better_auth 0.8.0 → 0.11.0

data/lib/better_auth/configuration.rb

@@ -31,7 +31,7 @@ module BetterAuth
     }.freeze
 
     attr_reader :app_name,
-      :base_url_config,
+      :base_url,
       :base_path,
       :context_base_url,
       :secret,
@@ -39,6 +39,7 @@ module BetterAuth
       :database,
       :plugins,
       :trusted_origins,
+      :serving_origins,
       :rate_limit,
       :session,
       :account,
@@ -48,6 +49,7 @@ module BetterAuth
       :email_and_password,
       :password_hasher,
       :email_verification,
+      :configured_social_provider_ids,
       :social_providers,
       :experimental,
       :secondary_storage,
@@ -60,6 +62,7 @@ module BetterAuth
       :logger
 
     def initialize(options = {})
+      @configured_social_provider_ids = extract_configured_social_provider_ids(options)
       options = symbolize_keys(options)
       @explicit_options = deep_dup(options)
 
@@ -75,7 +78,7 @@ module BetterAuth
       @hooks = options[:hooks]
       @on_api_error = symbolize_keys(options[:on_api_error] || options[:on_apierror] || {})
       @telemetry = symbolize_keys(options[:telemetry] || {})
-      @social_providers = symbolize_keys(options[:social_providers] || {})
+      @social_providers = normalize_social_providers(options[:social_providers])
       @trusted_origins_callbacks = []
       @trusted_origins_callbacks << options[:trusted_origins] if options[:trusted_origins].respond_to?(:call)
       @trusted_origins_callback = combined_trusted_origins_callback
@@ -88,8 +91,8 @@ module BetterAuth
         @secret = legacy_secret || (test_environment? ? DEFAULT_SECRET : nil)
         @secret_config = @secret
       end
-      @base_url_config = options[:base_url]
       @base_url, @context_base_url = normalize_base_url(options[:base_url])
+      @serving_origins = normalize_serving_origins(options[:serving_origins])
       @session = normalize_session(options[:session])
       @account = normalize_account(options[:account])
       @user = symbolize_keys(options[:user] || {})
@@ -110,26 +113,17 @@ module BetterAuth
       end
     end
 
-    def base_url
-      Thread.current[base_url_runtime_key] || @base_url
-    end
-
-    def set_runtime_base_url(value)
-      Thread.current[base_url_runtime_key] = value
-    end
-
-    def clear_runtime_base_url!
-      Thread.current[base_url_runtime_key] = nil
+    def explicit_trusted_origins
+      configured = @explicit_options[:trusted_origins]
+      origins = configured.respond_to?(:call) ? [] : Array(configured).compact
+      origins.concat(env_trusted_origins)
+      origins.map(&:to_s).reject(&:empty?).uniq
     end
 
     def production?
       production_environment?
     end
 
-    def dynamic_base_url?
-      URLHelpers.dynamic_config?(base_url_config)
-    end
-
     def to_h
       {
         app_name: app_name,
@@ -140,6 +134,7 @@ module BetterAuth
         database: database,
         plugins: plugins,
         trusted_origins: trusted_origins,
+        serving_origins: serving_origins,
         rate_limit: rate_limit,
         session: session,
         account: account,
@@ -164,7 +159,7 @@ module BetterAuth
       normalized = symbolize_keys(defaults || {})
       normalized.each do |key, value|
         next unless respond_to?(key)
-        next if key == :database_hooks
+        next if key == :database_hooks || key == :configured_social_provider_ids
 
         if key == :trusted_origins
           merge_trusted_origins_default(value)
@@ -231,15 +226,12 @@ module BetterAuth
 
     def normalize_base_url(value)
       configured = value || env_base_url
-      return ["", ""] unless configured && !configured.empty?
-
-      if URLHelpers.dynamic_config?(configured)
-        validate_dynamic_base_url!(configured)
-        resolved = URLHelpers.resolve_base_url(configured, base_path)
-        return ["", ""] unless resolved
+      if configured.nil? || configured.to_s.empty?
+        raise Error, "base_url is required. Pass a canonical URL to BetterAuth.auth(base_url: ...) or set BETTER_AUTH_URL."
+      end
 
-        uri = URI.parse(resolved)
-        return [self.class.origin_for(uri), resolved.sub(%r{/+\z}, "")]
+      if configured.is_a?(Hash)
+        raise Error, "Dynamic base_url hashes are no longer supported. Configure a canonical base_url and list request-facing origins in serving_origins."
       end
 
       with_path = append_base_path(configured.to_s)
@@ -250,11 +242,6 @@ module BetterAuth
       raise Error, "Invalid base URL: #{configured}. Please provide a valid base URL."
     end
 
-    def validate_dynamic_base_url!(value)
-      allowed_hosts = value[:allowed_hosts] || value["allowed_hosts"] || value[:allowedHosts] || value["allowedHosts"]
-      raise Error, "baseURL.allowedHosts cannot be empty" if allowed_hosts.respond_to?(:empty?) && allowed_hosts.empty?
-    end
-
     def normalize_base_path(value)
       return "" if value.nil? || value == "" || value == "/"
 
@@ -368,27 +355,45 @@ module BetterAuth
     end
 
     def normalize_plugins(value)
-      Array(value).compact.reject { |plugin| plugin == false }.map { |plugin| Plugin.coerce(plugin) }
+      Array(value).compact.reject { |plugin| plugin == false }.map do |plugin|
+        coerced = Plugin.coerce(plugin)
+        Plugins.ensure_plugin_loaded_for!(coerced)
+        coerced
+      end
+    end
+
+    def normalize_social_providers(value)
+      symbolize_keys(value || {}).reject do |_id, provider|
+        provider.nil? || provider == false || (provider.is_a?(Hash) && provider[:enabled] == false)
+      end
+    end
+
+    def extract_configured_social_provider_ids(options)
+      return [].freeze unless options.is_a?(Hash)
+
+      options.each_with_object([]) do |(key, providers), ids|
+        next unless normalize_key(key) == :social_providers && providers.is_a?(Hash)
+
+        ids.concat(providers.keys.map { |provider_id| provider_id.to_s.dup.freeze })
+      end.uniq.freeze
     end
 
     def normalize_trusted_origins(value)
-      origins = []
-      origins << base_url unless base_url.nil? || base_url.empty?
-      origins.concat(dynamic_base_url_trusted_origins)
+      origins = serving_origins.dup
       origins.concat(Array(value).compact) unless value.respond_to?(:call)
       origins.concat(env_trusted_origins)
       origins.map(&:to_s).reject(&:empty?).uniq
     end
 
-    def dynamic_base_url_trusted_origins
-      return [] unless URLHelpers.dynamic_config?(base_url_config)
+    def normalize_serving_origins(value)
+      ([base_url] + Array(value).compact).map do |origin|
+        normalized = origin.to_s.sub(%r{/+\z}, "")
+        unless normalized.match?(%r{\Ahttps?://[^/?#@]+\z}i)
+          raise Error, "Invalid serving origin: #{origin}. serving_origins entries must be full http(s) origins without a path."
+        end
 
-      protocol = base_url_config[:protocol] || base_url_config["protocol"] || "https"
-      allowed_hosts = base_url_config[:allowed_hosts] || base_url_config["allowed_hosts"] || base_url_config[:allowedHosts] || base_url_config["allowedHosts"] || []
-      Array(allowed_hosts).map do |host|
-        host = host.to_s
-        host.match?(%r{\Ahttps?://}i) ? host : "#{protocol}://#{host}"
-      end
+        normalized
+      end.uniq
     end
 
     def merge_trusted_origins_default(value)
@@ -473,10 +478,6 @@ module BetterAuth
       end
     end
 
-    def base_url_runtime_key
-      :"better_auth_configuration_base_url_#{object_id}"
-    end
-
     def test_environment?
       ENV["RACK_ENV"] == "test" || ENV["RAILS_ENV"] == "test" || ENV["APP_ENV"] == "test"
     end

data/lib/better_auth/context.rb

@@ -18,7 +18,8 @@ module BetterAuth
 
     def initialize(configuration)
       @app_name = configuration.app_name
-      @base_url = configuration.context_base_url
+      @canonical_base_url = configuration.context_base_url
+      @base_url = @canonical_base_url
       @version = BetterAuth::VERSION
       @options = configuration
       @social_providers = configuration.social_providers
@@ -30,6 +31,7 @@ module BetterAuth
       @session_config = configuration.session
       @rate_limit_config = configuration.rate_limit
       @trusted_origins = configuration.trusted_origins
+      @explicit_trusted_origins = configuration.explicit_trusted_origins
       @secret = configuration.secret
       @secret_config = configuration.secret_config
       @current_session = nil
@@ -46,10 +48,20 @@ module BetterAuth
       runtime_fetch(:base_url, @base_url)
     end
 
+    def token_link_base_url
+      base_url
+    end
+
+    attr_reader :canonical_base_url
+
     def trusted_origins
       runtime_fetch(:trusted_origins, @trusted_origins)
     end
 
+    def explicit_trusted_origins
+      runtime_fetch(:explicit_trusted_origins, @explicit_trusted_origins)
+    end
+
     def auth_cookies
       runtime_fetch(:auth_cookies, @auth_cookies)
     end
@@ -131,6 +143,7 @@ module BetterAuth
       @session_config = options.session
       @rate_limit_config = options.rate_limit
       @trusted_origins = options.trusted_origins
+      @explicit_trusted_origins = options.explicit_trusted_origins
       @secret = options.secret
       @secret_config = options.secret_config
     end
@@ -150,12 +163,7 @@ module BetterAuth
       runtime = request_runtime
       runtime[:current_session] = nil
       runtime[:new_session] = nil
-      if options.dynamic_base_url?
-        runtime[:base_url] = resolved_dynamic_base_url(request)
-        refresh_cookies!
-      elsif options.base_url.to_s.empty?
-        runtime[:base_url] = inferred_base_url(request)
-      end
+      runtime[:base_url] = serving_base_url(request)
       runtime[:trusted_origins] = current_trusted_origins(request)
     end
 
@@ -163,61 +171,30 @@ module BetterAuth
       runtime = request_runtime
       runtime[:current_session] = nil
       runtime[:new_session] = nil
-      if options.dynamic_base_url?
-        runtime[:base_url] = resolved_dynamic_base_url(source)
-        refresh_cookies!
-      end
+      runtime[:base_url] = serving_base_url(source)
       runtime[:trusted_origins] = current_trusted_origins(request_for_callbacks(source))
     end
 
     def reset_runtime!
       Thread.current[runtime_key] = nil if request_runtime?
-      options.clear_runtime_base_url! if options.respond_to?(:clear_runtime_base_url!)
       @current_session = nil
       @new_session = nil
     end
 
     def clear_runtime!
       Thread.current[runtime_key] = nil
-      options.clear_runtime_base_url! if options.respond_to?(:clear_runtime_base_url!)
-    end
-
-    def refresh_cookies!
-      cookies = Cookies.get_cookies(options)
-      if request_runtime?
-        runtime_store(:auth_cookies, cookies)
-        runtime_store(:cookies, cookies)
-      else
-        @auth_cookies = cookies
-        @cookies = cookies
-      end
     end
 
     private
 
-    def inferred_base_url(request)
-      origin = inferred_origin(request)
-      path = options.base_path
-      path.empty? ? origin : "#{origin}#{path}"
-    end
-
-    def resolved_dynamic_base_url(request)
-      resolved = URLHelpers.resolve_base_url(
-        options.base_url_config,
-        options.base_path,
-        request,
-        load_env: true,
-        trusted_proxy_headers: dynamic_trusted_proxy_headers?
-      )
-      origin = Configuration.origin_for(URI.parse(resolved))
-      options.set_runtime_base_url(origin) if options.respond_to?(:set_runtime_base_url)
-      resolved
-    end
-
-    def dynamic_trusted_proxy_headers?
-      return true unless options.advanced.key?(:trusted_proxy_headers)
+    def serving_base_url(source)
+      candidate = inferred_origin(source)
+      return canonical_base_url unless candidate
+      return canonical_base_url if candidate == options.base_url
+      return canonical_base_url unless options.serving_origins.any? { |pattern| Configuration.matches_origin_pattern?(candidate, pattern) }
 
-      !!options.advanced[:trusted_proxy_headers]
+      path = options.base_path
+      path.empty? ? candidate : "#{candidate}#{path}"
     end
 
     def request_for_callbacks(source)
@@ -230,6 +207,7 @@ module BetterAuth
       Thread.current[runtime_key] ||= {
         base_url: @base_url,
         trusted_origins: @trusted_origins,
+        explicit_trusted_origins: @explicit_trusted_origins,
         auth_cookies: @auth_cookies,
         cookies: @cookies,
         current_session: nil,
@@ -256,26 +234,25 @@ module BetterAuth
       :"better_auth_context_runtime_#{object_id}"
     end
 
-    def inferred_origin(request)
-      forwarded_host = request.get_header("HTTP_X_FORWARDED_HOST")
-      forwarded_proto = request.get_header("HTTP_X_FORWARDED_PROTO")
-      if options.advanced[:trusted_proxy_headers] && valid_forwarded?(forwarded_host, forwarded_proto)
+    def inferred_origin(source)
+      return nil unless source
+
+      trusted_proxy_headers = options.advanced[:trusted_proxy_headers] == true
+      forwarded_host = URLHelpers.header_value(URLHelpers.headers_from_source(source), "x-forwarded-host")
+      if trusted_proxy_headers && forwarded_host
+        forwarded_proto = URLHelpers.header_value(URLHelpers.headers_from_source(source), "x-forwarded-proto")
+        return nil unless valid_proxy_host?(forwarded_host.to_s) && valid_proxy_proto?(forwarded_proto.to_s)
+
         return "#{forwarded_proto}://#{forwarded_host}"
       end
 
-      scheme = request.get_header("rack.url_scheme") || request.scheme
-      scheme = "https" unless valid_proxy_proto?(scheme.to_s)
-      host_header = request.get_header("HTTP_HOST")
-      return "#{scheme}://#{host_header}" if host_header && valid_proxy_host?(host_header.to_s)
+      host = URLHelpers.host_from_source(source, trusted_proxy_headers: false)
+      return nil unless host && valid_proxy_host?(host)
 
-      host = request.get_header("SERVER_NAME") || request.host
-      port = (request.get_header("SERVER_PORT") || request.port).to_i
-      default_port = (scheme == "http" && port == 80) || (scheme == "https" && port == 443)
-      default_port ? "#{scheme}://#{host}" : "#{scheme}://#{host}:#{port}"
-    end
+      protocol = URLHelpers.protocol_from_source(source, trusted_proxy_headers: false)
+      return nil unless valid_proxy_proto?(protocol)
 
-    def valid_forwarded?(host, proto)
-      valid_proxy_proto?(proto.to_s) && valid_proxy_host?(host.to_s)
+      "#{protocol}://#{host}"
     end
 
     def valid_proxy_proto?(proto)
@@ -315,16 +292,15 @@ module BetterAuth
     end
 
     def current_trusted_origins(request)
-      origins = []
-      origins << Configuration.origin_for(URI.parse(base_url)) unless base_url.to_s.empty?
-      origins.concat(options.trusted_origins)
+      origins = options.trusted_origins.dup
+      dynamic_origins = []
       if options.trusted_origins_callback
-        origins.concat(Array(options.trusted_origins_callback.call(request)).compact)
+        dynamic_origins.concat(Array(options.trusted_origins_callback.call(request)).compact)
       end
+      origins.concat(dynamic_origins)
       origins.concat(Env.csv("BETTER_AUTH_TRUSTED_ORIGINS"))
+      runtime_store(:explicit_trusted_origins, (options.explicit_trusted_origins + dynamic_origins.map(&:to_s)).uniq)
       origins.map(&:to_s).reject(&:empty?).uniq
-    rescue URI::InvalidURIError
-      options.trusted_origins
     end
 
     def normalize_context(value)

data/lib/better_auth/cookies.rb

@@ -8,8 +8,10 @@ module BetterAuth
   module Cookies
     SECURE_COOKIE_PREFIX = "__Secure-"
     HOST_COOKIE_PREFIX = "__Host-"
+    COOKIE_NAME_PATTERN = /\A[\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E\x5F\x60\x61-\x7A\x7C\x7E]+\z/
+    COOKIE_VALUE_PATTERN = /\A[\x20\x21\x23-\x3A\x3C-\x5B\x5D-\x7E]*\z/
 
-    Cookie = Struct.new(:name, :attributes, keyword_init: true) do
+    Cookie = Struct.new(:name, :attributes) do
       alias_method :options, :attributes
     end
 
@@ -40,8 +42,6 @@ module BetterAuth
           uri.host unless uri.host.to_s.empty?
         end
       end
-      raise Error, "base_url is required when cross_subdomain_cookies are enabled" if cross_subdomain && domain.to_s.empty? && !options.dynamic_base_url?
-
       custom = advanced.dig(:cookies, cookie_name.to_sym) || {}
       prefix = advanced[:cookie_prefix] || "better-auth"
       name = custom[:name] || "#{prefix}.#{cookie_name}"
@@ -63,14 +63,51 @@ module BetterAuth
     end
 
     def parse_cookies(cookie_header)
-      cookie_header.to_s.split(/;\s*/).each_with_object({}) do |pair, result|
-        name, value = pair.split("=", 2)
-        next if name.to_s.empty? || value.nil?
+      header = cookie_header.to_s
+      return {} if header.length < 2
+
+      header.split(";", -1).each_with_object({}) do |pair, result|
+        separator = pair.index("=")
+        next unless separator
+
+        name = trim_cookie_ows(pair[0...separator])
+        value = unquote_cookie_value(trim_cookie_ows(pair[(separator + 1)..]))
+        next unless COOKIE_NAME_PATTERN.match?(name) && COOKIE_VALUE_PATTERN.match?(value)
 
-        result[name.strip] = value.strip
+        result[name] = decode_cookie_value(value)
       end
     end
 
+    def split_set_cookie_header(header)
+      Array(header).flat_map do |value|
+        value.to_s.lines(chomp: true).flat_map do |line|
+          line.split(/,(?=[ \t]*[!#$%&'*+\-.^_`|~0-9A-Za-z]+=)/).map(&:strip)
+        end
+      end.reject(&:empty?)
+    end
+
+    def parse_set_cookie(line)
+      first, *attributes = line.to_s.split(";").map(&:strip)
+      name, value = first.split("=", 2)
+      return unless name && value
+
+      {
+        name: name,
+        value: value,
+        attributes: attributes.each_with_object({}) do |attribute, result|
+          key, attribute_value = attribute.split("=", 2)
+          result[key.to_s.downcase] = attribute_value || true unless key.to_s.empty?
+        end
+      }
+    end
+
+    def set_request_cookie(cookie_header, name, value)
+      cookies = parse_cookies(cookie_header)
+      cookie_name = name.to_s
+      cookies[cookie_name] = value.to_s if COOKIE_NAME_PATTERN.match?(cookie_name)
+      cookies.map { |key, semantic_value| "#{key}=#{encode_cookie_value(semantic_value)}" }.join("; ")
+    end
+
     def strip_secure_cookie_prefix(name)
       name.to_s.delete_prefix(SECURE_COOKIE_PREFIX).delete_prefix(HOST_COOKIE_PREFIX)
     end
@@ -83,10 +120,10 @@ module BetterAuth
       cookie_name = config[:cookie_name] || "session_token"
       cookie_prefix = config[:cookie_prefix] || "better-auth"
       candidates = [
-        "#{cookie_prefix}.#{cookie_name}",
         "#{SECURE_COOKIE_PREFIX}#{cookie_prefix}.#{cookie_name}",
-        "#{cookie_prefix}-#{cookie_name}",
-        "#{SECURE_COOKIE_PREFIX}#{cookie_prefix}-#{cookie_name}"
+        "#{cookie_prefix}.#{cookie_name}",
+        "#{SECURE_COOKIE_PREFIX}#{cookie_prefix}-#{cookie_name}",
+        "#{cookie_prefix}-#{cookie_name}"
       ]
       candidates.lazy.filter_map { |candidate| parsed[candidate] }.first
     end
@@ -101,16 +138,23 @@ module BetterAuth
         ctx.set_signed_cookie(dont_remember_cookie.name, "true", ctx.context.secret, dont_remember_cookie.attributes)
       end
 
-      set_cookie_cache(ctx, session, dont_remember_me)
+      set_cookie_cache(ctx, session, dont_remember_me, max_age: overrides&.fetch(:max_age, nil))
       ctx.context.set_new_session(session) if ctx.context.respond_to?(:set_new_session)
     end
 
-    def set_cookie_cache(ctx, session, dont_remember_me)
+    def set_cookie_cache(ctx, session, dont_remember_me, max_age: nil)
       config = ctx.context.session_config[:cookie_cache] || {}
       return unless config[:enabled]
 
       cookie = ctx.context.auth_cookies[:session_data]
-      max_age = dont_remember_me ? nil : cookie.attributes[:max_age]
+      configured_max_age = cookie.attributes[:max_age]
+      max_age = if dont_remember_me
+        nil
+      elsif max_age
+        [configured_max_age, max_age].compact.map(&:to_i).min
+      else
+        configured_max_age
+      end
       data = filtered_cache_data(ctx, session)
       strategy = config[:strategy] || "compact"
       secret = (strategy.to_s == "jwe") ? ctx.context.secret_config : ctx.context.secret
@@ -150,12 +194,14 @@ module BetterAuth
       Crypto.symmetric_decode_jwt(value, ctx.context.secret_config, "better-auth-account")
     end
 
-    def get_cookie_cache(request_or_cookie_header, secret:, strategy: "compact", version: nil, cookie_prefix: "better-auth", cookie_name: "session_data", is_secure: nil)
+    def get_cookie_cache(request_or_cookie_header, secret:, strategy: "compact", version: nil, cookie_prefix: "better-auth", cookie_name: "session_data", is_secure: nil, cookie_full_name: nil)
       cookie_header = header_value(request_or_cookie_header)
       return nil if cookie_header.to_s.empty?
 
       parsed = parse_cookies(cookie_header)
-      name = if is_secure.nil?
+      name = if cookie_full_name
+        cookie_full_name
+      elsif is_secure.nil?
         production_environment? ? "#{SECURE_COOKIE_PREFIX}#{cookie_prefix}.#{cookie_name}" : "#{cookie_prefix}.#{cookie_name}"
       else
         secure_prefix = is_secure ? SECURE_COOKIE_PREFIX : ""
@@ -166,6 +212,7 @@ module BetterAuth
 
       payload = decode_cookie_cache(raw, secret, strategy: strategy)
       return nil unless payload && payload["session"] && payload["user"]
+      return nil if embedded_session_expired?(payload["session"])
 
       expected_version = cookie_cache_version(version, payload["session"], payload["user"])
       return nil if version && (payload["version"] || "1") != expected_version
@@ -174,6 +221,7 @@ module BetterAuth
     end
 
     def expire_cookie(ctx, cookie)
+      remove_set_cookie_entries(ctx, cookie.name)
       ctx.set_cookie(cookie.name, "", cookie.attributes.merge(max_age: 0))
     end
 
@@ -182,6 +230,11 @@ module BetterAuth
       expire_cookie(ctx, ctx.context.auth_cookies[:session_data])
       expire_cookie(ctx, ctx.context.auth_cookies[:account_data]) if ctx.context.options.account[:store_account_cookie]
 
+      if ctx.context.options.account[:store_account_cookie]
+        account_store = SessionStore.new(ctx.context.auth_cookies[:account_data].name, ctx.context.auth_cookies[:account_data].attributes, ctx)
+        account_store.set_cookies(account_store.clean)
+      end
+
       store = SessionStore.new(ctx.context.auth_cookies[:session_data].name, ctx.context.auth_cookies[:session_data].attributes, ctx)
       store.set_cookies(store.clean)
       expire_cookie(ctx, ctx.context.auth_cookies[:dont_remember]) unless skip_dont_remember_me
@@ -248,6 +301,57 @@ module BetterAuth
       chunks.sort_by(&:first).map(&:last).join
     end
 
+    def embedded_session_expired?(session)
+      expires_at = session["expiresAt"] || session[:expiresAt] || session["expires_at"] || session[:expires_at]
+      normalized = Session.normalize_time(expires_at)
+      normalized && normalized <= Time.now
+    rescue ArgumentError
+      true
+    end
+
+    def remove_set_cookie_entries(ctx, cookie_name)
+      header = ctx.response_headers["set-cookie"]
+      return unless header
+
+      exact = "#{cookie_name}="
+      chunk = "#{cookie_name}."
+      survivors = header.to_s.lines(chomp: true).reject do |entry|
+        entry.start_with?(exact, chunk)
+      end
+      if survivors.empty?
+        ctx.response_headers.delete("set-cookie")
+      else
+        ctx.response_headers["set-cookie"] = survivors.join("\n")
+      end
+    end
+
+    def decode_cookie_value(value)
+      decoded = URI.decode_uri_component(value)
+      decoded.valid_encoding? ? decoded : value
+    rescue ArgumentError
+      value
+    end
+
+    def trim_cookie_ows(value)
+      value.sub(/\A[ \t]*/, "").sub(/[ \t]*\z/, "")
+    end
+
+    def unquote_cookie_value(value)
+      return value unless value.length >= 2 && value.start_with?("\"") && value.end_with?("\"")
+
+      value[1...-1]
+    end
+
+    def encode_cookie_value(value)
+      value.to_s.encode(Encoding::UTF_8).bytes.map do |byte|
+        if byte.between?(48, 57) || byte.between?(65, 90) || byte.between?(97, 122) || [33, 39, 40, 41, 42, 45, 46, 95, 126].include?(byte)
+          byte.chr
+        else
+          "%#{byte.to_s(16).upcase.rjust(2, "0")}"
+        end
+      end.join
+    end
+
     def header_value(request_or_cookie_header)
       return request_or_cookie_header.headers["cookie"] if request_or_cookie_header.respond_to?(:headers)
       return request_or_cookie_header.get_header("HTTP_COOKIE") if request_or_cookie_header.respond_to?(:get_header)

data/lib/better_auth/core.rb

@@ -32,9 +32,7 @@ module BetterAuth
         delete_user: Routes.delete_user,
         delete_user_callback: Routes.delete_user_callback,
         list_accounts: Routes.list_accounts,
-        list_user_accounts: Routes.list_accounts,
         link_social: Routes.link_social,
-        link_social_account: Routes.link_social,
         unlink_account: Routes.unlink_account,
         get_access_token: Routes.get_access_token,
         refresh_token: Routes.refresh_token,

data/lib/better_auth/crypto.rb

@@ -9,7 +9,8 @@ require_relative "crypto/jwe"
 
 module BetterAuth
   module Crypto
-    URL_SAFE_ALPHABET = [*"a".."z", *"A".."Z", *"0".."9", "-", "_"].freeze
+    ALPHABETIC_ALPHABET = [*"a".."z", *"A".."Z"].freeze
+    URL_SAFE_ALPHABET = [*ALPHABETIC_ALPHABET, *"0".."9", "-", "_"].freeze
     MASK_64 = (1 << 64) - 1
     KECCAK_ROUND_CONSTANTS = [
       0x0000000000000001, 0x0000000000008082, 0x800000000000808a, 0x8000000080008000,
@@ -29,8 +30,8 @@ module BetterAuth
 
     module_function
 
-    def random_string(length = 32)
-      Array.new(length) { URL_SAFE_ALPHABET[SecureRandom.random_number(URL_SAFE_ALPHABET.length)] }.join
+    def random_string(length = 32, alphabet: URL_SAFE_ALPHABET)
+      Array.new(length) { alphabet[SecureRandom.random_number(alphabet.length)] }.join
     end
 
     def uuid