@protobase/server 0.9.0 → 0.11.0

package/dist/active-role.js

@@ -0,0 +1,8 @@
+//#region src/active-role.ts
+/**
+* The one role a session works as, which picks its bottom bar: the first of its roles. A Better Auth token carries the
+* session's active role alone (see `narrowClaims`); with another authenticator, the caller's first role.
+*/
+const activeRole = (session) => session.user.roles[0];
+//#endregion
+export { activeRole };

package/dist/admin-options.d.ts

@@ -1,4 +1,5 @@
 import { AuditQueue, PipelineHook, ScanGuardMode } from "./types.js";
+import { CorsOrigins } from "./api-cors.js";
 import { AssistantOptions } from "./assistant/assistant-settings.js";
 import { RuntimeOptions } from "./runtime/runtime-settings.js";
 import { ResolveOptions } from "@protobase/schema";
@@ -29,6 +30,13 @@ export type AdminOptions = {
   onUnhandledError?: (error: unknown) => void;
   /** The assistant in the admin app's dock: a backend elsewhere or the built-in one (see `AssistantOptions`); `false` turns it off. */
   assistant?: AssistantOptions | false;
+  /**
+   * The websites whose browser code may call the API (`/api/*` but `/api/auth/*`) besides the app's own origins (see
+   * `createAuth`'s `origins`): a list of origins, or `*` for any. Defaults to the one the platform passes in
+   * `PROTOBASE_CORS_ORIGINS` (`*` or comma separated), when set. With neither this nor other origins, the API sends no
+   * CORS headers.
+   */
+  cors?: CorsOrigins;
   /** The runtime updates endpoint behind the top bar's update button (see `RuntimeOptions`); `false` turns it off. */
   runtime?: RuntimeOptions | false;
 };

package/dist/api-cors.d.ts

@@ -0,0 +1,5 @@
+import "hono";
+//#region src/api-cors.d.ts
+/** The websites whose browser code may call the API: `*` for any, or a list of origins such as `https://shop.com`. */
+export type CorsOrigins = '*' | string[];
+//#endregion

package/dist/api-cors.js

@@ -0,0 +1,53 @@
+import { readList } from "./better-auth/origins.js";
+import { cors } from "hono/cors";
+//#region src/api-cors.ts
+const corsOriginsVariable = "PROTOBASE_CORS_ORIGINS";
+/** The origins in `PROTOBASE_CORS_ORIGINS`, `*` or comma separated; `undefined` when it is unset. One that is not a URL stops the server at startup. */
+const readCorsOrigins = (env) => {
+	const value = env[corsOriginsVariable]?.trim();
+	if (!value) return void 0;
+	if (value === "*") return "*";
+	return readList(value).map((origin) => {
+		if (!URL.canParse(origin)) throw new Error(`${corsOriginsVariable} lists "${origin}", which is not a URL such as https://shop.com`);
+		return new URL(origin).origin;
+	});
+};
+const allowHeaders = [
+	"authorization",
+	"content-type",
+	"if-match",
+	"if-none-match"
+];
+const exposeHeaders = [
+	"location",
+	"etag",
+	"x-meta-version",
+	"x-protobase-warning"
+];
+/**
+* CORS for the API: an allowed origin gets `Access-Control-Allow-Origin` (`*` when any is), preflights are answered
+* before authentication and kept for ten minutes.
+*/
+const apiCors = ({ own, allowed, skip }) => {
+	const origin = (requestOrigin) => {
+		if (allowed === "*") return "*";
+		return own.includes(requestOrigin) || allowed.includes(requestOrigin) ? requestOrigin : null;
+	};
+	const handler = cors({
+		origin,
+		allowHeaders,
+		exposeHeaders,
+		maxAge: 600,
+		allowMethods: [
+			"GET",
+			"HEAD",
+			"POST",
+			"PUT",
+			"PATCH",
+			"DELETE"
+		]
+	});
+	return (c, next) => skip(c.req.path) ? next() : handler(c, next);
+};
+//#endregion
+export { apiCors, corsOriginsVariable, readCorsOrigins };

package/dist/better-auth/admin-only.js

@@ -1,9 +1,11 @@
-import { parseRoles } from "./parse-roles.js";
+import "./organizations/role-definitions.js";
+import { sessionRoles } from "./roles/session-role.js";
 import { APIError, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/admin-only.ts
-/** Lets a request through only with the session of an admin; others get `403 ADMIN_ONLY` with `message`. */
+/** Lets a request through only with the session of someone acting as an admin; others get `403 ADMIN_ONLY` with `message`. */
 const adminOnly = (message) => createAuthMiddleware({ use: [sessionMiddleware] }, async (ctx) => {
-	if (!parseRoles(ctx.context.session.user.role).includes("admin")) throw new APIError("FORBIDDEN", {
+	const { active } = await sessionRoles(ctx.context, ctx.context.session);
+	if (active !== "admin") throw new APIError("FORBIDDEN", {
 		code: "ADMIN_ONLY",
 		message
 	});

package/dist/better-auth/authenticator.d.ts

@@ -7,7 +7,7 @@ export type BetterAuthAuthenticatorOptions = {
   auth?: AdminAuth;
   /** Or its JWKS endpoint, for an API that runs apart from the auth server. Needs `issuer`. */
   jwksUrl?: string | URL;
-  /** Defaults to the auth instance's `baseURL`; it is both issuer and audience of its tokens. */
+  /** Defaults to the auth instance's `issuer`, its `baseURL`; it is both issuer and audience of its tokens. */
   issuer?: string;
   /** The one tenant everyone works in, for an app without organizations; never read from the token. */
   tenant?: TenantValue | (() => Promise<TenantValue | undefined>);

package/dist/better-auth/authenticator.js

@@ -9,7 +9,7 @@ import { cachedKeys } from "./jwks-cache.js";
 * role, is left out.
 */
 const betterAuthAuthenticator = (options) => {
-	const issuer = options.issuer ?? options.auth?.options.baseURL;
+	const issuer = options.issuer ?? options.auth?.issuer;
 	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
 	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
 	const organizations = options.organizations ?? Boolean(options.auth?.organizations);

package/dist/better-auth/create-auth.d.ts

@@ -1,8 +1,8 @@
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
-import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
+import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
@@ -12,8 +12,21 @@ import { BetterAuthOptions } from "better-auth";
 export type CreateAuthOptions = {
   /** A `pg` Pool, or `{ dialect, type: 'postgres', schemaName? }` for a Kysely dialect: the admin store, apart from the application's tables (its own schema or database). */
   database: BetterAuthOptions['database'];
-  /** Public origin of the API, for example `https://admin.example.com`. Issuer and audience of the tokens; passkeys belong to its host. */
+  /** Public origin of the API, for example `https://admin.example.com`. Issuer and audience of the tokens; new passkeys are made for its host unless `passkeyDomain` names another. */
   baseURL: string;
+  /**
+   * The other origins the app is served on, for example `['https://admin.shop.com']`. A request to one of them is
+   * answered for that host: its sign-in callbacks and the links it mails, such as a password reset, stay there, and
+   * passkeys work on every origin. Tokens keep `baseURL` as issuer, whatever host issued them. Defaults to the
+   * comma-separated list the platform passes in `PROTOBASE_ORIGINS`, when set; none otherwise.
+   */
+  origins?: string[];
+  /**
+   * The host new passkeys are made for (their RP ID): the host of `baseURL` or of one of `origins`. Each passkey keeps
+   * the one it was made for, and works on every origin, so changing it breaks none. Defaults to the one the platform
+   * passes in `PROTOBASE_PASSKEY_DOMAIN`, when set, and to the host of `baseURL` otherwise.
+   */
+  passkeyDomain?: string;
   /** The name authenticator apps and passkey prompts show for this app. Default `Protobase`. */
   appName?: string;
   /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */
@@ -1075,26 +1088,26 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           user: import("better-auth").User & Record<string, any>;
           session: import("better-auth").Session & Record<string, any>;
         }) => Promise<{
-          email: string;
           role: any;
+          email: string;
         } | {
           org?: undefined;
           org_role?: undefined;
           app_roles?: undefined;
-          email: string;
           role: any;
+          email: string;
         } | {
           org: string;
           org_role: OrganizationRole;
           app_roles: string[];
-          email: string;
           role: any;
+          email: string;
         } | {
           org: string;
           org_role?: undefined;
           app_roles?: undefined;
-          email: string;
           role: any;
+          email: string;
         }>;
       };
       disableSettingJwtHeader: true;
@@ -1990,9 +2003,39 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_TWO_FACTOR_COOKIE: import("better-auth").RawError<"INVALID_TWO_FACTOR_COOKIE">;
     };
   }, {
-    id: "passkey";
-    version: string;
     endpoints: {
+      generatePasskeyAuthenticationOptions: import("better-auth").StrictEndpoint<"/passkey/generate-authenticate-options", {
+        method: "GET";
+        query: import("zod").ZodOptional<import("zod").ZodObject<{
+          rpId: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+      }, import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
+      verifyPasskeyAuthentication: import("better-auth").StrictEndpoint<"/passkey/verify-authentication", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          response: import("zod").ZodRecord<import("zod").ZodAny, import("zod").ZodAny>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        session: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          userId: string;
+          expiresAt: Date;
+          token: string;
+          ipAddress?: string | null | undefined;
+          userAgent?: string | null | undefined;
+        };
+        user: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          email: string;
+          emailVerified: boolean;
+          name: string;
+          image?: string | null | undefined;
+        };
+      }>;
       generatePasskeyRegistrationOptions: import("better-auth").StrictEndpoint<"/passkey/generate-register-options", {
         method: "GET";
         use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
@@ -2133,100 +2176,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           };
         };
       }, import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>;
-      generatePasskeyAuthenticationOptions: import("better-auth").StrictEndpoint<"/passkey/generate-authenticate-options", {
-        method: "GET";
-        metadata: {
-          openapi: {
-            operationId: string;
-            description: string;
-            responses: {
-              200: {
-                description: string;
-                content: {
-                  "application/json": {
-                    schema: {
-                      type: "object";
-                      properties: {
-                        challenge: {
-                          type: string;
-                        };
-                        rp: {
-                          type: string;
-                          properties: {
-                            name: {
-                              type: string;
-                            };
-                            id: {
-                              type: string;
-                            };
-                          };
-                        };
-                        user: {
-                          type: string;
-                          properties: {
-                            id: {
-                              type: string;
-                            };
-                            name: {
-                              type: string;
-                            };
-                            displayName: {
-                              type: string;
-                            };
-                          };
-                        };
-                        timeout: {
-                          type: string;
-                        };
-                        allowCredentials: {
-                          type: string;
-                          items: {
-                            type: string;
-                            properties: {
-                              id: {
-                                type: string;
-                              };
-                              type: {
-                                type: string;
-                              };
-                              transports: {
-                                type: string;
-                                items: {
-                                  type: string;
-                                };
-                              };
-                            };
-                          };
-                        };
-                        userVerification: {
-                          type: string;
-                        };
-                        authenticatorSelection: {
-                          type: string;
-                          properties: {
-                            authenticatorAttachment: {
-                              type: string;
-                            };
-                            requireResidentKey: {
-                              type: string;
-                            };
-                            userVerification: {
-                              type: string;
-                            };
-                          };
-                        };
-                        extensions: {
-                          type: string;
-                        };
-                      };
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      }, import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
       verifyPasskeyRegistration: import("better-auth").StrictEndpoint<"/passkey/verify-registration", {
         method: "POST";
         body: import("zod").ZodObject<{
@@ -2292,63 +2241,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           };
         };
       }, import("@better-auth/passkey").Passkey>;
-      verifyPasskeyAuthentication: import("better-auth").StrictEndpoint<"/passkey/verify-authentication", {
-        method: "POST";
-        body: import("zod").ZodObject<{
-          response: import("zod").ZodRecord<import("zod").ZodAny, import("zod").ZodAny>;
-        }, import("zod/v4/core").$strip>;
-        metadata: {
-          openapi: {
-            operationId: string;
-            description: string;
-            responses: {
-              200: {
-                description: string;
-                content: {
-                  "application/json": {
-                    schema: {
-                      type: "object";
-                      properties: {
-                        session: {
-                          $ref: string;
-                        };
-                        user: {
-                          $ref: string;
-                        };
-                      };
-                    };
-                  };
-                };
-              };
-            };
-          };
-          $Infer: {
-            body: {
-              response: import("@simplewebauthn/server").AuthenticationResponseJSON;
-            };
-          };
-        };
-      }, {
-        session: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          userId: string;
-          expiresAt: Date;
-          token: string;
-          ipAddress?: string | null | undefined;
-          userAgent?: string | null | undefined;
-        };
-        user: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          email: string;
-          emailVerified: boolean;
-          name: string;
-          image?: string | null | undefined;
-        };
-      }>;
       listPasskeys: import("better-auth").StrictEndpoint<"/passkey/list-user-passkeys", {
         method: "GET";
         use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
@@ -2515,6 +2407,13 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     schema: {
       passkey: {
         fields: {
+          rpID: {
+            type: "string";
+            required: false;
+            fieldName: string;
+            input: false;
+            defaultValue: () => string;
+          };
           name: {
             type: "string";
             required: false;
@@ -2564,6 +2463,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         };
       };
     };
+    id: "passkey";
+    version: string;
     $ERROR_CODES: {
       CHALLENGE_NOT_FOUND: import("better-auth").RawError<"CHALLENGE_NOT_FOUND">;
       YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY">;
@@ -3663,6 +3564,101 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-roles";
+    schema: {
+      session: {
+        fields: {
+          activeRole: {
+            type: "string";
+            required: false;
+            input: false;
+            fieldName: string;
+          };
+        };
+      };
+      user: {
+        fields: {
+          lastRole: {
+            type: "string";
+            required: false;
+            input: false;
+            fieldName: string;
+          };
+        };
+      };
+    };
+    endpoints: {
+      currentRole: import("better-auth").StrictEndpoint<"/role/current", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        active: string | null;
+        roles: {
+          name: string;
+          label: string;
+        }[];
+      }>;
+      switchRole: import("better-auth").StrictEndpoint<"/role/switch", {
+        method: "POST";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          role: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        role: string;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | import("better-auth/plugins").DefaultOrganizationPlugin<{
     organizationHooks: {
       beforeCreateOrganization?: (data: {
@@ -4264,7 +4260,11 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   socialProviders?: import("better-auth").SocialProviders | undefined;
   appName: string;
   database: any;
-  baseURL: string;
+  baseURL: string | {
+    allowedHosts: string[];
+    fallback: string;
+    protocol: "https" | "http";
+  };
   basePath: string;
   secret: string;
   trustedOrigins: string[];
@@ -4281,6 +4281,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     minPasswordLength: number;
   };
 }> & {
+  /** Issuer and audience of the tokens: `baseURL`, on every origin. */
+  issuer: string;
+  /** Every origin the app is served on, `baseURL`'s first. */
+  origins: string[];
+  /** The RP ID of new passkeys. */
+  passkeyDomain: string;
   roles: string[];
   roleDefinitions: RoleDefinitions;
   organizations: ResolvedOrganizations | undefined;

package/dist/better-auth/create-auth.js

@@ -1,3 +1,4 @@
+import { multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
 import { readMailSettings } from "../mail/mail-settings.js";
 import { smtpMailer } from "../mail/smtp-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
@@ -6,14 +7,17 @@ import { lastOrganizationField, organizationClaims, sessionOrganizationHooks } f
 import { organizationPlugin } from "./organizations/organization-plugin.js";
 import { protobaseOrganizationPlugin } from "./organizations/protobase-plugin.js";
 import { resolveOrganizations } from "./organizations/options.js";
+import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey-domain.js";
+import { coreNames, pluginNames } from "./snake-case-names.js";
+import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { narrowClaims } from "./roles/active-role.js";
+import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
-import { coreNames, pluginNames } from "./snake-case-names.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
-import { passkey } from "@better-auth/passkey";
 import { APIError } from "better-auth/api";
 import { betterAuth } from "better-auth";
 import { admin, emailOTP, genericOAuth, jwt } from "better-auth/plugins";
@@ -21,6 +25,8 @@ import { adminAc, userAc } from "better-auth/plugins/admin/access";
 //#region src/better-auth/create-auth.ts
 const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
+const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
+const platformPasskeyDomain = () => readPasskeyDomain(globalThis.process?.env ?? {});
 const platformMailer = () => {
 	const settings = readMailSettings(globalThis.process?.env ?? {});
 	return settings && smtpMailer(settings);
@@ -42,17 +48,19 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, platformSignIn, organizations, context = noContext }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, mailer, operator, platformSignIn, organizations, context = noContext }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
+	const hosts = passkeyHosts([options.baseURL, ...origins]);
 	return {
 		appName: options.appName ?? "Protobase",
 		database: options.database,
-		baseURL: options.baseURL,
+		baseURL: multiHostBaseURL(options.baseURL, origins),
 		basePath: authBasePath,
 		secret: options.secret,
 		trustedOrigins: [
 			options.baseURL,
+			...origins,
 			"https://*.trycloudflare.com",
 			...options.trustedOrigins ?? []
 		],
@@ -86,11 +94,17 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, plat
 					expirationTime: tokenLifetime,
 					issuer: options.baseURL,
 					audience: options.baseURL,
-					definePayload: async ({ user, session }) => ({
-						email: user.email,
-						role: user.role,
-						...organizations && await organizationClaims((await context()).adapter, user, session.activeOrganizationId)
-					})
+					definePayload: async ({ user, session }) => {
+						const { activeRole, activeOrganizationId } = session;
+						const claims = {
+							role: user.role,
+							...organizations && await organizationClaims((await context()).adapter, user, activeOrganizationId)
+						};
+						return {
+							email: user.email,
+							...narrowClaims(claims, [activeRole, user.lastRole], Boolean(organizations))
+						};
+					}
 				},
 				disableSettingJwtHeader: true
 			}),
@@ -99,7 +113,11 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, plat
 				allowPasswordless: true,
 				...mailer && { otpOptions: twoFactorCodeOptions(mailer) }
 			}),
-			passkey({ schema: pluginNames.passkey }),
+			passkeyPlugin({
+				domain: passkeyDomain ?? hosts[0],
+				hosts,
+				formerDomain: hosts[0]
+			}),
 			...mailer ? [emailOTP(emailCodeOptions(mailer))] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			signInPolicyPlugin({
@@ -115,6 +133,7 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, plat
 				...operator && { operator },
 				...mailer && { mailer }
 			}),
+			rolesPlugin({ definitions }),
 			...organizations ? [organizationPlugin({
 				resolved: organizations,
 				secret: options.secret,
@@ -186,11 +205,16 @@ const createAuth = (options) => {
 	const signInSettings = options.signInProvider === void 0 ? platformSignInSettings() : options.signInProvider || void 0;
 	const socialProviders = Object.keys(options.socialProviders ?? {});
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
+	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
+	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions, options.baseURL);
 	let instance;
 	const context = () => instance?.$context ?? Promise.reject(/* @__PURE__ */ new Error("The auth instance is not made yet"));
 	const auth = betterAuth(betterAuthOptions(options, {
+		origins,
+		passkeyDomain,
 		roles,
+		definitions,
 		defaultRole,
 		mailer,
 		operator,
@@ -202,6 +226,12 @@ const createAuth = (options) => {
 	}));
 	instance = auth;
 	return Object.assign(auth, {
+		/** Issuer and audience of the tokens: `baseURL`, on every origin. */
+		issuer: options.baseURL,
+		/** Every origin the app is served on, `baseURL`'s first. */
+		origins: [new URL(options.baseURL).origin, ...origins],
+		/** The RP ID of new passkeys. */
+		passkeyDomain,
 		roles,
 		roleDefinitions: definitions,
 		organizations,