@protobase/server 0.5.0 → 0.7.0

package/dist/better-auth/platform-sign-in.js

@@ -0,0 +1,88 @@
+import { decodeJwt } from "jose";
+//#region src/better-auth/platform-sign-in.ts
+const signInIssuerVariable = "PROTOBASE_SIGN_IN_ISSUER";
+const signInClientIdVariable = "PROTOBASE_SIGN_IN_CLIENT_ID";
+const signInClientSecretVariable = "PROTOBASE_SIGN_IN_CLIENT_SECRET";
+const signInProviderVariable = "PROTOBASE_SIGN_IN_PROVIDER";
+const signInNameVariable = "PROTOBASE_SIGN_IN_NAME";
+/**
+* The provider the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID` and
+* `PROTOBASE_SIGN_IN_CLIENT_SECRET` (with `PROTOBASE_SIGN_IN_PROVIDER` and `PROTOBASE_SIGN_IN_NAME` optional);
+* `undefined` when none of the three is set. Some but not all of them stops the server at startup.
+*/
+const readPlatformSignIn = (env) => {
+	const required = [
+		signInIssuerVariable,
+		signInClientIdVariable,
+		signInClientSecretVariable
+	];
+	const [issuer, clientId, clientSecret] = required.map((name) => env[name]?.trim() || void 0);
+	if (!issuer && !clientId && !clientSecret) return void 0;
+	if (!issuer || !clientId || !clientSecret) throw new Error(`${required.join(", ")} go together: set all three for the platform sign-in provider, or none`);
+	const provider = env[signInProviderVariable]?.trim();
+	const name = env[signInNameVariable]?.trim();
+	return {
+		issuer,
+		clientId,
+		clientSecret,
+		...provider && { provider },
+		...name && { name }
+	};
+};
+const providerId = /^[a-z][a-z0-9-]*$/;
+/** The provider with its defaults filled in; an issuer that is not a URL or a malformed id is an error. */
+const resolvePlatformSignIn = (signIn) => {
+	if (!URL.canParse(signIn.issuer)) throw new Error(`The platform sign-in provider's issuer must be a URL, not "${signIn.issuer}"`);
+	const provider = signIn.provider ?? "oidc";
+	if (!providerId.test(provider)) throw new Error(`Invalid sign-in provider id "${provider}": use lowercase letters, digits or "-"`);
+	return {
+		...signIn,
+		provider,
+		name: signIn.name ?? (provider === "github" ? "GitHub" : "SSO"),
+		scopes: signIn.scopes ?? []
+	};
+};
+/** The platform provider, unless the app configures a provider of its own with the same id, which then wins. */
+const platformSignInFor = (signIn, socialProviders) => signIn && !socialProviders.includes(signIn.provider) ? signIn : void 0;
+/**
+* The person as an ID token Better Auth already verified (the provider's keys, this client and the nonce) says, once
+* its issuer is the configured one; `null` without an ID token, so nothing comes from an unverified source.
+*/
+const idTokenUser = (idToken, issuer) => {
+	if (!idToken) return null;
+	const claims = decodeJwt(idToken);
+	if (claims.iss !== issuer || typeof claims.sub !== "string" || !claims.sub || typeof claims.email !== "string") return null;
+	return {
+		id: claims.sub,
+		sub: claims.sub,
+		email: claims.email,
+		emailVerified: claims.email_verified === true,
+		name: typeof claims.name === "string" && claims.name ? claims.name : claims.email.split("@")[0],
+		...typeof claims.picture === "string" && { image: claims.picture }
+	};
+};
+/**
+* The provider for Better Auth's generic OAuth plugin: discovery, PKCE, the client secret in a Basic header, an ID
+* token that must verify against the provider's keys, and no sign-up. A provider whose settings cannot be read at
+* startup is left out until the next start.
+*/
+const platformSignInProvider = (signIn) => ({
+	providerId: signIn.provider,
+	name: signIn.name,
+	clientId: signIn.clientId,
+	clientSecret: signIn.clientSecret,
+	discoveryUrl: `${signIn.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
+	scopes: [
+		"openid",
+		"email",
+		"profile",
+		...signIn.scopes
+	],
+	pkce: true,
+	requireIdTokenVerification: true,
+	authentication: "basic",
+	disableSignUp: true,
+	getUserInfo: async (tokens) => idTokenUser(tokens.idToken, signIn.issuer)
+});
+//#endregion
+export { idTokenUser, platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn, signInClientIdVariable, signInClientSecretVariable, signInIssuerVariable, signInNameVariable, signInProviderVariable };

package/dist/better-auth/policy-plugin.js

@@ -36,8 +36,9 @@ const refuse = (status, refusal) => new APIError(status, refusal);
 * applies it to Better Auth's own endpoints. A method the policy turns off answers `403 SIGN_IN_METHOD_FORBIDDEN`;
 * someone without what it requires gets a session, so they can set it up, but no API token (`403 SIGN_IN_SETUP_REQUIRED`).
 */
-const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
+const signInPolicyPlugin = ({ mail, socialProviders, operator, platformSignIn }) => {
 	const currentPolicy = async (context) => effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail });
+	const providersUnder = (policy) => [...socialProviders, ...platformSignIn && policy.platformSignIn === "allowed" ? [platformSignIn.provider] : []];
 	const policyAdmin = adminOnly("Only an admin can change how people sign in.");
 	const policyAnswer = async (context) => {
 		const stored = await readSignInPolicy(context.adapter);
@@ -47,6 +48,7 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 			effective: effectiveSignInPolicy(stored.policy, { mail }),
 			mail,
 			...operator && { operator },
+			...platformSignIn && { platformSignIn: platformSignIn.name },
 			...stored.savedAt && { savedAt: stored.savedAt },
 			...savedBy && { savedBy }
 		};
@@ -72,9 +74,10 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 					message: "Choose one of the offered rules for every sign-in method."
 				});
 				const user = ctx.context.session.user;
+				const admin = await accountMethods(ctx.context, user, providersUnder(effectiveSignInPolicy(policy, { mail })));
 				const problem = signInPolicyProblem(policy, {
 					mail,
-					admin: await accountMethods(ctx.context, user, socialProviders)
+					admin
 				});
 				if (problem) throw refuse("BAD_REQUEST", {
 					code: "SIGN_IN_POLICY_REFUSED",
@@ -92,7 +95,7 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 				use: [sessionMiddleware]
 			}, async (ctx) => {
 				const policy = await currentPolicy(ctx.context);
-				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, socialProviders);
+				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, providersUnder(policy));
 				return ctx.json({
 					policy,
 					mail,
@@ -112,14 +115,16 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 				const policy = await currentPolicy(ctx.context);
 				const refusal = policyRefusal(policy, {
 					path,
-					body: ctx.body
+					body: ctx.body,
+					params: ctx.params,
+					...platformSignIn && { platformProvider: platformSignIn.provider }
 				});
 				if (refusal) throw refuse("FORBIDDEN", refusal);
 				if (path === "/sign-in/email-otp") return vouchForCreatedAccount(ctx.context, ctx.body.email);
 				if (!(path === "/token" && (policy.twoFactor === "required" || policy.passkey === "required") || path === "/passkey/delete-passkey" && policy.passkey === "required")) return;
 				const session = await getSessionFromCtx(ctx);
 				if (!session || isStaffSession(session.session)) return;
-				const account = await accountMethods(ctx.context, session.user, socialProviders);
+				const account = await accountMethods(ctx.context, session.user, providersUnder(policy));
 				if (path === "/token" && missingRequiredMethods(policy, account).length > 0) throw refuse("FORBIDDEN", setupRequired);
 				if (path === "/passkey/delete-passkey" && account.passkeys <= 1) throw refuse("FORBIDDEN", lastPasskeyRequired);
 			})

package/dist/better-auth/policy-store.js

@@ -2,37 +2,51 @@ import { defaultSignInPolicy, parseSignInPolicy } from "./sign-in-policy.js";
 //#region src/better-auth/policy-store.ts
 /** Better Auth's model for the sign-in policy: one row per save, the newest applies, the older ones are its history. */
 const signInPolicyModel = "signInPolicy";
-const signInPolicySchema = { [signInPolicyModel]: { fields: {
-	password: {
-		type: "string",
-		required: true
-	},
-	emailCode: {
-		type: "string",
-		required: true
-	},
-	passkey: {
-		type: "string",
-		required: true
-	},
-	twoFactor: {
-		type: "string",
-		required: true
-	},
-	staffAccess: {
-		type: "string",
-		required: true,
-		defaultValue: "allowed"
-	},
-	createdAt: {
-		type: "date",
-		required: true
-	},
-	createdBy: {
-		type: "string",
-		required: false
+const signInPolicySchema = { [signInPolicyModel]: {
+	modelName: "sign_in_policy",
+	fields: {
+		password: {
+			type: "string",
+			required: true
+		},
+		emailCode: {
+			type: "string",
+			required: true,
+			fieldName: "email_code"
+		},
+		passkey: {
+			type: "string",
+			required: true
+		},
+		twoFactor: {
+			type: "string",
+			required: true,
+			fieldName: "two_factor"
+		},
+		staffAccess: {
+			type: "string",
+			required: true,
+			defaultValue: "allowed",
+			fieldName: "staff_access"
+		},
+		platformSignIn: {
+			type: "string",
+			required: true,
+			defaultValue: "allowed",
+			fieldName: "platform_sign_in"
+		},
+		createdAt: {
+			type: "date",
+			required: true,
+			fieldName: "created_at"
+		},
+		createdBy: {
+			type: "string",
+			required: false,
+			fieldName: "created_by"
+		}
 	}
-} } };
+} };
 /** The newest saved policy, or the default when none was saved. A row that no longer parses counts as none. */
 const readSignInPolicy = async (adapter) => {
 	const [row] = await adapter.findMany({

package/dist/better-auth/sign-in-enforcement.js

@@ -13,6 +13,8 @@ const passkeyPaths = [
 	"/passkey/verify-registration"
 ];
 const staffSignInPath = "/staff/sign-in";
+const providerPaths = ["/sign-in/social", "/link-social"];
+const callbackPath = "/callback/:id";
 const accountPaths = [
 	"/email-otp/send-verification-otp",
 	"/passkey/delete-passkey",
@@ -26,23 +28,29 @@ const isPoliced = (path) => path !== void 0 && ([
 	...emailCodePaths,
 	...passkeyPaths,
 	...accountPaths,
+	...providerPaths,
+	callbackPath,
 	"/staff/sign-in"
 ].includes(path) || path.startsWith("/reset-password/"));
-const methodOf = (path, body) => {
+const providerOf = ({ path, body, params }) => providerPaths.includes(path) ? body?.provider : path === callbackPath ? params?.id : void 0;
+const methodOf = (request) => {
+	const { path, body } = request;
 	if (passwordPaths.includes(path) || path.startsWith("/reset-password/")) return "password";
 	if (emailCodePaths.includes(path)) return "emailCode";
 	if (path === "/email-otp/send-verification-otp" && body?.type === "sign-in") return "emailCode";
 	if (passkeyPaths.includes(path)) return "passkey";
 	if (path === "/two-factor/enable") return "twoFactor";
 	if (path === "/staff/sign-in") return "staffAccess";
+	if (request.platformProvider !== void 0 && providerOf(request) === request.platformProvider) return "platformSignIn";
 };
 /**
 * Why the policy refuses a request to Better Auth at `path`, or `undefined` when it lets it through: a method the
 * policy turns off, or turning off two-factor authentication while the policy requires it. Removing the last passkey
 * while passkeys are required depends on the account, so the plugin checks that itself.
 */
-const policyRefusal = (policy, { path, body }) => {
-	const method = methodOf(path, body);
+const policyRefusal = (policy, request) => {
+	const { path } = request;
+	const method = methodOf(request);
 	if (method && policy[method] === "forbidden") return {
 		code: "SIGN_IN_METHOD_FORBIDDEN",
 		message: signInPolicyMethods[method].forbidden

package/dist/better-auth/sign-in-policy.d.ts

@@ -7,7 +7,8 @@ export type StaffAccessRule = 'allowed' | 'notify' | 'forbidden';
  * The app's sign-in policy. `password`, `emailCode` and `passkey` are ways to sign in; `twoFactor` is the second step
  * after a password or an emailed code. Only a passkey and two-factor authentication can be required: they are set up
  * once per person, so "required" sends everyone without one to set it up. `staffAccess` is whether the operator's
- * staff may sign in as people, for support.
+ * staff may sign in as people, for support. `platformSignIn` is whether people may sign in through the provider the
+ * platform adds (see `PlatformSignIn`), which the app's developer did not choose.
  */
 export type SignInPolicy = {
   password: 'allowed' | 'forbidden';
@@ -15,6 +16,7 @@ export type SignInPolicy = {
   passkey: SignInRule;
   twoFactor: SignInRule;
   staffAccess: StaffAccessRule;
+  platformSignIn: 'allowed' | 'forbidden';
 };
 /** Each method with the rules it takes, its name, and what the server answers when the policy turns it off. */
 export declare const signInPolicyMethods: {
@@ -43,6 +45,11 @@ export declare const signInPolicyMethods: {
     readonly rules: readonly ["allowed", "notify", "forbidden"];
     readonly forbidden: "Staff sign-in is turned off for this app.";
   };
+  readonly platformSignIn: {
+    readonly label: "Sign-in through the platform";
+    readonly rules: readonly ["allowed", "forbidden"];
+    readonly forbidden: "Signing in through the platform is turned off for this app.";
+  };
 };
 /** Everything allowed and nothing required: the policy of an app whose admins never saved one. */
 export declare const defaultSignInPolicy: SignInPolicy;

package/dist/better-auth/sign-in-policy.js

@@ -37,6 +37,11 @@ const signInPolicyMethods = {
 			"forbidden"
 		],
 		forbidden: "Staff sign-in is turned off for this app."
+	},
+	platformSignIn: {
+		label: "Sign-in through the platform",
+		rules: ["allowed", "forbidden"],
+		forbidden: "Signing in through the platform is turned off for this app."
 	}
 };
 /** Everything allowed and nothing required: the policy of an app whose admins never saved one. */
@@ -45,7 +50,8 @@ const defaultSignInPolicy = {
 	emailCode: "allowed",
 	passkey: "allowed",
 	twoFactor: "allowed",
-	staffAccess: "allowed"
+	staffAccess: "allowed",
+	platformSignIn: "allowed"
 };
 const methodNames = Object.keys(signInPolicyMethods);
 /** A policy from a request body or a stored row; `undefined` when a method is missing or has a rule it does not take. */
@@ -57,13 +63,21 @@ const parseSignInPolicy = (input) => {
 /**
 * The policy as it applies. Emailed codes need mail; without mail, password sign-in is on whatever the policy says, so
 * an app whose mail settings went missing does not lock out everyone who had only emailed codes left. Staff sign-in
-* that emails the person is off without mail, since nobody would be told.
+* that emails the person is off without mail, since nobody would be told. Sign-in through the platform is off while
+* passkeys or two-factor authentication are required: it skips the app's second step, and the provider's own cannot
+* be checked.
 */
-const effectiveSignInPolicy = (policy, { mail }) => mail ? policy : {
-	...policy,
-	password: "allowed",
-	emailCode: "forbidden",
-	...policy.staffAccess === "notify" && { staffAccess: "forbidden" }
+const effectiveSignInPolicy = (policy, { mail }) => {
+	const strict = policy.passkey === "required" || policy.twoFactor === "required";
+	return {
+		...policy,
+		...!mail && {
+			password: "allowed",
+			emailCode: "forbidden"
+		},
+		...!mail && policy.staffAccess === "notify" && { staffAccess: "forbidden" },
+		...strict && { platformSignIn: "forbidden" }
+	};
 };
 /** The required methods `account` has not set up yet, in the order a setup page asks for them. */
 const missingRequiredMethods = (policy, account) => [...policy.twoFactor === "required" && !account.twoFactor ? ["twoFactor"] : [], ...policy.passkey === "required" && account.passkeys === 0 ? ["passkey"] : []];

package/dist/better-auth/snake-case-migration.js

@@ -0,0 +1,122 @@
+//#region src/better-auth/snake-case-migration.ts
+const schemaName = /^[a-z_][a-z0-9_]*$/;
+/**
+* The migration that renames the auth store of Protobase 0.6 in place, from Better Auth's camelCase names to the
+* snake_case ones of `snake-case-names.ts`: tables, columns, and the indexes and constraints named after them. Data,
+* defaults, keys and indexes stay as they are. On a store that has the snake_case names already it does nothing, so a
+* project's migrations can carry it after an auth migration written with them. `schema` is the store's schema, the
+* connection's current one when left out.
+*/
+const snakeCaseMigration = (schema) => {
+	if (schema !== void 0 && !schemaName.test(schema)) throw new Error(`Invalid auth schema name "${schema}"`);
+	const s = schema === void 0 ? "" : `"${schema}".`;
+	const current = schema === void 0 ? "current_schema()" : `'${schema}'`;
+	return `-- Renames the auth store of Protobase 0.6 to snake_case. A store set up with the snake_case names has no "emailVerified"
+-- and is left as it is.
+do $$
+declare
+  constraint_row record;
+begin
+  if not exists (select from information_schema.columns where table_schema = ${current} and table_name = 'user' and column_name = 'emailVerified') then
+    return;
+  end if;
+
+  alter table ${s}"twoFactor" rename to two_factor;
+  alter table ${s}"signInPolicy" rename to sign_in_policy;
+  alter table ${s}"staffSignIn" rename to staff_sign_in;
+
+  alter table ${s}"user" rename column "emailVerified" to email_verified;
+  alter table ${s}"user" rename column "createdAt" to created_at;
+  alter table ${s}"user" rename column "updatedAt" to updated_at;
+  alter table ${s}"user" rename column "banReason" to ban_reason;
+  alter table ${s}"user" rename column "banExpires" to ban_expires;
+  alter table ${s}"user" rename column "twoFactorEnabled" to two_factor_enabled;
+
+  alter table ${s}session rename column "expiresAt" to expires_at;
+  alter table ${s}session rename column "createdAt" to created_at;
+  alter table ${s}session rename column "updatedAt" to updated_at;
+  alter table ${s}session rename column "ipAddress" to ip_address;
+  alter table ${s}session rename column "userAgent" to user_agent;
+  alter table ${s}session rename column "userId" to user_id;
+  alter table ${s}session rename column "impersonatedBy" to impersonated_by;
+
+  alter table ${s}account rename column "accountId" to account_id;
+  alter table ${s}account rename column "providerId" to provider_id;
+  alter table ${s}account rename column "userId" to user_id;
+  alter table ${s}account rename column "accessToken" to access_token;
+  alter table ${s}account rename column "refreshToken" to refresh_token;
+  alter table ${s}account rename column "idToken" to id_token;
+  alter table ${s}account rename column "accessTokenExpiresAt" to access_token_expires_at;
+  alter table ${s}account rename column "refreshTokenExpiresAt" to refresh_token_expires_at;
+  alter table ${s}account rename column "createdAt" to created_at;
+  alter table ${s}account rename column "updatedAt" to updated_at;
+
+  alter table ${s}verification rename column "expiresAt" to expires_at;
+  alter table ${s}verification rename column "createdAt" to created_at;
+  alter table ${s}verification rename column "updatedAt" to updated_at;
+
+  alter table ${s}jwks rename column "publicKey" to public_key;
+  alter table ${s}jwks rename column "privateKey" to private_key;
+  alter table ${s}jwks rename column "createdAt" to created_at;
+  alter table ${s}jwks rename column "expiresAt" to expires_at;
+
+  alter table ${s}two_factor rename column "backupCodes" to backup_codes;
+  alter table ${s}two_factor rename column "userId" to user_id;
+  alter table ${s}two_factor rename column "failedVerificationCount" to failed_verification_count;
+  alter table ${s}two_factor rename column "lockedUntil" to locked_until;
+
+  alter table ${s}passkey rename column "publicKey" to public_key;
+  alter table ${s}passkey rename column "userId" to user_id;
+  alter table ${s}passkey rename column "credentialID" to credential_id;
+  alter table ${s}passkey rename column "deviceType" to device_type;
+  alter table ${s}passkey rename column "backedUp" to backed_up;
+  alter table ${s}passkey rename column "createdAt" to created_at;
+
+  alter table ${s}sign_in_policy rename column "emailCode" to email_code;
+  alter table ${s}sign_in_policy rename column "twoFactor" to two_factor;
+  alter table ${s}sign_in_policy rename column "staffAccess" to staff_access;
+  alter table ${s}sign_in_policy rename column "platformSignIn" to platform_sign_in;
+  alter table ${s}sign_in_policy rename column "createdAt" to created_at;
+  alter table ${s}sign_in_policy rename column "createdBy" to created_by;
+
+  alter table ${s}staff_sign_in rename column "userId" to user_id;
+  alter table ${s}staff_sign_in rename column "userEmail" to user_email;
+  alter table ${s}staff_sign_in rename column "staffName" to staff_name;
+  alter table ${s}staff_sign_in rename column "staffSubject" to staff_subject;
+  alter table ${s}staff_sign_in rename column "sessionId" to session_id;
+  alter table ${s}staff_sign_in rename column "startedAt" to started_at;
+  alter table ${s}staff_sign_in rename column "expiresAt" to expires_at;
+  alter table ${s}staff_sign_in rename column "endedAt" to ended_at;
+
+  -- A primary key's index takes the new name with it.
+  alter table ${s}two_factor rename constraint "twoFactor_pkey" to two_factor_pkey;
+  alter table ${s}sign_in_policy rename constraint "signInPolicy_pkey" to sign_in_policy_pkey;
+  alter table ${s}staff_sign_in rename constraint "staffSignIn_pkey" to staff_sign_in_pkey;
+  alter table ${s}session rename constraint "session_userId_fkey" to session_user_id_fkey;
+  alter table ${s}account rename constraint "account_userId_fkey" to account_user_id_fkey;
+  alter table ${s}two_factor rename constraint "twoFactor_userId_fkey" to two_factor_user_id_fkey;
+  alter table ${s}passkey rename constraint "passkey_userId_fkey" to passkey_user_id_fkey;
+
+  alter index ${s}"session_userId_idx" rename to session_user_id_idx;
+  alter index ${s}"account_userId_idx" rename to account_user_id_idx;
+  alter index ${s}"twoFactor_secret_idx" rename to two_factor_secret_idx;
+  alter index ${s}"twoFactor_userId_idx" rename to two_factor_user_id_idx;
+  alter index ${s}"passkey_userId_idx" rename to passkey_user_id_idx;
+  alter index ${s}"passkey_credentialID_idx" rename to passkey_credential_id_idx;
+
+  -- Postgres 18 names each not-null constraint after its table and column, as "user_emailVerified_not_null"; earlier
+  -- versions keep no such constraints, so there is nothing to rename there.
+  for constraint_row in
+    select c.conrelid::regclass as table_name, c.conname as old_name, t.relname || '_' || a.attname || '_not_null' as new_name
+    from pg_constraint c
+    join pg_class t on t.oid = c.conrelid
+    join pg_attribute a on a.attrelid = c.conrelid and a.attnum = c.conkey[1]
+    where c.contype = 'n' and t.relnamespace = (select oid from pg_namespace where nspname = ${current}) and c.conname ~ '[A-Z]'
+  loop
+    execute format('alter table %s rename constraint %I to %I', constraint_row.table_name, constraint_row.old_name, constraint_row.new_name);
+  end loop;
+end
+$$;`;
+};
+//#endregion
+export { snakeCaseMigration };

package/dist/better-auth/snake-case-names.js

@@ -0,0 +1,72 @@
+//#region src/better-auth/snake-case-names.ts
+/** Better Auth's own tables, as its `user`, `session`, `account` and `verification` options name them. */
+const coreNames = {
+	user: { fields: {
+		emailVerified: "email_verified",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} },
+	session: { fields: {
+		expiresAt: "expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at",
+		ipAddress: "ip_address",
+		userAgent: "user_agent",
+		userId: "user_id"
+	} },
+	account: { fields: {
+		accountId: "account_id",
+		providerId: "provider_id",
+		userId: "user_id",
+		accessToken: "access_token",
+		refreshToken: "refresh_token",
+		idToken: "id_token",
+		accessTokenExpiresAt: "access_token_expires_at",
+		refreshTokenExpiresAt: "refresh_token_expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} },
+	verification: { fields: {
+		expiresAt: "expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} }
+};
+/** The `schema` option of each plugin with tables or columns of its own. */
+const pluginNames = {
+	admin: {
+		user: { fields: {
+			banReason: "ban_reason",
+			banExpires: "ban_expires"
+		} },
+		session: { fields: { impersonatedBy: "impersonated_by" } }
+	},
+	jwt: { jwks: { fields: {
+		publicKey: "public_key",
+		privateKey: "private_key",
+		createdAt: "created_at",
+		expiresAt: "expires_at"
+	} } },
+	twoFactor: {
+		user: { fields: { twoFactorEnabled: "two_factor_enabled" } },
+		twoFactor: {
+			modelName: "two_factor",
+			fields: {
+				backupCodes: "backup_codes",
+				userId: "user_id",
+				failedVerificationCount: "failed_verification_count",
+				lockedUntil: "locked_until"
+			}
+		}
+	},
+	passkey: { passkey: { fields: {
+		publicKey: "public_key",
+		userId: "user_id",
+		credentialID: "credential_id",
+		deviceType: "device_type",
+		backedUp: "backed_up",
+		createdAt: "created_at"
+	} } }
+};
+//#endregion
+export { coreNames, pluginNames };

package/dist/better-auth/staff-log.js

@@ -1,52 +1,63 @@
 //#region src/better-auth/staff-log.ts
 /** Better Auth's model for the log of staff sign-ins: one row per session staff started as someone. */
 const staffSignInModel = "staffSignIn";
-const staffSignInSchema = { [staffSignInModel]: { fields: {
-	userId: {
-		type: "string",
-		required: true
-	},
-	userEmail: {
-		type: "string",
-		required: true
-	},
-	staff: {
-		type: "string",
-		required: true
-	},
-	staffName: {
-		type: "string",
-		required: false
-	},
-	staffSubject: {
-		type: "string",
-		required: true
-	},
-	issuer: {
-		type: "string",
-		required: true
-	},
-	reason: {
-		type: "string",
-		required: true
-	},
-	sessionId: {
-		type: "string",
-		required: true
-	},
-	startedAt: {
-		type: "date",
-		required: true
-	},
-	expiresAt: {
-		type: "date",
-		required: true
-	},
-	endedAt: {
-		type: "date",
-		required: false
+const staffSignInSchema = { [staffSignInModel]: {
+	modelName: "staff_sign_in",
+	fields: {
+		userId: {
+			type: "string",
+			required: true,
+			fieldName: "user_id"
+		},
+		userEmail: {
+			type: "string",
+			required: true,
+			fieldName: "user_email"
+		},
+		staff: {
+			type: "string",
+			required: true
+		},
+		staffName: {
+			type: "string",
+			required: false,
+			fieldName: "staff_name"
+		},
+		staffSubject: {
+			type: "string",
+			required: true,
+			fieldName: "staff_subject"
+		},
+		issuer: {
+			type: "string",
+			required: true
+		},
+		reason: {
+			type: "string",
+			required: true
+		},
+		sessionId: {
+			type: "string",
+			required: true,
+			fieldName: "session_id"
+		},
+		startedAt: {
+			type: "date",
+			required: true,
+			fieldName: "started_at"
+		},
+		expiresAt: {
+			type: "date",
+			required: true,
+			fieldName: "expires_at"
+		},
+		endedAt: {
+			type: "date",
+			required: false,
+			fieldName: "ended_at"
+		}
 	}
-} } };
+} };
 const entry = (row) => ({
 	id: row.id,
 	user: row.userEmail,