@opensaas/stack-auth 0.1.0 → 0.1.1

package/dist/server/schema-converter.js

@@ -0,0 +1,250 @@
+/**
+ * Convert Better Auth database schema to OpenSaaS list configs
+ * Allows dynamic list generation from Better Auth plugins
+ */
+import { list } from '@opensaas/stack-core';
+import { text, timestamp, checkbox, integer } from '@opensaas/stack-core/fields';
+/**
+ * Convert Better Auth field type to OpenSaaS field config
+ */
+function convertField(fieldName, betterAuthField) {
+    const { type, required, unique, defaultValue, references } = betterAuthField;
+    // System fields are auto-generated by OpenSaaS
+    if (fieldName === 'id' || fieldName === 'createdAt' || fieldName === 'updatedAt') {
+        return null;
+    }
+    // Handle references (relationships)
+    if (references) {
+        // Relationships are handled separately
+        // Return null here and handle in relationship pass
+        return null;
+    }
+    // Map Better Auth types to OpenSaaS field types
+    switch (type) {
+        case 'string':
+            return text({
+                validation: { isRequired: required },
+                isIndexed: unique ? 'unique' : undefined,
+                defaultValue: typeof defaultValue === 'string' ? defaultValue : undefined,
+            });
+        case 'number':
+            return integer({
+                validation: { isRequired: required },
+                defaultValue: typeof defaultValue === 'number' ? defaultValue : undefined,
+            });
+        case 'boolean':
+            return checkbox({
+                defaultValue: typeof defaultValue === 'boolean' ? defaultValue : false,
+            });
+        case 'date':
+            return timestamp({
+                defaultValue: defaultValue === 'now' ? { kind: 'now' } : undefined,
+            });
+        default:
+            // Unknown type - default to text
+            console.warn(`[stack-auth] Unknown Better Auth field type "${type}" for field "${fieldName}", defaulting to text field`);
+            return text({
+                validation: { isRequired: required },
+            });
+    }
+}
+/**
+ * Get default access control for auth tables
+ * Most auth tables should only be accessible to their owners
+ */
+function getDefaultAccess(tableName) {
+    const lowerTableName = tableName.toLowerCase();
+    // User table - special access control
+    if (lowerTableName === 'user') {
+        return {
+            operation: {
+                query: () => true, // Anyone can query users
+                create: () => true, // Anyone can create (sign up)
+                update: ({ session, item }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    const itemId = item?.id;
+                    return userId === itemId;
+                },
+                delete: ({ session, item }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    const itemId = item?.id;
+                    return userId === itemId;
+                },
+            },
+        };
+    }
+    // Session table
+    if (lowerTableName === 'session') {
+        return {
+            operation: {
+                query: ({ session }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    if (!userId)
+                        return false;
+                    return {
+                        user: { id: { equals: userId } },
+                    };
+                },
+                create: () => true, // Better-auth handles session creation
+                update: () => false, // No manual updates
+                delete: ({ session, item }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    const itemUserId = item?.user?.id;
+                    return userId === itemUserId;
+                },
+            },
+        };
+    }
+    // Account table
+    if (lowerTableName === 'account') {
+        return {
+            operation: {
+                query: ({ session }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    if (!userId)
+                        return false;
+                    return {
+                        user: { id: { equals: userId } },
+                    };
+                },
+                create: () => true, // Better-auth handles account creation
+                update: ({ session, item }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    const itemUserId = item?.user?.id;
+                    return userId === itemUserId;
+                },
+                delete: ({ session, item }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    const itemUserId = item?.user?.id;
+                    return userId === itemUserId;
+                },
+            },
+        };
+    }
+    // Verification table
+    if (lowerTableName === 'verification') {
+        return {
+            operation: {
+                query: () => false, // No public querying
+                create: () => true, // Better-auth creates verification tokens
+                update: () => false, // No updates
+                delete: () => true, // Better-auth deletes used/expired tokens
+            },
+        };
+    }
+    // OAuth tables (from MCP/OIDC plugins)
+    if (lowerTableName === 'oauthapplication' ||
+        lowerTableName === 'oauthaccesstoken' ||
+        lowerTableName === 'oauthconsent') {
+        return {
+            operation: {
+                query: ({ session }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    if (!userId)
+                        return false;
+                    // Filter by userId if field exists
+                    return {
+                        userId: { equals: userId },
+                    };
+                },
+                create: () => true, // Better-auth/plugins handle creation
+                update: ({ session, item }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    const itemUserId = item?.userId;
+                    return userId === itemUserId;
+                },
+                delete: ({ session, item }) => {
+                    if (!session)
+                        return false;
+                    const userId = session.userId;
+                    const itemUserId = item?.userId;
+                    return userId === itemUserId;
+                },
+            },
+        };
+    }
+    // Default: restrict all access (safest default)
+    return {
+        operation: {
+            query: () => false,
+            create: () => false,
+            update: () => false,
+            delete: () => false,
+        },
+    };
+}
+/**
+ * Convert Better Auth table schema to OpenSaaS ListConfig
+ */
+export function convertTableToList(tableName, tableSchema) {
+    const fields = {};
+    // First pass: convert regular fields
+    for (const [fieldName, fieldAttr] of Object.entries(tableSchema.fields)) {
+        const fieldConfig = convertField(fieldName, fieldAttr);
+        if (fieldConfig) {
+            fields[fieldName] = fieldConfig;
+        }
+    }
+    // Second pass: add relationships
+    // NOTE: Better Auth uses one-way references, but OpenSaaS requires bidirectional relationships
+    // We skip relationship conversion for now and rely on the foreign key fields
+    // Users can manually add bidirectional relationships if needed by extending the User list
+    for (const [fieldName, fieldAttr] of Object.entries(tableSchema.fields)) {
+        if (fieldAttr.references) {
+            // For now, treat reference fields as regular text fields (foreign keys)
+            // This preserves the userId, clientId, etc. fields that Better Auth expects
+            if (!fields[fieldName]) {
+                fields[fieldName] = text({
+                    validation: { isRequired: fieldAttr.required },
+                });
+            }
+        }
+    }
+    // Create list config with default access control
+    return list({
+        fields,
+        access: getDefaultAccess(tableName),
+    });
+}
+/**
+ * Convert all Better Auth tables to OpenSaaS list configs
+ * This is called by withAuth() to generate lists from Better Auth + plugins
+ */
+export function convertBetterAuthSchema(tables) {
+    const lists = {};
+    for (const [tableName, tableSchema] of Object.entries(tables)) {
+        // Convert table name to PascalCase for OpenSaaS list key
+        const listKey = tableSchema.modelName || toPascalCase(tableName);
+        lists[listKey] = convertTableToList(tableName, tableSchema);
+    }
+    return lists;
+}
+/**
+ * Convert table name to PascalCase
+ * e.g., "oauth_application" -> "OauthApplication"
+ */
+function toPascalCase(str) {
+    return str
+        .split(/[_-]/)
+        .map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
+        .join('');
+}
+//# sourceMappingURL=schema-converter.js.map

package/dist/server/schema-converter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-converter.js","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AA6BhF;;GAEG;AACH,SAAS,YAAY,CACnB,SAAiB,EACjB,eAAyC;IAEzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,eAAe,CAAA;IAE5E,+CAA+C;IAC/C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,oCAAoC;IACpC,IAAI,UAAU,EAAE,CAAC;QACf,uCAAuC;QACvC,mDAAmD;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;gBACV,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACxC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;QAEJ,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC;gBACb,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;QAEJ,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;gBACd,YAAY,EAAE,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;aACvE,CAAC,CAAA;QAEJ,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;gBACf,YAAY,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAA;QAEJ;YACE,iCAAiC;YACjC,OAAO,CAAC,IAAI,CACV,gDAAgD,IAAI,gBAAgB,SAAS,6BAA6B,CAC3G,CAAA;YACD,OAAO,IAAI,CAAC;gBACV,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;aACrC,CAAC,CAAA;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;IAE9C,sCAAsC;IACtC,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO;YACL,SAAS,EAAE;gBACT,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,yBAAyB;gBAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,8BAA8B;gBAClD,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC5B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,MAAM,GAAI,IAAwB,EAAE,EAAE,CAAA;oBAC5C,OAAO,MAAM,KAAK,MAAM,CAAA;gBAC1B,CAAC;gBACD,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC5B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,MAAM,GAAI,IAAwB,EAAE,EAAE,CAAA;oBAC5C,OAAO,MAAM,KAAK,MAAM,CAAA;gBAC1B,CAAC;aACF;SACF,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,SAAS,EAAE;gBACT,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;oBACrB,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,IAAI,CAAC,MAAM;wBAAE,OAAO,KAAK,CAAA;oBACzB,OAAO;wBACL,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;qBACN,CAAA;gBAC9B,CAAC;gBACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,uCAAuC;gBAC3D,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,oBAAoB;gBACzC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC5B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAAmC,EAAE,IAAI,EAAE,EAAE,CAAA;oBACjE,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;aACF;SACF,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,SAAS,EAAE;gBACT,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;oBACrB,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,IAAI,CAAC,MAAM;wBAAE,OAAO,KAAK,CAAA;oBACzB,OAAO;wBACL,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;qBACN,CAAA;gBAC9B,CAAC;gBACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,uCAAuC;gBAC3D,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC5B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAAmC,EAAE,IAAI,EAAE,EAAE,CAAA;oBACjE,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;gBACD,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC5B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAAmC,EAAE,IAAI,EAAE,EAAE,CAAA;oBACjE,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;aACF;SACF,CAAA;IACH,CAAC;IAED,qBAAqB;IACrB,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;QACtC,OAAO;YACL,SAAS,EAAE;gBACT,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB;gBACzC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,0CAA0C;gBAC9D,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa;gBAClC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,0CAA0C;aAC/D;SACF,CAAA;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,cAAc,KAAK,kBAAkB;QACrC,cAAc,KAAK,kBAAkB;QACrC,cAAc,KAAK,cAAc,EACjC,CAAC;QACD,OAAO;YACL,SAAS,EAAE;gBACT,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;oBACrB,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,IAAI,CAAC,MAAM;wBAAE,OAAO,KAAK,CAAA;oBACzB,mCAAmC;oBACnC,OAAO;wBACL,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;qBACA,CAAA;gBAC9B,CAAC;gBACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,sCAAsC;gBAC1D,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC5B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAA4B,EAAE,MAAM,CAAA;oBACxD,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;gBACD,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC5B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAA4B,EAAE,MAAM,CAAA;oBACxD,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;aACF;SACF,CAAA;IACH,CAAC;IAED,gDAAgD;IAChD,OAAO;QACL,SAAS,EAAE;YACT,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;YAClB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;SACpB;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,WAAkC;IAElC,MAAM,MAAM,GAAgC,EAAE,CAAA;IAE9C,qCAAqC;IACrC,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW,CAAA;QACjC,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,+FAA+F;IAC/F,6EAA6E;IAC7E,0FAA0F;IAC1F,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,wEAAwE;YACxE,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;oBACvB,UAAU,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE;iBAC/C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,OAAO,IAAI,CAAC;QACV,MAAM;QACN,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA6C;IAE7C,MAAM,KAAK,GAA+B,EAAE,CAAA;IAE5C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,yDAAyD;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,CAAA;QAChE,KAAK,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-auth",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Better-auth integration for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,6 +21,10 @@
     "./ui": {
       "types": "./dist/ui/index.d.ts",
       "default": "./dist/ui/index.js"
+    },
+    "./plugins": {
+      "types": "./dist/plugins/index.d.ts",
+      "default": "./dist/plugins/index.js"
     }
   },
   "keywords": [
@@ -35,21 +39,27 @@
     "better-auth": "^1.3.29",
     "react": "^18.0.0 || ^19.0.0",
     "next": "^15.0.0 || ^16.0.0",
-    "@opensaas/stack-core": "0.1.0"
+    "@opensaas/stack-core": "0.1.1"
   },
   "dependencies": {},
   "devDependencies": {
     "@types/node": "^24.7.2",
     "@types/react": "^19.2.2",
+    "@vitest/coverage-v8": "^4.0.4",
+    "@vitest/ui": "^4.0.0",
     "better-auth": "^1.3.29",
     "next": "^16.0.0",
     "react": "^19.2.0",
     "typescript": "^5.9.3",
-    "@opensaas/stack-core": "0.1.0"
+    "vitest": "^4.0.0",
+    "@opensaas/stack-core": "0.1.1"
   },
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "clean": "rm -rf .turbo dist tsconfig.tsbuildinfo"
+    "clean": "rm -rf .turbo dist tsconfig.tsbuildinfo",
+    "test": "vitest run",
+    "test:ui": "vitest --ui",
+    "test:coverage": "vitest run --coverage"
   }
 }

package/src/config/index.ts

@@ -7,6 +7,7 @@ import type {
   PasswordResetConfig,
 } from './types.js'
 import { getAuthLists } from '../lists/index.js'
+import { convertBetterAuthSchema } from '../server/schema-converter.js'
 
 /**
  * Normalize auth configuration with defaults
@@ -65,6 +66,7 @@ export function normalizeAuthConfig(config: AuthConfig): NormalizedAuthConfig {
         console.log(`Subject: ${subject}`)
         console.log(`Body: ${html}`)
       }),
+    betterAuthPlugins: config.betterAuthPlugins || [],
   }
 }
 
@@ -114,8 +116,8 @@ export function authConfig(config: AuthConfig): AuthConfig {
 export function withAuth(opensaasConfig: OpenSaasConfig, authConfig: AuthConfig): OpenSaasConfig {
   const normalized = normalizeAuthConfig(authConfig)
 
-  // Get auth lists with user extensions
-  const authLists = getAuthLists(normalized.extendUserList)
+  // Get auth lists from plugins
+  const authLists = getAuthListsFromPlugins(normalized)
 
   // Merge auth lists with user lists (auth lists take priority)
   const mergedLists = {
@@ -136,5 +138,29 @@ export function withAuth(opensaasConfig: OpenSaasConfig, authConfig: AuthConfig)
   return result
 }
 
+/**
+ * Get auth lists by extracting schemas from Better Auth plugins
+ * This inspects the plugin objects directly without requiring a database connection
+ */
+function getAuthListsFromPlugins(authConfig: NormalizedAuthConfig) {
+  // Start with base Better Auth tables (always required)
+  const authLists = getAuthLists(authConfig.extendUserList)
+
+  // Extract additional tables from plugins
+  for (const plugin of authConfig.betterAuthPlugins) {
+    if (plugin && typeof plugin === 'object' && 'schema' in plugin) {
+      // Plugin has schema property - convert to OpenSaaS lists
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Plugin schema types are dynamic
+      const pluginSchema = plugin.schema as any
+
+      // Convert plugin schema to OpenSaaS lists and merge
+      const pluginLists = convertBetterAuthSchema(pluginSchema)
+      Object.assign(authLists, pluginLists)
+    }
+  }
+
+  return authLists
+}
+
 export type { AuthConfig, NormalizedAuthConfig }
 export * from './types.js'

package/src/config/types.ts

@@ -151,6 +151,22 @@ export type AuthConfig = {
    * ```
    */
   sendEmail?: (params: { to: string; subject: string; html: string }) => Promise<void>
+
+  /**
+   * Additional Better Auth plugins to enable
+   * Allows integrating any Better Auth plugin (MCP, 2FA, etc.)
+   *
+   * @example
+   * ```typescript
+   * import { mcp } from 'better-auth/plugins'
+   *
+   * betterAuthPlugins: [
+   *   mcp({ loginPage: '/sign-in' })
+   * ]
+   * ```
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Better Auth plugin types are not exposed, must use any
+  betterAuthPlugins?: any[]
 }
 
 /**
@@ -158,9 +174,11 @@ export type AuthConfig = {
  * Used after parsing user config
  */
 export type NormalizedAuthConfig = Required<
-  Omit<AuthConfig, 'emailAndPassword' | 'emailVerification' | 'passwordReset'>
+  Omit<AuthConfig, 'emailAndPassword' | 'emailVerification' | 'passwordReset' | 'betterAuthPlugins'>
 > & {
   emailAndPassword: Required<EmailPasswordConfig>
   emailVerification: Required<EmailVerificationConfig>
   passwordReset: Required<PasswordResetConfig>
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Better Auth plugin types are not exposed, must use any
+  betterAuthPlugins: any[]
 }

package/src/plugins/index.ts

@@ -0,0 +1,7 @@
+/**
+ * Re-export Better Auth plugins for convenience
+ * This allows users to import plugins from @opensaas/stack-auth/plugins
+ * instead of better-auth/plugins
+ */
+
+export { mcp } from 'better-auth/plugins'

package/src/server/index.ts

@@ -78,6 +78,9 @@ export function createAuth(
         },
         {} as Record<string, { clientId: string; clientSecret: string }>,
       ),
+
+    // Pass through any additional Better Auth plugins
+    plugins: authConfig.betterAuthPlugins || [],
   }
 
   return betterAuth(betterAuthConfig)