@convex-dev/better-auth 0.7.0-alpha.9 → 0.7.1

package/src/component/schema.ts

@@ -1,3 +1,7 @@
+// This file is auto-generated from auth.ts by generate-schema.ts. Do not edit this file manually.
+// To regenerate the schema, run:
+// npx tsx generate-schema.ts
+
 import { defineSchema, defineTable } from "convex/server";
 import { v } from "convex/values";
 
@@ -7,13 +11,23 @@ const schema = defineSchema({
     email: v.string(),
     emailVerified: v.boolean(),
     image: v.optional(v.string()),
-    twoFactorEnabled: v.optional(v.boolean()),
-    userId: v.string(),
     createdAt: v.number(),
     updatedAt: v.number(),
+    twoFactorEnabled: v.optional(v.boolean()),
+    isAnonymous: v.optional(v.boolean()),
+    username: v.optional(v.string()),
+    displayUsername: v.optional(v.string()),
+    phoneNumber: v.optional(v.string()),
+    phoneNumberVerified: v.optional(v.boolean()),
+    stripeCustomerId: v.optional(v.string()),
+    userId: v.optional(v.string()),
   })
+    .index("email_name", ["email","name"])
+    .index("name", ["name"])
+    .index("userId", ["userId"])
     .index("email", ["email"])
-    .index("userId", ["userId"]),
+    .index("username", ["username"])
+    .index("phoneNumber", ["phoneNumber"]),
 
   session: defineTable({
     expiresAt: v.number(),
@@ -23,11 +37,12 @@ const schema = defineSchema({
     ipAddress: v.optional(v.string()),
     userAgent: v.optional(v.string()),
     userId: v.string(),
+    activeOrganizationId: v.optional(v.string()),
   })
-    .index("token", ["token"])
-    .index("userId", ["userId"])
     .index("expiresAt", ["expiresAt"])
-    .index("userId_expiresAt", ["userId", "expiresAt"]),
+    .index("expiresAt_userId", ["expiresAt","userId"])
+    .index("token", ["token"])
+    .index("userId", ["userId"]),
 
   account: defineTable({
     accountId: v.string(),
@@ -43,34 +58,350 @@ const schema = defineSchema({
     createdAt: v.number(),
     updatedAt: v.number(),
   })
-    .index("userId", ["userId"])
     .index("accountId", ["accountId"])
-    .index("providerId_accountId", ["providerId", "accountId"])
-    .index("userId_providerId", ["userId", "providerId"]),
+    .index("accountId_providerId", ["accountId","providerId"])
+    .index("providerId_userId", ["providerId","userId"])
+    .index("userId", ["userId"]),
+
+  verification: defineTable({
+    identifier: v.string(),
+    value: v.string(),
+    expiresAt: v.number(),
+    createdAt: v.optional(v.number()),
+    updatedAt: v.optional(v.number()),
+  })
+    .index("expiresAt", ["expiresAt"])
+    .index("identifier", ["identifier"]),
 
   twoFactor: defineTable({
     secret: v.string(),
     backupCodes: v.string(),
     userId: v.string(),
-  }).index("userId", ["userId"]),
+  })
+    .index("userId", ["userId"]),
 
-  verification: defineTable({
-    identifier: v.string(),
-    value: v.string(),
-    expiresAt: v.number(),
+  passkey: defineTable({
+    name: v.optional(v.string()),
+    publicKey: v.string(),
+    userId: v.string(),
+    credentialID: v.string(),
+    counter: v.number(),
+    deviceType: v.string(),
+    backedUp: v.boolean(),
+    transports: v.optional(v.string()),
+    createdAt: v.optional(v.number()),
+    aaguid: v.optional(v.string()),
+  })
+    .index("credentialID", ["credentialID"])
+    .index("userId", ["userId"]),
+
+  apikey: defineTable({
+    name: v.optional(v.string()),
+    start: v.optional(v.string()),
+    prefix: v.optional(v.string()),
+    key: v.string(),
+    userId: v.string(),
+    refillInterval: v.optional(v.number()),
+    refillAmount: v.optional(v.number()),
+    lastRefillAt: v.optional(v.number()),
+    enabled: v.optional(v.boolean()),
+    rateLimitEnabled: v.optional(v.boolean()),
+    rateLimitTimeWindow: v.optional(v.number()),
+    rateLimitMax: v.optional(v.number()),
+    requestCount: v.optional(v.number()),
+    remaining: v.optional(v.number()),
+    lastRequest: v.optional(v.number()),
+    expiresAt: v.optional(v.number()),
+    createdAt: v.number(),
+    updatedAt: v.number(),
+    permissions: v.optional(v.string()),
+    metadata: v.optional(v.string()),
+  })
+    .index("key", ["key"])
+    .index("userId", ["userId"]),
+
+  oauthApplication: defineTable({
+    name: v.optional(v.string()),
+    icon: v.optional(v.string()),
+    metadata: v.optional(v.string()),
+    clientId: v.optional(v.string()),
+    clientSecret: v.optional(v.string()),
+    redirectURLs: v.optional(v.string()),
+    type: v.optional(v.string()),
+    disabled: v.optional(v.boolean()),
+    userId: v.optional(v.string()),
+    createdAt: v.optional(v.number()),
+    updatedAt: v.optional(v.number()),
+  })
+    .index("clientId", ["clientId"]),
+
+  oauthAccessToken: defineTable({
+    accessToken: v.optional(v.string()),
+    refreshToken: v.optional(v.string()),
+    accessTokenExpiresAt: v.optional(v.number()),
+    refreshTokenExpiresAt: v.optional(v.number()),
+    clientId: v.optional(v.string()),
+    userId: v.optional(v.string()),
+    scopes: v.optional(v.string()),
+    createdAt: v.optional(v.number()),
+    updatedAt: v.optional(v.number()),
+  })
+    .index("accessToken", ["accessToken"])
+    .index("refreshToken", ["refreshToken"]),
+
+  oauthConsent: defineTable({
+    clientId: v.optional(v.string()),
+    userId: v.optional(v.string()),
+    scopes: v.optional(v.string()),
     createdAt: v.optional(v.number()),
     updatedAt: v.optional(v.number()),
+    consentGiven: v.optional(v.boolean()),
+  })
+    .index("clientId_userId", ["clientId","userId"]),
+
+  organization: defineTable({
+    name: v.string(),
+    slug: v.optional(v.string()),
+    logo: v.optional(v.string()),
+    createdAt: v.number(),
+    metadata: v.optional(v.string()),
+  })
+    .index("name", ["name"])
+    .index("slug", ["slug"]),
+
+  member: defineTable({
+    organizationId: v.string(),
+    userId: v.string(),
+    role: v.string(),
+    teamId: v.optional(v.string()),
+    createdAt: v.number(),
+  })
+    .index("organizationId_userId", ["organizationId","userId"])
+    .index("organizationId", ["organizationId"])
+    .index("userId", ["userId"])
+    .index("role", ["role"])
+    .index("teamId", ["teamId"]),
+
+  invitation: defineTable({
+    organizationId: v.string(),
+    email: v.string(),
+    role: v.optional(v.string()),
+    teamId: v.optional(v.string()),
+    status: v.string(),
+    expiresAt: v.number(),
+    inviterId: v.string(),
+  })
+    .index("email_organizationId_status", ["email","organizationId","status"])
+    .index("organizationId_status", ["organizationId","status"])
+    .index("organizationId", ["organizationId"])
+    .index("email", ["email"])
+    .index("role", ["role"])
+    .index("teamId", ["teamId"])
+    .index("status", ["status"])
+    .index("inviterId", ["inviterId"]),
+
+  team: defineTable({
+    name: v.string(),
+    organizationId: v.string(),
+    createdAt: v.number(),
+    updatedAt: v.optional(v.number()),
   })
-    .index("identifier", ["identifier"])
-    .index("expiresAt", ["expiresAt"]),
+    .index("organizationId", ["organizationId"]),
+
+  ssoProvider: defineTable({
+    issuer: v.string(),
+    oidcConfig: v.optional(v.string()),
+    samlConfig: v.optional(v.string()),
+    userId: v.optional(v.string()),
+    providerId: v.string(),
+    organizationId: v.optional(v.string()),
+    domain: v.string(),
+  })
+    .index("organizationId", ["organizationId"])
+    .index("domain", ["domain"])
+    .index("userId", ["userId"])
+    .index("providerId", ["providerId"]),
 
   jwks: defineTable({
     publicKey: v.string(),
     privateKey: v.string(),
     createdAt: v.number(),
-    // no longer used
-    id: v.optional(v.string()),
   }),
+
+  subscription: defineTable({
+    plan: v.string(),
+    referenceId: v.string(),
+    stripeCustomerId: v.optional(v.string()),
+    stripeSubscriptionId: v.optional(v.string()),
+    status: v.optional(v.string()),
+    periodStart: v.optional(v.number()),
+    periodEnd: v.optional(v.number()),
+    cancelAtPeriodEnd: v.optional(v.boolean()),
+    seats: v.optional(v.number()),
+  })
+    .index("stripeSubscriptionId", ["stripeSubscriptionId"])
+    .index("stripeCustomerId", ["stripeCustomerId"])
+    .index("referenceId", ["referenceId"]),
+
+  rateLimit: defineTable({
+    key: v.optional(v.string()),
+    count: v.optional(v.number()),
+    lastRequest: v.optional(v.number()),
+  })
+    .index("key", ["key"]),
+
 });
 
 export default schema;
+
+export const specialFields = {
+  user: {
+    name: {
+      sortable: true
+    },
+    email: {
+      sortable: true,
+      unique: true
+    },
+    username: {
+      sortable: true,
+      unique: true
+    },
+    phoneNumber: {
+      sortable: true,
+      unique: true
+    }
+  },
+  session: {
+    token: {
+      unique: true
+    },
+    userId: {
+      references: {
+        model: "user",
+        field: "id",
+        onDelete: "cascade"
+      }
+    }
+  },
+  account: {
+    userId: {
+      references: {
+        model: "user",
+        field: "id",
+        onDelete: "cascade"
+      }
+    }
+  },
+  twoFactor: {
+    userId: {
+      references: {
+        model: "user",
+        field: "id"
+      }
+    }
+  },
+  passkey: {
+    userId: {
+      references: {
+        model: "user",
+        field: "id"
+      }
+    }
+  },
+  apikey: {
+    userId: {
+      references: {
+        model: "user",
+        field: "id"
+      }
+    }
+  },
+  oauthApplication: {
+    clientId: {
+      unique: true
+    }
+  },
+  oauthAccessToken: {
+    accessToken: {
+      unique: true
+    },
+    refreshToken: {
+      unique: true
+    }
+  },
+  organization: {
+    name: {
+      sortable: true
+    },
+    slug: {
+      sortable: true,
+      unique: true
+    }
+  },
+  member: {
+    organizationId: {
+      references: {
+        model: "organization",
+        field: "id"
+      }
+    },
+    userId: {
+      references: {
+        model: "user",
+        field: "id"
+      }
+    },
+    role: {
+      sortable: true
+    },
+    teamId: {
+      sortable: true
+    }
+  },
+  invitation: {
+    organizationId: {
+      references: {
+        model: "organization",
+        field: "id"
+      }
+    },
+    email: {
+      sortable: true
+    },
+    role: {
+      sortable: true
+    },
+    teamId: {
+      sortable: true
+    },
+    status: {
+      sortable: true
+    },
+    inviterId: {
+      references: {
+        model: "user",
+        field: "id"
+      }
+    }
+  },
+  team: {
+    organizationId: {
+      references: {
+        model: "organization",
+        field: "id"
+      }
+    }
+  },
+  ssoProvider: {
+    userId: {
+      references: {
+        model: "user",
+        field: "id"
+      }
+    },
+    providerId: {
+      unique: true
+    }
+  }
+};

package/src/nextjs/index.ts

@@ -3,23 +3,9 @@ import { createCookieGetter } from "better-auth/cookies";
 import { GenericActionCtx } from "convex/server";
 import { JWT_COOKIE_NAME } from "../plugins/convex";
 
-const requireBaseURL = (
-  createAuth: (ctx: GenericActionCtx<any>) => ReturnType<typeof betterAuth>
-) => {
-  if (!createAuth({} as any).options.baseURL) {
-    throw new Error(
-      "No baseURL found in Better Auth config. baseUrl should be set to your Convex Site URL."
-    );
-  }
-  return createAuth({} as any).options.baseURL;
-};
-
 export const getToken = async (
   createAuth: (ctx: GenericActionCtx<any>) => ReturnType<typeof betterAuth>
 ) => {
-  // Require baseURL here because it's protocol determines cookie secure mode,
-  // and must be set to ensure cookies work between Next.js and Convex.
-  requireBaseURL(createAuth);
   const { cookies } = await import("next/headers");
   const cookieStore = await cookies();
   const auth = createAuth({} as any);
@@ -33,6 +19,9 @@ const handler = (request: Request, opts?: { convexSiteUrl?: string }) => {
   const requestUrl = new URL(request.url);
   const convexSiteUrl =
     opts?.convexSiteUrl ?? process.env.NEXT_PUBLIC_CONVEX_SITE_URL;
+  if (!convexSiteUrl) {
+    throw new Error("NEXT_PUBLIC_CONVEX_SITE_URL is not set");
+  }
   const nextUrl = `${convexSiteUrl}${requestUrl.pathname}${requestUrl.search}`;
   const newRequest = new Request(nextUrl, request);
   newRequest.headers.set("accept-encoding", "application/json");

package/src/plugins/convex/index.ts

@@ -51,7 +51,7 @@ export const convex = (
         return session.user.userId;
       },
       // eslint-disable-next-line @typescript-eslint/no-unused-vars
-      definePayload: ({ user: { id, userId, ...user }, session }) => ({
+      definePayload: ({ user: { id, userId, image, ...user }, session }) => ({
         ...user,
         sessionId: session.id,
       }),
@@ -144,7 +144,10 @@ export const convex = (
         },
         {
           matcher: (ctx) => {
-            return ctx.path?.startsWith("/sign-out");
+            return (
+              ctx.path?.startsWith("/sign-out") ||
+              ctx.path?.startsWith("/delete-user")
+            );
           },
           handler: createAuthMiddleware(async (ctx) => {
             const jwtCookie = ctx.context.createAuthCookie(JWT_COOKIE_NAME, {

package/src/plugins/cross-domain/index.ts

@@ -21,6 +21,13 @@ export const crossDomain = ({ siteUrl }: { siteUrl: string }) => {
 
   return {
     id: "cross-domain",
+    init(ctx) {
+      return {
+        options: {
+          trustedOrigins: [siteUrl],
+        },
+      };
+    },
     hooks: {
       before: [
         {
@@ -52,12 +59,22 @@ export const crossDomain = ({ siteUrl }: { siteUrl: string }) => {
             };
           }),
         },
+        {
+          matcher: (ctx) => {
+            return ctx.method === "GET" && ctx.path.startsWith("/verify-email");
+          },
+          handler: createAuthMiddleware(async (ctx) => {
+            if (ctx.query?.callbackURL) {
+              ctx.query.callbackURL = rewriteCallbackURL(ctx.query.callbackURL);
+            }
+            return { context: ctx };
+          }),
+        },
         {
           matcher: (ctx) => {
             return (
-              ctx.path.startsWith("/link-social") ||
+              (ctx.method === "POST" && ctx.path.startsWith("/link-social")) ||
               ctx.path.startsWith("/send-verification-email") ||
-              ctx.path.startsWith("/verify-email") ||
               ctx.path.startsWith("/sign-in/email") ||
               ctx.path.startsWith("/sign-in/social") ||
               ctx.path.startsWith("/sign-in/magic-link") ||
@@ -149,8 +166,5 @@ export const crossDomain = ({ siteUrl }: { siteUrl: string }) => {
         }
       ),
     },
-    options: {
-      trustedOrigins: [siteUrl],
-    },
   } satisfies BetterAuthPlugin;
 };

package/src/react/client.tsx

@@ -27,7 +27,7 @@ export function useAuth() {
 }
 
 export type ConvexAuthClient = {
-  verbose: boolean | undefined;
+  verbose?: boolean;
   logger?: ConvexReactClient["logger"];
 };
 
@@ -64,7 +64,7 @@ export function AuthProvider({
   const { data: session, isPending: isSessionPending } =
     authClient.useSession();
 
-  const verbose: boolean = (client as any).options?.verbose ?? false;
+  const verbose: boolean = client.verbose ?? false;
   const logVerbose = useCallback(
     (message: string) => {
       if (verbose) {
@@ -128,17 +128,11 @@ export function AuthProvider({
     () => {
       // eslint-disable-next-line @typescript-eslint/no-floating-promises
       (async () => {
-        // Return early if cross domain plugin is not configured.
-        // Apparently there's no sane way to do this type check. Only the in
-        // keyword narrows the type effectively but it doesn't work on functions.
-        if (!(authClient as any)["crossDomain"]) {
-          return;
-        }
-        const authClientWithCrossDomain =
-          authClient as AuthClientWithPlugins<PluginsWithCrossDomain>;
-        const url = new URL(window.location.href);
+        const url = new URL(window.location?.href);
         const token = url.searchParams.get("ott");
         if (token) {
+          const authClientWithCrossDomain =
+            authClient as AuthClientWithPlugins<PluginsWithCrossDomain>;
           url.searchParams.delete("ott");
           const result =
             await authClientWithCrossDomain.crossDomain.oneTimeToken.verify({

package/src/react-start/index.ts

@@ -14,12 +14,15 @@ export const getCookieName = async (
 };
 
 const requireConvexSiteUrl = (
-  opts: { convexSiteUrl: string },
+  opts: { convexSiteUrl: string; verbose?: boolean },
   calledFrom: string
 ) => {
   if (!opts.convexSiteUrl) {
     throw new Error(`${calledFrom}: opts.convexSiteUrl is required`);
   }
+  if (opts.verbose) {
+    console.log(`${calledFrom}: opts.convexSiteUrl: ${opts.convexSiteUrl}`);
+  }
   return opts.convexSiteUrl;
 };