@delmaredigital/payload-better-auth 0.6.1 → 0.6.4

package/dist/adapter/index.js

@@ -262,8 +262,15 @@
                 }
                 // Get Payload collection slug from model name
                 // Uses factory's getModelName which respects BetterAuthOptions.modelName config
+                // Fix: Better Auth's getModelName blindly appends 's' even when name already ends in 's'
+                // (e.g., 'jwks' becomes 'jwkss'). We normalize to prevent double-s slugs.
                 const getCollection = (model)=>{
-                    return getModelName(model);
+                    const name = getModelName(model);
+                    // Fix double-s from naive pluralization (e.g., jwkss → jwks)
+                    if (name.endsWith('ss') && !model.endsWith('ss')) {
+                        return name.slice(0, -1);
+                    }
+                    return name;
                 };
                 // The CustomAdapter interface uses generics (T) for return types.
                 // Payload returns concrete types (JsonObject & TypeWithID).

package/dist/plugin/index.js

@@ -481,6 +481,12 @@ let apiKeyPermissionsConfig = undefined;
                         console.error('[better-auth] Failed to create auth:', error);
                         throw error;
                     }
+                    // Warn if nextCookies() plugin is detected — it's incompatible with Payload CMS.
+                    // Check via betterAuthOptions (if provided) or the auth instance's options.
+                    const pluginsToCheck = options.admin?.betterAuthOptions?.plugins ?? authInstance.options?.plugins;
+                    if (pluginsToCheck?.some((p)=>p.id === 'next-cookies')) {
+                        console.warn('\n⚠️  [payload-better-auth] The nextCookies() plugin was detected in your Better Auth config.\n' + '   This plugin is INCOMPATIBLE with Payload CMS and will cause infinite form-state\n' + '   submissions and input resets in the admin panel.\n\n' + '   The nextCookies() plugin is designed for Server Actions, but payload-better-auth\n' + '   handles cookie passthrough automatically via its endpoint proxy.\n\n' + '   → Remove nextCookies() from your Better Auth plugins to fix this issue.\n' + '   → See: https://github.com/delmaredigital/payload-better-auth/issues/15\n');
+                    }
                 }
                 // Attach to payload for global access
                 Object.defineProperty(payload, 'betterAuth', {
@@ -546,6 +552,90 @@ let apiKeyPermissionsConfig = undefined;
                     headers
                 });
                 if (!sessionData?.user?.id) {
+                    // No session found — check for OAuth JWT Bearer token
+                    const authHeader = headers.get('authorization');
+                    if (authHeader?.startsWith('Bearer ')) {
+                        const token = authHeader.slice(7);
+                        // Try OAuth JWT verification via the oauth-provider's verifyAccessToken
+                        try {
+                            const { verifyAccessToken } = await import('better-auth/oauth2');
+                            const baseURL = auth.options?.baseURL;
+                            if (!baseURL) throw new Error('baseURL not configured');
+                            const jwtPayload = await verifyAccessToken(token, {
+                                jwksUrl: `${baseURL}/api/auth/jwks`,
+                                verifyOptions: {
+                                    issuer: baseURL,
+                                    audience: baseURL
+                                }
+                            });
+                            if (jwtPayload?.sub) {
+                                const users = await payload.find({
+                                    collection: usersCollection,
+                                    where: {
+                                        id: {
+                                            equals: jwtPayload.sub
+                                        }
+                                    },
+                                    limit: 1,
+                                    depth: 0
+                                });
+                                if (users.docs.length > 0) {
+                                    // Extract org context and scopes from JWT claims
+                                    const oauthOrgId = jwtPayload.organizationId;
+                                    const oauthScopes = typeof jwtPayload.scope === 'string' ? jwtPayload.scope.split(' ') : Array.isArray(jwtPayload.scope) ? jwtPayload.scope : [];
+                                    // Look up org role if orgId is present
+                                    let orgRole;
+                                    if (oauthOrgId) {
+                                        try {
+                                            const memberships = await payload.find({
+                                                collection: membersCollection,
+                                                where: {
+                                                    and: [
+                                                        {
+                                                            user: {
+                                                                equals: jwtPayload.sub
+                                                            }
+                                                        },
+                                                        {
+                                                            organization: {
+                                                                equals: oauthOrgId
+                                                            }
+                                                        }
+                                                    ]
+                                                },
+                                                limit: 1,
+                                                depth: 0
+                                            });
+                                            if (memberships.docs.length > 0) {
+                                                orgRole = memberships.docs[0].role;
+                                            }
+                                        } catch  {
+                                        // Members collection might not exist
+                                        }
+                                    }
+                                    const userDoc = users.docs[0];
+                                    const oauthUser = {
+                                        ...userDoc,
+                                        id: userDoc.id,
+                                        oauthScopes,
+                                        collection: usersCollection,
+                                        _strategy: 'better-auth',
+                                        ...oauthOrgId ? {
+                                            activeOrganizationId: oauthOrgId
+                                        } : {},
+                                        ...orgRole ? {
+                                            organizationRole: orgRole
+                                        } : {}
+                                    };
+                                    return {
+                                        user: oauthUser
+                                    };
+                                }
+                            }
+                        } catch  {
+                        // JWT verification failed — not a valid OAuth token, continue to return null
+                        }
+                    }
                     return {
                         user: null
                     };

package/dist/utils/detectEnabledPlugins.d.ts

@@ -10,6 +10,7 @@ export type EnabledPluginsResult = {
     hasMagicLink: boolean;
     hasMultiSession: boolean;
     hasOrganization: boolean;
+    hasNextCookies: boolean;
 };
 /**
  * Detects which Better Auth plugins are enabled from the options.

package/dist/utils/detectEnabledPlugins.js

@@ -15,7 +15,8 @@
         hasPasskey: false,
         hasMagicLink: false,
         hasMultiSession: false,
-        hasOrganization: false
+        hasOrganization: false,
+        hasNextCookies: false
     };
     for (const plugin of plugins){
         // Better Auth plugins have an id property
@@ -42,6 +43,9 @@
             case 'organization':
                 result.hasOrganization = true;
                 break;
+            case 'next-cookies':
+                result.hasNextCookies = true;
+                break;
         }
     }
     return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-better-auth",
-  "version": "0.6.1",
+  "version": "0.6.4",
   "description": "Better Auth adapter and plugins for Payload CMS",
   "type": "module",
   "license": "MIT",