@protobase/server 0.6.0 → 0.8.0

package/dist/better-auth/organizations/organization-plugin.js

@@ -0,0 +1,128 @@
+import "./role-definitions.js";
+import { checkAppRoleChange, effectiveRoles, globalRoles, parseAppRoles } from "./app-roles.js";
+import { findMember } from "./store.js";
+import { invitationEmail } from "./invitation-mail.js";
+import { invitationLink, invitationToken } from "./invitation-token.js";
+import { APIError } from "better-auth/api";
+import { organization } from "better-auth/plugins/organization";
+//#region src/better-auth/organizations/organization-plugin.ts
+/** The snake_case names of the organization plugin's tables and columns, with the app roles of members and invitations. */
+const organizationNames = {
+	organization: { fields: { createdAt: "created_at" } },
+	member: {
+		fields: {
+			organizationId: "organization_id",
+			userId: "user_id",
+			createdAt: "created_at"
+		},
+		additionalFields: { appRoles: {
+			type: "string[]",
+			required: false,
+			defaultValue: [],
+			input: false,
+			fieldName: "app_roles"
+		} }
+	},
+	invitation: {
+		fields: {
+			organizationId: "organization_id",
+			inviterId: "inviter_id",
+			expiresAt: "expires_at",
+			createdAt: "created_at"
+		},
+		additionalFields: { appRoles: {
+			type: "string[]",
+			required: false,
+			defaultValue: [],
+			input: true,
+			fieldName: "app_roles"
+		} }
+	},
+	session: { fields: { activeOrganizationId: "active_organization_id" } }
+};
+/** Runs Protobase's hook, then the project's, with the same data; data either returns is merged, the project's last. */
+const mergeHooks = (own, project = {}) => {
+	const keys = /* @__PURE__ */ new Set([...Object.keys(own), ...Object.keys(project)]);
+	return Object.fromEntries([...keys].map((key) => {
+		const first = own[key];
+		const second = project[key];
+		if (!first || !second) return [key, first ?? second];
+		const both = async (...args) => {
+			const data = {
+				...(await first(...args))?.data,
+				...(await second(...args))?.data
+			};
+			return Object.keys(data).length > 0 ? { data } : void 0;
+		};
+		return [key, both];
+	}));
+};
+/**
+* Better Auth's organization plugin as Protobase uses it: organization roles `owner`, `admin` and `member` with Better
+* Auth's own access control, app roles on members and invitations, ids from `generateId`, creators holding
+* `creatorAppRoles`, invitations checked against what the inviter may give and mailed with a signed link, and the
+* project's hooks after Protobase's.
+*/
+const organizationPlugin = ({ resolved, secret, mailer, context }) => {
+	const { definitions } = resolved;
+	const own = {
+		beforeCreateOrganization: async () => ({ data: { id: await resolved.generateId() } }),
+		beforeAddMember: async ({ member }) => member.role === "owner" && member.appRoles === void 0 ? { data: { appRoles: resolved.creatorAppRoles } } : void 0,
+		afterCreateOrganization: async ({ organization, member }) => {
+			await resolved.options.onCreated?.({
+				organization,
+				member: {
+					...member,
+					appRoles: parseAppRoles(member.appRoles)
+				}
+			});
+		},
+		beforeCreateInvitation: async ({ invitation, inviter }) => {
+			const membership = await findMember((await context()).adapter, {
+				organizationId: invitation.organizationId,
+				userId: inviter.id
+			});
+			const held = effectiveRoles(globalRoles(inviter.role), membership?.appRoles);
+			const refusal = checkAppRoleChange({
+				held,
+				before: [],
+				after: parseAppRoles(invitation.appRoles),
+				definitions
+			});
+			if (refusal) throw new APIError(refusal.status, {
+				code: refusal.code,
+				message: refusal.message
+			});
+		},
+		afterRemoveMember: async ({ member, user }) => {
+			if (globalRoles(user.role).length > 0) return;
+			const { internalAdapter } = await context();
+			for (const session of await internalAdapter.listSessions(member.userId)) if (session.activeOrganizationId === member.organizationId) await internalAdapter.updateSession(session.token, { activeOrganizationId: null });
+		},
+		beforeDeleteOrganization: async ({ organization }) => {
+			await resolved.options.beforeDelete?.(organization);
+		}
+	};
+	return organization({
+		creatorRole: "owner",
+		allowUserToCreateOrganization: (user) => resolved.create === "everyone" || globalRoles(user.role).includes("admin"),
+		invitationExpiresIn: resolved.invitationExpiresIn,
+		membershipLimit: resolved.membershipLimit,
+		requireEmailVerificationOnInvitation: true,
+		cancelPendingInvitationsOnReInvite: true,
+		schema: organizationNames,
+		...mailer && { sendInvitationEmail: async ({ invitation, organization, inviter }) => {
+			const token = await invitationToken(secret, invitation);
+			await mailer.send(invitationEmail({
+				to: invitation.email,
+				inviter: inviter.user.name || inviter.user.email,
+				organization: organization.name,
+				url: invitationLink(resolved.invitationUrl, token),
+				expiresAt: invitation.expiresAt
+			}));
+		} },
+		organizationHooks: mergeHooks(own, resolved.options.hooks)
+	});
+};
+//#endregion
+export { organizationNames, organizationPlugin };

package/dist/better-auth/organizations/protobase-plugin.js

@@ -0,0 +1,21 @@
+import { invitationEndpoints, invitationLinkHook } from "./invitation-endpoints.js";
+import { memberEndpoints } from "./member-endpoints.js";
+//#region src/better-auth/organizations/protobase-plugin.ts
+/**
+* Protobase's endpoints beside Better Auth's organization plugin: invitation links that also make accounts, app roles,
+* handing ownership over, and finding organizations for people with a global role. Without a mailer, whoever invites
+* gets the link in the answer.
+*/
+const protobaseOrganizationPlugin = ({ resolved, mail }) => ({
+	id: "protobase-organizations",
+	endpoints: {
+		...invitationEndpoints({
+			resolved,
+			mail
+		}),
+		...memberEndpoints({ resolved })
+	},
+	hooks: { after: mail ? [] : [invitationLinkHook(resolved)] }
+});
+//#endregion
+export { protobaseOrganizationPlugin };

package/dist/better-auth/organizations/role-definitions.d.ts

@@ -0,0 +1,15 @@
+//#region src/better-auth/organizations/role-definitions.d.ts
+/** A role: its label, or its label and the other roles its holders may also give (see `grantableRoles`). */
+export type RoleDefinition = string | {
+  label: string;
+  grants?: string[];
+};
+/** The roles of an app: names only, or each with its definition. */
+export type RolesInput = string[] | Record<string, RoleDefinition>;
+export type RoleDefinitions = {
+  /** `admin` first, then the others in the order given. */
+  names: string[];
+  labels: Record<string, string>;
+  grants: Record<string, string[]>;
+};
+//#endregion

package/dist/better-auth/organizations/role-definitions.js

@@ -0,0 +1,56 @@
+//#region src/better-auth/organizations/role-definitions.ts
+const roleName = /^[a-z][a-z0-9_-]*$/;
+/** The superuser: holds every role in every organization. */
+const superuserRole = "admin";
+/** The admin plugin's role for an account without a global role; in organization mode it grants nothing. */
+const noGlobalRole = "user";
+const organizationRoleNames = ["owner", "member"];
+const builtInLabels = {
+	[superuserRole]: "Superuser",
+	[noGlobalRole]: "No global role"
+};
+const entriesOf = (input) => Array.isArray(input) ? input.map((name) => [name, void 0]) : Object.entries(input);
+/**
+* The roles with `admin` first (added when missing), their labels and grants. With `organizations`, every role needs a
+* label (`admin` and `user` have one built in), `user` is always there, as the role of an account without a global
+* role, and `owner` and `member` are refused, since they name organization roles.
+*/
+const roleDefinitions = (input = ["admin", "user"], { organizations = false } = {}) => {
+	const entries = entriesOf(input);
+	const bad = entries.find(([name]) => !roleName.test(name));
+	if (bad) throw new Error(`Invalid role "${bad[0]}": use lowercase letters, digits, "_" or "-"`);
+	const given = new Map(entries);
+	const names = [
+		superuserRole,
+		...new Set(entries.map(([name]) => name).filter((name) => name !== superuserRole)),
+		...organizations && !given.has("user") ? [noGlobalRole] : []
+	];
+	const labels = {};
+	const grants = {};
+	for (const name of names) {
+		const definition = given.get(name);
+		const label = typeof definition === "string" ? definition : definition?.label ?? builtInLabels[name];
+		if (label !== void 0) labels[name] = label;
+		grants[name] = typeof definition === "object" ? definition.grants ?? [] : [];
+		const unknown = grants[name].find((granted) => !names.includes(granted));
+		if (unknown !== void 0) throw new Error(`Role "${name}" grants "${unknown}", which is not one of the roles: ${names.join(", ")}`);
+	}
+	if (!organizations) return {
+		names,
+		labels,
+		grants
+	};
+	const reserved = names.find((name) => organizationRoleNames.includes(name));
+	if (reserved) throw new Error(`Role "${reserved}" names an organization role; choose another name`);
+	const unlabelled = names.find((name) => labels[name] === void 0);
+	if (unlabelled) throw new Error(`Role "${unlabelled}" needs a label: with organizations, roles are given as { name: 'Label' }`);
+	return {
+		names,
+		labels,
+		grants
+	};
+};
+/** The roles a member of an organization can hold there: every role but the superuser's and the placeholder. */
+const membershipRoles = ({ names }) => names.filter((name) => name !== "admin" && name !== "user");
+//#endregion
+export { membershipRoles, noGlobalRole, roleDefinitions, superuserRole };

package/dist/better-auth/organizations/session-organization.js

@@ -0,0 +1,68 @@
+import { globalRoles } from "./app-roles.js";
+import { initialOrganization } from "./active-organization.js";
+import { findMember, findOrganization, membershipsOf, organizationRoleOf, summaries } from "./store.js";
+//#region src/better-auth/organizations/session-organization.ts
+/** The user field that keeps the organization someone last worked in, for their next sign-in. */
+const lastOrganizationField = { lastOrganizationId: {
+	type: "string",
+	required: false,
+	input: false,
+	fieldName: "last_organization_id"
+} };
+/** Whether someone may work in an organization: a member, or holding a global role, which enters every one. */
+const mayEnter = async (adapter, user, organizationId) => {
+	if (await findMember(adapter, {
+		organizationId,
+		userId: user.id
+	})) return true;
+	return globalRoles(user.role).length > 0 && await findOrganization(adapter, organizationId) !== null;
+};
+/**
+* The token's organization claims for a session: `org`, the active organization, while the person may still work in
+* it; for a member also `org_role`, their organization role, and `app_roles`, their app roles there. Read when the
+* token is issued, so a removed member or a changed role shows within the token's lifetime.
+*/
+const organizationClaims = async (adapter, user, activeOrganizationId) => {
+	if (!activeOrganizationId) return {};
+	const member = await findMember(adapter, {
+		organizationId: activeOrganizationId,
+		userId: user.id
+	});
+	if (member) return {
+		org: activeOrganizationId,
+		org_role: organizationRoleOf(member),
+		app_roles: member.appRoles
+	};
+	if (await mayEnter(adapter, user, activeOrganizationId)) return { org: activeOrganizationId };
+	return {};
+};
+/**
+* Better Auth's session hooks for organizations: a new session starts in the organization the person last worked in
+* (`initialOrganization`), and a session's change of organization is kept on the user as the next one's start.
+*/
+const sessionOrganizationHooks = (context) => ({
+	create: { before: async (session) => {
+		const { adapter, internalAdapter } = await context();
+		const user = await internalAdapter.findUserById(session.userId);
+		if (!user) return;
+		const last = user.lastOrganizationId;
+		const activeOrganizationId = initialOrganization({
+			memberships: summaries(await membershipsOf(adapter, user.id)),
+			last,
+			entersAny: globalRoles(user.role).length > 0,
+			lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
+		});
+		return activeOrganizationId ? { data: {
+			...session,
+			activeOrganizationId
+		} } : void 0;
+	} },
+	update: { after: async (session) => {
+		if (!session.activeOrganizationId) return;
+		const { internalAdapter } = await context();
+		const user = await internalAdapter.findUserById(session.userId);
+		if (user && user.lastOrganizationId !== session.activeOrganizationId) await internalAdapter.updateUser(session.userId, { lastOrganizationId: session.activeOrganizationId });
+	} }
+});
+//#endregion
+export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks };

package/dist/better-auth/organizations/store.d.ts

@@ -0,0 +1,19 @@
+import { createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/organizations/store.d.ts
+export type OrganizationRole = 'owner' | 'admin' | 'member';
+export type StoredMember = {
+  id: string;
+  organizationId: string;
+  userId: string;
+  role: string;
+  appRoles: string[];
+  createdAt: Date;
+};
+export type StoredOrganization = {
+  id: string;
+  name: string;
+  slug: string;
+  logo?: string | null;
+  createdAt: Date;
+};
+//#endregion

package/dist/better-auth/organizations/store.js

@@ -0,0 +1,73 @@
+import { parseAppRoles } from "./app-roles.js";
+//#region src/better-auth/organizations/store.ts
+/** Better Auth's `findMany` returns 100 rows unless told otherwise; these lists are read whole. */
+const everyRow = 1e5;
+const memberOf = (row) => ({
+	...row,
+	appRoles: parseAppRoles(row.appRoles)
+});
+/** Better Auth stores several organization roles comma separated; Protobase gives each member one. */
+const organizationRoleOf = (member) => {
+	const roles = member.role.split(",").map((name) => name.trim());
+	return roles.includes("owner") ? "owner" : roles.includes("admin") ? "admin" : "member";
+};
+const findMember = async (adapter, where) => {
+	const row = await adapter.findOne({
+		model: "member",
+		where: [{
+			field: "organizationId",
+			value: where.organizationId
+		}, {
+			field: "userId",
+			value: where.userId
+		}]
+	});
+	return row ? memberOf(row) : void 0;
+};
+const findMemberById = async (adapter, id) => {
+	const row = await adapter.findOne({
+		model: "member",
+		where: [{
+			field: "id",
+			value: id
+		}]
+	});
+	return row ? memberOf(row) : void 0;
+};
+const membershipsOf = async (adapter, userId) => (await adapter.findMany({
+	model: "member",
+	where: [{
+		field: "userId",
+		value: userId
+	}],
+	limit: everyRow
+})).map(memberOf);
+const membersOf = async (adapter, organizationId) => (await adapter.findMany({
+	model: "member",
+	where: [{
+		field: "organizationId",
+		value: organizationId
+	}],
+	limit: everyRow
+})).map(memberOf);
+const findOrganization = (adapter, id) => adapter.findOne({
+	model: "organization",
+	where: [{
+		field: "id",
+		value: id
+	}]
+});
+const summaries = (members) => members.map(({ organizationId, createdAt }) => ({
+	organizationId,
+	createdAt
+}));
+const setAppRoles = (adapter, memberId, appRoles) => adapter.update({
+	model: "member",
+	where: [{
+		field: "id",
+		value: memberId
+	}],
+	update: { appRoles: [...appRoles] }
+});
+//#endregion
+export { everyRow, findMember, findMemberById, findOrganization, membersOf, membershipsOf, organizationRoleOf, setAppRoles, summaries };

package/dist/better-auth/policy-store.js

@@ -2,42 +2,51 @@ import { defaultSignInPolicy, parseSignInPolicy } from "./sign-in-policy.js";
 //#region src/better-auth/policy-store.ts
 /** Better Auth's model for the sign-in policy: one row per save, the newest applies, the older ones are its history. */
 const signInPolicyModel = "signInPolicy";
-const signInPolicySchema = { [signInPolicyModel]: { fields: {
-	password: {
-		type: "string",
-		required: true
-	},
-	emailCode: {
-		type: "string",
-		required: true
-	},
-	passkey: {
-		type: "string",
-		required: true
-	},
-	twoFactor: {
-		type: "string",
-		required: true
-	},
-	staffAccess: {
-		type: "string",
-		required: true,
-		defaultValue: "allowed"
-	},
-	platformSignIn: {
-		type: "string",
-		required: true,
-		defaultValue: "allowed"
-	},
-	createdAt: {
-		type: "date",
-		required: true
-	},
-	createdBy: {
-		type: "string",
-		required: false
+const signInPolicySchema = { [signInPolicyModel]: {
+	modelName: "sign_in_policy",
+	fields: {
+		password: {
+			type: "string",
+			required: true
+		},
+		emailCode: {
+			type: "string",
+			required: true,
+			fieldName: "email_code"
+		},
+		passkey: {
+			type: "string",
+			required: true
+		},
+		twoFactor: {
+			type: "string",
+			required: true,
+			fieldName: "two_factor"
+		},
+		staffAccess: {
+			type: "string",
+			required: true,
+			defaultValue: "allowed",
+			fieldName: "staff_access"
+		},
+		platformSignIn: {
+			type: "string",
+			required: true,
+			defaultValue: "allowed",
+			fieldName: "platform_sign_in"
+		},
+		createdAt: {
+			type: "date",
+			required: true,
+			fieldName: "created_at"
+		},
+		createdBy: {
+			type: "string",
+			required: false,
+			fieldName: "created_by"
+		}
 	}
-} } };
+} };
 /** The newest saved policy, or the default when none was saved. A row that no longer parses counts as none. */
 const readSignInPolicy = async (adapter) => {
 	const [row] = await adapter.findMany({

package/dist/better-auth/snake-case-migration.js

@@ -0,0 +1,122 @@
+//#region src/better-auth/snake-case-migration.ts
+const schemaName = /^[a-z_][a-z0-9_]*$/;
+/**
+* The migration that renames the auth store of Protobase 0.6 in place, from Better Auth's camelCase names to the
+* snake_case ones of `snake-case-names.ts`: tables, columns, and the indexes and constraints named after them. Data,
+* defaults, keys and indexes stay as they are. On a store that has the snake_case names already it does nothing, so a
+* project's migrations can carry it after an auth migration written with them. `schema` is the store's schema, the
+* connection's current one when left out.
+*/
+const snakeCaseMigration = (schema) => {
+	if (schema !== void 0 && !schemaName.test(schema)) throw new Error(`Invalid auth schema name "${schema}"`);
+	const s = schema === void 0 ? "" : `"${schema}".`;
+	const current = schema === void 0 ? "current_schema()" : `'${schema}'`;
+	return `-- Renames the auth store of Protobase 0.6 to snake_case. A store set up with the snake_case names has no "emailVerified"
+-- and is left as it is.
+do $$
+declare
+  constraint_row record;
+begin
+  if not exists (select from information_schema.columns where table_schema = ${current} and table_name = 'user' and column_name = 'emailVerified') then
+    return;
+  end if;
+
+  alter table ${s}"twoFactor" rename to two_factor;
+  alter table ${s}"signInPolicy" rename to sign_in_policy;
+  alter table ${s}"staffSignIn" rename to staff_sign_in;
+
+  alter table ${s}"user" rename column "emailVerified" to email_verified;
+  alter table ${s}"user" rename column "createdAt" to created_at;
+  alter table ${s}"user" rename column "updatedAt" to updated_at;
+  alter table ${s}"user" rename column "banReason" to ban_reason;
+  alter table ${s}"user" rename column "banExpires" to ban_expires;
+  alter table ${s}"user" rename column "twoFactorEnabled" to two_factor_enabled;
+
+  alter table ${s}session rename column "expiresAt" to expires_at;
+  alter table ${s}session rename column "createdAt" to created_at;
+  alter table ${s}session rename column "updatedAt" to updated_at;
+  alter table ${s}session rename column "ipAddress" to ip_address;
+  alter table ${s}session rename column "userAgent" to user_agent;
+  alter table ${s}session rename column "userId" to user_id;
+  alter table ${s}session rename column "impersonatedBy" to impersonated_by;
+
+  alter table ${s}account rename column "accountId" to account_id;
+  alter table ${s}account rename column "providerId" to provider_id;
+  alter table ${s}account rename column "userId" to user_id;
+  alter table ${s}account rename column "accessToken" to access_token;
+  alter table ${s}account rename column "refreshToken" to refresh_token;
+  alter table ${s}account rename column "idToken" to id_token;
+  alter table ${s}account rename column "accessTokenExpiresAt" to access_token_expires_at;
+  alter table ${s}account rename column "refreshTokenExpiresAt" to refresh_token_expires_at;
+  alter table ${s}account rename column "createdAt" to created_at;
+  alter table ${s}account rename column "updatedAt" to updated_at;
+
+  alter table ${s}verification rename column "expiresAt" to expires_at;
+  alter table ${s}verification rename column "createdAt" to created_at;
+  alter table ${s}verification rename column "updatedAt" to updated_at;
+
+  alter table ${s}jwks rename column "publicKey" to public_key;
+  alter table ${s}jwks rename column "privateKey" to private_key;
+  alter table ${s}jwks rename column "createdAt" to created_at;
+  alter table ${s}jwks rename column "expiresAt" to expires_at;
+
+  alter table ${s}two_factor rename column "backupCodes" to backup_codes;
+  alter table ${s}two_factor rename column "userId" to user_id;
+  alter table ${s}two_factor rename column "failedVerificationCount" to failed_verification_count;
+  alter table ${s}two_factor rename column "lockedUntil" to locked_until;
+
+  alter table ${s}passkey rename column "publicKey" to public_key;
+  alter table ${s}passkey rename column "userId" to user_id;
+  alter table ${s}passkey rename column "credentialID" to credential_id;
+  alter table ${s}passkey rename column "deviceType" to device_type;
+  alter table ${s}passkey rename column "backedUp" to backed_up;
+  alter table ${s}passkey rename column "createdAt" to created_at;
+
+  alter table ${s}sign_in_policy rename column "emailCode" to email_code;
+  alter table ${s}sign_in_policy rename column "twoFactor" to two_factor;
+  alter table ${s}sign_in_policy rename column "staffAccess" to staff_access;
+  alter table ${s}sign_in_policy rename column "platformSignIn" to platform_sign_in;
+  alter table ${s}sign_in_policy rename column "createdAt" to created_at;
+  alter table ${s}sign_in_policy rename column "createdBy" to created_by;
+
+  alter table ${s}staff_sign_in rename column "userId" to user_id;
+  alter table ${s}staff_sign_in rename column "userEmail" to user_email;
+  alter table ${s}staff_sign_in rename column "staffName" to staff_name;
+  alter table ${s}staff_sign_in rename column "staffSubject" to staff_subject;
+  alter table ${s}staff_sign_in rename column "sessionId" to session_id;
+  alter table ${s}staff_sign_in rename column "startedAt" to started_at;
+  alter table ${s}staff_sign_in rename column "expiresAt" to expires_at;
+  alter table ${s}staff_sign_in rename column "endedAt" to ended_at;
+
+  -- A primary key's index takes the new name with it.
+  alter table ${s}two_factor rename constraint "twoFactor_pkey" to two_factor_pkey;
+  alter table ${s}sign_in_policy rename constraint "signInPolicy_pkey" to sign_in_policy_pkey;
+  alter table ${s}staff_sign_in rename constraint "staffSignIn_pkey" to staff_sign_in_pkey;
+  alter table ${s}session rename constraint "session_userId_fkey" to session_user_id_fkey;
+  alter table ${s}account rename constraint "account_userId_fkey" to account_user_id_fkey;
+  alter table ${s}two_factor rename constraint "twoFactor_userId_fkey" to two_factor_user_id_fkey;
+  alter table ${s}passkey rename constraint "passkey_userId_fkey" to passkey_user_id_fkey;
+
+  alter index ${s}"session_userId_idx" rename to session_user_id_idx;
+  alter index ${s}"account_userId_idx" rename to account_user_id_idx;
+  alter index ${s}"twoFactor_secret_idx" rename to two_factor_secret_idx;
+  alter index ${s}"twoFactor_userId_idx" rename to two_factor_user_id_idx;
+  alter index ${s}"passkey_userId_idx" rename to passkey_user_id_idx;
+  alter index ${s}"passkey_credentialID_idx" rename to passkey_credential_id_idx;
+
+  -- Postgres 18 names each not-null constraint after its table and column, as "user_emailVerified_not_null"; earlier
+  -- versions keep no such constraints, so there is nothing to rename there.
+  for constraint_row in
+    select c.conrelid::regclass as table_name, c.conname as old_name, t.relname || '_' || a.attname || '_not_null' as new_name
+    from pg_constraint c
+    join pg_class t on t.oid = c.conrelid
+    join pg_attribute a on a.attrelid = c.conrelid and a.attnum = c.conkey[1]
+    where c.contype = 'n' and t.relnamespace = (select oid from pg_namespace where nspname = ${current}) and c.conname ~ '[A-Z]'
+  loop
+    execute format('alter table %s rename constraint %I to %I', constraint_row.table_name, constraint_row.old_name, constraint_row.new_name);
+  end loop;
+end
+$$;`;
+};
+//#endregion
+export { snakeCaseMigration };

package/dist/better-auth/snake-case-names.js

@@ -0,0 +1,72 @@
+//#region src/better-auth/snake-case-names.ts
+/** Better Auth's own tables, as its `user`, `session`, `account` and `verification` options name them. */
+const coreNames = {
+	user: { fields: {
+		emailVerified: "email_verified",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} },
+	session: { fields: {
+		expiresAt: "expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at",
+		ipAddress: "ip_address",
+		userAgent: "user_agent",
+		userId: "user_id"
+	} },
+	account: { fields: {
+		accountId: "account_id",
+		providerId: "provider_id",
+		userId: "user_id",
+		accessToken: "access_token",
+		refreshToken: "refresh_token",
+		idToken: "id_token",
+		accessTokenExpiresAt: "access_token_expires_at",
+		refreshTokenExpiresAt: "refresh_token_expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} },
+	verification: { fields: {
+		expiresAt: "expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} }
+};
+/** The `schema` option of each plugin with tables or columns of its own. */
+const pluginNames = {
+	admin: {
+		user: { fields: {
+			banReason: "ban_reason",
+			banExpires: "ban_expires"
+		} },
+		session: { fields: { impersonatedBy: "impersonated_by" } }
+	},
+	jwt: { jwks: { fields: {
+		publicKey: "public_key",
+		privateKey: "private_key",
+		createdAt: "created_at",
+		expiresAt: "expires_at"
+	} } },
+	twoFactor: {
+		user: { fields: { twoFactorEnabled: "two_factor_enabled" } },
+		twoFactor: {
+			modelName: "two_factor",
+			fields: {
+				backupCodes: "backup_codes",
+				userId: "user_id",
+				failedVerificationCount: "failed_verification_count",
+				lockedUntil: "locked_until"
+			}
+		}
+	},
+	passkey: { passkey: { fields: {
+		publicKey: "public_key",
+		userId: "user_id",
+		credentialID: "credential_id",
+		deviceType: "device_type",
+		backedUp: "backed_up",
+		createdAt: "created_at"
+	} } }
+};
+//#endregion
+export { coreNames, pluginNames };