@delmaredigital/payload-better-auth 0.6.6 → 0.6.8

package/dist/adapter/collections.js

@@ -166,7 +166,11 @@ function generateCollection(modelKey, table, usePlural, adminGroup, customAccess
             continue;
         }
         const fieldName = fieldDef.fieldName ?? fieldKey;
-        const hasReferences = fieldDef.references !== undefined;
+        // Only treat as a relationship if it references the target's 'id' field.
+        // When referencing a non-PK field (e.g., oauthClient.clientId), use a plain
+        // text field instead — Payload relationships always FK to 'id', which would
+        // cause FK constraint violations for non-PK references.
+        const hasReferences = fieldDef.references !== undefined && (!fieldDef.references.field || fieldDef.references.field === 'id');
         const fieldType = mapFieldType(fieldDef.type, fieldKey, hasReferences);
         if (fieldType === 'relationship') {
             // Use schema reference if available, otherwise infer from field name

package/dist/adapter/index.js

@@ -218,9 +218,12 @@
             adapter: ({ schema, getModelName, debugLog })=>{
                 // Set fieldName on reference fields so the factory maps userId→user, etc.
                 // Payload uses relationship fields without the Id suffix.
+                // Only do this for references to 'id' (primary key). Non-PK references
+                // (e.g., oauthRefreshToken.clientId → oauthClient.clientId) stay as plain
+                // text fields and should keep their original name.
                 for (const table of Object.values(schema)){
                     for (const [fieldKey, fieldDef] of Object.entries(table.fields)){
-                        if (fieldDef.references) {
+                        if (fieldDef.references && (!fieldDef.references.field || fieldDef.references.field === 'id')) {
                             const stripped = fieldKey.replace(/(_id|Id)$/, '');
                             if (stripped !== fieldKey) fieldDef.fieldName = stripped;
                         }

package/dist/plugin/index.js

@@ -638,7 +638,96 @@ let apiKeyPermissionsConfig = undefined;
                                 }
                             }
                         } catch  {
-                        // JWT verification failed — not a valid OAuth token, continue to return null
+                            // JWT verification failed — try opaque token lookup
+                            // Refreshed OAuth tokens are opaque (not JWTs) and stored in the DB
+                            try {
+                                const adapter = auth.options?.adapter;
+                                if (adapter?.findOne) {
+                                    // Hash the token the same way Better Auth stores it (SHA-256 base64url)
+                                    const { createHash } = await import('crypto');
+                                    const hashedToken = createHash('sha256').update(token).digest('base64url');
+                                    const accessTokenRecord = await adapter.findOne({
+                                        model: 'oauthAccessToken',
+                                        where: [
+                                            {
+                                                field: 'token',
+                                                value: hashedToken
+                                            }
+                                        ]
+                                    });
+                                    if (accessTokenRecord && accessTokenRecord.userId) {
+                                        // Check expiry
+                                        const expiresAt = accessTokenRecord.expiresAt instanceof Date ? accessTokenRecord.expiresAt : new Date(accessTokenRecord.expiresAt);
+                                        if (expiresAt < new Date()) {
+                                        // Token expired
+                                        } else {
+                                            const userId = accessTokenRecord.userId;
+                                            const users = await payload.find({
+                                                collection: usersCollection,
+                                                where: {
+                                                    id: {
+                                                        equals: userId
+                                                    }
+                                                },
+                                                limit: 1,
+                                                depth: 0
+                                            });
+                                            if (users.docs.length > 0) {
+                                                const scopes = Array.isArray(accessTokenRecord.scopes) ? accessTokenRecord.scopes : [];
+                                                const referenceId = accessTokenRecord.referenceId;
+                                                // Look up org role if referenceId (org ID) is present
+                                                let orgRole;
+                                                if (referenceId) {
+                                                    try {
+                                                        const memberships = await payload.find({
+                                                            collection: membersCollection,
+                                                            where: {
+                                                                and: [
+                                                                    {
+                                                                        user: {
+                                                                            equals: userId
+                                                                        }
+                                                                    },
+                                                                    {
+                                                                        organization: {
+                                                                            equals: referenceId
+                                                                        }
+                                                                    }
+                                                                ]
+                                                            },
+                                                            limit: 1,
+                                                            depth: 0
+                                                        });
+                                                        if (memberships.docs.length > 0) {
+                                                            orgRole = memberships.docs[0].role;
+                                                        }
+                                                    } catch  {
+                                                    // Members collection might not exist
+                                                    }
+                                                }
+                                                const userDoc = users.docs[0];
+                                                return {
+                                                    user: {
+                                                        ...userDoc,
+                                                        id: userDoc.id,
+                                                        oauthScopes: scopes,
+                                                        collection: usersCollection,
+                                                        _strategy: 'better-auth',
+                                                        ...referenceId ? {
+                                                            activeOrganizationId: referenceId
+                                                        } : {},
+                                                        ...orgRole ? {
+                                                            organizationRole: orgRole
+                                                        } : {}
+                                                    }
+                                                };
+                                            }
+                                        }
+                                    }
+                                }
+                            } catch  {
+                            // Opaque token lookup also failed — continue to return null
+                            }
                         }
                     }
                     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-better-auth",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Better Auth adapter and plugins for Payload CMS",
   "type": "module",
   "license": "MIT",