@delmaredigital/payload-better-auth 0.3.7 → 0.3.9

package/dist/utils/apiKeyAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiKeyAccess.js","sourceRoot":"","sources":["../../src/utils/apiKeyAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAwCH,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAmB;IAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,CAAC,CAAA;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAE5B,gCAAgC;IAChC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,0CAA0C;IAC1C,OAAO,UAAU,CAAC,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAmB,EACnB,MAAc,EACd,iBAAiB,GAAG,SAAS;IAE7B,IAAI,CAAC;QACH,yCAAyC;QACzC,IAAI,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YACnC,UAAU,EAAE,iBAAiB;YAC7B,KAAK,EAAE;gBACL,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBACvB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;aAC/B;YACD,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;SACT,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAEpB,qCAAqC;QACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;YACxE,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC/B,UAAU,EAAE,OAAO;gBACnB,KAAK,EAAE;oBACL,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oBACvB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;iBAC/B;gBACD,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC;aACT,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAQzB,CAAA;QAED,2EAA2E;QAC3E,IAAI,MAAM,GAAa,EAAE,CAAA;QACzB,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,MAAM,GAAG,MAAM,CAAA;gBACjB,CAAC;qBAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACtC,6CAA6C;oBAC7C,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;gBACxC,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;QACrB,CAAC;QAED,0DAA0D;QAC1D,IAAI,MAAc,CAAA;QAClB,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChF,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAA;QACb,CAAC;QAED,iBAAiB;QACjB,IAAI,QAA6C,CAAA;QACjD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;YACzB,CAAC;QACH,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM;YACN,MAAM;YACN,SAAS,EAAE,GAAG,CAAC,KAAK;YACpB,QAAQ;SACT,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAmB,EAAE,aAAqB;IACjE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9B,cAAc;QACd,IAAI,KAAK,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;QAExC,iDAAiD;QACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,uBAAuB;YACzD,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC;QAED,kBAAkB;QAClB,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAE9B,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,SAAmB,EAAE,cAAwB;IACvE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAmB,EAAE,cAAwB;IACxE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,SAA6B,EAAE;IAE/B,MAAM,EACJ,iBAAiB,GAAG,SAAS,EAC7B,uBAAuB,GAAG,KAAK,EAC/B,aAAa,GAAG,wBAAwB,GACzC,GAAG,MAAM,CAAA;IAEV,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,2EAA2E;QAC3E,IAAI,uBAAuB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAA,CAAC,qDAAqD;YACnE,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAA;QACd,CAAC;QAED,kBAAkB;QAClB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAA;QACd,CAAC;QAED,cAAc;QACd,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACxC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAgB,EAChB,SAA6B,EAAE;IAE/B,MAAM,EACJ,iBAAiB,GAAG,SAAS,EAC7B,uBAAuB,GAAG,KAAK,EAC/B,aAAa,GAAG,wBAAwB,GACzC,GAAG,MAAM,CAAA;IAEV,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,2EAA2E;QAC3E,IAAI,uBAAuB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5C,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAgB,EAChB,SAA6B,EAAE;IAE/B,MAAM,EACJ,iBAAiB,GAAG,SAAS,EAC7B,uBAAuB,GAAG,KAAK,EAC/B,aAAa,GAAG,wBAAwB,GACzC,GAAG,MAAM,CAAA;IAEV,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,2EAA2E;QAC3E,IAAI,uBAAuB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,SAA8D,EAAE;IAEhE,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAgB,EAChB,SAA8D,EAAE;IAEhE,OAAO,eAAe,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9E,CAAC;AAED,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAmB,EACnB,iBAAiB,GAAG,SAAS;IAE7B,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA;AACtD,CAAC"}
+{"version":3,"sources":["../../src/utils/apiKeyAccess.ts"],"sourcesContent":["/**\n * API Key Scope Enforcement Utilities\n *\n * These utilities help enforce API key scopes in Payload access control.\n * They extract the API key from requests, validate scopes, and provide\n * type-safe access control functions.\n *\n * @example\n * ```ts\n * import { requireScope, requireAnyScope } from '@delmaredigital/payload-better-auth'\n *\n * export const Posts: CollectionConfig = {\n *   slug: 'posts',\n *   access: {\n *     read: requireAnyScope(['posts:read', 'content:read']),\n *     create: requireScope('posts:write'),\n *     update: requireScope('posts:write'),\n *     delete: requireScope('posts:delete'),\n *   },\n * }\n * ```\n */\n\nimport type { Access, PayloadRequest } from 'payload'\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type ApiKeyInfo = {\n  /** The API key ID */\n  id: string\n  /** User ID who owns this key */\n  userId: string\n  /** Array of granted scope strings */\n  scopes: string[]\n  /** The raw key (only first/last chars visible) */\n  keyPrefix?: string\n  /** Optional metadata */\n  metadata?: Record<string, unknown>\n}\n\nexport type ApiKeyAccessConfig = {\n  /**\n   * API keys collection slug.\n   * @default 'apiKeys' or 'api-keys' (auto-detected)\n   */\n  apiKeysCollection?: string\n  /**\n   * Allow access if user is authenticated (non-API key session).\n   * Useful for allowing both API keys and regular sessions.\n   * @default false\n   */\n  allowAuthenticatedUsers?: boolean\n  /**\n   * Custom function to extract API key from request.\n   * By default, extracts from Authorization: Bearer <key> header.\n   */\n  extractApiKey?: (req: PayloadRequest) => string | null\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Extract API key from request headers.\n * Supports Bearer token format: Authorization: Bearer <api-key>\n */\nexport function extractApiKeyFromRequest(req: PayloadRequest): string | null {\n  const authHeader = req.headers?.get('authorization')\n  if (!authHeader) return null\n\n  // Support \"Bearer <key>\" format\n  if (authHeader.startsWith('Bearer ')) {\n    return authHeader.slice(7).trim()\n  }\n\n  // Support raw key in Authorization header\n  return authHeader.trim()\n}\n\n/**\n * Look up API key info from the database.\n * Returns null if key not found or disabled.\n */\nexport async function getApiKeyInfo(\n  req: PayloadRequest,\n  apiKey: string,\n  apiKeysCollection = 'apiKeys'\n): Promise<ApiKeyInfo | null> {\n  try {\n    // Try the provided collection name first\n    let results = await req.payload.find({\n      collection: apiKeysCollection,\n      where: {\n        key: { equals: apiKey },\n        enabled: { not_equals: false },\n      },\n      limit: 1,\n      depth: 0,\n    }).catch(() => null)\n\n    // If not found, try alternative slug\n    if (!results || results.docs.length === 0) {\n      const altSlug = apiKeysCollection === 'apiKeys' ? 'api-keys' : 'apiKeys'\n      results = await req.payload.find({\n        collection: altSlug,\n        where: {\n          key: { equals: apiKey },\n          enabled: { not_equals: false },\n        },\n        limit: 1,\n        depth: 0,\n      }).catch(() => null)\n    }\n\n    if (!results || results.docs.length === 0) {\n      return null\n    }\n\n    const doc = results.docs[0] as {\n      id: string | number\n      user?: string | number | { id: string | number }\n      userId?: string | number\n      permissions?: string\n      scopes?: string[]\n      start?: string\n      metadata?: string | Record<string, unknown>\n    }\n\n    // Parse scopes from permissions field (Better Auth format) or scopes array\n    let scopes: string[] = []\n    if (doc.permissions) {\n      try {\n        const parsed = JSON.parse(doc.permissions)\n        if (Array.isArray(parsed)) {\n          scopes = parsed\n        } else if (typeof parsed === 'object') {\n          // If it's an object, extract keys or flatten\n          scopes = Object.keys(parsed)\n        }\n      } catch {\n        // If not JSON, treat as comma-separated\n        scopes = doc.permissions.split(',').map((s) => s.trim()).filter(Boolean)\n      }\n    } else if (Array.isArray(doc.scopes)) {\n      scopes = doc.scopes\n    }\n\n    // Get user ID (handle both direct field and relationship)\n    let userId: string\n    if (doc.userId) {\n      userId = String(doc.userId)\n    } else if (doc.user) {\n      userId = typeof doc.user === 'object' ? String(doc.user.id) : String(doc.user)\n    } else {\n      return null\n    }\n\n    // Parse metadata\n    let metadata: Record<string, unknown> | undefined\n    if (doc.metadata) {\n      if (typeof doc.metadata === 'string') {\n        try {\n          metadata = JSON.parse(doc.metadata)\n        } catch {\n          // Ignore parse errors\n        }\n      } else {\n        metadata = doc.metadata\n      }\n    }\n\n    return {\n      id: String(doc.id),\n      userId,\n      scopes,\n      keyPrefix: doc.start,\n      metadata,\n    }\n  } catch {\n    return null\n  }\n}\n\n/**\n * Check if an API key has a specific scope.\n * Supports wildcard patterns like 'posts:*' matching 'posts:read', 'posts:write', etc.\n */\nexport function hasScope(keyScopes: string[], requiredScope: string): boolean {\n  return keyScopes.some((scope) => {\n    // Exact match\n    if (scope === requiredScope) return true\n\n    // Wildcard match: 'posts:*' matches 'posts:read'\n    if (scope.endsWith(':*')) {\n      const prefix = scope.slice(0, -1) // Remove '*', keep ':'\n      return requiredScope.startsWith(prefix)\n    }\n\n    // Global wildcard\n    if (scope === '*') return true\n\n    return false\n  })\n}\n\n/**\n * Check if an API key has any of the specified scopes.\n */\nexport function hasAnyScope(keyScopes: string[], requiredScopes: string[]): boolean {\n  return requiredScopes.some((scope) => hasScope(keyScopes, scope))\n}\n\n/**\n * Check if an API key has all of the specified scopes.\n */\nexport function hasAllScopes(keyScopes: string[], requiredScopes: string[]): boolean {\n  return requiredScopes.every((scope) => hasScope(keyScopes, scope))\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Access Control Functions\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Create an access control function that requires a specific scope.\n *\n * @param scope - The required scope string (e.g., 'posts:read')\n * @param config - Configuration options\n * @returns Payload access function\n *\n * @example\n * ```ts\n * access: {\n *   read: requireScope('posts:read'),\n *   create: requireScope('posts:write'),\n * }\n * ```\n */\nexport function requireScope(\n  scope: string,\n  config: ApiKeyAccessConfig = {}\n): Access {\n  const {\n    apiKeysCollection = 'apiKeys',\n    allowAuthenticatedUsers = false,\n    extractApiKey = extractApiKeyFromRequest,\n  } = config\n\n  return async ({ req }) => {\n    // If authenticated users are allowed and user is logged in without API key\n    if (allowAuthenticatedUsers && req.user) {\n      const apiKey = extractApiKey(req)\n      if (!apiKey) {\n        return true // User authenticated via session, no API key = allow\n      }\n    }\n\n    // Extract API key from request\n    const apiKey = extractApiKey(req)\n    if (!apiKey) {\n      return false\n    }\n\n    // Look up API key\n    const keyInfo = await getApiKeyInfo(req, apiKey, apiKeysCollection)\n    if (!keyInfo) {\n      return false\n    }\n\n    // Check scope\n    return hasScope(keyInfo.scopes, scope)\n  }\n}\n\n/**\n * Create an access control function that requires any of the specified scopes.\n *\n * @param scopes - Array of acceptable scopes (at least one must match)\n * @param config - Configuration options\n * @returns Payload access function\n *\n * @example\n * ```ts\n * access: {\n *   read: requireAnyScope(['posts:read', 'content:read', 'admin:*']),\n * }\n * ```\n */\nexport function requireAnyScope(\n  scopes: string[],\n  config: ApiKeyAccessConfig = {}\n): Access {\n  const {\n    apiKeysCollection = 'apiKeys',\n    allowAuthenticatedUsers = false,\n    extractApiKey = extractApiKeyFromRequest,\n  } = config\n\n  return async ({ req }) => {\n    // If authenticated users are allowed and user is logged in without API key\n    if (allowAuthenticatedUsers && req.user) {\n      const apiKey = extractApiKey(req)\n      if (!apiKey) {\n        return true\n      }\n    }\n\n    const apiKey = extractApiKey(req)\n    if (!apiKey) {\n      return false\n    }\n\n    const keyInfo = await getApiKeyInfo(req, apiKey, apiKeysCollection)\n    if (!keyInfo) {\n      return false\n    }\n\n    return hasAnyScope(keyInfo.scopes, scopes)\n  }\n}\n\n/**\n * Create an access control function that requires all specified scopes.\n *\n * @param scopes - Array of required scopes (all must be present)\n * @param config - Configuration options\n * @returns Payload access function\n *\n * @example\n * ```ts\n * access: {\n *   delete: requireAllScopes(['posts:delete', 'admin:write']),\n * }\n * ```\n */\nexport function requireAllScopes(\n  scopes: string[],\n  config: ApiKeyAccessConfig = {}\n): Access {\n  const {\n    apiKeysCollection = 'apiKeys',\n    allowAuthenticatedUsers = false,\n    extractApiKey = extractApiKeyFromRequest,\n  } = config\n\n  return async ({ req }) => {\n    // If authenticated users are allowed and user is logged in without API key\n    if (allowAuthenticatedUsers && req.user) {\n      const apiKey = extractApiKey(req)\n      if (!apiKey) {\n        return true\n      }\n    }\n\n    const apiKey = extractApiKey(req)\n    if (!apiKey) {\n      return false\n    }\n\n    const keyInfo = await getApiKeyInfo(req, apiKey, apiKeysCollection)\n    if (!keyInfo) {\n      return false\n    }\n\n    return hasAllScopes(keyInfo.scopes, scopes)\n  }\n}\n\n/**\n * Create an access control function that allows either:\n * 1. Authenticated users (via session)\n * 2. API key with required scope\n *\n * This is useful for endpoints that should work with both auth methods.\n *\n * @param scope - The required scope for API key access\n * @param config - Configuration options\n * @returns Payload access function\n *\n * @example\n * ```ts\n * access: {\n *   read: allowSessionOrScope('posts:read'),\n * }\n * ```\n */\nexport function allowSessionOrScope(\n  scope: string,\n  config: Omit<ApiKeyAccessConfig, 'allowAuthenticatedUsers'> = {}\n): Access {\n  return requireScope(scope, { ...config, allowAuthenticatedUsers: true })\n}\n\n/**\n * Create an access control function that allows either:\n * 1. Authenticated users (via session)\n * 2. API key with any of the required scopes\n *\n * @param scopes - Array of acceptable scopes for API key access\n * @param config - Configuration options\n * @returns Payload access function\n */\nexport function allowSessionOrAnyScope(\n  scopes: string[],\n  config: Omit<ApiKeyAccessConfig, 'allowAuthenticatedUsers'> = {}\n): Access {\n  return requireAnyScope(scopes, { ...config, allowAuthenticatedUsers: true })\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Better Auth Integration\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Validate an API key and get its info.\n *\n * This performs a database lookup to validate the key and retrieve\n * its associated scopes and user.\n *\n * @param req - Payload request\n * @param apiKeysCollection - The API keys collection slug\n * @returns API key info if valid, null otherwise\n *\n * @example\n * ```ts\n * const keyInfo = await validateApiKey(req)\n * if (keyInfo) {\n *   console.log('Valid API key for user:', keyInfo.userId)\n *   console.log('Scopes:', keyInfo.scopes)\n * }\n * ```\n */\nexport async function validateApiKey(\n  req: PayloadRequest,\n  apiKeysCollection = 'apiKeys'\n): Promise<ApiKeyInfo | null> {\n  const apiKey = extractApiKeyFromRequest(req)\n  if (!apiKey) return null\n  return getApiKeyInfo(req, apiKey, apiKeysCollection)\n}\n"],"names":["extractApiKeyFromRequest","req","authHeader","headers","get","startsWith","slice","trim","getApiKeyInfo","apiKey","apiKeysCollection","results","payload","find","collection","where","key","equals","enabled","not_equals","limit","depth","catch","docs","length","altSlug","doc","scopes","permissions","parsed","JSON","parse","Array","isArray","Object","keys","split","map","s","filter","Boolean","userId","String","user","id","metadata","keyPrefix","start","hasScope","keyScopes","requiredScope","some","scope","endsWith","prefix","hasAnyScope","requiredScopes","hasAllScopes","every","requireScope","config","allowAuthenticatedUsers","extractApiKey","keyInfo","requireAnyScope","requireAllScopes","allowSessionOrScope","allowSessionOrAnyScope","validateApiKey"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;CAqBC,GAwCD,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;CAGC,GACD,OAAO,SAASA,yBAAyBC,GAAmB;IAC1D,MAAMC,aAAaD,IAAIE,OAAO,EAAEC,IAAI;IACpC,IAAI,CAACF,YAAY,OAAO;IAExB,gCAAgC;IAChC,IAAIA,WAAWG,UAAU,CAAC,YAAY;QACpC,OAAOH,WAAWI,KAAK,CAAC,GAAGC,IAAI;IACjC;IAEA,0CAA0C;IAC1C,OAAOL,WAAWK,IAAI;AACxB;AAEA;;;CAGC,GACD,OAAO,eAAeC,cACpBP,GAAmB,EACnBQ,MAAc,EACdC,oBAAoB,SAAS;IAE7B,IAAI;QACF,yCAAyC;QACzC,IAAIC,UAAU,MAAMV,IAAIW,OAAO,CAACC,IAAI,CAAC;YACnCC,YAAYJ;YACZK,OAAO;gBACLC,KAAK;oBAAEC,QAAQR;gBAAO;gBACtBS,SAAS;oBAAEC,YAAY;gBAAM;YAC/B;YACAC,OAAO;YACPC,OAAO;QACT,GAAGC,KAAK,CAAC,IAAM;QAEf,qCAAqC;QACrC,IAAI,CAACX,WAAWA,QAAQY,IAAI,CAACC,MAAM,KAAK,GAAG;YACzC,MAAMC,UAAUf,sBAAsB,YAAY,aAAa;YAC/DC,UAAU,MAAMV,IAAIW,OAAO,CAACC,IAAI,CAAC;gBAC/BC,YAAYW;gBACZV,OAAO;oBACLC,KAAK;wBAAEC,QAAQR;oBAAO;oBACtBS,SAAS;wBAAEC,YAAY;oBAAM;gBAC/B;gBACAC,OAAO;gBACPC,OAAO;YACT,GAAGC,KAAK,CAAC,IAAM;QACjB;QAEA,IAAI,CAACX,WAAWA,QAAQY,IAAI,CAACC,MAAM,KAAK,GAAG;YACzC,OAAO;QACT;QAEA,MAAME,MAAMf,QAAQY,IAAI,CAAC,EAAE;QAU3B,2EAA2E;QAC3E,IAAII,SAAmB,EAAE;QACzB,IAAID,IAAIE,WAAW,EAAE;YACnB,IAAI;gBACF,MAAMC,SAASC,KAAKC,KAAK,CAACL,IAAIE,WAAW;gBACzC,IAAII,MAAMC,OAAO,CAACJ,SAAS;oBACzBF,SAASE;gBACX,OAAO,IAAI,OAAOA,WAAW,UAAU;oBACrC,6CAA6C;oBAC7CF,SAASO,OAAOC,IAAI,CAACN;gBACvB;YACF,EAAE,OAAM;gBACN,wCAAwC;gBACxCF,SAASD,IAAIE,WAAW,CAACQ,KAAK,CAAC,KAAKC,GAAG,CAAC,CAACC,IAAMA,EAAE/B,IAAI,IAAIgC,MAAM,CAACC;YAClE;QACF,OAAO,IAAIR,MAAMC,OAAO,CAACP,IAAIC,MAAM,GAAG;YACpCA,SAASD,IAAIC,MAAM;QACrB;QAEA,0DAA0D;QAC1D,IAAIc;QACJ,IAAIf,IAAIe,MAAM,EAAE;YACdA,SAASC,OAAOhB,IAAIe,MAAM;QAC5B,OAAO,IAAIf,IAAIiB,IAAI,EAAE;YACnBF,SAAS,OAAOf,IAAIiB,IAAI,KAAK,WAAWD,OAAOhB,IAAIiB,IAAI,CAACC,EAAE,IAAIF,OAAOhB,IAAIiB,IAAI;QAC/E,OAAO;YACL,OAAO;QACT;QAEA,iBAAiB;QACjB,IAAIE;QACJ,IAAInB,IAAImB,QAAQ,EAAE;YAChB,IAAI,OAAOnB,IAAImB,QAAQ,KAAK,UAAU;gBACpC,IAAI;oBACFA,WAAWf,KAAKC,KAAK,CAACL,IAAImB,QAAQ;gBACpC,EAAE,OAAM;gBACN,sBAAsB;gBACxB;YACF,OAAO;gBACLA,WAAWnB,IAAImB,QAAQ;YACzB;QACF;QAEA,OAAO;YACLD,IAAIF,OAAOhB,IAAIkB,EAAE;YACjBH;YACAd;YACAmB,WAAWpB,IAAIqB,KAAK;YACpBF;QACF;IACF,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA;;;CAGC,GACD,OAAO,SAASG,SAASC,SAAmB,EAAEC,aAAqB;IACjE,OAAOD,UAAUE,IAAI,CAAC,CAACC;QACrB,cAAc;QACd,IAAIA,UAAUF,eAAe,OAAO;QAEpC,iDAAiD;QACjD,IAAIE,MAAMC,QAAQ,CAAC,OAAO;YACxB,MAAMC,SAASF,MAAM9C,KAAK,CAAC,GAAG,CAAC,GAAG,uBAAuB;;YACzD,OAAO4C,cAAc7C,UAAU,CAACiD;QAClC;QAEA,kBAAkB;QAClB,IAAIF,UAAU,KAAK,OAAO;QAE1B,OAAO;IACT;AACF;AAEA;;CAEC,GACD,OAAO,SAASG,YAAYN,SAAmB,EAAEO,cAAwB;IACvE,OAAOA,eAAeL,IAAI,CAAC,CAACC,QAAUJ,SAASC,WAAWG;AAC5D;AAEA;;CAEC,GACD,OAAO,SAASK,aAAaR,SAAmB,EAAEO,cAAwB;IACxE,OAAOA,eAAeE,KAAK,CAAC,CAACN,QAAUJ,SAASC,WAAWG;AAC7D;AAEA,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASO,aACdP,KAAa,EACbQ,SAA6B,CAAC,CAAC;IAE/B,MAAM,EACJlD,oBAAoB,SAAS,EAC7BmD,0BAA0B,KAAK,EAC/BC,gBAAgB9D,wBAAwB,EACzC,GAAG4D;IAEJ,OAAO,OAAO,EAAE3D,GAAG,EAAE;QACnB,2EAA2E;QAC3E,IAAI4D,2BAA2B5D,IAAI0C,IAAI,EAAE;YACvC,MAAMlC,SAASqD,cAAc7D;YAC7B,IAAI,CAACQ,QAAQ;gBACX,OAAO,KAAK,qDAAqD;;YACnE;QACF;QAEA,+BAA+B;QAC/B,MAAMA,SAASqD,cAAc7D;QAC7B,IAAI,CAACQ,QAAQ;YACX,OAAO;QACT;QAEA,kBAAkB;QAClB,MAAMsD,UAAU,MAAMvD,cAAcP,KAAKQ,QAAQC;QACjD,IAAI,CAACqD,SAAS;YACZ,OAAO;QACT;QAEA,cAAc;QACd,OAAOf,SAASe,QAAQpC,MAAM,EAAEyB;IAClC;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASY,gBACdrC,MAAgB,EAChBiC,SAA6B,CAAC,CAAC;IAE/B,MAAM,EACJlD,oBAAoB,SAAS,EAC7BmD,0BAA0B,KAAK,EAC/BC,gBAAgB9D,wBAAwB,EACzC,GAAG4D;IAEJ,OAAO,OAAO,EAAE3D,GAAG,EAAE;QACnB,2EAA2E;QAC3E,IAAI4D,2BAA2B5D,IAAI0C,IAAI,EAAE;YACvC,MAAMlC,SAASqD,cAAc7D;YAC7B,IAAI,CAACQ,QAAQ;gBACX,OAAO;YACT;QACF;QAEA,MAAMA,SAASqD,cAAc7D;QAC7B,IAAI,CAACQ,QAAQ;YACX,OAAO;QACT;QAEA,MAAMsD,UAAU,MAAMvD,cAAcP,KAAKQ,QAAQC;QACjD,IAAI,CAACqD,SAAS;YACZ,OAAO;QACT;QAEA,OAAOR,YAAYQ,QAAQpC,MAAM,EAAEA;IACrC;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASsC,iBACdtC,MAAgB,EAChBiC,SAA6B,CAAC,CAAC;IAE/B,MAAM,EACJlD,oBAAoB,SAAS,EAC7BmD,0BAA0B,KAAK,EAC/BC,gBAAgB9D,wBAAwB,EACzC,GAAG4D;IAEJ,OAAO,OAAO,EAAE3D,GAAG,EAAE;QACnB,2EAA2E;QAC3E,IAAI4D,2BAA2B5D,IAAI0C,IAAI,EAAE;YACvC,MAAMlC,SAASqD,cAAc7D;YAC7B,IAAI,CAACQ,QAAQ;gBACX,OAAO;YACT;QACF;QAEA,MAAMA,SAASqD,cAAc7D;QAC7B,IAAI,CAACQ,QAAQ;YACX,OAAO;QACT;QAEA,MAAMsD,UAAU,MAAMvD,cAAcP,KAAKQ,QAAQC;QACjD,IAAI,CAACqD,SAAS;YACZ,OAAO;QACT;QAEA,OAAON,aAAaM,QAAQpC,MAAM,EAAEA;IACtC;AACF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASuC,oBACdd,KAAa,EACbQ,SAA8D,CAAC,CAAC;IAEhE,OAAOD,aAAaP,OAAO;QAAE,GAAGQ,MAAM;QAAEC,yBAAyB;IAAK;AACxE;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASM,uBACdxC,MAAgB,EAChBiC,SAA8D,CAAC,CAAC;IAEhE,OAAOI,gBAAgBrC,QAAQ;QAAE,GAAGiC,MAAM;QAAEC,yBAAyB;IAAK;AAC5E;AAEA,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,eAAeO,eACpBnE,GAAmB,EACnBS,oBAAoB,SAAS;IAE7B,MAAMD,SAAST,yBAAyBC;IACxC,IAAI,CAACQ,QAAQ,OAAO;IACpB,OAAOD,cAAcP,KAAKQ,QAAQC;AACpC"}

package/dist/utils/betterAuthDefaults.js

@@ -2,8 +2,7 @@
  * Utility to apply sensible defaults to Better Auth options.
  *
  * @packageDocumentation
- */
-import { apiKey as betterAuthApiKey } from 'better-auth/plugins';
+ */ import { apiKey as betterAuthApiKey } from 'better-auth/plugins';
 /**
  * API Key plugin with sensible defaults for use with this package.
  *
@@ -28,11 +27,10 @@ import { apiKey as betterAuthApiKey } from 'better-auth/plugins';
  *   // enableMetadata is already true
  * })
  * ```
- */
-export function apiKeyWithDefaults(options) {
+ */ export function apiKeyWithDefaults(options) {
     return betterAuthApiKey({
         enableMetadata: true,
-        ...options,
+        ...options
     });
 }
 /**
@@ -74,8 +72,7 @@ export function apiKeyWithDefaults(options) {
  *   })),
  * })
  * ```
- */
-export function withBetterAuthDefaults(options) {
+ */ export function withBetterAuthDefaults(options) {
     // If trustedOrigins is explicitly provided, use it as-is
     if (options.trustedOrigins !== undefined) {
         return options;
@@ -84,10 +81,13 @@ export function withBetterAuthDefaults(options) {
     if (options.baseURL) {
         return {
             ...options,
-            trustedOrigins: [options.baseURL],
+            trustedOrigins: [
+                options.baseURL
+            ]
         };
     }
     // No defaults to apply
     return options;
 }
+
 //# sourceMappingURL=betterAuthDefaults.js.map

package/dist/utils/betterAuthDefaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"betterAuthDefaults.js","sourceRoot":"","sources":["../../src/utils/betterAuthDefaults.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAIhE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC9D,OAAO,gBAAgB,CAAC;QACtB,cAAc,EAAE,IAAI;QACpB,GAAG,OAAO;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAU;IAEV,yDAAyD;IACzD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,GAAG,OAAO;YACV,cAAc,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;SAClC,CAAA;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"sources":["../../src/utils/betterAuthDefaults.ts"],"sourcesContent":["/**\n * Utility to apply sensible defaults to Better Auth options.\n *\n * @packageDocumentation\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\nimport { apiKey as betterAuthApiKey } from 'better-auth/plugins'\n\ntype ApiKeyPluginOptions = Parameters<typeof betterAuthApiKey>[0]\n\n/**\n * API Key plugin with sensible defaults for use with this package.\n *\n * Enables metadata storage by default so that scopes can be displayed\n * in the admin UI after key creation.\n *\n * @example\n * ```ts\n * import { apiKeyWithDefaults } from '@delmaredigital/payload-better-auth'\n *\n * export const betterAuthOptions = {\n *   plugins: [\n *     apiKeyWithDefaults(),  // metadata enabled by default\n *   ],\n * }\n * ```\n *\n * @example With custom options\n * ```ts\n * apiKeyWithDefaults({\n *   rateLimit: { max: 100, window: 60 },\n *   // enableMetadata is already true\n * })\n * ```\n */\nexport function apiKeyWithDefaults(options?: ApiKeyPluginOptions) {\n  return betterAuthApiKey({\n    enableMetadata: true,\n    ...options,\n  })\n}\n\n/**\n * Applies sensible defaults to Better Auth options.\n *\n * Currently applies the following defaults:\n * - `trustedOrigins`: If not explicitly provided but `baseURL` is set,\n *   defaults to `[baseURL]`. This handles the common single-domain case\n *   where the app's origin should be trusted for auth requests.\n *\n * Multi-domain setups can still explicitly set `trustedOrigins` to include\n * multiple origins.\n *\n * @example Simple case - trustedOrigins defaults to [baseURL]\n * ```ts\n * import { withBetterAuthDefaults } from '@delmaredigital/payload-better-auth'\n *\n * const auth = betterAuth(withBetterAuthDefaults({\n *   baseURL: 'https://myapp.com',\n *   // trustedOrigins automatically becomes ['https://myapp.com']\n * }))\n * ```\n *\n * @example Multi-domain case - explicit trustedOrigins respected\n * ```ts\n * const auth = betterAuth(withBetterAuthDefaults({\n *   baseURL: 'https://myapp.com',\n *   trustedOrigins: ['https://myapp.com', 'https://other-domain.com'],\n *   // trustedOrigins stays as explicitly provided\n * }))\n * ```\n *\n * @example With createBetterAuthPlugin\n * ```ts\n * createBetterAuthPlugin({\n *   createAuth: (payload) => betterAuth(withBetterAuthDefaults({\n *     database: payloadAdapter({ payloadClient: payload }),\n *     baseURL: process.env.BETTER_AUTH_URL,\n *   })),\n * })\n * ```\n */\nexport function withBetterAuthDefaults<T extends BetterAuthOptions>(\n  options: T\n): T {\n  // If trustedOrigins is explicitly provided, use it as-is\n  if (options.trustedOrigins !== undefined) {\n    return options\n  }\n\n  // If baseURL is set, default trustedOrigins to [baseURL]\n  if (options.baseURL) {\n    return {\n      ...options,\n      trustedOrigins: [options.baseURL],\n    }\n  }\n\n  // No defaults to apply\n  return options\n}\n"],"names":["apiKey","betterAuthApiKey","apiKeyWithDefaults","options","enableMetadata","withBetterAuthDefaults","trustedOrigins","undefined","baseURL"],"mappings":"AAAA;;;;CAIC,GAGD,SAASA,UAAUC,gBAAgB,QAAQ,sBAAqB;AAIhE;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,SAASC,mBAAmBC,OAA6B;IAC9D,OAAOF,iBAAiB;QACtBG,gBAAgB;QAChB,GAAGD,OAAO;IACZ;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GACD,OAAO,SAASE,uBACdF,OAAU;IAEV,yDAAyD;IACzD,IAAIA,QAAQG,cAAc,KAAKC,WAAW;QACxC,OAAOJ;IACT;IAEA,yDAAyD;IACzD,IAAIA,QAAQK,OAAO,EAAE;QACnB,OAAO;YACL,GAAGL,OAAO;YACVG,gBAAgB;gBAACH,QAAQK,OAAO;aAAC;QACnC;IACF;IAEA,uBAAuB;IACvB,OAAOL;AACT"}

package/dist/utils/detectAuthConfig.js

@@ -1,23 +1,19 @@
 /**
  * Utility to detect auth configuration in Payload config
- */
-/**
+ */ /**
  * Scans Payload config to detect if any collection uses disableLocalStrategy.
  * Used to determine whether to auto-inject admin components.
- */
-export function detectAuthConfig(config) {
+ */ export function detectAuthConfig(config) {
     const collections = config.collections ?? [];
-    for (const collection of collections) {
+    for (const collection of collections){
         if (collection.auth) {
             const auth = collection.auth;
             // disableLocalStrategy can be `true` or an object with options
-            if (auth === true ||
-                (typeof auth === 'object' && auth.disableLocalStrategy)) {
+            if (auth === true || typeof auth === 'object' && auth.disableLocalStrategy) {
                 return {
-                    hasDisableLocalStrategy: auth === true ||
-                        (typeof auth === 'object' && !!auth.disableLocalStrategy),
+                    hasDisableLocalStrategy: auth === true || typeof auth === 'object' && !!auth.disableLocalStrategy,
                     authCollectionSlug: collection.slug,
-                    authCollectionConfig: collection,
+                    authCollectionConfig: collection
                 };
             }
         }
@@ -25,7 +21,8 @@ export function detectAuthConfig(config) {
     return {
         hasDisableLocalStrategy: false,
         authCollectionSlug: null,
-        authCollectionConfig: null,
+        authCollectionConfig: null
     };
 }
+
 //# sourceMappingURL=detectAuthConfig.js.map

package/dist/utils/detectAuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"detectAuthConfig.js","sourceRoot":"","sources":["../../src/utils/detectAuthConfig.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAA;IAE5C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;YAC5B,+DAA+D;YAC/D,IACE,IAAI,KAAK,IAAI;gBACb,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,oBAAoB,CAAC,EACvD,CAAC;gBACD,OAAO;oBACL,uBAAuB,EACrB,IAAI,KAAK,IAAI;wBACb,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;oBAC3D,kBAAkB,EAAE,UAAU,CAAC,IAAI;oBACnC,oBAAoB,EAAE,UAAU;iBACjC,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,uBAAuB,EAAE,KAAK;QAC9B,kBAAkB,EAAE,IAAI;QACxB,oBAAoB,EAAE,IAAI;KAC3B,CAAA;AACH,CAAC"}
+{"version":3,"sources":["../../src/utils/detectAuthConfig.ts"],"sourcesContent":["/**\n * Utility to detect auth configuration in Payload config\n */\n\nimport type { Config, CollectionConfig } from 'payload'\n\nexport type AuthDetectionResult = {\n  /** Whether any collection has disableLocalStrategy: true */\n  hasDisableLocalStrategy: boolean\n  /** The slug of the auth collection (if found) */\n  authCollectionSlug: string | null\n  /** The auth collection config (if found) */\n  authCollectionConfig: CollectionConfig | null\n}\n\n/**\n * Scans Payload config to detect if any collection uses disableLocalStrategy.\n * Used to determine whether to auto-inject admin components.\n */\nexport function detectAuthConfig(config: Config): AuthDetectionResult {\n  const collections = config.collections ?? []\n\n  for (const collection of collections) {\n    if (collection.auth) {\n      const auth = collection.auth\n      // disableLocalStrategy can be `true` or an object with options\n      if (\n        auth === true ||\n        (typeof auth === 'object' && auth.disableLocalStrategy)\n      ) {\n        return {\n          hasDisableLocalStrategy:\n            auth === true ||\n            (typeof auth === 'object' && !!auth.disableLocalStrategy),\n          authCollectionSlug: collection.slug,\n          authCollectionConfig: collection,\n        }\n      }\n    }\n  }\n\n  return {\n    hasDisableLocalStrategy: false,\n    authCollectionSlug: null,\n    authCollectionConfig: null,\n  }\n}\n"],"names":["detectAuthConfig","config","collections","collection","auth","disableLocalStrategy","hasDisableLocalStrategy","authCollectionSlug","slug","authCollectionConfig"],"mappings":"AAAA;;CAEC,GAaD;;;CAGC,GACD,OAAO,SAASA,iBAAiBC,MAAc;IAC7C,MAAMC,cAAcD,OAAOC,WAAW,IAAI,EAAE;IAE5C,KAAK,MAAMC,cAAcD,YAAa;QACpC,IAAIC,WAAWC,IAAI,EAAE;YACnB,MAAMA,OAAOD,WAAWC,IAAI;YAC5B,+DAA+D;YAC/D,IACEA,SAAS,QACR,OAAOA,SAAS,YAAYA,KAAKC,oBAAoB,EACtD;gBACA,OAAO;oBACLC,yBACEF,SAAS,QACR,OAAOA,SAAS,YAAY,CAAC,CAACA,KAAKC,oBAAoB;oBAC1DE,oBAAoBJ,WAAWK,IAAI;oBACnCC,sBAAsBN;gBACxB;YACF;QACF;IACF;IAEA,OAAO;QACLG,yBAAyB;QACzBC,oBAAoB;QACpBE,sBAAsB;IACxB;AACF"}

package/dist/utils/detectEnabledPlugins.js

@@ -1,14 +1,12 @@
 /**
  * Utility to detect which Better Auth plugins are enabled
- */
-/**
+ */ /**
  * Detects which Better Auth plugins are enabled from the options.
  * Inspects the plugins array by checking plugin identifiers.
  *
  * @param options - Better Auth options containing plugins array
  * @returns Object with boolean flags for each supported plugin
- */
-export function detectEnabledPlugins(options) {
+ */ export function detectEnabledPlugins(options) {
     const plugins = options?.plugins ?? [];
     const result = {
         hasAdmin: false,
@@ -17,12 +15,12 @@ export function detectEnabledPlugins(options) {
         hasPasskey: false,
         hasMagicLink: false,
         hasMultiSession: false,
-        hasOrganization: false,
+        hasOrganization: false
     };
-    for (const plugin of plugins) {
+    for (const plugin of plugins){
         // Better Auth plugins have an id property
         const id = plugin.id;
-        switch (id) {
+        switch(id){
             case 'admin':
                 result.hasAdmin = true;
                 break;
@@ -48,4 +46,5 @@ export function detectEnabledPlugins(options) {
     }
     return result;
 }
+
 //# sourceMappingURL=detectEnabledPlugins.js.map

package/dist/utils/detectEnabledPlugins.js.map

@@ -1 +1 @@
-{"version":3,"file":"detectEnabledPlugins.js","sourceRoot":"","sources":["../../src/utils/detectEnabledPlugins.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAoC;IAEpC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,EAAE,CAAA;IAEtC,MAAM,MAAM,GAAyB;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,KAAK;QACnB,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,KAAK;KACvB,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,0CAA0C;QAC1C,MAAM,EAAE,GAAI,MAA0B,CAAC,EAAE,CAAA;QAEzC,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,OAAO;gBACV,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACtB,MAAK;YACP,KAAK,SAAS;gBACZ,MAAM,CAAC,SAAS,GAAG,IAAI,CAAA;gBACvB,MAAK;YACP,KAAK,YAAY;gBACf,MAAM,CAAC,YAAY,GAAG,IAAI,CAAA;gBAC1B,MAAK;YACP,KAAK,SAAS;gBACZ,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;gBACxB,MAAK;YACP,KAAK,YAAY;gBACf,MAAM,CAAC,YAAY,GAAG,IAAI,CAAA;gBAC1B,MAAK;YACP,KAAK,eAAe;gBAClB,MAAM,CAAC,eAAe,GAAG,IAAI,CAAA;gBAC7B,MAAK;YACP,KAAK,cAAc;gBACjB,MAAM,CAAC,eAAe,GAAG,IAAI,CAAA;gBAC7B,MAAK;QACT,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"sources":["../../src/utils/detectEnabledPlugins.ts"],"sourcesContent":["/**\n * Utility to detect which Better Auth plugins are enabled\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\n\nexport type EnabledPluginsResult = {\n  hasAdmin: boolean\n  hasApiKey: boolean\n  hasTwoFactor: boolean\n  hasPasskey: boolean\n  hasMagicLink: boolean\n  hasMultiSession: boolean\n  hasOrganization: boolean\n}\n\n/**\n * Detects which Better Auth plugins are enabled from the options.\n * Inspects the plugins array by checking plugin identifiers.\n *\n * @param options - Better Auth options containing plugins array\n * @returns Object with boolean flags for each supported plugin\n */\nexport function detectEnabledPlugins(\n  options?: Partial<BetterAuthOptions>\n): EnabledPluginsResult {\n  const plugins = options?.plugins ?? []\n\n  const result: EnabledPluginsResult = {\n    hasAdmin: false,\n    hasApiKey: false,\n    hasTwoFactor: false,\n    hasPasskey: false,\n    hasMagicLink: false,\n    hasMultiSession: false,\n    hasOrganization: false,\n  }\n\n  for (const plugin of plugins) {\n    // Better Auth plugins have an id property\n    const id = (plugin as { id?: string }).id\n\n    switch (id) {\n      case 'admin':\n        result.hasAdmin = true\n        break\n      case 'api-key':\n        result.hasApiKey = true\n        break\n      case 'two-factor':\n        result.hasTwoFactor = true\n        break\n      case 'passkey':\n        result.hasPasskey = true\n        break\n      case 'magic-link':\n        result.hasMagicLink = true\n        break\n      case 'multi-session':\n        result.hasMultiSession = true\n        break\n      case 'organization':\n        result.hasOrganization = true\n        break\n    }\n  }\n\n  return result\n}\n"],"names":["detectEnabledPlugins","options","plugins","result","hasAdmin","hasApiKey","hasTwoFactor","hasPasskey","hasMagicLink","hasMultiSession","hasOrganization","plugin","id"],"mappings":"AAAA;;CAEC,GAcD;;;;;;CAMC,GACD,OAAO,SAASA,qBACdC,OAAoC;IAEpC,MAAMC,UAAUD,SAASC,WAAW,EAAE;IAEtC,MAAMC,SAA+B;QACnCC,UAAU;QACVC,WAAW;QACXC,cAAc;QACdC,YAAY;QACZC,cAAc;QACdC,iBAAiB;QACjBC,iBAAiB;IACnB;IAEA,KAAK,MAAMC,UAAUT,QAAS;QAC5B,0CAA0C;QAC1C,MAAMU,KAAK,AAACD,OAA2BC,EAAE;QAEzC,OAAQA;YACN,KAAK;gBACHT,OAAOC,QAAQ,GAAG;gBAClB;YACF,KAAK;gBACHD,OAAOE,SAAS,GAAG;gBACnB;YACF,KAAK;gBACHF,OAAOG,YAAY,GAAG;gBACtB;YACF,KAAK;gBACHH,OAAOI,UAAU,GAAG;gBACpB;YACF,KAAK;gBACHJ,OAAOK,YAAY,GAAG;gBACtB;YACF,KAAK;gBACHL,OAAOM,eAAe,GAAG;gBACzB;YACF,KAAK;gBACHN,OAAOO,eAAe,GAAG;gBACzB;QACJ;IACF;IAEA,OAAOP;AACT"}

package/dist/utils/firstUserAdmin.js

@@ -5,8 +5,7 @@
  * makes the first registered user an admin.
  *
  * @packageDocumentation
- */
-/**
+ */ /**
  * Creates Better Auth databaseHooks configuration that makes the first
  * registered user an admin.
  *
@@ -62,13 +61,12 @@
  *   },
  * })
  * ```
- */
-export function firstUserAdminHooks(options) {
-    const { adminRole = 'admin', defaultRole = 'user', roleField = 'role', } = options ?? {};
+ */ export function firstUserAdminHooks(options) {
+    const { adminRole = 'admin', defaultRole = 'user', roleField = 'role' } = options ?? {};
     // Using explicit any for the context type because Better Auth's
     // GenericEndpointContext type is complex and includes [x: string]: any.
     // The runtime behavior is what matters here.
-    const beforeHook = async (user, ctx) => {
+    const beforeHook = async (user, ctx)=>{
         try {
             // Access the adapter from context
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -79,39 +77,38 @@ export function firstUserAdminHooks(options) {
                 return {
                     data: {
                         ...user,
-                        [roleField]: user[roleField] ?? defaultRole,
-                    },
+                        [roleField]: user[roleField] ?? defaultRole
+                    }
                 };
             }
             const userCount = await adapter.count({
                 model: 'user',
-                where: [],
+                where: []
             });
             if (userCount === 0) {
                 // First user becomes admin
                 return {
                     data: {
                         ...user,
-                        [roleField]: adminRole,
-                    },
+                        [roleField]: adminRole
+                    }
                 };
             }
             // Subsequent users get default role if not already set
             return {
                 data: {
                     ...user,
-                    [roleField]: user[roleField] ?? defaultRole,
-                },
+                    [roleField]: user[roleField] ?? defaultRole
+                }
             };
-        }
-        catch (error) {
+        } catch (error) {
             // On error, don't block user creation - just use provided or default role
             console.warn('[firstUserAdminHooks] Failed to check user count:', error);
             return {
                 data: {
                     ...user,
-                    [roleField]: user[roleField] ?? defaultRole,
-                },
+                    [roleField]: user[roleField] ?? defaultRole
+                }
             };
         }
     };
@@ -120,9 +117,10 @@ export function firstUserAdminHooks(options) {
             create: {
                 // Cast needed because Better Auth's hook types are complex
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                before: beforeHook,
-            },
-        },
+                before: beforeHook
+            }
+        }
     };
 }
+
 //# sourceMappingURL=firstUserAdmin.js.map

package/dist/utils/firstUserAdmin.js.map

@@ -1 +1 @@
-{"version":3,"file":"firstUserAdmin.js","sourceRoot":"","sources":["../../src/utils/firstUserAdmin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwBH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA+B;IAE/B,MAAM,EACJ,SAAS,GAAG,OAAO,EACnB,WAAW,GAAG,MAAM,EACpB,SAAS,GAAG,MAAM,GACnB,GAAG,OAAO,IAAI,EAAE,CAAA;IAEjB,gEAAgE;IAChE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,UAAU,GAAG,KAAK,EACtB,IAA6B,EAC7B,GAAY,EACgC,EAAE;QAC9C,IAAI,CAAC;YACH,kCAAkC;YAClC,8DAA8D;YAC9D,MAAM,OAAO,GAAG,GAA6C,CAAA;YAC7D,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAA;YAEzC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;gBACpB,mDAAmD;gBACnD,OAAO;oBACL,IAAI,EAAE;wBACJ,GAAG,IAAI;wBACP,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW;qBAC5C;iBACF,CAAA;YACH,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;gBACpC,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,EAAE;aACV,CAAC,CAAA;YAEF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,2BAA2B;gBAC3B,OAAO;oBACL,IAAI,EAAE;wBACJ,GAAG,IAAI;wBACP,CAAC,SAAS,CAAC,EAAE,SAAS;qBACvB;iBACF,CAAA;YACH,CAAC;YAED,uDAAuD;YACvD,OAAO;gBACL,IAAI,EAAE;oBACJ,GAAG,IAAI;oBACP,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW;iBAC5C;aACF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAA;YACxE,OAAO;gBACL,IAAI,EAAE;oBACJ,GAAG,IAAI;oBACP,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW;iBAC5C;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,2DAA2D;gBAC3D,8DAA8D;gBAC9D,MAAM,EAAE,UAAiB;aAC1B;SACF;KACF,CAAA;AACH,CAAC"}
+{"version":3,"sources":["../../src/utils/firstUserAdmin.ts"],"sourcesContent":["/**\n * First User Admin Hook Utility\n *\n * Provides a Better Auth databaseHooks configuration that automatically\n * makes the first registered user an admin.\n *\n * @packageDocumentation\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\n\nexport type FirstUserAdminOptions = {\n  /**\n   * Role to assign to the first user\n   * @default 'admin'\n   */\n  adminRole?: string\n\n  /**\n   * Role to assign to subsequent users (if not already set)\n   * @default 'user'\n   */\n  defaultRole?: string\n\n  /**\n   * Field name for the role field\n   * @default 'role'\n   */\n  roleField?: string\n}\n\n/**\n * Creates Better Auth databaseHooks configuration that makes the first\n * registered user an admin.\n *\n * @example Basic usage\n * ```ts\n * import { betterAuth } from 'better-auth'\n * import { payloadAdapter } from '@delmaredigital/payload-better-auth/adapter'\n * import { firstUserAdminHooks } from '@delmaredigital/payload-better-auth'\n *\n * export const auth = betterAuth({\n *   database: payloadAdapter({ payloadClient: payload }),\n *   databaseHooks: firstUserAdminHooks(),\n * })\n * ```\n *\n * @example Custom roles\n * ```ts\n * export const auth = betterAuth({\n *   database: payloadAdapter({ payloadClient: payload }),\n *   databaseHooks: firstUserAdminHooks({\n *     adminRole: 'super-admin',\n *     defaultRole: 'member',\n *   }),\n * })\n * ```\n *\n * @example Merging with other hooks\n * ```ts\n * export const auth = betterAuth({\n *   database: payloadAdapter({ payloadClient: payload }),\n *   databaseHooks: {\n *     user: {\n *       create: {\n *         before: async (user, ctx) => {\n *           // First apply first-user-admin logic\n *           const result = await firstUserAdminHooks().user.create.before(user, ctx)\n *           const userData = result?.data ?? user\n *\n *           // Then apply your custom logic\n *           return {\n *             data: {\n *               ...userData,\n *               createdVia: 'custom-signup',\n *             },\n *           }\n *         },\n *         after: async (user) => {\n *           // Your after-create logic\n *           console.log('User created:', user.email)\n *         },\n *       },\n *     },\n *   },\n * })\n * ```\n */\nexport function firstUserAdminHooks(\n  options?: FirstUserAdminOptions\n): NonNullable<BetterAuthOptions['databaseHooks']> {\n  const {\n    adminRole = 'admin',\n    defaultRole = 'user',\n    roleField = 'role',\n  } = options ?? {}\n\n  // Using explicit any for the context type because Better Auth's\n  // GenericEndpointContext type is complex and includes [x: string]: any.\n  // The runtime behavior is what matters here.\n  const beforeHook = async (\n    user: Record<string, unknown>,\n    ctx: unknown\n  ): Promise<{ data: Record<string, unknown> }> => {\n    try {\n      // Access the adapter from context\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const context = ctx as { context?: { adapter?: any } } | null\n      const adapter = context?.context?.adapter\n\n      if (!adapter?.count) {\n        // Adapter not available, fall back to default role\n        return {\n          data: {\n            ...user,\n            [roleField]: user[roleField] ?? defaultRole,\n          },\n        }\n      }\n\n      const userCount = await adapter.count({\n        model: 'user',\n        where: [],\n      })\n\n      if (userCount === 0) {\n        // First user becomes admin\n        return {\n          data: {\n            ...user,\n            [roleField]: adminRole,\n          },\n        }\n      }\n\n      // Subsequent users get default role if not already set\n      return {\n        data: {\n          ...user,\n          [roleField]: user[roleField] ?? defaultRole,\n        },\n      }\n    } catch (error) {\n      // On error, don't block user creation - just use provided or default role\n      console.warn('[firstUserAdminHooks] Failed to check user count:', error)\n      return {\n        data: {\n          ...user,\n          [roleField]: user[roleField] ?? defaultRole,\n        },\n      }\n    }\n  }\n\n  return {\n    user: {\n      create: {\n        // Cast needed because Better Auth's hook types are complex\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        before: beforeHook as any,\n      },\n    },\n  }\n}\n"],"names":["firstUserAdminHooks","options","adminRole","defaultRole","roleField","beforeHook","user","ctx","context","adapter","count","data","userCount","model","where","error","console","warn","create","before"],"mappings":"AAAA;;;;;;;CAOC,GAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwDC,GACD,OAAO,SAASA,oBACdC,OAA+B;IAE/B,MAAM,EACJC,YAAY,OAAO,EACnBC,cAAc,MAAM,EACpBC,YAAY,MAAM,EACnB,GAAGH,WAAW,CAAC;IAEhB,gEAAgE;IAChE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAMI,aAAa,OACjBC,MACAC;QAEA,IAAI;YACF,kCAAkC;YAClC,8DAA8D;YAC9D,MAAMC,UAAUD;YAChB,MAAME,UAAUD,SAASA,SAASC;YAElC,IAAI,CAACA,SAASC,OAAO;gBACnB,mDAAmD;gBACnD,OAAO;oBACLC,MAAM;wBACJ,GAAGL,IAAI;wBACP,CAACF,UAAU,EAAEE,IAAI,CAACF,UAAU,IAAID;oBAClC;gBACF;YACF;YAEA,MAAMS,YAAY,MAAMH,QAAQC,KAAK,CAAC;gBACpCG,OAAO;gBACPC,OAAO,EAAE;YACX;YAEA,IAAIF,cAAc,GAAG;gBACnB,2BAA2B;gBAC3B,OAAO;oBACLD,MAAM;wBACJ,GAAGL,IAAI;wBACP,CAACF,UAAU,EAAEF;oBACf;gBACF;YACF;YAEA,uDAAuD;YACvD,OAAO;gBACLS,MAAM;oBACJ,GAAGL,IAAI;oBACP,CAACF,UAAU,EAAEE,IAAI,CAACF,UAAU,IAAID;gBAClC;YACF;QACF,EAAE,OAAOY,OAAO;YACd,0EAA0E;YAC1EC,QAAQC,IAAI,CAAC,qDAAqDF;YAClE,OAAO;gBACLJ,MAAM;oBACJ,GAAGL,IAAI;oBACP,CAACF,UAAU,EAAEE,IAAI,CAACF,UAAU,IAAID;gBAClC;YACF;QACF;IACF;IAEA,OAAO;QACLG,MAAM;YACJY,QAAQ;gBACN,2DAA2D;gBAC3D,8DAA8D;gBAC9DC,QAAQd;YACV;QACF;IACF;AACF"}

package/dist/utils/generateScopes.js

@@ -1,60 +1,61 @@
 /**
  * Auto-generate API key scopes from Payload collections.
- */
-/** Default collections to exclude from auto-generated scopes */
-const DEFAULT_EXCLUDED_COLLECTIONS = [
+ */ /** Default collections to exclude from auto-generated scopes */ const DEFAULT_EXCLUDED_COLLECTIONS = [
     'sessions',
     'verifications',
     'accounts',
     'twoFactors',
-    'apiKeys',
+    'apiKeys'
 ];
 /**
  * Capitalize the first letter of a string.
- */
-function capitalize(str) {
+ */ function capitalize(str) {
     return str.charAt(0).toUpperCase() + str.slice(1);
 }
 /**
  * Convert slug to human-readable label.
  * e.g., 'blog-posts' -> 'Blog Posts'
- */
-function slugToLabel(slug) {
-    return slug
-        .split('-')
-        .map(capitalize)
-        .join(' ');
+ */ function slugToLabel(slug) {
+    return slug.split('-').map(capitalize).join(' ');
 }
 /**
  * Generate scopes from Payload collections.
  * Creates {collection}:read, {collection}:write, {collection}:delete for each collection.
- */
-export function generateScopesFromCollections(collections, excludeCollections = DEFAULT_EXCLUDED_COLLECTIONS) {
+ */ export function generateScopesFromCollections(collections, excludeCollections = DEFAULT_EXCLUDED_COLLECTIONS) {
     const scopes = {};
-    for (const collection of collections) {
-        if (excludeCollections.includes(collection.slug))
-            continue;
+    for (const collection of collections){
+        if (excludeCollections.includes(collection.slug)) continue;
         const slug = collection.slug;
-        const singularLabel = (typeof collection.labels?.singular === 'string'
-            ? collection.labels.singular
-            : null) ?? slugToLabel(slug);
-        const pluralLabel = (typeof collection.labels?.plural === 'string'
-            ? collection.labels.plural
-            : null) ?? slugToLabel(slug) + 's';
+        const singularLabel = (typeof collection.labels?.singular === 'string' ? collection.labels.singular : null) ?? slugToLabel(slug);
+        const pluralLabel = (typeof collection.labels?.plural === 'string' ? collection.labels.plural : null) ?? slugToLabel(slug) + 's';
         scopes[`${slug}:read`] = {
             label: `Read ${pluralLabel}`,
             description: `View ${pluralLabel.toLowerCase()}`,
-            permissions: { [slug]: ['read'] },
+            permissions: {
+                [slug]: [
+                    'read'
+                ]
+            }
         };
         scopes[`${slug}:write`] = {
             label: `Write ${pluralLabel}`,
             description: `Create and edit ${pluralLabel.toLowerCase()}`,
-            permissions: { [slug]: ['read', 'create', 'update'] },
+            permissions: {
+                [slug]: [
+                    'read',
+                    'create',
+                    'update'
+                ]
+            }
         };
         scopes[`${slug}:delete`] = {
             label: `Delete ${pluralLabel}`,
             description: `Delete ${pluralLabel.toLowerCase()}`,
-            permissions: { [slug]: ['delete'] },
+            permissions: {
+                [slug]: [
+                    'delete'
+                ]
+            }
         };
     }
     return scopes;
@@ -62,8 +63,7 @@ export function generateScopesFromCollections(collections, excludeCollections =
 /**
  * Build the final scopes configuration from plugin options and collections.
  * Handles merging custom scopes with auto-generated collection scopes.
- */
-export function buildAvailableScopes(collections, config) {
+ */ export function buildAvailableScopes(collections, config) {
     const customScopes = config?.scopes ?? {};
     const hasCustomScopes = Object.keys(customScopes).length > 0;
     // Determine if we should include collection scopes
@@ -77,31 +77,29 @@ export function buildAvailableScopes(collections, config) {
         allScopes = generateScopesFromCollections(collections, excludeCollections);
     }
     // Add custom scopes (they override collection scopes with same ID)
-    for (const [id, scope] of Object.entries(customScopes)) {
+    for (const [id, scope] of Object.entries(customScopes)){
         allScopes[id] = scope;
     }
     // Convert to array format for the client
-    return Object.entries(allScopes).map(([id, scope]) => ({
-        id,
-        ...scope,
-    }));
+    return Object.entries(allScopes).map(([id, scope])=>({
+            id,
+            ...scope
+        }));
 }
 /**
  * Convert selected scopes to Better Auth permission format.
  * Used when creating an API key.
- */
-export function scopesToPermissions(selectedScopeIds, availableScopes) {
+ */ export function scopesToPermissions(selectedScopeIds, availableScopes) {
     const permissions = {};
-    for (const scopeId of selectedScopeIds) {
-        const scope = availableScopes.find((s) => s.id === scopeId);
-        if (!scope)
-            continue;
-        for (const [resource, actions] of Object.entries(scope.permissions)) {
+    for (const scopeId of selectedScopeIds){
+        const scope = availableScopes.find((s)=>s.id === scopeId);
+        if (!scope) continue;
+        for (const [resource, actions] of Object.entries(scope.permissions)){
             if (!permissions[resource]) {
                 permissions[resource] = [];
             }
             // Add unique actions
-            for (const action of actions) {
+            for (const action of actions){
                 if (!permissions[resource].includes(action)) {
                     permissions[resource].push(action);
                 }
@@ -110,4 +108,5 @@ export function scopesToPermissions(selectedScopeIds, availableScopes) {
     }
     return permissions;
 }
+
 //# sourceMappingURL=generateScopes.js.map

package/dist/utils/generateScopes.js.map

@@ -1 +1 @@
-{"version":3,"file":"generateScopes.js","sourceRoot":"","sources":["../../src/utils/generateScopes.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,gEAAgE;AAChE,MAAM,4BAA4B,GAAG;IACnC,UAAU;IACV,eAAe;IACf,UAAU;IACV,YAAY;IACZ,SAAS;CACV,CAAA;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,UAAU,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAA+B,EAC/B,qBAA+B,4BAA4B;IAE3D,MAAM,MAAM,GAAoC,EAAE,CAAA;IAElD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAQ;QAE1D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;QAC5B,MAAM,aAAa,GACjB,CAAC,OAAO,UAAU,CAAC,MAAM,EAAE,QAAQ,KAAK,QAAQ;YAC9C,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ;YAC5B,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,WAAW,GACf,CAAC,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ;YAC5C,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;QAEtC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YACvB,KAAK,EAAE,QAAQ,WAAW,EAAE;YAC5B,WAAW,EAAE,QAAQ,WAAW,CAAC,WAAW,EAAE,EAAE;YAChD,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE;SAClC,CAAA;QAED,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG;YACxB,KAAK,EAAE,SAAS,WAAW,EAAE;YAC7B,WAAW,EAAE,mBAAmB,WAAW,CAAC,WAAW,EAAE,EAAE;YAC3D,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;SACtD,CAAA;QAED,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG;YACzB,KAAK,EAAE,UAAU,WAAW,EAAE;YAC9B,WAAW,EAAE,UAAU,WAAW,CAAC,WAAW,EAAE,EAAE;YAClD,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE;SACpC,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAA+B,EAC/B,MAA2B;IAE3B,MAAM,YAAY,GAAG,MAAM,EAAE,MAAM,IAAI,EAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAE5D,mDAAmD;IACnD,yEAAyE;IACzE,MAAM,uBAAuB,GAC3B,MAAM,EAAE,uBAAuB,IAAI,CAAC,eAAe,CAAA;IAErD,MAAM,kBAAkB,GAAG,MAAM,EAAE,kBAAkB,IAAI,4BAA4B,CAAA;IAErF,mCAAmC;IACnC,IAAI,SAAS,GAAoC,EAAE,CAAA;IAEnD,mCAAmC;IACnC,IAAI,uBAAuB,EAAE,CAAC;QAC5B,SAAS,GAAG,6BAA6B,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAA;IAC5E,CAAC;IAED,mEAAmE;IACnE,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,SAAS,CAAC,EAAE,CAAC,GAAG,KAAK,CAAA;IACvB,CAAC;IAED,yCAAyC;IACzC,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,EAAE;QACF,GAAG,KAAK;KACT,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAA0B,EAC1B,eAAiC;IAEjC,MAAM,WAAW,GAA6B,EAAE,CAAA;IAEhD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAA;QAC3D,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;YAC5B,CAAC;YACD,qBAAqB;YACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5C,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC"}
+{"version":3,"sources":["../../src/utils/generateScopes.ts"],"sourcesContent":["/**\n * Auto-generate API key scopes from Payload collections.\n */\n\nimport type { CollectionConfig } from 'payload'\nimport type {\n  ScopeDefinition,\n  ApiKeyScopesConfig,\n  AvailableScope,\n} from '../types/apiKey.js'\n\n/** Default collections to exclude from auto-generated scopes */\nconst DEFAULT_EXCLUDED_COLLECTIONS = [\n  'sessions',\n  'verifications',\n  'accounts',\n  'twoFactors',\n  'apiKeys',\n]\n\n/**\n * Capitalize the first letter of a string.\n */\nfunction capitalize(str: string): string {\n  return str.charAt(0).toUpperCase() + str.slice(1)\n}\n\n/**\n * Convert slug to human-readable label.\n * e.g., 'blog-posts' -> 'Blog Posts'\n */\nfunction slugToLabel(slug: string): string {\n  return slug\n    .split('-')\n    .map(capitalize)\n    .join(' ')\n}\n\n/**\n * Generate scopes from Payload collections.\n * Creates {collection}:read, {collection}:write, {collection}:delete for each collection.\n */\nexport function generateScopesFromCollections(\n  collections: CollectionConfig[],\n  excludeCollections: string[] = DEFAULT_EXCLUDED_COLLECTIONS\n): Record<string, ScopeDefinition> {\n  const scopes: Record<string, ScopeDefinition> = {}\n\n  for (const collection of collections) {\n    if (excludeCollections.includes(collection.slug)) continue\n\n    const slug = collection.slug\n    const singularLabel =\n      (typeof collection.labels?.singular === 'string'\n        ? collection.labels.singular\n        : null) ?? slugToLabel(slug)\n    const pluralLabel =\n      (typeof collection.labels?.plural === 'string'\n        ? collection.labels.plural\n        : null) ?? slugToLabel(slug) + 's'\n\n    scopes[`${slug}:read`] = {\n      label: `Read ${pluralLabel}`,\n      description: `View ${pluralLabel.toLowerCase()}`,\n      permissions: { [slug]: ['read'] },\n    }\n\n    scopes[`${slug}:write`] = {\n      label: `Write ${pluralLabel}`,\n      description: `Create and edit ${pluralLabel.toLowerCase()}`,\n      permissions: { [slug]: ['read', 'create', 'update'] },\n    }\n\n    scopes[`${slug}:delete`] = {\n      label: `Delete ${pluralLabel}`,\n      description: `Delete ${pluralLabel.toLowerCase()}`,\n      permissions: { [slug]: ['delete'] },\n    }\n  }\n\n  return scopes\n}\n\n/**\n * Build the final scopes configuration from plugin options and collections.\n * Handles merging custom scopes with auto-generated collection scopes.\n */\nexport function buildAvailableScopes(\n  collections: CollectionConfig[],\n  config?: ApiKeyScopesConfig\n): AvailableScope[] {\n  const customScopes = config?.scopes ?? {}\n  const hasCustomScopes = Object.keys(customScopes).length > 0\n\n  // Determine if we should include collection scopes\n  // Default: true when no custom scopes, false when custom scopes provided\n  const includeCollectionScopes =\n    config?.includeCollectionScopes ?? !hasCustomScopes\n\n  const excludeCollections = config?.excludeCollections ?? DEFAULT_EXCLUDED_COLLECTIONS\n\n  // Build the combined scopes object\n  let allScopes: Record<string, ScopeDefinition> = {}\n\n  // Add collection scopes if enabled\n  if (includeCollectionScopes) {\n    allScopes = generateScopesFromCollections(collections, excludeCollections)\n  }\n\n  // Add custom scopes (they override collection scopes with same ID)\n  for (const [id, scope] of Object.entries(customScopes)) {\n    allScopes[id] = scope\n  }\n\n  // Convert to array format for the client\n  return Object.entries(allScopes).map(([id, scope]) => ({\n    id,\n    ...scope,\n  }))\n}\n\n/**\n * Convert selected scopes to Better Auth permission format.\n * Used when creating an API key.\n */\nexport function scopesToPermissions(\n  selectedScopeIds: string[],\n  availableScopes: AvailableScope[]\n): Record<string, string[]> {\n  const permissions: Record<string, string[]> = {}\n\n  for (const scopeId of selectedScopeIds) {\n    const scope = availableScopes.find((s) => s.id === scopeId)\n    if (!scope) continue\n\n    for (const [resource, actions] of Object.entries(scope.permissions)) {\n      if (!permissions[resource]) {\n        permissions[resource] = []\n      }\n      // Add unique actions\n      for (const action of actions) {\n        if (!permissions[resource].includes(action)) {\n          permissions[resource].push(action)\n        }\n      }\n    }\n  }\n\n  return permissions\n}\n"],"names":["DEFAULT_EXCLUDED_COLLECTIONS","capitalize","str","charAt","toUpperCase","slice","slugToLabel","slug","split","map","join","generateScopesFromCollections","collections","excludeCollections","scopes","collection","includes","singularLabel","labels","singular","pluralLabel","plural","label","description","toLowerCase","permissions","buildAvailableScopes","config","customScopes","hasCustomScopes","Object","keys","length","includeCollectionScopes","allScopes","id","scope","entries","scopesToPermissions","selectedScopeIds","availableScopes","scopeId","find","s","resource","actions","action","push"],"mappings":"AAAA;;CAEC,GASD,8DAA8D,GAC9D,MAAMA,+BAA+B;IACnC;IACA;IACA;IACA;IACA;CACD;AAED;;CAEC,GACD,SAASC,WAAWC,GAAW;IAC7B,OAAOA,IAAIC,MAAM,CAAC,GAAGC,WAAW,KAAKF,IAAIG,KAAK,CAAC;AACjD;AAEA;;;CAGC,GACD,SAASC,YAAYC,IAAY;IAC/B,OAAOA,KACJC,KAAK,CAAC,KACNC,GAAG,CAACR,YACJS,IAAI,CAAC;AACV;AAEA;;;CAGC,GACD,OAAO,SAASC,8BACdC,WAA+B,EAC/BC,qBAA+Bb,4BAA4B;IAE3D,MAAMc,SAA0C,CAAC;IAEjD,KAAK,MAAMC,cAAcH,YAAa;QACpC,IAAIC,mBAAmBG,QAAQ,CAACD,WAAWR,IAAI,GAAG;QAElD,MAAMA,OAAOQ,WAAWR,IAAI;QAC5B,MAAMU,gBACJ,AAAC,CAAA,OAAOF,WAAWG,MAAM,EAAEC,aAAa,WACpCJ,WAAWG,MAAM,CAACC,QAAQ,GAC1B,IAAG,KAAMb,YAAYC;QAC3B,MAAMa,cACJ,AAAC,CAAA,OAAOL,WAAWG,MAAM,EAAEG,WAAW,WAClCN,WAAWG,MAAM,CAACG,MAAM,GACxB,IAAG,KAAMf,YAAYC,QAAQ;QAEnCO,MAAM,CAAC,GAAGP,KAAK,KAAK,CAAC,CAAC,GAAG;YACvBe,OAAO,CAAC,KAAK,EAAEF,aAAa;YAC5BG,aAAa,CAAC,KAAK,EAAEH,YAAYI,WAAW,IAAI;YAChDC,aAAa;gBAAE,CAAClB,KAAK,EAAE;oBAAC;iBAAO;YAAC;QAClC;QAEAO,MAAM,CAAC,GAAGP,KAAK,MAAM,CAAC,CAAC,GAAG;YACxBe,OAAO,CAAC,MAAM,EAAEF,aAAa;YAC7BG,aAAa,CAAC,gBAAgB,EAAEH,YAAYI,WAAW,IAAI;YAC3DC,aAAa;gBAAE,CAAClB,KAAK,EAAE;oBAAC;oBAAQ;oBAAU;iBAAS;YAAC;QACtD;QAEAO,MAAM,CAAC,GAAGP,KAAK,OAAO,CAAC,CAAC,GAAG;YACzBe,OAAO,CAAC,OAAO,EAAEF,aAAa;YAC9BG,aAAa,CAAC,OAAO,EAAEH,YAAYI,WAAW,IAAI;YAClDC,aAAa;gBAAE,CAAClB,KAAK,EAAE;oBAAC;iBAAS;YAAC;QACpC;IACF;IAEA,OAAOO;AACT;AAEA;;;CAGC,GACD,OAAO,SAASY,qBACdd,WAA+B,EAC/Be,MAA2B;IAE3B,MAAMC,eAAeD,QAAQb,UAAU,CAAC;IACxC,MAAMe,kBAAkBC,OAAOC,IAAI,CAACH,cAAcI,MAAM,GAAG;IAE3D,mDAAmD;IACnD,yEAAyE;IACzE,MAAMC,0BACJN,QAAQM,2BAA2B,CAACJ;IAEtC,MAAMhB,qBAAqBc,QAAQd,sBAAsBb;IAEzD,mCAAmC;IACnC,IAAIkC,YAA6C,CAAC;IAElD,mCAAmC;IACnC,IAAID,yBAAyB;QAC3BC,YAAYvB,8BAA8BC,aAAaC;IACzD;IAEA,mEAAmE;IACnE,KAAK,MAAM,CAACsB,IAAIC,MAAM,IAAIN,OAAOO,OAAO,CAACT,cAAe;QACtDM,SAAS,CAACC,GAAG,GAAGC;IAClB;IAEA,yCAAyC;IACzC,OAAON,OAAOO,OAAO,CAACH,WAAWzB,GAAG,CAAC,CAAC,CAAC0B,IAAIC,MAAM,GAAM,CAAA;YACrDD;YACA,GAAGC,KAAK;QACV,CAAA;AACF;AAEA;;;CAGC,GACD,OAAO,SAASE,oBACdC,gBAA0B,EAC1BC,eAAiC;IAEjC,MAAMf,cAAwC,CAAC;IAE/C,KAAK,MAAMgB,WAAWF,iBAAkB;QACtC,MAAMH,QAAQI,gBAAgBE,IAAI,CAAC,CAACC,IAAMA,EAAER,EAAE,KAAKM;QACnD,IAAI,CAACL,OAAO;QAEZ,KAAK,MAAM,CAACQ,UAAUC,QAAQ,IAAIf,OAAOO,OAAO,CAACD,MAAMX,WAAW,EAAG;YACnE,IAAI,CAACA,WAAW,CAACmB,SAAS,EAAE;gBAC1BnB,WAAW,CAACmB,SAAS,GAAG,EAAE;YAC5B;YACA,qBAAqB;YACrB,KAAK,MAAME,UAAUD,QAAS;gBAC5B,IAAI,CAACpB,WAAW,CAACmB,SAAS,CAAC5B,QAAQ,CAAC8B,SAAS;oBAC3CrB,WAAW,CAACmB,SAAS,CAACG,IAAI,CAACD;gBAC7B;YACF;QACF;IACF;IAEA,OAAOrB;AACT"}

package/dist/utils/session.js

@@ -2,8 +2,7 @@
  * Server-side session utilities
  *
  * @packageDocumentation
- */
-/**
+ */ /**
  * Get the current session from headers.
  *
  * @example
@@ -22,18 +21,18 @@
  *   return <div>Hello {session.user.name}</div>
  * }
  * ```
- */
-export async function getServerSession(payload, headers) {
+ */ export async function getServerSession(payload, headers) {
     try {
         const payloadWithAuth = payload;
         if (!payloadWithAuth.betterAuth) {
             console.error('[session] Better Auth not initialized');
             return null;
         }
-        const session = await payloadWithAuth.betterAuth.api.getSession({ headers });
+        const session = await payloadWithAuth.betterAuth.api.getSession({
+            headers
+        });
         return session;
-    }
-    catch (error) {
+    } catch (error) {
         console.error('[session] Error getting session:', error);
         return null;
     }
@@ -57,9 +56,9 @@ export async function getServerSession(payload, headers) {
  *   return <div>Hello {user.name}</div>
  * }
  * ```
- */
-export async function getServerUser(payload, headers) {
+ */ export async function getServerUser(payload, headers) {
     const session = await getServerSession(payload, headers);
     return session?.user ?? null;
 }
+
 //# sourceMappingURL=session.js.map

package/dist/utils/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/utils/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAoB,EACpB,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,OAA0B,CAAA;QAElD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAA;YACtD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5E,OAAO,OAAyB,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAoB,EACpB,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACxD,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,CAAA;AAC9B,CAAC"}
+{"version":3,"sources":["../../src/utils/session.ts"],"sourcesContent":["/**\n * Server-side session utilities\n *\n * @packageDocumentation\n */\n\nimport type { BasePayload } from 'payload'\nimport type { PayloadWithAuth } from '../plugin/index.js'\n\nexport type Session = {\n  user: {\n    id: string\n    email: string\n    name?: string\n    image?: string\n    [key: string]: unknown\n  }\n  session: {\n    id: string\n    expiresAt: Date\n    [key: string]: unknown\n  }\n}\n\n/**\n * Get the current session from headers.\n *\n * @example\n * ```ts\n * import { headers } from 'next/headers'\n * import { getServerSession } from '@delmare/payload-better-auth'\n *\n * export default async function Page() {\n *   const headersList = await headers()\n *   const session = await getServerSession(payload, headersList)\n *\n *   if (!session) {\n *     redirect('/login')\n *   }\n *\n *   return <div>Hello {session.user.name}</div>\n * }\n * ```\n */\nexport async function getServerSession(\n  payload: BasePayload,\n  headers: Headers\n): Promise<Session | null> {\n  try {\n    const payloadWithAuth = payload as PayloadWithAuth\n\n    if (!payloadWithAuth.betterAuth) {\n      console.error('[session] Better Auth not initialized')\n      return null\n    }\n\n    const session = await payloadWithAuth.betterAuth.api.getSession({ headers })\n    return session as Session | null\n  } catch (error) {\n    console.error('[session] Error getting session:', error)\n    return null\n  }\n}\n\n/**\n * Get the current user from the session.\n *\n * @example\n * ```ts\n * import { headers } from 'next/headers'\n * import { getServerUser } from '@delmare/payload-better-auth'\n *\n * export default async function Page() {\n *   const headersList = await headers()\n *   const user = await getServerUser(payload, headersList)\n *\n *   if (!user) {\n *     redirect('/login')\n *   }\n *\n *   return <div>Hello {user.name}</div>\n * }\n * ```\n */\nexport async function getServerUser(\n  payload: BasePayload,\n  headers: Headers\n): Promise<Session['user'] | null> {\n  const session = await getServerSession(payload, headers)\n  return session?.user ?? null\n}\n"],"names":["getServerSession","payload","headers","payloadWithAuth","betterAuth","console","error","session","api","getSession","getServerUser","user"],"mappings":"AAAA;;;;CAIC,GAoBD;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,eAAeA,iBACpBC,OAAoB,EACpBC,OAAgB;IAEhB,IAAI;QACF,MAAMC,kBAAkBF;QAExB,IAAI,CAACE,gBAAgBC,UAAU,EAAE;YAC/BC,QAAQC,KAAK,CAAC;YACd,OAAO;QACT;QAEA,MAAMC,UAAU,MAAMJ,gBAAgBC,UAAU,CAACI,GAAG,CAACC,UAAU,CAAC;YAAEP;QAAQ;QAC1E,OAAOK;IACT,EAAE,OAAOD,OAAO;QACdD,QAAQC,KAAK,CAAC,oCAAoCA;QAClD,OAAO;IACT;AACF;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,eAAeI,cACpBT,OAAoB,EACpBC,OAAgB;IAEhB,MAAMK,UAAU,MAAMP,iBAAiBC,SAASC;IAChD,OAAOK,SAASI,QAAQ;AAC1B"}