better_auth 0.8.0 → 0.11.0

data/lib/better_auth/social_providers/base.rb

@@ -7,6 +7,7 @@ require "net/http"
 require "openssl"
 require "time"
 require "uri"
+require_relative "../http_client"
 
 module BetterAuth
   module SocialProviders
@@ -25,8 +26,9 @@ module BetterAuth
         uri.to_s
       end
 
-      def oauth_provider(id:, name:, client_id:, authorization_endpoint:, token_endpoint:, profile_map:, client_secret: nil, user_info_endpoint: nil, scopes: [], scope_separator: " ", pkce: false, auth_params: {}, token_params: {}, user_info_method: :get, user_info_headers: {}, user_info_body: nil, **options)
+      def oauth_provider(id:, name:, client_id:, authorization_endpoint:, token_endpoint:, profile_map:, client_secret: nil, user_info_endpoint: nil, scopes: [], scope_separator: " ", pkce: false, require_code_verifier: false, auth_params: {}, token_params: {}, token_authentication: :post, user_info_method: :get, user_info_headers: {}, user_info_body: nil, **options)
         opts = normalize_options(options.merge(client_id: client_id, client_secret: client_secret))
+        primary_id = primary_client_id(client_id)
         {
           id: id,
           name: name,
@@ -35,9 +37,11 @@ module BetterAuth
           options: opts,
           create_authorization_url: lambda do |data|
             verifier = value(data, :code_verifier, :codeVerifier)
+            raise Error, "codeVerifier is required for #{name}" if require_code_verifier && verifier.to_s.empty?
+
             selected_scopes = selected_scopes(scopes, opts, data)
             params = {
-              client_id: primary_client_id(client_id),
+              client_id: primary_id,
               redirect_uri: opts[:redirect_uri] || value(data, :redirect_uri, :redirectURI),
               response_type: "code",
               scope: selected_scopes.empty? ? nil : selected_scopes.join(scope_separator),
@@ -50,28 +54,30 @@ module BetterAuth
             authorization_url(option(opts, :authorization_endpoint, :authorizationEndpoint) || authorization_endpoint, params)
           end,
           validate_authorization_code: lambda do |data|
-            post_form_json(option(opts, :token_endpoint, :tokenEndpoint) || token_endpoint, {
-              client_id: primary_client_id(client_id),
-              client_secret: client_secret,
+            token_form = {
               code: value(data, :code),
               code_verifier: value(data, :code_verifier, :codeVerifier),
               grant_type: "authorization_code",
               redirect_uri: opts[:redirect_uri] || value(data, :redirect_uri, :redirectURI)
-            }.merge(resolve_hash(token_params, data, opts)))
+            }.merge(resolve_hash(token_params, data, opts))
+            post_token_form(
+              option(opts, :token_endpoint, :tokenEndpoint) || token_endpoint,
+              token_form,
+              client_id: primary_id,
+              client_secret: client_secret,
+              authentication: token_authentication
+            )
           end,
           refresh_access_token: opts[:refresh_access_token] || lambda do |refresh_token|
             refresh_access_token(
               option(opts, :token_endpoint, :tokenEndpoint) || token_endpoint,
               refresh_token,
-              client_id: primary_client_id(client_id),
-              client_secret: client_secret
+              client_id: primary_id,
+              client_secret: client_secret,
+              authentication: token_authentication
             )
           end,
-          verify_id_token: opts[:verify_id_token] || lambda do |token, _nonce = nil|
-            return false if opts[:disable_id_token_sign_in]
-
-            !decode_jwt_payload(token).empty?
-          end,
+          verify_id_token: opts[:verify_id_token],
           get_user_info: lambda do |tokens|
             custom = opts[:get_user_info]
             profile = if custom
@@ -141,13 +147,27 @@ module BetterAuth
         (method == :post) ? post_json(endpoint, resolved_body, resolved_headers) : get_json(endpoint, resolved_headers)
       end
 
-      def refresh_access_token(token_endpoint, refresh_token, client_id:, client_secret: nil, extra_params: {})
-        normalize_tokens(post_form_json(token_endpoint, {
-          client_id: client_id,
-          client_secret: client_secret,
+      def refresh_access_token(token_endpoint, refresh_token, client_id:, client_secret: nil, extra_params: {}, authentication: :post)
+        normalize_tokens(post_token_form(token_endpoint, {
           grant_type: "refresh_token",
           refresh_token: refresh_token
-        }.merge(extra_params || {})))
+        }.merge(extra_params || {}), client_id: client_id, client_secret: client_secret, authentication: authentication))
+      end
+
+      def post_token_form(token_endpoint, form, client_id:, client_secret: nil, authentication: :post, headers: {})
+        case authentication&.to_sym
+        when :basic
+          post_form_json(token_endpoint, form.compact, basic_auth_headers(client_id, client_secret).merge(headers))
+        else
+          post_form_json(token_endpoint, {
+            client_id: client_id,
+            client_secret: client_secret
+          }.merge(form), headers)
+        end
+      end
+
+      def basic_auth_headers(client_id, client_secret)
+        {"Authorization" => "Basic #{Base64.strict_encode64("#{client_id}:#{client_secret}")}"}
       end
 
       def normalize_tokens(tokens, now: Time.now)
@@ -214,7 +234,11 @@ module BetterAuth
           appBundleIdentifier: :app_bundle_identifier,
           profilePhotoSize: :profile_photo_size,
           disableProfilePhoto: :disable_profile_photo,
-          tenantId: :tenant_id
+          tenantId: :tenant_id,
+          userPoolId: :user_pool_id,
+          requireClientSecret: :require_client_secret,
+          configId: :config_id,
+          loginUrl: :login_url
         }.each do |camel, snake|
           normalized[snake] = normalized[camel] if normalized.key?(camel) && !normalized.key?(snake)
         end
@@ -277,7 +301,7 @@ module BetterAuth
         return nil if max_age && payload["iat"] && payload["iat"].to_i < Time.now.to_i - max_age.to_i
 
         payload
-      rescue JWT::DecodeError, JSON::ParserError, ArgumentError, OpenSSL::PKey::PKeyError
+      rescue JWT::DecodeError, JSON::ParserError, ArgumentError, OpenSSL::PKey::PKeyError, Net::OpenTimeout, Net::ReadTimeout, SocketError, SystemCallError
         nil
       end
 
@@ -312,9 +336,7 @@ module BetterAuth
       end
 
       def request_json(uri, request)
-        Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https", open_timeout: 5, read_timeout: 5) do |http|
-          http.request(request)
-        end
+        HTTPClient.request(uri, request)
       end
 
       def padded_base64(value)

data/lib/better_auth/social_providers/cognito.rb

@@ -5,15 +5,25 @@ module BetterAuth
     module_function
 
     def cognito(client_id:, client_secret: nil, scopes: ["openid", "profile", "email"], **options)
-      domain = (options[:domain] || options[:issuer] || "https://cognito-idp.#{options[:region] || "us-east-1"}.amazonaws.com").to_s.sub(%r{/+\z}, "")
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      domain = normalized[:domain]
+      region = normalized[:region]
+      user_pool_id = normalized[:user_pool_id]
+      raise Error, "DOMAIN_AND_REGION_REQUIRED" if domain.to_s.empty? || region.to_s.empty? || user_pool_id.to_s.empty?
+
+      if normalized[:require_client_secret] && client_secret.to_s.empty?
+        raise Error, "CLIENT_SECRET_REQUIRED"
+      end
+
+      clean_domain = domain.to_s.sub(%r{\Ahttps?://}, "").sub(%r{/+\z}, "")
+      provider = Base.oauth_provider(
         id: "cognito",
         name: "Cognito",
         client_id: client_id,
         client_secret: client_secret,
-        authorization_endpoint: "#{domain}/oauth2/authorize",
-        token_endpoint: "#{domain}/oauth2/token",
-        user_info_endpoint: "#{domain}/oauth2/userinfo",
+        authorization_endpoint: "https://#{clean_domain}/oauth2/authorize",
+        token_endpoint: "https://#{clean_domain}/oauth2/token",
+        user_info_endpoint: "https://#{clean_domain}/oauth2/userinfo",
         scopes: scopes,
         pkce: true,
         profile_map: ->(profile) {
@@ -27,6 +37,66 @@ module BetterAuth
         },
         **options
       )
+      create_authorization_url = provider.fetch(:create_authorization_url)
+      provider[:create_authorization_url] = lambda do |data|
+        create_authorization_url.call(data).sub(/scope=([^&]+)/) { "scope=#{$1.gsub("+", "%20")}" }
+      end
+      provider[:verify_id_token] ||= lambda do |token, nonce = nil|
+        return false if normalized[:disable_id_token_sign_in]
+
+        profile = Base.verify_jwt_with_jwks(
+          token,
+          jwks: normalized[:jwks],
+          jwks_endpoint: normalized[:jwks_endpoint] || "https://cognito-idp.#{region}.amazonaws.com/#{user_pool_id}/.well-known/jwks.json",
+          algorithms: ["RS256"],
+          issuers: "https://cognito-idp.#{region}.amazonaws.com/#{user_pool_id}",
+          audience: Array(client_id),
+          nonce: nonce,
+          max_age: 3600
+        )
+        !!profile&.fetch("sub", nil)
+      end
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        if Base.id_token(tokens)
+          profile = Base.decode_jwt_payload(Base.id_token(tokens))
+          unless profile.empty?
+            name = profile["name"] || profile["given_name"] || profile["username"] || ""
+            enriched = profile.merge("name" => name)
+            user = Base.apply_profile_mapping(
+              {
+                id: profile["sub"],
+                name: name,
+                email: profile["email"],
+                image: profile["picture"],
+                emailVerified: !!profile["email_verified"]
+              },
+              enriched,
+              normalized
+            )
+            next({user: user, data: enriched})
+          end
+        end
+
+        profile = Base.fetch_user_info("https://#{clean_domain}/oauth2/userinfo", tokens)
+        next nil unless profile
+
+        user = Base.apply_profile_mapping(
+          {
+            id: profile["sub"],
+            name: profile["name"] || profile["given_name"] || profile["username"] || "",
+            email: profile["email"],
+            image: profile["picture"],
+            emailVerified: !!profile["email_verified"]
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/facebook.rb

@@ -5,6 +5,7 @@ module BetterAuth
     module_function
 
     def facebook(client_id:, client_secret:, scopes: ["email", "public_profile"], **options)
+      normalized = Base.normalize_options(options)
       fields = Array(options[:fields] || %w[id name email picture email_verified]).join(",")
       provider = Base.oauth_provider(
         id: "facebook",
@@ -28,7 +29,100 @@ module BetterAuth
         },
         **options
       )
-      provider[:verify_id_token] = provider[:options][:verify_id_token] || ->(token, _nonce = nil) { provider[:options][:disable_id_token_sign_in] ? false : !token.to_s.empty? }
+      verify_access_token = lambda do |access_token|
+        primary_client_id = Base.primary_client_id(client_id)
+        next nil if access_token.to_s.empty? || client_secret.to_s.empty?
+
+        response = Base.get_json(Base.authorization_url("https://graph.facebook.com/debug_token", {
+          input_token: access_token,
+          access_token: "#{primary_client_id}|#{client_secret}"
+        }))
+        data = response.is_a?(Hash) ? response["data"] : nil
+        next nil unless data.is_a?(Hash)
+        next nil unless data["is_valid"] == true
+        next nil unless Array(client_id).map(&:to_s).include?(data["app_id"].to_s)
+        next nil if data["app_id"].to_s.empty? || data["user_id"].to_s.empty?
+
+        data["user_id"]
+      rescue
+        nil
+      end
+      provider[:verify_id_token] = lambda do |token, nonce = nil|
+        return false if normalized[:disable_id_token_sign_in]
+
+        custom = normalized[:verify_id_token]
+        next custom.call(token, nonce) if custom
+
+        begin
+          unless token.to_s.split(".").length == 3
+            next !!verify_access_token.call(token)
+          end
+
+          profile = Base.verify_jwt_with_jwks(
+            token,
+            jwks: normalized[:jwks],
+            jwks_endpoint: normalized[:jwks_endpoint] || "https://limited.facebook.com/.well-known/oauth/openid/jwks/",
+            algorithms: ["RS256"],
+            issuers: "https://www.facebook.com",
+            audience: Array(client_id),
+            nonce: nonce
+          )
+          !!profile
+        rescue
+          false
+        end
+      end
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        begin
+          token = Base.id_token(tokens)
+          if token && token.split(".").length == 3
+            profile = Base.decode_jwt_payload(token)
+            next nil if profile["sub"].to_s.empty?
+
+            user = Base.apply_profile_mapping(
+              {
+                id: profile["sub"],
+                name: profile["name"],
+                email: profile["email"],
+                image: profile["picture"],
+                emailVerified: false
+              },
+              profile.merge("email_verified" => false),
+              normalized
+            )
+            next({user: user, data: profile})
+          end
+
+          access_token = Base.access_token(tokens)
+          next nil if access_token.to_s.empty?
+
+          token_user_id = verify_access_token.call(access_token)
+          next nil unless token_user_id
+
+          profile = Base.fetch_user_info("https://graph.facebook.com/me?fields=#{URI.encode_www_form_component(fields)}", tokens)
+          next nil unless profile.is_a?(Hash)
+          next nil unless profile["id"] == token_user_id
+
+          picture = profile.dig("picture", "data", "url") || profile["picture"]
+          user = Base.apply_profile_mapping(
+            {
+              id: profile["id"] || profile["sub"],
+              name: profile["name"],
+              email: profile["email"],
+              image: picture,
+              emailVerified: !!profile["email_verified"]
+            },
+            profile,
+            normalized
+          )
+          {user: user, data: profile}
+        rescue
+          nil
+        end
+      end
       provider
     end
   end

data/lib/better_auth/social_providers/figma.rb

@@ -15,6 +15,8 @@ module BetterAuth
         user_info_endpoint: "https://api.figma.com/v1/me",
         scopes: scopes,
         pkce: true,
+        require_code_verifier: true,
+        token_authentication: :basic,
         profile_map: ->(profile) {
           {
             id: profile["id"],

data/lib/better_auth/social_providers/github.rb

@@ -43,6 +43,8 @@ module BetterAuth
             "User-Agent" => "better-auth"
           }
           profile = Base.get_json(user_info_endpoint, headers)
+          next nil unless profile
+
           emails = Base.get_json(emails_endpoint, headers)
           primary = Array(emails).find { |email| email["email"] == profile["email"] } ||
             Array(emails).find { |email| email["primary"] } ||

data/lib/better_auth/social_providers/google.rb

@@ -4,6 +4,14 @@ module BetterAuth
   module SocialProviders
     module_function
 
+    def google_hosted_domain_allowed?(configured_hosted_domain, token_hosted_domain)
+      return true if configured_hosted_domain.nil? || configured_hosted_domain.to_s.empty?
+      return false unless token_hosted_domain.is_a?(String) && !token_hosted_domain.strip.empty?
+      return true if configured_hosted_domain == "*"
+
+      token_hosted_domain == configured_hosted_domain
+    end
+
     def google(client_id:, client_secret:, scopes: ["openid", "email", "profile"], **options)
       normalized = Base.normalize_options(options)
       primary_client_id = Base.primary_client_id(client_id)
@@ -12,6 +20,7 @@ module BetterAuth
         name: "Google",
         client_id: client_id,
         client_secret: client_secret,
+        options: normalized,
         create_authorization_url: lambda do |data|
           verifier = data[:code_verifier] || data[:codeVerifier]
           raise Error, "codeVerifier is required for Google" if verifier.to_s.empty?
@@ -57,7 +66,7 @@ module BetterAuth
             audience: audiences,
             nonce: nonce
           )
-          !!profile&.fetch("sub", nil)
+          !!profile&.fetch("sub", nil) && google_hosted_domain_allowed?(normalized[:hd], profile["hd"])
         end,
         get_user_info: lambda do |tokens|
           custom = normalized[:get_user_info]
@@ -65,6 +74,8 @@ module BetterAuth
           next nil unless Base.id_token(tokens)
 
           profile = Base.decode_jwt_payload(Base.id_token(tokens))
+          next nil unless google_hosted_domain_allowed?(normalized[:hd], profile["hd"])
+
           user = Base.apply_profile_mapping(
             {
               id: profile["sub"],

data/lib/better_auth/social_providers/line.rb

@@ -5,6 +5,7 @@ module BetterAuth
     module_function
 
     def line(client_id:, client_secret:, scopes: ["openid", "profile", "email"], **options)
+      normalized = Base.normalize_options(options)
       provider = Base.oauth_provider(
         id: "line",
         name: "LINE",
@@ -26,7 +27,40 @@ module BetterAuth
         },
         **options
       )
-      provider[:verify_id_token] = provider[:options][:verify_id_token] || ->(token, _nonce = nil) { provider[:options][:disable_id_token_sign_in] ? false : !Base.decode_jwt_payload(token).empty? }
+      provider[:verify_id_token] ||= lambda do |token, nonce = nil|
+        return false if normalized[:disable_id_token_sign_in]
+
+        profile = Base.post_form_json(
+          normalized[:verify_id_token_endpoint] || "https://api.line.me/oauth2/v2.1/verify",
+          {id_token: token, client_id: client_id, nonce: nonce}
+        )
+        next false unless profile
+        next false unless profile["aud"] == client_id
+        next false if profile["nonce"] && profile["nonce"] != nonce
+
+        true
+      end
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        profile = Base.id_token(tokens) ? Base.decode_jwt_payload(Base.id_token(tokens)) : {}
+        profile = Base.fetch_user_info("https://api.line.me/oauth2/v2.1/userinfo", tokens) if profile.empty?
+        next nil unless profile && !profile.empty?
+
+        user = Base.apply_profile_mapping(
+          {
+            id: profile["sub"] || profile["userId"],
+            name: profile["name"] || profile["displayName"] || "",
+            email: profile["email"],
+            image: profile["picture"] || profile["pictureUrl"],
+            emailVerified: false
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
       provider
     end
   end

data/lib/better_auth/social_providers/linear.rb

@@ -33,6 +33,7 @@ module BetterAuth
           "Authorization" => "Bearer #{Base.access_token(tokens)}"
         )
         return profile if Base.provider_user_info?(profile)
+        return nil unless profile
 
         mapped = provider[:options][:map_profile_to_user]&.call(profile) || {}
         viewer = profile.dig("data", "viewer") || {}

data/lib/better_auth/social_providers/microsoft_entra_id.rb

@@ -2,6 +2,9 @@
 
 module BetterAuth
   module SocialProviders
+    MICROSOFT_CONSUMER_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad"
+    private_constant :MICROSOFT_CONSUMER_TENANT_ID
+
     module_function
 
     def microsoft_entra_id(client_id:, client_secret:, tenant_id: "common", scopes: ["openid", "profile", "email", "User.Read", "offline_access"], **options)
@@ -81,6 +84,12 @@ module BetterAuth
             nonce: nonce
           )
 
+          tid = profile&.fetch("tid", nil)
+          next false unless tid.is_a?(String)
+          next false unless profile["iss"] == "#{authority.to_s.sub(%r{/+\z}, "")}/#{tid}/v2.0"
+          next false if tenant_id.to_s == "organizations" && tid == MICROSOFT_CONSUMER_TENANT_ID
+          next false if tenant_id.to_s == "consumers" && tid != MICROSOFT_CONSUMER_TENANT_ID
+
           !!(profile&.fetch("sub", nil) || profile&.fetch("oid", nil))
         end,
         get_user_info: lambda do |tokens|

data/lib/better_auth/social_providers/naver.rb

@@ -5,7 +5,8 @@ module BetterAuth
     module_function
 
     def naver(client_id:, client_secret:, scopes: ["profile", "email"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      provider = Base.oauth_provider(
         id: "naver",
         name: "Naver",
         client_id: client_id,
@@ -26,6 +27,28 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        profile = Base.fetch_user_info("https://openapi.naver.com/v1/nid/me", tokens)
+        next nil unless profile && profile["resultcode"] == "00"
+
+        data = profile["response"] || {}
+        user = Base.apply_profile_mapping(
+          {
+            id: data["id"],
+            name: data["name"] || data["nickname"] || "",
+            email: data["email"],
+            image: data["profile_image"],
+            emailVerified: false
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/notion.rb

@@ -15,6 +15,7 @@ module BetterAuth
         user_info_endpoint: "https://api.notion.com/v1/users/me",
         scopes: scopes,
         auth_params: {owner: "user"},
+        token_authentication: :basic,
         user_info_headers: {"Notion-Version" => "2022-06-28"},
         profile_map: ->(profile) {
           user = profile.dig("bot", "owner", "user") || profile

data/lib/better_auth/social_providers/paybin.rb

@@ -5,8 +5,9 @@ module BetterAuth
     module_function
 
     def paybin(client_id:, client_secret:, scopes: ["openid", "email", "profile"], **options)
+      normalized = Base.normalize_options(options)
       issuer = (options[:issuer] || "https://idp.paybin.io").to_s.sub(%r{/+\z}, "")
-      Base.oauth_provider(
+      provider = Base.oauth_provider(
         id: "paybin",
         name: "Paybin",
         client_id: client_id,
@@ -15,6 +16,7 @@ module BetterAuth
         token_endpoint: "#{issuer}/oauth2/token",
         scopes: scopes,
         pkce: true,
+        require_code_verifier: true,
         profile_map: ->(profile) {
           {
             id: profile["sub"],
@@ -26,6 +28,28 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+        next nil unless Base.id_token(tokens)
+
+        profile = Base.decode_jwt_payload(Base.id_token(tokens))
+        next nil if profile.empty?
+
+        user = Base.apply_profile_mapping(
+          {
+            id: profile["sub"],
+            name: profile["name"] || profile["preferred_username"] || "",
+            email: profile["email"],
+            image: profile["picture"],
+            emailVerified: !!profile["email_verified"]
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end