better_auth 0.8.0 → 0.11.0

data/lib/better_auth/schema/sql.rb

@@ -7,18 +7,47 @@ module BetterAuth
 
       def create_statements(options, dialect:)
         dialect = dialect.to_sym
-        tables = Schema.auth_tables(options)
-        statements = tables.map { |logical_name, table| create_table_statement(logical_name, table, dialect, tables) }
+        tables = Schema.migration_tables(options)
+        delete_actions = mssql_delete_actions(tables, dialect)
+        statements = tables.map do |logical_name, table|
+          create_table_statement(logical_name, table, dialect, tables, delete_actions: delete_actions)
+        end
         statements.concat(tables.flat_map { |_logical_name, table| index_statements(table, dialect) })
       end
 
-      def create_table_statement(logical_name, table, dialect, tables = nil)
+      def pending_statements(plan)
+        delete_actions = mssql_delete_actions(plan.tables, plan.dialect)
+        statements = plan.to_create.map do |change|
+          create_table_statement(change.logical_name, change.table, plan.dialect, plan.tables, delete_actions: delete_actions)
+        end
+        statements.concat(plan.to_add.flat_map do |change|
+          change.fields.map do |logical_field, attributes|
+            if logical_name(logical_field, attributes) == "id" && plan.dialect == :postgres
+              add_postgres_id_column_statements(change.table_name)
+            else
+              add_column_statement(change.table_name, logical_field, attributes, plan.dialect)
+            end
+          end
+        end.flatten)
+        statements.concat(plan.to_index.map do |change|
+          index_statement(
+            change.table_name,
+            change.field_name,
+            change.name,
+            plan.dialect,
+            unique: change.unique,
+            where_not_null: filtered_unique_index?(change.field, plan.dialect)
+          )
+        end)
+      end
+
+      def create_table_statement(logical_name, table, dialect, tables = nil, delete_actions: nil)
         table_name = table.fetch(:model_name)
         columns = table.fetch(:fields).map do |logical_field, attributes|
           column_definition(table_name, logical_field, attributes, dialect)
         end
         constraints = table.fetch(:fields).flat_map do |logical_field, attributes|
-          field_constraints(table_name, logical_field, attributes, dialect, tables)
+          field_constraints(table_name, logical_field, attributes, dialect, tables, delete_actions: delete_actions)
         end
         body = (columns + constraints).join(",\n  ")
 
@@ -28,7 +57,7 @@ module BetterAuth
         when :mysql
           %(CREATE TABLE IF NOT EXISTS #{quote(table_name, dialect)} (\n  #{body}\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;)
         when :mssql
-          %(IF OBJECT_ID(N'#{quote(table_name, dialect)}', N'U') IS NULL\nCREATE TABLE #{quote(table_name, dialect)} (\n  #{body}\n);)
+          %(#{mssql_required_set_options}\nIF OBJECT_ID(N'#{quote(table_name, dialect)}', N'U') IS NULL\nCREATE TABLE #{quote(table_name, dialect)} (\n  #{body}\n);)
         else
           raise ArgumentError, "Unsupported SQL dialect: #{dialect}"
         end
@@ -36,8 +65,8 @@ module BetterAuth
 
       def column_definition(table_name, logical_field, attributes, dialect)
         column = quote(attributes[:field_name] || physical_name(logical_field), dialect)
-        parts = [column, sql_type(logical_field, attributes, dialect)]
-        parts << "PRIMARY KEY" if logical_field == "id"
+        parts = [column, sql_type(logical_name(logical_field, attributes), attributes, dialect)]
+        parts << "PRIMARY KEY" if logical_name(logical_field, attributes) == "id"
         if attributes[:required]
           parts << "NOT NULL"
         elsif dialect == :mssql
@@ -48,17 +77,17 @@ module BetterAuth
         parts.join(" ")
       end
 
-      def field_constraints(table_name, logical_field, attributes, dialect, tables = nil)
+      def field_constraints(table_name, logical_field, attributes, dialect, tables = nil, delete_actions: nil)
         constraints = []
         column = attributes[:field_name] || physical_name(logical_field)
 
-        if attributes[:unique] && logical_field != "id"
+        if attributes[:unique] && logical_name(logical_field, attributes) != "id" && !(dialect == :mssql && !attributes[:required])
           constraints << unique_constraint(table_name, column, dialect)
         end
 
         reference = attributes[:references]
         if reference
-          constraints << foreign_key_constraint(table_name, column, reference, dialect, tables)
+          constraints << foreign_key_constraint(table_name, column, reference, dialect, tables, delete_actions: delete_actions)
         end
 
         constraints
@@ -67,23 +96,65 @@ module BetterAuth
       def index_statements(table, dialect)
         table_name = table.fetch(:model_name)
         table.fetch(:fields).filter_map do |logical_field, attributes|
-          next unless attributes[:index]
+          nullable_unique_mssql = dialect == :mssql && attributes[:unique] && logical_name(logical_field, attributes) != "id" && !attributes[:required]
+          next if attributes[:unique] && !nullable_unique_mssql
+          next unless attributes[:index] || nullable_unique_mssql
 
           column = attributes[:field_name] || Schema.physical_name(logical_field)
-          name = "index_#{table_name}_on_#{column}"
-          case dialect
-          when :postgres, :sqlite
-            %(CREATE INDEX IF NOT EXISTS #{quote(name, dialect)} ON #{quote(table_name, dialect)} (#{quote(column, dialect)});)
-          when :mysql
-            %(CREATE INDEX #{quote(name, dialect)} ON #{quote(table_name, dialect)} (#{quote(column, dialect)});)
-          when :mssql
-            %(IF NOT EXISTS (SELECT name FROM sys.indexes WHERE name = '#{name.gsub("'", "''")}' AND object_id = OBJECT_ID(N'#{quote(table_name, dialect)}')) CREATE INDEX #{quote(name, dialect)} ON #{quote(table_name, dialect)} (#{quote(column, dialect)});)
-          end
+          unique = attributes[:unique] && dialect == :mssql
+          name = unique ? "uniq_#{table_name}_#{column}" : "index_#{table_name}_on_#{column}"
+          index_statement(table_name, column, name, dialect, unique: unique, where_not_null: filtered_unique_index?(attributes, dialect))
         end
       end
 
+      def add_column_statement(table_name, logical_field, attributes, dialect)
+        keyword = (dialect == :mssql) ? "ADD" : "ADD COLUMN"
+        %(ALTER TABLE #{quote(table_name, dialect)} #{keyword} #{column_definition(table_name, logical_field, attributes, dialect)};)
+      end
+
+      def add_postgres_id_column_statements(table_name)
+        quoted_table = quote(table_name, :postgres)
+        quoted_id = quote("id", :postgres)
+        [
+          %(ALTER TABLE #{quoted_table} ADD COLUMN #{quoted_id} text;),
+          %(UPDATE #{quoted_table} SET #{quoted_id} = md5(random()::text || clock_timestamp()::text || ctid::text) WHERE #{quoted_id} IS NULL;),
+          %(ALTER TABLE #{quoted_table} ALTER COLUMN #{quoted_id} SET NOT NULL;),
+          %(ALTER TABLE #{quoted_table} ADD PRIMARY KEY (#{quoted_id});)
+        ]
+      end
+
+      def index_statement(table_name, column, name, dialect, unique: false, where_not_null: false)
+        unique_prefix = unique ? "UNIQUE " : ""
+        case dialect
+        when :postgres, :sqlite
+          %(CREATE #{unique_prefix}INDEX IF NOT EXISTS #{quote(name, dialect)} ON #{quote(table_name, dialect)} (#{quote(column, dialect)});)
+        when :mysql
+          %(CREATE #{unique_prefix}INDEX #{quote(name, dialect)} ON #{quote(table_name, dialect)} (#{quote(column, dialect)});)
+        when :mssql
+          filter = where_not_null ? " WHERE #{quote(column, dialect)} IS NOT NULL" : ""
+          %(#{mssql_required_set_options}\nIF NOT EXISTS (SELECT name FROM sys.indexes WHERE name = '#{name.gsub("'", "''")}' AND object_id = OBJECT_ID(N'#{quote(table_name, dialect)}')) CREATE #{unique_prefix}INDEX #{quote(name, dialect)} ON #{quote(table_name, dialect)} (#{quote(column, dialect)})#{filter};)
+        end
+      end
+
+      def filtered_unique_index?(attributes, dialect)
+        dialect == :mssql && attributes[:unique] && !attributes[:required]
+      end
+
+      def mssql_required_set_options
+        <<~SQL.strip
+          SET ANSI_NULLS ON;
+          SET QUOTED_IDENTIFIER ON;
+          SET ANSI_WARNINGS ON;
+          SET ANSI_PADDING ON;
+          SET CONCAT_NULL_YIELDS_NULL ON;
+          SET ARITHABORT ON;
+          SET NUMERIC_ROUNDABORT OFF;
+        SQL
+      end
+
       def sql_type(logical_field, attributes, dialect)
-        case attributes[:type]
+        type = attributes[:type] || "string"
+        case type
         when "boolean"
           case dialect
           when :mysql
@@ -119,16 +190,22 @@ module BetterAuth
           else
             "text"
           end
+        when "string"
+          indexed_string_sql_type(logical_field, attributes, dialect)
         else
-          if dialect == :mysql
-            indexed = logical_field == "id" || attributes[:unique] || attributes[:index] || attributes[:references]
-            indexed ? "varchar(191)" : "text"
-          elsif dialect == :mssql
-            indexed = logical_field == "id" || attributes[:unique] || attributes[:index] || attributes[:references] || attributes[:sortable]
-            indexed ? "varchar(255)" : "varchar(8000)"
-          else
-            "text"
-          end
+          raise BetterAuth::Error, "Unsupported field type: #{type}"
+        end
+      end
+
+      def indexed_string_sql_type(logical_field, attributes, dialect)
+        if dialect == :mysql
+          indexed = logical_field == "id" || attributes[:unique] || attributes[:index] || attributes[:references] || attributes[:sortable] || attributes.key?(:default_value)
+          indexed ? "varchar(191)" : "text"
+        elsif dialect == :mssql
+          indexed = logical_field == "id" || attributes[:unique] || attributes[:index] || attributes[:references] || attributes[:sortable]
+          indexed ? "varchar(255)" : "varchar(8000)"
+        else
+          "text"
         end
       end
 
@@ -163,10 +240,12 @@ module BetterAuth
         end
       end
 
-      def foreign_key_constraint(table_name, column, reference, dialect, tables = nil)
-        target_model = tables&.fetch(reference.fetch(:model).to_s, nil)&.fetch(:model_name) || reference.fetch(:model)
-        target_field = reference.fetch(:field)
-        on_delete = reference[:on_delete] ? " ON DELETE #{reference[:on_delete].to_s.upcase}" : ""
+      def foreign_key_constraint(table_name, column, reference, dialect, tables = nil, delete_actions: nil)
+        target_table = foreign_key_target_table(reference, tables)
+        target_model = target_table&.fetch(:model_name) || reference.fetch(:model)
+        target_field = foreign_key_target_field(reference, target_table)
+        delete_action = delete_actions&.fetch([table_name.to_s, column.to_s], reference[:on_delete]) || reference[:on_delete]
+        on_delete = delete_action ? " ON DELETE #{delete_action.to_s.upcase}" : ""
 
         case dialect
         when :postgres, :sqlite
@@ -178,6 +257,78 @@ module BetterAuth
         end
       end
 
+      def mssql_delete_actions(tables, dialect)
+        return unless dialect.to_sym == :mssql
+
+        graph = {}
+        tables.each_with_object({}) do |(_logical_name, table), actions|
+          child = table.fetch(:model_name).to_s
+          table.fetch(:fields).each do |logical_field, attributes|
+            reference = attributes[:references]
+            next unless reference
+
+            column = (attributes[:field_name] || physical_name(logical_field)).to_s
+            action = reference[:on_delete]&.to_s
+            key = [child, column]
+            unless mssql_cascading_action?(action)
+              actions[key] = action
+              next
+            end
+
+            target_table = foreign_key_target_table(reference, tables)
+            parent = (target_table&.fetch(:model_name) || reference.fetch(:model)).to_s
+            if mssql_cascade_conflict?(graph, parent, child)
+              actions[key] = "no action"
+            else
+              graph[parent] ||= []
+              graph[parent] << child unless graph[parent].include?(child)
+              actions[key] = action
+            end
+          end
+        end
+      end
+
+      def mssql_cascading_action?(action)
+        %w[cascade set\ null set\ default].include?(action.to_s.downcase.tr("_", " "))
+      end
+
+      def mssql_cascade_conflict?(graph, parent, child)
+        nodes = (graph.keys + graph.values.flatten + [parent, child]).uniq
+        nodes.any? do |source|
+          mssql_reachable?(graph, source, parent) && mssql_reachable?(graph, source, child)
+        end
+      end
+
+      def mssql_reachable?(graph, source, target, visited = {})
+        return true if source == target
+        return false if visited[source]
+
+        visited[source] = true
+        Array(graph[source]).any? { |child| mssql_reachable?(graph, child, target, visited) }
+      end
+
+      def foreign_key_target_table(reference, tables)
+        return unless tables
+
+        model = reference.fetch(:model).to_s
+        tables.fetch(model, nil) || tables.each_value.find { |table| table.fetch(:model_name).to_s == model }
+      end
+
+      def foreign_key_target_field(reference, target_table)
+        field = reference.fetch(:field).to_s
+        return field unless target_table
+
+        fields = target_table.fetch(:fields)
+        attributes = fields.fetch(field, nil)
+        return attributes[:field_name] || physical_name(field) if attributes
+
+        if fields.each_value.any? { |data| data[:field_name].to_s == field }
+          field
+        else
+          physical_name(field)
+        end
+      end
+
       def quote(identifier, dialect)
         case dialect
         when :postgres, :sqlite
@@ -197,6 +348,10 @@ module BetterAuth
           .tr("-", "_")
           .downcase
       end
+
+      def logical_name(logical_field, attributes)
+        (attributes[:logical_name] || logical_field).to_s
+      end
     end
   end
 end

data/lib/better_auth/schema.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "time"
+
 module BetterAuth
   module Schema
     module_function
@@ -18,9 +20,44 @@ module BetterAuth
       tables.delete("verification") if secondary_storage?(options) && !verification_option(options, :store_in_database)
       tables.merge!(plugin_schema)
       tables["rateLimit"] = rate_limit_table(options) if rate_limit_option(options, :storage) == "database"
+      ensure_id_fields!(tables)
       tables.sort_by { |_name, table| table[:order] || Float::INFINITY }.to_h
     end
 
+    def migration_tables(options)
+      tables = auth_tables(options)
+      grouped = {}
+
+      tables.each_with_index do |(logical_name, table), index|
+        table_name = table.fetch(:model_name)
+        target = grouped[table_name] ||= {
+          model_name: table_name,
+          fields: {},
+          order: table[:order] || Float::INFINITY,
+          source_order: index,
+          logical_names: [],
+          disable_migration: false
+        }
+        target[:order] = [target[:order], table[:order] || Float::INFINITY].min
+        target[:source_order] = [target[:source_order], index].min
+        target[:logical_names] << logical_name
+        target[:disable_migration] ||= table[:disable_migration] == true
+
+        table.fetch(:fields).each do |logical_field, attributes|
+          column = attributes[:field_name] || physical_name(logical_field)
+          physical_attributes = physical_field_attributes(logical_field, attributes, tables)
+          merge_physical_field!(target, column, physical_attributes)
+        end
+      end
+
+      grouped
+        .reject { |_name, table| table[:disable_migration] }
+        .sort_by { |_name, table| [table[:order], table[:source_order]] }
+        .to_h do |name, table|
+          [name, table.except(:source_order, :disable_migration)]
+        end
+    end
+
     def storage_model_name(options, model)
       table = auth_tables(options).fetch(model.to_s)
       table[:model_name]
@@ -48,10 +85,48 @@ module BetterAuth
       data
     end
 
+    def parse_provider_profile_user_input(options, profile, action:)
+      action = action.to_sym
+      raise ArgumentError, "action must be :create or :update" unless [:create, :update].include?(action)
+
+      input = (profile || {}).each_with_object({}) do |(key, value), result|
+        result[storage_key(key)] = value
+      end
+      core_fields = %w[id email emailVerified name image createdAt updatedAt]
+      fields = auth_tables(options).fetch("user").fetch(:fields).except(*core_fields)
+
+      fields.each_with_object({}) do |(field, attributes), result|
+        provider_value_allowed = attributes[:input] != false && input.key?(field)
+        if provider_value_allowed
+          value = coerce_provider_profile_value(input[field], attributes)
+          transform = attributes[:transform]
+          value = transform.call(value) if transform.respond_to?(:call)
+          validator = attributes[:validator]
+          if validator.respond_to?(:call) && !validator.call(value)
+            raise APIError.new("BAD_REQUEST", message: "#{field} is invalid")
+          end
+          result[field] = value
+        elsif action == :create && attributes.key?(:default_value)
+          default = attributes[:default_value]
+          result[field] = default.respond_to?(:call) ? default.call : default
+        elsif action == :create && attributes[:required]
+          raise APIError.new("BAD_REQUEST", message: "#{field} is required")
+        end
+      end
+    end
+
+    private_class_method def self.coerce_provider_profile_value(value, attributes)
+      return value if value.nil?
+      return Time.parse(value) if attributes[:type] == "date" && value.is_a?(String)
+
+      value
+    end
+
     private_class_method def self.user_table(options, plugin_table)
       table(
         model_name: model_option(options, :user, :model_name) || "users",
         order: 1,
+        disable_migration: plugin_table&.fetch(:disable_migration, false),
         fields: id_field.merge(
           "name" => field("string", required: true, sortable: true, field_name: mapped_field(options, :user, "name")),
           "email" => field("string", required: true, unique: true, sortable: true, field_name: mapped_field(options, :user, "email")),
@@ -66,6 +141,7 @@ module BetterAuth
       table(
         model_name: model_option(options, :session, :model_name) || "sessions",
         order: 2,
+        disable_migration: plugin_table&.fetch(:disable_migration, false),
         fields: base_fields.merge(
           "expiresAt" => field("date", required: true, field_name: mapped_field(options, :session, "expiresAt")),
           "token" => field("string", required: true, unique: true, field_name: mapped_field(options, :session, "token")),
@@ -81,6 +157,7 @@ module BetterAuth
       table(
         model_name: model_option(options, :account, :model_name) || "accounts",
         order: 3,
+        disable_migration: plugin_table&.fetch(:disable_migration, false),
         fields: base_fields.merge(
           "accountId" => field("string", required: true, field_name: mapped_field(options, :account, "accountId")),
           "providerId" => field("string", required: true, field_name: mapped_field(options, :account, "providerId")),
@@ -101,6 +178,7 @@ module BetterAuth
       table(
         model_name: model_option(options, :verification, :model_name) || "verifications",
         order: 4,
+        disable_migration: plugin_table&.fetch(:disable_migration, false),
         fields: base_fields.merge(
           "identifier" => field("string", required: true, index: true, field_name: mapped_field(options, :verification, "identifier")),
           "value" => field("string", required: true, field_name: mapped_field(options, :verification, "value")),
@@ -121,6 +199,58 @@ module BetterAuth
       }
     end
 
+    private_class_method def self.ensure_id_fields!(tables)
+      tables.each_value do |table|
+        fields = table.fetch(:fields)
+        next if fields.key?("id")
+
+        table[:fields] = id_field.merge(fields)
+      end
+    end
+
+    private_class_method def self.physical_field_attributes(logical_field, attributes, tables)
+      column = attributes[:field_name] || physical_name(logical_field)
+      physical_attributes = attributes.merge(field_name: column, logical_name: logical_field.to_s)
+      reference = attributes[:references]
+      return physical_attributes unless reference
+
+      physical_attributes.merge(references: physical_reference(reference, tables))
+    end
+
+    private_class_method def self.physical_reference(reference, tables)
+      model = reference.fetch(:model).to_s
+      target_table = tables.fetch(model, nil) || tables.each_value.find { |table| table.fetch(:model_name).to_s == model }
+      return reference unless target_table
+
+      field = reference.fetch(:field).to_s
+      target_field = target_table.fetch(:fields).fetch(field, nil)
+      physical_field = if target_field
+        target_field[:field_name] || physical_name(field)
+      elsif target_table.fetch(:fields).each_value.any? { |attributes| attributes[:field_name].to_s == field }
+        field
+      else
+        physical_name(field)
+      end
+      reference.merge(model: target_table.fetch(:model_name), field: physical_field)
+    end
+
+    private_class_method def self.merge_physical_field!(table, column, attributes)
+      existing = table.fetch(:fields)[column]
+      unless existing
+        table.fetch(:fields)[column] = attributes
+        return
+      end
+
+      return if compatible_physical_field?(existing, attributes)
+
+      raise BetterAuth::Error, "Conflicting schema metadata for #{table.fetch(:model_name)}.#{column}"
+    end
+
+    private_class_method def self.compatible_physical_field?(left, right)
+      keys = [:type, :required, :references, :index, :unique, :sortable, :bigint]
+      keys.all? { |key| left[key] == right[key] }
+    end
+
     private_class_method def self.base_fields
       id_field.merge(timestamp_fields)
     end
@@ -138,12 +268,12 @@ module BetterAuth
       }
     end
 
-    private_class_method def self.table(model_name:, fields:, extra_fields:, order:)
+    private_class_method def self.table(model_name:, fields:, extra_fields:, order:, disable_migration: false)
       {
         model_name: model_name,
         fields: merge_fields(fields, *extra_fields),
         order: order
-      }
+      }.tap { |data| data[:disable_migration] = true if disable_migration == true }
     end
 
     private_class_method def self.merge_fields(base, *extras)
@@ -162,14 +292,20 @@ module BetterAuth
         schema.each do |raw_key, raw_table|
           key = storage_key(raw_key)
           table_data = symbolize_hash(raw_table || {})
-          existing = tables[key] || {model_name: table_data[:model_name] || physical_name(key), fields: {}}
-          existing[:model_name] = table_data[:model_name] || existing[:model_name] || physical_name(key)
+          existing = tables[key] || {model_name: table_data[:model_name] || physical_table_name(key), fields: {}}
+          existing[:model_name] = table_data[:model_name] || existing[:model_name] || physical_table_name(key)
           existing[:fields] = existing[:fields].merge(normalize_fields(table_data[:fields] || {}))
+          existing[:disable_migration] = true if table_data[:disable_migration] == true
+          existing[:fields] = id_field.merge(existing[:fields]) unless core_table?(key) || existing[:fields].key?("id")
           tables[key] = existing
         end
       end
     end
 
+    private_class_method def self.core_table?(key)
+      %w[user session account verification].include?(key.to_s)
+    end
+
     private_class_method def self.normalize_fields(fields)
       fields.each_with_object({}) do |(raw_key, raw_value), result|
         key = storage_key(raw_key)
@@ -270,6 +406,24 @@ module BetterAuth
       underscore(value.to_s)
     end
 
+    private_class_method def self.physical_table_name(value)
+      pluralize_table_name(physical_name(value))
+    end
+
+    private_class_method def self.pluralize_table_name(value)
+      special = {
+        "apikey" => "api_keys",
+        "api_key" => "api_keys",
+        "wallet_address" => "wallet_addresses"
+      }
+      return special.fetch(value) if special.key?(value)
+      return value if value.end_with?("s")
+      return "#{value[0...-1]}ies" if value.end_with?("y") && value.match?(/[^aeiou]y\z/)
+      return "#{value}es" if value.match?(/(s|x|z|ch|sh)\z/)
+
+      "#{value}s"
+    end
+
     private_class_method def self.camelize_lower(value)
       parts = underscore(value).split("_")
       ([parts.first] + parts.drop(1).map(&:capitalize)).join
@@ -286,6 +440,6 @@ module BetterAuth
       (Time.now.to_f * 1000).to_i
     end
 
-    public_class_method :storage_key
+    public_class_method :physical_name, :storage_key
   end
 end

data/lib/better_auth/session.rb

@@ -7,15 +7,21 @@ module BetterAuth
     module_function
 
     def find_current(ctx, disable_cookie_cache: false, disable_refresh: false, sensitive: false)
-      if ctx.context.current_session
+      authoritative = sensitive && stateful?(ctx)
+      if ctx.context.current_session && !authoritative
         return ctx.context.current_session
       end
 
       token_cookie = ctx.context.auth_cookies[:session_token]
       token = ctx.get_signed_cookie(token_cookie.name, ctx.context.secret)
-      return nil unless token
+      unless token
+        present = ctx.get_cookie(token_cookie.name)
+        return missing_session(ctx) if present && !present.empty?
 
-      cached = cached_session(ctx, token, disable_cookie_cache: disable_cookie_cache, sensitive: sensitive)
+        return nil
+      end
+
+      cached = cached_session(ctx, token, disable_cookie_cache: disable_cookie_cache, sensitive: authoritative)
       if cached
         ctx.context.set_current_session(cached) if ctx.context.respond_to?(:set_current_session)
         return cached
@@ -45,7 +51,8 @@ module BetterAuth
         strategy: config[:strategy] || "compact",
         version: config[:version],
         cookie_prefix: ctx.context.options.advanced[:cookie_prefix] || "better-auth",
-        is_secure: ctx.context.auth_cookies[:session_data].name.start_with?(Cookies::SECURE_COOKIE_PREFIX)
+        is_secure: ctx.context.auth_cookies[:session_data].name.start_with?(Cookies::SECURE_COOKIE_PREFIX),
+        cookie_full_name: ctx.context.auth_cookies[:session_data].name
       )
       return nil unless payload
       return nil if payload["session"]["token"] && payload["session"]["token"] != token
@@ -56,10 +63,16 @@ module BetterAuth
     end
 
     def missing_session(ctx)
+      ctx.context.set_current_session(nil) if ctx.context.respond_to?(:set_current_session)
       Cookies.delete_session_cookie(ctx)
       nil
     end
 
+    def stateful?(ctx)
+      options = ctx.context.options
+      !options.database.nil? || !options.secondary_storage.nil?
+    end
+
     def expired?(session)
       expires_at = normalize_time(session["expiresAt"])
       expires_at && expires_at <= Time.now
@@ -83,7 +96,12 @@ module BetterAuth
         "expiresAt" => expires_at,
         "updatedAt" => now
       )
-      session = stringify_keys(updated || result[:session]).merge("expiresAt" => expires_at, "updatedAt" => now)
+      unless updated
+        missing_session(ctx)
+        raise APIError.new("UNAUTHORIZED", message: BASE_ERROR_CODES["FAILED_TO_GET_SESSION"])
+      end
+
+      session = stringify_keys(updated)
       refreshed = {session: session, user: result[:user]}
       Cookies.set_session_cookie(ctx, refreshed, Cookies.dont_remember?(ctx))
       refreshed
@@ -91,12 +109,13 @@ module BetterAuth
 
     def refresh_cached_session(ctx, result)
       now = Time.now
-      session = stringify_keys(result[:session]).merge(
-        "expiresAt" => now + ctx.context.session_config[:expires_in].to_i,
-        "updatedAt" => now
-      )
+      session = stringify_keys(result[:session])
+      expires_at = normalize_time(session["expiresAt"])
+      return missing_session(ctx) if expires_at && expires_at <= now
+
+      remaining = expires_at && [(expires_at - now).floor, 0].max
       refreshed = {session: session, user: result[:user]}
-      Cookies.set_session_cookie(ctx, refreshed, Cookies.dont_remember?(ctx))
+      Cookies.set_session_cookie(ctx, refreshed, Cookies.dont_remember?(ctx), max_age: remaining)
       refreshed
     end
 

data/lib/better_auth/session_store.rb

@@ -6,7 +6,7 @@ module BetterAuth
     ESTIMATED_EMPTY_COOKIE_SIZE = 200
     CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE
 
-    CookieValue = Struct.new(:name, :value, :attributes, keyword_init: true)
+    CookieValue = Struct.new(:name, :value, :attributes)
 
     attr_reader :cookie_name, :cookie_options, :context, :chunks
 

data/lib/better_auth/social_providers/apple.rb

@@ -45,8 +45,13 @@ module BetterAuth
             algorithms: ["RS256"],
             issuers: "https://appleid.apple.com",
             audience: audiences,
-            nonce: nonce
+            nonce: nil
           )
+          if nonce
+            token_nonce = profile&.fetch("nonce", nil)
+            expected_nonces = [nonce, OpenSSL::Digest::SHA256.hexdigest(nonce.to_s)]
+            return false unless token_nonce.is_a?(String) && expected_nonces.include?(token_nonce)
+          end
           !!profile&.fetch("sub", nil)
         end,
         get_user_info: lambda do |tokens|

data/lib/better_auth/social_providers/atlassian.rb

@@ -15,6 +15,7 @@ module BetterAuth
         user_info_endpoint: "https://api.atlassian.com/me",
         scopes: scopes,
         pkce: true,
+        require_code_verifier: true,
         auth_params: {audience: "api.atlassian.com"},
         profile_map: ->(profile) {
           {