@payez/next-mvp 4.0.23 → 4.0.25

package/dist/auth/better-auth.d.ts

@@ -45,13 +45,6 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig): im
             refreshCache: false;
         };
     };
-    databaseHooks: {
-        session: {
-            create: {
-                after: (session: any) => Promise<void>;
-            };
-        };
-    };
     advanced: {
         cookiePrefix: string;
         cookies: {
@@ -105,3 +98,13 @@ export declare function getBetterAuthHandler(): Promise<{
     GET: (req: Request) => Promise<Response>;
     POST: (req: Request) => Promise<Response>;
 } | null>;
+/**
+ * Exchange OAuth identity for IDP tokens and store in the BA Redis session.
+ *
+ * Call this from the OAuth callback route AFTER better-auth has processed the
+ * callback and created the session. Reads the session token from the Set-Cookie
+ * header of the response to find the BA Redis key.
+ *
+ * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ */
+export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider?: string): Promise<boolean>;

package/dist/auth/better-auth.js

@@ -16,6 +16,7 @@ exports.createBetterAuthInstance = createBetterAuthInstance;
 exports.isBetterAuthEnabled = isBetterAuthEnabled;
 exports.getBetterAuthInstance = getBetterAuthInstance;
 exports.getBetterAuthHandler = getBetterAuthHandler;
+exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 require("server-only");
 const better_auth_1 = require("better-auth");
 const next_js_1 = require("better-auth/next-js");
@@ -49,17 +50,20 @@ function buildBetterAuthProviders(config) {
 function createBetterAuthInstance(idpConfig) {
     const appSlug = idpConfig.clientSlug || (0, app_slug_1.getAppSlug)();
     // Resolve base URL: BETTER_AUTH_URL env > IDP config > localhost fallback
-    const baseURL = process.env.BETTER_AUTH_URL
+    // Must include /api/auth since that's where the catch-all route is mounted
+    const rawBaseURL = process.env.BETTER_AUTH_URL
         || idpConfig.baseClientUrl
         || `http://localhost:${process.env.PORT || '3000'}`;
+    const baseURL = rawBaseURL.replace(/\/+$/, '') + '/api/auth';
     return (0, better_auth_1.betterAuth)({
         baseURL,
         secret: idpConfig.nextAuthSecret,
         socialProviders: buildBetterAuthProviders(idpConfig),
         // Trust the app's own origin + any configured base URL
         trustedOrigins: [
+            rawBaseURL,
             baseURL,
-            ...(idpConfig.baseClientUrl && idpConfig.baseClientUrl !== baseURL ? [idpConfig.baseClientUrl] : []),
+            ...(idpConfig.baseClientUrl ? [idpConfig.baseClientUrl] : []),
             'http://localhost:3000',
             'http://localhost:3400',
             'http://localhost:3600',
@@ -100,90 +104,6 @@ function createBetterAuthInstance(idpConfig) {
                 refreshCache: false,
             },
         },
-        // After social login, exchange Google identity for IDP tokens and store in Redis
-        databaseHooks: {
-            session: {
-                create: {
-                    after: async (session) => {
-                        try {
-                            const userId = session.userId;
-                            const token = session.token;
-                            if (!userId || !token)
-                                return;
-                            // Look up user from Better Auth's memory/DB to get email
-                            // The user was just created/found by Better Auth during OAuth
-                            const baKey = `ba:${appSlug}:${token}`;
-                            const baRaw = await (0, redis_1.getRedis)().get(baKey).catch(() => null);
-                            const baData = baRaw ? JSON.parse(baRaw) : null;
-                            const email = baData?.user?.email;
-                            const name = baData?.user?.name;
-                            const image = baData?.user?.image;
-                            if (!email) {
-                                console.warn('[BETTER_AUTH] Session created but no email found for IDP token exchange');
-                                return;
-                            }
-                            // Call IDP oauth-callback to get IDP tokens
-                            const idpUrl = process.env.IDP_URL || '';
-                            if (!idpUrl) {
-                                console.warn('[BETTER_AUTH] No IDP URL configured, skipping token exchange');
-                                return;
-                            }
-                            const oauthRes = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
-                                method: 'POST',
-                                headers: { 'Content-Type': 'application/json' },
-                                body: JSON.stringify({
-                                    provider: 'google',
-                                    provider_account_id: userId,
-                                    email,
-                                    name,
-                                    image,
-                                    client_id: idpConfig.clientSlug || String(idpConfig.clientId),
-                                }),
-                            });
-                            const oauthResText = await oauthRes.text();
-                            console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
-                            if (!oauthRes.ok) {
-                                console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
-                                return;
-                            }
-                            let idpData;
-                            try {
-                                idpData = JSON.parse(oauthResText);
-                            }
-                            catch {
-                                return;
-                            }
-                            const result = idpData?.data?.result || idpData?.data || idpData;
-                            if (!result?.access_token) {
-                                console.warn('[BETTER_AUTH] IDP oauth-callback returned no access_token. Keys:', Object.keys(result || {}));
-                                return;
-                            }
-                            // Store IDP tokens in the BA Redis session
-                            if (baData) {
-                                const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
-                                baData.idpTokens = {
-                                    idpAccessToken: result.access_token,
-                                    idpRefreshToken: result.refresh_token,
-                                    idpAccessTokenExpires: result.expires_in
-                                        ? Date.now() + result.expires_in * 1000
-                                        : Date.now() + 15 * 60 * 1000,
-                                    userId: String(result.user?.user_id || result.user?.id || result.user_id || userId),
-                                    email: result.user?.email || result.email || email,
-                                    name: result.user?.full_name || result.user?.name || result.name || name,
-                                    roles: result.user?.roles || result.roles || [],
-                                    mfaVerified: !requiresTwoFactor,
-                                };
-                                await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
-                                console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
-                            }
-                        }
-                        catch (err) {
-                            console.error('[BETTER_AUTH] Post-login IDP exchange failed:', err instanceof Error ? err.message : String(err));
-                        }
-                    },
-                },
-            },
-        },
         // Cookie prefix must match slim-middleware expectations ({slug}.session-token)
         advanced: {
             cookiePrefix: appSlug,
@@ -248,3 +168,92 @@ async function getBetterAuthHandler() {
     const auth = await getBetterAuthInstance();
     return (0, next_js_2.toNextJsHandler)(auth);
 }
+/**
+ * Exchange OAuth identity for IDP tokens and store in the BA Redis session.
+ *
+ * Call this from the OAuth callback route AFTER better-auth has processed the
+ * callback and created the session. Reads the session token from the Set-Cookie
+ * header of the response to find the BA Redis key.
+ *
+ * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ */
+async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
+    try {
+        const config = await (0, idp_client_config_1.getIDPClientConfig)();
+        const appSlug = config.clientSlug || (0, app_slug_1.getAppSlug)();
+        const baKey = `ba:${appSlug}:${sessionToken}`;
+        // Read the BA session from Redis
+        const baRaw = await (0, redis_1.getRedis)().get(baKey).catch(() => null);
+        if (!baRaw) {
+            console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: session not found in Redis for token', sessionToken.substring(0, 10));
+            return false;
+        }
+        const baData = JSON.parse(baRaw);
+        const email = baData?.user?.email;
+        const name = baData?.user?.name;
+        const image = baData?.user?.image;
+        const baUserId = baData?.session?.userId || baData?.user?.id;
+        if (!email) {
+            console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: no email in session');
+            return false;
+        }
+        // Call IDP oauth-callback
+        const idpUrl = process.env.IDP_URL || '';
+        if (!idpUrl) {
+            console.warn('[BETTER_AUTH] No IDP_URL configured, skipping token exchange');
+            return false;
+        }
+        console.log('[BETTER_AUTH] Exchanging OAuth identity for IDP tokens:', email);
+        const oauthRes = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                provider,
+                provider_account_id: baUserId,
+                email,
+                name,
+                image,
+                client_id: config.clientSlug || String(config.clientId),
+            }),
+        });
+        const oauthResText = await oauthRes.text();
+        console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
+        if (!oauthRes.ok) {
+            console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
+            return false;
+        }
+        let idpData;
+        try {
+            idpData = JSON.parse(oauthResText);
+        }
+        catch {
+            return false;
+        }
+        const result = idpData?.data?.result || idpData?.data || idpData;
+        if (!result?.access_token) {
+            console.warn('[BETTER_AUTH] IDP oauth-callback returned no access_token. Keys:', Object.keys(result || {}));
+            return false;
+        }
+        // Store IDP tokens in the BA Redis session
+        const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
+        baData.idpTokens = {
+            idpAccessToken: result.access_token,
+            idpRefreshToken: result.refresh_token,
+            idpAccessTokenExpires: result.expires_in
+                ? Date.now() + result.expires_in * 1000
+                : Date.now() + 15 * 60 * 1000,
+            userId: String(result.user?.user_id || result.user?.id || result.user_id || baUserId),
+            email: result.user?.email || result.email || email,
+            name: result.user?.full_name || result.user?.name || result.name || name,
+            roles: result.user?.roles || result.roles || [],
+            mfaVerified: !requiresTwoFactor,
+        };
+        await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
+        console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
+        return true;
+    }
+    catch (err) {
+        console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+        return false;
+    }
+}

package/dist/client/better-auth-client.d.ts

@@ -956,14 +956,6 @@ export declare const useSession: () => {
     code?: string | undefined;
     message?: string | undefined;
 }, FetchOptions["throw"] extends true ? true : false>>;
-/**
- * Sign in with a specific OAuth provider via direct redirect.
- *
- * better-auth exposes per-provider endpoints at /api/auth/sign-in/{provider}
- * (e.g. /api/auth/sign-in/google). The generic signIn.social() method POSTs
- * to /api/auth/sign-in/social which doesn't exist — use this instead.
- */
-export declare function signInWithProvider(provider: string, callbackURL?: string): void;
 /**
  * NextAuth-compatible useSession wrapper.
  *

package/dist/client/better-auth-client.js

@@ -10,7 +10,6 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signOut = exports.signIn = exports.useSession = exports.authClient = void 0;
-exports.signInWithProvider = signInWithProvider;
 exports.useSessionCompat = useSessionCompat;
 exports.signOutCompat = signOutCompat;
 const react_1 = require("better-auth/react");
@@ -20,20 +19,6 @@ exports.authClient = (0, react_1.createAuthClient)({
 });
 // Convenience exports
 exports.useSession = exports.authClient.useSession, exports.signIn = exports.authClient.signIn, exports.signOut = exports.authClient.signOut;
-/**
- * Sign in with a specific OAuth provider via direct redirect.
- *
- * better-auth exposes per-provider endpoints at /api/auth/sign-in/{provider}
- * (e.g. /api/auth/sign-in/google). The generic signIn.social() method POSTs
- * to /api/auth/sign-in/social which doesn't exist — use this instead.
- */
-function signInWithProvider(provider, callbackURL) {
-    const params = new URLSearchParams();
-    if (callbackURL)
-        params.set('callbackURL', callbackURL);
-    const qs = params.toString();
-    window.location.href = `/api/auth/sign-in/${provider}${qs ? '?' + qs : ''}`;
-}
 /**
  * NextAuth-compatible useSession wrapper.
  *

package/dist/components/account/MobileNavDrawer.js

@@ -44,7 +44,7 @@ function MobileNavDrawer({ isOpen, onClose, navItems, customSections, basePath =
             onSignIn();
         }
         else {
-            (0, better_auth_client_1.signInWithProvider)('google', signInCallbackUrl);
+            better_auth_client_1.authClient.signIn.social({ provider: 'google', callbackURL: signInCallbackUrl });
         }
     };
     const handleSectionItemClick = (item) => {

package/dist/server/auth.d.ts

@@ -28,13 +28,6 @@ export declare function getAuthInstance(): Promise<import("better-auth/types").A
             refreshCache: false;
         };
     };
-    databaseHooks: {
-        session: {
-            create: {
-                after: (session: any) => Promise<void>;
-            };
-        };
-    };
     advanced: {
         cookiePrefix: string;
         cookies: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.0.23",
+  "version": "4.0.25",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -58,9 +58,11 @@ export function createBetterAuthInstance(idpConfig: IDPClientConfig) {
   const appSlug = idpConfig.clientSlug || getAppSlug();
 
   // Resolve base URL: BETTER_AUTH_URL env > IDP config > localhost fallback
-  const baseURL = process.env.BETTER_AUTH_URL
+  // Must include /api/auth since that's where the catch-all route is mounted
+  const rawBaseURL = process.env.BETTER_AUTH_URL
     || idpConfig.baseClientUrl
     || `http://localhost:${process.env.PORT || '3000'}`;
+  const baseURL = rawBaseURL.replace(/\/+$/, '') + '/api/auth';
 
   return betterAuth({
     baseURL,
@@ -70,8 +72,9 @@ export function createBetterAuthInstance(idpConfig: IDPClientConfig) {
 
     // Trust the app's own origin + any configured base URL
     trustedOrigins: [
+      rawBaseURL,
       baseURL,
-      ...(idpConfig.baseClientUrl && idpConfig.baseClientUrl !== baseURL ? [idpConfig.baseClientUrl] : []),
+      ...(idpConfig.baseClientUrl ? [idpConfig.baseClientUrl] : []),
       'http://localhost:3000',
       'http://localhost:3400',
       'http://localhost:3600',
@@ -109,93 +112,6 @@ export function createBetterAuthInstance(idpConfig: IDPClientConfig) {
       },
     },
 
-    // After social login, exchange Google identity for IDP tokens and store in Redis
-    databaseHooks: {
-      session: {
-        create: {
-          after: async (session: any) => {
-            try {
-              const userId = session.userId;
-              const token = session.token;
-              if (!userId || !token) return;
-
-              // Look up user from Better Auth's memory/DB to get email
-              // The user was just created/found by Better Auth during OAuth
-              const baKey = `ba:${appSlug}:${token}`;
-              const baRaw = await getRedis().get(baKey).catch(() => null);
-              const baData = baRaw ? JSON.parse(baRaw) : null;
-              const email = baData?.user?.email;
-              const name = baData?.user?.name;
-              const image = baData?.user?.image;
-
-              if (!email) {
-                console.warn('[BETTER_AUTH] Session created but no email found for IDP token exchange');
-                return;
-              }
-
-              // Call IDP oauth-callback to get IDP tokens
-              const idpUrl = process.env.IDP_URL || '';
-              if (!idpUrl) {
-                console.warn('[BETTER_AUTH] No IDP URL configured, skipping token exchange');
-                return;
-              }
-
-              const oauthRes = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                  provider: 'google',
-                  provider_account_id: userId,
-                  email,
-                  name,
-                  image,
-                  client_id: idpConfig.clientSlug || String(idpConfig.clientId),
-                }),
-              });
-
-              const oauthResText = await oauthRes.text();
-              console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
-
-              if (!oauthRes.ok) {
-                console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
-                return;
-              }
-
-              let idpData: any;
-              try { idpData = JSON.parse(oauthResText); } catch { return; }
-              const result = idpData?.data?.result || idpData?.data || idpData;
-
-              if (!result?.access_token) {
-                console.warn('[BETTER_AUTH] IDP oauth-callback returned no access_token. Keys:', Object.keys(result || {}));
-                return;
-              }
-
-              // Store IDP tokens in the BA Redis session
-              if (baData) {
-                const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
-                baData.idpTokens = {
-                  idpAccessToken: result.access_token,
-                  idpRefreshToken: result.refresh_token,
-                  idpAccessTokenExpires: result.expires_in
-                    ? Date.now() + result.expires_in * 1000
-                    : Date.now() + 15 * 60 * 1000,
-                  userId: String(result.user?.user_id || result.user?.id || result.user_id || userId),
-                  email: result.user?.email || result.email || email,
-                  name: result.user?.full_name || result.user?.name || result.name || name,
-                  roles: result.user?.roles || result.roles || [],
-                  mfaVerified: !requiresTwoFactor,
-                };
-                await getRedis().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
-                console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
-              }
-            } catch (err) {
-              console.error('[BETTER_AUTH] Post-login IDP exchange failed:', err instanceof Error ? err.message : String(err));
-            }
-          },
-        },
-      },
-    },
-
     // Cookie prefix must match slim-middleware expectations ({slug}.session-token)
     advanced: {
       cookiePrefix: appSlug,
@@ -269,3 +185,101 @@ export async function getBetterAuthHandler(): Promise<{ GET: (req: Request) => P
   const auth = await getBetterAuthInstance();
   return toNextJsHandler(auth);
 }
+
+/**
+ * Exchange OAuth identity for IDP tokens and store in the BA Redis session.
+ *
+ * Call this from the OAuth callback route AFTER better-auth has processed the
+ * callback and created the session. Reads the session token from the Set-Cookie
+ * header of the response to find the BA Redis key.
+ *
+ * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ */
+export async function exchangeOAuthForIdpTokens(
+  sessionToken: string,
+  provider: string = 'google'
+): Promise<boolean> {
+  try {
+    const config = await getIDPClientConfig();
+    const appSlug = config.clientSlug || getAppSlug();
+    const baKey = `ba:${appSlug}:${sessionToken}`;
+
+    // Read the BA session from Redis
+    const baRaw = await getRedis().get(baKey).catch(() => null);
+    if (!baRaw) {
+      console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: session not found in Redis for token', sessionToken.substring(0, 10));
+      return false;
+    }
+
+    const baData = JSON.parse(baRaw);
+    const email = baData?.user?.email;
+    const name = baData?.user?.name;
+    const image = baData?.user?.image;
+    const baUserId = baData?.session?.userId || baData?.user?.id;
+
+    if (!email) {
+      console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: no email in session');
+      return false;
+    }
+
+    // Call IDP oauth-callback
+    const idpUrl = process.env.IDP_URL || '';
+    if (!idpUrl) {
+      console.warn('[BETTER_AUTH] No IDP_URL configured, skipping token exchange');
+      return false;
+    }
+
+    console.log('[BETTER_AUTH] Exchanging OAuth identity for IDP tokens:', email);
+
+    const oauthRes = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        provider,
+        provider_account_id: baUserId,
+        email,
+        name,
+        image,
+        client_id: config.clientSlug || String(config.clientId),
+      }),
+    });
+
+    const oauthResText = await oauthRes.text();
+    console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
+
+    if (!oauthRes.ok) {
+      console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
+      return false;
+    }
+
+    let idpData: any;
+    try { idpData = JSON.parse(oauthResText); } catch { return false; }
+    const result = idpData?.data?.result || idpData?.data || idpData;
+
+    if (!result?.access_token) {
+      console.warn('[BETTER_AUTH] IDP oauth-callback returned no access_token. Keys:', Object.keys(result || {}));
+      return false;
+    }
+
+    // Store IDP tokens in the BA Redis session
+    const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
+    baData.idpTokens = {
+      idpAccessToken: result.access_token,
+      idpRefreshToken: result.refresh_token,
+      idpAccessTokenExpires: result.expires_in
+        ? Date.now() + result.expires_in * 1000
+        : Date.now() + 15 * 60 * 1000,
+      userId: String(result.user?.user_id || result.user?.id || result.user_id || baUserId),
+      email: result.user?.email || result.email || email,
+      name: result.user?.full_name || result.user?.name || result.name || name,
+      roles: result.user?.roles || result.roles || [],
+      mfaVerified: !requiresTwoFactor,
+    };
+    await getRedis().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
+    console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
+    return true;
+  } catch (err) {
+    console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+    return false;
+  }
+}

package/src/client/better-auth-client.ts

@@ -18,19 +18,6 @@ export const authClient = createAuthClient({
 // Convenience exports
 export const { useSession, signIn, signOut } = authClient;
 
-/**
- * Sign in with a specific OAuth provider via direct redirect.
- *
- * better-auth exposes per-provider endpoints at /api/auth/sign-in/{provider}
- * (e.g. /api/auth/sign-in/google). The generic signIn.social() method POSTs
- * to /api/auth/sign-in/social which doesn't exist — use this instead.
- */
-export function signInWithProvider(provider: string, callbackURL?: string) {
-  const params = new URLSearchParams();
-  if (callbackURL) params.set('callbackURL', callbackURL);
-  const qs = params.toString();
-  window.location.href = `/api/auth/sign-in/${provider}${qs ? '?' + qs : ''}`;
-}
 
 /**
  * NextAuth-compatible useSession wrapper.

package/src/components/account/MobileNavDrawer.tsx

@@ -1,7 +1,7 @@
 'use client';
 
 import { useEffect, useCallback } from 'react';
-import { authClient, signInWithProvider } from '../../client/better-auth-client';
+import { authClient } from '../../client/better-auth-client';
 import { usePathname } from 'next/navigation';
 import Image from 'next/image';
 import Link from 'next/link';
@@ -90,7 +90,7 @@ export function MobileNavDrawer({
     if (onSignIn) {
       onSignIn();
     } else {
-      signInWithProvider('google', signInCallbackUrl);
+      authClient.signIn.social({ provider: 'google', callbackURL: signInCallbackUrl });
     }
   };