@payez/next-mvp 4.0.24 → 4.0.26

package/dist/auth/better-auth.d.ts

@@ -45,13 +45,6 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig): im
             refreshCache: false;
         };
     };
-    databaseHooks: {
-        session: {
-            create: {
-                after: (session: any) => Promise<void>;
-            };
-        };
-    };
     advanced: {
         cookiePrefix: string;
         cookies: {
@@ -105,3 +98,13 @@ export declare function getBetterAuthHandler(): Promise<{
     GET: (req: Request) => Promise<Response>;
     POST: (req: Request) => Promise<Response>;
 } | null>;
+/**
+ * Exchange OAuth identity for IDP tokens and store in the BA Redis session.
+ *
+ * Call this from the OAuth callback route AFTER better-auth has processed the
+ * callback and created the session. Reads the session token from the Set-Cookie
+ * header of the response to find the BA Redis key.
+ *
+ * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ */
+export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider?: string): Promise<boolean>;

package/dist/auth/better-auth.js

@@ -16,6 +16,7 @@ exports.createBetterAuthInstance = createBetterAuthInstance;
 exports.isBetterAuthEnabled = isBetterAuthEnabled;
 exports.getBetterAuthInstance = getBetterAuthInstance;
 exports.getBetterAuthHandler = getBetterAuthHandler;
+exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 require("server-only");
 const better_auth_1 = require("better-auth");
 const next_js_1 = require("better-auth/next-js");
@@ -103,90 +104,6 @@ function createBetterAuthInstance(idpConfig) {
                 refreshCache: false,
             },
         },
-        // After social login, exchange Google identity for IDP tokens and store in Redis
-        databaseHooks: {
-            session: {
-                create: {
-                    after: async (session) => {
-                        try {
-                            const userId = session.userId;
-                            const token = session.token;
-                            if (!userId || !token)
-                                return;
-                            // Look up user from Better Auth's memory/DB to get email
-                            // The user was just created/found by Better Auth during OAuth
-                            const baKey = `ba:${appSlug}:${token}`;
-                            const baRaw = await (0, redis_1.getRedis)().get(baKey).catch(() => null);
-                            const baData = baRaw ? JSON.parse(baRaw) : null;
-                            const email = baData?.user?.email;
-                            const name = baData?.user?.name;
-                            const image = baData?.user?.image;
-                            if (!email) {
-                                console.warn('[BETTER_AUTH] Session created but no email found for IDP token exchange');
-                                return;
-                            }
-                            // Call IDP oauth-callback to get IDP tokens
-                            const idpUrl = process.env.IDP_URL || '';
-                            if (!idpUrl) {
-                                console.warn('[BETTER_AUTH] No IDP URL configured, skipping token exchange');
-                                return;
-                            }
-                            const oauthRes = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
-                                method: 'POST',
-                                headers: { 'Content-Type': 'application/json' },
-                                body: JSON.stringify({
-                                    provider: 'google',
-                                    provider_account_id: userId,
-                                    email,
-                                    name,
-                                    image,
-                                    client_id: idpConfig.clientSlug || String(idpConfig.clientId),
-                                }),
-                            });
-                            const oauthResText = await oauthRes.text();
-                            console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
-                            if (!oauthRes.ok) {
-                                console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
-                                return;
-                            }
-                            let idpData;
-                            try {
-                                idpData = JSON.parse(oauthResText);
-                            }
-                            catch {
-                                return;
-                            }
-                            const result = idpData?.data?.result || idpData?.data || idpData;
-                            if (!result?.access_token) {
-                                console.warn('[BETTER_AUTH] IDP oauth-callback returned no access_token. Keys:', Object.keys(result || {}));
-                                return;
-                            }
-                            // Store IDP tokens in the BA Redis session
-                            if (baData) {
-                                const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
-                                baData.idpTokens = {
-                                    idpAccessToken: result.access_token,
-                                    idpRefreshToken: result.refresh_token,
-                                    idpAccessTokenExpires: result.expires_in
-                                        ? Date.now() + result.expires_in * 1000
-                                        : Date.now() + 15 * 60 * 1000,
-                                    userId: String(result.user?.user_id || result.user?.id || result.user_id || userId),
-                                    email: result.user?.email || result.email || email,
-                                    name: result.user?.full_name || result.user?.name || result.name || name,
-                                    roles: result.user?.roles || result.roles || [],
-                                    mfaVerified: !requiresTwoFactor,
-                                };
-                                await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
-                                console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
-                            }
-                        }
-                        catch (err) {
-                            console.error('[BETTER_AUTH] Post-login IDP exchange failed:', err instanceof Error ? err.message : String(err));
-                        }
-                    },
-                },
-            },
-        },
         // Cookie prefix must match slim-middleware expectations ({slug}.session-token)
         advanced: {
             cookiePrefix: appSlug,
@@ -251,3 +168,92 @@ async function getBetterAuthHandler() {
     const auth = await getBetterAuthInstance();
     return (0, next_js_2.toNextJsHandler)(auth);
 }
+/**
+ * Exchange OAuth identity for IDP tokens and store in the BA Redis session.
+ *
+ * Call this from the OAuth callback route AFTER better-auth has processed the
+ * callback and created the session. Reads the session token from the Set-Cookie
+ * header of the response to find the BA Redis key.
+ *
+ * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ */
+async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
+    try {
+        const config = await (0, idp_client_config_1.getIDPClientConfig)();
+        const appSlug = config.clientSlug || (0, app_slug_1.getAppSlug)();
+        const baKey = `ba:${appSlug}:${sessionToken}`;
+        // Read the BA session from Redis
+        const baRaw = await (0, redis_1.getRedis)().get(baKey).catch(() => null);
+        if (!baRaw) {
+            console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: session not found in Redis for token', sessionToken.substring(0, 10));
+            return false;
+        }
+        const baData = JSON.parse(baRaw);
+        const email = baData?.user?.email;
+        const name = baData?.user?.name;
+        const image = baData?.user?.image;
+        const baUserId = baData?.session?.userId || baData?.user?.id;
+        if (!email) {
+            console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: no email in session');
+            return false;
+        }
+        // Call IDP oauth-callback
+        const idpUrl = process.env.IDP_URL || '';
+        if (!idpUrl) {
+            console.warn('[BETTER_AUTH] No IDP_URL configured, skipping token exchange');
+            return false;
+        }
+        console.log('[BETTER_AUTH] Exchanging OAuth identity for IDP tokens:', email);
+        const oauthRes = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                provider,
+                provider_account_id: baUserId,
+                email,
+                name,
+                image,
+                client_id: config.clientSlug || String(config.clientId),
+            }),
+        });
+        const oauthResText = await oauthRes.text();
+        console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
+        if (!oauthRes.ok) {
+            console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
+            return false;
+        }
+        let idpData;
+        try {
+            idpData = JSON.parse(oauthResText);
+        }
+        catch {
+            return false;
+        }
+        const result = idpData?.data?.result || idpData?.data || idpData;
+        if (!result?.access_token) {
+            console.warn('[BETTER_AUTH] IDP oauth-callback returned no access_token. Keys:', Object.keys(result || {}));
+            return false;
+        }
+        // Store IDP tokens in the BA Redis session
+        const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
+        baData.idpTokens = {
+            idpAccessToken: result.access_token,
+            idpRefreshToken: result.refresh_token,
+            idpAccessTokenExpires: result.expires_in
+                ? Date.now() + result.expires_in * 1000
+                : Date.now() + 15 * 60 * 1000,
+            userId: String(result.user?.user_id || result.user?.id || result.user_id || baUserId),
+            email: result.user?.email || result.email || email,
+            name: result.user?.full_name || result.user?.name || result.name || name,
+            roles: result.user?.roles || result.roles || [],
+            mfaVerified: !requiresTwoFactor,
+        };
+        await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
+        console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
+        return true;
+    }
+    catch (err) {
+        console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+        return false;
+    }
+}

package/dist/server/auth.d.ts

@@ -28,13 +28,6 @@ export declare function getAuthInstance(): Promise<import("better-auth/types").A
             refreshCache: false;
         };
     };
-    databaseHooks: {
-        session: {
-            create: {
-                after: (session: any) => Promise<void>;
-            };
-        };
-    };
     advanced: {
         cookiePrefix: string;
         cookies: {

package/dist/server/decode-session.js

@@ -91,7 +91,7 @@ async function tryBetterAuthSession(requestCookies) {
         if (!result?.session || !result?.user) {
             return null;
         }
-        // Read IDP tokens from BA Redis session (stored by post-login hook)
+        // Read IDP tokens from BA Redis session (stored by callback route after OAuth)
         let idpTokens = null;
         try {
             const { getRedis } = await Promise.resolve().then(() => __importStar(require('../lib/redis')));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.0.24",
+  "version": "4.0.26",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -112,93 +112,6 @@ export function createBetterAuthInstance(idpConfig: IDPClientConfig) {
       },
     },
 
-    // After social login, exchange Google identity for IDP tokens and store in Redis
-    databaseHooks: {
-      session: {
-        create: {
-          after: async (session: any) => {
-            try {
-              const userId = session.userId;
-              const token = session.token;
-              if (!userId || !token) return;
-
-              // Look up user from Better Auth's memory/DB to get email
-              // The user was just created/found by Better Auth during OAuth
-              const baKey = `ba:${appSlug}:${token}`;
-              const baRaw = await getRedis().get(baKey).catch(() => null);
-              const baData = baRaw ? JSON.parse(baRaw) : null;
-              const email = baData?.user?.email;
-              const name = baData?.user?.name;
-              const image = baData?.user?.image;
-
-              if (!email) {
-                console.warn('[BETTER_AUTH] Session created but no email found for IDP token exchange');
-                return;
-              }
-
-              // Call IDP oauth-callback to get IDP tokens
-              const idpUrl = process.env.IDP_URL || '';
-              if (!idpUrl) {
-                console.warn('[BETTER_AUTH] No IDP URL configured, skipping token exchange');
-                return;
-              }
-
-              const oauthRes = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                  provider: 'google',
-                  provider_account_id: userId,
-                  email,
-                  name,
-                  image,
-                  client_id: idpConfig.clientSlug || String(idpConfig.clientId),
-                }),
-              });
-
-              const oauthResText = await oauthRes.text();
-              console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
-
-              if (!oauthRes.ok) {
-                console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
-                return;
-              }
-
-              let idpData: any;
-              try { idpData = JSON.parse(oauthResText); } catch { return; }
-              const result = idpData?.data?.result || idpData?.data || idpData;
-
-              if (!result?.access_token) {
-                console.warn('[BETTER_AUTH] IDP oauth-callback returned no access_token. Keys:', Object.keys(result || {}));
-                return;
-              }
-
-              // Store IDP tokens in the BA Redis session
-              if (baData) {
-                const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
-                baData.idpTokens = {
-                  idpAccessToken: result.access_token,
-                  idpRefreshToken: result.refresh_token,
-                  idpAccessTokenExpires: result.expires_in
-                    ? Date.now() + result.expires_in * 1000
-                    : Date.now() + 15 * 60 * 1000,
-                  userId: String(result.user?.user_id || result.user?.id || result.user_id || userId),
-                  email: result.user?.email || result.email || email,
-                  name: result.user?.full_name || result.user?.name || result.name || name,
-                  roles: result.user?.roles || result.roles || [],
-                  mfaVerified: !requiresTwoFactor,
-                };
-                await getRedis().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
-                console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
-              }
-            } catch (err) {
-              console.error('[BETTER_AUTH] Post-login IDP exchange failed:', err instanceof Error ? err.message : String(err));
-            }
-          },
-        },
-      },
-    },
-
     // Cookie prefix must match slim-middleware expectations ({slug}.session-token)
     advanced: {
       cookiePrefix: appSlug,
@@ -272,3 +185,101 @@ export async function getBetterAuthHandler(): Promise<{ GET: (req: Request) => P
   const auth = await getBetterAuthInstance();
   return toNextJsHandler(auth);
 }
+
+/**
+ * Exchange OAuth identity for IDP tokens and store in the BA Redis session.
+ *
+ * Call this from the OAuth callback route AFTER better-auth has processed the
+ * callback and created the session. Reads the session token from the Set-Cookie
+ * header of the response to find the BA Redis key.
+ *
+ * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ */
+export async function exchangeOAuthForIdpTokens(
+  sessionToken: string,
+  provider: string = 'google'
+): Promise<boolean> {
+  try {
+    const config = await getIDPClientConfig();
+    const appSlug = config.clientSlug || getAppSlug();
+    const baKey = `ba:${appSlug}:${sessionToken}`;
+
+    // Read the BA session from Redis
+    const baRaw = await getRedis().get(baKey).catch(() => null);
+    if (!baRaw) {
+      console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: session not found in Redis for token', sessionToken.substring(0, 10));
+      return false;
+    }
+
+    const baData = JSON.parse(baRaw);
+    const email = baData?.user?.email;
+    const name = baData?.user?.name;
+    const image = baData?.user?.image;
+    const baUserId = baData?.session?.userId || baData?.user?.id;
+
+    if (!email) {
+      console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: no email in session');
+      return false;
+    }
+
+    // Call IDP oauth-callback
+    const idpUrl = process.env.IDP_URL || '';
+    if (!idpUrl) {
+      console.warn('[BETTER_AUTH] No IDP_URL configured, skipping token exchange');
+      return false;
+    }
+
+    console.log('[BETTER_AUTH] Exchanging OAuth identity for IDP tokens:', email);
+
+    const oauthRes = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        provider,
+        provider_account_id: baUserId,
+        email,
+        name,
+        image,
+        client_id: config.clientSlug || String(config.clientId),
+      }),
+    });
+
+    const oauthResText = await oauthRes.text();
+    console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
+
+    if (!oauthRes.ok) {
+      console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
+      return false;
+    }
+
+    let idpData: any;
+    try { idpData = JSON.parse(oauthResText); } catch { return false; }
+    const result = idpData?.data?.result || idpData?.data || idpData;
+
+    if (!result?.access_token) {
+      console.warn('[BETTER_AUTH] IDP oauth-callback returned no access_token. Keys:', Object.keys(result || {}));
+      return false;
+    }
+
+    // Store IDP tokens in the BA Redis session
+    const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
+    baData.idpTokens = {
+      idpAccessToken: result.access_token,
+      idpRefreshToken: result.refresh_token,
+      idpAccessTokenExpires: result.expires_in
+        ? Date.now() + result.expires_in * 1000
+        : Date.now() + 15 * 60 * 1000,
+      userId: String(result.user?.user_id || result.user?.id || result.user_id || baUserId),
+      email: result.user?.email || result.email || email,
+      name: result.user?.full_name || result.user?.name || result.name || name,
+      roles: result.user?.roles || result.roles || [],
+      mfaVerified: !requiresTwoFactor,
+    };
+    await getRedis().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
+    console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
+    return true;
+  } catch (err) {
+    console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+    return false;
+  }
+}

package/src/server/decode-session.ts

@@ -66,7 +66,7 @@ async function tryBetterAuthSession(
       return null;
     }
 
-    // Read IDP tokens from BA Redis session (stored by post-login hook)
+    // Read IDP tokens from BA Redis session (stored by callback route after OAuth)
     let idpTokens: any = null;
     try {
       const { getRedis } = await import('../lib/redis');