@better-auth/infra 0.2.7 → 0.2.9

package/dist/index.mjs

@@ -535,7 +535,7 @@ const initSessionEvents = (tracker) => {
 			eventData: {
 				userId: session.userId,
 				userName: user.name,
-				userEmail: user.email,
+				userEmail: user.email ?? "unknown",
 				sessionId: session.id,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
@@ -621,10 +621,10 @@ const initUserEvents = (tracker) => {
 		trackEvent({
 			eventKey: user.id,
 			eventType: EVENT_TYPES.USER_CREATED,
-			eventDisplayName: `${user.name || user.email} signed up`,
+			eventDisplayName: `${user.name || user.email || "unknown"} signed up`,
 			eventData: {
 				userId: user.id,
-				userEmail: user.email,
+				userEmail: user.email ?? "unknown",
 				userName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
@@ -642,7 +642,7 @@ const initUserEvents = (tracker) => {
 			eventDisplayName: "User deleted",
 			eventData: {
 				userId: user.id,
-				userEmail: user.email,
+				userEmail: user.email ?? "unknown",
 				userName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
@@ -660,7 +660,7 @@ const initUserEvents = (tracker) => {
 			eventDisplayName: "Profile updated",
 			eventData: {
 				userId: user.id,
-				userEmail: user.email,
+				userEmail: user.email ?? "unknown",
 				userName: user.name,
 				updatedFields: Object.keys(ctx?.body || {}),
 				triggeredBy: trigger.triggeredBy,
@@ -679,7 +679,7 @@ const initUserEvents = (tracker) => {
 			eventDisplayName: "Profile image updated",
 			eventData: {
 				userId: user.id,
-				userEmail: user.email,
+				userEmail: user.email ?? "unknown",
 				userName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
@@ -699,7 +699,7 @@ const initUserEvents = (tracker) => {
 			eventDisplayName: `User banned${reasonSuffix}${expiresSuffix}`,
 			eventData: {
 				userId: user.id,
-				userEmail: user.email,
+				userEmail: user.email ?? "unknown",
 				userName: user.name,
 				banned: user.banned,
 				banReason: user.banReason,
@@ -720,7 +720,7 @@ const initUserEvents = (tracker) => {
 			eventDisplayName: "User unbanned",
 			eventData: {
 				userId: user.id,
-				userEmail: user.email,
+				userEmail: user.email ?? "unknown",
 				userName: user.name,
 				banned: user.banned,
 				triggeredBy: trigger.triggeredBy,
@@ -739,7 +739,7 @@ const initUserEvents = (tracker) => {
 			eventDisplayName: "Email verified",
 			eventData: {
 				userId: user.id,
-				userEmail: user.email,
+				userEmail: user.email ?? "unknown",
 				userName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
@@ -1210,7 +1210,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				return "";
 			}
 		},
-		async checkImpossibleTravel(userId, currentLocation, visitorId) {
+		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null) {
 			if (!options.impossibleTravel?.enabled || !currentLocation) return null;
 			try {
 				const data = await $api("/security/impossible-travel", {
@@ -1219,6 +1219,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 						userId,
 						visitorId,
 						location: currentLocation,
+						ip,
 						config: options
 					}
 				});
@@ -1249,14 +1250,15 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 		/**
 		* Store user's last known location for impossible travel detection
 		*/
-		async storeLastLocation(userId, location) {
-			if (!location) return;
+		async storeLastLocation(userId, location, ip = null) {
+			if (!options.impossibleTravel?.enabled || !location) return;
 			try {
 				await $api("/security/store-last-login", {
 					method: "POST",
 					body: {
 						userId,
-						location
+						location,
+						ip
 					}
 				});
 			} catch (error) {
@@ -1497,7 +1499,9 @@ const all = new Set([
 	"/send-verification-email",
 	"/change-email",
 	"/organization/invite-member",
-	"/dash/organization/invite-member"
+	"/dash/organization/invite-member",
+	"/dash/create-user",
+	"/dash/update-user"
 ]);
 /**
 * Path is one of `[
@@ -1516,7 +1520,9 @@ const all = new Set([
 *   '/send-verification-email',
 *   '/change-email',
 *   '/organization/invite-member',
-*   '/dash/organization/invite-member'
+*   '/dash/organization/invite-member',
+*   '/dash/create-user',
+*   '/dash/update-user'
 * ]`.
 * @param context Request context
 * @param context.path Request path
@@ -2088,33 +2094,42 @@ const sentinel = (options) => {
 				emailValidation: opts.security?.emailValidation,
 				emailNormalization: opts.security?.emailNormalization,
 				databaseHooks: {
-					user: { create: {
-						async before(user, ctx) {
-							if (!ctx) return;
-							const visitorId = ctx.context.visitorId;
-							if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
-								recordCheck(ctx, "free_trial_abuse");
-								const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
-								if (abuseCheck.isAbuse && abuseCheck.action === "block") {
-									setOutcome(ctx, "blocked", "free_trial_abuse", {
-										accountCount: abuseCheck.accountCount,
-										maxAccounts: abuseCheck.maxAccounts
-									});
-									emitEvaluation(ctx, trackEvent);
-									throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+					user: {
+						create: {
+							async before(user, ctx) {
+								if (!ctx) return;
+								const visitorId = ctx.context.visitorId;
+								if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
+									recordCheck(ctx, "free_trial_abuse");
+									const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
+									if (abuseCheck.isAbuse && abuseCheck.action === "block") {
+										setOutcome(ctx, "blocked", "free_trial_abuse", {
+											accountCount: abuseCheck.accountCount,
+											maxAccounts: abuseCheck.maxAccounts
+										});
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+									}
 								}
+								if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
+									...user,
+									email: normalizeEmail(user.email, ctx.context)
+								} };
+							},
+							async after(user, ctx) {
+								if (!ctx) return;
+								const visitorId = ctx.context.visitorId;
+								if (visitorId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.trackFreeTrialSignup(visitorId, user.id));
 							}
+						},
+						update: { async before(user, ctx) {
+							if (!ctx) return;
 							if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 								...user,
 								email: normalizeEmail(user.email, ctx.context)
 							} };
-						},
-						async after(user, ctx) {
-							if (!ctx) return;
-							const visitorId = ctx.context.visitorId;
-							if (visitorId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.trackFreeTrialSignup(visitorId, user.id));
-						}
-					} },
+						} }
+					},
 					session: { create: {
 						async before(session, ctx) {
 							if (!ctx) return;
@@ -2122,7 +2137,7 @@ const sentinel = (options) => {
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
 								recordCheck(ctx, "impossible_travel");
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId);
+								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip);
 								if (travelCheck?.isImpossible) {
 									if (travelCheck.action === "block") {
 										setOutcome(ctx, "blocked", "impossible_travel", {
@@ -2201,7 +2216,7 @@ const sentinel = (options) => {
 									}
 								}
 							}
-							if (identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location));
+							if (opts.security?.impossibleTravel?.enabled && identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location, identification.ip));
 						}
 					} }
 				}
@@ -2356,7 +2371,7 @@ const initInvitationEvents = (tracker) => {
 				inviteeTeamId: invitation.teamId,
 				inviterId: inviter.id,
 				inviterName: inviter.name,
-				inviterEmail: inviter.email,
+				inviterEmail: inviter.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
 			}
@@ -2376,7 +2391,7 @@ const initInvitationEvents = (tracker) => {
 				inviteeRole: invitation.role,
 				inviteeTeamId: invitation.teamId,
 				acceptedById: acceptedBy.id,
-				acceptedByEmail: acceptedBy.email,
+				acceptedByEmail: acceptedBy.email ?? "unknown",
 				acceptedByName: acceptedBy.name,
 				memberId: member.id,
 				memberRole: member.role,
@@ -2399,7 +2414,7 @@ const initInvitationEvents = (tracker) => {
 				inviteeRole: invitation.role,
 				inviteeTeamId: invitation.teamId,
 				rejectedById: rejectedBy.id,
-				rejectedByEmail: rejectedBy.email,
+				rejectedByEmail: rejectedBy.email ?? "unknown",
 				rejectedByName: rejectedBy.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
@@ -2421,7 +2436,7 @@ const initInvitationEvents = (tracker) => {
 				inviteeTeamId: invitation.teamId,
 				cancelledById: cancelledBy.id,
 				cancelledByName: cancelledBy.name,
-				cancelledByEmail: cancelledBy.email,
+				cancelledByEmail: cancelledBy.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
 			}
@@ -2451,7 +2466,7 @@ const initMemberEvents = (tracker) => {
 				memberName: user.name,
 				role: member.role,
 				memberId: member.id,
-				memberEmail: user.email,
+				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
 			}
@@ -2470,7 +2485,7 @@ const initMemberEvents = (tracker) => {
 				memberName: user.name,
 				role: member.role,
 				memberId: member.id,
-				memberEmail: user.email,
+				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
 			}
@@ -2490,7 +2505,7 @@ const initMemberEvents = (tracker) => {
 				newRole: member.role,
 				oldRole: previousRole,
 				memberId: member.id,
-				memberEmail: user.email,
+				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
 			}
@@ -2779,7 +2794,7 @@ const jwtValidateMiddleware = (options) => {
 };
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.7";
+const PLUGIN_VERSION = "0.2.9";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3794,13 +3809,13 @@ const completeInvitation = (options) => {
 * Used by the platform to verify before sending invitation
 * This is different from /dash/organization/check-user-by-email which also checks membership
 */
-const checkUserExists = (_options) => {
+const checkUserExists = (options) => {
 	return createAuthEndpoint("/dash/check-user-exists", {
 		method: "POST",
+		use: [jwtMiddleware(options)],
 		body: z$1.object({ email: z$1.email() })
 	}, async (ctx) => {
 		const { email } = ctx.body;
-		if (!ctx.request?.headers.get("Authorization")) throw new APIError("UNAUTHORIZED", { message: "Authorization required" });
 		const normalizedEmail = normalizeEmail(email, ctx.context);
 		const existingUser = await ctx.context.internalAdapter.findUserByEmail(normalizedEmail).then((user) => user?.user);
 		return {
@@ -3837,7 +3852,7 @@ const listOrganizationInvitations = (options) => {
 				operator: "in"
 			}]
 		}) : [];
-		const userByEmail = new Map(users.map((u) => [normalizeEmail(u.email, ctx.context), u]));
+		const userByEmail = new Map(users.filter((u) => u.email != null).map((u) => [normalizeEmail(u.email, ctx.context), u]));
 		return invitations.map((invitation) => {
 			const invitationEmail = normalizeEmail(invitation.email, ctx.context);
 			const user = userByEmail.get(invitationEmail);
@@ -3846,7 +3861,7 @@ const listOrganizationInvitations = (options) => {
 				user: user ? {
 					id: user.id,
 					name: user.name,
-					email: user.email,
+					email: user.email ?? void 0,
 					image: user.image || null
 				} : null
 			};
@@ -3932,7 +3947,7 @@ const checkUserByEmail = (options) => {
 			user: {
 				id: user.id,
 				name: user.name,
-				email: user.email,
+				email: user.email ?? void 0,
 				image: user.image ?? null
 			},
 			isAlreadyMember: !!existingMember
@@ -4088,18 +4103,18 @@ const listOrganizationMembers = (options) => {
 		for (const m of members) {
 			const joinedUser = Array.isArray(m.user) ? m.user[0] : m.user;
 			if (!joinedUser) continue;
-			const invitation = invitationByEmail.get(joinedUser.email.toLowerCase());
+			const invitation = joinedUser.email ? invitationByEmail.get(joinedUser.email.toLowerCase()) : void 0;
 			const inviter = invitation ? inviterById.get(invitation.inviterId) : void 0;
 			const user = {
 				id: joinedUser.id,
-				email: joinedUser.email,
+				email: joinedUser.email ?? void 0,
 				name: joinedUser.name,
 				image: joinedUser.image ?? null
 			};
 			const invitedBy = inviter ? {
 				id: inviter.id,
 				name: inviter.name,
-				email: inviter.email,
+				email: inviter.email ?? void 0,
 				image: inviter.image ?? null
 			} : null;
 			result.push({
@@ -4411,6 +4426,121 @@ async function withConcurrency(items, fn, options) {
 	return results;
 }
 //#endregion
+//#region src/routes/organizations/schemas.ts
+const DENIED_ORG_WRITE_KEYS = new Set([
+	"id",
+	"createdAt",
+	"updatedAt"
+]);
+const CREATE_NON_PERSISTED_KEYS = new Set(["defaultTeamName"]);
+const CREATE_REQUEST_ONLY_KEYS = new Set(["userId", "skipDefaultTeam"]);
+const CORE_CREATE_KEYS = [
+	"name",
+	"slug",
+	"logo"
+];
+const CORE_UPDATE_KEYS = [
+	"name",
+	"slug",
+	"logo",
+	"metadata"
+];
+function getOrganizationAdditionalFields(orgOptions) {
+	return orgOptions?.schema?.organization?.additionalFields ?? {};
+}
+function getWritableOrganizationAdditionalFieldNames(orgOptions) {
+	const additional = getOrganizationAdditionalFields(orgOptions);
+	return Object.entries(additional).filter(([, field]) => {
+		return field.input !== false;
+	}).map(([name]) => name);
+}
+function getWritableOrganizationFieldNames(orgOptions, mode) {
+	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS : CORE_UPDATE_KEYS);
+	for (const name of getWritableOrganizationAdditionalFieldNames(orgOptions)) keys.add(name);
+	return keys;
+}
+/**
+* Returns only organization fields that may be persisted on create/update.
+* Strips unknown keys, denied keys, and create-only request fields.
+*/
+function pickWritableOrganizationFields(body, orgOptions, mode) {
+	const allowed = getWritableOrganizationFieldNames(orgOptions, mode);
+	const skip = new Set([
+		...DENIED_ORG_WRITE_KEYS,
+		...mode === "create" ? CREATE_NON_PERSISTED_KEYS : [],
+		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
+	]);
+	const result = {};
+	for (const [key, value] of Object.entries(body)) {
+		if (skip.has(key) || !allowed.has(key) || value === void 0) continue;
+		result[key] = value;
+	}
+	return result;
+}
+const BaseCreateOrgCoreBodySchema = z$1.object({
+	name: z$1.string(),
+	slug: z$1.string(),
+	logo: z$1.string().optional(),
+	defaultTeamName: z$1.string().optional()
+});
+const BaseUpdateOrgCoreBodySchema = z$1.object({
+	logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+	name: z$1.string().optional(),
+	slug: z$1.string().optional(),
+	metadata: z$1.string().optional()
+});
+const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z$1.unknown());
+const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z$1.unknown());
+function createSchemaForDBField(field) {
+	switch (field.type) {
+		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
+		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
+		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
+		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+	}
+}
+/**
+* Validates required core + configured additional fields on create.
+* Call after pickWritableOrgFields if you need required additional field checks.
+*/
+function validateWritableCreateOrganizationFields(data, options) {
+	const shape = {
+		name: z$1.string().min(1),
+		slug: z$1.string().min(1),
+		logo: z$1.string().optional()
+	};
+	const additional = getOrganizationAdditionalFields(options);
+	for (const [name, field] of Object.entries(additional)) {
+		if (field.input === false) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+/**
+* Ensures at least one field is present on update and validates additional field types.
+*/
+function validateWritableOrganizationUpdateFields(data, orgOptions) {
+	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+		code: "custom",
+		message: "No valid fields to update",
+		path: []
+	}]);
+	const shape = {
+		name: z$1.string().min(1).optional(),
+		slug: z$1.string().min(1).optional(),
+		logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+		metadata: z$1.string().optional()
+	};
+	const additional = getOrganizationAdditionalFields(orgOptions);
+	for (const [name, field] of Object.entries(additional)) {
+		if (field.input === false) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).partial().strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+//#endregion
 //#region src/routes/organizations/organization.ts
 const listOrganizations = (options) => {
 	return createAuthEndpoint("/dash/list-organizations", {
@@ -4542,8 +4672,8 @@ const listOrganizations = (options) => {
 				const members = organization.member.map((m) => userMap.get(m.userId)).filter((u) => u !== void 0).map((u) => ({
 					id: u.id,
 					name: u.name,
-					email: u.email,
-					image: u.image
+					email: u.email ?? void 0,
+					image: u.image ?? null
 				}));
 				const { member: _members, ...org } = organization;
 				return {
@@ -4729,15 +4859,11 @@ const createOrganization = (options) => {
 			userId: z$1.string(),
 			skipDefaultTeam: z$1.boolean().optional().default(false)
 		}))],
-		body: z$1.looseObject({
-			name: z$1.string(),
-			slug: z$1.string(),
-			logo: z$1.string().optional(),
-			defaultTeamName: z$1.string().optional()
-		})
+		body: CreateOrganizationBodySchema
 	}, async (ctx) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { userId } = ctx.context.payload;
+		const defaultTeamName = ctx.body.defaultTeamName;
 		const user = await ctx.context.adapter.findOne({
 			model: "user",
 			where: [{
@@ -4753,10 +4879,13 @@ const createOrganization = (options) => {
 				value: ctx.body.slug
 			}]
 		}) > 0) throw ctx.error("BAD_REQUEST", { message: "Organization already exists" });
-		let orgData = {
-			...ctx.body,
-			defaultTeamName: void 0
-		};
+		let orgData = pickWritableOrganizationFields(ctx.body, orgOptions, "create");
+		try {
+			validateWritableCreateOrganizationFields(orgData, orgOptions);
+		} catch (error) {
+			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			throw error;
+		}
 		if (orgOptions.organizationCreation?.beforeCreate) {
 			const response = await orgOptions.organizationCreation.beforeCreate({
 				organization: {
@@ -4765,20 +4894,20 @@ const createOrganization = (options) => {
 				},
 				user
 			}, ctx.request);
-			if (response && typeof response === "object" && "data" in response) orgData = {
+			if (response && typeof response === "object" && "data" in response) orgData = pickWritableOrganizationFields({
 				...orgData,
 				...response.data
-			};
+			}, orgOptions, "create");
 		}
 		if (orgOptions?.organizationHooks?.beforeCreateOrganization) {
 			const response = await orgOptions?.organizationHooks.beforeCreateOrganization({
 				organization: orgData,
 				user
 			});
-			if (response && typeof response === "object" && "data" in response) orgData = {
+			if (response && typeof response === "object" && "data" in response) orgData = pickWritableOrganizationFields({
 				...orgData,
 				...response.data
-			};
+			}, orgOptions, "create");
 		}
 		const organization = await ctx.context.adapter.create({
 			model: "organization",
@@ -4827,7 +4956,7 @@ const createOrganization = (options) => {
 		if (orgOptions?.teams?.enabled && orgOptions.teams.defaultTeam?.enabled !== false && !ctx.context.payload.skipDefaultTeam) {
 			let teamData = {
 				organizationId: organization.id,
-				name: ctx.body.defaultTeamName || `${organization.name}`,
+				name: defaultTeamName || `${organization.name}`,
 				createdAt: /* @__PURE__ */ new Date()
 			};
 			if (orgOptions?.organizationHooks?.beforeCreateTeam) {
@@ -4891,12 +5020,7 @@ const updateOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/update", {
 		method: "POST",
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.looseObject({
-			logo: z$1.url().optional(),
-			name: z$1.string().optional(),
-			slug: z$1.string().optional(),
-			metadata: z$1.string().optional()
-		})
+		body: UpdateOrganizationBodySchema
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
@@ -4931,7 +5055,13 @@ const updateOrganization = (options) => {
 		const owner = owners[0];
 		const updatedByUser = Array.isArray(owner.user) ? owner.user[0] : owner.user;
 		if (!updatedByUser) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
-		let updateData = { ...ctx.body };
+		let updateData = pickWritableOrganizationFields(ctx.body, orgOptions, "update");
+		try {
+			validateWritableOrganizationUpdateFields(updateData, orgOptions);
+		} catch (error) {
+			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			throw error;
+		}
 		if (typeof updateData.metadata === "string") try {
 			updateData.metadata = updateData.metadata === "" ? void 0 : JSON.parse(updateData.metadata);
 		} catch (parseError) {
@@ -4944,10 +5074,10 @@ const updateOrganization = (options) => {
 				user: updatedByUser,
 				member: owner
 			});
-			if (response && typeof response === "object" && "data" in response) updateData = {
+			if (response && typeof response === "object" && "data" in response) updateData = pickWritableOrganizationFields({
 				...updateData,
 				...response.data
-			};
+			}, orgOptions, "update");
 		}
 		const organization = await ctx.context.adapter.update({
 			model: "organization",
@@ -5285,7 +5415,7 @@ const listTeamMembers = (options) => {
 					user: user ? {
 						id: user.id,
 						name: user.name,
-						email: user.email,
+						email: user.email ?? void 0,
 						image: user.image ?? null
 					} : null
 				};
@@ -7365,6 +7495,7 @@ const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verifi
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
 	if (user.emailVerified) throw ctx.error("BAD_REQUEST", { message: "Email is already verified" });
+	if (!user.email) throw ctx.error("BAD_REQUEST", { message: "User has no associated email address" });
 	if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
 	await sendVerificationEmailFn({
 		...ctx,
@@ -7401,6 +7532,10 @@ const sendManyVerificationEmails = (options) => {
 			});
 			if (chunk.length - users.length > 0) for (const id of chunk.filter((id) => !users.some((u) => u.id === id))) skippedEmailUserIds.add(id);
 			for (const result of await Promise.allSettled(users.map(async (user) => {
+				if (!user.email) return {
+					success: false,
+					id: user.id
+				};
 				try {
 					await sendVerificationEmailFn({
 						...ctx,
@@ -7440,6 +7575,7 @@ const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset
 	const { userId } = ctx.context.payload;
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
+	if (!user.email) throw ctx.error("BAD_REQUEST", { message: "User has no associated email address" });
 	ctx.body.redirectTo = ctx.body.callbackUrl;
 	ctx.body.email = user.email;
 	return await requestPasswordReset(ctx);

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-B6U89e1S.mjs";
+import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-CZzJyRrV.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 
 //#region src/sentinel/native/client.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -64,21 +64,21 @@
     "@better-auth/scim": "catalog:",
     "@better-auth/sso": "catalog:",
     "@infra/mocks": "workspace:*",
-    "@types/bun": "latest",
+    "@types/bun": "catalog:",
     "@types/node": "catalog:",
     "better-auth": "catalog:",
     "expo-crypto": "^14.0.2",
     "happy-dom": "^20.9.0",
-    "msw": "^2.14.3",
-    "tsdown": "^0.21.10",
+    "msw": "catalog:",
+    "tsdown": "^0.22.0",
     "typescript": "catalog:",
     "zod": "catalog:"
   },
   "dependencies": {
-    "@better-fetch/fetch": "^1.1.21",
-    "better-call": "^1.3.3",
+    "@better-fetch/fetch": "catalog:",
+    "better-call": "catalog:",
     "jose": "^6.1.0",
-    "libphonenumber-js": "^1.12.42"
+    "libphonenumber-js": "^1.13.1"
   },
   "peerDependencies": {
     "better-auth": ">=1.4.0",