@better-auth/infra 0.2.8 → 0.2.9

package/dist/index.mjs

@@ -1210,7 +1210,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				return "";
 			}
 		},
-		async checkImpossibleTravel(userId, currentLocation, visitorId) {
+		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null) {
 			if (!options.impossibleTravel?.enabled || !currentLocation) return null;
 			try {
 				const data = await $api("/security/impossible-travel", {
@@ -1219,6 +1219,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 						userId,
 						visitorId,
 						location: currentLocation,
+						ip,
 						config: options
 					}
 				});
@@ -1249,14 +1250,15 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 		/**
 		* Store user's last known location for impossible travel detection
 		*/
-		async storeLastLocation(userId, location) {
-			if (!location) return;
+		async storeLastLocation(userId, location, ip = null) {
+			if (!options.impossibleTravel?.enabled || !location) return;
 			try {
 				await $api("/security/store-last-login", {
 					method: "POST",
 					body: {
 						userId,
-						location
+						location,
+						ip
 					}
 				});
 			} catch (error) {
@@ -1497,7 +1499,9 @@ const all = new Set([
 	"/send-verification-email",
 	"/change-email",
 	"/organization/invite-member",
-	"/dash/organization/invite-member"
+	"/dash/organization/invite-member",
+	"/dash/create-user",
+	"/dash/update-user"
 ]);
 /**
 * Path is one of `[
@@ -1516,7 +1520,9 @@ const all = new Set([
 *   '/send-verification-email',
 *   '/change-email',
 *   '/organization/invite-member',
-*   '/dash/organization/invite-member'
+*   '/dash/organization/invite-member',
+*   '/dash/create-user',
+*   '/dash/update-user'
 * ]`.
 * @param context Request context
 * @param context.path Request path
@@ -2088,33 +2094,42 @@ const sentinel = (options) => {
 				emailValidation: opts.security?.emailValidation,
 				emailNormalization: opts.security?.emailNormalization,
 				databaseHooks: {
-					user: { create: {
-						async before(user, ctx) {
-							if (!ctx) return;
-							const visitorId = ctx.context.visitorId;
-							if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
-								recordCheck(ctx, "free_trial_abuse");
-								const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
-								if (abuseCheck.isAbuse && abuseCheck.action === "block") {
-									setOutcome(ctx, "blocked", "free_trial_abuse", {
-										accountCount: abuseCheck.accountCount,
-										maxAccounts: abuseCheck.maxAccounts
-									});
-									emitEvaluation(ctx, trackEvent);
-									throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+					user: {
+						create: {
+							async before(user, ctx) {
+								if (!ctx) return;
+								const visitorId = ctx.context.visitorId;
+								if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
+									recordCheck(ctx, "free_trial_abuse");
+									const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
+									if (abuseCheck.isAbuse && abuseCheck.action === "block") {
+										setOutcome(ctx, "blocked", "free_trial_abuse", {
+											accountCount: abuseCheck.accountCount,
+											maxAccounts: abuseCheck.maxAccounts
+										});
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+									}
 								}
+								if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
+									...user,
+									email: normalizeEmail(user.email, ctx.context)
+								} };
+							},
+							async after(user, ctx) {
+								if (!ctx) return;
+								const visitorId = ctx.context.visitorId;
+								if (visitorId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.trackFreeTrialSignup(visitorId, user.id));
 							}
+						},
+						update: { async before(user, ctx) {
+							if (!ctx) return;
 							if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 								...user,
 								email: normalizeEmail(user.email, ctx.context)
 							} };
-						},
-						async after(user, ctx) {
-							if (!ctx) return;
-							const visitorId = ctx.context.visitorId;
-							if (visitorId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.trackFreeTrialSignup(visitorId, user.id));
-						}
-					} },
+						} }
+					},
 					session: { create: {
 						async before(session, ctx) {
 							if (!ctx) return;
@@ -2122,7 +2137,7 @@ const sentinel = (options) => {
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
 								recordCheck(ctx, "impossible_travel");
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId);
+								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip);
 								if (travelCheck?.isImpossible) {
 									if (travelCheck.action === "block") {
 										setOutcome(ctx, "blocked", "impossible_travel", {
@@ -2201,7 +2216,7 @@ const sentinel = (options) => {
 									}
 								}
 							}
-							if (identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location));
+							if (opts.security?.impossibleTravel?.enabled && identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location, identification.ip));
 						}
 					} }
 				}
@@ -2779,7 +2794,7 @@ const jwtValidateMiddleware = (options) => {
 };
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.8";
+const PLUGIN_VERSION = "0.2.9";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3794,13 +3809,13 @@ const completeInvitation = (options) => {
 * Used by the platform to verify before sending invitation
 * This is different from /dash/organization/check-user-by-email which also checks membership
 */
-const checkUserExists = (_options) => {
+const checkUserExists = (options) => {
 	return createAuthEndpoint("/dash/check-user-exists", {
 		method: "POST",
+		use: [jwtMiddleware(options)],
 		body: z$1.object({ email: z$1.email() })
 	}, async (ctx) => {
 		const { email } = ctx.body;
-		if (!ctx.request?.headers.get("Authorization")) throw new APIError("UNAUTHORIZED", { message: "Authorization required" });
 		const normalizedEmail = normalizeEmail(email, ctx.context);
 		const existingUser = await ctx.context.internalAdapter.findUserByEmail(normalizedEmail).then((user) => user?.user);
 		return {
@@ -4411,6 +4426,121 @@ async function withConcurrency(items, fn, options) {
 	return results;
 }
 //#endregion
+//#region src/routes/organizations/schemas.ts
+const DENIED_ORG_WRITE_KEYS = new Set([
+	"id",
+	"createdAt",
+	"updatedAt"
+]);
+const CREATE_NON_PERSISTED_KEYS = new Set(["defaultTeamName"]);
+const CREATE_REQUEST_ONLY_KEYS = new Set(["userId", "skipDefaultTeam"]);
+const CORE_CREATE_KEYS = [
+	"name",
+	"slug",
+	"logo"
+];
+const CORE_UPDATE_KEYS = [
+	"name",
+	"slug",
+	"logo",
+	"metadata"
+];
+function getOrganizationAdditionalFields(orgOptions) {
+	return orgOptions?.schema?.organization?.additionalFields ?? {};
+}
+function getWritableOrganizationAdditionalFieldNames(orgOptions) {
+	const additional = getOrganizationAdditionalFields(orgOptions);
+	return Object.entries(additional).filter(([, field]) => {
+		return field.input !== false;
+	}).map(([name]) => name);
+}
+function getWritableOrganizationFieldNames(orgOptions, mode) {
+	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS : CORE_UPDATE_KEYS);
+	for (const name of getWritableOrganizationAdditionalFieldNames(orgOptions)) keys.add(name);
+	return keys;
+}
+/**
+* Returns only organization fields that may be persisted on create/update.
+* Strips unknown keys, denied keys, and create-only request fields.
+*/
+function pickWritableOrganizationFields(body, orgOptions, mode) {
+	const allowed = getWritableOrganizationFieldNames(orgOptions, mode);
+	const skip = new Set([
+		...DENIED_ORG_WRITE_KEYS,
+		...mode === "create" ? CREATE_NON_PERSISTED_KEYS : [],
+		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
+	]);
+	const result = {};
+	for (const [key, value] of Object.entries(body)) {
+		if (skip.has(key) || !allowed.has(key) || value === void 0) continue;
+		result[key] = value;
+	}
+	return result;
+}
+const BaseCreateOrgCoreBodySchema = z$1.object({
+	name: z$1.string(),
+	slug: z$1.string(),
+	logo: z$1.string().optional(),
+	defaultTeamName: z$1.string().optional()
+});
+const BaseUpdateOrgCoreBodySchema = z$1.object({
+	logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+	name: z$1.string().optional(),
+	slug: z$1.string().optional(),
+	metadata: z$1.string().optional()
+});
+const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z$1.unknown());
+const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z$1.unknown());
+function createSchemaForDBField(field) {
+	switch (field.type) {
+		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
+		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
+		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
+		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+	}
+}
+/**
+* Validates required core + configured additional fields on create.
+* Call after pickWritableOrgFields if you need required additional field checks.
+*/
+function validateWritableCreateOrganizationFields(data, options) {
+	const shape = {
+		name: z$1.string().min(1),
+		slug: z$1.string().min(1),
+		logo: z$1.string().optional()
+	};
+	const additional = getOrganizationAdditionalFields(options);
+	for (const [name, field] of Object.entries(additional)) {
+		if (field.input === false) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+/**
+* Ensures at least one field is present on update and validates additional field types.
+*/
+function validateWritableOrganizationUpdateFields(data, orgOptions) {
+	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+		code: "custom",
+		message: "No valid fields to update",
+		path: []
+	}]);
+	const shape = {
+		name: z$1.string().min(1).optional(),
+		slug: z$1.string().min(1).optional(),
+		logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+		metadata: z$1.string().optional()
+	};
+	const additional = getOrganizationAdditionalFields(orgOptions);
+	for (const [name, field] of Object.entries(additional)) {
+		if (field.input === false) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).partial().strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+//#endregion
 //#region src/routes/organizations/organization.ts
 const listOrganizations = (options) => {
 	return createAuthEndpoint("/dash/list-organizations", {
@@ -4729,15 +4859,11 @@ const createOrganization = (options) => {
 			userId: z$1.string(),
 			skipDefaultTeam: z$1.boolean().optional().default(false)
 		}))],
-		body: z$1.looseObject({
-			name: z$1.string(),
-			slug: z$1.string(),
-			logo: z$1.string().optional(),
-			defaultTeamName: z$1.string().optional()
-		})
+		body: CreateOrganizationBodySchema
 	}, async (ctx) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { userId } = ctx.context.payload;
+		const defaultTeamName = ctx.body.defaultTeamName;
 		const user = await ctx.context.adapter.findOne({
 			model: "user",
 			where: [{
@@ -4753,10 +4879,13 @@ const createOrganization = (options) => {
 				value: ctx.body.slug
 			}]
 		}) > 0) throw ctx.error("BAD_REQUEST", { message: "Organization already exists" });
-		let orgData = {
-			...ctx.body,
-			defaultTeamName: void 0
-		};
+		let orgData = pickWritableOrganizationFields(ctx.body, orgOptions, "create");
+		try {
+			validateWritableCreateOrganizationFields(orgData, orgOptions);
+		} catch (error) {
+			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			throw error;
+		}
 		if (orgOptions.organizationCreation?.beforeCreate) {
 			const response = await orgOptions.organizationCreation.beforeCreate({
 				organization: {
@@ -4765,20 +4894,20 @@ const createOrganization = (options) => {
 				},
 				user
 			}, ctx.request);
-			if (response && typeof response === "object" && "data" in response) orgData = {
+			if (response && typeof response === "object" && "data" in response) orgData = pickWritableOrganizationFields({
 				...orgData,
 				...response.data
-			};
+			}, orgOptions, "create");
 		}
 		if (orgOptions?.organizationHooks?.beforeCreateOrganization) {
 			const response = await orgOptions?.organizationHooks.beforeCreateOrganization({
 				organization: orgData,
 				user
 			});
-			if (response && typeof response === "object" && "data" in response) orgData = {
+			if (response && typeof response === "object" && "data" in response) orgData = pickWritableOrganizationFields({
 				...orgData,
 				...response.data
-			};
+			}, orgOptions, "create");
 		}
 		const organization = await ctx.context.adapter.create({
 			model: "organization",
@@ -4827,7 +4956,7 @@ const createOrganization = (options) => {
 		if (orgOptions?.teams?.enabled && orgOptions.teams.defaultTeam?.enabled !== false && !ctx.context.payload.skipDefaultTeam) {
 			let teamData = {
 				organizationId: organization.id,
-				name: ctx.body.defaultTeamName || `${organization.name}`,
+				name: defaultTeamName || `${organization.name}`,
 				createdAt: /* @__PURE__ */ new Date()
 			};
 			if (orgOptions?.organizationHooks?.beforeCreateTeam) {
@@ -4891,12 +5020,7 @@ const updateOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/update", {
 		method: "POST",
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.looseObject({
-			logo: z$1.url().optional(),
-			name: z$1.string().optional(),
-			slug: z$1.string().optional(),
-			metadata: z$1.string().optional()
-		})
+		body: UpdateOrganizationBodySchema
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
@@ -4931,7 +5055,13 @@ const updateOrganization = (options) => {
 		const owner = owners[0];
 		const updatedByUser = Array.isArray(owner.user) ? owner.user[0] : owner.user;
 		if (!updatedByUser) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
-		let updateData = { ...ctx.body };
+		let updateData = pickWritableOrganizationFields(ctx.body, orgOptions, "update");
+		try {
+			validateWritableOrganizationUpdateFields(updateData, orgOptions);
+		} catch (error) {
+			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			throw error;
+		}
 		if (typeof updateData.metadata === "string") try {
 			updateData.metadata = updateData.metadata === "" ? void 0 : JSON.parse(updateData.metadata);
 		} catch (parseError) {
@@ -4944,10 +5074,10 @@ const updateOrganization = (options) => {
 				user: updatedByUser,
 				member: owner
 			});
-			if (response && typeof response === "object" && "data" in response) updateData = {
+			if (response && typeof response === "object" && "data" in response) updateData = pickWritableOrganizationFields({
 				...updateData,
 				...response.data
-			};
+			}, orgOptions, "update");
 		}
 		const organization = await ctx.context.adapter.update({
 			model: "organization",

package/dist/native.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-B6U89e1S.mjs";
+import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-CZzJyRrV.mjs";
 import { BetterAuthClientPlugin } from "better-auth";
 
 //#region src/sentinel/native/client.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -64,19 +64,19 @@
     "@better-auth/scim": "catalog:",
     "@better-auth/sso": "catalog:",
     "@infra/mocks": "workspace:*",
-    "@types/bun": "latest",
+    "@types/bun": "catalog:",
     "@types/node": "catalog:",
     "better-auth": "catalog:",
     "expo-crypto": "^14.0.2",
     "happy-dom": "^20.9.0",
-    "msw": "^2.14.3",
-    "tsdown": "^0.21.10",
+    "msw": "catalog:",
+    "tsdown": "^0.22.0",
     "typescript": "catalog:",
     "zod": "catalog:"
   },
   "dependencies": {
-    "@better-fetch/fetch": "^1.1.21",
-    "better-call": "^1.3.3",
+    "@better-fetch/fetch": "catalog:",
+    "better-call": "catalog:",
     "jose": "^6.1.0",
     "libphonenumber-js": "^1.13.1"
   },