@delmaredigital/payload-better-auth 0.4.2 → 0.4.4

package/dist/adapter/collections.js

@@ -303,11 +303,19 @@ function generateCollection(modelKey, table, usePlural, adminGroup, customAccess
             });
         } else {
             const saveToJWT = configureSaveToJWT ? getSaveToJWT(modelKey, payloadFieldName) : undefined;
+            // Fields managed exclusively by Better Auth should be read-only in the admin UI
+            const readOnlyFields = [
+                'twoFactorEnabled'
+            ];
+            const isReadOnly = readOnlyFields.includes(payloadFieldName);
             const field = {
                 name: payloadFieldName,
                 type: fieldType,
                 admin: {
-                    description: `Auto-added by Better Auth (${fieldKey})`
+                    description: `Auto-added by Better Auth (${fieldKey})`,
+                    ...isReadOnly && {
+                        readOnly: true
+                    }
                 },
                 ...saveToJWT !== undefined && {
                     saveToJWT

package/dist/adapter/index.d.ts

@@ -8,6 +8,20 @@
  */
 import type { Adapter, BetterAuthOptions } from 'better-auth';
 import type { BasePayload } from 'payload';
+/**
+ * Database types supported by Payload CMS.
+ */
+export type DbType = 'postgres' | 'mongodb' | 'sqlite';
+/**
+ * Detect the database type from the Payload instance.
+ */
+export declare function detectDbType(payload: BasePayload): DbType;
+/**
+ * Determine ID type based on database type and Better Auth config.
+ * MongoDB always uses text IDs (ObjectId strings).
+ * Postgres defaults to 'number' (SERIAL) unless generateId indicates otherwise.
+ */
+export declare function resolveIdType(dbType: DbType, options: BetterAuthOptions, explicitIdType?: 'number' | 'text'): 'number' | 'text';
 export type PayloadAdapterConfig = {
     /**
      * The Payload instance or a function that returns it.
@@ -22,6 +36,11 @@ export type PayloadAdapterConfig = {
          * Enable debug logging for troubleshooting
          */
         enableDebugLogs?: boolean;
+        /**
+         * Database type. Auto-detected from Payload's database adapter if not set.
+         * Set explicitly if auto-detection doesn't work for your adapter.
+         */
+        dbType?: DbType;
         /**
          * ID type used by Payload.
          * If not specified, auto-detects from Better Auth's generateId setting.

package/dist/adapter/index.js

@@ -7,15 +7,26 @@
  * @packageDocumentation
  */ import { createAdapterFactory } from 'better-auth/adapters';
 /**
- * Detect ID type from Better Auth options.
- * Defaults to 'number' (SERIAL) since Payload uses SERIAL IDs by default.
- */ function detectIdType(options) {
+ * Detect the database type from the Payload instance.
+ */ export function detectDbType(payload) {
+    const dbName = payload.db?.name;
+    if (typeof dbName === 'string') {
+        if (dbName.includes('mongo') || dbName.includes('mongoose')) return 'mongodb';
+        if (dbName.includes('sqlite')) return 'sqlite';
+    }
+    return 'postgres';
+}
+/**
+ * Determine ID type based on database type and Better Auth config.
+ * MongoDB always uses text IDs (ObjectId strings).
+ * Postgres defaults to 'number' (SERIAL) unless generateId indicates otherwise.
+ */ export function resolveIdType(dbType, options, explicitIdType) {
+    if (dbType === 'mongodb') return 'text';
+    if (explicitIdType) return explicitIdType;
     const generateId = options.advanced?.database?.generateId;
-    // If explicitly set to something other than 'serial', use text (UUID)
     if (generateId !== undefined && generateId !== 'serial') {
         return 'text';
     }
-    // Default to number (SERIAL) - Payload's default
     return 'number';
 }
 /**
@@ -59,7 +70,7 @@
     async function resolvePayloadClient() {
         return typeof payloadClient === 'function' ? await payloadClient() : payloadClient;
     }
-    function convertOperator(operator, value) {
+    function convertOperator(operator, value, dbType) {
         switch(operator){
             case 'eq':
                 return {
@@ -89,15 +100,25 @@
                 return {
                     in: value
                 };
+            case 'not_in':
+                return {
+                    not_in: value
+                };
             case 'contains':
                 return {
                     contains: value
                 };
             case 'starts_with':
+                if (dbType === 'mongodb') return {
+                    contains: value
+                };
                 return {
                     like: `${value}%`
                 };
             case 'ends_with':
+                if (dbType === 'mongodb') return {
+                    contains: value
+                };
                 return {
                     like: `%${value}`
                 };
@@ -122,9 +143,11 @@
     }
     // Return the adapter factory function
     return (options)=>{
-        // Determine ID type: explicit config > auto-detect
-        // Defaults to 'number' (SERIAL) since Payload uses SERIAL IDs by default
-        const idType = adapterConfig.idType ?? detectIdType(options);
+        // Determine ID type based on database type
+        // If payloadClient is already resolved, detect dbType immediately
+        // Otherwise default to 'postgres' (will be updated on first operation)
+        const effectiveDbType = adapterConfig.dbType ?? (typeof payloadClient !== 'function' ? detectDbType(payloadClient) : 'postgres');
+        const idType = resolveIdType(effectiveDbType, options, adapterConfig.idType);
         const generateId = options.advanced?.database?.generateId;
         // Warn if using number IDs but Better Auth is explicitly configured to generate its own IDs
         // This would cause Better Auth to generate UUIDs which won't work with SERIAL columns
@@ -153,11 +176,13 @@
             // Payload collections are plural by default (users, sessions, etc.)
             // Users can customize via BetterAuthOptions: user: { modelName: 'custom_users' }
             usePlural: true,
-            // Let Payload generate IDs when using serial/auto-increment
-            disableIdGeneration: idType === 'number',
-            // Payload supports these features
-            supportsNumericIds: true,
-            supportsDates: true,
+            // Payload always generates IDs (SERIAL for postgres/sqlite, ObjectId for mongodb)
+            disableIdGeneration: true,
+            // MongoDB uses ObjectId strings, not numeric IDs
+            supportsNumericIds: effectiveDbType !== 'mongodb',
+            // Payload returns dates as ISO strings via its Local API, not Date objects.
+            // Setting false tells the factory to convert string dates ↔ Date objects.
+            supportsDates: false,
             supportsBooleans: true,
             supportsJSON: true,
             supportsArrays: false,
@@ -171,11 +196,18 @@
         // so we'll resolve it lazily on first operation
         let resolvedPayload = null;
         let resolvePromise = null;
+        let resolvedDbType = adapterConfig.dbType ?? null;
         const getPayload = async ()=>{
             if (resolvedPayload) return resolvedPayload;
             if (!resolvePromise) {
                 resolvePromise = resolvePayloadClient().then((p)=>{
                     resolvedPayload = p;
+                    if (!resolvedDbType) {
+                        resolvedDbType = detectDbType(p);
+                        if (enableDebugLogs) {
+                            console.log('[payload-adapter] Detected database type:', resolvedDbType);
+                        }
+                    }
                     return p;
                 });
             }
@@ -295,19 +327,6 @@
                             }
                         }
                     }
-                    // Convert date strings to Date objects
-                    // Better Auth expects Date objects for date field comparisons
-                    for (const [key, value] of Object.entries(transformed)){
-                        if (typeof value !== 'string') continue;
-                        // Check if schema defines this field as a date type
-                        const fieldDef = modelSchema.fields[key];
-                        if (fieldDef?.type === 'date') {
-                            const dateValue = new Date(value);
-                            if (!isNaN(dateValue.getTime())) {
-                                transformed[key] = dateValue;
-                            }
-                        }
-                    }
                     // Convert semantic ID fields to numbers when using serial IDs
                     // Heuristic: fields ending in 'Id' or '_id' containing numeric strings
                     // Modified by allowlist (add) and blocklist (exclude)
@@ -337,7 +356,7 @@
                     if (where.length === 1) {
                         const w = where[0];
                         return {
-                            [getPayloadFieldName(model, w.field)]: convertOperator(w.operator, w.value)
+                            [getPayloadFieldName(model, w.field)]: convertOperator(w.operator, w.value, resolvedDbType ?? 'postgres')
                         };
                     }
                     const andConditions = where.filter((w)=>w.connector !== 'OR');
@@ -345,12 +364,12 @@
                     const result = {};
                     if (andConditions.length > 0) {
                         result.and = andConditions.map((w)=>({
-                                [getPayloadFieldName(model, w.field)]: convertOperator(w.operator, w.value)
+                                [getPayloadFieldName(model, w.field)]: convertOperator(w.operator, w.value, resolvedDbType ?? 'postgres')
                             }));
                     }
                     if (orConditions.length > 0) {
                         result.or = orConditions.map((w)=>({
-                                [getPayloadFieldName(model, w.field)]: convertOperator(w.operator, w.value)
+                                [getPayloadFieldName(model, w.field)]: convertOperator(w.operator, w.value, resolvedDbType ?? 'postgres')
                             }));
                     }
                     return result;
@@ -389,10 +408,19 @@
                             // Transform back and merge with input data for Better Auth
                             // Database result takes precedence (handles hooks that modify data like firstUserAdmin)
                             const transformed = transformDataFromPayload(model, result);
-                            return {
+                            const merged = {
                                 ...data,
                                 ...transformed
                             };
+                            if (enableDebugLogs) {
+                                debugLog('create result', {
+                                    collection,
+                                    resultId: result.id,
+                                    transformedKeys: Object.keys(transformed),
+                                    mergedKeys: Object.keys(merged)
+                                });
+                            }
+                            return merged;
                         } catch (error) {
                             console.error('[payload-adapter] create failed:', {
                                 collection,
@@ -424,15 +452,39 @@
                                         depth: join ? 1 : 0,
                                         overrideAccess: true
                                     });
-                                    return transformDataFromPayload(model, result);
+                                    const transformed = transformDataFromPayload(model, result);
+                                    if (enableDebugLogs) {
+                                        debugLog('findOne result (byID)', {
+                                            collection,
+                                            id: convertId(id),
+                                            found: true,
+                                            transformedKeys: Object.keys(transformed)
+                                        });
+                                    }
+                                    return transformed;
                                 } catch (error) {
                                     if (error instanceof Error && 'status' in error && error.status === 404) {
+                                        if (enableDebugLogs) {
+                                            debugLog('findOne result (byID)', {
+                                                collection,
+                                                id: convertId(id),
+                                                found: false
+                                            });
+                                        }
                                         return null;
                                     }
                                     throw error;
                                 }
                             }
                             const payloadWhere = convertWhereToPayload(model, where);
+                            if (enableDebugLogs) {
+                                debugLog('findOne query', {
+                                    collection,
+                                    payloadWhere: JSON.stringify(payloadWhere),
+                                    resolvedDbType,
+                                    idType
+                                });
+                            }
                             const result = await payload.find({
                                 collection,
                                 where: payloadWhere,
@@ -440,8 +492,22 @@
                                 depth: join ? 1 : 0,
                                 overrideAccess: true
                             });
+                            if (enableDebugLogs) {
+                                debugLog('findOne result', {
+                                    collection,
+                                    totalDocs: result.totalDocs,
+                                    found: result.docs.length > 0
+                                });
+                            }
                             if (!result.docs[0]) return null;
-                            return transformDataFromPayload(model, result.docs[0]);
+                            const transformed = transformDataFromPayload(model, result.docs[0]);
+                            if (enableDebugLogs) {
+                                debugLog('findOne transformed', {
+                                    collection,
+                                    transformedKeys: Object.keys(transformed)
+                                });
+                            }
+                            return transformed;
                         } catch (error) {
                             console.error('[payload-adapter] findOne failed:', {
                                 model,

package/dist/components/LogoutButton.d.ts

@@ -1,6 +1,9 @@
 /**
  * Logout button component styled to match Payload's admin nav.
  * Uses Payload's CSS classes and variables for native theme integration.
+ *
+ * Clears both Better Auth session and Payload's JWT cookie to ensure
+ * clean state when switching between users.
  */
 export declare function LogoutButton(): import("react").JSX.Element;
 export default LogoutButton;

package/dist/components/LogoutButton.js

@@ -5,6 +5,9 @@ import { useRouter } from 'next/navigation.js';
 /**
  * Logout button component styled to match Payload's admin nav.
  * Uses Payload's CSS classes and variables for native theme integration.
+ *
+ * Clears both Better Auth session and Payload's JWT cookie to ensure
+ * clean state when switching between users.
  */ export function LogoutButton() {
     const router = useRouter();
     const [isLoading, setIsLoading] = useState(false);
@@ -12,14 +15,23 @@ import { useRouter } from 'next/navigation.js';
         if (isLoading) return;
         setIsLoading(true);
         try {
-            await fetch('/api/auth/sign-out', {
-                method: 'POST',
-                credentials: 'include',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify({})
-            });
+            // Clear both sessions simultaneously while cookies are still valid.
+            // - Better Auth: clears BA session cookie
+            // - Payload: clears JWT cookie (payload-token) so useAuth() resets
+            await Promise.allSettled([
+                fetch('/api/auth/sign-out', {
+                    method: 'POST',
+                    credentials: 'include',
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({})
+                }),
+                fetch('/api/users/logout', {
+                    method: 'POST',
+                    credentials: 'include'
+                })
+            ]);
             router.push('/admin/login');
         } catch (error) {
             console.error('[better-auth] Logout error:', error);

package/dist/components/management/fields/PasskeysField.d.ts

@@ -1,5 +1,13 @@
 /**
  * Thin wrapper around PasskeysManagementClient for use as a Payload `ui` field.
+ *
+ * Better Auth's passkey APIs are session-based (always operate on the logged-in user).
+ * When viewing another user's document, we show an info message instead of the
+ * management UI to avoid displaying the admin's own passkeys on someone else's page.
+ *
+ * While auth context is hydrating (user is null), we show the management UI since
+ * the API is session-based and will only ever return the logged-in user's passkeys —
+ * no other user's data can be leaked.
  */
 export declare function PasskeysField(): import("react").JSX.Element;
 export default PasskeysField;

package/dist/components/management/fields/PasskeysField.js

@@ -1,9 +1,32 @@
 'use client';
 import { jsx as _jsx } from "react/jsx-runtime";
+import { useAuth, useDocumentInfo } from '@payloadcms/ui';
 import { PasskeysManagementClient } from '../PasskeysManagementClient.js';
 /**
  * Thin wrapper around PasskeysManagementClient for use as a Payload `ui` field.
+ *
+ * Better Auth's passkey APIs are session-based (always operate on the logged-in user).
+ * When viewing another user's document, we show an info message instead of the
+ * management UI to avoid displaying the admin's own passkeys on someone else's page.
+ *
+ * While auth context is hydrating (user is null), we show the management UI since
+ * the API is session-based and will only ever return the logged-in user's passkeys —
+ * no other user's data can be leaked.
  */ export function PasskeysField() {
+    const { id: documentId } = useDocumentInfo();
+    const { user } = useAuth();
+    // Only block when we KNOW it's a different user.
+    // While auth is loading (user is null), show the UI — it's session-based
+    // and only returns the logged-in user's own passkeys regardless.
+    if (user && String(documentId) !== String(user.id)) {
+        return /*#__PURE__*/ _jsx("div", {
+            className: "field-type",
+            children: /*#__PURE__*/ _jsx("p", {
+                className: "field-description",
+                children: "Passkeys can only be managed by the account owner."
+            })
+        });
+    }
     return /*#__PURE__*/ _jsx(PasskeysManagementClient, {});
 }
 export default PasskeysField;

package/dist/components/management/fields/TwoFactorField.d.ts

@@ -1,6 +1,15 @@
 /**
  * Wrapper around TwoFactorManagementClient for use as a Payload `ui` field.
  *
+ * Better Auth's 2FA APIs are session-based (always operate on the logged-in user).
+ * When viewing another user's document, we show an info message instead of the
+ * management UI to avoid the admin accidentally modifying their own 2FA settings
+ * while on someone else's page.
+ *
+ * While auth context is hydrating (user is null), we show the management UI since
+ * the API is session-based and will only ever operate on the logged-in user's own
+ * 2FA settings — no other user's data can be leaked or modified.
+ *
  * After 2FA is enabled or disabled, triggers a Next.js router refresh so that
  * the document form re-fetches from the DB and picks up the `twoFactorEnabled`
  * value that Better Auth wrote. Without this, navigating away without clicking

package/dist/components/management/fields/TwoFactorField.js

@@ -2,21 +2,45 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { useRouter } from 'next/navigation.js';
 import { useCallback } from 'react';
+import { useAuth, useDocumentInfo } from '@payloadcms/ui';
 import { TwoFactorManagementClient } from '../TwoFactorManagementClient.js';
 /**
  * Wrapper around TwoFactorManagementClient for use as a Payload `ui` field.
  *
+ * Better Auth's 2FA APIs are session-based (always operate on the logged-in user).
+ * When viewing another user's document, we show an info message instead of the
+ * management UI to avoid the admin accidentally modifying their own 2FA settings
+ * while on someone else's page.
+ *
+ * While auth context is hydrating (user is null), we show the management UI since
+ * the API is session-based and will only ever operate on the logged-in user's own
+ * 2FA settings — no other user's data can be leaked or modified.
+ *
  * After 2FA is enabled or disabled, triggers a Next.js router refresh so that
  * the document form re-fetches from the DB and picks up the `twoFactorEnabled`
  * value that Better Auth wrote. Without this, navigating away without clicking
  * Save would overwrite the change.
  */ export function TwoFactorField() {
     const router = useRouter();
+    const { id: documentId } = useDocumentInfo();
+    const { user } = useAuth();
     const handleComplete = useCallback(()=>{
         router.refresh();
     }, [
         router
     ]);
+    // Only block when we KNOW it's a different user.
+    // While auth is loading (user is null), show the UI — it's session-based
+    // and only operates on the logged-in user's own 2FA regardless.
+    if (user && String(documentId) !== String(user.id)) {
+        return /*#__PURE__*/ _jsx("div", {
+            className: "field-type",
+            children: /*#__PURE__*/ _jsx("p", {
+                className: "field-description",
+                children: "Two-factor authentication can only be managed by the account owner."
+            })
+        });
+    }
     return /*#__PURE__*/ _jsx(TwoFactorManagementClient, {
         onComplete: handleComplete
     });

package/dist/index.d.ts

@@ -6,8 +6,8 @@
  *
  * @packageDocumentation
  */
-export { payloadAdapter } from './adapter/index.js';
-export type { PayloadAdapterConfig } from './adapter/index.js';
+export { payloadAdapter, detectDbType, resolveIdType } from './adapter/index.js';
+export type { PayloadAdapterConfig, DbType } from './adapter/index.js';
 export { betterAuthCollections } from './adapter/collections.js';
 export type { BetterAuthCollectionsOptions } from './adapter/collections.js';
 export { createBetterAuthPlugin, betterAuthStrategy, resetAuthInstance, getApiKeyScopesConfig, } from './plugin/index.js';

package/dist/index.js

@@ -6,7 +6,7 @@
  *
  * @packageDocumentation
  */ // Adapter
-export { payloadAdapter } from './adapter/index.js';
+export { payloadAdapter, detectDbType, resolveIdType } from './adapter/index.js';
 // Collection generator plugin
 export { betterAuthCollections } from './adapter/collections.js';
 // Payload plugin and strategy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-better-auth",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Better Auth adapter and plugins for Payload CMS",
   "type": "module",
   "license": "MIT",
@@ -89,17 +89,17 @@
     }
   },
   "devDependencies": {
-    "@payloadcms/next": "^3.76.1",
-    "@payloadcms/ui": "^3.76.1",
+    "@better-auth/passkey": "^1.4.18",
+    "@payloadcms/next": "^3.77.0",
+    "@payloadcms/ui": "^3.77.0",
     "@swc/cli": "^0.6.0",
     "@swc/core": "^1.15.11",
-    "@types/node": "^25.2.3",
+    "@types/node": "^25.3.0",
     "@types/react": "^19.2.14",
     "@vitest/coverage-v8": "^2.1.9",
-    "@better-auth/passkey": "^1.4.18",
     "better-auth": "^1.4.18",
     "next": "^16.1.6",
-    "payload": "^3.76.1",
+    "payload": "^3.77.0",
     "react": "^19.2.4",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",