@delmaredigital/payload-better-auth 0.3.14 → 0.4.0

package/README.md

@@ -41,6 +41,7 @@ For additional documentation and references, visit: [https://deepwiki.com/delmar
 | `@payloadcms/next` | >= 3.69.0 |
 | `@payloadcms/ui` | >= 3.69.0 |
 | `better-auth` | >= 1.4.0 |
+| `@better-auth/passkey` | >= 1.4.18 (if using passkeys) |
 | `next` | >= 15.4.8 |
 | `react` | >= 19.2.1 |
 
@@ -48,6 +49,9 @@ For additional documentation and references, visit: [https://deepwiki.com/delmar
 
 ```bash
 pnpm add @delmaredigital/payload-better-auth better-auth
+
+# If using passkeys:
+pnpm add @better-auth/passkey
 ```
 
 ### Environment Variables
@@ -545,12 +549,14 @@ Payload auth strategy for Better Auth session validation.
 ```ts
 betterAuthStrategy({
   usersCollection: 'users',
+  idType: 'number', // default — coerces session field IDs for serial IDs
 })
 ```
 
 | Option | Type | Description |
 |--------|------|-------------|
 | `usersCollection` | `string` | The collection slug for users (default: `'users'`) |
+| `idType` | `'number' \| 'text'` | Coerces string IDs in session fields (`activeOrganizationId`, etc.) to numbers. Defaults to `'number'` matching the adapter default. Set to `'text'` for UUID IDs. |
 
 ### `getServerSession<TUser>(payload, headers)`
 
@@ -992,9 +998,7 @@ The adapter uses Better Auth's `createAdapterFactory` which is **schema-aware**
 | API Keys | `better-auth` (core) | Auto-generates apikeys collection |
 | Organizations | `better-auth` (core) | Auto-generates organizations, members, invitations |
 | Admin | `better-auth` (core) | Adds admin fields to users |
-| Passkey | Bundled | Auto-generates passkeys collection |
-
-**Note:** The `@better-auth/passkey` package is bundled with this package - no separate installation required.
+| Passkey | `@better-auth/passkey` (peer dep) | Auto-generates passkeys collection |
 
 ### Example: Core Plugins
 

package/dist/components/management/SecurityNavLinks.d.ts

@@ -11,7 +11,7 @@ export type SecurityNavLinksProps = {
 /**
  * Navigation links for security management features.
  * Rendered in admin sidebar via afterNavLinks injection.
- * Uses Payload's nav CSS classes for native styling.
+ * Uses Payload's NavGroup and nav CSS classes for native styling.
  *
  * Links are conditionally shown based on which Better Auth plugins are enabled.
  */

package/dist/components/management/SecurityNavLinks.js

@@ -1,92 +1,45 @@
 'use client';
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { NavGroup } from '@payloadcms/ui';
 /**
  * Navigation links for security management features.
  * Rendered in admin sidebar via afterNavLinks injection.
- * Uses Payload's nav CSS classes for native styling.
+ * Uses Payload's NavGroup and nav CSS classes for native styling.
  *
  * Links are conditionally shown based on which Better Auth plugins are enabled.
  */ export function SecurityNavLinks({ basePath = '/admin/security', showTwoFactor = true, showApiKeys = true, showPasskeys = true } = {}) {
-    // Build links based on enabled plugins
     const links = [];
     if (showTwoFactor) {
         links.push({
             href: `${basePath}/two-factor`,
-            label: 'Two-Factor Auth',
-            icon: '📱'
+            label: 'Two-Factor Auth'
         });
     }
     if (showApiKeys) {
         links.push({
             href: `${basePath}/api-keys`,
-            label: 'API Keys',
-            icon: '🔑'
+            label: 'API Keys'
         });
     }
     if (showPasskeys) {
         links.push({
             href: `${basePath}/passkeys`,
-            label: 'Passkeys',
-            icon: '🔐'
+            label: 'Passkeys'
         });
     }
-    // Don't render anything if no plugins are enabled
     if (links.length === 0) {
         return null;
     }
-    return /*#__PURE__*/ _jsxs("div", {
-        style: {
-            borderTop: '1px solid var(--theme-elevation-100)',
-            marginTop: 'var(--base)',
-            paddingTop: 'var(--base)'
-        },
-        children: [
-            /*#__PURE__*/ _jsx("div", {
-                style: {
-                    fontSize: '11px',
-                    fontWeight: 600,
-                    color: 'var(--theme-elevation-500)',
-                    padding: '0 calc(var(--base) * 0.75)',
-                    marginBottom: 'calc(var(--base) * 0.5)',
-                    textTransform: 'uppercase',
-                    letterSpacing: '0.5px'
-                },
-                children: "Security"
-            }),
-            links.map((link)=>/*#__PURE__*/ _jsxs("a", {
-                    href: link.href,
-                    className: "nav__link",
-                    style: {
-                        display: 'flex',
-                        alignItems: 'center',
-                        gap: 'calc(var(--base) * 0.5)',
-                        padding: 'calc(var(--base) * 0.5) calc(var(--base) * 0.75)',
-                        color: 'var(--theme-elevation-800)',
-                        textDecoration: 'none',
-                        fontSize: 'var(--font-size-small)',
-                        borderRadius: 'var(--style-radius-s)',
-                        transition: 'background-color 150ms ease'
-                    },
-                    onMouseEnter: (e)=>{
-                        e.currentTarget.style.backgroundColor = 'var(--theme-elevation-50)';
-                    },
-                    onMouseLeave: (e)=>{
-                        e.currentTarget.style.backgroundColor = 'transparent';
-                    },
-                    children: [
-                        /*#__PURE__*/ _jsx("span", {
-                            style: {
-                                fontSize: '14px'
-                            },
-                            children: link.icon
-                        }),
-                        /*#__PURE__*/ _jsx("span", {
-                            className: "nav__link-label",
-                            children: link.label
-                        })
-                    ]
-                }, link.href))
-        ]
+    return /*#__PURE__*/ _jsx(NavGroup, {
+        label: "Security",
+        children: links.map((link)=>/*#__PURE__*/ _jsx("a", {
+                href: link.href,
+                className: "nav__link",
+                children: /*#__PURE__*/ _jsx("span", {
+                    className: "nav__link-label",
+                    children: link.label
+                })
+            }, link.href))
     });
 }
 export default SecurityNavLinks;

package/dist/exports/client.d.ts

@@ -722,6 +722,8 @@ export declare const payloadAuthPlugins: readonly [{
                         responseHeaders?: Headers | undefined;
                     } & import("better-auth").PluginContext & import("better-auth").InfoContext & {
                         options: import("better-auth").BetterAuthOptions;
+                        appName: string;
+                        baseURL: string;
                         trustedOrigins: string[];
                         isTrustedOrigin: (url: string, settings?: {
                             allowRelativePaths: boolean;
@@ -790,8 +792,8 @@ export declare const payloadAuthPlugins: readonly [{
                         }) => Promise<void>;
                         skipOriginCheck: boolean | string[];
                         skipCSRFCheck: boolean;
-                        runInBackground: (promise: Promise<void>) => void;
-                        runInBackgroundOrAwait: (promise: Promise<unknown> | Promise<void> | void | unknown) => Promise<unknown>;
+                        runInBackground: (promise: Promise<unknown>) => void;
+                        runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("better-auth").Awaitable<unknown>;
                     }>;
                 }>;
             }[];

package/dist/plugin/index.d.ts

@@ -178,6 +178,17 @@ export type BetterAuthStrategyOptions = {
      * @default 'members'
      */
     membersCollection?: string;
+    /**
+     * ID type strategy matching your adapter's `adapterConfig.idType`.
+     *
+     * When `'number'` (default), coerces string IDs in session fields
+     * (e.g., `activeOrganizationId`) to numbers before merging onto `req.user`.
+     * Better Auth always returns string IDs from `api.getSession()`, but Payload
+     * relationship fields expect numbers when using serial IDs.
+     *
+     * @default 'number'
+     */
+    idType?: 'number' | 'text';
 };
 /**
  * Payload auth strategy that uses Better Auth for authentication.

package/dist/plugin/index.js

@@ -459,7 +459,7 @@ let apiKeyScopesConfig = undefined;
  * }
  * ```
  */ export function betterAuthStrategy(options = {}) {
-    const { usersCollection = 'users', membersCollection = 'members' } = options;
+    const { usersCollection = 'users', membersCollection = 'members', idType = 'number' } = options;
     return {
         name: 'better-auth',
         authenticate: async ({ payload, headers })=>{
@@ -498,6 +498,19 @@ let apiKeyScopesConfig = undefined;
                 // Extract session fields to merge onto user (e.g., activeOrganizationId from org plugin)
                 // Exclude fields that might conflict with user fields
                 const { id: _sessionId, userId: _userId, expiresAt: _expiresAt, token: _token, ...sessionFields } = sessionData.session || {};
+                // Coerce string IDs in session fields to numbers when using serial IDs.
+                // BA's api.getSession() always returns strings, but Payload relationship
+                // fields expect numbers for serial IDs.
+                if (idType === 'number') {
+                    for (const [key, value] of Object.entries(sessionFields)){
+                        if (typeof value !== 'string') continue;
+                        if (key === 'id' || /(?:Id|_id)$/.test(key)) {
+                            if (/^\d+$/.test(value)) {
+                                sessionFields[key] = parseInt(value, 10);
+                            }
+                        }
+                    }
+                }
                 // If there's an active organization, fetch the user's role in that org
                 let organizationRole;
                 if (sessionFields.activeOrganizationId) {

package/dist/utils/betterAuthDefaults.d.ts

@@ -89,6 +89,8 @@ export declare function apiKeyWithDefaults(options?: ApiKeyPluginOptions): {
                     responseHeaders?: Headers | undefined;
                 } & import("better-auth").PluginContext & import("better-auth").InfoContext & {
                     options: BetterAuthOptions;
+                    appName: string;
+                    baseURL: string;
                     trustedOrigins: string[];
                     isTrustedOrigin: (url: string, settings?: {
                         allowRelativePaths: boolean;
@@ -157,8 +159,8 @@ export declare function apiKeyWithDefaults(options?: ApiKeyPluginOptions): {
                     }) => Promise<void>;
                     skipOriginCheck: boolean | string[];
                     skipCSRFCheck: boolean;
-                    runInBackground: (promise: Promise<void>) => void;
-                    runInBackgroundOrAwait: (promise: Promise<unknown> | Promise<void> | void | unknown) => Promise<unknown>;
+                    runInBackground: (promise: Promise<unknown>) => void;
+                    runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("better-auth").Awaitable<unknown>;
                 }>;
             }>;
         }[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-better-auth",
-  "version": "0.3.14",
+  "version": "0.4.0",
   "description": "Better Auth adapter and plugins for Payload CMS",
   "type": "module",
   "license": "MIT",
@@ -74,10 +74,8 @@
     "test:coverage": "vitest run --coverage",
     "prepublishOnly": "pnpm build"
   },
-  "dependencies": {
-    "@better-auth/passkey": "^1.4.17"
-  },
   "peerDependencies": {
+    "@better-auth/passkey": ">=1.4.18",
     "@payloadcms/next": ">=3.69.0",
     "@payloadcms/ui": ">=3.69.0",
     "better-auth": ">=1.4.0",
@@ -85,17 +83,23 @@
     "payload": ">=3.69.0",
     "react": ">=19.2.1"
   },
+  "peerDependenciesMeta": {
+    "@better-auth/passkey": {
+      "optional": true
+    }
+  },
   "devDependencies": {
-    "@payloadcms/next": "^3.73.0",
-    "@payloadcms/ui": "^3.73.0",
+    "@payloadcms/next": "^3.76.1",
+    "@payloadcms/ui": "^3.76.1",
     "@swc/cli": "^0.6.0",
-    "@swc/core": "^1.10.18",
-    "@types/node": "^25.0.10",
-    "@types/react": "^19.2.9",
+    "@swc/core": "^1.15.11",
+    "@types/node": "^25.2.3",
+    "@types/react": "^19.2.14",
     "@vitest/coverage-v8": "^2.1.9",
-    "better-auth": "^1.4.17",
-    "next": "^16.1.4",
-    "payload": "^3.73.0",
+    "@better-auth/passkey": "^1.4.18",
+    "better-auth": "^1.4.18",
+    "next": "^16.1.6",
+    "payload": "^3.76.1",
     "react": "^19.2.4",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",