@delmaredigital/payload-better-auth 0.6.7 → 0.6.8

package/dist/plugin/index.js

@@ -638,7 +638,96 @@ let apiKeyPermissionsConfig = undefined;
                                 }
                             }
                         } catch  {
-                        // JWT verification failed — not a valid OAuth token, continue to return null
+                            // JWT verification failed — try opaque token lookup
+                            // Refreshed OAuth tokens are opaque (not JWTs) and stored in the DB
+                            try {
+                                const adapter = auth.options?.adapter;
+                                if (adapter?.findOne) {
+                                    // Hash the token the same way Better Auth stores it (SHA-256 base64url)
+                                    const { createHash } = await import('crypto');
+                                    const hashedToken = createHash('sha256').update(token).digest('base64url');
+                                    const accessTokenRecord = await adapter.findOne({
+                                        model: 'oauthAccessToken',
+                                        where: [
+                                            {
+                                                field: 'token',
+                                                value: hashedToken
+                                            }
+                                        ]
+                                    });
+                                    if (accessTokenRecord && accessTokenRecord.userId) {
+                                        // Check expiry
+                                        const expiresAt = accessTokenRecord.expiresAt instanceof Date ? accessTokenRecord.expiresAt : new Date(accessTokenRecord.expiresAt);
+                                        if (expiresAt < new Date()) {
+                                        // Token expired
+                                        } else {
+                                            const userId = accessTokenRecord.userId;
+                                            const users = await payload.find({
+                                                collection: usersCollection,
+                                                where: {
+                                                    id: {
+                                                        equals: userId
+                                                    }
+                                                },
+                                                limit: 1,
+                                                depth: 0
+                                            });
+                                            if (users.docs.length > 0) {
+                                                const scopes = Array.isArray(accessTokenRecord.scopes) ? accessTokenRecord.scopes : [];
+                                                const referenceId = accessTokenRecord.referenceId;
+                                                // Look up org role if referenceId (org ID) is present
+                                                let orgRole;
+                                                if (referenceId) {
+                                                    try {
+                                                        const memberships = await payload.find({
+                                                            collection: membersCollection,
+                                                            where: {
+                                                                and: [
+                                                                    {
+                                                                        user: {
+                                                                            equals: userId
+                                                                        }
+                                                                    },
+                                                                    {
+                                                                        organization: {
+                                                                            equals: referenceId
+                                                                        }
+                                                                    }
+                                                                ]
+                                                            },
+                                                            limit: 1,
+                                                            depth: 0
+                                                        });
+                                                        if (memberships.docs.length > 0) {
+                                                            orgRole = memberships.docs[0].role;
+                                                        }
+                                                    } catch  {
+                                                    // Members collection might not exist
+                                                    }
+                                                }
+                                                const userDoc = users.docs[0];
+                                                return {
+                                                    user: {
+                                                        ...userDoc,
+                                                        id: userDoc.id,
+                                                        oauthScopes: scopes,
+                                                        collection: usersCollection,
+                                                        _strategy: 'better-auth',
+                                                        ...referenceId ? {
+                                                            activeOrganizationId: referenceId
+                                                        } : {},
+                                                        ...orgRole ? {
+                                                            organizationRole: orgRole
+                                                        } : {}
+                                                    }
+                                                };
+                                            }
+                                        }
+                                    }
+                                }
+                            } catch  {
+                            // Opaque token lookup also failed — continue to return null
+                            }
                         }
                     }
                     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-better-auth",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "description": "Better Auth adapter and plugins for Payload CMS",
   "type": "module",
   "license": "MIT",