@headless-lms/adapter-auth 0.2.0 → 0.3.0

package/dist/better-auth.js

@@ -1,19 +1,73 @@
+import { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions } from "./access-grant.js";
 import { ac, roles } from "./access.js";
+import { withLoopbackNativeDefault } from "./client-registration.js";
+import { ACCESS_TOKEN_TTL_SECONDS, ORG_CLAIM } from "@headless-lms/core/identity";
+import { ACCESS_SCOPES, OrganizationRuleError, parseRole } from "@headless-lms/core/organizations";
+import { createDpopReplayStore, enforceDpopBinding, isDpopBindingError, verifyJwsAccessToken } from "better-auth/oauth2";
 import { fromNodeHeaders } from "better-auth/node";
 import { APIError, betterAuth } from "better-auth";
+import { createAuthMiddleware } from "better-auth/api";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import * as authSchema from "@headless-lms/adapter-db/schema/better-auth";
 import { prefixId } from "@headless-lms/core/shared/id";
-import { customSession, magicLink, organization } from "better-auth/plugins";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
+import { customSession, jwt, magicLink, organization } from "better-auth/plugins";
+import { oauthProviderAuthServerMetadata } from "@better-auth/oauth-provider";
+import { mcp } from "@better-auth/mcp";
+import { cimd } from "@better-auth/cimd";
+import { fetchClientMetadataResource } from "@better-auth/cimd/node";
+import { apiKey } from "@better-auth/api-key";
 import { eq } from "drizzle-orm";
-import { OrganizationRuleError, parseRole } from "@headless-lms/core/organizations";
 //#region src/better-auth.ts
-function createAuth(opts) {
+const JWT_ALG = "EdDSA";
+const UNMIRRORED_ORG_ENDPOINTS = /* @__PURE__ */ new Set([
+	"/organization/leave",
+	"/organization/invite-member",
+	"/organization/accept-invitation"
+]);
+const OAUTH_CLIENT_WRITES = /* @__PURE__ */ new Set([
+	"/oauth2/create-client",
+	"/oauth2/update-client",
+	"/oauth2/delete-client"
+]);
+function activeOrgOf(session) {
+	const value = session?.activeOrganizationId;
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+async function memberOrgIds(db, userId) {
+	return (await db.select({ organizationId: authSchema.member.organizationId }).from(authSchema.member).where(eq(authSchema.member.userId, userId))).map((row) => row.organizationId);
+}
+function mcpOAuthPlugins(opts) {
+	return [mcp({
+		resource: opts.mcp.resource,
+		loginPage: opts.mcp.loginPage,
+		consentPage: opts.mcp.consentPage,
+		scopes: [...ACCESS_SCOPES, "offline_access"],
+		clientRegistrationDefaultScopes: [...ACCESS_SCOPES, "offline_access"],
+		accessTokenExpiresIn: ACCESS_TOKEN_TTL_SECONDS,
+		allowDynamicClientRegistration: true,
+		allowUnauthenticatedClientRegistration: true,
+		postLogin: {
+			page: opts.mcp.orgPickerPage,
+			shouldRedirect: ({ session, user }) => needsOrgChoice(activeOrgOf(session), () => memberOrgIds(opts.db, user.id)),
+			consentReferenceId: async ({ session, user }) => {
+				const orgId = await consentOrgId(activeOrgOf(session), () => memberOrgIds(opts.db, user.id));
+				if (!orgId) throw new APIError("FORBIDDEN", { message: "Choose an organization you are a member of" });
+				return orgId;
+			}
+		},
+		customAccessTokenClaims: ({ referenceId }) => referenceId ? { [ORG_CLAIM]: referenceId } : {}
+	}), cimd({
+		fetchClientMetadataResource,
+		metadataProfile: "mcp-2026-07-28"
+	})];
+}
+function buildAuthOptions(opts) {
 	const { sendResetPassword, onPasswordReset, sendMagicLink, beforeUserCreate, beforeCreateSession } = opts.hooks;
 	const detached = (name, hook) => async (...args) => {
 		hook(...args).catch((err) => opts.logger.error(`auth hook ${name} failed`, { err }));
 	};
-	return betterAuth({
+	return {
 		baseURL: opts.baseUrl,
 		secret: opts.secret,
 		trustedOrigins: opts.trustedOrigins,
@@ -54,6 +108,15 @@ function createAuth(opts) {
 				creatorRole: "owner",
 				organizationHooks: opts.hooks
 			}),
+			jwt({
+				disableSettingJwtHeader: true,
+				jwks: { keyPairConfig: { alg: JWT_ALG } }
+			}),
+			...opts.mcp.oauthEnabled ? mcpOAuthPlugins(opts) : [],
+			apiKey({
+				enableMetadata: true,
+				rateLimit: { enabled: false }
+			}),
 			customSession(async ({ user, session }) => {
 				const memberships = await opts.db.select({
 					role: authSchema.member.role,
@@ -80,22 +143,220 @@ function createAuth(opts) {
 				};
 			})
 		],
+		hooks: { before: createAuthMiddleware(async (ctx) => {
+			if (ctx.path === "/api-key/create" && (ctx.request || ctx.headers)) throw new APIError("FORBIDDEN", { message: "API keys are created through the LMS" });
+			if (UNMIRRORED_ORG_ENDPOINTS.has(ctx.path)) throw new APIError("FORBIDDEN", { message: "Membership changes go through the LMS" });
+			if (OAUTH_CLIENT_WRITES.has(ctx.path) && (ctx.request || ctx.headers)) throw new APIError("FORBIDDEN", { message: "Apps register themselves when they connect" });
+			if (ctx.path === "/api-key/update" && ctx.body?.metadata !== void 0) throw new APIError("FORBIDDEN", { message: "An API key stays in the organization it was made for" });
+			if (ctx.path !== "/oauth2/register") return;
+			const body = withLoopbackNativeDefault(ctx.body);
+			return body ? { context: { body } } : void 0;
+		}) },
 		databaseHooks: {
 			user: { create: { before: beforeUserCreate } },
 			session: { create: { before: beforeCreateSession } }
 		}
-	});
+	};
+}
+function createAuth(opts) {
+	return betterAuth(buildAuthOptions(opts));
 }
 var BetterAuth = class {
 	auth;
 	logger;
-	constructor(opts) {
-		this.auth = createAuth(opts);
+	mcp;
+	issuer;
+	jwksCacheKey = {};
+	constructor(opts, auth) {
+		this.auth = auth ?? createAuth(opts);
 		this.logger = opts.logger;
+		this.mcp = opts.mcp;
+		this.issuer = `${opts.baseUrl.replace(/\/+$/, "")}/api/auth`;
+	}
+	get pluginApi() {
+		return this.auth.api;
 	}
 	async handler(request) {
 		return this.auth.handler(request);
 	}
+	async authorizationServerMetadata(request) {
+		return oauthProviderAuthServerMetadata(this.auth)(request);
+	}
+	async verifyAccess(request) {
+		const apiKeyHeader = request.headers["x-api-key"];
+		if (typeof apiKeyHeader === "string" && apiKeyHeader.length > 0) return this.verifyApiKey(apiKeyHeader);
+		const authorization = accessTokenAuthorization(request.headers.authorization);
+		if (!authorization) return null;
+		if (authorization.scheme === "Bearer" && !isCompactJws(authorization.token)) return this.verifyApiKey(authorization.token);
+		return this.mcp.oauthEnabled ? this.verifyAccessToken(authorization, request) : null;
+	}
+	async verifyAccessToken(authorization, request) {
+		let claims;
+		try {
+			claims = await verifyJwsAccessToken(authorization.token, {
+				jwksFetch: async () => this.pluginApi.getJwks(),
+				jwksCacheKey: this.jwksCacheKey,
+				verifyOptions: {
+					audience: this.mcp.resource,
+					issuer: this.issuer,
+					algorithms: [JWT_ALG]
+				}
+			});
+		} catch {
+			return null;
+		}
+		const ctx = await this.auth.$context;
+		const proof = request.headers.dpop;
+		try {
+			await enforceDpopBinding({
+				payload: claims,
+				authorization,
+				proofJwt: typeof proof === "string" ? proof : void 0,
+				method: request.method,
+				url: request.url,
+				replayStore: createDpopReplayStore(ctx.internalAdapter)
+			});
+		} catch (error) {
+			if (isDpopBindingError(error)) return null;
+			throw error;
+		}
+		const grant = grantFromClaims(claims);
+		if (!grant) return null;
+		const consent = await ctx.adapter.findOne({
+			model: "oauthConsent",
+			where: [
+				{
+					field: "clientId",
+					value: grant.clientId
+				},
+				{
+					field: "userId",
+					value: grant.userId
+				},
+				{
+					field: "referenceId",
+					value: grant.orgId
+				}
+			]
+		});
+		return consent ? {
+			...grant,
+			scopes: grant.scopes.filter((scope) => consent.scopes.includes(scope))
+		} : null;
+	}
+	async verifyApiKey(key) {
+		const result = await this.pluginApi.verifyApiKey({ body: { key } });
+		if (!result.valid || !result.key) return null;
+		const orgId = orgIdFromMetadata(result.key.metadata);
+		if (!orgId) return null;
+		return {
+			userId: result.key.referenceId,
+			orgId,
+			scopes: permissionsToScopes(result.key.permissions),
+			clientId: `api-key:${result.key.id}`
+		};
+	}
+	async sessionUserId(headers) {
+		const session = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });
+		if (!session) throw new OrganizationRuleError("No session");
+		return session.user.id;
+	}
+	async listConnectedApps(headers, orgId) {
+		const userId = await this.sessionUserId(headers);
+		if (!this.mcp.oauthEnabled) return [];
+		const ctx = await this.auth.$context;
+		const consents = await ctx.adapter.findMany({
+			model: "oauthConsent",
+			where: [{
+				field: "userId",
+				value: userId
+			}, {
+				field: "referenceId",
+				value: orgId
+			}]
+		});
+		return Promise.all(consents.map(async (consent) => {
+			const client = await ctx.adapter.findOne({
+				model: "oauthClient",
+				where: [{
+					field: "clientId",
+					value: consent.clientId
+				}]
+			});
+			return {
+				clientId: consent.clientId,
+				name: client?.name ?? consent.clientId,
+				iconUrl: client?.icon ?? null,
+				scopes: consent.scopes,
+				connectedAt: consent.createdAt ?? /* @__PURE__ */ new Date(0)
+			};
+		}));
+	}
+	async revokeConnectedApp(headers, orgId, clientId) {
+		const userId = await this.sessionUserId(headers);
+		if (!this.mcp.oauthEnabled) return;
+		const ctx = await this.auth.$context;
+		const where = [
+			{
+				field: "clientId",
+				value: clientId
+			},
+			{
+				field: "userId",
+				value: userId
+			},
+			{
+				field: "referenceId",
+				value: orgId
+			}
+		];
+		await ctx.adapter.deleteMany({
+			model: "oauthAccessToken",
+			where
+		});
+		await ctx.adapter.deleteMany({
+			model: "oauthRefreshToken",
+			where
+		});
+		await ctx.adapter.deleteMany({
+			model: "oauthConsent",
+			where
+		});
+	}
+	async listApiKeys(headers, orgId) {
+		return (await this.pluginApi.listApiKeys({ headers: fromNodeHeaders(headers) })).apiKeys.filter((key) => orgIdFromMetadata(key.metadata) === orgId).map((key) => ({
+			id: key.id,
+			name: key.name ?? null,
+			start: key.start ?? null,
+			scopes: permissionsToScopes(key.permissions),
+			createdAt: new Date(key.createdAt),
+			lastUsedAt: key.lastRequest ? new Date(key.lastRequest) : null
+		}));
+	}
+	async createApiKey(input) {
+		const created = await this.pluginApi.createApiKey({ body: {
+			name: input.name,
+			userId: input.authUserId,
+			metadata: { organizationId: input.orgId },
+			permissions: scopesToPermissions(input.scopes)
+		} });
+		return {
+			id: created.id,
+			name: created.name ?? null,
+			start: created.start ?? null,
+			scopes: permissionsToScopes(created.permissions),
+			createdAt: new Date(created.createdAt),
+			lastUsedAt: null,
+			key: created.key
+		};
+	}
+	async deleteApiKey(headers, orgId, keyId) {
+		if (!(await this.listApiKeys(headers, orgId)).some((key) => key.id === keyId)) throw new NotFoundError("API key", keyId);
+		await this.pluginApi.deleteApiKey({
+			body: { keyId },
+			headers: fromNodeHeaders(headers)
+		});
+	}
 	async verify(headers) {
 		const res = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });
 		if (!res) return null;
@@ -227,6 +488,6 @@ var BetterAuth = class {
 	}
 };
 //#endregion
-export { BetterAuth, createAuth };
+export { BetterAuth, buildAuthOptions, createAuth };
 
 //# sourceMappingURL=better-auth.js.map

package/dist/better-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth.js","names":[],"sources":["../src/better-auth.ts"],"sourcesContent":["import type {\n  ActiveSession,\n  Logger,\n  NewOrganizationInput,\n  SessionVerifier,\n} from \"@headless-lms/core/types\";\nimport type { IncomingHttpHeaders } from \"node:http\";\nimport { fromNodeHeaders } from \"better-auth/node\";\nimport { APIError, betterAuth } from \"better-auth\";\nimport type { CreateAuthOptions } from \"./types.js\";\nimport { drizzleAdapter } from \"better-auth/adapters/drizzle\";\nimport * as authSchema from \"@headless-lms/adapter-db/schema/better-auth\";\nimport { prefixId } from \"@headless-lms/core/shared/id\";\nimport { customSession, magicLink, organization } from \"better-auth/plugins\";\nimport { eq } from \"drizzle-orm\";\nimport { ac, roles } from \"./access.js\";\nimport {\n  type AuthHeaders,\n  type AuthOrganization,\n  type MemberWriteContext,\n  type OrgAdmin,\n  OrganizationRuleError,\n  parseRole,\n  type Role,\n  type UpdateOrganizationInput,\n} from \"@headless-lms/core/organizations\";\nimport type { SessionAdmin } from \"@headless-lms/core/identity\";\n\nexport function createAuth(opts: CreateAuthOptions) {\n  const {\n    sendResetPassword,\n    onPasswordReset,\n    sendMagicLink,\n    beforeUserCreate,\n    beforeCreateSession,\n  } = opts.hooks;\n  const detached =\n    <A extends unknown[]>(name: string, hook: (...args: A) => Promise<void>) =>\n    async (...args: A): Promise<void> => {\n      void hook(...args).catch((err: unknown) =>\n        opts.logger.error(`auth hook ${name} failed`, { err }),\n      );\n    };\n\n  const auth = betterAuth({\n    baseURL: opts.baseUrl,\n    secret: opts.secret,\n    trustedOrigins: opts.trustedOrigins,\n    session: {\n      // Signed short-lived cookie cache: avoids a Postgres session lookup on\n      // every request. The BFF verifies the session per request (each API call\n      // + every SSR getSession), so without this each one is a DB round-trip.\n      // The cache holds for maxAge; sign-out / expiry still invalidate it.\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60,\n      },\n    },\n    advanced: {\n      database: {\n        // Prefixed, KSUID-bodied ids for every better-auth table (usr_, org_, …).\n        generateId: () => prefixId(\"id\"),\n      },\n      // Cross-subdomain shared session cookie for admin/api/web on one parent\n      // domain (e.g. `.example.com` in prod). Left unset in local dev so the\n      // host-only `localhost` cookie is used, which is already shared across\n      // ports (cookies are not port-scoped).\n      crossSubDomainCookies: {\n        enabled: true,\n        domain: opts.cookieDomain || undefined,\n      },\n      // Same-site cookie for the shared-parent-domain plan. Only switch to\n      // `sameSite: \"none\"` + `secure` if admin and api are genuinely cross-site\n      // (different registrable domains).\n      defaultCookieAttributes: {\n        sameSite: \"lax\",\n        secure: opts.secureCookies ?? false,\n        httpOnly: true,\n      },\n    },\n    database: drizzleAdapter(opts.db, {\n      provider: \"pg\",\n      schema: authSchema,\n    }),\n    emailAndPassword: {\n      enabled: true,\n      // Detached so send time can't reveal which emails have accounts, and a failed notice can't fail the reset.\n      sendResetPassword: detached(\"sendResetPassword\", sendResetPassword),\n      onPasswordReset: detached(\"onPasswordReset\", onPasswordReset),\n      revokeSessionsOnPasswordReset: true,\n    },\n    plugins: [\n      magicLink({\n        disableSignUp: true,\n        sendMagicLink,\n      }),\n      organization({\n        ac,\n        roles,\n        creatorRole: \"owner\",\n        organizationHooks: opts.hooks,\n      }),\n      // Enrich get-session with the caller's memberships (role + org) so BFFs\n      // resolve auth in one call instead of fanning out to get-active-member /\n      // get-full-organization / organization/list. Custom fields bypass the\n      // cookie cache, so this costs one indexed query per get-session.\n      customSession(async ({ user, session }) => {\n        const memberships = await opts.db\n          .select({\n            role: authSchema.member.role,\n            id: authSchema.organization.id,\n            name: authSchema.organization.name,\n            slug: authSchema.organization.slug,\n          })\n          .from(authSchema.member)\n          .innerJoin(\n            authSchema.organization,\n            eq(authSchema.member.organizationId, authSchema.organization.id),\n          )\n          .where(eq(authSchema.member.userId, user.id));\n        const activeOrgId =\n          (session as { activeOrganizationId?: string | null }).activeOrganizationId ?? null;\n        const active = memberships.find((m) => m.id === activeOrgId) ?? null;\n        return {\n          user,\n          session,\n          activeMemberRole: active?.role ?? null,\n          activeOrganization: active\n            ? { id: active.id, name: active.name, slug: active.slug }\n            : null,\n          organizations: memberships.map(({ id, name, slug }) => ({ id, name, slug })),\n        };\n      }),\n    ],\n    databaseHooks: {\n      user: {\n        create: {\n          before: beforeUserCreate,\n        },\n      },\n      session: {\n        create: {\n          before: beforeCreateSession,\n        },\n      },\n    },\n  });\n  return auth;\n}\n\nexport type Auth = ReturnType<typeof createAuth>;\n\nexport class BetterAuth implements SessionVerifier, OrgAdmin, SessionAdmin {\n  protected auth: Auth;\n  protected logger: Logger;\n\n  constructor(opts: CreateAuthOptions) {\n    this.auth = createAuth(opts);\n    this.logger = opts.logger;\n  }\n\n  async handler(request: Request): Promise<Response> {\n    return this.auth.handler(request);\n  }\n\n  async verify(headers: IncomingHttpHeaders): Promise<ActiveSession | null> {\n    const res = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });\n    if (!res) {\n      return null;\n    }\n    return {\n      user: {\n        id: res.user.id,\n        createdAt: res.user.createdAt,\n        email: res.user.email,\n        firstName: res.user.name,\n        externalId: res.user.id,\n        lastName: res.user.name,\n        updatedAt: res.user.updatedAt,\n      },\n      session: {\n        // customSession erases the org plugin's session extension from the\n        // inferred type; the field is still present at runtime.\n        activeOrganizationId:\n          (res.session as { activeOrganizationId?: string | null }).activeOrganizationId ?? null,\n      },\n    };\n  }\n\n  /** Stamps the org onto the caller's session row. The 5-minute cookie cache\n   *  still holds the pre-stamp session, so callers refresh it client-side with\n   *  `getSession({ disableCookieCache: true })`. */\n  async stampActiveOrganization(headers: AuthHeaders, orgId: string): Promise<boolean> {\n    const session = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });\n    const token = (session?.session as { token?: string } | undefined)?.token;\n    if (!token) {\n      return false;\n    }\n    const ctx = await this.auth.$context;\n    await ctx.internalAdapter.updateSession(token, { activeOrganizationId: orgId });\n    return true;\n  }\n\n  async createOrganization(\n    headers: AuthHeaders,\n    input: NewOrganizationInput,\n  ): Promise<AuthOrganization> {\n    const org = await this.auth.api.createOrganization({\n      body: { name: input.name, slug: input.slug },\n      headers: fromNodeHeaders(headers),\n    });\n    if (!org) {\n      throw new Error(`Couldn't create organization`);\n    }\n    return { id: org.id, name: org.name, slug: org.slug, createdAt: org.createdAt };\n  }\n  async setActiveOrganization(headers: AuthHeaders, externalId: string): Promise<void> {\n    await this.auth.api.setActiveOrganization({\n      body: { organizationId: externalId },\n      headers: fromNodeHeaders(headers),\n    });\n  }\n  async updateOrganization(\n    headers: AuthHeaders,\n    externalId: string,\n    input: UpdateOrganizationInput,\n  ): Promise<AuthOrganization> {\n    try {\n      const org = await this.auth.api.updateOrganization({\n        body: { organizationId: externalId, data: { name: input.name, slug: input.slug } },\n        headers: fromNodeHeaders(headers),\n      });\n      if (!org) {\n        throw new Error(`Couldn't update organization`);\n      }\n      return { id: org.id, name: org.name, slug: org.slug, createdAt: org.createdAt };\n    } catch (err) {\n      // Surface Better Auth validation/permission failures (e.g. slug taken) as\n      // a domain rule error the route maps to 409 rather than a raw 500.\n      if (err instanceof APIError) {\n        throw new OrganizationRuleError(err.message || \"Could not update organization\");\n      }\n      throw err;\n    }\n  }\n  async deleteOrganization(headers: AuthHeaders, externalId: string): Promise<void> {\n    try {\n      await this.auth.api.deleteOrganization({\n        body: { organizationId: externalId },\n        headers: fromNodeHeaders(headers),\n      });\n    } catch (err) {\n      if (err instanceof APIError) {\n        throw new OrganizationRuleError(err.message || \"Could not delete organization\");\n      }\n      throw err;\n    }\n  }\n  async grantMembership(\n    orgExternalId: string,\n    userExternalId: string,\n    role: string,\n  ): Promise<void> {\n    // Server-side (no session): the accepted invitation is the authorisation.\n    try {\n      await this.auth.api.addMember({\n        body: { userId: userExternalId, organizationId: orgExternalId, role: parseRole(role) },\n      });\n    } catch (err) {\n      if (\n        err instanceof APIError &&\n        err.body?.code === \"USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION\"\n      ) {\n        return;\n      }\n      throw err;\n    }\n  }\n  async updateRole(ctx: MemberWriteContext, userExternalId: string, role: Role): Promise<void> {\n    await this.auth.api.updateMemberRole({\n      body: {\n        memberId: await this.resolveMemberId(ctx, userExternalId),\n        role,\n        organizationId: ctx.authOrgId,\n      },\n      headers: this.headersOf(ctx),\n    });\n  }\n  async removeMember(ctx: MemberWriteContext, userExternalId: string): Promise<void> {\n    await this.auth.api.removeMember({\n      body: {\n        memberIdOrEmail: await this.resolveMemberId(ctx, userExternalId),\n        organizationId: ctx.authOrgId,\n      },\n      headers: this.headersOf(ctx),\n    });\n  }\n\n  protected headersOf(ctx: MemberWriteContext): Headers {\n    return fromNodeHeaders(ctx.headers);\n  }\n\n  // Better Auth's member endpoints key on its own member id, which the domain\n  // deliberately does not store — `(org, user)` already identifies the record,\n  // so it is looked up here instead of mirrored into org_users.\n  protected async resolveMemberId(\n    ctx: MemberWriteContext,\n    userExternalId: string,\n  ): Promise<string> {\n    const res = await this.auth.api.listMembers({\n      query: {\n        organizationId: ctx.authOrgId,\n        filterField: \"userId\",\n        filterValue: userExternalId,\n        limit: 1,\n      },\n      headers: this.headersOf(ctx),\n    });\n    const memberId = res?.members?.[0]?.id;\n    if (!memberId) {\n      throw new OrganizationRuleError(\"That person is no longer a member of this organization\");\n    }\n    return memberId;\n  }\n}\n"],"mappings":";;;;;;;;;;AA4BA,SAAgB,WAAW,MAAyB;CAClD,MAAM,EACJ,mBACA,iBACA,eACA,kBACA,wBACE,KAAK;CACT,MAAM,YACkB,MAAc,SACpC,OAAO,GAAG,SAA2B;EACnC,KAAU,GAAG,IAAI,CAAC,CAAC,OAAO,QACxB,KAAK,OAAO,MAAM,aAAa,KAAK,UAAU,EAAE,IAAI,CAAC,CACvD;CACF;CAyGF,OAvGa,WAAW;EACtB,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,gBAAgB,KAAK;EACrB,SAAS,EAKP,aAAa;GACX,SAAS;GACT,QAAQ;EACV,EACF;EACA,UAAU;GACR,UAAU,EAER,kBAAkB,SAAS,IAAI,EACjC;GAKA,uBAAuB;IACrB,SAAS;IACT,QAAQ,KAAK,gBAAgB,KAAA;GAC/B;GAIA,yBAAyB;IACvB,UAAU;IACV,QAAQ,KAAK,iBAAiB;IAC9B,UAAU;GACZ;EACF;EACA,UAAU,eAAe,KAAK,IAAI;GAChC,UAAU;GACV,QAAQ;EACV,CAAC;EACD,kBAAkB;GAChB,SAAS;GAET,mBAAmB,SAAS,qBAAqB,iBAAiB;GAClE,iBAAiB,SAAS,mBAAmB,eAAe;GAC5D,+BAA+B;EACjC;EACA,SAAS;GACP,UAAU;IACR,eAAe;IACf;GACF,CAAC;GACD,aAAa;IACX;IACA;IACA,aAAa;IACb,mBAAmB,KAAK;GAC1B,CAAC;GAKD,cAAc,OAAO,EAAE,MAAM,cAAc;IACzC,MAAM,cAAc,MAAM,KAAK,GAC5B,OAAO;KACN,MAAM,WAAW,OAAO;KACxB,IAAI,WAAW,aAAa;KAC5B,MAAM,WAAW,aAAa;KAC9B,MAAM,WAAW,aAAa;IAChC,CAAC,CAAC,CACD,KAAK,WAAW,MAAM,CAAC,CACvB,UACC,WAAW,cACX,GAAG,WAAW,OAAO,gBAAgB,WAAW,aAAa,EAAE,CACjE,CAAC,CACA,MAAM,GAAG,WAAW,OAAO,QAAQ,KAAK,EAAE,CAAC;IAC9C,MAAM,cACH,QAAqD,wBAAwB;IAChF,MAAM,SAAS,YAAY,MAAM,MAAM,EAAE,OAAO,WAAW,KAAK;IAChE,OAAO;KACL;KACA;KACA,kBAAkB,QAAQ,QAAQ;KAClC,oBAAoB,SAChB;MAAE,IAAI,OAAO;MAAI,MAAM,OAAO;MAAM,MAAM,OAAO;KAAK,IACtD;KACJ,eAAe,YAAY,KAAK,EAAE,IAAI,MAAM,YAAY;MAAE;MAAI;MAAM;KAAK,EAAE;IAC7E;GACF,CAAC;EACH;EACA,eAAe;GACb,MAAM,EACJ,QAAQ,EACN,QAAQ,iBACV,EACF;GACA,SAAS,EACP,QAAQ,EACN,QAAQ,oBACV,EACF;EACF;CACF,CACU;AACZ;AAIA,IAAa,aAAb,MAA2E;CACzE;CACA;CAEA,YAAY,MAAyB;EACnC,KAAK,OAAO,WAAW,IAAI;EAC3B,KAAK,SAAS,KAAK;CACrB;CAEA,MAAM,QAAQ,SAAqC;EACjD,OAAO,KAAK,KAAK,QAAQ,OAAO;CAClC;CAEA,MAAM,OAAO,SAA6D;EACxE,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,gBAAgB,OAAO,EAAE,CAAC;EAChF,IAAI,CAAC,KACH,OAAO;EAET,OAAO;GACL,MAAM;IACJ,IAAI,IAAI,KAAK;IACb,WAAW,IAAI,KAAK;IACpB,OAAO,IAAI,KAAK;IAChB,WAAW,IAAI,KAAK;IACpB,YAAY,IAAI,KAAK;IACrB,UAAU,IAAI,KAAK;IACnB,WAAW,IAAI,KAAK;GACtB;GACA,SAAS,EAGP,sBACG,IAAI,QAAqD,wBAAwB,KACtF;EACF;CACF;;;;CAKA,MAAM,wBAAwB,SAAsB,OAAiC;EAEnF,MAAM,UAAS,MADO,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,gBAAgB,OAAO,EAAE,CAAC,EAAA,EAC5D,QAAA,EAA4C;EACpE,IAAI,CAAC,OACH,OAAO;EAGT,OAAM,MADY,KAAK,KAAK,SAAA,CAClB,gBAAgB,cAAc,OAAO,EAAE,sBAAsB,MAAM,CAAC;EAC9E,OAAO;CACT;CAEA,MAAM,mBACJ,SACA,OAC2B;EAC3B,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,mBAAmB;GACjD,MAAM;IAAE,MAAM,MAAM;IAAM,MAAM,MAAM;GAAK;GAC3C,SAAS,gBAAgB,OAAO;EAClC,CAAC;EACD,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO;GAAE,IAAI,IAAI;GAAI,MAAM,IAAI;GAAM,MAAM,IAAI;GAAM,WAAW,IAAI;EAAU;CAChF;CACA,MAAM,sBAAsB,SAAsB,YAAmC;EACnF,MAAM,KAAK,KAAK,IAAI,sBAAsB;GACxC,MAAM,EAAE,gBAAgB,WAAW;GACnC,SAAS,gBAAgB,OAAO;EAClC,CAAC;CACH;CACA,MAAM,mBACJ,SACA,YACA,OAC2B;EAC3B,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,mBAAmB;IACjD,MAAM;KAAE,gBAAgB;KAAY,MAAM;MAAE,MAAM,MAAM;MAAM,MAAM,MAAM;KAAK;IAAE;IACjF,SAAS,gBAAgB,OAAO;GAClC,CAAC;GACD,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,8BAA8B;GAEhD,OAAO;IAAE,IAAI,IAAI;IAAI,MAAM,IAAI;IAAM,MAAM,IAAI;IAAM,WAAW,IAAI;GAAU;EAChF,SAAS,KAAK;GAGZ,IAAI,eAAe,UACjB,MAAM,IAAI,sBAAsB,IAAI,WAAW,+BAA+B;GAEhF,MAAM;EACR;CACF;CACA,MAAM,mBAAmB,SAAsB,YAAmC;EAChF,IAAI;GACF,MAAM,KAAK,KAAK,IAAI,mBAAmB;IACrC,MAAM,EAAE,gBAAgB,WAAW;IACnC,SAAS,gBAAgB,OAAO;GAClC,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,eAAe,UACjB,MAAM,IAAI,sBAAsB,IAAI,WAAW,+BAA+B;GAEhF,MAAM;EACR;CACF;CACA,MAAM,gBACJ,eACA,gBACA,MACe;EAEf,IAAI;GACF,MAAM,KAAK,KAAK,IAAI,UAAU,EAC5B,MAAM;IAAE,QAAQ;IAAgB,gBAAgB;IAAe,MAAM,UAAU,IAAI;GAAE,EACvF,CAAC;EACH,SAAS,KAAK;GACZ,IACE,eAAe,YACf,IAAI,MAAM,SAAS,iDAEnB;GAEF,MAAM;EACR;CACF;CACA,MAAM,WAAW,KAAyB,gBAAwB,MAA2B;EAC3F,MAAM,KAAK,KAAK,IAAI,iBAAiB;GACnC,MAAM;IACJ,UAAU,MAAM,KAAK,gBAAgB,KAAK,cAAc;IACxD;IACA,gBAAgB,IAAI;GACtB;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC;CACH;CACA,MAAM,aAAa,KAAyB,gBAAuC;EACjF,MAAM,KAAK,KAAK,IAAI,aAAa;GAC/B,MAAM;IACJ,iBAAiB,MAAM,KAAK,gBAAgB,KAAK,cAAc;IAC/D,gBAAgB,IAAI;GACtB;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC;CACH;CAEA,UAAoB,KAAkC;EACpD,OAAO,gBAAgB,IAAI,OAAO;CACpC;CAKA,MAAgB,gBACd,KACA,gBACiB;EAUjB,MAAM,YAAW,MATC,KAAK,KAAK,IAAI,YAAY;GAC1C,OAAO;IACL,gBAAgB,IAAI;IACpB,aAAa;IACb,aAAa;IACb,OAAO;GACT;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC,EAAA,EACqB,UAAU,EAAE,EAAE;EACpC,IAAI,CAAC,UACH,MAAM,IAAI,sBAAsB,wDAAwD;EAE1F,OAAO;CACT;AACF"}
+{"version":3,"file":"better-auth.js","names":[],"sources":["../src/better-auth.ts"],"sourcesContent":["import type {\n  AccessGrant,\n  AccessRequest,\n  AccessTokenVerifier,\n  ActiveSession,\n  ApiKeySummary,\n  AppAccessAdmin,\n  ConnectedApp,\n  CreatedApiKey,\n  HeaderBag,\n  Logger,\n  NewApiKey,\n  NewOrganizationInput,\n  SessionVerifier,\n} from \"@headless-lms/core/types\";\nimport type { IncomingHttpHeaders } from \"node:http\";\nimport { fromNodeHeaders } from \"better-auth/node\";\nimport { APIError, betterAuth, type BetterAuthOptions, type BetterAuthPlugin } from \"better-auth\";\nimport { createAuthMiddleware } from \"better-auth/api\";\nimport type { CreateAuthOptions } from \"./types.js\";\nimport { drizzleAdapter } from \"better-auth/adapters/drizzle\";\nimport * as authSchema from \"@headless-lms/adapter-db/schema/better-auth\";\nimport { prefixId } from \"@headless-lms/core/shared/id\";\nimport { NotFoundError } from \"@headless-lms/core/shared/errors\";\nimport { customSession, jwt, magicLink, organization } from \"better-auth/plugins\";\nimport {\n  type AccessTokenAuthorization,\n  createDpopReplayStore,\n  enforceDpopBinding,\n  isDpopBindingError,\n  verifyJwsAccessToken,\n} from \"better-auth/oauth2\";\nimport { oauthProviderAuthServerMetadata } from \"@better-auth/oauth-provider\";\nimport { mcp } from \"@better-auth/mcp\";\nimport { cimd } from \"@better-auth/cimd\";\nimport { fetchClientMetadataResource } from \"@better-auth/cimd/node\";\nimport { apiKey } from \"@better-auth/api-key\";\nimport { eq } from \"drizzle-orm\";\nimport { ac, roles } from \"./access.js\";\nimport {\n  accessTokenAuthorization,\n  consentOrgId,\n  grantFromClaims,\n  isCompactJws,\n  needsOrgChoice,\n  orgIdFromMetadata,\n  permissionsToScopes,\n  scopesToPermissions,\n} from \"./access-grant.js\";\nimport { withLoopbackNativeDefault } from \"./client-registration.js\";\nimport {\n  ACCESS_SCOPES,\n  type AuthHeaders,\n  type AuthOrganization,\n  type MemberWriteContext,\n  type OrgAdmin,\n  OrganizationRuleError,\n  parseRole,\n  type Role,\n  type UpdateOrganizationInput,\n} from \"@headless-lms/core/organizations\";\nimport {\n  ACCESS_TOKEN_TTL_SECONDS,\n  ORG_CLAIM,\n  type SessionAdmin,\n} from \"@headless-lms/core/identity\";\n\nconst JWT_ALG = \"EdDSA\";\n\nconst UNMIRRORED_ORG_ENDPOINTS = new Set([\n  \"/organization/leave\",\n  \"/organization/invite-member\",\n  \"/organization/accept-invitation\",\n]);\n\nconst OAUTH_CLIENT_WRITES = new Set([\n  \"/oauth2/create-client\",\n  \"/oauth2/update-client\",\n  \"/oauth2/delete-client\",\n]);\n\nfunction activeOrgOf(session: unknown): string | null {\n  const value = (session as { activeOrganizationId?: string | null } | null)?.activeOrganizationId;\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\nasync function memberOrgIds(db: CreateAuthOptions[\"db\"], userId: string): Promise<string[]> {\n  const rows = await db\n    .select({ organizationId: authSchema.member.organizationId })\n    .from(authSchema.member)\n    .where(eq(authSchema.member.userId, userId));\n  return rows.map((row) => row.organizationId);\n}\n\nfunction mcpOAuthPlugins(opts: CreateAuthOptions): BetterAuthPlugin[] {\n  return [\n    mcp({\n      resource: opts.mcp.resource,\n      loginPage: opts.mcp.loginPage,\n      consentPage: opts.mcp.consentPage,\n      scopes: [...ACCESS_SCOPES, \"offline_access\"],\n      clientRegistrationDefaultScopes: [...ACCESS_SCOPES, \"offline_access\"],\n      accessTokenExpiresIn: ACCESS_TOKEN_TTL_SECONDS,\n      allowDynamicClientRegistration: true,\n      allowUnauthenticatedClientRegistration: true,\n      postLogin: {\n        page: opts.mcp.orgPickerPage,\n        shouldRedirect: ({ session, user }) =>\n          needsOrgChoice(activeOrgOf(session), () => memberOrgIds(opts.db, user.id)),\n        consentReferenceId: async ({ session, user }) => {\n          const orgId = await consentOrgId(activeOrgOf(session), () =>\n            memberOrgIds(opts.db, user.id),\n          );\n          if (!orgId) {\n            throw new APIError(\"FORBIDDEN\", {\n              message: \"Choose an organization you are a member of\",\n            });\n          }\n          return orgId;\n        },\n      },\n      customAccessTokenClaims: ({ referenceId }) =>\n        referenceId ? { [ORG_CLAIM]: referenceId } : {},\n    }) as BetterAuthPlugin,\n    cimd({ fetchClientMetadataResource, metadataProfile: \"mcp-2026-07-28\" }) as BetterAuthPlugin,\n  ];\n}\n\nexport function buildAuthOptions(opts: CreateAuthOptions) {\n  const {\n    sendResetPassword,\n    onPasswordReset,\n    sendMagicLink,\n    beforeUserCreate,\n    beforeCreateSession,\n  } = opts.hooks;\n  const detached =\n    <A extends unknown[]>(name: string, hook: (...args: A) => Promise<void>) =>\n    async (...args: A): Promise<void> => {\n      void hook(...args).catch((err: unknown) =>\n        opts.logger.error(`auth hook ${name} failed`, { err }),\n      );\n    };\n\n  return {\n    baseURL: opts.baseUrl,\n    secret: opts.secret,\n    trustedOrigins: opts.trustedOrigins,\n    session: {\n      // Signed short-lived cookie cache: avoids a Postgres session lookup on\n      // every request. The BFF verifies the session per request (each API call\n      // + every SSR getSession), so without this each one is a DB round-trip.\n      // The cache holds for maxAge; sign-out / expiry still invalidate it.\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60,\n      },\n    },\n    advanced: {\n      database: {\n        // Prefixed, KSUID-bodied ids for every better-auth table (usr_, org_, …).\n        generateId: () => prefixId(\"id\"),\n      },\n      // Cross-subdomain shared session cookie for admin/api/web on one parent\n      // domain (e.g. `.example.com` in prod). Left unset in local dev so the\n      // host-only `localhost` cookie is used, which is already shared across\n      // ports (cookies are not port-scoped).\n      crossSubDomainCookies: {\n        enabled: true,\n        domain: opts.cookieDomain || undefined,\n      },\n      // Same-site cookie for the shared-parent-domain plan. Only switch to\n      // `sameSite: \"none\"` + `secure` if admin and api are genuinely cross-site\n      // (different registrable domains).\n      defaultCookieAttributes: {\n        sameSite: \"lax\",\n        secure: opts.secureCookies ?? false,\n        httpOnly: true,\n      },\n    },\n    database: drizzleAdapter(opts.db, {\n      provider: \"pg\",\n      schema: authSchema,\n    }),\n    emailAndPassword: {\n      enabled: true,\n      // Detached so send time can't reveal which emails have accounts, and a failed notice can't fail the reset.\n      sendResetPassword: detached(\"sendResetPassword\", sendResetPassword),\n      onPasswordReset: detached(\"onPasswordReset\", onPasswordReset),\n      revokeSessionsOnPasswordReset: true,\n    },\n    plugins: [\n      magicLink({\n        disableSignUp: true,\n        sendMagicLink,\n      }),\n      organization({\n        ac,\n        roles,\n        creatorRole: \"owner\",\n        organizationHooks: opts.hooks,\n      }),\n      jwt({\n        disableSettingJwtHeader: true,\n        jwks: { keyPairConfig: { alg: JWT_ALG } },\n      }) as BetterAuthPlugin,\n      ...(opts.mcp.oauthEnabled ? mcpOAuthPlugins(opts) : []),\n      apiKey({ enableMetadata: true, rateLimit: { enabled: false } }) as BetterAuthPlugin,\n      // Enrich get-session with the caller's memberships (role + org) so BFFs\n      // resolve auth in one call instead of fanning out to get-active-member /\n      // get-full-organization / organization/list. Custom fields bypass the\n      // cookie cache, so this costs one indexed query per get-session.\n      customSession(async ({ user, session }) => {\n        const memberships = await opts.db\n          .select({\n            role: authSchema.member.role,\n            id: authSchema.organization.id,\n            name: authSchema.organization.name,\n            slug: authSchema.organization.slug,\n          })\n          .from(authSchema.member)\n          .innerJoin(\n            authSchema.organization,\n            eq(authSchema.member.organizationId, authSchema.organization.id),\n          )\n          .where(eq(authSchema.member.userId, user.id));\n        const activeOrgId =\n          (session as { activeOrganizationId?: string | null }).activeOrganizationId ?? null;\n        const active = memberships.find((m) => m.id === activeOrgId) ?? null;\n        return {\n          user,\n          session,\n          activeMemberRole: active?.role ?? null,\n          activeOrganization: active\n            ? { id: active.id, name: active.name, slug: active.slug }\n            : null,\n          organizations: memberships.map(({ id, name, slug }) => ({ id, name, slug })),\n        };\n      }),\n    ],\n    hooks: {\n      before: createAuthMiddleware(async (ctx) => {\n        if (ctx.path === \"/api-key/create\" && (ctx.request || ctx.headers)) {\n          throw new APIError(\"FORBIDDEN\", { message: \"API keys are created through the LMS\" });\n        }\n        if (UNMIRRORED_ORG_ENDPOINTS.has(ctx.path)) {\n          throw new APIError(\"FORBIDDEN\", { message: \"Membership changes go through the LMS\" });\n        }\n        if (OAUTH_CLIENT_WRITES.has(ctx.path) && (ctx.request || ctx.headers)) {\n          throw new APIError(\"FORBIDDEN\", {\n            message: \"Apps register themselves when they connect\",\n          });\n        }\n        if (ctx.path === \"/api-key/update\" && ctx.body?.metadata !== undefined) {\n          throw new APIError(\"FORBIDDEN\", {\n            message: \"An API key stays in the organization it was made for\",\n          });\n        }\n        if (ctx.path !== \"/oauth2/register\") {\n          return;\n        }\n        const body = withLoopbackNativeDefault(ctx.body);\n        return body ? { context: { body } } : undefined;\n      }),\n    },\n    databaseHooks: {\n      user: {\n        create: {\n          before: beforeUserCreate,\n        },\n      },\n      session: {\n        create: {\n          before: beforeCreateSession,\n        },\n      },\n    },\n  } satisfies BetterAuthOptions;\n}\n\nexport function createAuth(opts: CreateAuthOptions) {\n  return betterAuth(buildAuthOptions(opts));\n}\n\nexport type Auth = ReturnType<typeof createAuth>;\n\ntype JSONWebKeySet = { keys: Array<Record<string, unknown>> };\n\ntype PluginApiKey = {\n  id: string;\n  name: string | null;\n  start: string | null;\n  referenceId: string;\n  metadata: unknown;\n  permissions: Record<string, string[]> | null;\n  createdAt: Date;\n  lastRequest: Date | null;\n};\n\ntype PluginApi = {\n  getJwks(): Promise<JSONWebKeySet>;\n  verifyApiKey(input: {\n    body: { key: string };\n  }): Promise<{ valid: boolean; key: PluginApiKey | null }>;\n  createApiKey(input: {\n    body: {\n      name: string;\n      userId: string;\n      metadata: Record<string, unknown>;\n      permissions: Record<string, string[]>;\n    };\n  }): Promise<PluginApiKey & { key: string }>;\n  listApiKeys(input: { headers: Headers }): Promise<{ apiKeys: PluginApiKey[] }>;\n  deleteApiKey(input: { body: { keyId: string }; headers: Headers }): Promise<unknown>;\n};\n\nexport class BetterAuth\n  implements SessionVerifier, OrgAdmin, SessionAdmin, AccessTokenVerifier, AppAccessAdmin\n{\n  protected auth: Auth;\n  protected logger: Logger;\n  protected mcp: CreateAuthOptions[\"mcp\"];\n  protected issuer: string;\n  protected jwksCacheKey = {};\n\n  constructor(opts: CreateAuthOptions, auth?: Auth) {\n    this.auth = auth ?? createAuth(opts);\n    this.logger = opts.logger;\n    this.mcp = opts.mcp;\n    this.issuer = `${opts.baseUrl.replace(/\\/+$/, \"\")}/api/auth`;\n  }\n\n  protected get pluginApi(): PluginApi {\n    return this.auth.api as unknown as PluginApi;\n  }\n\n  async handler(request: Request): Promise<Response> {\n    return this.auth.handler(request);\n  }\n\n  async authorizationServerMetadata(request: Request): Promise<Response> {\n    return oauthProviderAuthServerMetadata(\n      this.auth as unknown as Parameters<typeof oauthProviderAuthServerMetadata>[0],\n    )(request);\n  }\n\n  async verifyAccess(request: AccessRequest): Promise<AccessGrant | null> {\n    const apiKeyHeader = request.headers[\"x-api-key\"];\n    if (typeof apiKeyHeader === \"string\" && apiKeyHeader.length > 0) {\n      return this.verifyApiKey(apiKeyHeader);\n    }\n    const authorization = accessTokenAuthorization(request.headers.authorization);\n    if (!authorization) {\n      return null;\n    }\n    if (authorization.scheme === \"Bearer\" && !isCompactJws(authorization.token)) {\n      return this.verifyApiKey(authorization.token);\n    }\n    return this.mcp.oauthEnabled ? this.verifyAccessToken(authorization, request) : null;\n  }\n\n  protected async verifyAccessToken(\n    authorization: AccessTokenAuthorization,\n    request: AccessRequest,\n  ): Promise<AccessGrant | null> {\n    let claims: Awaited<ReturnType<typeof verifyJwsAccessToken>>;\n    try {\n      claims = await verifyJwsAccessToken(authorization.token, {\n        jwksFetch: async () => this.pluginApi.getJwks(),\n        jwksCacheKey: this.jwksCacheKey,\n        verifyOptions: {\n          audience: this.mcp.resource,\n          issuer: this.issuer,\n          algorithms: [JWT_ALG],\n        },\n      });\n    } catch {\n      return null;\n    }\n    const ctx = await this.auth.$context;\n    const proof = request.headers.dpop;\n    try {\n      await enforceDpopBinding({\n        payload: claims,\n        authorization,\n        proofJwt: typeof proof === \"string\" ? proof : undefined,\n        method: request.method,\n        url: request.url,\n        replayStore: createDpopReplayStore(ctx.internalAdapter),\n      });\n    } catch (error) {\n      if (isDpopBindingError(error)) {\n        return null;\n      }\n      throw error;\n    }\n    const grant = grantFromClaims(claims);\n    if (!grant) {\n      return null;\n    }\n    const consent = await ctx.adapter.findOne<{ scopes: string[] }>({\n      model: \"oauthConsent\",\n      where: [\n        { field: \"clientId\", value: grant.clientId },\n        { field: \"userId\", value: grant.userId },\n        { field: \"referenceId\", value: grant.orgId },\n      ],\n    });\n    return consent\n      ? { ...grant, scopes: grant.scopes.filter((scope) => consent.scopes.includes(scope)) }\n      : null;\n  }\n\n  protected async verifyApiKey(key: string): Promise<AccessGrant | null> {\n    const result = await this.pluginApi.verifyApiKey({ body: { key } });\n    if (!result.valid || !result.key) {\n      return null;\n    }\n    const orgId = orgIdFromMetadata(result.key.metadata);\n    if (!orgId) {\n      return null;\n    }\n    return {\n      userId: result.key.referenceId,\n      orgId,\n      scopes: permissionsToScopes(result.key.permissions),\n      clientId: `api-key:${result.key.id}`,\n    };\n  }\n\n  protected async sessionUserId(headers: HeaderBag): Promise<string> {\n    const session = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });\n    if (!session) {\n      throw new OrganizationRuleError(\"No session\");\n    }\n    return session.user.id;\n  }\n\n  async listConnectedApps(headers: HeaderBag, orgId: string): Promise<ConnectedApp[]> {\n    const userId = await this.sessionUserId(headers);\n    if (!this.mcp.oauthEnabled) {\n      return [];\n    }\n    const ctx = await this.auth.$context;\n    const consents = await ctx.adapter.findMany<{\n      clientId: string;\n      scopes: string[];\n      createdAt: Date | null;\n    }>({\n      model: \"oauthConsent\",\n      where: [\n        { field: \"userId\", value: userId },\n        { field: \"referenceId\", value: orgId },\n      ],\n    });\n    return Promise.all(\n      consents.map(async (consent) => {\n        const client = await ctx.adapter.findOne<{ name: string | null; icon: string | null }>({\n          model: \"oauthClient\",\n          where: [{ field: \"clientId\", value: consent.clientId }],\n        });\n        return {\n          clientId: consent.clientId,\n          name: client?.name ?? consent.clientId,\n          iconUrl: client?.icon ?? null,\n          scopes: consent.scopes,\n          connectedAt: consent.createdAt ?? new Date(0),\n        };\n      }),\n    );\n  }\n\n  async revokeConnectedApp(headers: HeaderBag, orgId: string, clientId: string): Promise<void> {\n    const userId = await this.sessionUserId(headers);\n    if (!this.mcp.oauthEnabled) {\n      return;\n    }\n    const ctx = await this.auth.$context;\n    const where = [\n      { field: \"clientId\", value: clientId },\n      { field: \"userId\", value: userId },\n      { field: \"referenceId\", value: orgId },\n    ];\n    await ctx.adapter.deleteMany({ model: \"oauthAccessToken\", where });\n    await ctx.adapter.deleteMany({ model: \"oauthRefreshToken\", where });\n    await ctx.adapter.deleteMany({ model: \"oauthConsent\", where });\n  }\n\n  async listApiKeys(headers: HeaderBag, orgId: string): Promise<ApiKeySummary[]> {\n    const res = await this.pluginApi.listApiKeys({ headers: fromNodeHeaders(headers) });\n    return res.apiKeys\n      .filter((key) => orgIdFromMetadata(key.metadata) === orgId)\n      .map((key) => ({\n        id: key.id,\n        name: key.name ?? null,\n        start: key.start ?? null,\n        scopes: permissionsToScopes(key.permissions),\n        createdAt: new Date(key.createdAt),\n        lastUsedAt: key.lastRequest ? new Date(key.lastRequest) : null,\n      }));\n  }\n\n  async createApiKey(input: NewApiKey): Promise<CreatedApiKey> {\n    const created = await this.pluginApi.createApiKey({\n      body: {\n        name: input.name,\n        userId: input.authUserId,\n        metadata: { organizationId: input.orgId },\n        permissions: scopesToPermissions(input.scopes),\n      },\n    });\n    return {\n      id: created.id,\n      name: created.name ?? null,\n      start: created.start ?? null,\n      scopes: permissionsToScopes(created.permissions),\n      createdAt: new Date(created.createdAt),\n      lastUsedAt: null,\n      key: created.key,\n    };\n  }\n\n  async deleteApiKey(headers: HeaderBag, orgId: string, keyId: string): Promise<void> {\n    const owned = await this.listApiKeys(headers, orgId);\n    if (!owned.some((key) => key.id === keyId)) {\n      throw new NotFoundError(\"API key\", keyId);\n    }\n    await this.pluginApi.deleteApiKey({ body: { keyId }, headers: fromNodeHeaders(headers) });\n  }\n\n  async verify(headers: IncomingHttpHeaders): Promise<ActiveSession | null> {\n    const res = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });\n    if (!res) {\n      return null;\n    }\n    return {\n      user: {\n        id: res.user.id,\n        createdAt: res.user.createdAt,\n        email: res.user.email,\n        firstName: res.user.name,\n        externalId: res.user.id,\n        lastName: res.user.name,\n        updatedAt: res.user.updatedAt,\n      },\n      session: {\n        // customSession erases the org plugin's session extension from the\n        // inferred type; the field is still present at runtime.\n        activeOrganizationId:\n          (res.session as { activeOrganizationId?: string | null }).activeOrganizationId ?? null,\n      },\n    };\n  }\n\n  /** Stamps the org onto the caller's session row. The 5-minute cookie cache\n   *  still holds the pre-stamp session, so callers refresh it client-side with\n   *  `getSession({ disableCookieCache: true })`. */\n  async stampActiveOrganization(headers: AuthHeaders, orgId: string): Promise<boolean> {\n    const session = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });\n    const token = (session?.session as { token?: string } | undefined)?.token;\n    if (!token) {\n      return false;\n    }\n    const ctx = await this.auth.$context;\n    await ctx.internalAdapter.updateSession(token, { activeOrganizationId: orgId });\n    return true;\n  }\n\n  async createOrganization(\n    headers: AuthHeaders,\n    input: NewOrganizationInput,\n  ): Promise<AuthOrganization> {\n    const org = await this.auth.api.createOrganization({\n      body: { name: input.name, slug: input.slug },\n      headers: fromNodeHeaders(headers),\n    });\n    if (!org) {\n      throw new Error(`Couldn't create organization`);\n    }\n    return { id: org.id, name: org.name, slug: org.slug, createdAt: org.createdAt };\n  }\n  async setActiveOrganization(headers: AuthHeaders, externalId: string): Promise<void> {\n    await this.auth.api.setActiveOrganization({\n      body: { organizationId: externalId },\n      headers: fromNodeHeaders(headers),\n    });\n  }\n  async updateOrganization(\n    headers: AuthHeaders,\n    externalId: string,\n    input: UpdateOrganizationInput,\n  ): Promise<AuthOrganization> {\n    try {\n      const org = await this.auth.api.updateOrganization({\n        body: { organizationId: externalId, data: { name: input.name, slug: input.slug } },\n        headers: fromNodeHeaders(headers),\n      });\n      if (!org) {\n        throw new Error(`Couldn't update organization`);\n      }\n      return { id: org.id, name: org.name, slug: org.slug, createdAt: org.createdAt };\n    } catch (err) {\n      // Surface Better Auth validation/permission failures (e.g. slug taken) as\n      // a domain rule error the route maps to 409 rather than a raw 500.\n      if (err instanceof APIError) {\n        throw new OrganizationRuleError(err.message || \"Could not update organization\");\n      }\n      throw err;\n    }\n  }\n  async deleteOrganization(headers: AuthHeaders, externalId: string): Promise<void> {\n    try {\n      await this.auth.api.deleteOrganization({\n        body: { organizationId: externalId },\n        headers: fromNodeHeaders(headers),\n      });\n    } catch (err) {\n      if (err instanceof APIError) {\n        throw new OrganizationRuleError(err.message || \"Could not delete organization\");\n      }\n      throw err;\n    }\n  }\n  async grantMembership(\n    orgExternalId: string,\n    userExternalId: string,\n    role: string,\n  ): Promise<void> {\n    // Server-side (no session): the accepted invitation is the authorisation.\n    try {\n      await this.auth.api.addMember({\n        body: { userId: userExternalId, organizationId: orgExternalId, role: parseRole(role) },\n      });\n    } catch (err) {\n      if (\n        err instanceof APIError &&\n        err.body?.code === \"USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION\"\n      ) {\n        return;\n      }\n      throw err;\n    }\n  }\n  async updateRole(ctx: MemberWriteContext, userExternalId: string, role: Role): Promise<void> {\n    await this.auth.api.updateMemberRole({\n      body: {\n        memberId: await this.resolveMemberId(ctx, userExternalId),\n        role,\n        organizationId: ctx.authOrgId,\n      },\n      headers: this.headersOf(ctx),\n    });\n  }\n  async removeMember(ctx: MemberWriteContext, userExternalId: string): Promise<void> {\n    await this.auth.api.removeMember({\n      body: {\n        memberIdOrEmail: await this.resolveMemberId(ctx, userExternalId),\n        organizationId: ctx.authOrgId,\n      },\n      headers: this.headersOf(ctx),\n    });\n  }\n\n  protected headersOf(ctx: MemberWriteContext): Headers {\n    return fromNodeHeaders(ctx.headers);\n  }\n\n  // Better Auth's member endpoints key on its own member id, which the domain\n  // deliberately does not store — `(org, user)` already identifies the record,\n  // so it is looked up here instead of mirrored into org_users.\n  protected async resolveMemberId(\n    ctx: MemberWriteContext,\n    userExternalId: string,\n  ): Promise<string> {\n    const res = await this.auth.api.listMembers({\n      query: {\n        organizationId: ctx.authOrgId,\n        filterField: \"userId\",\n        filterValue: userExternalId,\n        limit: 1,\n      },\n      headers: this.headersOf(ctx),\n    });\n    const memberId = res?.members?.[0]?.id;\n    if (!memberId) {\n      throw new OrganizationRuleError(\"That person is no longer a member of this organization\");\n    }\n    return memberId;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAmEA,MAAM,UAAU;AAEhB,MAAM,2CAA2B,IAAI,IAAI;CACvC;CACA;CACA;AACF,CAAC;AAED,MAAM,sCAAsB,IAAI,IAAI;CAClC;CACA;CACA;AACF,CAAC;AAED,SAAS,YAAY,SAAiC;CACpD,MAAM,QAAS,SAA6D;CAC5E,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,eAAe,aAAa,IAA6B,QAAmC;CAK1F,QAAO,MAJY,GAChB,OAAO,EAAE,gBAAgB,WAAW,OAAO,eAAe,CAAC,CAAC,CAC5D,KAAK,WAAW,MAAM,CAAC,CACvB,MAAM,GAAG,WAAW,OAAO,QAAQ,MAAM,CAAC,EAAA,CACjC,KAAK,QAAQ,IAAI,cAAc;AAC7C;AAEA,SAAS,gBAAgB,MAA6C;CACpE,OAAO,CACL,IAAI;EACF,UAAU,KAAK,IAAI;EACnB,WAAW,KAAK,IAAI;EACpB,aAAa,KAAK,IAAI;EACtB,QAAQ,CAAC,GAAG,eAAe,gBAAgB;EAC3C,iCAAiC,CAAC,GAAG,eAAe,gBAAgB;EACpE,sBAAsB;EACtB,gCAAgC;EAChC,wCAAwC;EACxC,WAAW;GACT,MAAM,KAAK,IAAI;GACf,iBAAiB,EAAE,SAAS,WAC1B,eAAe,YAAY,OAAO,SAAS,aAAa,KAAK,IAAI,KAAK,EAAE,CAAC;GAC3E,oBAAoB,OAAO,EAAE,SAAS,WAAW;IAC/C,MAAM,QAAQ,MAAM,aAAa,YAAY,OAAO,SAClD,aAAa,KAAK,IAAI,KAAK,EAAE,CAC/B;IACA,IAAI,CAAC,OACH,MAAM,IAAI,SAAS,aAAa,EAC9B,SAAS,6CACX,CAAC;IAEH,OAAO;GACT;EACF;EACA,0BAA0B,EAAE,kBAC1B,cAAc,GAAG,YAAY,YAAY,IAAI,CAAC;CAClD,CAAC,GACD,KAAK;EAAE;EAA6B,iBAAiB;CAAiB,CAAC,CACzE;AACF;AAEA,SAAgB,iBAAiB,MAAyB;CACxD,MAAM,EACJ,mBACA,iBACA,eACA,kBACA,wBACE,KAAK;CACT,MAAM,YACkB,MAAc,SACpC,OAAO,GAAG,SAA2B;EACnC,KAAU,GAAG,IAAI,CAAC,CAAC,OAAO,QACxB,KAAK,OAAO,MAAM,aAAa,KAAK,UAAU,EAAE,IAAI,CAAC,CACvD;CACF;CAEF,OAAO;EACL,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,gBAAgB,KAAK;EACrB,SAAS,EAKP,aAAa;GACX,SAAS;GACT,QAAQ;EACV,EACF;EACA,UAAU;GACR,UAAU,EAER,kBAAkB,SAAS,IAAI,EACjC;GAKA,uBAAuB;IACrB,SAAS;IACT,QAAQ,KAAK,gBAAgB,KAAA;GAC/B;GAIA,yBAAyB;IACvB,UAAU;IACV,QAAQ,KAAK,iBAAiB;IAC9B,UAAU;GACZ;EACF;EACA,UAAU,eAAe,KAAK,IAAI;GAChC,UAAU;GACV,QAAQ;EACV,CAAC;EACD,kBAAkB;GAChB,SAAS;GAET,mBAAmB,SAAS,qBAAqB,iBAAiB;GAClE,iBAAiB,SAAS,mBAAmB,eAAe;GAC5D,+BAA+B;EACjC;EACA,SAAS;GACP,UAAU;IACR,eAAe;IACf;GACF,CAAC;GACD,aAAa;IACX;IACA;IACA,aAAa;IACb,mBAAmB,KAAK;GAC1B,CAAC;GACD,IAAI;IACF,yBAAyB;IACzB,MAAM,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE;GAC1C,CAAC;GACD,GAAI,KAAK,IAAI,eAAe,gBAAgB,IAAI,IAAI,CAAC;GACrD,OAAO;IAAE,gBAAgB;IAAM,WAAW,EAAE,SAAS,MAAM;GAAE,CAAC;GAK9D,cAAc,OAAO,EAAE,MAAM,cAAc;IACzC,MAAM,cAAc,MAAM,KAAK,GAC5B,OAAO;KACN,MAAM,WAAW,OAAO;KACxB,IAAI,WAAW,aAAa;KAC5B,MAAM,WAAW,aAAa;KAC9B,MAAM,WAAW,aAAa;IAChC,CAAC,CAAC,CACD,KAAK,WAAW,MAAM,CAAC,CACvB,UACC,WAAW,cACX,GAAG,WAAW,OAAO,gBAAgB,WAAW,aAAa,EAAE,CACjE,CAAC,CACA,MAAM,GAAG,WAAW,OAAO,QAAQ,KAAK,EAAE,CAAC;IAC9C,MAAM,cACH,QAAqD,wBAAwB;IAChF,MAAM,SAAS,YAAY,MAAM,MAAM,EAAE,OAAO,WAAW,KAAK;IAChE,OAAO;KACL;KACA;KACA,kBAAkB,QAAQ,QAAQ;KAClC,oBAAoB,SAChB;MAAE,IAAI,OAAO;MAAI,MAAM,OAAO;MAAM,MAAM,OAAO;KAAK,IACtD;KACJ,eAAe,YAAY,KAAK,EAAE,IAAI,MAAM,YAAY;MAAE;MAAI;MAAM;KAAK,EAAE;IAC7E;GACF,CAAC;EACH;EACA,OAAO,EACL,QAAQ,qBAAqB,OAAO,QAAQ;GAC1C,IAAI,IAAI,SAAS,sBAAsB,IAAI,WAAW,IAAI,UACxD,MAAM,IAAI,SAAS,aAAa,EAAE,SAAS,uCAAuC,CAAC;GAErF,IAAI,yBAAyB,IAAI,IAAI,IAAI,GACvC,MAAM,IAAI,SAAS,aAAa,EAAE,SAAS,wCAAwC,CAAC;GAEtF,IAAI,oBAAoB,IAAI,IAAI,IAAI,MAAM,IAAI,WAAW,IAAI,UAC3D,MAAM,IAAI,SAAS,aAAa,EAC9B,SAAS,6CACX,CAAC;GAEH,IAAI,IAAI,SAAS,qBAAqB,IAAI,MAAM,aAAa,KAAA,GAC3D,MAAM,IAAI,SAAS,aAAa,EAC9B,SAAS,uDACX,CAAC;GAEH,IAAI,IAAI,SAAS,oBACf;GAEF,MAAM,OAAO,0BAA0B,IAAI,IAAI;GAC/C,OAAO,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,KAAA;EACxC,CAAC,EACH;EACA,eAAe;GACb,MAAM,EACJ,QAAQ,EACN,QAAQ,iBACV,EACF;GACA,SAAS,EACP,QAAQ,EACN,QAAQ,oBACV,EACF;EACF;CACF;AACF;AAEA,SAAgB,WAAW,MAAyB;CAClD,OAAO,WAAW,iBAAiB,IAAI,CAAC;AAC1C;AAkCA,IAAa,aAAb,MAEA;CACE;CACA;CACA;CACA;CACA,eAAyB,CAAC;CAE1B,YAAY,MAAyB,MAAa;EAChD,KAAK,OAAO,QAAQ,WAAW,IAAI;EACnC,KAAK,SAAS,KAAK;EACnB,KAAK,MAAM,KAAK;EAChB,KAAK,SAAS,GAAG,KAAK,QAAQ,QAAQ,QAAQ,EAAE,EAAE;CACpD;CAEA,IAAc,YAAuB;EACnC,OAAO,KAAK,KAAK;CACnB;CAEA,MAAM,QAAQ,SAAqC;EACjD,OAAO,KAAK,KAAK,QAAQ,OAAO;CAClC;CAEA,MAAM,4BAA4B,SAAqC;EACrE,OAAO,gCACL,KAAK,IACP,CAAC,CAAC,OAAO;CACX;CAEA,MAAM,aAAa,SAAqD;EACtE,MAAM,eAAe,QAAQ,QAAQ;EACrC,IAAI,OAAO,iBAAiB,YAAY,aAAa,SAAS,GAC5D,OAAO,KAAK,aAAa,YAAY;EAEvC,MAAM,gBAAgB,yBAAyB,QAAQ,QAAQ,aAAa;EAC5E,IAAI,CAAC,eACH,OAAO;EAET,IAAI,cAAc,WAAW,YAAY,CAAC,aAAa,cAAc,KAAK,GACxE,OAAO,KAAK,aAAa,cAAc,KAAK;EAE9C,OAAO,KAAK,IAAI,eAAe,KAAK,kBAAkB,eAAe,OAAO,IAAI;CAClF;CAEA,MAAgB,kBACd,eACA,SAC6B;EAC7B,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,qBAAqB,cAAc,OAAO;IACvD,WAAW,YAAY,KAAK,UAAU,QAAQ;IAC9C,cAAc,KAAK;IACnB,eAAe;KACb,UAAU,KAAK,IAAI;KACnB,QAAQ,KAAK;KACb,YAAY,CAAC,OAAO;IACtB;GACF,CAAC;EACH,QAAQ;GACN,OAAO;EACT;EACA,MAAM,MAAM,MAAM,KAAK,KAAK;EAC5B,MAAM,QAAQ,QAAQ,QAAQ;EAC9B,IAAI;GACF,MAAM,mBAAmB;IACvB,SAAS;IACT;IACA,UAAU,OAAO,UAAU,WAAW,QAAQ,KAAA;IAC9C,QAAQ,QAAQ;IAChB,KAAK,QAAQ;IACb,aAAa,sBAAsB,IAAI,eAAe;GACxD,CAAC;EACH,SAAS,OAAO;GACd,IAAI,mBAAmB,KAAK,GAC1B,OAAO;GAET,MAAM;EACR;EACA,MAAM,QAAQ,gBAAgB,MAAM;EACpC,IAAI,CAAC,OACH,OAAO;EAET,MAAM,UAAU,MAAM,IAAI,QAAQ,QAA8B;GAC9D,OAAO;GACP,OAAO;IACL;KAAE,OAAO;KAAY,OAAO,MAAM;IAAS;IAC3C;KAAE,OAAO;KAAU,OAAO,MAAM;IAAO;IACvC;KAAE,OAAO;KAAe,OAAO,MAAM;IAAM;GAC7C;EACF,CAAC;EACD,OAAO,UACH;GAAE,GAAG;GAAO,QAAQ,MAAM,OAAO,QAAQ,UAAU,QAAQ,OAAO,SAAS,KAAK,CAAC;EAAE,IACnF;CACN;CAEA,MAAgB,aAAa,KAA0C;EACrE,MAAM,SAAS,MAAM,KAAK,UAAU,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;EAClE,IAAI,CAAC,OAAO,SAAS,CAAC,OAAO,KAC3B,OAAO;EAET,MAAM,QAAQ,kBAAkB,OAAO,IAAI,QAAQ;EACnD,IAAI,CAAC,OACH,OAAO;EAET,OAAO;GACL,QAAQ,OAAO,IAAI;GACnB;GACA,QAAQ,oBAAoB,OAAO,IAAI,WAAW;GAClD,UAAU,WAAW,OAAO,IAAI;EAClC;CACF;CAEA,MAAgB,cAAc,SAAqC;EACjE,MAAM,UAAU,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,gBAAgB,OAAO,EAAE,CAAC;EACpF,IAAI,CAAC,SACH,MAAM,IAAI,sBAAsB,YAAY;EAE9C,OAAO,QAAQ,KAAK;CACtB;CAEA,MAAM,kBAAkB,SAAoB,OAAwC;EAClF,MAAM,SAAS,MAAM,KAAK,cAAc,OAAO;EAC/C,IAAI,CAAC,KAAK,IAAI,cACZ,OAAO,CAAC;EAEV,MAAM,MAAM,MAAM,KAAK,KAAK;EAC5B,MAAM,WAAW,MAAM,IAAI,QAAQ,SAIhC;GACD,OAAO;GACP,OAAO,CACL;IAAE,OAAO;IAAU,OAAO;GAAO,GACjC;IAAE,OAAO;IAAe,OAAO;GAAM,CACvC;EACF,CAAC;EACD,OAAO,QAAQ,IACb,SAAS,IAAI,OAAO,YAAY;GAC9B,MAAM,SAAS,MAAM,IAAI,QAAQ,QAAsD;IACrF,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAY,OAAO,QAAQ;IAAS,CAAC;GACxD,CAAC;GACD,OAAO;IACL,UAAU,QAAQ;IAClB,MAAM,QAAQ,QAAQ,QAAQ;IAC9B,SAAS,QAAQ,QAAQ;IACzB,QAAQ,QAAQ;IAChB,aAAa,QAAQ,6BAAa,IAAI,KAAK,CAAC;GAC9C;EACF,CAAC,CACH;CACF;CAEA,MAAM,mBAAmB,SAAoB,OAAe,UAAiC;EAC3F,MAAM,SAAS,MAAM,KAAK,cAAc,OAAO;EAC/C,IAAI,CAAC,KAAK,IAAI,cACZ;EAEF,MAAM,MAAM,MAAM,KAAK,KAAK;EAC5B,MAAM,QAAQ;GACZ;IAAE,OAAO;IAAY,OAAO;GAAS;GACrC;IAAE,OAAO;IAAU,OAAO;GAAO;GACjC;IAAE,OAAO;IAAe,OAAO;GAAM;EACvC;EACA,MAAM,IAAI,QAAQ,WAAW;GAAE,OAAO;GAAoB;EAAM,CAAC;EACjE,MAAM,IAAI,QAAQ,WAAW;GAAE,OAAO;GAAqB;EAAM,CAAC;EAClE,MAAM,IAAI,QAAQ,WAAW;GAAE,OAAO;GAAgB;EAAM,CAAC;CAC/D;CAEA,MAAM,YAAY,SAAoB,OAAyC;EAE7E,QAAO,MADW,KAAK,UAAU,YAAY,EAAE,SAAS,gBAAgB,OAAO,EAAE,CAAC,EAAA,CACvE,QACR,QAAQ,QAAQ,kBAAkB,IAAI,QAAQ,MAAM,KAAK,CAAC,CAC1D,KAAK,SAAS;GACb,IAAI,IAAI;GACR,MAAM,IAAI,QAAQ;GAClB,OAAO,IAAI,SAAS;GACpB,QAAQ,oBAAoB,IAAI,WAAW;GAC3C,WAAW,IAAI,KAAK,IAAI,SAAS;GACjC,YAAY,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI;EAC5D,EAAE;CACN;CAEA,MAAM,aAAa,OAA0C;EAC3D,MAAM,UAAU,MAAM,KAAK,UAAU,aAAa,EAChD,MAAM;GACJ,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,UAAU,EAAE,gBAAgB,MAAM,MAAM;GACxC,aAAa,oBAAoB,MAAM,MAAM;EAC/C,EACF,CAAC;EACD,OAAO;GACL,IAAI,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,OAAO,QAAQ,SAAS;GACxB,QAAQ,oBAAoB,QAAQ,WAAW;GAC/C,WAAW,IAAI,KAAK,QAAQ,SAAS;GACrC,YAAY;GACZ,KAAK,QAAQ;EACf;CACF;CAEA,MAAM,aAAa,SAAoB,OAAe,OAA8B;EAElF,IAAI,EAAC,MADe,KAAK,YAAY,SAAS,KAAK,EAAA,CACxC,MAAM,QAAQ,IAAI,OAAO,KAAK,GACvC,MAAM,IAAI,cAAc,WAAW,KAAK;EAE1C,MAAM,KAAK,UAAU,aAAa;GAAE,MAAM,EAAE,MAAM;GAAG,SAAS,gBAAgB,OAAO;EAAE,CAAC;CAC1F;CAEA,MAAM,OAAO,SAA6D;EACxE,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,gBAAgB,OAAO,EAAE,CAAC;EAChF,IAAI,CAAC,KACH,OAAO;EAET,OAAO;GACL,MAAM;IACJ,IAAI,IAAI,KAAK;IACb,WAAW,IAAI,KAAK;IACpB,OAAO,IAAI,KAAK;IAChB,WAAW,IAAI,KAAK;IACpB,YAAY,IAAI,KAAK;IACrB,UAAU,IAAI,KAAK;IACnB,WAAW,IAAI,KAAK;GACtB;GACA,SAAS,EAGP,sBACG,IAAI,QAAqD,wBAAwB,KACtF;EACF;CACF;;;;CAKA,MAAM,wBAAwB,SAAsB,OAAiC;EAEnF,MAAM,UAAS,MADO,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,gBAAgB,OAAO,EAAE,CAAC,EAAA,EAC5D,QAAA,EAA4C;EACpE,IAAI,CAAC,OACH,OAAO;EAGT,OAAM,MADY,KAAK,KAAK,SAAA,CAClB,gBAAgB,cAAc,OAAO,EAAE,sBAAsB,MAAM,CAAC;EAC9E,OAAO;CACT;CAEA,MAAM,mBACJ,SACA,OAC2B;EAC3B,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,mBAAmB;GACjD,MAAM;IAAE,MAAM,MAAM;IAAM,MAAM,MAAM;GAAK;GAC3C,SAAS,gBAAgB,OAAO;EAClC,CAAC;EACD,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO;GAAE,IAAI,IAAI;GAAI,MAAM,IAAI;GAAM,MAAM,IAAI;GAAM,WAAW,IAAI;EAAU;CAChF;CACA,MAAM,sBAAsB,SAAsB,YAAmC;EACnF,MAAM,KAAK,KAAK,IAAI,sBAAsB;GACxC,MAAM,EAAE,gBAAgB,WAAW;GACnC,SAAS,gBAAgB,OAAO;EAClC,CAAC;CACH;CACA,MAAM,mBACJ,SACA,YACA,OAC2B;EAC3B,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,mBAAmB;IACjD,MAAM;KAAE,gBAAgB;KAAY,MAAM;MAAE,MAAM,MAAM;MAAM,MAAM,MAAM;KAAK;IAAE;IACjF,SAAS,gBAAgB,OAAO;GAClC,CAAC;GACD,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,8BAA8B;GAEhD,OAAO;IAAE,IAAI,IAAI;IAAI,MAAM,IAAI;IAAM,MAAM,IAAI;IAAM,WAAW,IAAI;GAAU;EAChF,SAAS,KAAK;GAGZ,IAAI,eAAe,UACjB,MAAM,IAAI,sBAAsB,IAAI,WAAW,+BAA+B;GAEhF,MAAM;EACR;CACF;CACA,MAAM,mBAAmB,SAAsB,YAAmC;EAChF,IAAI;GACF,MAAM,KAAK,KAAK,IAAI,mBAAmB;IACrC,MAAM,EAAE,gBAAgB,WAAW;IACnC,SAAS,gBAAgB,OAAO;GAClC,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,eAAe,UACjB,MAAM,IAAI,sBAAsB,IAAI,WAAW,+BAA+B;GAEhF,MAAM;EACR;CACF;CACA,MAAM,gBACJ,eACA,gBACA,MACe;EAEf,IAAI;GACF,MAAM,KAAK,KAAK,IAAI,UAAU,EAC5B,MAAM;IAAE,QAAQ;IAAgB,gBAAgB;IAAe,MAAM,UAAU,IAAI;GAAE,EACvF,CAAC;EACH,SAAS,KAAK;GACZ,IACE,eAAe,YACf,IAAI,MAAM,SAAS,iDAEnB;GAEF,MAAM;EACR;CACF;CACA,MAAM,WAAW,KAAyB,gBAAwB,MAA2B;EAC3F,MAAM,KAAK,KAAK,IAAI,iBAAiB;GACnC,MAAM;IACJ,UAAU,MAAM,KAAK,gBAAgB,KAAK,cAAc;IACxD;IACA,gBAAgB,IAAI;GACtB;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC;CACH;CACA,MAAM,aAAa,KAAyB,gBAAuC;EACjF,MAAM,KAAK,KAAK,IAAI,aAAa;GAC/B,MAAM;IACJ,iBAAiB,MAAM,KAAK,gBAAgB,KAAK,cAAc;IAC/D,gBAAgB,IAAI;GACtB;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC;CACH;CAEA,UAAoB,KAAkC;EACpD,OAAO,gBAAgB,IAAI,OAAO;CACpC;CAKA,MAAgB,gBACd,KACA,gBACiB;EAUjB,MAAM,YAAW,MATC,KAAK,KAAK,IAAI,YAAY;GAC1C,OAAO;IACL,gBAAgB,IAAI;IACpB,aAAa;IACb,aAAa;IACb,OAAO;GACT;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC,EAAA,EACqB,UAAU,EAAE,EAAE;EACpC,IAAI,CAAC,UACH,MAAM,IAAI,sBAAsB,wDAAwD;EAE1F,OAAO;CACT;AACF"}

package/dist/client-registration.d.ts

@@ -0,0 +1,5 @@
+//#region src/client-registration.d.ts
+declare function withLoopbackNativeDefault(body: unknown): Record<string, unknown> | null;
+//#endregion
+export { withLoopbackNativeDefault };
+//# sourceMappingURL=client-registration.d.ts.map

package/dist/client-registration.js

@@ -0,0 +1,15 @@
+//#region src/client-registration.ts
+function withLoopbackNativeDefault(body) {
+	if (body === null || typeof body !== "object") return null;
+	const registration = body;
+	const redirectUris = registration.redirect_uris;
+	if (registration.application_type !== void 0 || !Array.isArray(redirectUris)) return null;
+	return redirectUris.every((uri) => typeof uri === "string" && uri.toLowerCase().startsWith("https:")) ? null : {
+		...registration,
+		application_type: "native"
+	};
+}
+//#endregion
+export { withLoopbackNativeDefault };
+
+//# sourceMappingURL=client-registration.js.map

package/dist/client-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registration.js","names":[],"sources":["../src/client-registration.ts"],"sourcesContent":["export function withLoopbackNativeDefault(body: unknown): Record<string, unknown> | null {\n  if (body === null || typeof body !== \"object\") {\n    return null;\n  }\n  const registration = body as Record<string, unknown>;\n  const redirectUris = registration.redirect_uris;\n  if (registration.application_type !== undefined || !Array.isArray(redirectUris)) {\n    return null;\n  }\n  const httpsOnly = redirectUris.every(\n    (uri) => typeof uri === \"string\" && uri.toLowerCase().startsWith(\"https:\"),\n  );\n  return httpsOnly ? null : { ...registration, application_type: \"native\" };\n}\n"],"mappings":";AAAA,SAAgB,0BAA0B,MAA+C;CACvF,IAAI,SAAS,QAAQ,OAAO,SAAS,UACnC,OAAO;CAET,MAAM,eAAe;CACrB,MAAM,eAAe,aAAa;CAClC,IAAI,aAAa,qBAAqB,KAAA,KAAa,CAAC,MAAM,QAAQ,YAAY,GAC5E,OAAO;CAKT,OAHkB,aAAa,OAC5B,QAAQ,OAAO,QAAQ,YAAY,IAAI,YAAY,CAAC,CAAC,WAAW,QAAQ,CAE5D,IAAI,OAAO;EAAE,GAAG;EAAc,kBAAkB;CAAS;AAC1E"}

package/dist/index.d.ts

@@ -1,3 +1,4 @@
-import { CreateAuthOptions, Hooks } from "./types.js";
-import { Auth, BetterAuth, createAuth } from "./better-auth.js";
-export { Auth, BetterAuth, CreateAuthOptions, Hooks, createAuth };
+import { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions } from "./access-grant.js";
+import { CreateAuthOptions, Hooks, McpAuthOptions } from "./types.js";
+import { Auth, BetterAuth, buildAuthOptions, createAuth } from "./better-auth.js";
+export { Auth, BetterAuth, CreateAuthOptions, Hooks, McpAuthOptions, accessTokenAuthorization, buildAuthOptions, consentOrgId, createAuth, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions };

package/dist/index.js

@@ -1,3 +1,4 @@
-import { BetterAuth, createAuth } from "./better-auth.js";
+import { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions } from "./access-grant.js";
+import { BetterAuth, buildAuthOptions, createAuth } from "./better-auth.js";
 import "./types.js";
-export { BetterAuth, createAuth };
+export { BetterAuth, accessTokenAuthorization, buildAuthOptions, consentOrgId, createAuth, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions };

package/dist/types.d.ts

@@ -1,7 +1,7 @@
 import { GenericEndpointContext, Session, User } from "better-auth";
 import { OrganizationOptions } from "better-auth/plugins";
-import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { Logger } from "@headless-lms/core/types";
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
 //#region src/types.d.ts
 type Hooks = NonNullable<OrganizationOptions["organizationHooks"]> & {
   beforeUserCreate: (user: User & Record<string, unknown>, context: GenericEndpointContext | null) => Promise<boolean | void | {
@@ -27,6 +27,13 @@ type Hooks = NonNullable<OrganizationOptions["organizationHooks"]> & {
     metadata?: Record<string, unknown>;
   }, ctx?: GenericEndpointContext | undefined) => Promise<void>;
 };
+interface McpAuthOptions {
+  oauthEnabled: boolean;
+  resource: string;
+  loginPage: string;
+  consentPage: string;
+  orgPickerPage: string;
+}
 interface CreateAuthOptions {
   db: NodePgDatabase;
   baseUrl: string;
@@ -36,11 +43,12 @@ interface CreateAuthOptions {
   logger: Logger;
   /** Handlers for what the engine reports. The adapter owns no rules. */
   hooks: Hooks;
+  mcp: McpAuthOptions;
   /** Parent domain for cross-subdomain session cookies (e.g. ".example.com"); undefined → host-only cookie. */
   cookieDomain?: string;
   /** Mark session cookies Secure (set behind HTTPS / in production). */
   secureCookies?: boolean;
 }
 //#endregion
-export { CreateAuthOptions, Hooks };
+export { CreateAuthOptions, Hooks, McpAuthOptions };
 //# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@headless-lms/adapter-auth",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -14,10 +14,16 @@
     "dist"
   ],
   "dependencies": {
-    "better-auth": "^1.6.25",
+    "@better-auth/api-key": "1.7.7",
+    "@better-auth/cimd": "1.7.7",
+    "@better-auth/mcp": "1.7.7",
+    "@better-auth/oauth-provider": "1.7.7",
+    "@better-auth/utils": "0.4.2",
+    "better-auth": "1.7.7",
     "drizzle-orm": "^0.45.2",
-    "@headless-lms/adapter-db": "0.2.0",
-    "@headless-lms/core": "0.2.0"
+    "zod": "4.6.7",
+    "@headless-lms/adapter-db": "0.3.0",
+    "@headless-lms/core": "0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",

package/dist/node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/schemas.d.ts

@@ -1,8 +0,0 @@
-//#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/schemas.d.cts
-type $strip = {
-  out: {};
-  in: {};
-};
-//#endregion
-export { $strip };
-//# sourceMappingURL=schemas.d.ts.map