@delmaredigital/payload-better-auth 0.6.2 → 0.6.4

package/dist/adapter/index.js

@@ -262,8 +262,15 @@
                 }
                 // Get Payload collection slug from model name
                 // Uses factory's getModelName which respects BetterAuthOptions.modelName config
+                // Fix: Better Auth's getModelName blindly appends 's' even when name already ends in 's'
+                // (e.g., 'jwks' becomes 'jwkss'). We normalize to prevent double-s slugs.
                 const getCollection = (model)=>{
-                    return getModelName(model);
+                    const name = getModelName(model);
+                    // Fix double-s from naive pluralization (e.g., jwkss → jwks)
+                    if (name.endsWith('ss') && !model.endsWith('ss')) {
+                        return name.slice(0, -1);
+                    }
+                    return name;
                 };
                 // The CustomAdapter interface uses generics (T) for return types.
                 // Payload returns concrete types (JsonObject & TypeWithID).

package/dist/plugin/index.js

@@ -552,6 +552,90 @@ let apiKeyPermissionsConfig = undefined;
                     headers
                 });
                 if (!sessionData?.user?.id) {
+                    // No session found — check for OAuth JWT Bearer token
+                    const authHeader = headers.get('authorization');
+                    if (authHeader?.startsWith('Bearer ')) {
+                        const token = authHeader.slice(7);
+                        // Try OAuth JWT verification via the oauth-provider's verifyAccessToken
+                        try {
+                            const { verifyAccessToken } = await import('better-auth/oauth2');
+                            const baseURL = auth.options?.baseURL;
+                            if (!baseURL) throw new Error('baseURL not configured');
+                            const jwtPayload = await verifyAccessToken(token, {
+                                jwksUrl: `${baseURL}/api/auth/jwks`,
+                                verifyOptions: {
+                                    issuer: baseURL,
+                                    audience: baseURL
+                                }
+                            });
+                            if (jwtPayload?.sub) {
+                                const users = await payload.find({
+                                    collection: usersCollection,
+                                    where: {
+                                        id: {
+                                            equals: jwtPayload.sub
+                                        }
+                                    },
+                                    limit: 1,
+                                    depth: 0
+                                });
+                                if (users.docs.length > 0) {
+                                    // Extract org context and scopes from JWT claims
+                                    const oauthOrgId = jwtPayload.organizationId;
+                                    const oauthScopes = typeof jwtPayload.scope === 'string' ? jwtPayload.scope.split(' ') : Array.isArray(jwtPayload.scope) ? jwtPayload.scope : [];
+                                    // Look up org role if orgId is present
+                                    let orgRole;
+                                    if (oauthOrgId) {
+                                        try {
+                                            const memberships = await payload.find({
+                                                collection: membersCollection,
+                                                where: {
+                                                    and: [
+                                                        {
+                                                            user: {
+                                                                equals: jwtPayload.sub
+                                                            }
+                                                        },
+                                                        {
+                                                            organization: {
+                                                                equals: oauthOrgId
+                                                            }
+                                                        }
+                                                    ]
+                                                },
+                                                limit: 1,
+                                                depth: 0
+                                            });
+                                            if (memberships.docs.length > 0) {
+                                                orgRole = memberships.docs[0].role;
+                                            }
+                                        } catch  {
+                                        // Members collection might not exist
+                                        }
+                                    }
+                                    const userDoc = users.docs[0];
+                                    const oauthUser = {
+                                        ...userDoc,
+                                        id: userDoc.id,
+                                        oauthScopes,
+                                        collection: usersCollection,
+                                        _strategy: 'better-auth',
+                                        ...oauthOrgId ? {
+                                            activeOrganizationId: oauthOrgId
+                                        } : {},
+                                        ...orgRole ? {
+                                            organizationRole: orgRole
+                                        } : {}
+                                    };
+                                    return {
+                                        user: oauthUser
+                                    };
+                                }
+                            }
+                        } catch  {
+                        // JWT verification failed — not a valid OAuth token, continue to return null
+                        }
+                    }
                     return {
                         user: null
                     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-better-auth",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "Better Auth adapter and plugins for Payload CMS",
   "type": "module",
   "license": "MIT",