACCOUNT_NOT_FOUND"]) unless account && account["password"]
+
+        unless verify_password_value(ctx, current_password.to_s, account["password"])
           raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_PASSWORD"])
         end
 
         ctx.context.internal_adapter.update_account(account["id"], password: hash_password(ctx, new_password))
         token = nil
         if body["revokeOtherSessions"] || body["revoke_other_sessions"]
-          ctx.context.internal_adapter.delete_sessions(session[:user]["id"])
+          ctx.context.internal_adapter.delete_user_sessions(session[:user]["id"])
           new_session = ctx.context.internal_adapter.create_session(session[:user]["id"])
           Cookies.set_session_cookie(ctx, {session: new_session, user: session[:user]})
           token = new_session["token"]
@@ -174,9 +176,12 @@ module BetterAuth
         session = current_session(ctx, sensitive: true)
         body = normalize_hash(ctx.body)
         sender = ctx.context.options.user.dig(:delete_user, :send_delete_account_verification)
+        token_link_base_url = ctx.context.token_link_base_url if !body["token"] && sender.respond_to?(:call)
         if body["password"]
           account = credential_account(ctx, session[:user]["id"])
-          unless account && account["password"] && verify_password_value(ctx, body["password"], account["password"])
+          raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["CREDENTIAL_ACCOUNT_NOT_FOUND"]) unless account && account["password"]
+
+          unless verify_password_value(ctx, body["password"], account["password"])
             raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["INVALID_PASSWORD"])
           end
         end
@@ -187,7 +192,7 @@ module BetterAuth
           token = SecureRandom.hex(16)
           expires_in = ctx.context.options.user.dig(:delete_user, :delete_token_expires_in) || 3600
           callback_url = body["callbackURL"] || body["callbackUrl"] || body["callback_url"] || "/"
-          url = "#{ctx.context.base_url}/delete-user/callback?token=#{URI.encode_www_form_component(token)}&callbackURL=#{URI.encode_www_form_component(callback_url)}"
+          url = "#{token_link_base_url}/delete-user/callback?token=#{URI.encode_www_form_component(token)}&callbackURL=#{URI.encode_www_form_component(callback_url)}"
           ctx.context.internal_adapter.create_verification_value(
             identifier: "delete-account-#{token}",
             value: session[:user]["id"],
@@ -294,7 +299,7 @@ module BetterAuth
         }
       ) do |ctx|
         enabled = ctx.context.options.user.dig(:change_email, :enabled)
-        raise APIError.new("BAD_REQUEST", message: "Change email is disabled") unless enabled
+        raise APIError.new("BAD_REQUEST", code: "CHANGE_EMAIL_DISABLED", message: BASE_ERROR_CODES["CHANGE_EMAIL_DISABLED"]) unless enabled
         session = current_session(ctx, sensitive: true)
         body = normalize_hash(ctx.body)
         new_email = (body["newEmail"] || body["new_email"]).to_s.downcase
@@ -308,6 +313,7 @@ module BetterAuth
         unless can_update_without_verification || can_send_confirmation || can_send_verification
           raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES["VERIFICATION_EMAIL_NOT_ENABLED"])
         end
+        ctx.context.token_link_base_url if can_send_confirmation || can_send_verification
 
         existing_target = ctx.context.internal_adapter.find_user_by_email(new_email)
         next ctx.json({status: true}) if existing_target
@@ -322,6 +328,7 @@ module BetterAuth
         if can_send_confirmation
           callback_url = body["callbackURL"] || body["callbackUrl"] || body["callback_url"]
           token = create_email_verification_token(ctx, session[:user]["email"], update_to: new_email, extra: {"requestType" => "change-email-confirmation"})
+          register_change_email_token!(ctx, token)
           url = email_verification_url(ctx, token, callback_url)
           confirmation_sender.call({user: session[:user], new_email: new_email, url: url, token: token}, ctx.request)
           next ctx.json({status: true})
@@ -334,20 +341,20 @@ module BetterAuth
 
     def self.send_change_email_verification(ctx, sender, user, current_email, new_email, callback_url)
       token = create_email_verification_token(ctx, current_email, update_to: new_email, extra: {"requestType" => "change-email-verification"})
+      register_change_email_token!(ctx, token)
       sender.call({user: user.merge("email" => new_email), url: email_verification_url(ctx, token, callback_url), token: token}, ctx.request)
     end
 
     def self.email_verification_url(ctx, token, callback_url)
       callback = URI.encode_www_form_component(callback_url || "/")
-      "#{ctx.context.base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
+      "#{ctx.context.token_link_base_url}/verify-email?token=#{URI.encode_www_form_component(token)}&callbackURL=#{callback}"
     end
 
     def self.delete_user_by_token!(ctx, session, token)
-      verification = ctx.context.internal_adapter.find_verification_value("delete-account-#{token}")
-      unless verification && verification["value"] == session[:user]["id"] && !expired_time?(verification["expiresAt"])
+      verification = ctx.context.internal_adapter.consume_verification_value("delete-account-#{token}")
+      unless verification && verification["value"] == session[:user]["id"]
         raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES["INVALID_TOKEN"])
       end
-      ctx.context.internal_adapter.delete_verification_value(verification["id"])
     end
 
     def self.delete_current_user!(ctx, session)
@@ -356,7 +363,7 @@ module BetterAuth
       deleted = ctx.context.internal_adapter.delete_user(session[:user]["id"])
       raise APIError.new("BAD_REQUEST", message: "User delete aborted") if deleted == false
 
-      ctx.context.internal_adapter.delete_sessions(session[:user]["id"])
+      ctx.context.internal_adapter.delete_user_sessions(session[:user]["id"])
       Cookies.delete_session_cookie(ctx)
       call_option(config[:after_delete], session[:user], ctx.request)
     end