better_auth_api/plugins/
email_password.rs

1use argon2::password_hash::{SaltString, rand_core::OsRng};
2use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
3use async_trait::async_trait;
4use serde::{Deserialize, Serialize};
5use validator::Validate;
6
7use better_auth_core::adapters::DatabaseAdapter;
8use better_auth_core::entity::{AuthSession, AuthUser};
9use better_auth_core::{AuthContext, AuthPlugin, AuthRoute};
10use better_auth_core::{AuthError, AuthResult};
11use better_auth_core::{AuthRequest, AuthResponse, CreateUser, HttpMethod};
12
13/// Email and password authentication plugin
14pub struct EmailPasswordPlugin {
15    config: EmailPasswordConfig,
16}
17
18#[derive(Debug, Clone)]
19pub struct EmailPasswordConfig {
20    pub enable_signup: bool,
21    pub require_email_verification: bool,
22    pub password_min_length: usize,
23}
24
25#[derive(Debug, Deserialize, Validate)]
26#[allow(dead_code)]
27struct SignUpRequest {
28    #[validate(length(min = 1, message = "Name is required"))]
29    name: String,
30    #[validate(email(message = "Invalid email address"))]
31    email: String,
32    #[validate(length(min = 1, message = "Password is required"))]
33    password: String,
34    username: Option<String>,
35    #[serde(rename = "displayUsername")]
36    display_username: Option<String>,
37    #[serde(rename = "callbackURL")]
38    callback_url: Option<String>,
39}
40
41#[derive(Debug, Deserialize, Validate)]
42#[allow(dead_code)]
43struct SignInRequest {
44    #[validate(email(message = "Invalid email address"))]
45    email: String,
46    #[validate(length(min = 1, message = "Password is required"))]
47    password: String,
48    #[serde(rename = "callbackURL")]
49    callback_url: Option<String>,
50    #[serde(rename = "rememberMe")]
51    remember_me: Option<bool>,
52}
53
54#[derive(Debug, Deserialize, Validate)]
55#[allow(dead_code)]
56struct SignInUsernameRequest {
57    #[validate(length(min = 1, message = "Username is required"))]
58    username: String,
59    #[validate(length(min = 1, message = "Password is required"))]
60    password: String,
61    #[serde(rename = "rememberMe")]
62    remember_me: Option<bool>,
63}
64
65#[derive(Debug, Serialize)]
66struct SignUpResponse<U: Serialize> {
67    token: Option<String>,
68    user: U,
69}
70
71#[derive(Debug, Serialize)]
72struct SignInResponse<U: Serialize> {
73    redirect: bool,
74    token: String,
75    url: Option<String>,
76    user: U,
77}
78
79impl EmailPasswordPlugin {
80    #[allow(clippy::new_without_default)]
81    pub fn new() -> Self {
82        Self {
83            config: EmailPasswordConfig::default(),
84        }
85    }
86
87    pub fn with_config(config: EmailPasswordConfig) -> Self {
88        Self { config }
89    }
90
91    pub fn enable_signup(mut self, enable: bool) -> Self {
92        self.config.enable_signup = enable;
93        self
94    }
95
96    pub fn require_email_verification(mut self, require: bool) -> Self {
97        self.config.require_email_verification = require;
98        self
99    }
100
101    pub fn password_min_length(mut self, length: usize) -> Self {
102        self.config.password_min_length = length;
103        self
104    }
105
106    async fn handle_sign_up<DB: DatabaseAdapter>(
107        &self,
108        req: &AuthRequest,
109        ctx: &AuthContext<DB>,
110    ) -> AuthResult<AuthResponse> {
111        if !self.config.enable_signup {
112            return Err(AuthError::forbidden("User registration is not enabled"));
113        }
114
115        let signup_req: SignUpRequest = match better_auth_core::validate_request_body(req) {
116            Ok(v) => v,
117            Err(resp) => return Ok(resp),
118        };
119
120        // Validate password
121        self.validate_password(&signup_req.password, ctx)?;
122
123        // Check if user already exists
124        if ctx
125            .database
126            .get_user_by_email(&signup_req.email)
127            .await?
128            .is_some()
129        {
130            return Err(AuthError::conflict("A user with this email already exists"));
131        }
132
133        // Hash password
134        let password_hash = self.hash_password(&signup_req.password)?;
135
136        // Create user with password hash in metadata
137        let mut metadata = std::collections::HashMap::new();
138        metadata.insert(
139            "password_hash".to_string(),
140            serde_json::Value::String(password_hash),
141        );
142
143        let mut create_user = CreateUser::new()
144            .with_email(&signup_req.email)
145            .with_name(&signup_req.name);
146        if let Some(username) = signup_req.username {
147            create_user = create_user.with_username(username);
148        }
149        if let Some(display_username) = signup_req.display_username {
150            create_user.display_username = Some(display_username);
151        }
152        create_user.metadata = Some(metadata);
153
154        let user = ctx.database.create_user(create_user).await?;
155
156        // Create session
157        let session_manager =
158            better_auth_core::SessionManager::new(ctx.config.clone(), ctx.database.clone());
159        let session = session_manager.create_session(&user, None, None).await?;
160
161        let response = SignUpResponse {
162            token: Some(session.token().to_string()),
163            user,
164        };
165
166        // Create session cookie
167        let cookie_header = self.create_session_cookie(session.token(), ctx);
168
169        Ok(AuthResponse::json(200, &response)?.with_header("Set-Cookie", cookie_header))
170    }
171
172    async fn handle_sign_in<DB: DatabaseAdapter>(
173        &self,
174        req: &AuthRequest,
175        ctx: &AuthContext<DB>,
176    ) -> AuthResult<AuthResponse> {
177        let signin_req: SignInRequest = match better_auth_core::validate_request_body(req) {
178            Ok(v) => v,
179            Err(resp) => return Ok(resp),
180        };
181
182        // Get user by email
183        let user = ctx
184            .database
185            .get_user_by_email(&signin_req.email)
186            .await?
187            .ok_or(AuthError::InvalidCredentials)?;
188
189        // Verify password
190        let stored_hash = user
191            .metadata()
192            .get("password_hash")
193            .and_then(|v| v.as_str())
194            .ok_or(AuthError::InvalidCredentials)?;
195
196        self.verify_password(&signin_req.password, stored_hash)?;
197
198        // Create session
199        let session_manager =
200            better_auth_core::SessionManager::new(ctx.config.clone(), ctx.database.clone());
201        let session = session_manager.create_session(&user, None, None).await?;
202
203        let response = SignInResponse {
204            redirect: false,
205            token: session.token().to_string(),
206            url: None,
207            user,
208        };
209
210        // Create session cookie
211        let cookie_header = self.create_session_cookie(session.token(), ctx);
212
213        Ok(AuthResponse::json(200, &response)?.with_header("Set-Cookie", cookie_header))
214    }
215
216    async fn handle_sign_in_username<DB: DatabaseAdapter>(
217        &self,
218        req: &AuthRequest,
219        ctx: &AuthContext<DB>,
220    ) -> AuthResult<AuthResponse> {
221        let signin_req: SignInUsernameRequest = match better_auth_core::validate_request_body(req) {
222            Ok(v) => v,
223            Err(resp) => return Ok(resp),
224        };
225
226        // Get user by username
227        let user = ctx
228            .database
229            .get_user_by_username(&signin_req.username)
230            .await?
231            .ok_or(AuthError::InvalidCredentials)?;
232
233        // Verify password
234        let stored_hash = user
235            .metadata()
236            .get("password_hash")
237            .and_then(|v| v.as_str())
238            .ok_or(AuthError::InvalidCredentials)?;
239
240        self.verify_password(&signin_req.password, stored_hash)?;
241
242        // Create session
243        let session_manager =
244            better_auth_core::SessionManager::new(ctx.config.clone(), ctx.database.clone());
245        let session = session_manager.create_session(&user, None, None).await?;
246
247        let response = SignInResponse {
248            redirect: false,
249            token: session.token().to_string(),
250            url: None,
251            user,
252        };
253
254        // Create session cookie
255        let cookie_header = self.create_session_cookie(session.token(), ctx);
256
257        Ok(AuthResponse::json(200, &response)?.with_header("Set-Cookie", cookie_header))
258    }
259
260    fn validate_password<DB: DatabaseAdapter>(
261        &self,
262        password: &str,
263        ctx: &AuthContext<DB>,
264    ) -> AuthResult<()> {
265        if password.len() < ctx.config.password.min_length {
266            return Err(AuthError::bad_request(format!(
267                "Password must be at least {} characters long",
268                ctx.config.password.min_length
269            )));
270        }
271        Ok(())
272    }
273
274    fn hash_password(&self, password: &str) -> AuthResult<String> {
275        let salt = SaltString::generate(&mut OsRng);
276        let argon2 = Argon2::default();
277
278        let password_hash = argon2
279            .hash_password(password.as_bytes(), &salt)
280            .map_err(|e| AuthError::PasswordHash(format!("Failed to hash password: {}", e)))?;
281
282        Ok(password_hash.to_string())
283    }
284
285    fn create_session_cookie<DB: DatabaseAdapter>(
286        &self,
287        token: &str,
288        ctx: &AuthContext<DB>,
289    ) -> String {
290        let session_config = &ctx.config.session;
291        let secure = if session_config.cookie_secure {
292            "; Secure"
293        } else {
294            ""
295        };
296        let http_only = if session_config.cookie_http_only {
297            "; HttpOnly"
298        } else {
299            ""
300        };
301        let same_site = match session_config.cookie_same_site {
302            better_auth_core::config::SameSite::Strict => "; SameSite=Strict",
303            better_auth_core::config::SameSite::Lax => "; SameSite=Lax",
304            better_auth_core::config::SameSite::None => "; SameSite=None",
305        };
306
307        let expires = chrono::Utc::now() + session_config.expires_in;
308        let expires_str = expires.format("%a, %d %b %Y %H:%M:%S GMT");
309
310        format!(
311            "{}={}; Path=/; Expires={}{}{}{}",
312            session_config.cookie_name, token, expires_str, secure, http_only, same_site
313        )
314    }
315
316    fn verify_password(&self, password: &str, hash: &str) -> AuthResult<()> {
317        let parsed_hash = PasswordHash::new(hash)
318            .map_err(|e| AuthError::PasswordHash(format!("Invalid password hash: {}", e)))?;
319
320        let argon2 = Argon2::default();
321        argon2
322            .verify_password(password.as_bytes(), &parsed_hash)
323            .map_err(|_| AuthError::InvalidCredentials)?;
324
325        Ok(())
326    }
327}
328
329impl Default for EmailPasswordConfig {
330    fn default() -> Self {
331        Self {
332            enable_signup: true,
333            require_email_verification: false,
334            password_min_length: 8,
335        }
336    }
337}
338
339#[async_trait]
340impl<DB: DatabaseAdapter> AuthPlugin<DB> for EmailPasswordPlugin {
341    fn name(&self) -> &'static str {
342        "email-password"
343    }
344
345    fn routes(&self) -> Vec<AuthRoute> {
346        let mut routes = vec![
347            AuthRoute::post("/sign-in/email", "sign_in_email"),
348            AuthRoute::post("/sign-in/username", "sign_in_username"),
349        ];
350
351        if self.config.enable_signup {
352            routes.push(AuthRoute::post("/sign-up/email", "sign_up_email"));
353        }
354
355        routes
356    }
357
358    async fn on_request(
359        &self,
360        req: &AuthRequest,
361        ctx: &AuthContext<DB>,
362    ) -> AuthResult<Option<AuthResponse>> {
363        match (req.method(), req.path()) {
364            (HttpMethod::Post, "/sign-up/email") if self.config.enable_signup => {
365                Ok(Some(self.handle_sign_up(req, ctx).await?))
366            }
367            (HttpMethod::Post, "/sign-in/email") => Ok(Some(self.handle_sign_in(req, ctx).await?)),
368            (HttpMethod::Post, "/sign-in/username") => {
369                Ok(Some(self.handle_sign_in_username(req, ctx).await?))
370            }
371            _ => Ok(None),
372        }
373    }
374
375    async fn on_user_created(&self, user: &DB::User, _ctx: &AuthContext<DB>) -> AuthResult<()> {
376        if self.config.require_email_verification
377            && !user.email_verified()
378            && let Some(email) = user.email()
379        {
380            println!("Email verification required for user: {}", email);
381        }
382        Ok(())
383    }
384}
better_auth_api/plugins/email_password.rs

better_auth_api/plugins/
email_password.rs
