@opensaas/stack-auth 0.39.2 → 0.40.0

package/src/config/index.ts

@@ -10,12 +10,6 @@ import type {
   SendAuthEmail,
 } from './types.js'
 
-/**
- * Default better-auth model names. Used when the developer does not override
- * `modelName`, preserving the historical `User`/`Session`/`Account`/`Verification`
- * keys exactly. `rateLimit` only applies when `rateLimit.storage: 'database'`
- * derives the fifth Auth list.
- */
 const DEFAULT_MODEL_NAMES = {
   user: 'User',
   session: 'Session',
@@ -25,11 +19,6 @@ const DEFAULT_MODEL_NAMES = {
 } as const
 
 /**
- * Resolve a single better-auth model config block into its normalized form,
- * falling back to the better-auth default model name and an empty column map.
- * The model's Postgres schema is the per-model `schema` override when present,
- * otherwise the plugin-level `schema` default (or `undefined` for `public`).
- *
  * `tableName` defaults to today's behaviour when not explicitly set: it
  * follows `modelName` when that differs from the better-auth default (so a
  * renamed list still pins its table via `@@map`), otherwise it stays unset.
@@ -49,15 +38,10 @@ function normalizeModelConfig(
     tableName,
     fields: config?.fields || {},
     schema: config?.schema ?? defaultSchema,
+    indexes: config?.indexes ?? [],
   }
 }
 
-/**
- * Resolve the better-auth model config for all four auth models, plus a fifth
- * `rateLimit` model when `rateLimit.storage: 'database'` requires deriving
- * the `RateLimit` list. `defaultSchema` is the plugin-level `schema` applied
- * to every model unless a per-model `schema` override is given.
- */
 function normalizeAuthModels(config: AuthConfig): NormalizedAuthModels {
   const defaultSchema = config.schema
   const models: NormalizedAuthModels = {
@@ -82,11 +66,6 @@ function normalizeAuthModels(config: AuthConfig): NormalizedAuthModels {
   return models
 }
 
-/**
- * Default `sendResetPassword`/`sendVerificationEmail` — logs to console
- * instead of sending, matching the pre-existing "no sendEmail configured"
- * behavior for apps that haven't wired a real email provider yet.
- */
 function defaultSendAuthEmail(kind: 'password reset' | 'verification'): SendAuthEmail {
   return async ({ user, url }) => {
     console.log(
@@ -97,11 +76,7 @@ function defaultSendAuthEmail(kind: 'password reset' | 'verification'): SendAuth
   }
 }
 
-/**
- * Normalize auth configuration with defaults
- */
 export function normalizeAuthConfig(config: AuthConfig): NormalizedAuthConfig {
-  // Email and password defaults
   const emailAndPassword = config.emailAndPassword?.enabled
     ? {
         enabled: true as const,
@@ -119,7 +94,6 @@ export function normalizeAuthConfig(config: AuthConfig): NormalizedAuthConfig {
         sendResetPassword: defaultSendAuthEmail('password reset'),
       }
 
-  // Email verification defaults
   const emailVerification = config.emailVerification?.enabled
     ? {
         enabled: true as const,
@@ -137,7 +111,6 @@ export function normalizeAuthConfig(config: AuthConfig): NormalizedAuthConfig {
         sendVerificationEmail: defaultSendAuthEmail('verification'),
       }
 
-  // Password reset defaults
   const passwordReset = config.passwordReset?.enabled
     ? {
         enabled: true as const,
@@ -145,17 +118,13 @@ export function normalizeAuthConfig(config: AuthConfig): NormalizedAuthConfig {
       }
     : { enabled: false as const, tokenExpiration: 3600 }
 
-  // Session defaults
   const session = {
-    expiresIn: config.session?.expiresIn || 604800, // 7 days
-    updateAge: config.session?.updateAge ?? 86400, // 1 day, matching better-auth's own default
+    expiresIn: config.session?.expiresIn || 604800,
+    updateAge: config.session?.updateAge ?? 86400, // matches better-auth's own default
   }
 
-  // Session fields defaults
   const sessionFields = config.sessionFields || ['userId', 'email', 'name']
 
-  // Resolve better-auth per-model config (modelName + field column maps).
-  // Defaults preserve the historical User/Session/Account/Verification keys.
   const models = normalizeAuthModels(config)
 
   return {
@@ -169,6 +138,7 @@ export function normalizeAuthConfig(config: AuthConfig): NormalizedAuthConfig {
     sessionFields,
     extendUserList: config.extendUserList || {},
     access: config.access || {},
+    credentialFields: config.credentialFields || {},
     betterAuthPlugins: config.betterAuthPlugins || [],
     rateLimit: config.rateLimit,
     betterAuthOptions: config.betterAuthOptions || {},

package/src/config/plugin.ts

@@ -3,7 +3,6 @@ import { getDbKey } from '@opensaas/stack-core'
 import type { AuthConfig, NormalizedAuthConfig } from './types.js'
 import { normalizeAuthConfig } from './index.js'
 import { getAuthLists } from '../lists/index.js'
-import { convertBetterAuthSchema } from '../server/schema-converter.js'
 
 /**
  * Auth plugin for OpenSaas Stack
@@ -39,49 +38,29 @@ export function authPlugin(config: AuthConfig): Plugin {
     },
 
     init: async (context) => {
-      // Derive the auth lists from the better-auth model config (modelName +
-      // field column maps). With no overrides this yields the historical
-      // User/Session/Account/Verification keys; with overrides (e.g.
-      // user.modelName: 'AuthUser') the lists are keyed and column-mapped to
-      // match the developer's live better-auth tables.
+      // One consolidated derivation covers the four base models, the
+      // optional RateLimit model, and every table a better-auth plugin
+      // declares in its own `schema` (base-model extensions like the
+      // `anonymous` plugin's `user.isAnonymous`, and standalone tables like
+      // the MCP plugin's OAuth tables) — see `deriveAuthLists` (issue #992).
+      // `getAuthTables` merges a plugin's base-model schema extension
+      // directly into that model's own fields, so the derived `User`/`AuthUser`
+      // list here already carries e.g. `isAnonymous` before this loop runs.
       const authLists = getAuthLists(
         normalized.extendUserList,
         normalized.models,
         normalized.access,
+        normalized.betterAuthPlugins,
+        normalized.credentialFields,
       )
 
-      // The same base-model list keys the Auth lists above were derived under
-      // (e.g. `user.modelName: 'AuthUser'`). A provider plugin's schema
-      // extension of a base model (e.g. `user`) must resolve against this
-      // remap too, so it lands on the adopted Auth list rather than a
-      // re-derived key that can collide with an unrelated host list. The
-      // `rateLimit` key is only present when `rateLimit.storage: 'database'`
-      // derived the fifth Auth list.
-      const baseModelKeys = {
-        user: normalized.models.user.modelName,
-        session: normalized.models.session.modelName,
-        account: normalized.models.account.modelName,
-        verification: normalized.models.verification.modelName,
-        ...(normalized.models.rateLimit
-          ? { rateLimit: normalized.models.rateLimit.modelName }
-          : {}),
-      }
-
-      // Add all auth lists FIRST, before any better-auth plugin schema
-      // extension is processed. This must happen before the betterAuthPlugins
-      // loop below so a base-model extension (e.g. a plugin's `schema: {
-      // user: { fields: … } }`) always finds the real derived list already
-      // registered under its key and takes the merge (`extendList`) path
-      // against it — instead of pre-empting that key with a bare
-      // `list({ fields })` that carries no `db`/`access` (see #861).
-      //
-      // The plugin only ever touches its OWN derived keys. When a developer
-      // renames the auth user model (e.g. user.modelName: 'AuthUser'), the
-      // derived key is 'AuthUser' and an app's separate 'User' list is left
-      // untouched — the plugin never extends/overwrites a list it didn't
-      // derive. Extending only kicks in when an existing list shares the
-      // derived key (e.g. the default 'User'), which is the intended
-      // "merge auth fields into my User" behaviour.
+      // Base models are always the first entries in `authLists` (see
+      // `deriveAuthLists`), so a plugin table's reverse relation onto a base
+      // model (e.g. `AuthUser.oauthApplications`) is already part of that
+      // base list's `fields` by the time this loop reaches it — one pass
+      // suffices for both: a list already declared by the app (or added by
+      // an earlier iteration of this same loop) merges via `extendList`;
+      // everything else registers via `addList`.
       for (const [listName, listConfig] of Object.entries(authLists)) {
         if (context.config.lists[listName]) {
           // A list already exists under this derived key — merge auth fields
@@ -94,55 +73,14 @@ export function authPlugin(config: AuthConfig): Plugin {
             mcp: listConfig.mcp,
           })
         } else {
-          // Otherwise, add the auth list
           context.addList(listName, listConfig)
         }
       }
 
-      // Extract additional lists from Better Auth plugins. Because the auth
-      // lists above are already registered, a schema extension of a base
-      // model (user/session/account/verification) always finds its resolved
-      // key occupied by the real derived list and merges via `extendList` —
-      // its `db`/`access` are preserved. Non-base plugin tables (e.g.
-      // `oauth_application`, `passkey`) still register as new lists via
-      // `addList`, same as before.
-      for (const plugin of normalized.betterAuthPlugins) {
-        if (plugin && typeof plugin === 'object' && plugin.schema) {
-          // Plugin has schema property - convert to OpenSaaS lists
-          const pluginSchema = plugin.schema
-          const pluginLists = convertBetterAuthSchema(pluginSchema, baseModelKeys)
-
-          // Add or extend lists from plugin
-          for (const [listName, listConfig] of Object.entries(pluginLists)) {
-            if (context.config.lists[listName]) {
-              // List already exists — merge fields/hooks/mcp in only. Access
-              // control belongs to whoever owns the list; per ADR-0013 an
-              // extension must never carry operation-level access for a
-              // pre-existing list (the plugin engine throws if it does).
-              context.extendList(listName, {
-                fields: listConfig.fields,
-                hooks: listConfig.hooks,
-                mcp: listConfig.mcp,
-              })
-            } else {
-              // List doesn't exist, add it
-              context.addList(listName, listConfig)
-            }
-          }
-        }
-      }
-
-      // Store auth config for runtime access
-      // Access at runtime via: config._pluginData.auth
       context.setPluginData<NormalizedAuthConfig>('auth', normalized)
     },
 
     beforeGenerate: (generationConfig) => {
-      // Collect every schema the Auth lists are placed in (per-model schema,
-      // else the plugin-level schema). When none is configured the Auth lists
-      // stay in the default `public` schema and we leave the config untouched —
-      // the greenfield default Prisma schema is unchanged (no `schemas`, no
-      // `previewFeatures`, no `@@schema`).
       const authSchemas = Array.from(
         new Set(
           Object.values(normalized.models)
@@ -181,18 +119,13 @@ export function authPlugin(config: AuthConfig): Plugin {
     },
 
     runtime: (context, sudo) => {
-      // Resolve the user list's context.db key from the configured user model.
-      // context.db is keyed camelCase, so 'User' -> 'user', 'AuthUser' -> 'authUser'.
       const userDbKey = getDbKey(normalized.models.user.modelName)
 
-      // Provide auth-related utilities at runtime
       return {
         /**
-         * Get user by ID.
-         *
-         * Resolves through `sudo()` (per ADR-0013): the User list ships closed
-         * by default, and "who is this session" must not depend on the
-         * application's User access policy.
+         * Resolves through `sudo()` (per ADR-0013): the User list ships
+         * closed by default, and "who is this session" must not depend on
+         * the application's User access policy.
          */
         getUser: async (userId: string) => {
           return await sudo().db[userDbKey].findUnique({
@@ -200,10 +133,7 @@ export function authPlugin(config: AuthConfig): Plugin {
           })
         },
 
-        /**
-         * Get current user from session. Extracts userId from session and
-         * fetches user data via `sudo()` — see {@link getUser}.
-         */
+        /** See {@link getUser} — same `sudo()` rationale (ADR-0013), keyed off `context.session.userId`. */
         getCurrentUser: async () => {
           if (!context.session?.userId) {
             return null

package/src/config/types.ts

@@ -1,4 +1,4 @@
-import type { ListConfig } from '@opensaas/stack-core'
+import type { ListConfig, ListIndex } from '@opensaas/stack-core'
 import type { BetterAuthOptions, BetterAuthPlugin, User } from 'better-auth'
 import type { ExtendUserListConfig } from '../lists/index.js'
 
@@ -13,18 +13,12 @@ export type SendAuthEmail = (
   request?: Request,
 ) => Promise<void>
 
-/**
- * OAuth provider configuration
- */
 export type OAuthProvider = {
   clientId: string
   clientSecret: string
   enabled?: boolean
 }
 
-/**
- * Social provider configurations
- */
 export type SocialProvidersConfig = {
   github?: OAuthProvider
   google?: OAuthProvider
@@ -33,9 +27,6 @@ export type SocialProvidersConfig = {
   [key: string]: OAuthProvider | undefined
 }
 
-/**
- * Email and password configuration
- */
 export type EmailPasswordConfig = {
   enabled: boolean
   /**
@@ -76,9 +67,6 @@ export type EmailPasswordConfig = {
   sendResetPassword?: SendAuthEmail
 }
 
-/**
- * Email verification configuration
- */
 export type EmailVerificationConfig = {
   enabled: boolean
   /**
@@ -111,9 +99,6 @@ export type EmailVerificationConfig = {
   sendVerificationEmail?: SendAuthEmail
 }
 
-/**
- * Password reset configuration
- */
 export type PasswordResetConfig = {
   enabled: boolean
   /**
@@ -123,9 +108,6 @@ export type PasswordResetConfig = {
   tokenExpiration?: number
 }
 
-/**
- * Session configuration
- */
 export type SessionConfig = {
   /**
    * Session expiration in seconds
@@ -141,24 +123,6 @@ export type SessionConfig = {
   updateAge?: number | false
 }
 
-/**
- * Per-model better-auth configuration block.
- *
- * Mirrors better-auth's own `BetterAuthDBOptions` (the `user`/`session`/
- * `account`/`verification` config a developer already writes): `modelName`
- * renames the table/list and `fields` maps individual better-auth field names
- * to database column names. The auth plugin derives its Auth lists from this
- * config so the generated lists carry the same keys and column maps as the
- * developer's live better-auth tables.
- *
- * @example
- * ```typescript
- * authPlugin({
- *   user: { modelName: 'AuthUser', fields: { name: 'full_name' } },
- *   session: { modelName: 'AuthSession' },
- * })
- * ```
- */
 /**
  * App-authored operation + field-level access control for the Auth lists,
  * keyed by better-auth model name (not by the derived list key, so it stays
@@ -213,6 +177,24 @@ export type AuthAccessConfig = {
   rateLimit?: ListConfig<any>['access']
 }
 
+/**
+ * Per-model better-auth configuration block.
+ *
+ * Mirrors better-auth's own `BetterAuthDBOptions` (the `user`/`session`/
+ * `account`/`verification` config a developer already writes): `modelName`
+ * renames the table/list and `fields` maps individual better-auth field names
+ * to database column names. The auth plugin derives its Auth lists from this
+ * config so the generated lists carry the same keys and column maps as the
+ * developer's live better-auth tables.
+ *
+ * @example
+ * ```typescript
+ * authPlugin({
+ *   user: { modelName: 'AuthUser', fields: { name: 'full_name' } },
+ *   session: { modelName: 'AuthSession' },
+ * })
+ * ```
+ */
 export type AuthModelConfig = {
   /**
    * The table/list name for this model.
@@ -262,35 +244,50 @@ export type AuthModelConfig = {
    * ```
    */
   schema?: string
+  /**
+   * App-authored model-level `@@unique`/`@@index` constraints for this auth
+   * model, in the same shape as a list's own {@link ListConfig.db} `indexes`
+   * (core's {@link ListIndex}). Entries name this model's own OpenSaaS field
+   * keys (e.g. `identifier`, `createdAt` on `verification`) — the same names
+   * used in this model's `fields` column map — not raw database column names.
+   *
+   * The stack already derives some indexes from better-auth's own table
+   * definitions (e.g. `User.email` is `@unique`). When an entry here covers a
+   * column that also carries a derived index, the derived index is
+   * suppressed for that column and only this entry is emitted — the
+   * application's declaration wins (ADR-0035). This is what makes adopting a
+   * live database's real constraint name, or extending a derived column into
+   * a composite index, expressible.
+   *
+   * @example Adopt a live `user.email` unique constraint under its real name
+   * ```typescript
+   * authPlugin({
+   *   user: { indexes: [{ fields: ['email'], unique: true, name: 'user_email_key' }] },
+   * })
+   * ```
+   *
+   * @example Extend a derived index into a composite (per-identifier resend cooldown)
+   * ```typescript
+   * authPlugin({
+   *   verification: {
+   *     indexes: [{ fields: ['identifier', { field: 'createdAt', sort: 'desc' }] }],
+   *   },
+   * })
+   * ```
+   */
+  indexes?: ListIndex[]
 }
 
-/**
- * Auth configuration options
- */
 export type AuthConfig = {
-  /**
-   * Email and password authentication
-   */
   emailAndPassword?: EmailPasswordConfig | { enabled: true }
 
-  /**
-   * Email verification
-   */
   emailVerification?: EmailVerificationConfig | { enabled: true }
 
-  /**
-   * Password reset
-   */
   passwordReset?: PasswordResetConfig | { enabled: true }
 
-  /**
-   * OAuth/social providers
-   */
   socialProviders?: SocialProvidersConfig
 
   /**
-   * Session configuration.
-   *
    * Carries session expiry settings as well as the better-auth `session` model
    * config (`modelName` + field column `fields` maps) used to derive the Auth
    * session list.
@@ -305,14 +302,8 @@ export type AuthConfig = {
    */
   user?: AuthModelConfig
 
-  /**
-   * better-auth `account` model configuration (modelName + field column maps).
-   */
   account?: AuthModelConfig
 
-  /**
-   * better-auth `verification` model configuration (modelName + field column maps).
-   */
   verification?: AuthModelConfig
 
   /**
@@ -402,16 +393,51 @@ export type AuthConfig = {
    */
   access?: AuthAccessConfig
 
+  /**
+   * Mark additional better-auth model fields as credentials, so they ship
+   * field-level read-denied like the stack's own seeded set (ADR-0036) — the
+   * six base-model fields plus, as of issue #1014, the `mcp`/oauth-provider
+   * plugin's `oauthClient.clientSecret`/`oauthAccessToken.token`/
+   * `oauthRefreshToken.token` and `twoFactor()`'s `twoFactor.secret`/
+   * `backupCodes`. Use this for a better-auth plugin the stack doesn't seed a
+   * credential set for.
+   *
+   * Keyed by better-auth's own **model key** (e.g. `'twoFactor'`,
+   * `'oauthClient'` — not the derived list key, so it stays remap-proof), each
+   * naming better-auth **field keys** (not mapped column names).
+   *
+   * Strictly additive: an entry can mark further fields as credentials, but
+   * can never unmark one of the stack's seeded fields — omitting or emptying
+   * a seeded model's list here leaves that model's seeded deny standing. An
+   * entry naming a field that doesn't exist on a model the app actually
+   * derives (has that plugin registered) throws, naming the model and field;
+   * an entry for a model the app doesn't derive at all is a silent no-op.
+   * An entry naming an id-referencing relationship field (e.g. an FK ending
+   * `Id`) also throws — that field derives to a `relationship()`, never a
+   * scalar column, so a deny registered against it could never apply.
+   *
+   * @example
+   * ```typescript
+   * authPlugin({
+   *   betterAuthPlugins: [passkey()],
+   *   credentialFields: { passkey: ['publicKey'] },
+   * })
+   * ```
+   */
+  credentialFields?: Record<string, string[]>
+
   /**
    * Additional Better Auth plugins to enable
    * Allows integrating any Better Auth plugin (MCP, 2FA, etc.)
    *
    * @example
    * ```typescript
-   * import { mcp } from 'better-auth/plugins'
+   * import { mcp } from '@opensaas/stack-auth/plugins'
+   * import { jwt } from 'better-auth/plugins'
    *
    * betterAuthPlugins: [
-   *   mcp({ loginPage: '/sign-in' })
+   *   jwt(), // required alongside mcp() since better-auth 1.7
+   *   mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'https://your-app.com/api/mcp' })
    * ]
    * ```
    */
@@ -530,6 +556,8 @@ export type NormalizedAuthModelConfig = {
   tableName?: string
   fields: Record<string, string>
   schema?: string
+  /** App-authored `db.indexes` entries for this model (see {@link AuthModelConfig.indexes}). Defaults to `[]`. */
+  indexes?: ListIndex[]
 }
 
 /**
@@ -550,10 +578,6 @@ export type NormalizedAuthModels = {
   rateLimit?: NormalizedAuthModelConfig
 }
 
-/**
- * Internal normalized auth configuration
- * Used after parsing user config
- */
 export type NormalizedAuthConfig = Required<
   Omit<
     AuthConfig,
@@ -574,7 +598,6 @@ export type NormalizedAuthConfig = Required<
   passwordReset: Required<PasswordResetConfig>
   /** Resolved session expiry settings (model config lives under `models.session`). */
   session: Required<SessionConfig>
-  /** Resolved better-auth model config (modelName + field column maps + schema) for all auth models. */
   models: NormalizedAuthModels
   /**
    * Plugin-level Postgres schema for the Auth lists, if any. Resolved per-model

package/src/index.ts

@@ -1,13 +1,5 @@
 /**
- * @opensaas/stack-auth
- *
- * Better-auth integration for OpenSaas Stack
- *
- * This package provides:
- * - Auto-generated User, Session, Account, Verification lists
- * - Session integration with OpenSaas access control
- * - Pre-built auth UI components (SignIn, SignUp, ForgotPassword)
- * - Easy configuration with authPlugin()
+ * @opensaas/stack-auth — Better-auth integration for OpenSaas Stack.
  *
  * @example
  * ```typescript
@@ -28,7 +20,6 @@
  * ```
  */
 
-// Config exports
 export { normalizeAuthConfig } from './config/index.js'
 export { authPlugin } from './config/plugin.js'
 export type { AuthConfig, NormalizedAuthConfig } from './config/index.js'
@@ -38,16 +29,14 @@ export type * from './config/types.js'
 export { deriveAuthLists } from './config/derive-auth-lists.js'
 export type { DerivedAuthLists } from './config/derive-auth-lists.js'
 
-// "Adopt existing better-auth tables" recipe — sets the model/schema knobs that
-// match a pre-existing separate-schema better-auth install so a migrating
-// project reaches Schema parity without rebuilding the config by hand.
+// "Adopt existing better-auth tables" recipe — presets the model/schema knobs
+// for a pre-existing separate-schema better-auth install (advanced use case).
 export { adoptBetterAuthTables } from './config/adopt-better-auth-tables.js'
 export type {
   AdoptBetterAuthTablesOptions,
   AdoptBetterAuthTablesConfig,
 } from './config/adopt-better-auth-tables.js'
 
-// Runtime type exports
 export type { AuthRuntimeServices } from './runtime/types.js'
 
 // List generators (for advanced use cases)

package/src/lists/index.ts

@@ -1,4 +1,5 @@
 import type { ListConfig, FieldConfig } from '@opensaas/stack-core'
+import type { BetterAuthPlugin } from 'better-auth'
 import type { AuthAccessConfig, NormalizedAuthModels } from '../config/types.js'
 import { deriveAuthLists } from '../config/derive-auth-lists.js'
 
@@ -42,8 +43,6 @@ const DEFAULT_MODELS: NormalizedAuthModels = {
 }
 
 /**
- * Create the base User list with better-auth required fields.
- *
  * Backwards-compatible helper: derives the default `User` list (keyed `User`,
  * default field shapes) via {@link deriveAuthLists}.
  */
@@ -79,7 +78,9 @@ export function createVerificationList(): ListConfig<any> {
 }
 
 /**
- * Get all auth lists required by better-auth.
+ * Get all auth lists required by better-auth — the four base models, an
+ * optional database-backed `RateLimit`, and any table a better-auth plugin
+ * declares in its own `schema` (issue #992).
  *
  * Derives the Auth lists from the resolved better-auth model config. When no
  * `models` are supplied (or none carry overrides), the result is the historical
@@ -87,13 +88,24 @@ export function createVerificationList(): ListConfig<any> {
  *
  * @param userConfig - Extra User-list fields/access/hooks (from `extendUserList`)
  * @param models - Resolved better-auth model config; defaults to the better-auth defaults
- * @param accessConfig - App-authored access for each Auth list, keyed by better-auth model name
+ * @param accessConfig - App-authored access for each base Auth list, keyed by better-auth model name
+ * @param plugins - The app's better-auth plugins (`authPlugin({ betterAuthPlugins })`)
+ * @param credentialFieldsConfig - App-authored additions to the credential-field read-deny
+ *   (`authPlugin({ credentialFields })`), keyed by better-auth model key
  */
 export function getAuthLists(
   userConfig?: ExtendUserListConfig,
   models: NormalizedAuthModels = DEFAULT_MODELS,
   accessConfig?: AuthAccessConfig,
+  plugins?: BetterAuthPlugin[],
+  credentialFieldsConfig?: Record<string, string[]>,
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
 ): Record<string, ListConfig<any>> {
-  return deriveAuthLists(models, userConfig || {}, accessConfig || {}).lists
+  return deriveAuthLists(
+    models,
+    userConfig || {},
+    accessConfig || {},
+    plugins || [],
+    credentialFieldsConfig || {},
+  ).lists
 }