better_auth 0.8.0 → 0.11.0

data/lib/better_auth/doctor.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+require "better_auth/sql_migration"
+
+module BetterAuth
+  module Doctor
+    Result = Struct.new(:ok, :warnings, :errors) do
+      def success?
+        errors.empty?
+      end
+    end
+
+    module_function
+
+    def check(config_or_options)
+      config = BetterAuth::SQLMigration.configuration_for(config_or_options)
+      result = Result.new(ok: ["config loaded"], warnings: [], errors: [])
+
+      check_secret(config, result)
+      check_base_url(config, result)
+      check_rate_limit(config, result)
+      check_database(config, result)
+
+      result
+    end
+
+    def print(result, stdout:, stderr:)
+      result.ok.each { |message| stdout.puts "OK #{message}" }
+      result.warnings.each { |message| stdout.puts "WARN #{message}" }
+      result.errors.each { |message| stderr.puts "ERROR #{message}" }
+      result.success? ? 0 : 1
+    end
+
+    def as_json(result)
+      {
+        "ok" => result.ok,
+        "warnings" => result.warnings,
+        "errors" => result.errors,
+        "success" => result.success?
+      }
+    end
+
+    def check_secret(config, result)
+      secret = config.secret.to_s
+      if secret.empty?
+        result.errors << "secret is missing"
+      elsif secret == BetterAuth::Configuration::DEFAULT_SECRET
+        result.errors << "secret uses the default development value"
+      elsif secret.length < 32
+        result.errors << "secret should be at least 32 characters"
+      elsif entropy(secret) < 120
+        result.errors << "secret appears low-entropy; use a random production secret"
+      else
+        result.ok << "secret length and entropy look acceptable"
+      end
+    end
+
+    def check_base_url(config, result)
+      base_url = config.base_url.to_s
+      if base_url.empty?
+        result.errors << "base_url is not configured"
+      elsif !base_url.start_with?("https://")
+        result.warnings << "base_url is not HTTPS"
+      else
+        result.ok << "base_url uses HTTPS"
+      end
+    end
+
+    def check_rate_limit(config, result)
+      rate_limit = config.rate_limit || {}
+      result.warnings << "rate_limit is disabled" unless rate_limit[:enabled]
+      if rate_limit[:storage].to_s == "memory"
+        result.warnings << "rate_limit uses memory storage; use database or secondary-storage for multi-process production deployments"
+      else
+        result.ok << "rate_limit storage is #{rate_limit[:storage]}"
+      end
+    end
+
+    def check_database(config, result)
+      auth = BetterAuth.auth(config.to_h)
+      adapter = auth.context.adapter
+      unless adapter.respond_to?(:dialect) && adapter.respond_to?(:connection)
+        warning = "database adapter does not expose SQL migration introspection; schema drift check skipped"
+        warning += "; run `better-auth mongo indexes` to ensure MongoDB indexes" if adapter.respond_to?(:ensure_indexes!)
+        result.warnings << warning
+        return
+      end
+
+      result.ok << "database adapter supports SQL migrations"
+      plan = BetterAuth::SQLMigration.plan(config, connection: adapter.connection, dialect: adapter.dialect)
+      if plan.empty?
+        result.ok << "database schema is up to date"
+      else
+        result.warnings << "database has pending Better Auth migrations"
+        plan.warnings.each { |warning| result.warnings << warning }
+      end
+    rescue BetterAuth::SQLMigration::UnsupportedAdapterError => error
+      result.warnings << error.message
+    end
+
+    def entropy(value)
+      unique = value.chars.uniq.length
+      return 0 if unique.zero?
+
+      Math.log2(unique**value.length)
+    end
+  end
+end

data/lib/better_auth/endpoint.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "uri"
 
 module BetterAuth
   class Endpoint
@@ -24,6 +25,7 @@ module BetterAuth
       @headers_schema = headers_schema
       @metadata = metadata || {}
       apply_default_open_api_metadata!
+      apply_open_api_defaults!
       apply_open_api_schemas!
       @options = endpoint_options
       @use = Array(use)
@@ -40,13 +42,12 @@ module BetterAuth
     end
 
     def call(context)
-      apply_schemas!(context)
-
       use.each do |middleware|
         middleware_result = middleware.call(context)
         return Result.from_value(middleware_result, context) if middleware_result
       end
 
+      apply_schemas!(context)
       Result.from_value(handler.call(context), context)
     end
 
@@ -72,6 +73,41 @@ module BetterAuth
       metadata[:openapi] = BetterAuth::OpenAPI.default_metadata(path, methods)
     end
 
+    def apply_open_api_defaults!
+      return unless path
+      return unless defined?(BetterAuth::OpenAPI)
+
+      openapi = fetch_key(metadata, :openapi)
+      return unless openapi.is_a?(Hash)
+
+      defaults = BetterAuth::OpenAPI.default_metadata(path, methods)
+      openapi[:operationId] = defaults[:operationId] if fetch_key(openapi, :operationId).to_s.empty?
+      openapi[:description] = defaults[:description] if default_open_api_description?(fetch_key(openapi, :description))
+      openapi[:parameters] = merge_open_api_parameters(defaults[:parameters], fetch_key(openapi, :parameters))
+      openapi[:responses] = defaults[:responses].merge(fetch_key(openapi, :responses) || {})
+      if request_body_method? && !fetch_key(openapi, :requestBody).is_a?(Hash)
+        openapi[:requestBody] = defaults[:requestBody] || BetterAuth::OpenAPI.default_request_body
+      end
+    end
+
+    def default_open_api_description?(description)
+      methods.any? { |method| description.to_s == "#{method} #{path}" }
+    end
+
+    def request_body_method?
+      methods.any? { |method| %w[POST PUT PATCH].include?(method) }
+    end
+
+    def merge_open_api_parameters(default_parameters, custom_parameters)
+      merged = Array(custom_parameters).dup
+      Array(default_parameters).each do |parameter|
+        next if merged.any? { |entry| fetch_key(entry, :name).to_s == fetch_key(parameter, :name).to_s && fetch_key(entry, :in).to_s == fetch_key(parameter, :in).to_s }
+
+        merged << parameter
+      end
+      merged
+    end
+
     def apply_open_api_schemas!
       openapi = fetch_key(metadata, :openapi)
       return unless openapi.is_a?(Hash)
@@ -172,6 +208,42 @@ module BetterAuth
     class Result
       attr_accessor :response, :status, :headers
 
+      class SetCookieHeader < Array
+        def self.from(value)
+          new(value.lines.map(&:chomp))
+        end
+
+        def include?(value)
+          return super unless value.is_a?(String)
+
+          any? { |line| line.include?(value) }
+        end
+
+        def lines
+          self
+        end
+
+        def match(...)
+          to_s.match(...)
+        end
+
+        def =~(pattern)
+          to_s =~ pattern
+        end
+
+        def split(...)
+          to_s.split(...)
+        end
+
+        def to_s
+          join("\n")
+        end
+
+        def to_str
+          to_s
+        end
+      end
+
       def initialize(response:, status: 200, headers: {}, raw_response: nil)
         @response = response
         @status = status
@@ -223,7 +295,7 @@ module BetterAuth
       end
 
       def to_response
-        return Response.from_rack(@raw_response) if raw_response?
+        return Response.from_rack([@raw_response[0], rack_headers(@raw_response[1]), @raw_response[2]]) if raw_response?
 
         body = if response.nil?
           [JSON.generate(nil)]
@@ -232,12 +304,23 @@ module BetterAuth
         else
           [JSON.generate(response)]
         end
-        response_headers = {"content-type" => "application/json"}.merge(headers)
+        response_headers = rack_headers({"content-type" => "application/json"}.merge(headers))
         Response.new(status: status, headers: response_headers, body: body)
       end
 
       private
 
+      def rack_headers(value)
+        value.each_with_object({}) do |(key, header_value), result|
+          normalized = key.to_s.downcase
+          result[normalized] = if normalized == "set-cookie" && header_value.is_a?(String) && header_value.include?("\n")
+            SetCookieHeader.from(header_value)
+          else
+            header_value
+          end
+        end
+      end
+
       def normalize_headers(headers)
         headers.each_with_object({}) do |(key, value), result|
           result[key.to_s.downcase] = value
@@ -290,7 +373,7 @@ module BetterAuth
 
       def set_cookie(name, value, options = {})
         attributes = cookie_attributes(options)
-        cookie = (["#{name}=#{value}"] + attributes).join("; ")
+        cookie = (["#{name}=#{URI.encode_uri_component(value.to_s)}"] + attributes).join("; ")
         set_header("set-cookie", cookie)
       end
 

data/lib/better_auth/error.rb

@@ -17,6 +17,7 @@ module BetterAuth
     "PROVIDER_NOT_FOUND" => "Provider not found",
     "INVALID_TOKEN" => "Invalid token",
     "TOKEN_EXPIRED" => "Token expired",
+    "TOKEN_ALREADY_USED" => "Token has already been used",
     "ID_TOKEN_NOT_SUPPORTED" => "id_token not supported",
     "FAILED_TO_GET_USER_INFO" => "Failed to get user info",
     "USER_EMAIL_NOT_FOUND" => "User email not found",
@@ -54,6 +55,7 @@ module BetterAuth
     "PASSWORD_ALREADY_SET" => "User already has a password set",
     "RESET_PASSWORD_DISABLED" => "Reset password isn't enabled",
     "EMAIL_PASSWORD_DISABLED" => "Email and password is not enabled",
-    "EMAIL_PASSWORD_SIGN_UP_DISABLED" => "Email and password sign up is not enabled"
+    "EMAIL_PASSWORD_SIGN_UP_DISABLED" => "Email and password sign up is not enabled",
+    "CHANGE_EMAIL_DISABLED" => "Change email is disabled"
   }.freeze
 end

data/lib/better_auth/http_client.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "json"
+require "net/http"
+require "uri"
+
+module BetterAuth
+  module HTTPClient
+    DEFAULT_OPEN_TIMEOUT = 5
+    DEFAULT_READ_TIMEOUT = 5
+
+    module_function
+
+    def request(uri, request, open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT)
+      Net::HTTP.start(
+        uri.hostname || uri.host,
+        uri.port,
+        use_ssl: uri.scheme == "https",
+        open_timeout: open_timeout,
+        read_timeout: read_timeout
+      ) do |http|
+        http.request(request)
+      end
+    end
+
+    def get_response(uri, headers = {})
+      request = Net::HTTP::Get.new(uri)
+      headers.each { |key, value| request[key.to_s] = value.to_s }
+      request(uri, request)
+    end
+
+    def post_form(uri, form_body, headers = {})
+      request = Net::HTTP::Post.new(uri)
+      headers.each { |key, value| request[key.to_s] = value.to_s }
+      request["Content-Type"] ||= "application/x-www-form-urlencoded"
+      request.body = form_body
+      request(uri, request)
+    end
+
+    def get_json(url, headers = {})
+      uri = url.is_a?(URI) ? url : URI.parse(url.to_s)
+      response = get_response(uri, headers)
+      response.is_a?(Net::HTTPSuccess) ? JSON.parse(response.body.to_s) : nil
+    end
+  end
+end

data/lib/better_auth/logger.rb

@@ -4,7 +4,7 @@ module BetterAuth
   module Logger
     LEVELS = [:debug, :info, :success, :warn, :error].freeze
 
-    Internal = Struct.new(:level, :disabled, :handler, keyword_init: true) do
+    Internal = Struct.new(:level, :disabled, :handler) do
       LEVELS.each do |log_level|
         define_method(log_level) do |message, *args|
           return if disabled || !Logger.should_publish?(level, log_level)

data/lib/better_auth/middleware/origin_check.rb

@@ -55,7 +55,11 @@ module BetterAuth
         mode = headers["sec-fetch-mode"]
         dest = headers["sec-fetch-dest"]
         has_metadata = [site, mode, dest].any? { |value| value && !value.to_s.strip.empty? }
-        return unless has_metadata
+        unless has_metadata
+          origin = headers["origin"] || headers["referer"]
+          validate_origin(endpoint_context, force: true) if login_or_signup_path?(endpoint_context.path) && origin && !origin.to_s.empty?
+          return
+        end
 
         if site == "cross-site" && mode == "navigate"
           log(endpoint_context.context, :error, "Blocked cross-site navigation login attempt (CSRF protection)")
@@ -109,6 +113,10 @@ module BetterAuth
         skip.any? { |path| endpoint_context.path.start_with?(path.to_s) }
       end
 
+      def login_or_signup_path?(path)
+        path.to_s.match?(%r{/(?:sign-in|sign-up)(?:/|$)})
+      end
+
       def fetch_data(data, key)
         return unless data.is_a?(Hash)
 

data/lib/better_auth/migration_plan.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module MigrationPlan
+    TableChange = Struct.new(:logical_name, :table_name, :table, :order)
+    FieldChange = Struct.new(:logical_name, :table_name, :fields, :table, :order)
+    IndexChange = Struct.new(:table_name, :field_name, :name, :unique, :field)
+
+    Plan = Struct.new(:to_create, :to_add, :to_index, :warnings, :dialect, :tables) do
+      def empty?
+        to_create.empty? && to_add.empty? && to_index.empty?
+      end
+    end
+  end
+end

data/lib/better_auth/oauth2.rb

@@ -81,7 +81,7 @@ module BetterAuth
 
     def post_form(token_endpoint, request)
       uri = URI.parse(token_endpoint)
-      response = Net::HTTP.post(uri, URI.encode_www_form(request[:body]), request[:headers])
+      response = HTTPClient.post_form(uri, URI.encode_www_form(request[:body]), request[:headers])
       JSON.parse(response.body)
     end
 

data/lib/better_auth/oauth_state.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require "json"
+
+module BetterAuth
+  # Shared OAuth state storage matching upstream's opaque-state adaptation.
+  # State data is encrypted client-side for the cookie strategy or consumed
+  # from verification storage for the database strategy. Signed JWT state is
+  # still accepted so in-flight legacy sign-in and link flows keep working.
+  module OAuthState
+    INTERNAL_KEYS = %w[
+      callbackURL codeVerifier errorURL newUserURL expiresAt oauthState link requestSignUp
+    ].freeze
+
+    class Error < BetterAuth::Error
+      attr_reader :code, :error_url
+
+      def initialize(code, error_url: nil)
+        @code = code
+        @error_url = error_url
+        super(code)
+      end
+    end
+
+    module_function
+
+    def generate(ctx, state_data)
+      state = Crypto.random_string(32)
+      payload = stringify_keys(state_data).merge("oauthState" => state)
+
+      if cookie_strategy?(ctx)
+        cookie = ctx.context.create_auth_cookie("oauth_state", max_age: 600)
+        encrypted = Crypto.symmetric_encrypt(
+          key: ctx.context.secret_config,
+          data: JSON.generate(payload)
+        )
+        ctx.set_cookie(cookie.name, encrypted, cookie.attributes)
+      else
+        cookie = ctx.context.create_auth_cookie("state", max_age: 300)
+        ctx.set_signed_cookie(cookie.name, state, ctx.context.secret, cookie.attributes)
+        verification = ctx.context.internal_adapter.create_verification_value(
+          identifier: state,
+          value: JSON.generate(payload),
+          expiresAt: Time.now + 600
+        )
+        raise Error, "state_generation_error" unless verification
+      end
+
+      state
+    end
+
+    def parse(ctx, state)
+      raise Error, "state_not_found" if state.to_s.empty?
+
+      legacy = Crypto.verify_jwt(state.to_s, ctx.context.secret)
+      return parse_legacy(ctx, state, legacy) if legacy
+
+      cookie_strategy?(ctx) ? parse_cookie_state(ctx, state) : parse_database_state(ctx, state)
+    rescue JSON::ParserError
+      raise Error, "state_invalid"
+    end
+
+    def parse_legacy(ctx, state, data)
+      cookie = ctx.context.create_auth_cookie("state", max_age: 600)
+      stored = ctx.get_signed_cookie(cookie.name, ctx.context.secret)
+      Cookies.expire_cookie(ctx, cookie) if ctx.request || stored
+      valid = ctx.request ? stored == state : (stored.nil? || stored == state)
+      return data if valid
+
+      raise Error.new("state_mismatch", error_url: recovered_error_url(data))
+    end
+
+    def parse_cookie_state(ctx, state)
+      cookie = ctx.context.create_auth_cookie("oauth_state")
+      encrypted = ctx.get_cookie(cookie.name)
+      raise Error, "state_mismatch" if encrypted.to_s.empty?
+
+      data = begin
+        decrypted = Crypto.symmetric_decrypt(key: ctx.context.secret_config, data: encrypted)
+        JSON.parse(decrypted)
+      rescue JSON::ParserError, ArgumentError, TypeError
+        raise Error, "state_invalid"
+      end
+
+      expected = data["oauthState"] || data["state"]
+      unless expected == state
+        raise Error.new("state_mismatch", error_url: recovered_error_url(data))
+      end
+
+      Cookies.expire_cookie(ctx, cookie)
+      validate_expiration!(data)
+      data
+    end
+
+    def parse_database_state(ctx, state)
+      preview = ctx.context.internal_adapter.find_verification_value(state)
+      raise Error, "state_mismatch" unless preview
+
+      data = JSON.parse(preview.fetch("value"))
+      error_url = recovered_error_url(data)
+      expected = data["oauthState"] || data["state"]
+      raise Error.new("state_mismatch", error_url: error_url) if expected && expected != state
+
+      cookie = ctx.context.create_auth_cookie("state")
+      stored = ctx.get_signed_cookie(cookie.name, ctx.context.secret)
+      valid = ctx.request ? stored == state : (stored.nil? || stored == state)
+      raise Error.new("state_mismatch", error_url: error_url) unless valid
+
+      consumed = ctx.context.internal_adapter.consume_verification_value(state)
+      Cookies.expire_cookie(ctx, cookie) if ctx.request || stored
+      raise Error.new("state_mismatch", error_url: error_url) unless consumed
+
+      consumed_data = JSON.parse(consumed.fetch("value"))
+      consumed_expected = consumed_data["oauthState"] || consumed_data["state"]
+      same_payload = consumed.fetch("value") == preview.fetch("value")
+      expected_matches = !consumed_expected || consumed_expected == state
+      unless same_payload && expected_matches
+        raise Error.new("state_mismatch", error_url: recovered_error_url(consumed_data) || error_url)
+      end
+
+      validate_expiration!(consumed_data)
+      consumed_data
+    end
+
+    def validate_expiration!(data)
+      expires_at = data["expiresAt"].to_i
+      return data unless expires_at.positive? && expires_at < Time.now.to_i
+
+      raise Error.new("state_mismatch", error_url: recovered_error_url(data))
+    end
+
+    def recovered_error_url(data)
+      data["errorURL"] || data["errorCallbackURL"]
+    end
+
+    def cookie_strategy?(ctx)
+      ctx.context.options.account[:store_state_strategy].to_s == "cookie"
+    end
+
+    def stringify_keys(value)
+      return value.each_with_object({}) { |(key, object), result| result[key.to_s] = stringify_keys(object) } if value.is_a?(Hash)
+      return value.map { |entry| stringify_keys(entry) } if value.is_a?(Array)
+
+      value
+    end
+  end
+end