better_auth 0.8.0 → 0.11.0

data/lib/better_auth/plugin_loader.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    # Maps `BetterAuth::Plugins` factory methods and nested modules to source files.
+    PLUGIN_FILES = {
+      additional_fields: "plugins/additional_fields",
+      custom_session: "plugins/custom_session",
+      multi_session: "plugins/multi_session",
+      last_login_method: "plugins/last_login_method",
+      bearer: "plugins/bearer",
+      jwt: "plugins/jwt",
+      open_api: "plugins/open_api",
+      access: "plugins/access",
+      username: "plugins/username",
+      anonymous: "plugins/anonymous",
+      magic_link: "plugins/magic_link",
+      email_otp: "plugins/email_otp",
+      phone_number: "plugins/phone_number",
+      one_time_token: "plugins/one_time_token",
+      one_tap: "plugins/one_tap",
+      siwe: "plugins/siwe",
+      generic_oauth: "plugins/generic_oauth",
+      oauth_popup: "plugins/oauth_popup",
+      dub: "plugins/dub",
+      oauth_proxy: "plugins/oauth_proxy",
+      passkey: "plugins/passkey",
+      organization_schema: "plugins/organization/schema",
+      organization: "plugins/organization",
+      admin_schema: "plugins/admin/schema",
+      admin: "plugins/admin",
+      oauth_protocol: "plugins/oauth_protocol",
+      oauth_provider: "plugins/oauth_provider",
+      device_authorization: "plugins/device_authorization",
+      two_factor: "plugins/two_factor",
+      captcha: "plugins/captcha",
+      have_i_been_pwned: "plugins/have_i_been_pwned",
+      api_key: "plugins/api_key",
+      sso: "plugins/sso",
+      scim: "plugins/scim",
+      stripe: "plugins/stripe",
+      expo: "plugins/expo",
+      i18n: "plugins/i18n"
+    }.freeze
+
+    PLUGIN_DEPENDENCIES = {
+      organization: %i[organization_schema access],
+      admin_schema: %i[organization_schema],
+      admin: %i[admin_schema access],
+      device_authorization: %i[oauth_protocol]
+    }.freeze
+
+    # Core route metadata helpers; loaded at boot because base endpoints reference OpenAPI.
+    BOOT_PLUGINS = %i[open_api].freeze
+
+    PLUGIN_ID_TO_LOADER = {
+      "additional-fields" => :additional_fields,
+      "custom-session" => :custom_session,
+      "multi-session" => :multi_session,
+      "last-login-method" => :last_login_method,
+      "bearer" => :bearer,
+      "jwt" => :jwt,
+      "open-api" => :open_api,
+      "username" => :username,
+      "anonymous" => :anonymous,
+      "magic-link" => :magic_link,
+      "email-otp" => :email_otp,
+      "phone-number" => :phone_number,
+      "one-time-token" => :one_time_token,
+      "one-tap" => :one_tap,
+      "siwe" => :siwe,
+      "generic-oauth" => :generic_oauth,
+      "oauth-popup" => :oauth_popup,
+      "dub" => :dub,
+      "oauth-proxy" => :oauth_proxy,
+      "passkey" => :passkey,
+      "organization" => :organization,
+      "admin" => :admin,
+      "oauth-provider" => :oauth_provider,
+      "device-authorization" => :device_authorization,
+      "two-factor" => :two_factor,
+      "captcha" => :captcha,
+      "have-i-been-pwned" => :have_i_been_pwned,
+      "api-key" => :api_key,
+      "sso" => :sso,
+      "scim" => :scim,
+      "stripe" => :stripe,
+      "expo" => :expo,
+      "i18n" => :i18n
+    }.freeze
+
+    NESTED_MODULE_LOADERS = {
+      OAuthProtocol: :oauth_protocol,
+      JWT: :jwt,
+      OrganizationSchema: :organization_schema,
+      AdminSchema: :admin_schema
+    }.freeze
+
+    LAZY_PLUGIN_METHODS = PLUGIN_FILES.keys.freeze
+
+    @loaded_plugins = {}
+
+    EXTERNAL_PLUGIN_IMPLEMENTATIONS = {
+      sso: :SSO_PLUGIN_IMPLEMENTATION,
+      scim: :SCIM_PLUGIN_IMPLEMENTATION,
+      api_key: :API_KEY_PLUGIN_IMPLEMENTATION,
+      passkey: :PASSKEY_PLUGIN_IMPLEMENTATION,
+      stripe: :STRIPE_PLUGIN_IMPLEMENTATION,
+      oauth_provider: :OAUTH_PROVIDER_PLUGIN_IMPLEMENTATION
+    }.freeze
+
+    module_function
+
+    def ensure_external_plugin_loaded!(gem_name:, entry:, implementation_constant:)
+      return if const_defined?(implementation_constant, false)
+
+      spec = Gem.loaded_specs[gem_name] || Gem::Specification.find_by_name(gem_name)
+      entry_path = File.join(spec.full_gem_path, entry)
+      load entry_path unless $LOADED_FEATURES.include?(entry_path)
+
+      return if const_defined?(implementation_constant, false)
+
+      raise LoadError,
+        "BetterAuth requires the #{gem_name} gem. Add it to your Gemfile and require its entrypoint."
+    rescue Gem::MissingSpecError
+      raise LoadError,
+        "BetterAuth requires the #{gem_name} gem. Add it to your Gemfile and require its entrypoint."
+    end
+
+    def call_external_plugin!(method_name, *args, implementation_constant:, gem_name:, entry:, &block)
+      loader = method(method_name)
+      ensure_external_plugin_loaded!(
+        gem_name: gem_name,
+        entry: entry,
+        implementation_constant: implementation_constant
+      )
+      resolved = method(method_name)
+      if resolved == loader
+        raise LoadError,
+          "BetterAuth::Plugins.#{method_name} requires the #{gem_name} gem. Add it to your Gemfile and require its entrypoint."
+      end
+
+      resolved.call(*args, &block)
+    end
+
+    def load_plugin!(name)
+      name = name.to_sym
+      return true if @loaded_plugins[name]
+      implementation_constant = EXTERNAL_PLUGIN_IMPLEMENTATIONS[name]
+      if implementation_constant && const_defined?(implementation_constant, false)
+        @loaded_plugins[name] = true
+        return true
+      end
+
+      Array(PLUGIN_DEPENDENCIES[name]).each { |dependency| load_plugin!(dependency) }
+
+      relative_path = PLUGIN_FILES.fetch(name) do
+        raise ArgumentError, "Unknown plugin loader: #{name}"
+      end
+
+      absolute_path = File.expand_path(relative_path, __dir__)
+      unless File.file?("#{absolute_path}.rb")
+        @loaded_plugins[name] = true
+        return false
+      end
+
+      require_relative relative_path
+      @loaded_plugins[name] = true
+      true
+    end
+
+    def plugin_loaded?(name)
+      @loaded_plugins.key?(name.to_sym)
+    end
+
+    def ensure_plugin_loaded_for!(plugin)
+      return unless plugin.is_a?(BetterAuth::Plugin)
+
+      loader = PLUGIN_ID_TO_LOADER[plugin.id]
+      load_plugin!(loader) if loader
+    end
+
+    def lazy_plugin_method?(name)
+      !plugin_loader_for_method(name).nil?
+    end
+
+    def plugin_loader_for_method(name)
+      symbol = name.to_sym
+      return symbol if LAZY_PLUGIN_METHODS.include?(symbol)
+
+      PLUGIN_FILES.each_key do |plugin|
+        return plugin if name.to_s.start_with?("#{plugin}_")
+      end
+
+      nil
+    end
+
+    def load_plugin_for_constant!(name)
+      if (loader = NESTED_MODULE_LOADERS[name])
+        return load_plugin!(loader)
+      end
+
+      if name == :OpenAPI
+        return load_plugin!(:open_api)
+      end
+
+      constant = name.to_s
+      if constant.end_with?("_ERROR_CODES")
+        plugin_name = constant.delete_suffix("_ERROR_CODES").downcase.to_sym
+        return load_plugin!(plugin_name) if PLUGIN_FILES.key?(plugin_name)
+      end
+
+      false
+    end
+
+    def load_boot_plugins!
+      BOOT_PLUGINS.each { |plugin| load_plugin!(plugin) }
+    end
+  end
+end

data/lib/better_auth/plugins/access.rb

@@ -10,36 +10,33 @@ module BetterAuth
       end
 
       def authorize(request, connector = "AND")
+        connector = (connector == "OR") ? "OR" : "AND"
         success = false
         stringify_request(request).each do |resource, requested_actions|
           allowed_actions = statements[resource]
           unless allowed_actions
+            next if connector == "OR"
+
             return {success: false, error: "You are not allowed to access resource: #{resource}"}
           end
 
           success = if requested_actions.is_a?(Array)
-            requested_actions.all? { |action| allowed_actions.include?(action.to_s) }
+            requested_actions.any? && requested_actions.all? { |action| action.is_a?(String) && allowed_actions.include?(action) }
           elsif requested_actions.is_a?(Hash)
-            unless requested_actions.key?("actions") || requested_actions.key?(:actions)
-              raise Error, "Invalid access control request"
-            end
-
             raw_actions = requested_actions["actions"] || requested_actions[:actions]
-            raise Error, "Invalid access control request" if raw_actions.nil?
-
-            actions = Array(raw_actions).map(&:to_s)
-            action_connector = (requested_actions["connector"] || requested_actions[:connector] || "AND").to_s.upcase
+            actions = raw_actions.is_a?(Array) ? raw_actions : []
+            action_connector = ((requested_actions["connector"] || requested_actions[:connector]) == "OR") ? "OR" : "AND"
             if action_connector == "OR"
-              actions.any? { |action| allowed_actions.include?(action) }
+              actions.any? { |action| action.is_a?(String) && allowed_actions.include?(action) }
             else
-              actions.all? { |action| allowed_actions.include?(action) }
+              actions.any? && actions.all? { |action| action.is_a?(String) && allowed_actions.include?(action) }
             end
           else
             raise Error, "Invalid access control request"
           end
 
-          return {success: true} if success && connector.to_s.upcase == "OR"
-          return {success: false, error: "unauthorized to access resource \"#{resource}\""} if !success && connector.to_s.upcase == "AND"
+          return {success: true} if success && connector == "OR"
+          return {success: false, error: "unauthorized to access resource \"#{resource}\""} if !success && connector == "AND"
         end
 
         success ? {success: true} : {success: false, error: "Not authorized"}

data/lib/better_auth/plugins/admin.rb

@@ -25,15 +25,17 @@ module BetterAuth
       "YOU_CANNOT_REMOVE_YOURSELF" => "You cannot remove yourself",
       "YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE" => "You are not allowed to set a non-existent role value",
       "YOU_CANNOT_IMPERSONATE_ADMINS" => "You cannot impersonate admins",
-      "INVALID_ROLE_TYPE" => "Invalid role type"
+      "INVALID_ROLE_TYPE" => "Invalid role type",
+      "YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL" => "You are not allowed to update users email",
+      "PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER" => "Password cannot be updated through update-user. Use the set-user-password endpoint instead"
     }.freeze
 
     ADMIN_DEFAULT_STATEMENTS = {
-      user: ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"],
+      user: ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"],
       session: ["list", "revoke", "delete"]
     }.freeze
     ADMIN_DEFAULT_ROLE_STATEMENTS = {
-      user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"],
+      user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"],
       session: ["list", "revoke", "delete"]
     }.freeze
 
@@ -66,7 +68,11 @@ module BetterAuth
           after: [
             {
               matcher: ->(ctx) { ctx.path == "/list-sessions" },
-              handler: ->(ctx) { ctx.json(Array(ctx.returned).reject { |session| session["impersonatedBy"] || session[:impersonatedBy] }) }
+              handler: lambda do |ctx|
+                next unless ctx.returned.is_a?(Array)
+
+                ctx.json(ctx.returned.reject { |session| session["impersonatedBy"] || session[:impersonatedBy] })
+              end
             }
           ]
         },
@@ -154,6 +160,8 @@ module BetterAuth
         user_id = body[:user_id].to_s
         raise APIError.new("BAD_REQUEST", message: "userId is required") if user_id.empty?
         update = {role: admin_validate_roles!(body[:role], config)}
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
+
         user = ctx.context.internal_adapter.update_user(user_id, update)
         ctx.json({user: Schema.parse_output(ctx.context.options, "user", user || {})})
       end
@@ -185,7 +193,7 @@ module BetterAuth
         elsif query[:email]
           ctx.context.internal_adapter.find_user_by_email(query[:email])&.fetch(:user)
         end
-        raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless user
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless user
         ctx.json(Schema.parse_output(ctx.context.options, "user", user))
       end
     end
@@ -208,10 +216,10 @@ module BetterAuth
           required: ["email", "name"]
         )
       ) do |ctx|
-        session = Routes.current_session(ctx, allow_nil: true)
+        session = Routes.current_session(ctx, allow_nil: true, sensitive: true)
         if session
           unless admin_permission?(session[:user], session[:user]["role"], {user: ["create"]}, config)
-            raise APIError.new("FORBIDDEN", message: ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS"))
+            raise APIError.new("FORBIDDEN", code: "YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS", message: ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS"))
           end
         elsif !ctx.headers.empty?
           raise APIError.new("UNAUTHORIZED")
@@ -219,18 +227,25 @@ module BetterAuth
 
         body = normalize_hash(ctx.body)
         email = body[:email].to_s.downcase
-        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES.fetch("INVALID_EMAIL")) unless Routes::EMAIL_PATTERN.match?(email)
+        raise APIError.new("BAD_REQUEST", code: "INVALID_EMAIL", message: BASE_ERROR_CODES.fetch("INVALID_EMAIL")) unless Routes::EMAIL_PATTERN.match?(email)
 
         if ctx.context.internal_adapter.find_user_by_email(email)
-          raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL"))
+          raise APIError.new("BAD_REQUEST", code: "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL", message: ADMIN_ERROR_CODES.fetch("USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL"))
         end
         data = normalize_hash(body[:data]).each_with_object({}) { |(key, value), result| result[Schema.storage_key(key)] = value }
+        requested_role = body.key?(:role) ? body[:role] : data.delete("role")
+        if !requested_role.nil? && session
+          admin_require_permission!(ctx, config, {user: ["set-role"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE"))
+        end
+        if session && ["banned", "banReason", "banExpires"].any? { |field| data.key?(field) }
+          admin_require_permission!(ctx, config, {user: ["ban"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_BAN_USERS"))
+        end
         user = ctx.context.internal_adapter.create_user(data.merge(
           name: body[:name].to_s,
           email: email,
-          role: admin_validate_roles!(body[:role] || config[:default_role], config)
+          role: requested_role.nil? ? config[:default_role] : admin_validate_roles!(requested_role, config)
         ).merge(body.key?(:image) ? {image: body[:image]} : {}), context: ctx)
-        raise APIError.new("INTERNAL_SERVER_ERROR", message: ADMIN_ERROR_CODES.fetch("FAILED_TO_CREATE_USER")) unless user
+        raise APIError.new("INTERNAL_SERVER_ERROR", code: "FAILED_TO_CREATE_USER", message: ADMIN_ERROR_CODES.fetch("FAILED_TO_CREATE_USER")) unless user
 
         if body[:password].to_s != ""
           ctx.context.internal_adapter.link_account(userId: user["id"], providerId: "credential", accountId: user["id"], password: Routes.hash_password(ctx, body[:password]))
@@ -265,12 +280,38 @@ module BetterAuth
         admin_require_permission!(ctx, config, {user: ["update"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS"))
         body = normalize_hash(ctx.body)
         data = normalize_hash(body[:data] || body).except(:user_id, :data)
-        raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("NO_DATA_TO_UPDATE")) if data.empty?
+        raise APIError.new("BAD_REQUEST", code: "NO_DATA_TO_UPDATE", message: ADMIN_ERROR_CODES.fetch("NO_DATA_TO_UPDATE")) if data.empty?
+        if data.key?(:password)
+          raise APIError.new("BAD_REQUEST", code: "PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER", message: ADMIN_ERROR_CODES.fetch("PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER"))
+        end
         if data.key?(:role)
           admin_require_permission!(ctx, config, {user: ["set-role"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE"))
           data[:role] = admin_validate_roles!(data[:role], config)
         end
-        user = ctx.context.internal_adapter.update_user(body[:user_id], data)
+        if [:banned, :ban_reason, :ban_expires].any? { |field| data.key?(field) }
+          session = admin_require_permission!(ctx, config, {user: ["ban"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_BAN_USERS"))
+          if data[:banned] == true && body[:user_id] == session[:user]["id"]
+            raise APIError.new("BAD_REQUEST", code: "YOU_CANNOT_BAN_YOURSELF", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_BAN_YOURSELF"))
+          end
+        end
+        if data.key?(:email) || data.key?(:email_verified)
+          admin_require_permission!(ctx, config, {user: ["set-email"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL"))
+          if data.key?(:email)
+            email = data[:email].to_s.downcase
+            raise APIError.new("BAD_REQUEST", code: "INVALID_EMAIL", message: BASE_ERROR_CODES.fetch("INVALID_EMAIL")) unless Routes::EMAIL_PATTERN.match?(email)
+
+            existing = ctx.context.internal_adapter.find_user_by_email(email)
+            if existing && existing[:user]["id"] != body[:user_id]
+              raise APIError.new("BAD_REQUEST", code: "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL", message: ADMIN_ERROR_CODES.fetch("USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL"))
+            end
+            data[:email] = email
+          end
+        end
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(body[:user_id])
+
+        stored_data = data.each_with_object({}) { |(key, value), result| result[Schema.storage_key(key)] = value }
+        user = ctx.context.internal_adapter.update_user(body[:user_id], stored_data)
+        ctx.context.internal_adapter.delete_user_sessions(body[:user_id]) if data[:banned] == true
         ctx.json(Schema.parse_output(ctx.context.options, "user", user))
       end
     end
@@ -353,11 +394,11 @@ module BetterAuth
         session = admin_require_permission!(ctx, config, {user: ["ban"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_BAN_USERS"))
         body = normalize_hash(ctx.body)
         found = ctx.context.internal_adapter.find_user_by_id(body[:user_id])
-        raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless found
-        raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_BAN_YOURSELF")) if body[:user_id] == session[:user]["id"]
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless found
+        raise APIError.new("BAD_REQUEST", code: "YOU_CANNOT_BAN_YOURSELF", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_BAN_YOURSELF")) if body[:user_id] == session[:user]["id"]
         expires_in = body[:ban_expires_in] || config[:default_ban_expires_in]
         user = ctx.context.internal_adapter.update_user(body[:user_id], banned: true, banReason: body[:ban_reason] || config[:default_ban_reason] || "No reason", banExpires: expires_in ? Time.now + expires_in.to_i : nil, updatedAt: Time.now)
-        ctx.context.internal_adapter.delete_sessions(body[:user_id])
+        ctx.context.internal_adapter.delete_user_sessions(body[:user_id])
         ctx.json({user: Schema.parse_output(ctx.context.options, "user", user)})
       end
     end
@@ -377,7 +418,10 @@ module BetterAuth
         )
       ) do |ctx|
         admin_require_permission!(ctx, config, {user: ["ban"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_BAN_USERS"))
-        user = ctx.context.internal_adapter.update_user(normalize_hash(ctx.body)[:user_id], banned: false, banReason: nil, banExpires: nil, updatedAt: Time.now)
+        user_id = normalize_hash(ctx.body)[:user_id]
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
+
+        user = ctx.context.internal_adapter.update_user(user_id, banned: false, banReason: nil, banExpires: nil, updatedAt: Time.now)
         ctx.json({user: Schema.parse_output(ctx.context.options, "user", user)})
       end
     end
@@ -407,11 +451,11 @@ module BetterAuth
         session = admin_require_permission!(ctx, config, {user: ["impersonate"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS"))
         body = normalize_hash(ctx.body)
         target = ctx.context.internal_adapter.find_user_by_id(body[:user_id])
-        raise APIError.new("NOT_FOUND", message: "User not found") unless target
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless target
         can_impersonate_admins = config[:allow_impersonating_admins] ||
           admin_permission?(session[:user], session[:user]["role"], {user: ["impersonate-admins"]}, config)
         if !can_impersonate_admins && admin_user?(target, config)
-          raise APIError.new("FORBIDDEN", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_IMPERSONATE_ADMINS"))
+          raise APIError.new("FORBIDDEN", code: "YOU_CANNOT_IMPERSONATE_ADMINS", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_IMPERSONATE_ADMINS"))
         end
         impersonated = ctx.context.internal_adapter.create_session(target["id"], true, {impersonatedBy: session[:user]["id"], expiresAt: Time.now + config[:impersonation_session_duration].to_i}, true, ctx)
         raise APIError.new("INTERNAL_SERVER_ERROR", message: ADMIN_ERROR_CODES.fetch("FAILED_TO_CREATE_USER")) unless impersonated
@@ -436,6 +480,7 @@ module BetterAuth
           openapi: {
             operationId: "stopImpersonating",
             description: "Stop impersonating a user",
+            requestBody: OpenAPI.empty_request_body,
             responses: {
               "200" => OpenAPI.json_response("Impersonation stopped", OpenAPI.session_response_schema_pair)
             }
@@ -519,7 +564,7 @@ module BetterAuth
         }
       ) do |ctx|
         admin_require_permission!(ctx, config, {session: ["revoke"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS"))
-        ctx.context.internal_adapter.delete_sessions(normalize_hash(ctx.body)[:user_id])
+        ctx.context.internal_adapter.delete_user_sessions(normalize_hash(ctx.body)[:user_id])
         ctx.json({success: true})
       end
     end
@@ -548,8 +593,8 @@ module BetterAuth
       ) do |ctx|
         session = admin_require_permission!(ctx, config, {user: ["delete"]}, ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS"))
         user_id = normalize_hash(ctx.body)[:user_id]
-        raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_REMOVE_YOURSELF")) if user_id == session[:user]["id"]
-        raise APIError.new("NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
+        raise APIError.new("BAD_REQUEST", code: "YOU_CANNOT_REMOVE_YOURSELF", message: ADMIN_ERROR_CODES.fetch("YOU_CANNOT_REMOVE_YOURSELF")) if user_id == session[:user]["id"]
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
         ctx.context.internal_adapter.delete_user(user_id)
         ctx.json({success: true})
       end
@@ -585,9 +630,17 @@ module BetterAuth
         raise APIError.new("BAD_REQUEST", message: "userId is required") if user_id.empty?
         min = ctx.context.options.email_and_password[:min_password_length]
         max = ctx.context.options.email_and_password[:max_password_length]
-        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES.fetch("PASSWORD_TOO_SHORT")) if password.length < min
-        raise APIError.new("BAD_REQUEST", message: BASE_ERROR_CODES.fetch("PASSWORD_TOO_LONG")) if password.length > max
-        ctx.context.internal_adapter.update_password(user_id, Routes.hash_password(ctx, password))
+        raise APIError.new("BAD_REQUEST", code: "PASSWORD_TOO_SHORT", message: BASE_ERROR_CODES.fetch("PASSWORD_TOO_SHORT")) if password.length < min
+        raise APIError.new("BAD_REQUEST", code: "PASSWORD_TOO_LONG", message: BASE_ERROR_CODES.fetch("PASSWORD_TOO_LONG")) if password.length > max
+        raise APIError.new("NOT_FOUND", code: "USER_NOT_FOUND", message: BASE_ERROR_CODES.fetch("USER_NOT_FOUND")) unless ctx.context.internal_adapter.find_user_by_id(user_id)
+
+        hashed_password = Routes.hash_password(ctx, password)
+        credential_account = ctx.context.internal_adapter.find_accounts(user_id).find { |account| account["providerId"] == "credential" }
+        if credential_account
+          ctx.context.internal_adapter.update_password(user_id, hashed_password)
+        else
+          ctx.context.internal_adapter.create_account(userId: user_id, providerId: "credential", accountId: user_id, password: hashed_password)
+        end
         ctx.json({status: true})
       end
     end
@@ -626,7 +679,7 @@ module BetterAuth
           }
         }
       ) do |ctx|
-        session = Routes.current_session(ctx, allow_nil: true)
+        session = Routes.current_session(ctx, allow_nil: true, sensitive: true)
         body = normalize_hash(ctx.body)
         permissions = body[:permissions] || body[:permission]
         unless permissions
@@ -718,7 +771,10 @@ module BetterAuth
       session = Routes.current_session(ctx, sensitive: true)
       return session if admin_permission?(session[:user], session[:user]["role"], permissions, config)
 
-      raise APIError.new("FORBIDDEN", message: message)
+      code = ADMIN_ERROR_CODES.key(message)
+      raise Error, "Unknown admin permission error: #{message}" unless code
+
+      raise APIError.new("FORBIDDEN", code: code, message: message)
     end
 
     def admin_permission?(user, role_string, permissions, config)
@@ -745,7 +801,7 @@ module BetterAuth
 
     def admin_validate_roles!(roles, config)
       unless Array(roles).all? { |role| role.is_a?(String) || role.is_a?(Symbol) }
-        raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("INVALID_ROLE_TYPE"))
+        raise APIError.new("BAD_REQUEST", code: "INVALID_ROLE_TYPE", message: ADMIN_ERROR_CODES.fetch("INVALID_ROLE_TYPE"))
       end
 
       parsed = admin_parse_roles(roles)
@@ -753,7 +809,7 @@ module BetterAuth
         defined_roles = (config[:roles] || {}).transform_keys(&:to_s)
         invalid = parsed.split(",", -1).reject { |role| admin_role_for(defined_roles, role) }
         if invalid.any?
-          raise APIError.new("BAD_REQUEST", message: ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE"))
+          raise APIError.new("BAD_REQUEST", code: "YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE", message: ADMIN_ERROR_CODES.fetch("YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE"))
         end
       end
 

data/lib/better_auth/plugins/anonymous.rb

@@ -47,6 +47,7 @@ module BetterAuth
           openapi: {
             operationId: "signInAnonymous",
             description: "Sign in anonymously",
+            requestBody: OpenAPI.empty_request_body,
             responses: {
               "200" => OpenAPI.json_response(
                 "Anonymous session created",
@@ -96,6 +97,7 @@ module BetterAuth
           openapi: {
             operationId: "deleteAnonymousUser",
             description: "Delete the current anonymous user",
+            requestBody: OpenAPI.empty_request_body,
             responses: {
               "200" => OpenAPI.json_response("Anonymous user deleted", OpenAPI.success_response_schema)
             }

data/lib/better_auth/plugins/api_key.rb

@@ -1,16 +1,13 @@
 # frozen_string_literal: true
 
+return if defined?(BetterAuth::Plugins::API_KEY_PLUGIN_IMPLEMENTATION)
+
 module BetterAuth
   module Plugins
     module_function
 
-    def api_key(*args)
-      Kernel.require "better_auth/api_key"
-      BetterAuth::Plugins.api_key(*args)
-    rescue LoadError => error
-      raise if error.path && error.path != "better_auth/api_key"
-
-      raise LoadError, "BetterAuth::Plugins.api_key requires the better_auth-api-key gem. Add `gem \"better_auth-api-key\"` and `require \"better_auth/api_key\"`."
+    def api_key(*args, &block)
+      call_external_plugin!(:api_key, *args, implementation_constant: :API_KEY_PLUGIN_IMPLEMENTATION, gem_name: "better_auth-api-key", entry: "lib/better_auth/api_key.rb", &block)
     end
   end
 end

data/lib/better_auth/plugins/bearer.rb

@@ -50,7 +50,7 @@ module BetterAuth
       return unless signed_token && valid_signed_token?(ctx, signed_token)
 
       cookie_name = ctx.context.auth_cookies[:session_token].name
-      cookie = [ctx.headers["cookie"], "#{cookie_name}=#{signed_token}"].compact.reject(&:empty?).join("; ")
+      cookie = Cookies.set_request_cookie(ctx.headers["cookie"], cookie_name, signed_token)
       {context: {headers: ctx.headers.merge("cookie" => cookie)}}
     end
 
@@ -86,37 +86,23 @@ module BetterAuth
       token.to_s
     end
 
-    def bearer_session_cookie(line)
-      first, *attributes = line.to_s.split(";").map(&:strip)
-      name, value = first.split("=", 2)
-      return unless name && value
-
-      {
-        name: name,
-        value: value,
-        attributes: attributes.each_with_object({}) do |attribute, result|
-          key, attribute_value = attribute.split("=", 2)
-          result[key.to_s.downcase] = attribute_value || true unless key.to_s.empty?
-        end
-      }
-    end
-
     def expired_bearer_cookie?(cookie)
       max_age = cookie[:attributes]["max-age"]
       max_age.to_s.strip.match?(/\A[+-]?\d+\z/) && max_age.to_i == 0
     end
 
     def expose_auth_token(ctx)
-      set_cookie = ctx.response_headers["set-cookie"].to_s
       token_name = ctx.context.auth_cookies[:session_token].name
-      token = set_cookie.lines.filter_map do |line|
-        cookie = bearer_session_cookie(line)
+      session_cookie = Cookies.split_set_cookie_header(ctx.response_headers["set-cookie"]).reverse_each.filter_map do |line|
+        cookie = Cookies.parse_set_cookie(line)
         next unless cookie && cookie[:name] == token_name
-        next if cookie[:value].empty? || expired_bearer_cookie?(cookie)
 
-        cookie[:value]
+        cookie
       end.first
-      return unless token
+      return unless session_cookie
+      return if session_cookie[:value].empty? || expired_bearer_cookie?(session_cookie)
+
+      token = session_cookie[:value]
 
       exposed = ctx.response_headers["access-control-expose-headers"].to_s.split(",").map(&:strip).reject(&:empty?)
       exposed << "set-auth-token"