better_auth 0.8.0 → 0.11.0

data/lib/better_auth/plugins/generic_oauth.rb

@@ -31,14 +31,14 @@ module BetterAuth
         init: ->(context) {
           {
             options: {
-              social_providers: generic_oauth_social_providers(config, context).merge(context.social_providers)
+              social_providers: context.social_providers.merge(generic_oauth_social_providers(config, context))
             }
           }
         },
         endpoints: {
           sign_in_with_oauth2: sign_in_with_oauth2_endpoint(config),
-          o_auth2_callback: o_auth2_callback_endpoint(config),
-          o_auth2_link_account: o_auth2_link_account_endpoint(config)
+          oauth2_callback: oauth2_callback_endpoint(config),
+          oauth2_link_account: oauth2_link_account_endpoint(config)
         },
         error_codes: GENERIC_OAUTH_ERROR_CODES,
         options: config
@@ -212,6 +212,36 @@ module BetterAuth
       )
     end
 
+    def yandex(options = {})
+      data = normalize_hash(options)
+      generic_oauth_provider_config(
+        data,
+        provider_id: "yandex",
+        authorization_url: "https://oauth.yandex.com/authorize",
+        token_url: "https://oauth.yandex.com/token",
+        scopes: ["login:info", "login:email", "login:avatar"],
+        get_user_info: ->(tokens) {
+          profile = generic_oauth_fetch_json(
+            "https://login.yandex.ru/info?format=json",
+            authorization: "OAuth #{fetch_value(tokens, "accessToken")}"
+          )
+          return nil unless profile
+
+          avatar_id = fetch_value(profile, "default_avatar_id")
+          image = if !fetch_value(profile, "is_avatar_empty") && !avatar_id.to_s.empty?
+            "https://avatars.yandex.net/get-yapic/#{avatar_id}/islands-200"
+          end
+          {
+            id: fetch_value(profile, "id"),
+            name: fetch_value(profile, "display_name") || fetch_value(profile, "real_name") || fetch_value(profile, "first_name") || fetch_value(profile, "login"),
+            email: fetch_value(profile, "default_email") || Array(fetch_value(profile, "emails")).first,
+            emailVerified: false,
+            image: image
+          }.compact
+        }
+      )
+    end
+
     def sign_in_with_oauth2_endpoint(config)
       Endpoint.new(
         path: "/sign-in/oauth2",
@@ -220,6 +250,7 @@ module BetterAuth
           openapi: {
             operationId: "signInOAuth2",
             description: "Sign in with OAuth2",
+            requestBody: OpenAPI.json_request_body(generic_oauth_start_body_schema),
             responses: {
               "200" => OpenAPI.json_response("Sign in with OAuth2", generic_oauth_url_response_schema)
             }
@@ -234,7 +265,7 @@ module BetterAuth
       end
     end
 
-    def o_auth2_link_account_endpoint(config)
+    def oauth2_link_account_endpoint(config)
       Endpoint.new(
         path: "/oauth2/link",
         method: "POST",
@@ -242,6 +273,7 @@ module BetterAuth
           openapi: {
             operationId: "linkOAuth2",
             description: "Link an OAuth2 account to the current user session",
+            requestBody: OpenAPI.json_request_body(generic_oauth_start_body_schema),
             responses: {
               "200" => OpenAPI.json_response("Authorization URL generated successfully for linking an OAuth2 account", generic_oauth_url_response_schema)
             }
@@ -264,7 +296,7 @@ module BetterAuth
       end
     end
 
-    def o_auth2_callback_endpoint(config)
+    def oauth2_callback_endpoint(config)
       Endpoint.new(
         path: "/oauth2/callback/:providerId",
         method: "GET",
@@ -289,9 +321,9 @@ module BetterAuth
         provider = generic_oauth_provider!(config, provider_id)
         state_data = generic_oauth_parse_state(ctx, query[:state].to_s)
         error_url = state_data["errorURL"] || state_data["errorCallbackURL"] || "#{ctx.context.base_url}/error"
-        redirect_error = ->(error) { raise ctx.redirect(generic_oauth_error_url(error_url, error)) }
+        redirect_error = ->(error, description = nil) { raise ctx.redirect(generic_oauth_error_url(error_url, error, description)) }
 
-        redirect_error.call(query[:error] || "oAuth_code_missing") if query[:error] || query[:code].to_s.empty?
+        redirect_error.call(query[:error] || "oAuth_code_missing", query[:error_description]) if query[:error] || query[:code].to_s.empty?
         generic_oauth_validate_issuer!(ctx, provider, query, redirect_error)
 
         tokens = begin
@@ -309,6 +341,7 @@ module BetterAuth
         account_id = fetch_value(mapped_user, "id").to_s
         redirect_error.call("email_is_missing") if email.empty?
         redirect_error.call("name_is_missing") if name.empty?
+        redirect_error.call("user_info_is_missing") if Routes.blank_remote_id?(account_id)
 
         link = state_data["link"]
         callback_url = state_data["callbackURL"] || "/"
@@ -321,21 +354,20 @@ module BetterAuth
         if !existing && (provider[:disable_sign_up] || (provider[:disable_implicit_sign_up] && !state_data["requestSignUp"]))
           redirect_error.call("signup_disabled")
         end
-        if existing && provider[:override_user_info]
-          ctx.context.internal_adapter.update_user(
-            existing[:user]["id"],
-            "name" => name,
-            "image" => fetch_value(mapped_user, "image"),
-            "emailVerified" => !!fetch_value(mapped_user, "emailVerified")
+        session_data = begin
+          Routes.persist_social_user(
+            ctx,
+            provider_id,
+            mapped_user.merge("email" => email, "name" => name, "id" => account_id),
+            generic_oauth_account_info(ctx, provider_id, account_id, tokens),
+            override_user_info: provider[:override_user_info]
           )
-        end
+        rescue APIError => error
+          raise if error.code.to_s.empty?
 
-        session_data = Routes.persist_social_user(
-          ctx,
-          provider_id,
-          mapped_user.merge("email" => email, "name" => name, "id" => account_id),
-          generic_oauth_account_info(ctx, provider_id, account_id, tokens)
-        )
+          redirect_error.call(error.code, error.message)
+        end
+        redirect_error.call(session_data[:error].tr(" ", "_")) if session_data[:error]
         generic_oauth_set_account_cookie(ctx, provider_id, account_id, session_data[:user]["id"])
         Cookies.set_session_cookie(ctx, session_data)
         raise ctx.redirect(existing ? callback_url : (state_data["newUserURL"] || state_data["newUserCallbackURL"] || callback_url))
@@ -352,13 +384,35 @@ module BetterAuth
       )
     end
 
-    def generic_oauth_authorization_url(ctx, provider, body, link:)
+    def generic_oauth_start_body_schema
+      OpenAPI.object_schema(
+        {
+          providerId: {type: "string", description: "OAuth provider ID"},
+          callbackURL: {type: "string", description: "URL to redirect to after success"},
+          errorCallbackURL: {type: "string", description: "URL to redirect to after error"},
+          newUserCallbackURL: {type: "string", description: "URL to redirect to for new users"},
+          requestSignUp: {type: "boolean", description: "Whether this request is a sign-up flow"},
+          scopes: {type: "array", items: {type: "string"}, description: "Additional OAuth scopes"},
+          disableRedirect: {type: "boolean", description: "Return the URL instead of redirecting"},
+          additionalData: {type: "object", additionalProperties: true}
+        }
+      )
+    end
+
+    def generic_oauth_authorization_url(ctx, provider, body, link:, code_verifier: nil, preserve_additional_data: false)
       authorization_url = provider[:authorization_url] || generic_oauth_discovery(provider)["authorization_endpoint"]
       token_url = provider[:token_url] || generic_oauth_discovery(provider)["token_endpoint"]
       raise APIError.new("BAD_REQUEST", message: GENERIC_OAUTH_ERROR_CODES["INVALID_OAUTH_CONFIGURATION"]) if authorization_url.to_s.empty? || token_url.to_s.empty?
 
-      code_verifier = Crypto.random_string(43)
-      state_data = normalize_hash(body[:additional_data] || body[:additionalData]).transform_keys(&:to_s).merge(
+      code_verifier ||= Crypto.random_string(43)
+      additional_data = if preserve_additional_data
+        raw = body[:additional_data] || body[:additionalData]
+        raw.is_a?(Hash) ? raw.each_with_object({}) { |(key, value), data| data[key.to_s] = value } : {}
+      else
+        normalize_hash(body[:additional_data] || body[:additionalData]).transform_keys(&:to_s)
+      end
+      additional_data = additional_data.reject { |key, _value| OAuthState::INTERNAL_KEYS.include?(key.to_s) }
+      state_data = additional_data.merge(
         "callbackURL" => body[:callback_url] || body[:callbackURL] || "/",
         "errorURL" => body[:error_callback_url] || body[:errorCallbackURL],
         "newUserURL" => body[:new_user_callback_url] || body[:newUserCallbackURL],
@@ -368,79 +422,59 @@ module BetterAuth
         "expiresAt" => Time.now.to_i + 600
       )
       state = generic_oauth_generate_state(ctx, state_data)
-      legacy_state = Crypto.sign_jwt(
-        {
-          "callbackURL" => body[:callback_url] || body[:callbackURL] || "/",
-          "errorURL" => body[:error_callback_url] || body[:errorCallbackURL],
-          "newUserURL" => body[:new_user_callback_url] || body[:newUserCallbackURL],
-          "requestSignUp" => body[:request_sign_up] || body[:requestSignUp],
-          "codeVerifier" => code_verifier,
-          "link" => link
-        },
-        ctx.context.secret,
-        expires_in: 600
-      )
-      state ||= legacy_state
 
       uri = URI.parse(authorization_url.to_s)
       params = URI.decode_www_form(uri.query.to_s)
-      params.concat([
-        ["client_id", provider[:client_id].to_s],
-        ["response_type", provider[:response_type] || "code"],
-        ["redirect_uri", generic_oauth_redirect_uri(ctx, provider)],
-        ["state", state]
-      ])
+      generic_oauth_set_query_param(params, "client_id", provider[:client_id].to_s)
+      generic_oauth_set_query_param(params, "response_type", provider[:response_type] || "code")
+      generic_oauth_set_query_param(params, "redirect_uri", generic_oauth_redirect_uri(ctx, provider))
+      generic_oauth_set_query_param(params, "state", state)
       scopes = Array(body[:scopes]) + Array(provider[:scopes])
-      params << ["scope", scopes.join(" ")] unless scopes.empty?
+      generic_oauth_set_query_param(params, "scope", scopes.join(" ")) unless scopes.empty?
       if provider[:pkce]
-        params << ["code_challenge", generic_oauth_pkce_challenge(code_verifier)]
-        params << ["code_challenge_method", "S256"]
+        generic_oauth_set_query_param(params, "code_challenge", generic_oauth_pkce_challenge(code_verifier))
+        generic_oauth_set_query_param(params, "code_challenge_method", "S256")
       end
-      params << ["prompt", provider[:prompt]] if provider[:prompt]
-      params << ["access_type", provider[:access_type]] if provider[:access_type]
-      params << ["response_mode", provider[:response_mode]] if provider[:response_mode]
+      generic_oauth_set_query_param(params, "prompt", provider[:prompt]) if provider[:prompt]
+      generic_oauth_set_query_param(params, "access_type", provider[:access_type]) if provider[:access_type]
+      generic_oauth_set_query_param(params, "response_mode", provider[:response_mode]) if provider[:response_mode]
       authorization_params = if provider[:authorization_url_params].respond_to?(:call)
         provider[:authorization_url_params].call(ctx)
       else
         provider[:authorization_url_params]
       end
-      normalize_hash(authorization_params || {}).each { |key, value| params << [key.to_s, value.to_s] }
+      normalize_hash(authorization_params || {}).each { |key, value| generic_oauth_set_query_param(params, key, value) }
       uri.query = URI.encode_www_form(params)
       uri.to_s
     end
 
-    def generic_oauth_generate_state(ctx, state_data)
-      strategy = ctx.context.options.account[:store_state_strategy]
-      state = Crypto.random_string(32)
-      if strategy.to_s == "cookie"
-        cookie = ctx.context.create_auth_cookie("oauth_state", max_age: 600)
-        encrypted = Crypto.symmetric_encrypt(key: ctx.context.secret_config, data: JSON.generate(state_data.merge("state" => state)))
-        ctx.set_cookie(cookie.name, encrypted, cookie.attributes)
-        return state
+    def generic_oauth_set_query_param(params, key, value)
+      name = key.to_s
+      first_index = params.index { |param_name, _param_value| param_name == name }
+      if first_index
+        params[first_index] = [name, value.to_s]
+        (params.length - 1).downto(first_index + 1) do |index|
+          params.delete_at(index) if params[index].first == name
+        end
+      else
+        params << [name, value.to_s]
       end
+    end
 
-      cookie = ctx.context.create_auth_cookie("state", max_age: 300)
-      ctx.set_signed_cookie(cookie.name, state, ctx.context.secret, cookie.attributes)
-      ctx.context.internal_adapter.create_verification_value(
-        identifier: state,
-        value: JSON.generate(state_data),
-        expiresAt: Time.now + 600
-      )
-      state
-    rescue
-      nil
+    def generic_oauth_generate_state(ctx, state_data)
+      OAuthState.generate(ctx, state_data)
     end
 
     def generic_oauth_exchange_token(ctx, provider, code, state_data)
       token_callback = provider[:get_token]
       if token_callback.respond_to?(:call)
-        return normalize_hash(token_callback.call(
+        return generic_oauth_normalize_tokens(token_callback.call(
           code: code,
           redirectURI: generic_oauth_redirect_uri(ctx, provider),
           redirect_uri: generic_oauth_redirect_uri(ctx, provider),
           codeVerifier: provider[:pkce] ? state_data["codeVerifier"] : nil,
           code_verifier: provider[:pkce] ? state_data["codeVerifier"] : nil
-        ))
+        ), access_token_expires_in: provider[:access_token_expires_in])
       end
 
       token_url = provider[:token_url] || generic_oauth_discovery(provider)["token_endpoint"]
@@ -450,70 +484,37 @@ module BetterAuth
     end
 
     def generic_oauth_parse_state(ctx, state)
-      if state.to_s.empty?
-        raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "please_restart_the_process"))
-      end
-
-      if ctx.context.options.account[:store_state_strategy].to_s == "cookie"
-        cookie = ctx.context.create_auth_cookie("oauth_state")
-        encrypted = ctx.get_cookie(cookie.name)
-        unless encrypted
-          raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "state_mismatch"))
-        end
-
-        begin
-          decrypted = Crypto.symmetric_decrypt(key: ctx.context.secret_config, data: encrypted)
-          unless decrypted
-            Cookies.expire_cookie(ctx, cookie)
-            raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "please_restart_the_process"))
-          end
-
-          parsed = JSON.parse(decrypted)
-        rescue JSON::ParserError
-          Cookies.expire_cookie(ctx, cookie)
-          raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "please_restart_the_process"))
-        end
-
-        Cookies.expire_cookie(ctx, cookie)
-        if parsed["state"] != state
-          raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "state_mismatch"))
-        end
-        if parsed["expiresAt"].to_i.positive? && parsed["expiresAt"].to_i < Time.now.to_i
-          raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "state_mismatch"))
-        end
-        return parsed
-      else
-        verification = ctx.context.internal_adapter.find_verification_value(state)
-        if verification
-          cookie = ctx.context.create_auth_cookie("state")
-          cookie_state = ctx.get_signed_cookie(cookie.name, ctx.context.secret)
-          if cookie_state && cookie_state != state
-            Cookies.expire_cookie(ctx, cookie)
-            raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "state_mismatch"))
-          end
-
-          parsed = JSON.parse(verification.fetch("value"))
-          ctx.context.internal_adapter.delete_verification_value(verification.fetch("id"))
-          Cookies.expire_cookie(ctx, cookie) if cookie_state
-          return parsed
-        end
-      end
-
-      Crypto.verify_jwt(state.to_s, ctx.context.secret) || {}
-    rescue JSON::ParserError
-      {}
+      OAuthState.parse(ctx, state)
+    rescue OAuthState::Error => error
+      code = (error.code == "state_not_found") ? "please_restart_the_process" : error.code
+      error_url = error.error_url || generic_oauth_state_error_url(ctx)
+      raise ctx.redirect(generic_oauth_error_url(error_url, code))
     end
 
     def generic_oauth_state_error_url(ctx)
       ctx.context.options.on_api_error[:error_url] || "#{ctx.context.base_url}/error"
     end
 
+    def generic_oauth_recovered_state_error_url(ctx, state_data)
+      state_data["errorURL"] || state_data["errorCallbackURL"] || generic_oauth_state_error_url(ctx)
+    end
+
     def generic_oauth_user_info(provider, tokens)
       callback = provider[:get_user_info]
-      return normalize_hash(callback.call(tokens)) if callback.respond_to?(:call)
+      if callback.respond_to?(:call)
+        user_info = callback.call(tokens)
+        return nil if user_info.nil?
+
+        return normalize_hash(user_info)
+      end
 
       id_token = tokens[:id_token] || tokens[:idToken]
-      return generic_oauth_user_from_id_token(id_token) if id_token
+      if id_token
+        token_user = generic_oauth_user_from_id_token(id_token)
+        id = fetch_value(token_user, "id")
+        email = fetch_value(token_user, "email")
+        return token_user if !id.to_s.empty? && !email.to_s.empty?
+      end
 
       user_info_url = provider[:user_info_url] || generic_oauth_discovery(provider)["userinfo_endpoint"]
       return nil if user_info_url.to_s.empty?
@@ -521,7 +522,7 @@ module BetterAuth
       uri = URI(user_info_url)
       request = Net::HTTP::Get.new(uri)
       request["authorization"] = "Bearer #{fetch_value(tokens, "accessToken")}"
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       return nil unless response.is_a?(Net::HTTPSuccess)
 
       generic_oauth_normalize_user_info(JSON.parse(response.body))
@@ -593,7 +594,7 @@ module BetterAuth
     end
 
     def generic_oauth_redirect_uri(ctx, provider)
-      provider[:redirect_uri] || provider[:redirectURI] || "#{ctx.context.base_url}/oauth2/callback/#{provider[:provider_id]}"
+      provider[:redirect_uri] || provider[:redirectURI] || "#{ctx.context.canonical_base_url}/oauth2/callback/#{provider[:provider_id]}"
     end
 
     def generic_oauth_validate_issuer!(ctx, provider, query, redirect_error)
@@ -615,7 +616,7 @@ module BetterAuth
       normalize_hash(provider[:discovery_headers] || provider[:discoveryHeaders]).each do |key, value|
         request[key.to_s.tr("_", "-")] = value.to_s
       end
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       provider[:_discovery] = response.is_a?(Net::HTTPSuccess) ? JSON.parse(response.body) : {}
     rescue
       {}
@@ -649,16 +650,16 @@ module BetterAuth
         form_data[key] = value unless form_data.key?(key)
       end
       request.set_form_data(form_data)
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       return nil unless response.is_a?(Net::HTTPSuccess)
 
-      generic_oauth_normalize_tokens(JSON.parse(response.body))
+      generic_oauth_normalize_tokens(JSON.parse(response.body), access_token_expires_in: provider[:access_token_expires_in])
     rescue
       nil
     end
 
     def generic_oauth_user_from_id_token(id_token)
-      payload = JWT.decode(id_token, nil, false).first
+      payload = ::JWT.decode(id_token, nil, false).first
       normalize_hash(
         id: payload["sub"],
         email: payload["email"],
@@ -670,15 +671,17 @@ module BetterAuth
       nil
     end
 
-    def generic_oauth_normalize_tokens(data)
+    def generic_oauth_normalize_tokens(data, access_token_expires_in: nil)
       token_data = normalize_hash(data)
+      access_token_expires_at = token_data[:access_token_expires_at] || generic_oauth_expiry_time(token_data[:expires_in])
+      access_token_expires_at ||= generic_oauth_expiry_time(access_token_expires_in)
       token_data.merge(
         access_token: token_data[:access_token],
         refresh_token: token_data[:refresh_token],
         id_token: token_data[:id_token],
-        access_token_expires_at: generic_oauth_expiry_time(token_data[:expires_in]),
-        refresh_token_expires_at: generic_oauth_expiry_time(token_data[:refresh_token_expires_in]),
-        scopes: generic_oauth_token_scopes(token_data[:scope]),
+        access_token_expires_at: access_token_expires_at,
+        refresh_token_expires_at: token_data[:refresh_token_expires_at] || generic_oauth_expiry_time(token_data[:refresh_token_expires_in]),
+        scopes: generic_oauth_token_scopes(token_data[:scopes] || token_data[:scope]),
         raw: token_data
       ).compact
     end
@@ -714,7 +717,7 @@ module BetterAuth
       uri = URI(url)
       request = Net::HTTP::Get.new(uri)
       normalize_hash(headers).each { |key, value| request[key.to_s.tr("_", "-")] = value.to_s }
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       return nil unless response.is_a?(Net::HTTPSuccess)
 
       JSON.parse(response.body)
@@ -740,7 +743,8 @@ module BetterAuth
         pkce: data[:pkce],
         disable_implicit_sign_up: data[:disable_implicit_sign_up],
         disable_sign_up: data[:disable_sign_up],
-        override_user_info: data[:override_user_info]
+        override_user_info: data[:override_user_info],
+        access_token_expires_in: data[:access_token_expires_in]
       )
       config[:scopes] = data[:scopes] if data[:scopes]
       config.compact
@@ -753,7 +757,20 @@ module BetterAuth
           id: provider_id,
           name: provider_id,
           get_user_info: ->(tokens) { generic_oauth_provider_user_info(provider, tokens) },
-          refresh_access_token: ->(refresh_token) { generic_oauth_refresh_access_token(context, provider, refresh_token) }
+          refresh_access_token: ->(refresh_token) { generic_oauth_refresh_access_token(context, provider, refresh_token) },
+          oauth_popup_authorization_url: lambda do |ctx, data|
+            additional_data = data[:additionalData] || data["additionalData"] || data[:additional_data] || data["additional_data"]
+            normalized = normalize_hash(data)
+            normalized[:additional_data] = additional_data if additional_data.is_a?(Hash)
+            generic_oauth_authorization_url(
+              ctx,
+              provider,
+              normalized,
+              link: nil,
+              code_verifier: normalized[:code_verifier],
+              preserve_additional_data: true
+            )
+          end
         }
       end
     end
@@ -790,16 +807,21 @@ module BetterAuth
       token_url_params = token_url_params.call(ctx) if token_url_params.respond_to?(:call)
       normalize_hash(token_url_params || {}).each { |key, value| form_data[key] = value }
       request.set_form_data(form_data.compact)
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       raise APIError.new("BAD_REQUEST", message: GENERIC_OAUTH_ERROR_CODES["INVALID_OAUTH_CONFIG"]) unless response.is_a?(Net::HTTPSuccess)
 
-      generic_oauth_normalize_tokens(JSON.parse(response.body))
+      generic_oauth_normalize_tokens(JSON.parse(response.body), access_token_expires_in: provider[:access_token_expires_in])
     end
 
-    def generic_oauth_error_url(base_url, error)
+    def generic_oauth_error_url(base_url, error, description = nil)
       uri = URI.parse(base_url.to_s)
       query = URI.decode_www_form(uri.query.to_s)
-      query << ["error", error.to_s]
+      generic_oauth_set_query_param(query, "error", error)
+      if description.to_s.empty?
+        query.delete_if { |name, _value| name == "error_description" }
+      else
+        generic_oauth_set_query_param(query, "error_description", description)
+      end
       uri.query = URI.encode_www_form(query)
       uri.to_s
     end

data/lib/better_auth/plugins/have_i_been_pwned.rb

@@ -83,7 +83,7 @@ module BetterAuth
       request = Net::HTTP::Get.new(uri)
       request["Add-Padding"] = "true"
       request["User-Agent"] = "BetterAuth Password Checker"
-      response = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       unless response.is_a?(Net::HTTPSuccess)
         raise APIError.new("INTERNAL_SERVER_ERROR", message: "Failed to check password. Status: #{response.code}")
       end