@momentumcms/auth 0.5.6 → 0.5.7

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.5.7 (2026-03-10)
+
+### 🩹 Fixes
+
+- migration mode fixes, first-user admin, and overrideAccess bypass ([bf164074](https://github.com/DonaldMurillo/momentum-cms/commit/bf164074))
+
+### ❤️ Thank You
+
+- Claude Opus 4.6
+- Donald Murillo @DonaldMurillo
+
 ## 0.5.6 (2026-03-10)
 
 This was a version bump only for auth to align it with other projects, there were no code changes.

package/index.cjs

@@ -1815,8 +1815,32 @@ function createMomentumAuth(config) {
       plugins.push(p);
     }
   }
+  const firstUserAdminHook = {
+    user: {
+      create: {
+        async before(user) {
+          try {
+            let count = 0;
+            if (dbConfig.type === "sqlite") {
+              const row2 = dbConfig.database.prepare('SELECT COUNT(*) as cnt FROM "user"').get();
+              count = row2 && typeof row2 === "object" && "cnt" in row2 ? Number(row2.cnt) : 0;
+            } else {
+              const result = await dbConfig.pool.query('SELECT COUNT(*) as cnt FROM "user"');
+              count = Number(result.rows[0]?.cnt ?? 0);
+            }
+            if (count === 0) {
+              return { data: { ...user, role: "admin" } };
+            }
+          } catch {
+          }
+          return { data: user };
+        }
+      }
+    }
+  };
   return (0, import_better_auth.betterAuth)({
     database: databaseOption,
+    databaseHooks: firstUserAdminHook,
     baseURL: baseURL ?? "http://localhost:4000",
     secret: secret ?? process.env["AUTH_SECRET"] ?? "momentum-cms-dev-secret-change-in-production",
     trustedOrigins: trustedOrigins ?? [baseURL ?? "http://localhost:4000"],

package/index.js

@@ -1770,8 +1770,32 @@ function createMomentumAuth(config) {
       plugins.push(p);
     }
   }
+  const firstUserAdminHook = {
+    user: {
+      create: {
+        async before(user) {
+          try {
+            let count = 0;
+            if (dbConfig.type === "sqlite") {
+              const row2 = dbConfig.database.prepare('SELECT COUNT(*) as cnt FROM "user"').get();
+              count = row2 && typeof row2 === "object" && "cnt" in row2 ? Number(row2.cnt) : 0;
+            } else {
+              const result = await dbConfig.pool.query('SELECT COUNT(*) as cnt FROM "user"');
+              count = Number(result.rows[0]?.cnt ?? 0);
+            }
+            if (count === 0) {
+              return { data: { ...user, role: "admin" } };
+            }
+          } catch {
+          }
+          return { data: user };
+        }
+      }
+    }
+  };
   return betterAuth({
     database: databaseOption,
+    databaseHooks: firstUserAdminHook,
     baseURL: baseURL ?? "http://localhost:4000",
     secret: secret ?? process.env["AUTH_SECRET"] ?? "momentum-cms-dev-secret-change-in-production",
     trustedOrigins: trustedOrigins ?? [baseURL ?? "http://localhost:4000"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@momentumcms/auth",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Better Auth integration for Momentum CMS",
   "license": "MIT",
   "author": "Momentum CMS Contributors",