better_auth 0.8.0 → 0.11.0

data/lib/better_auth/social_providers/paypal.rb

@@ -5,19 +5,24 @@ module BetterAuth
     module_function
 
     def paypal(client_id:, client_secret:, scopes: [], **options)
+      normalized = Base.normalize_options(options)
       sandbox = (options[:environment] || "sandbox").to_s == "sandbox"
       auth_host = sandbox ? "https://www.sandbox.paypal.com" : "https://www.paypal.com"
       api_host = sandbox ? "https://api-m.sandbox.paypal.com" : "https://api-m.paypal.com"
+      token_endpoint = normalized[:token_endpoint] || "#{api_host}/v1/oauth2/token"
+      issuer = sandbox ? "https://www.sandbox.paypal.com" : "https://www.paypal.com"
+      jwks_endpoint = normalized[:jwks_endpoint] || (sandbox ? "https://api.sandbox.paypal.com/v1/oauth2/certs" : "https://api.paypal.com/v1/oauth2/certs")
       provider = Base.oauth_provider(
         id: "paypal",
         name: "PayPal",
         client_id: client_id,
         client_secret: client_secret,
         authorization_endpoint: "#{auth_host}/signin/authorize",
-        token_endpoint: "#{api_host}/v1/oauth2/token",
+        token_endpoint: token_endpoint,
         user_info_endpoint: "#{api_host}/v1/identity/oauth2/userinfo?schema=paypalv1.1",
         scopes: scopes,
         pkce: true,
+        token_authentication: :basic,
         profile_map: ->(profile) {
           {
             id: profile["user_id"],
@@ -29,7 +34,118 @@ module BetterAuth
         },
         **options
       )
-      provider[:verify_id_token] = provider[:options][:verify_id_token] || ->(token, _nonce = nil) { provider[:options][:disable_id_token_sign_in] ? false : !!Base.decode_jwt_payload(token)["sub"] }
+      provider[:validate_authorization_code] = lambda do |data|
+        Base.normalize_tokens(Base.post_token_form(
+          token_endpoint,
+          {
+            code: data[:code] || data["code"],
+            grant_type: "authorization_code",
+            redirect_uri: data[:redirect_uri] || data[:redirectURI] || data["redirect_uri"] || data["redirectURI"]
+          },
+          client_id: Base.primary_client_id(client_id),
+          client_secret: client_secret,
+          authentication: :basic,
+          headers: {"Accept-Language" => "en_US"}
+        ))
+      end
+      provider[:refresh_access_token] = lambda do |refresh_token|
+        Base.normalize_tokens(Base.post_token_form(
+          token_endpoint,
+          {
+            grant_type: "refresh_token",
+            refresh_token: refresh_token
+          },
+          client_id: Base.primary_client_id(client_id),
+          client_secret: client_secret,
+          authentication: :basic,
+          headers: {"Accept-Language" => "en_US"}
+        ))
+      end
+      provider[:verify_id_token] = lambda do |token, nonce = nil|
+        return false if normalized[:disable_id_token_sign_in]
+
+        custom = normalized[:verify_id_token]
+        next custom.call(token, nonce) if custom
+
+        begin
+          encoded_header, _encoded_payload, signature = token.to_s.split(".", 3)
+          next false if encoded_header.to_s.empty? || signature.to_s.empty?
+
+          header = JSON.parse(Base64.urlsafe_decode64(Base.padded_base64(encoded_header)))
+          algorithm = header["alg"]
+          profile = case algorithm
+          when "RS256"
+            Base.verify_jwt_with_jwks(
+              token,
+              jwks: normalized[:jwks],
+              jwks_endpoint: jwks_endpoint,
+              algorithms: ["RS256"],
+              issuers: issuer,
+              audience: Array(client_id),
+              nonce: nonce,
+              max_age: 3600
+            )
+          when "HS256"
+            next false if client_secret.to_s.empty?
+
+            claims, = JWT.decode(token.to_s, client_secret, true, {
+              algorithm: "HS256",
+              aud: Array(client_id),
+              verify_aud: true,
+              iss: issuer,
+              verify_iss: true
+            })
+            next false if nonce && claims["nonce"] != nonce
+
+            claims
+          else
+            next false
+          end
+
+          issued_at = Integer(profile.fetch("iat"))
+          token_age = Time.now.to_i - issued_at
+          next false if token_age.negative? || token_age > 3600
+
+          !!profile.fetch("sub", nil)
+        rescue
+          false
+        end
+      end
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        begin
+          access_token = Base.access_token(tokens)
+          next nil if access_token.to_s.empty?
+
+          profile = Base.fetch_user_info("#{api_host}/v1/identity/oauth2/userinfo?schema=paypalv1.1", tokens)
+          next nil unless profile.is_a?(Hash)
+          next nil if profile["user_id"].to_s.empty?
+
+          id_token = Base.id_token(tokens)
+          if id_token
+            id_token_subject = Base.decode_jwt_payload(id_token)["sub"]
+            profile_subject = profile["sub"] || profile["user_id"]
+            next nil if id_token_subject.to_s.empty? || profile_subject.to_s.empty? || id_token_subject != profile_subject
+          end
+
+          user = Base.apply_profile_mapping(
+            {
+              id: profile["user_id"],
+              name: profile["name"],
+              email: profile["email"],
+              image: profile["picture"],
+              emailVerified: !!profile["email_verified"]
+            },
+            profile,
+            normalized
+          )
+          {user: user, data: profile}
+        rescue
+          nil
+        end
+      end
       provider
     end
   end

data/lib/better_auth/social_providers/reddit.rb

@@ -5,28 +5,49 @@ module BetterAuth
     module_function
 
     def reddit(client_id:, client_secret:, scopes: ["identity"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      token_endpoint = normalized[:token_endpoint] || "https://www.reddit.com/api/v1/access_token"
+      provider = Base.oauth_provider(
         id: "reddit",
         name: "Reddit",
         client_id: client_id,
         client_secret: client_secret,
         authorization_endpoint: "https://www.reddit.com/api/v1/authorize",
-        token_endpoint: "https://www.reddit.com/api/v1/access_token",
+        token_endpoint: token_endpoint,
         user_info_endpoint: "https://oauth.reddit.com/api/v1/me",
         user_info_headers: {"User-Agent" => "better-auth"},
         scopes: scopes,
         auth_params: ->(_data, opts) { {duration: opts[:duration]} },
+        token_authentication: :basic,
         profile_map: ->(profile) {
           {
             id: profile["id"],
             name: profile["name"],
-            email: profile["oauth_client_id"],
+            email: "#{profile["id"]}@reddit.invalid",
             image: profile["icon_img"].to_s.split("?").first,
-            emailVerified: !!profile["has_verified_email"]
+            emailVerified: false
           }
         },
         **options
       )
+      provider[:validate_authorization_code] = lambda do |data|
+        Base.post_token_form(
+          token_endpoint,
+          {
+            code: data[:code] || data["code"],
+            grant_type: "authorization_code",
+            redirect_uri: data[:redirect_uri] || data[:redirectURI] || data["redirect_uri"] || data["redirectURI"]
+          },
+          client_id: Base.primary_client_id(client_id),
+          client_secret: client_secret,
+          authentication: :basic,
+          headers: {
+            "accept" => "text/plain",
+            "user-agent" => "better-auth"
+          }
+        )
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/salesforce.rb

@@ -22,6 +22,7 @@ module BetterAuth
         user_info_endpoint: "#{host}/services/oauth2/userinfo",
         scopes: scopes,
         pkce: true,
+        require_code_verifier: true,
         profile_map: ->(profile) {
           {
             id: profile["user_id"],

data/lib/better_auth/social_providers/twitch.rb

@@ -5,7 +5,8 @@ module BetterAuth
     module_function
 
     def twitch(client_id:, client_secret:, scopes: ["user:read:email", "openid"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      provider = Base.oauth_provider(
         id: "twitch",
         name: "Twitch",
         client_id: client_id,
@@ -34,6 +35,28 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+        next nil unless Base.id_token(tokens)
+
+        profile = Base.decode_jwt_payload(Base.id_token(tokens))
+        next nil if profile.empty?
+
+        user = Base.apply_profile_mapping(
+          {
+            id: profile["sub"],
+            name: profile["preferred_username"],
+            email: profile["email"],
+            image: profile["picture"],
+            emailVerified: !!profile["email_verified"]
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/twitter.rb

@@ -5,7 +5,8 @@ module BetterAuth
     module_function
 
     def twitter(client_id:, client_secret:, scopes: ["users.read", "tweet.read", "offline.access", "users.email"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      provider = Base.oauth_provider(
         id: "twitter",
         name: "Twitter",
         client_id: client_id,
@@ -15,6 +16,7 @@ module BetterAuth
         user_info_endpoint: "https://api.x.com/2/users/me?user.fields=profile_image_url,verified",
         scopes: scopes,
         pkce: true,
+        token_authentication: :basic,
         profile_map: ->(profile) {
           data = profile["data"] || profile
           {
@@ -27,6 +29,39 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        profile = Base.get_json(
+          "https://api.x.com/2/users/me?user.fields=profile_image_url",
+          "Authorization" => "Bearer #{Base.access_token(tokens)}"
+        )
+        next nil unless profile
+
+        email_data = Base.get_json(
+          "https://api.x.com/2/users/me?user.fields=confirmed_email",
+          "Authorization" => "Bearer #{Base.access_token(tokens)}"
+        )
+        data = profile["data"] || profile
+        confirmed_email = email_data&.dig("data", "confirmed_email")
+        data["email"] = confirmed_email if confirmed_email
+        data["confirmed_email"] = true if confirmed_email
+
+        user = Base.apply_profile_mapping(
+          {
+            id: data["id"],
+            name: data["name"],
+            email: data["email"] || data["username"],
+            image: data["profile_image_url"],
+            emailVerified: !!data["confirmed_email"]
+          },
+          profile,
+          normalized
+        )
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/vk.rb

@@ -5,7 +5,8 @@ module BetterAuth
     module_function
 
     def vk(client_id:, client_secret:, scopes: ["email", "phone"], **options)
-      Base.oauth_provider(
+      normalized = Base.normalize_options(options)
+      provider = Base.oauth_provider(
         id: "vk",
         name: "VK",
         client_id: client_id,
@@ -29,6 +30,38 @@ module BetterAuth
         },
         **options
       )
+      provider[:get_user_info] = lambda do |tokens|
+        custom = normalized[:get_user_info]
+        next custom.call(tokens) if custom
+
+        access_token = Base.access_token(tokens)
+        next nil unless access_token
+
+        profile = Base.post_json(
+          "https://id.vk.com/oauth2/user_info",
+          {access_token: access_token, client_id: client_id},
+          "Content-Type" => "application/x-www-form-urlencoded"
+        )
+        next nil unless profile
+
+        user_profile = profile["user"] || profile
+        user_map = normalized[:map_profile_to_user]&.call(profile) || {}
+        next nil if user_profile["email"].to_s.empty? && user_map[:email].to_s.empty? && user_map["email"].to_s.empty?
+
+        user = {
+          id: user_profile["user_id"],
+          first_name: user_profile["first_name"],
+          last_name: user_profile["last_name"],
+          name: [user_profile["first_name"], user_profile["last_name"]].compact.join(" "),
+          email: user_profile["email"],
+          image: user_profile["avatar"],
+          emailVerified: false,
+          birthday: user_profile["birthday"],
+          sex: user_profile["sex"]
+        }.merge(user_map)
+        {user: user, data: profile}
+      end
+      provider
     end
   end
 end

data/lib/better_auth/social_providers/wechat.rb

@@ -17,10 +17,11 @@ module BetterAuth
         scopes: scopes,
         scope_separator: ",",
         profile_map: ->(profile) {
+          id = profile["unionid"] || profile["openid"]
           {
-            id: profile["unionid"] || profile["openid"],
+            id: id,
             name: profile["nickname"],
-            email: profile["email"],
+            email: profile["email"] || "#{id}@wechat.invalid",
             image: profile["headimgurl"],
             emailVerified: false
           }
@@ -85,11 +86,12 @@ module BetterAuth
         profile = Base.get_json(url)
         next nil if !profile || profile["errcode"]
 
+        id = profile["unionid"] || profile["openid"] || openid
         user = Base.apply_profile_mapping(
           {
-            id: profile["unionid"] || profile["openid"] || openid,
+            id: id,
             name: profile["nickname"],
-            email: profile["email"],
+            email: profile["email"] || "#{id}@wechat.invalid",
             image: profile["headimgurl"],
             emailVerified: false
           },