@delmaredigital/payload-better-auth 0.6.5 → 0.6.7

package/dist/adapter/collections.js

@@ -166,7 +166,11 @@ function generateCollection(modelKey, table, usePlural, adminGroup, customAccess
             continue;
         }
         const fieldName = fieldDef.fieldName ?? fieldKey;
-        const hasReferences = fieldDef.references !== undefined;
+        // Only treat as a relationship if it references the target's 'id' field.
+        // When referencing a non-PK field (e.g., oauthClient.clientId), use a plain
+        // text field instead — Payload relationships always FK to 'id', which would
+        // cause FK constraint violations for non-PK references.
+        const hasReferences = fieldDef.references !== undefined && (!fieldDef.references.field || fieldDef.references.field === 'id');
         const fieldType = mapFieldType(fieldDef.type, fieldKey, hasReferences);
         if (fieldType === 'relationship') {
             // Use schema reference if available, otherwise infer from field name

package/dist/adapter/index.js

@@ -218,9 +218,12 @@
             adapter: ({ schema, getModelName, debugLog })=>{
                 // Set fieldName on reference fields so the factory maps userId→user, etc.
                 // Payload uses relationship fields without the Id suffix.
+                // Only do this for references to 'id' (primary key). Non-PK references
+                // (e.g., oauthRefreshToken.clientId → oauthClient.clientId) stay as plain
+                // text fields and should keep their original name.
                 for (const table of Object.values(schema)){
                     for (const [fieldKey, fieldDef] of Object.entries(table.fields)){
-                        if (fieldDef.references) {
+                        if (fieldDef.references && (!fieldDef.references.field || fieldDef.references.field === 'id')) {
                             const stripped = fieldKey.replace(/(_id|Id)$/, '');
                             if (stripped !== fieldKey) fieldDef.fieldName = stripped;
                         }

package/dist/plugin/index.js

@@ -560,11 +560,16 @@ let apiKeyPermissionsConfig = undefined;
                         try {
                             const { verifyAccessToken } = await import('better-auth/oauth2');
                             const baseURL = auth.options?.baseURL;
+                            const basePath = auth.options?.basePath || '/api/auth';
                             if (!baseURL) throw new Error('baseURL not configured');
+                            // issuer = baseURL + basePath (e.g., https://example.com/api/auth)
+                            // audience = baseURL (e.g., https://example.com) — the resource server
+                            // jwks = issuer + /jwks
+                            const issuer = `${baseURL}${basePath}`;
                             const jwtPayload = await verifyAccessToken(token, {
-                                jwksUrl: `${baseURL}/api/auth/jwks`,
+                                jwksUrl: `${issuer}/jwks`,
                                 verifyOptions: {
-                                    issuer: baseURL,
+                                    issuer,
                                     audience: baseURL
                                 }
                             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-better-auth",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Better Auth adapter and plugins for Payload CMS",
   "type": "module",
   "license": "MIT",