@baseplate-dev/plugin-auth 1.0.7 → 1.0.8

package/dist/better-auth/generators/fastify/better-auth-module/templates/module/services/user-session.service.ts

@@ -1,14 +1,15 @@
 // @ts-nocheck
 
+import type { Auth } from '$auth';
 import type { AuthUserSessionInfo } from '%authContextImports';
 import type { UserSessionService } from '%userSessionTypesImports';
 import type { FastifyRequest } from 'fastify';
 
-import { auth, cookiePrefix } from '$auth';
+import { cookiePrefix } from '$auth';
 import { toWebHeaders } from '$headersUtils';
 
 function toSessionInfo(
-  session: typeof auth.$Infer.Session,
+  session: Auth['$Infer']['Session'],
 ): AuthUserSessionInfo {
   return {
     id: session.session.id,
@@ -19,54 +20,65 @@ function toSessionInfo(
   };
 }
 
-export class BetterAuthUserSessionService implements UserSessionService {
-  /**
-   * Retrieves the user session information from the request.
-   *
-   * @param req - The Fastify request object containing the cookies.
-   * @returns A promise that resolves to the authenticated user session information or undefined if no session.
-   */
-  async getSessionInfoFromRequest(
-    req: FastifyRequest,
-  ): Promise<AuthUserSessionInfo | undefined> {
-    const session = await auth.api.getSession({
-      headers: toWebHeaders(req.headers),
-    });
+/**
+ * Creates a {@link UserSessionService} backed by Better Auth.
+ *
+ * @param auth - The {@link Auth} instance to look up sessions with.
+ * @returns A {@link UserSessionService} implementation.
+ */
+export function createBetterAuthUserSessionService(
+  auth: Auth,
+): UserSessionService {
+  return {
+    /**
+     * Retrieves the user session information from the request.
+     *
+     * Better Auth looks up sessions purely from request headers, so the
+     * optional `res` parameter on {@link UserSessionService} is unused here.
+     *
+     * @param req - The Fastify request object containing the cookies.
+     * @returns A promise that resolves to the authenticated user session information or undefined if no session.
+     */
+    async getSessionInfoFromRequest(
+      req: FastifyRequest,
+    ): Promise<AuthUserSessionInfo | undefined> {
+      const session = await auth.api.getSession({
+        headers: toWebHeaders(req.headers),
+      });
 
-    if (!session) {
-      return undefined;
-    }
+      if (!session) {
+        return undefined;
+      }
 
-    return toSessionInfo(session);
-  }
+      return toSessionInfo(session);
+    },
 
-  /**
-   * Retrieves the user session information from the authentication token
-   *
-   * @param _req The request object (unused for Better Auth cookie-based sessions)
-   * @param token The session token
-   * @returns The session info or undefined if no session is found
-   */
-  async getSessionInfoFromToken(
-    _req: FastifyRequest,
-    token?: string | null,
-  ): Promise<AuthUserSessionInfo | undefined> {
-    if (!token) {
-      return undefined;
-    }
+    /**
+     * Retrieves the user session information from the authentication token
+     *
+     * @param _req The request object (unused for Better Auth cookie-based sessions)
+     * @param token The session token
+     * @returns The session info or undefined if no session is found
+     */
+    async getSessionInfoFromToken(
+      _req: FastifyRequest,
+      token?: string | null,
+    ): Promise<AuthUserSessionInfo | undefined> {
+      if (!token) {
+        return undefined;
+      }
 
-    const session = await auth.api.getSession({
-      headers: new Headers({
-        cookie: `${cookiePrefix}.session_token=${token}`,
-      }),
-    });
+      const session = await auth.api.getSession({
+        headers: new Headers({
+          cookie: `${cookiePrefix}.session_token=${token}`,
+        }),
+      });
 
-    if (!session) {
-      return undefined;
-    }
+      if (!session) {
+        return undefined;
+      }
 
-    return toSessionInfo(session);
-  }
+      return toSessionInfo(session);
+    },
+  };
 }
-
-export const userSessionService = new BetterAuthUserSessionService();

package/dist/better-auth/generators/fastify/index.d.ts

@@ -1,2 +1,5 @@
+export * from './better-auth-admin-module/index.js';
+export * from './better-auth-email-templates/index.js';
 export * from './better-auth-module/index.js';
+export * from './seed-initial-user/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/better-auth/generators/fastify/index.js

@@ -1,2 +1,5 @@
+export * from './better-auth-admin-module/index.js';
+export * from './better-auth-email-templates/index.js';
 export * from './better-auth-module/index.js';
+export * from './seed-initial-user/index.js';
 //# sourceMappingURL=index.js.map

package/dist/better-auth/generators/fastify/seed-initial-user/generated/index.d.ts

@@ -0,0 +1,66 @@
+export declare const BETTER_AUTH_SEED_INITIAL_USER_GENERATED: {
+    paths: {
+        provider: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").BetterAuthSeedInitialUserPaths>;
+        task: import("@baseplate-dev/sync").GeneratorTask<{
+            betterAuthSeedInitialUserPaths: import("@baseplate-dev/sync").ProviderExport<import("./template-paths.js").BetterAuthSeedInitialUserPaths>;
+        }, {
+            packageInfo: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").PackageInfoProvider>;
+        }, undefined>;
+    };
+    renderers: {
+        provider: import("@baseplate-dev/sync").ProviderType<import("./template-renderers.js").BetterAuthSeedInitialUserRenderers>;
+        task: import("@baseplate-dev/sync").GeneratorTask<{
+            betterAuthSeedInitialUserRenderers: import("@baseplate-dev/sync").ProviderExport<import("./template-renderers.js").BetterAuthSeedInitialUserRenderers>;
+        }, {
+            authRolesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                AUTH_ROLE_CONFIG: {};
+                AuthRole: {
+                    isTypeOnly: true;
+                };
+                DEFAULT_PUBLIC_ROLES: {};
+                DEFAULT_USER_ROLES: {};
+                RoleConfig: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").BetterAuthSeedInitialUserPaths>;
+            prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                PrismaClient: {};
+                Prisma: {};
+                '*': {};
+                $Enums: {};
+            }>>;
+            prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                prisma: {};
+            }>>;
+            typescriptFile: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").TypescriptFileProvider>;
+        }, undefined>;
+    };
+    templates: {
+        seedInitialUser: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_INITIAL_USER_ROLES: {};
+        }, {
+            authRolesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                AUTH_ROLE_CONFIG: {};
+                AuthRole: {
+                    isTypeOnly: true;
+                };
+                DEFAULT_PUBLIC_ROLES: {};
+                DEFAULT_USER_ROLES: {};
+                RoleConfig: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                PrismaClient: {};
+                Prisma: {};
+                '*': {};
+                $Enums: {};
+            }>>;
+            prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                prisma: {};
+            }>>;
+        }, Record<never, Record<never, never>>>;
+    };
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/better-auth/generators/fastify/seed-initial-user/generated/index.js

@@ -0,0 +1,9 @@
+import { BETTER_AUTH_SEED_INITIAL_USER_PATHS } from './template-paths.js';
+import { BETTER_AUTH_SEED_INITIAL_USER_RENDERERS } from './template-renderers.js';
+import { BETTER_AUTH_SEED_INITIAL_USER_TEMPLATES } from './typed-templates.js';
+export const BETTER_AUTH_SEED_INITIAL_USER_GENERATED = {
+    paths: BETTER_AUTH_SEED_INITIAL_USER_PATHS,
+    renderers: BETTER_AUTH_SEED_INITIAL_USER_RENDERERS,
+    templates: BETTER_AUTH_SEED_INITIAL_USER_TEMPLATES,
+};
+//# sourceMappingURL=index.js.map

package/dist/better-auth/generators/fastify/seed-initial-user/generated/template-paths.d.ts

@@ -0,0 +1,12 @@
+export interface BetterAuthSeedInitialUserPaths {
+    seedInitialUser: string;
+}
+export declare const BETTER_AUTH_SEED_INITIAL_USER_PATHS: {
+    provider: import("@baseplate-dev/sync").ProviderType<BetterAuthSeedInitialUserPaths>;
+    task: import("@baseplate-dev/sync").GeneratorTask<{
+        betterAuthSeedInitialUserPaths: import("@baseplate-dev/sync").ProviderExport<BetterAuthSeedInitialUserPaths>;
+    }, {
+        packageInfo: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").PackageInfoProvider>;
+    }, undefined>;
+};
+//# sourceMappingURL=template-paths.d.ts.map

package/dist/better-auth/generators/fastify/seed-initial-user/generated/template-paths.js

@@ -0,0 +1,24 @@
+import { packageInfoProvider } from '@baseplate-dev/core-generators';
+import { createGeneratorTask, createProviderType } from '@baseplate-dev/sync';
+const betterAuthSeedInitialUserPaths = createProviderType('better-auth-seed-initial-user-paths');
+const betterAuthSeedInitialUserPathsTask = createGeneratorTask({
+    dependencies: { packageInfo: packageInfoProvider },
+    exports: {
+        betterAuthSeedInitialUserPaths: betterAuthSeedInitialUserPaths.export(),
+    },
+    run({ packageInfo }) {
+        const srcRoot = packageInfo.getPackageSrcPath();
+        return {
+            providers: {
+                betterAuthSeedInitialUserPaths: {
+                    seedInitialUser: `${srcRoot}/prisma/seed-initial-user.ts`,
+                },
+            },
+        };
+    },
+});
+export const BETTER_AUTH_SEED_INITIAL_USER_PATHS = {
+    provider: betterAuthSeedInitialUserPaths,
+    task: betterAuthSeedInitialUserPathsTask,
+};
+//# sourceMappingURL=template-paths.js.map

package/dist/better-auth/generators/fastify/seed-initial-user/generated/template-renderers.d.ts

@@ -0,0 +1,38 @@
+import type { RenderTsTemplateFileActionInput } from '@baseplate-dev/core-generators';
+import type { BuilderAction } from '@baseplate-dev/sync';
+import { BETTER_AUTH_SEED_INITIAL_USER_TEMPLATES } from './typed-templates.js';
+export interface BetterAuthSeedInitialUserRenderers {
+    seedInitialUser: {
+        render: (options: Omit<RenderTsTemplateFileActionInput<typeof BETTER_AUTH_SEED_INITIAL_USER_TEMPLATES.seedInitialUser>, 'destination' | 'importMapProviders' | 'template' | 'generatorPaths'>) => BuilderAction;
+    };
+}
+export declare const BETTER_AUTH_SEED_INITIAL_USER_RENDERERS: {
+    provider: import("@baseplate-dev/sync").ProviderType<BetterAuthSeedInitialUserRenderers>;
+    task: import("@baseplate-dev/sync").GeneratorTask<{
+        betterAuthSeedInitialUserRenderers: import("@baseplate-dev/sync").ProviderExport<BetterAuthSeedInitialUserRenderers>;
+    }, {
+        authRolesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            AUTH_ROLE_CONFIG: {};
+            AuthRole: {
+                isTypeOnly: true;
+            };
+            DEFAULT_PUBLIC_ROLES: {};
+            DEFAULT_USER_ROLES: {};
+            RoleConfig: {
+                isTypeOnly: true;
+            };
+        }>>;
+        paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").BetterAuthSeedInitialUserPaths>;
+        prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            PrismaClient: {};
+            Prisma: {};
+            '*': {};
+            $Enums: {};
+        }>>;
+        prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            prisma: {};
+        }>>;
+        typescriptFile: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").TypescriptFileProvider>;
+    }, undefined>;
+};
+//# sourceMappingURL=template-renderers.d.ts.map

package/dist/better-auth/generators/fastify/seed-initial-user/generated/template-renderers.js

@@ -0,0 +1,43 @@
+import { typescriptFileProvider } from '@baseplate-dev/core-generators';
+import { authRolesImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { createGeneratorTask, createProviderType } from '@baseplate-dev/sync';
+import { BETTER_AUTH_SEED_INITIAL_USER_PATHS } from './template-paths.js';
+import { BETTER_AUTH_SEED_INITIAL_USER_TEMPLATES } from './typed-templates.js';
+const betterAuthSeedInitialUserRenderers = createProviderType('better-auth-seed-initial-user-renderers');
+const betterAuthSeedInitialUserRenderersTask = createGeneratorTask({
+    dependencies: {
+        authRolesImports: authRolesImportsProvider,
+        paths: BETTER_AUTH_SEED_INITIAL_USER_PATHS.provider,
+        prismaGeneratedImports: prismaGeneratedImportsProvider,
+        prismaImports: prismaImportsProvider,
+        typescriptFile: typescriptFileProvider,
+    },
+    exports: {
+        betterAuthSeedInitialUserRenderers: betterAuthSeedInitialUserRenderers.export(),
+    },
+    run({ authRolesImports, paths, prismaGeneratedImports, prismaImports, typescriptFile, }) {
+        return {
+            providers: {
+                betterAuthSeedInitialUserRenderers: {
+                    seedInitialUser: {
+                        render: (options) => typescriptFile.renderTemplateFile({
+                            template: BETTER_AUTH_SEED_INITIAL_USER_TEMPLATES.seedInitialUser,
+                            destination: paths.seedInitialUser,
+                            importMapProviders: {
+                                authRolesImports,
+                                prismaGeneratedImports,
+                                prismaImports,
+                            },
+                            ...options,
+                        }),
+                    },
+                },
+            },
+        };
+    },
+});
+export const BETTER_AUTH_SEED_INITIAL_USER_RENDERERS = {
+    provider: betterAuthSeedInitialUserRenderers,
+    task: betterAuthSeedInitialUserRenderersTask,
+};
+//# sourceMappingURL=template-renderers.js.map

package/dist/better-auth/generators/fastify/seed-initial-user/generated/typed-templates.d.ts

@@ -0,0 +1,27 @@
+export declare const BETTER_AUTH_SEED_INITIAL_USER_TEMPLATES: {
+    seedInitialUser: import("@baseplate-dev/core-generators").TsTemplateFile<{
+        TPL_INITIAL_USER_ROLES: {};
+    }, {
+        authRolesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            AUTH_ROLE_CONFIG: {};
+            AuthRole: {
+                isTypeOnly: true;
+            };
+            DEFAULT_PUBLIC_ROLES: {};
+            DEFAULT_USER_ROLES: {};
+            RoleConfig: {
+                isTypeOnly: true;
+            };
+        }>>;
+        prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            PrismaClient: {};
+            Prisma: {};
+            '*': {};
+            $Enums: {};
+        }>>;
+        prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            prisma: {};
+        }>>;
+    }, Record<never, Record<never, never>>>;
+};
+//# sourceMappingURL=typed-templates.d.ts.map

package/dist/better-auth/generators/fastify/seed-initial-user/generated/typed-templates.js

@@ -0,0 +1,18 @@
+import { createTsTemplateFile } from '@baseplate-dev/core-generators';
+import { authRolesImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, } from '@baseplate-dev/fastify-generators';
+import path from 'node:path';
+const seedInitialUser = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        authRolesImports: authRolesImportsProvider,
+        prismaGeneratedImports: prismaGeneratedImportsProvider,
+        prismaImports: prismaImportsProvider,
+    },
+    name: 'seed-initial-user',
+    source: {
+        path: path.join(import.meta.dirname, '../templates/src/prisma/seed-initial-user.ts'),
+    },
+    variables: { TPL_INITIAL_USER_ROLES: {} },
+});
+export const BETTER_AUTH_SEED_INITIAL_USER_TEMPLATES = { seedInitialUser };
+//# sourceMappingURL=typed-templates.js.map

package/dist/better-auth/generators/fastify/seed-initial-user/index.d.ts

@@ -0,0 +1,2 @@
+export * from './seed-initial-user.generator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/better-auth/generators/fastify/seed-initial-user/index.js

@@ -0,0 +1,2 @@
+export * from './seed-initial-user.generator.js';
+//# sourceMappingURL=index.js.map

package/dist/better-auth/generators/fastify/seed-initial-user/seed-initial-user.generator.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Generator for better-auth/seed-initial-user.
+ *
+ * Creates a seed script that creates an initial admin user with email/password
+ * credentials and assigns the configured roles via direct Prisma calls.
+ */
+export declare const betterAuthSeedInitialUserGenerator: import("@baseplate-dev/sync").GeneratorBundleCreator<{
+    initialUserRoles: string[];
+}, {
+    paths: import("@baseplate-dev/sync").GeneratorTask<{
+        betterAuthSeedInitialUserPaths: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-paths.js").BetterAuthSeedInitialUserPaths>;
+    }, {
+        packageInfo: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").PackageInfoProvider>;
+    }, undefined>;
+    renderers: import("@baseplate-dev/sync").GeneratorTask<{
+        betterAuthSeedInitialUserRenderers: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-renderers.js").BetterAuthSeedInitialUserRenderers>;
+    }, {
+        authRolesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            AUTH_ROLE_CONFIG: {};
+            AuthRole: {
+                isTypeOnly: true;
+            };
+            DEFAULT_PUBLIC_ROLES: {};
+            DEFAULT_USER_ROLES: {};
+            RoleConfig: {
+                isTypeOnly: true;
+            };
+        }>>;
+        paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").BetterAuthSeedInitialUserPaths>;
+        prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            PrismaClient: {};
+            Prisma: {};
+            '*': {};
+            $Enums: {};
+        }>>;
+        prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            prisma: {};
+        }>>;
+        typescriptFile: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").TypescriptFileProvider>;
+    }, undefined>;
+    prismaSeed: import("@baseplate-dev/sync").GeneratorTask<any, {
+        prismaSeed: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/fastify-generators").PrismaSeedProvider>;
+        paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").BetterAuthSeedInitialUserPaths>;
+    }, any>;
+    main: import("@baseplate-dev/sync").GeneratorTask<any, {
+        renderers: import("@baseplate-dev/sync").ProviderType<import("./generated/template-renderers.js").BetterAuthSeedInitialUserRenderers>;
+    }, any>;
+}>;
+//# sourceMappingURL=seed-initial-user.generator.d.ts.map

package/dist/better-auth/generators/fastify/seed-initial-user/seed-initial-user.generator.js

@@ -0,0 +1,64 @@
+import { TsCodeUtils, tsImportBuilder, tsTemplateWithImports, } from '@baseplate-dev/core-generators';
+import { prismaSeedProvider } from '@baseplate-dev/fastify-generators';
+import { createGenerator, createGeneratorTask } from '@baseplate-dev/sync';
+import { quot } from '@baseplate-dev/utils';
+import { z } from 'zod';
+import { BETTER_AUTH_SEED_INITIAL_USER_GENERATED as GENERATED_TEMPLATES } from './generated/index.js';
+const descriptorSchema = z.object({
+    initialUserRoles: z.array(z.string()),
+});
+/**
+ * Generator for better-auth/seed-initial-user.
+ *
+ * Creates a seed script that creates an initial admin user with email/password
+ * credentials and assigns the configured roles via direct Prisma calls.
+ */
+export const betterAuthSeedInitialUserGenerator = createGenerator({
+    name: 'better-auth/seed-initial-user',
+    generatorFileUrl: import.meta.url,
+    descriptorSchema,
+    buildTasks: ({ initialUserRoles }) => ({
+        paths: GENERATED_TEMPLATES.paths.task,
+        renderers: GENERATED_TEMPLATES.renderers.task,
+        prismaSeed: createGeneratorTask({
+            dependencies: {
+                prismaSeed: prismaSeedProvider,
+                paths: GENERATED_TEMPLATES.paths.provider,
+            },
+            run({ prismaSeed, paths }) {
+                prismaSeed.addSeedFragment('initial-user', tsTemplateWithImports([
+                    tsImportBuilder(['seedInitialUser']).from(paths.seedInitialUser),
+                ]) `await seedInitialUser();`);
+                prismaSeed.addSeedEnvField({
+                    name: 'INITIAL_USER_EMAIL',
+                    exampleValue: 'admin@example.com',
+                });
+                prismaSeed.addSeedEnvField({
+                    name: 'INITIAL_USER_PASSWORD',
+                    exampleValue: 'password',
+                });
+                prismaSeed.addSeedEnvField({
+                    name: 'INITIAL_USER_NAME',
+                    exampleValue: 'Admin',
+                });
+            },
+        }),
+        main: createGeneratorTask({
+            dependencies: {
+                renderers: GENERATED_TEMPLATES.renderers.provider,
+            },
+            run({ renderers }) {
+                return {
+                    build: async (builder) => {
+                        await builder.apply(renderers.seedInitialUser.render({
+                            variables: {
+                                TPL_INITIAL_USER_ROLES: TsCodeUtils.mergeFragmentsAsArrayPresorted(initialUserRoles.map((role) => quot(role)).toSorted()),
+                            },
+                        }));
+                    },
+                };
+            },
+        }),
+    }),
+});
+//# sourceMappingURL=seed-initial-user.generator.js.map

package/dist/better-auth/generators/fastify/seed-initial-user/templates/src/prisma/seed-initial-user.ts

@@ -0,0 +1,64 @@
+// @ts-nocheck
+
+import type { AuthRole } from '%authRolesImports';
+import type { User } from '%prismaGeneratedImports';
+
+import { prisma } from '%prismaImports';
+import { hashPassword } from 'better-auth/crypto';
+
+const { INITIAL_USER_EMAIL, INITIAL_USER_PASSWORD, INITIAL_USER_NAME } =
+  process.env;
+const INITIAL_USER_ROLES: AuthRole[] = TPL_INITIAL_USER_ROLES;
+
+/**
+ * Seeds the initial user with email/password credentials and assigns roles.
+ * Uses direct Prisma calls instead of the auth API to avoid triggering
+ * verification emails during seeding.
+ *
+ * @returns The seeded user, or undefined if env vars are not set
+ */
+export async function seedInitialUser(): Promise<User | undefined> {
+  if (!INITIAL_USER_EMAIL || !INITIAL_USER_PASSWORD) {
+    console.warn(
+      'INITIAL_USER_EMAIL and INITIAL_USER_PASSWORD must be set in .seed.env to seed the initial user',
+    );
+    return undefined;
+  }
+
+  let user = await prisma.user.findFirst({
+    where: { email: INITIAL_USER_EMAIL },
+  });
+
+  if (!user) {
+    const passwordHash = await hashPassword(INITIAL_USER_PASSWORD);
+
+    user = await prisma.user.create({
+      data: {
+        name: INITIAL_USER_NAME ? INITIAL_USER_NAME : 'Admin',
+        email: INITIAL_USER_EMAIL,
+        emailVerified: true,
+        accounts: {
+          create: {
+            accountId: INITIAL_USER_EMAIL,
+            providerId: 'credential',
+            password: passwordHash,
+          },
+        },
+      },
+    });
+
+    console.info(
+      `Seeded user "${INITIAL_USER_EMAIL}" with roles "${INITIAL_USER_ROLES.join(', ')}"`,
+    );
+  }
+
+  await prisma.userRole.createMany({
+    data: INITIAL_USER_ROLES.map((role) => ({
+      userId: user.id,
+      role,
+    })),
+    skipDuplicates: true,
+  });
+
+  return user;
+}