@delmaredigital/payload-better-auth 0.6.0 → 0.6.2

package/dist/components/management/ApiKeysManagementClient.d.ts

@@ -1,4 +1,9 @@
 import type { PermissionDefinition } from '../../types/apiKey.js';
+/** Organization option for the org selector */
+export type OrganizationOption = {
+    id: string | number;
+    name: string;
+};
 export type ApiKeysManagementClientProps = {
     /** Optional pre-configured auth client with apiKey plugin */
     authClient?: any;
@@ -6,10 +11,16 @@ export type ApiKeysManagementClientProps = {
     title?: string;
     /** Available permission definitions (collections + actions). Auto-generated if not provided. */
     permissions?: PermissionDefinition[];
+    /**
+     * Available organizations for scoping API keys.
+     * When provided, shows an organization selector in the creation form.
+     * Each key can be optionally bound to one organization.
+     */
+    organizations?: OrganizationOption[];
 };
 /**
  * Client component for API keys management.
  * Lists, creates, and deletes API keys with permission selection (read/write per collection).
  */
-export declare function ApiKeysManagementClient({ authClient: providedClient, title, permissions, }?: ApiKeysManagementClientProps): import("react").JSX.Element;
+export declare function ApiKeysManagementClient({ authClient: providedClient, title, permissions, organizations, }?: ApiKeysManagementClientProps): import("react").JSX.Element;
 export default ApiKeysManagementClient;

package/dist/components/management/ApiKeysManagementClient.js

@@ -5,7 +5,7 @@ import { createAuthClient } from 'better-auth/react';
 /**
  * Client component for API keys management.
  * Lists, creates, and deletes API keys with permission selection (read/write per collection).
- */ export function ApiKeysManagementClient({ authClient: providedClient, title = 'API Keys', permissions = [] } = {}) {
+ */ export function ApiKeysManagementClient({ authClient: providedClient, title = 'API Keys', permissions = [], organizations = [] } = {}) {
     const [apiKeys, setApiKeys] = useState([]);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
@@ -17,7 +17,9 @@ import { createAuthClient } from 'better-auth/react';
     // Selected permissions: { posts: ['read', 'write'], pages: ['read'] }
     const [selectedPermissions, setSelectedPermissions] = useState({});
     const [newlyCreatedKey, setNewlyCreatedKey] = useState(null);
+    const [selectedOrganizationId, setSelectedOrganizationId] = useState('');
     const hasPermissions = permissions.length > 0;
+    const hasOrganizations = organizations.length > 0;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const clientRef = useRef(null);
     const getClient = async ()=>{
@@ -205,6 +207,10 @@ import { createAuthClient } from 'better-auth/react';
             if (hasPermissions && selectedCount > 0) {
                 createOptions.permissions = selectedPermissions;
             }
+            // Bind to organization if selected
+            if (selectedOrganizationId) {
+                createOptions.organizationId = selectedOrganizationId;
+            }
             const result = await client.apiKey.create(createOptions);
             if (result.error) {
                 setError(result.error.message ?? 'Failed to create API key');
@@ -214,6 +220,7 @@ import { createAuthClient } from 'better-auth/react';
                 setNewKeyName('');
                 setNewKeyExpiry('');
                 setSelectedPermissions({});
+                setSelectedOrganizationId('');
                 fetchApiKeys();
             }
         } catch  {
@@ -448,6 +455,53 @@ import { createAuthClient } from 'better-auth/react';
                                     })
                                 ]
                             }),
+                            hasOrganizations && /*#__PURE__*/ _jsxs("div", {
+                                style: {
+                                    marginBottom: 'var(--base)'
+                                },
+                                children: [
+                                    /*#__PURE__*/ _jsx("label", {
+                                        style: {
+                                            display: 'block',
+                                            color: 'var(--theme-text)',
+                                            fontSize: 'var(--font-size-small)',
+                                            marginBottom: 'calc(var(--base) * 0.25)'
+                                        },
+                                        children: "Organization (optional)"
+                                    }),
+                                    /*#__PURE__*/ _jsxs("select", {
+                                        value: selectedOrganizationId,
+                                        onChange: (e)=>setSelectedOrganizationId(e.target.value),
+                                        style: {
+                                            width: '100%',
+                                            padding: 'calc(var(--base) * 0.5)',
+                                            background: 'var(--theme-input-bg)',
+                                            border: '1px solid var(--theme-elevation-150)',
+                                            borderRadius: 'var(--style-radius-s)',
+                                            color: 'var(--theme-text)',
+                                            boxSizing: 'border-box'
+                                        },
+                                        children: [
+                                            /*#__PURE__*/ _jsx("option", {
+                                                value: "",
+                                                children: "No organization (global key)"
+                                            }),
+                                            organizations.map((org)=>/*#__PURE__*/ _jsx("option", {
+                                                    value: String(org.id),
+                                                    children: org.name
+                                                }, String(org.id)))
+                                        ]
+                                    }),
+                                    /*#__PURE__*/ _jsx("div", {
+                                        style: {
+                                            marginTop: 'calc(var(--base) * 0.25)',
+                                            fontSize: '11px',
+                                            color: 'var(--theme-elevation-600)'
+                                        },
+                                        children: selectedOrganizationId ? 'API key will only have access to this organization\'s data.' : 'Without an organization, the key will not have org-scoped access.'
+                                    })
+                                ]
+                            }),
                             hasPermissions && /*#__PURE__*/ _jsxs("div", {
                                 style: {
                                     marginBottom: 'var(--base)'
@@ -745,6 +799,29 @@ import { createAuthClient } from 'better-auth/react';
                                             })
                                         ]
                                     }),
+                                    Boolean(key.metadata?.organizationId) && /*#__PURE__*/ _jsx("div", {
+                                        style: {
+                                            marginTop: 'calc(var(--base) * 0.5)'
+                                        },
+                                        children: /*#__PURE__*/ _jsxs("span", {
+                                            style: {
+                                                padding: '2px 6px',
+                                                background: 'var(--theme-elevation-150)',
+                                                borderRadius: 'var(--style-radius-s)',
+                                                fontSize: '11px',
+                                                color: 'var(--theme-elevation-700)',
+                                                fontWeight: 500
+                                            },
+                                            children: [
+                                                "Org: ",
+                                                (()=>{
+                                                    const orgId = String(key.metadata?.organizationId ?? '');
+                                                    const org = organizations.find((o)=>String(o.id) === orgId);
+                                                    return org?.name ?? orgId;
+                                                })()
+                                            ]
+                                        })
+                                    }),
                                     key.permissions && Object.keys(key.permissions).length > 0 && /*#__PURE__*/ _jsx("div", {
                                         style: {
                                             display: 'flex',

package/dist/components/management/views/ApiKeysView.js

@@ -4,6 +4,51 @@ import { getVisibleEntities } from '@payloadcms/ui/shared';
 import { ApiKeysManagementClient } from '../ApiKeysManagementClient.js';
 import { getApiKeyPermissionsConfig } from '../../../plugin/index.js';
 import { generateCollectionPermissions } from '../../../utils/generatePermissions.js';
+/**
+ * Fetch organizations the current user belongs to.
+ * Returns an empty array if the members/organizations collections don't exist.
+ */ async function getUserOrganizations(payload, userId) {
+    try {
+        // Check if members and organizations collections exist
+        const collectionSlugs = payload.config.collections.map((c)=>c.slug);
+        if (!collectionSlugs.includes('members') || !collectionSlugs.includes('organizations')) {
+            return [];
+        }
+        // Find all memberships for this user
+        const memberships = await payload.find({
+            collection: 'members',
+            where: {
+                user: {
+                    equals: userId
+                }
+            },
+            limit: 100,
+            depth: 0,
+            overrideAccess: true
+        });
+        if (memberships.docs.length === 0) return [];
+        // Fetch organization details
+        const orgIds = memberships.docs.map((m)=>m.organization);
+        const orgs = await payload.find({
+            collection: 'organizations',
+            where: {
+                id: {
+                    in: orgIds
+                }
+            },
+            limit: 100,
+            depth: 0,
+            overrideAccess: true
+        });
+        return orgs.docs.map((org)=>({
+                id: org.id,
+                name: org.name || String(org.id)
+            }));
+    } catch  {
+        // Collections might not exist or have different schemas — return empty
+        return [];
+    }
+}
 /**
  * API Keys management view for Payload admin panel.
  * Server component that provides the admin layout.
@@ -19,6 +64,9 @@ import { generateCollectionPermissions } from '../../../utils/generatePermission
     // Build permission definitions from collections
     const permissionsConfig = getApiKeyPermissionsConfig();
     const permissions = generateCollectionPermissions(payload.config.collections, permissionsConfig?.excludeCollections);
+    // Fetch user's organizations if the organization plugin is in use
+    const userId = req.user?.id;
+    const organizations = userId ? await getUserOrganizations(payload, userId) : [];
     return /*#__PURE__*/ _jsx(DefaultTemplate, {
         i18n: req.i18n,
         locale: req.locale,
@@ -29,7 +77,8 @@ import { generateCollectionPermissions } from '../../../utils/generatePermission
         user: req.user ?? undefined,
         visibleEntities: visibleEntities,
         children: /*#__PURE__*/ _jsx(ApiKeysManagementClient, {
-            permissions: permissions
+            permissions: permissions,
+            organizations: organizations
         })
     });
 }

package/dist/plugin/index.js

@@ -18,7 +18,11 @@ let apiKeyPermissionsConfig = undefined;
 /**
  * Handle API key creation server-side.
  * Passes permissions directly from the client to Better Auth's server API.
- */ async function handleApiKeyCreate(authApi, headers, body) {
+ *
+ * When `organizationId` is provided in the body, it is validated against the
+ * user's memberships and stored in the API key's metadata. This allows the
+ * `betterAuthStrategy` to resolve organization context for API key requests.
+ */ async function handleApiKeyCreate(authApi, headers, body, payload, membersCollection = 'members') {
     try {
         // Get the current session to find the user
         const session = await authApi.getSession({
@@ -34,8 +38,51 @@ let apiKeyPermissionsConfig = undefined;
                 }
             });
         }
+        // If organizationId is provided, validate that the user is a member
+        const organizationId = body.organizationId;
+        if (organizationId && payload) {
+            try {
+                const memberships = await payload.find({
+                    collection: membersCollection,
+                    where: {
+                        and: [
+                            {
+                                user: {
+                                    equals: session.user.id
+                                }
+                            },
+                            {
+                                organization: {
+                                    equals: organizationId
+                                }
+                            }
+                        ]
+                    },
+                    limit: 1,
+                    depth: 0
+                });
+                if (memberships.docs.length === 0) {
+                    return new Response(JSON.stringify({
+                        error: 'You are not a member of this organization'
+                    }), {
+                        status: 403,
+                        headers: {
+                            'Content-Type': 'application/json'
+                        }
+                    });
+                }
+            } catch  {
+            // Members collection might not exist — allow creation without org binding
+            }
+        }
         // Permissions come directly from the client in BA's native format
         const permissions = body.permissions;
+        // Merge organizationId into metadata if provided
+        const existingMetadata = body.metadata;
+        const metadata = organizationId ? {
+            ...existingMetadata || {},
+            organizationId
+        } : existingMetadata;
         const createOptions = {
             body: {
                 name: body.name,
@@ -43,7 +90,7 @@ let apiKeyPermissionsConfig = undefined;
                 expiresIn: body.expiresIn,
                 prefix: body.prefix,
                 permissions: permissions && Object.keys(permissions).length > 0 ? permissions : undefined,
-                metadata: body.metadata
+                metadata: metadata && Object.keys(metadata).length > 0 ? metadata : undefined
             }
         };
         // Call Better Auth's server-side API
@@ -177,7 +224,7 @@ let apiKeyPermissionsConfig = undefined;
             // Intercept API key creation requests to inject userId from session
             const isApiKeyCreate = req.method === 'POST' && pathname.endsWith('/api-key/create');
             if (isApiKeyCreate && parsedBody) {
-                return handleApiKeyCreate(auth.api, req.headers, parsedBody);
+                return handleApiKeyCreate(auth.api, req.headers, parsedBody, req.payload);
             }
             // Create a new Request for Better Auth
             const request = new Request(url.toString(), {
@@ -434,6 +481,12 @@ let apiKeyPermissionsConfig = undefined;
                         console.error('[better-auth] Failed to create auth:', error);
                         throw error;
                     }
+                    // Warn if nextCookies() plugin is detected — it's incompatible with Payload CMS.
+                    // Check via betterAuthOptions (if provided) or the auth instance's options.
+                    const pluginsToCheck = options.admin?.betterAuthOptions?.plugins ?? authInstance.options?.plugins;
+                    if (pluginsToCheck?.some((p)=>p.id === 'next-cookies')) {
+                        console.warn('\n⚠️  [payload-better-auth] The nextCookies() plugin was detected in your Better Auth config.\n' + '   This plugin is INCOMPATIBLE with Payload CMS and will cause infinite form-state\n' + '   submissions and input resets in the admin panel.\n\n' + '   The nextCookies() plugin is designed for Server Actions, but payload-better-auth\n' + '   handles cookie passthrough automatically via its endpoint proxy.\n\n' + '   → Remove nextCookies() from your Better Auth plugins to fix this issue.\n' + '   → See: https://github.com/delmaredigital/payload-better-auth/issues/15\n');
+                    }
                 }
                 // Attach to payload for global access
                 Object.defineProperty(payload, 'betterAuth', {
@@ -564,6 +617,64 @@ let apiKeyPermissionsConfig = undefined;
                     // Members collection might not exist (org plugin not used), silently ignore
                     }
                 }
+                // If activeOrganizationId is not set (common with API key mock sessions),
+                // check if the API key has an organizationId in its metadata
+                if (!sessionFields.activeOrganizationId) {
+                    const apiKeyHeader = headers.get('x-api-key') || headers.get('authorization')?.replace('Bearer ', '');
+                    if (apiKeyHeader) {
+                        const auth = payloadWithAuth.betterAuth;
+                        const verifyApiKey = auth.api.verifyApiKey;
+                        if (typeof verifyApiKey === 'function') {
+                            try {
+                                const verifyResult = await verifyApiKey({
+                                    body: {
+                                        key: apiKeyHeader
+                                    }
+                                });
+                                if (verifyResult.valid && verifyResult.key?.metadata) {
+                                    const metadata = typeof verifyResult.key.metadata === 'string' ? JSON.parse(verifyResult.key.metadata) : verifyResult.key.metadata;
+                                    if (metadata.organizationId) {
+                                        // Coerce to number if using serial IDs
+                                        let orgId = metadata.organizationId;
+                                        if (idType === 'number' && typeof orgId === 'string' && /^\d+$/.test(orgId)) {
+                                            orgId = parseInt(orgId, 10);
+                                        }
+                                        // Verify the user is actually a member of this org
+                                        try {
+                                            const memberships = await payload.find({
+                                                collection: membersCollection,
+                                                where: {
+                                                    and: [
+                                                        {
+                                                            user: {
+                                                                equals: sessionData.user.id
+                                                            }
+                                                        },
+                                                        {
+                                                            organization: {
+                                                                equals: orgId
+                                                            }
+                                                        }
+                                                    ]
+                                                },
+                                                limit: 1,
+                                                depth: 0
+                                            });
+                                            if (memberships.docs.length > 0) {
+                                                sessionFields.activeOrganizationId = orgId;
+                                                organizationRole = memberships.docs[0].role;
+                                            }
+                                        } catch  {
+                                        // Members collection might not exist, continue without org context
+                                        }
+                                    }
+                                }
+                            } catch  {
+                            // API key verification failed, continue without org context
+                            }
+                        }
+                    }
+                }
                 return {
                     user: {
                         ...users.docs[0],

package/dist/utils/detectEnabledPlugins.d.ts

@@ -10,6 +10,7 @@ export type EnabledPluginsResult = {
     hasMagicLink: boolean;
     hasMultiSession: boolean;
     hasOrganization: boolean;
+    hasNextCookies: boolean;
 };
 /**
  * Detects which Better Auth plugins are enabled from the options.

package/dist/utils/detectEnabledPlugins.js

@@ -15,7 +15,8 @@
         hasPasskey: false,
         hasMagicLink: false,
         hasMultiSession: false,
-        hasOrganization: false
+        hasOrganization: false,
+        hasNextCookies: false
     };
     for (const plugin of plugins){
         // Better Auth plugins have an id property
@@ -42,6 +43,9 @@
             case 'organization':
                 result.hasOrganization = true;
                 break;
+            case 'next-cookies':
+                result.hasNextCookies = true;
+                break;
         }
     }
     return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-better-auth",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Better Auth adapter and plugins for Payload CMS",
   "type": "module",
   "license": "MIT",