@revealui/auth 0.0.1-pre.0

package/dist/better-auth/plugin/lib/build-collections/users/endpoints/set-admin-role.js

@@ -0,0 +1,80 @@
+import { adminEndpoints, baseSlugs } from "@/better-auth/plugin/constants";
+import { status as httpStatus } from "http-status";
+import { z } from "zod";
+import { getPayloadAuth } from "../../../get-payload-auth";
+const setAdminRoleSchema = z.object({
+    token: z.string().optional(),
+    redirect: z.string().optional()
+});
+export const getSetAdminRoleEndpoint = (pluginOptions, userSlug)=>{
+    const endpoint = {
+        path: adminEndpoints.setAdminRole,
+        method: 'get',
+        handler: async (req)=>{
+            const { config } = req.payload;
+            const schema = setAdminRoleSchema.safeParse(req.query);
+            if (!schema.success) {
+                return Response.json({
+                    message: schema.error.message
+                }, {
+                    status: httpStatus.BAD_REQUEST
+                });
+            }
+            const payloadAuth = await getPayloadAuth(config);
+            const session = await payloadAuth.betterAuth.api.getSession({
+                headers: req.headers
+            });
+            if (!session) {
+                return Response.json({
+                    message: 'No session found'
+                }, {
+                    status: httpStatus.UNAUTHORIZED
+                });
+            }
+            const { token, redirect } = schema.data;
+            const invite = await req.payload.find({
+                collection: pluginOptions.adminInvitations?.slug ?? baseSlugs.adminInvitations,
+                where: {
+                    token: {
+                        equals: token
+                    }
+                },
+                limit: 1
+            });
+            if (invite.docs.length === 0) {
+                return Response.json({
+                    message: 'Invalid token'
+                }, {
+                    status: httpStatus.UNAUTHORIZED
+                });
+            }
+            const role = invite.docs[0]?.role;
+            await req.payload.update({
+                collection: userSlug,
+                id: session.user.id,
+                data: {
+                    role: role
+                },
+                overrideAccess: true
+            });
+            await req.payload.delete({
+                collection: pluginOptions.adminInvitations?.slug ?? baseSlugs.adminInvitations,
+                where: {
+                    token: {
+                        equals: token
+                    }
+                }
+            });
+            const response = new Response(null, {
+                status: 307,
+                headers: {
+                    Location: redirect ?? config.routes.admin
+                }
+            });
+            return response;
+        }
+    };
+    return endpoint;
+};
+
+//# sourceMappingURL=set-admin-role.js.map

package/dist/better-auth/plugin/lib/build-collections/users/endpoints/set-admin-role.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../src/better-auth/plugin/lib/build-collections/users/endpoints/set-admin-role.ts"],"sourcesContent":["import { adminEndpoints, baseSlugs } from '@/better-auth/plugin/constants';\nimport { status as httpStatus } from 'http-status';\nimport { type CollectionSlug, type Endpoint } from 'payload';\nimport { z } from 'zod';\nimport type { BetterAuthPluginOptions } from '../../../../types';\nimport { getPayloadAuth } from '../../../get-payload-auth';\n\nconst setAdminRoleSchema = z.object({\n  token: z.string().optional(),\n  redirect: z.string().optional(),\n});\n\nexport const getSetAdminRoleEndpoint = (\n  pluginOptions: BetterAuthPluginOptions,\n  userSlug: string\n): Endpoint => {\n  const endpoint: Endpoint = {\n    path: adminEndpoints.setAdminRole,\n    method: 'get',\n    handler: async req => {\n      const { config } = req.payload;\n      const schema = setAdminRoleSchema.safeParse(req.query);\n      if (!schema.success) {\n        return Response.json({ message: schema.error.message }, { status: httpStatus.BAD_REQUEST });\n      }\n      const payloadAuth = await getPayloadAuth(config);\n      const session = await payloadAuth.betterAuth.api.getSession({\n        headers: req.headers,\n      });\n      if (!session) {\n        return Response.json({ message: 'No session found' }, { status: httpStatus.UNAUTHORIZED });\n      }\n      const { token, redirect } = schema.data;\n      const invite = await req.payload.find({\n        collection: (pluginOptions.adminInvitations?.slug ??\n          baseSlugs.adminInvitations) as CollectionSlug,\n        where: {\n          token: { equals: token },\n        },\n        limit: 1,\n      });\n      if (invite.docs.length === 0) {\n        return Response.json({ message: 'Invalid token' }, { status: httpStatus.UNAUTHORIZED });\n      }\n      const role = (invite.docs[0] as any)?.role as string;\n      await req.payload.update({\n        collection: userSlug as CollectionSlug,\n        id: session.user.id,\n        data: {\n          role: role as any,\n        } as any,\n        overrideAccess: true,\n      });\n      await req.payload.delete({\n        collection: (pluginOptions.adminInvitations?.slug ??\n          baseSlugs.adminInvitations) as CollectionSlug,\n        where: {\n          token: {\n            equals: token,\n          },\n        },\n      });\n      const response = new Response(null, {\n        status: 307,\n        headers: {\n          Location: redirect ?? config.routes.admin,\n        },\n      });\n      return response;\n    },\n  };\n\n  return endpoint;\n};\n"],"names":["adminEndpoints","baseSlugs","status","httpStatus","z","getPayloadAuth","setAdminRoleSchema","object","token","string","optional","redirect","getSetAdminRoleEndpoint","pluginOptions","userSlug","endpoint","path","setAdminRole","method","handler","req","config","payload","schema","safeParse","query","success","Response","json","message","error","BAD_REQUEST","payloadAuth","session","betterAuth","api","getSession","headers","UNAUTHORIZED","data","invite","find","collection","adminInvitations","slug","where","equals","limit","docs","length","role","update","id","user","overrideAccess","delete","response","Location","routes","admin"],"mappings":"AAAA,SAASA,cAAc,EAAEC,SAAS,QAAQ,iCAAiC;AAC3E,SAASC,UAAUC,UAAU,QAAQ,cAAc;AAEnD,SAASC,CAAC,QAAQ,MAAM;AAExB,SAASC,cAAc,QAAQ,4BAA4B;AAE3D,MAAMC,qBAAqBF,EAAEG,MAAM,CAAC;IAClCC,OAAOJ,EAAEK,MAAM,GAAGC,QAAQ;IAC1BC,UAAUP,EAAEK,MAAM,GAAGC,QAAQ;AAC/B;AAEA,OAAO,MAAME,0BAA0B,CACrCC,eACAC;IAEA,MAAMC,WAAqB;QACzBC,MAAMhB,eAAeiB,YAAY;QACjCC,QAAQ;QACRC,SAAS,OAAMC;YACb,MAAM,EAAEC,MAAM,EAAE,GAAGD,IAAIE,OAAO;YAC9B,MAAMC,SAASjB,mBAAmBkB,SAAS,CAACJ,IAAIK,KAAK;YACrD,IAAI,CAACF,OAAOG,OAAO,EAAE;gBACnB,OAAOC,SAASC,IAAI,CAAC;oBAAEC,SAASN,OAAOO,KAAK,CAACD,OAAO;gBAAC,GAAG;oBAAE3B,QAAQC,WAAW4B,WAAW;gBAAC;YAC3F;YACA,MAAMC,cAAc,MAAM3B,eAAegB;YACzC,MAAMY,UAAU,MAAMD,YAAYE,UAAU,CAACC,GAAG,CAACC,UAAU,CAAC;gBAC1DC,SAASjB,IAAIiB,OAAO;YACtB;YACA,IAAI,CAACJ,SAAS;gBACZ,OAAON,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAAmB,GAAG;oBAAE3B,QAAQC,WAAWmC,YAAY;gBAAC;YAC1F;YACA,MAAM,EAAE9B,KAAK,EAAEG,QAAQ,EAAE,GAAGY,OAAOgB,IAAI;YACvC,MAAMC,SAAS,MAAMpB,IAAIE,OAAO,CAACmB,IAAI,CAAC;gBACpCC,YAAa7B,cAAc8B,gBAAgB,EAAEC,QAC3C3C,UAAU0C,gBAAgB;gBAC5BE,OAAO;oBACLrC,OAAO;wBAAEsC,QAAQtC;oBAAM;gBACzB;gBACAuC,OAAO;YACT;YACA,IAAIP,OAAOQ,IAAI,CAACC,MAAM,KAAK,GAAG;gBAC5B,OAAOtB,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAAgB,GAAG;oBAAE3B,QAAQC,WAAWmC,YAAY;gBAAC;YACvF;YACA,MAAMY,OAAQV,OAAOQ,IAAI,CAAC,EAAE,EAAUE;YACtC,MAAM9B,IAAIE,OAAO,CAAC6B,MAAM,CAAC;gBACvBT,YAAY5B;gBACZsC,IAAInB,QAAQoB,IAAI,CAACD,EAAE;gBACnBb,MAAM;oBACJW,MAAMA;gBACR;gBACAI,gBAAgB;YAClB;YACA,MAAMlC,IAAIE,OAAO,CAACiC,MAAM,CAAC;gBACvBb,YAAa7B,cAAc8B,gBAAgB,EAAEC,QAC3C3C,UAAU0C,gBAAgB;gBAC5BE,OAAO;oBACLrC,OAAO;wBACLsC,QAAQtC;oBACV;gBACF;YACF;YACA,MAAMgD,WAAW,IAAI7B,SAAS,MAAM;gBAClCzB,QAAQ;gBACRmC,SAAS;oBACPoB,UAAU9C,YAAYU,OAAOqC,MAAM,CAACC,KAAK;gBAC3C;YACF;YACA,OAAOH;QACT;IACF;IAEA,OAAOzC;AACT,EAAE"}

package/dist/better-auth/plugin/lib/build-collections/users/hooks/after-login.d.ts

@@ -0,0 +1,6 @@
+import type { CollectionAfterLoginHook } from 'payload';
+/**
+ * This hook is used to sync the admin login token with better-auth session token
+ * It also creates a new session in better-auth
+ */
+export declare function getAfterLoginHook(): CollectionAfterLoginHook;

package/dist/better-auth/plugin/lib/build-collections/users/hooks/after-login.js

@@ -0,0 +1,79 @@
+import { baModelKey } from "@/better-auth/plugin/constants";
+import { getCollectionByModelKey } from "@/better-auth/plugin/helpers/get-collection";
+import { getIp } from "@/better-auth/plugin/helpers/get-ip";
+import { prepareSessionData } from "@/better-auth/plugin/helpers/prepare-session-data";
+import { getPayloadAuth } from "@/better-auth/plugin/lib/get-payload-auth";
+import { generateId } from "../../../../..";
+import { createAuthMiddleware } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { parseSetCookie } from "next/dist/compiled/@edge-runtime/cookies";
+import { cookies } from "next/headers";
+/**
+ * This hook is used to sync the admin login token with better-auth session token
+ * It also creates a new session in better-auth
+ */ export function getAfterLoginHook() {
+    const hook = async ({ req, user })=>{
+        const config = req.payload.config;
+        const payload = await getPayloadAuth(config);
+        const collections = req.payload.collections;
+        const userCollection = getCollectionByModelKey(collections, baModelKey.user);
+        const sessionCollection = getCollectionByModelKey(collections, baModelKey.session);
+        const cookieStore = await cookies();
+        const authContext = await payload.betterAuth.$context;
+        const sessionExpiration = payload.betterAuth.options.session?.expiresIn ?? 60 * 60 * 24 * 7; // 7 days
+        // we can't use internal adapter as we can cause a race condition unless we pass req to the payload.create
+        const session = await payload.create({
+            collection: sessionCollection.slug,
+            data: {
+                ipAddress: getIp(req.headers, payload.betterAuth.options) ?? '',
+                userAgent: req.headers?.get('user-agent') ?? '',
+                user: user.id,
+                token: generateId(32),
+                expiresAt: new Date(Date.now() + sessionExpiration * 1000).toISOString()
+            },
+            req
+        });
+        const betterAuthHandleRequest = createAuthMiddleware(async (ctx)=>{
+            ctx.context = {
+                ...authContext,
+                user
+            };
+            await ctx.setSignedCookie(ctx.context.authCookies.sessionToken.name, session.token, ctx.context.secret, ctx.context.authCookies.sessionToken.options);
+            const filteredSessionData = await prepareSessionData({
+                sessionData: {
+                    session,
+                    user
+                },
+                usersCollection: userCollection,
+                sessionsCollection: sessionCollection
+            });
+            if (filteredSessionData) {
+                await setSessionCookie(ctx, filteredSessionData);
+            }
+            if ('responseHeaders' in ctx) {
+                return ctx.responseHeaders;
+            }
+            return null;
+        });
+        // Create a modified request object that matches the expected MiddlewareInputContext type
+        const modifiedReq = {
+            ...req,
+            body: undefined
+        };
+        const responseHeaders = await betterAuthHandleRequest(modifiedReq);
+        const responseCookies = responseHeaders?.getSetCookie().map((cookie)=>parseSetCookie(cookie)).filter(Boolean);
+        if (responseCookies) {
+            for (const cookieData of responseCookies){
+                const { name, value, ...options } = cookieData;
+                cookieStore.set({
+                    ...options,
+                    name,
+                    value: decodeURIComponent(value)
+                });
+            }
+        }
+    };
+    return hook;
+}
+
+//# sourceMappingURL=after-login.js.map

package/dist/better-auth/plugin/lib/build-collections/users/hooks/after-login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../src/better-auth/plugin/lib/build-collections/users/hooks/after-login.ts"],"sourcesContent":["import { baModelKey } from '@/better-auth/plugin/constants';\nimport { getCollectionByModelKey } from '@/better-auth/plugin/helpers/get-collection';\nimport { getIp } from '@/better-auth/plugin/helpers/get-ip';\nimport { prepareSessionData } from '@/better-auth/plugin/helpers/prepare-session-data';\nimport { getPayloadAuth } from '@/better-auth/plugin/lib/get-payload-auth';\nimport { type Session, generateId } from 'better-auth';\nimport { createAuthMiddleware } from 'better-auth/api';\nimport { setSessionCookie } from 'better-auth/cookies';\nimport { type ResponseCookie, parseSetCookie } from 'next/dist/compiled/@edge-runtime/cookies';\nimport { cookies } from 'next/headers';\nimport type { CollectionAfterLoginHook, CollectionSlug } from 'payload';\n/**\n * This hook is used to sync the admin login token with better-auth session token\n * It also creates a new session in better-auth\n */\nexport function getAfterLoginHook() {\n  const hook: CollectionAfterLoginHook = async ({ req, user }) => {\n    const config = req.payload.config;\n    const payload = await getPayloadAuth(config);\n    const collections = req.payload.collections;\n    const userCollection = getCollectionByModelKey(collections, baModelKey.user);\n    const sessionCollection = getCollectionByModelKey(collections, baModelKey.session);\n    const cookieStore = await cookies();\n    const authContext = await payload.betterAuth.$context;\n    const sessionExpiration = payload.betterAuth.options.session?.expiresIn ?? 60 * 60 * 24 * 7; // 7 days\n    // we can't use internal adapter as we can cause a race condition unless we pass req to the payload.create\n    const session = (await payload.create({\n      collection: sessionCollection.slug as CollectionSlug,\n      data: {\n        ipAddress: getIp(req.headers, payload.betterAuth.options) ?? '',\n        userAgent: req.headers?.get('user-agent') ?? '',\n        user: user.id,\n        token: generateId(32),\n        expiresAt: new Date(Date.now() + sessionExpiration * 1000).toISOString(),\n        // Using Record<string, unknown> because PayloadCMS create data structure varies by collection configuration\n      } as /* Using Record<string, unknown> because PayloadCMS create data structure varies by collection configuration */ Record<\n        string,\n        unknown\n      >,\n      req,\n    })) as unknown as Session;\n\n    const betterAuthHandleRequest = createAuthMiddleware(async (ctx): Promise<Headers | null> => {\n      ctx.context = { ...authContext, user };\n      await ctx.setSignedCookie(\n        ctx.context.authCookies.sessionToken.name,\n        session.token,\n        ctx.context.secret,\n        ctx.context.authCookies.sessionToken.options\n      );\n      const filteredSessionData = await prepareSessionData({\n        sessionData: { session, user },\n        usersCollection: userCollection,\n        sessionsCollection: sessionCollection,\n      });\n      if (filteredSessionData) {\n        await setSessionCookie(ctx, filteredSessionData);\n      }\n      if ('responseHeaders' in ctx) {\n        return ctx.responseHeaders as Headers;\n      }\n      return null;\n    });\n\n    // Create a modified request object that matches the expected MiddlewareInputContext type\n    const modifiedReq = {\n      ...req,\n      body: undefined, // Explicitly set body to undefined to satisfy type constraint\n    };\n\n    const responseHeaders = await betterAuthHandleRequest(modifiedReq);\n    const responseCookies = responseHeaders\n      ?.getSetCookie()\n      .map(cookie => parseSetCookie(cookie))\n      .filter(Boolean) as ResponseCookie[];\n\n    if (responseCookies) {\n      for (const cookieData of responseCookies) {\n        const { name, value, ...options } = cookieData;\n        cookieStore.set({\n          ...options,\n          name,\n          value: decodeURIComponent(value),\n        });\n      }\n    }\n  };\n\n  return hook as CollectionAfterLoginHook;\n}\n"],"names":["baModelKey","getCollectionByModelKey","getIp","prepareSessionData","getPayloadAuth","generateId","createAuthMiddleware","setSessionCookie","parseSetCookie","cookies","getAfterLoginHook","hook","req","user","config","payload","collections","userCollection","sessionCollection","session","cookieStore","authContext","betterAuth","$context","sessionExpiration","options","expiresIn","create","collection","slug","data","ipAddress","headers","userAgent","get","id","token","expiresAt","Date","now","toISOString","betterAuthHandleRequest","ctx","context","setSignedCookie","authCookies","sessionToken","name","secret","filteredSessionData","sessionData","usersCollection","sessionsCollection","responseHeaders","modifiedReq","body","undefined","responseCookies","getSetCookie","map","cookie","filter","Boolean","cookieData","value","set","decodeURIComponent"],"mappings":"AAAA,SAASA,UAAU,QAAQ,iCAAiC;AAC5D,SAASC,uBAAuB,QAAQ,8CAA8C;AACtF,SAASC,KAAK,QAAQ,sCAAsC;AAC5D,SAASC,kBAAkB,QAAQ,oDAAoD;AACvF,SAASC,cAAc,QAAQ,4CAA4C;AAC3E,SAAuBC,UAAU,QAAQ,iBAAc;AACvD,SAASC,oBAAoB,QAAQ,kBAAkB;AACvD,SAASC,gBAAgB,QAAQ,sBAAsB;AACvD,SAA8BC,cAAc,QAAQ,2CAA2C;AAC/F,SAASC,OAAO,QAAQ,eAAe;AAEvC;;;CAGC,GACD,OAAO,SAASC;IACd,MAAMC,OAAiC,OAAO,EAAEC,GAAG,EAAEC,IAAI,EAAE;QACzD,MAAMC,SAASF,IAAIG,OAAO,CAACD,MAAM;QACjC,MAAMC,UAAU,MAAMX,eAAeU;QACrC,MAAME,cAAcJ,IAAIG,OAAO,CAACC,WAAW;QAC3C,MAAMC,iBAAiBhB,wBAAwBe,aAAahB,WAAWa,IAAI;QAC3E,MAAMK,oBAAoBjB,wBAAwBe,aAAahB,WAAWmB,OAAO;QACjF,MAAMC,cAAc,MAAMX;QAC1B,MAAMY,cAAc,MAAMN,QAAQO,UAAU,CAACC,QAAQ;QACrD,MAAMC,oBAAoBT,QAAQO,UAAU,CAACG,OAAO,CAACN,OAAO,EAAEO,aAAa,KAAK,KAAK,KAAK,GAAG,SAAS;QACtG,0GAA0G;QAC1G,MAAMP,UAAW,MAAMJ,QAAQY,MAAM,CAAC;YACpCC,YAAYV,kBAAkBW,IAAI;YAClCC,MAAM;gBACJC,WAAW7B,MAAMU,IAAIoB,OAAO,EAAEjB,QAAQO,UAAU,CAACG,OAAO,KAAK;gBAC7DQ,WAAWrB,IAAIoB,OAAO,EAAEE,IAAI,iBAAiB;gBAC7CrB,MAAMA,KAAKsB,EAAE;gBACbC,OAAO/B,WAAW;gBAClBgC,WAAW,IAAIC,KAAKA,KAAKC,GAAG,KAAKf,oBAAoB,MAAMgB,WAAW;YAExE;YAIA5B;QACF;QAEA,MAAM6B,0BAA0BnC,qBAAqB,OAAOoC;YAC1DA,IAAIC,OAAO,GAAG;gBAAE,GAAGtB,WAAW;gBAAER;YAAK;YACrC,MAAM6B,IAAIE,eAAe,CACvBF,IAAIC,OAAO,CAACE,WAAW,CAACC,YAAY,CAACC,IAAI,EACzC5B,QAAQiB,KAAK,EACbM,IAAIC,OAAO,CAACK,MAAM,EAClBN,IAAIC,OAAO,CAACE,WAAW,CAACC,YAAY,CAACrB,OAAO;YAE9C,MAAMwB,sBAAsB,MAAM9C,mBAAmB;gBACnD+C,aAAa;oBAAE/B;oBAASN;gBAAK;gBAC7BsC,iBAAiBlC;gBACjBmC,oBAAoBlC;YACtB;YACA,IAAI+B,qBAAqB;gBACvB,MAAM1C,iBAAiBmC,KAAKO;YAC9B;YACA,IAAI,qBAAqBP,KAAK;gBAC5B,OAAOA,IAAIW,eAAe;YAC5B;YACA,OAAO;QACT;QAEA,yFAAyF;QACzF,MAAMC,cAAc;YAClB,GAAG1C,GAAG;YACN2C,MAAMC;QACR;QAEA,MAAMH,kBAAkB,MAAMZ,wBAAwBa;QACtD,MAAMG,kBAAkBJ,iBACpBK,eACDC,IAAIC,CAAAA,SAAUpD,eAAeoD,SAC7BC,OAAOC;QAEV,IAAIL,iBAAiB;YACnB,KAAK,MAAMM,cAAcN,gBAAiB;gBACxC,MAAM,EAAEV,IAAI,EAAEiB,KAAK,EAAE,GAAGvC,SAAS,GAAGsC;gBACpC3C,YAAY6C,GAAG,CAAC;oBACd,GAAGxC,OAAO;oBACVsB;oBACAiB,OAAOE,mBAAmBF;gBAC5B;YACF;QACF;IACF;IAEA,OAAOrD;AACT"}

package/dist/better-auth/plugin/lib/build-collections/users/hooks/after-logout.d.ts

@@ -0,0 +1,2 @@
+import type { CollectionAfterLogoutHook } from 'payload';
+export declare function getAfterLogoutHook(): CollectionAfterLogoutHook;

package/dist/better-auth/plugin/lib/build-collections/users/hooks/after-logout.js

@@ -0,0 +1,82 @@
+import { baModelKey } from "@/better-auth/plugin/constants";
+import { getCollectionByModelKey } from "@/better-auth/plugin/helpers/get-collection";
+import { getPayloadAuth } from "@/better-auth/plugin/lib/get-payload-auth";
+import { cookies } from "next/headers";
+export function getAfterLogoutHook() {
+    const hook = async ({ req })=>{
+        const store = await cookies();
+        const payload = await getPayloadAuth(req.payload.config);
+        const { dontRememberToken, sessionData, sessionToken } = (await payload.betterAuth.$context).authCookies;
+        const sessionsSlug = getCollectionByModelKey(req.payload.collections, baModelKey.session).slug;
+        await deleteSessionFromDb(payload, sessionsSlug, store.get(sessionToken.name)?.value, req);
+        const baseNames = [
+            sessionToken.name,
+            sessionData.name,
+            dontRememberToken.name,
+            //This is a hacky wat to delete the admin session cookie (BETTER AUTH HARDCODED THIS)
+            // see https://github.com/better-auth/better-auth/blob/25e82669eed83ba6da063c167e8ae5b7da84ef9f/packages/better-auth/src/plugins/admin/admin.ts#L917C7-L917C23
+            'admin_session'
+        ];
+        const multiBase = `${sessionToken.name}_multi`;
+        const multiCandidates = store.getAll().filter((c)=>c.name.startsWith(multiBase) || c.name.startsWith(`__Secure-${multiBase}`)).map((c)=>c.name);
+        const allNames = [
+            ...baseNames.flatMap((n)=>{
+                const clean = n.replace(/^__Secure-/, '');
+                return [
+                    clean,
+                    `__Secure-${clean}`
+                ];
+            }),
+            ...multiCandidates
+        ];
+        allNames.forEach((n)=>deleteCookie(store, n));
+    };
+    return hook;
+}
+async function deleteSessionFromDb(payload, slug, rawCookieValue, req) {
+    if (!rawCookieValue) return;
+    const [token] = rawCookieValue.split('.');
+    const { docs } = await payload.find({
+        collection: slug,
+        limit: 1,
+        req,
+        where: {
+            token: {
+                equals: token
+            }
+        }
+    });
+    const session = docs.at(0);
+    if (!session) return;
+    try {
+        await payload.delete({
+            collection: slug,
+            req,
+            where: {
+                id: {
+                    equals: session.id
+                }
+            }
+        });
+    } catch  {
+    // Ignore errors during session deletion
+    }
+}
+/**
+ * Deleting __Secure-* cookies need to set options.secure = true
+ */ function deleteCookie(store, name) {
+    const cookie = store.get(name);
+    if (!cookie) return;
+    const isSecure = name.startsWith('__Secure-') || name.startsWith('__Host-');
+    // Using Record<string, unknown> because cookie options structure varies by Next.js cookie store implementation
+    const options = {
+        httpOnly: true,
+        maxAge: 0,
+        path: '/',
+        sameSite: 'lax'
+    };
+    if (isSecure) options.secure = true;
+    store.set(name, '', options);
+}
+
+//# sourceMappingURL=after-logout.js.map

package/dist/better-auth/plugin/lib/build-collections/users/hooks/after-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../src/better-auth/plugin/lib/build-collections/users/hooks/after-logout.ts"],"sourcesContent":["import { baModelKey } from '@/better-auth/plugin/constants';\nimport { getCollectionByModelKey } from '@/better-auth/plugin/helpers/get-collection';\nimport { getPayloadAuth } from '@/better-auth/plugin/lib/get-payload-auth';\nimport { cookies } from 'next/headers';\n\nimport type { CollectionAfterLogoutHook, CollectionSlug, PayloadRequest } from 'payload';\n\nexport function getAfterLogoutHook() {\n  const hook: CollectionAfterLogoutHook = async ({ req }) => {\n    const store = await cookies();\n    const payload = await getPayloadAuth(req.payload.config);\n\n    const { dontRememberToken, sessionData, sessionToken } = (await payload.betterAuth.$context)\n      .authCookies;\n\n    const sessionsSlug = getCollectionByModelKey(req.payload.collections, baModelKey.session).slug;\n\n    await deleteSessionFromDb(payload, sessionsSlug, store.get(sessionToken.name)?.value, req);\n\n    const baseNames = [\n      sessionToken.name,\n      sessionData.name,\n      dontRememberToken.name,\n      //This is a hacky wat to delete the admin session cookie (BETTER AUTH HARDCODED THIS)\n      // see https://github.com/better-auth/better-auth/blob/25e82669eed83ba6da063c167e8ae5b7da84ef9f/packages/better-auth/src/plugins/admin/admin.ts#L917C7-L917C23\n      'admin_session',\n    ];\n\n    const multiBase = `${sessionToken.name}_multi`;\n    const multiCandidates = store\n      .getAll()\n      .filter(c => c.name.startsWith(multiBase) || c.name.startsWith(`__Secure-${multiBase}`))\n      .map(c => c.name);\n\n    const allNames = [\n      ...baseNames.flatMap(n => {\n        const clean = n.replace(/^__Secure-/, '');\n        return [clean, `__Secure-${clean}`];\n      }),\n      ...multiCandidates,\n    ];\n\n    allNames.forEach(n => deleteCookie(store, n));\n  };\n\n  return hook;\n}\n\nasync function deleteSessionFromDb(\n  payload: Awaited<ReturnType<typeof getPayloadAuth>>,\n  slug: string,\n  rawCookieValue: string | undefined,\n  req: PayloadRequest\n) {\n  if (!rawCookieValue) return;\n  const [token] = rawCookieValue.split('.');\n  const { docs } = await payload.find({\n    collection: slug as CollectionSlug,\n    limit: 1,\n    req,\n    where: { token: { equals: token } },\n  });\n  const session = docs.at(0);\n  if (!session) return;\n  try {\n    await payload.delete({\n      collection: slug as CollectionSlug,\n      req,\n      where: { id: { equals: session.id } },\n    });\n  } catch {\n    // Ignore errors during session deletion\n  }\n}\n\n/**\n * Deleting __Secure-* cookies need to set options.secure = true\n */\nfunction deleteCookie(store: Awaited<ReturnType<typeof cookies>>, name: string) {\n  const cookie = store.get(name);\n  if (!cookie) return;\n\n  const isSecure = name.startsWith('__Secure-') || name.startsWith('__Host-');\n\n  // Using Record<string, unknown> because cookie options structure varies by Next.js cookie store implementation\n  const options: /* Using Record<string, unknown> because cookie options structure varies by Next.js cookie store implementation */ Record<\n    string,\n    unknown\n  > = {\n    httpOnly: true,\n    maxAge: 0,\n    path: '/',\n    sameSite: 'lax',\n  };\n\n  if (isSecure) options.secure = true;\n\n  store.set(name, '', options);\n}\n"],"names":["baModelKey","getCollectionByModelKey","getPayloadAuth","cookies","getAfterLogoutHook","hook","req","store","payload","config","dontRememberToken","sessionData","sessionToken","betterAuth","$context","authCookies","sessionsSlug","collections","session","slug","deleteSessionFromDb","get","name","value","baseNames","multiBase","multiCandidates","getAll","filter","c","startsWith","map","allNames","flatMap","n","clean","replace","forEach","deleteCookie","rawCookieValue","token","split","docs","find","collection","limit","where","equals","at","delete","id","cookie","isSecure","options","httpOnly","maxAge","path","sameSite","secure","set"],"mappings":"AAAA,SAASA,UAAU,QAAQ,iCAAiC;AAC5D,SAASC,uBAAuB,QAAQ,8CAA8C;AACtF,SAASC,cAAc,QAAQ,4CAA4C;AAC3E,SAASC,OAAO,QAAQ,eAAe;AAIvC,OAAO,SAASC;IACd,MAAMC,OAAkC,OAAO,EAAEC,GAAG,EAAE;QACpD,MAAMC,QAAQ,MAAMJ;QACpB,MAAMK,UAAU,MAAMN,eAAeI,IAAIE,OAAO,CAACC,MAAM;QAEvD,MAAM,EAAEC,iBAAiB,EAAEC,WAAW,EAAEC,YAAY,EAAE,GAAG,AAAC,CAAA,MAAMJ,QAAQK,UAAU,CAACC,QAAQ,AAAD,EACvFC,WAAW;QAEd,MAAMC,eAAef,wBAAwBK,IAAIE,OAAO,CAACS,WAAW,EAAEjB,WAAWkB,OAAO,EAAEC,IAAI;QAE9F,MAAMC,oBAAoBZ,SAASQ,cAAcT,MAAMc,GAAG,CAACT,aAAaU,IAAI,GAAGC,OAAOjB;QAEtF,MAAMkB,YAAY;YAChBZ,aAAaU,IAAI;YACjBX,YAAYW,IAAI;YAChBZ,kBAAkBY,IAAI;YACtB,qFAAqF;YACrF,8JAA8J;YAC9J;SACD;QAED,MAAMG,YAAY,GAAGb,aAAaU,IAAI,CAAC,MAAM,CAAC;QAC9C,MAAMI,kBAAkBnB,MACrBoB,MAAM,GACNC,MAAM,CAACC,CAAAA,IAAKA,EAAEP,IAAI,CAACQ,UAAU,CAACL,cAAcI,EAAEP,IAAI,CAACQ,UAAU,CAAC,CAAC,SAAS,EAAEL,WAAW,GACrFM,GAAG,CAACF,CAAAA,IAAKA,EAAEP,IAAI;QAElB,MAAMU,WAAW;eACZR,UAAUS,OAAO,CAACC,CAAAA;gBACnB,MAAMC,QAAQD,EAAEE,OAAO,CAAC,cAAc;gBACtC,OAAO;oBAACD;oBAAO,CAAC,SAAS,EAAEA,OAAO;iBAAC;YACrC;eACGT;SACJ;QAEDM,SAASK,OAAO,CAACH,CAAAA,IAAKI,aAAa/B,OAAO2B;IAC5C;IAEA,OAAO7B;AACT;AAEA,eAAee,oBACbZ,OAAmD,EACnDW,IAAY,EACZoB,cAAkC,EAClCjC,GAAmB;IAEnB,IAAI,CAACiC,gBAAgB;IACrB,MAAM,CAACC,MAAM,GAAGD,eAAeE,KAAK,CAAC;IACrC,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMlC,QAAQmC,IAAI,CAAC;QAClCC,YAAYzB;QACZ0B,OAAO;QACPvC;QACAwC,OAAO;YAAEN,OAAO;gBAAEO,QAAQP;YAAM;QAAE;IACpC;IACA,MAAMtB,UAAUwB,KAAKM,EAAE,CAAC;IACxB,IAAI,CAAC9B,SAAS;IACd,IAAI;QACF,MAAMV,QAAQyC,MAAM,CAAC;YACnBL,YAAYzB;YACZb;YACAwC,OAAO;gBAAEI,IAAI;oBAAEH,QAAQ7B,QAAQgC,EAAE;gBAAC;YAAE;QACtC;IACF,EAAE,OAAM;IACN,wCAAwC;IAC1C;AACF;AAEA;;CAEC,GACD,SAASZ,aAAa/B,KAA0C,EAAEe,IAAY;IAC5E,MAAM6B,SAAS5C,MAAMc,GAAG,CAACC;IACzB,IAAI,CAAC6B,QAAQ;IAEb,MAAMC,WAAW9B,KAAKQ,UAAU,CAAC,gBAAgBR,KAAKQ,UAAU,CAAC;IAEjE,+GAA+G;IAC/G,MAAMuB,UAGF;QACFC,UAAU;QACVC,QAAQ;QACRC,MAAM;QACNC,UAAU;IACZ;IAEA,IAAIL,UAAUC,QAAQK,MAAM,GAAG;IAE/BnD,MAAMoD,GAAG,CAACrC,MAAM,IAAI+B;AACtB"}

package/dist/better-auth/plugin/lib/build-collections/users/hooks/before-delete.d.ts

@@ -0,0 +1,2 @@
+import { type CollectionBeforeDeleteHook } from 'payload';
+export declare function getBeforeDeleteHook(): CollectionBeforeDeleteHook;

package/dist/better-auth/plugin/lib/build-collections/users/hooks/before-delete.js

@@ -0,0 +1,54 @@
+import { baModelKey } from "@/better-auth/plugin/constants";
+import { getCollectionByModelKey } from "@/better-auth/plugin/helpers/get-collection";
+import { commitTransaction, initTransaction, killTransaction } from "payload";
+export function getBeforeDeleteHook() {
+    const hook = async ({ req, id })=>{
+        const collections = req.payload.collections;
+        const accountsSlug = getCollectionByModelKey(collections, baModelKey.account).slug;
+        const sessionsSlug = getCollectionByModelKey(collections, baModelKey.session).slug;
+        const verificationsSlug = getCollectionByModelKey(collections, baModelKey.verification).slug;
+        try {
+            const { payload } = req;
+            const userId = id;
+            const shouldCommit = await initTransaction(req);
+            await payload.delete({
+                collection: accountsSlug,
+                where: {
+                    user: {
+                        equals: userId
+                    }
+                },
+                req
+            });
+            await payload.delete({
+                collection: sessionsSlug,
+                where: {
+                    user: {
+                        equals: userId
+                    }
+                },
+                req
+            });
+            await payload.delete({
+                collection: verificationsSlug,
+                where: {
+                    value: {
+                        like: `"${userId}"`
+                    }
+                },
+                req
+            });
+            if (shouldCommit) {
+                await commitTransaction(req);
+            }
+            return;
+        } catch (error) {
+            await killTransaction(req);
+            console.error('Error in user afterDelete hook:', error);
+            return;
+        }
+    };
+    return hook;
+}
+
+//# sourceMappingURL=before-delete.js.map

package/dist/better-auth/plugin/lib/build-collections/users/hooks/before-delete.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../src/better-auth/plugin/lib/build-collections/users/hooks/before-delete.ts"],"sourcesContent":["import { baModelKey } from '@/better-auth/plugin/constants';\nimport { getCollectionByModelKey } from '@/better-auth/plugin/helpers/get-collection';\nimport {\n  type CollectionBeforeDeleteHook,\n  type CollectionSlug,\n  commitTransaction,\n  initTransaction,\n  killTransaction,\n} from 'payload';\n\nexport function getBeforeDeleteHook(): CollectionBeforeDeleteHook {\n  const hook: CollectionBeforeDeleteHook = async ({ req, id }) => {\n    const collections = req.payload.collections;\n    const accountsSlug = getCollectionByModelKey(collections, baModelKey.account).slug;\n    const sessionsSlug = getCollectionByModelKey(collections, baModelKey.session).slug;\n    const verificationsSlug = getCollectionByModelKey(collections, baModelKey.verification).slug;\n    try {\n      const { payload } = req;\n      const userId = id;\n\n      const shouldCommit = await initTransaction(req);\n\n      await payload.delete({\n        collection: accountsSlug as CollectionSlug,\n        where: {\n          user: {\n            equals: userId,\n          },\n        },\n        req,\n      });\n\n      await payload.delete({\n        collection: sessionsSlug as CollectionSlug,\n        where: {\n          user: {\n            equals: userId,\n          },\n        },\n        req,\n      });\n\n      await payload.delete({\n        collection: verificationsSlug as CollectionSlug,\n        where: {\n          value: {\n            like: `\"${userId}\"`,\n          },\n        },\n        req,\n      });\n\n      if (shouldCommit) {\n        await commitTransaction(req);\n      }\n\n      return;\n    } catch (error) {\n      await killTransaction(req);\n      console.error('Error in user afterDelete hook:', error);\n      return;\n    }\n  };\n\n  return hook;\n}\n"],"names":["baModelKey","getCollectionByModelKey","commitTransaction","initTransaction","killTransaction","getBeforeDeleteHook","hook","req","id","collections","payload","accountsSlug","account","slug","sessionsSlug","session","verificationsSlug","verification","userId","shouldCommit","delete","collection","where","user","equals","value","like","error","console"],"mappings":"AAAA,SAASA,UAAU,QAAQ,iCAAiC;AAC5D,SAASC,uBAAuB,QAAQ,8CAA8C;AACtF,SAGEC,iBAAiB,EACjBC,eAAe,EACfC,eAAe,QACV,UAAU;AAEjB,OAAO,SAASC;IACd,MAAMC,OAAmC,OAAO,EAAEC,GAAG,EAAEC,EAAE,EAAE;QACzD,MAAMC,cAAcF,IAAIG,OAAO,CAACD,WAAW;QAC3C,MAAME,eAAeV,wBAAwBQ,aAAaT,WAAWY,OAAO,EAAEC,IAAI;QAClF,MAAMC,eAAeb,wBAAwBQ,aAAaT,WAAWe,OAAO,EAAEF,IAAI;QAClF,MAAMG,oBAAoBf,wBAAwBQ,aAAaT,WAAWiB,YAAY,EAAEJ,IAAI;QAC5F,IAAI;YACF,MAAM,EAAEH,OAAO,EAAE,GAAGH;YACpB,MAAMW,SAASV;YAEf,MAAMW,eAAe,MAAMhB,gBAAgBI;YAE3C,MAAMG,QAAQU,MAAM,CAAC;gBACnBC,YAAYV;gBACZW,OAAO;oBACLC,MAAM;wBACJC,QAAQN;oBACV;gBACF;gBACAX;YACF;YAEA,MAAMG,QAAQU,MAAM,CAAC;gBACnBC,YAAYP;gBACZQ,OAAO;oBACLC,MAAM;wBACJC,QAAQN;oBACV;gBACF;gBACAX;YACF;YAEA,MAAMG,QAAQU,MAAM,CAAC;gBACnBC,YAAYL;gBACZM,OAAO;oBACLG,OAAO;wBACLC,MAAM,CAAC,CAAC,EAAER,OAAO,CAAC,CAAC;oBACrB;gBACF;gBACAX;YACF;YAEA,IAAIY,cAAc;gBAChB,MAAMjB,kBAAkBK;YAC1B;YAEA;QACF,EAAE,OAAOoB,OAAO;YACd,MAAMvB,gBAAgBG;YACtBqB,QAAQD,KAAK,CAAC,mCAAmCA;YACjD;QACF;IACF;IAEA,OAAOrB;AACT"}

package/dist/better-auth/plugin/lib/build-collections/users/hooks/before-login.d.ts

@@ -0,0 +1,6 @@
+import type { BetterAuthOptions } from '@/better-auth/plugin/types';
+import { type CollectionBeforeLoginHook } from 'payload';
+/**
+ * This hook blocks login attempts if email verification is required and the user's email is not verified
+ */
+export declare function getBeforeLoginHook(betterAuthOptions: BetterAuthOptions): CollectionBeforeLoginHook;

package/dist/better-auth/plugin/lib/build-collections/users/hooks/before-login.js

@@ -0,0 +1,15 @@
+import { APIError } from "payload";
+/**
+ * This hook blocks login attempts if email verification is required and the user's email is not verified
+ */ export function getBeforeLoginHook(betterAuthOptions) {
+    const hook = async ({ user })=>{
+        const requireEmailVerification = betterAuthOptions.emailAndPassword?.requireEmailVerification ?? false;
+        if (requireEmailVerification && !user.emailVerified) {
+            throw new APIError('Email verification required. Please verify your email before logging in.', 403);
+        }
+        return user;
+    };
+    return hook;
+}
+
+//# sourceMappingURL=before-login.js.map

package/dist/better-auth/plugin/lib/build-collections/users/hooks/before-login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../src/better-auth/plugin/lib/build-collections/users/hooks/before-login.ts"],"sourcesContent":["import type { BetterAuthOptions } from '@/better-auth/plugin/types';\nimport { APIError, type CollectionBeforeLoginHook } from 'payload';\n/**\n * This hook blocks login attempts if email verification is required and the user's email is not verified\n */\nexport function getBeforeLoginHook(betterAuthOptions: BetterAuthOptions) {\n  const hook: CollectionBeforeLoginHook = async ({ user }) => {\n    const requireEmailVerification =\n      betterAuthOptions.emailAndPassword?.requireEmailVerification ?? false;\n\n    if (requireEmailVerification && !user.emailVerified) {\n      throw new APIError(\n        'Email verification required. Please verify your email before logging in.',\n        403\n      );\n    }\n\n    return user;\n  };\n\n  return hook;\n}\n"],"names":["APIError","getBeforeLoginHook","betterAuthOptions","hook","user","requireEmailVerification","emailAndPassword","emailVerified"],"mappings":"AACA,SAASA,QAAQ,QAAwC,UAAU;AACnE;;CAEC,GACD,OAAO,SAASC,mBAAmBC,iBAAoC;IACrE,MAAMC,OAAkC,OAAO,EAAEC,IAAI,EAAE;QACrD,MAAMC,2BACJH,kBAAkBI,gBAAgB,EAAED,4BAA4B;QAElE,IAAIA,4BAA4B,CAACD,KAAKG,aAAa,EAAE;YACnD,MAAM,IAAIP,SACR,4EACA;QAEJ;QAEA,OAAOI;IACT;IAEA,OAAOD;AACT"}

package/dist/better-auth/plugin/lib/build-collections/users/hooks/index.d.ts

@@ -0,0 +1,6 @@
+export * from './after-login';
+export * from './after-logout';
+export * from './before-delete';
+export * from './before-login';
+export * from './on-verified-change';
+export * from './sync-account';

package/dist/better-auth/plugin/lib/build-collections/users/hooks/index.js

@@ -0,0 +1,8 @@
+export * from "./after-login";
+export * from "./after-logout";
+export * from "./before-delete";
+export * from "./before-login";
+export * from "./on-verified-change";
+export * from "./sync-account";
+
+//# sourceMappingURL=index.js.map

package/dist/better-auth/plugin/lib/build-collections/users/hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../src/better-auth/plugin/lib/build-collections/users/hooks/index.ts"],"sourcesContent":["export * from './after-login';\nexport * from './after-logout';\nexport * from './before-delete';\nexport * from './before-login';\nexport * from './on-verified-change';\nexport * from './sync-account';\n"],"names":[],"mappings":"AAAA,cAAc,gBAAgB;AAC9B,cAAc,iBAAiB;AAC/B,cAAc,kBAAkB;AAChC,cAAc,iBAAiB;AAC/B,cAAc,uBAAuB;AACrC,cAAc,iBAAiB"}

package/dist/better-auth/plugin/lib/build-collections/users/hooks/on-verified-change.d.ts

@@ -0,0 +1,2 @@
+import type { CollectionBeforeChangeHook } from 'payload';
+export declare function getOnVerifiedChangeHook(): CollectionBeforeChangeHook;

package/dist/better-auth/plugin/lib/build-collections/users/hooks/on-verified-change.js

@@ -0,0 +1,17 @@
+export function getOnVerifiedChangeHook() {
+    const hook = async ({ data, originalDoc })=>{
+        const isVerifiedChangingToTrue = !!data._verified && !originalDoc?._verified;
+        const isEmailVerifiedChangingToTrue = !!data.emailVerified && !originalDoc?.emailVerified;
+        if (!isVerifiedChangingToTrue && !isEmailVerifiedChangingToTrue) {
+            return data;
+        }
+        return {
+            ...data,
+            _verified: true,
+            emailVerified: true
+        };
+    };
+    return hook;
+}
+
+//# sourceMappingURL=on-verified-change.js.map

package/dist/better-auth/plugin/lib/build-collections/users/hooks/on-verified-change.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../src/better-auth/plugin/lib/build-collections/users/hooks/on-verified-change.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload';\n\nexport function getOnVerifiedChangeHook() {\n  const hook: CollectionBeforeChangeHook = async ({ data, originalDoc }) => {\n    const isVerifiedChangingToTrue = !!data._verified && !originalDoc?._verified;\n    const isEmailVerifiedChangingToTrue = !!data.emailVerified && !originalDoc?.emailVerified;\n\n    if (!isVerifiedChangingToTrue && !isEmailVerifiedChangingToTrue) {\n      return data;\n    }\n\n    return {\n      ...data,\n      _verified: true,\n      emailVerified: true,\n    } as typeof data;\n  };\n\n  return hook;\n}\n"],"names":["getOnVerifiedChangeHook","hook","data","originalDoc","isVerifiedChangingToTrue","_verified","isEmailVerifiedChangingToTrue","emailVerified"],"mappings":"AAEA,OAAO,SAASA;IACd,MAAMC,OAAmC,OAAO,EAAEC,IAAI,EAAEC,WAAW,EAAE;QACnE,MAAMC,2BAA2B,CAAC,CAACF,KAAKG,SAAS,IAAI,CAACF,aAAaE;QACnE,MAAMC,gCAAgC,CAAC,CAACJ,KAAKK,aAAa,IAAI,CAACJ,aAAaI;QAE5E,IAAI,CAACH,4BAA4B,CAACE,+BAA+B;YAC/D,OAAOJ;QACT;QAEA,OAAO;YACL,GAAGA,IAAI;YACPG,WAAW;YACXE,eAAe;QACjB;IACF;IAEA,OAAON;AACT"}

package/dist/better-auth/plugin/lib/build-collections/users/hooks/sync-account.d.ts

@@ -0,0 +1,2 @@
+import type { CollectionAfterChangeHook } from 'payload';
+export declare function getSyncAccountHook(): CollectionAfterChangeHook;

package/dist/better-auth/plugin/lib/build-collections/users/hooks/sync-account.js

@@ -0,0 +1,91 @@
+import { BETTER_AUTH_CONTEXT_KEY } from "@/better-auth/adapter";
+import { baModelKey } from "@/better-auth/plugin/constants";
+import { getCollectionByModelKey, getCollectionFieldNameByFieldKey } from "@/better-auth/plugin/helpers/get-collection";
+export function getSyncAccountHook() {
+    const hook = async ({ context, doc, operation, req })=>{
+        if (context?.syncPasswordToUser) return doc;
+        if (operation !== 'create' && operation !== 'update') return doc;
+        const collections = req.payload.collections;
+        const userCollection = getCollectionByModelKey(collections, baModelKey.user);
+        const accountCollection = getCollectionByModelKey(collections, baModelKey.account);
+        const userIdFieldName = getCollectionFieldNameByFieldKey(accountCollection, baModelKey.account, 'userId');
+        const accountIdFieldName = getCollectionFieldNameByFieldKey(accountCollection, baModelKey.account, 'accountId');
+        const providerIdFieldName = getCollectionFieldNameByFieldKey(accountCollection, baModelKey.account, 'providerId');
+        const passwordFieldName = getCollectionFieldNameByFieldKey(accountCollection, baModelKey.account, 'password');
+        const user = await req.payload.findByID({
+            collection: userCollection.slug,
+            depth: 0,
+            id: doc.id,
+            req,
+            showHiddenFields: true
+        });
+        const userAny = user;
+        if (!userAny || !userAny.hash || !userAny.salt) return doc;
+        const passwordValue = `${userAny.salt}:${userAny.hash}`;
+        if (operation === 'create' && !(BETTER_AUTH_CONTEXT_KEY in context)) {
+            try {
+                await req.payload.create({
+                    collection: accountCollection.slug,
+                    context: {
+                        syncAccountHook: true
+                    },
+                    data: {
+                        [accountIdFieldName]: doc.id.toString(),
+                        [passwordFieldName]: passwordValue,
+                        [providerIdFieldName]: 'credential',
+                        [userIdFieldName]: doc.id
+                    },
+                    req
+                });
+            } catch (error) {
+                console.error('Failed to create account for user:', error);
+            }
+        }
+        if (operation === 'update') {
+            try {
+                const accounts = await req.payload.find({
+                    collection: accountCollection.slug,
+                    context: {
+                        syncAccountHook: true
+                    },
+                    depth: 0,
+                    req,
+                    where: {
+                        and: [
+                            {
+                                [userIdFieldName]: {
+                                    equals: doc.id
+                                }
+                            },
+                            {
+                                [providerIdFieldName]: {
+                                    equals: 'credential'
+                                }
+                            }
+                        ]
+                    }
+                });
+                const account = accounts.docs.at(0);
+                if (account) {
+                    await req.payload.update({
+                        collection: accountCollection.slug,
+                        context: {
+                            syncAccountHook: true
+                        },
+                        data: {
+                            [passwordFieldName]: passwordValue
+                        },
+                        id: account.id,
+                        req
+                    });
+                }
+            } catch (error) {
+                console.error('Failed to sync hash/salt to account:', error);
+            }
+        }
+        return doc;
+    };
+    return hook;
+}
+
+//# sourceMappingURL=sync-account.js.map

package/dist/better-auth/plugin/lib/build-collections/users/hooks/sync-account.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../src/better-auth/plugin/lib/build-collections/users/hooks/sync-account.ts"],"sourcesContent":["import { BETTER_AUTH_CONTEXT_KEY } from '@/better-auth/adapter';\nimport { baModelKey } from '@/better-auth/plugin/constants';\nimport {\n  getCollectionByModelKey,\n  getCollectionFieldNameByFieldKey,\n} from '@/better-auth/plugin/helpers/get-collection';\n\nimport type { CollectionAfterChangeHook, CollectionSlug } from 'payload';\n\nexport function getSyncAccountHook(): CollectionAfterChangeHook {\n  const hook: CollectionAfterChangeHook = async ({ context, doc, operation, req }) => {\n    if (context?.syncPasswordToUser) return doc;\n\n    if (operation !== 'create' && operation !== 'update') return doc;\n\n    const collections = req.payload.collections;\n    const userCollection = getCollectionByModelKey(collections, baModelKey.user);\n    const accountCollection = getCollectionByModelKey(collections, baModelKey.account);\n\n    const userIdFieldName = getCollectionFieldNameByFieldKey(\n      accountCollection,\n      baModelKey.account,\n      'userId'\n    );\n    const accountIdFieldName = getCollectionFieldNameByFieldKey(\n      accountCollection,\n      baModelKey.account,\n      'accountId'\n    );\n    const providerIdFieldName = getCollectionFieldNameByFieldKey(\n      accountCollection,\n      baModelKey.account,\n      'providerId'\n    );\n    const passwordFieldName = getCollectionFieldNameByFieldKey(\n      accountCollection,\n      baModelKey.account,\n      'password'\n    );\n\n    const user = await req.payload.findByID({\n      collection: userCollection.slug as unknown as CollectionSlug,\n      depth: 0,\n      id: doc.id,\n      req,\n      showHiddenFields: true,\n    });\n\n    const userAny = user as any;\n    if (!userAny || !userAny.hash || !userAny.salt) return doc;\n\n    const passwordValue = `${userAny.salt}:${userAny.hash}`;\n\n    if (operation === 'create' && !(BETTER_AUTH_CONTEXT_KEY in context)) {\n      try {\n        await req.payload.create({\n          collection: accountCollection.slug as unknown as CollectionSlug,\n          context: { syncAccountHook: true },\n          data: {\n            [accountIdFieldName]: doc.id.toString(),\n            [passwordFieldName]: passwordValue,\n            [providerIdFieldName]: 'credential',\n            [userIdFieldName]: doc.id,\n          },\n          req,\n        });\n      } catch (error) {\n        console.error('Failed to create account for user:', error);\n      }\n    }\n\n    if (operation === 'update') {\n      try {\n        const accounts = await req.payload.find({\n          collection: accountCollection.slug as unknown as CollectionSlug,\n          context: { syncAccountHook: true },\n          depth: 0,\n          req,\n          where: {\n            and: [\n              { [userIdFieldName]: { equals: doc.id } },\n              { [providerIdFieldName]: { equals: 'credential' } },\n            ],\n          },\n        });\n\n        const account = accounts.docs.at(0);\n        if (account) {\n          await req.payload.update({\n            collection: accountCollection.slug as unknown as CollectionSlug,\n            context: { syncAccountHook: true },\n            data: {\n              [passwordFieldName]: passwordValue,\n            },\n            id: account.id,\n            req,\n          });\n        }\n      } catch (error) {\n        console.error('Failed to sync hash/salt to account:', error);\n      }\n    }\n\n    return doc;\n  };\n\n  return hook as CollectionAfterChangeHook;\n}\n"],"names":["BETTER_AUTH_CONTEXT_KEY","baModelKey","getCollectionByModelKey","getCollectionFieldNameByFieldKey","getSyncAccountHook","hook","context","doc","operation","req","syncPasswordToUser","collections","payload","userCollection","user","accountCollection","account","userIdFieldName","accountIdFieldName","providerIdFieldName","passwordFieldName","findByID","collection","slug","depth","id","showHiddenFields","userAny","hash","salt","passwordValue","create","syncAccountHook","data","toString","error","console","accounts","find","where","and","equals","docs","at","update"],"mappings":"AAAA,SAASA,uBAAuB,QAAQ,wBAAwB;AAChE,SAASC,UAAU,QAAQ,iCAAiC;AAC5D,SACEC,uBAAuB,EACvBC,gCAAgC,QAC3B,8CAA8C;AAIrD,OAAO,SAASC;IACd,MAAMC,OAAkC,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,SAAS,EAAEC,GAAG,EAAE;QAC7E,IAAIH,SAASI,oBAAoB,OAAOH;QAExC,IAAIC,cAAc,YAAYA,cAAc,UAAU,OAAOD;QAE7D,MAAMI,cAAcF,IAAIG,OAAO,CAACD,WAAW;QAC3C,MAAME,iBAAiBX,wBAAwBS,aAAaV,WAAWa,IAAI;QAC3E,MAAMC,oBAAoBb,wBAAwBS,aAAaV,WAAWe,OAAO;QAEjF,MAAMC,kBAAkBd,iCACtBY,mBACAd,WAAWe,OAAO,EAClB;QAEF,MAAME,qBAAqBf,iCACzBY,mBACAd,WAAWe,OAAO,EAClB;QAEF,MAAMG,sBAAsBhB,iCAC1BY,mBACAd,WAAWe,OAAO,EAClB;QAEF,MAAMI,oBAAoBjB,iCACxBY,mBACAd,WAAWe,OAAO,EAClB;QAGF,MAAMF,OAAO,MAAML,IAAIG,OAAO,CAACS,QAAQ,CAAC;YACtCC,YAAYT,eAAeU,IAAI;YAC/BC,OAAO;YACPC,IAAIlB,IAAIkB,EAAE;YACVhB;YACAiB,kBAAkB;QACpB;QAEA,MAAMC,UAAUb;QAChB,IAAI,CAACa,WAAW,CAACA,QAAQC,IAAI,IAAI,CAACD,QAAQE,IAAI,EAAE,OAAOtB;QAEvD,MAAMuB,gBAAgB,GAAGH,QAAQE,IAAI,CAAC,CAAC,EAAEF,QAAQC,IAAI,EAAE;QAEvD,IAAIpB,cAAc,YAAY,CAAER,CAAAA,2BAA2BM,OAAM,GAAI;YACnE,IAAI;gBACF,MAAMG,IAAIG,OAAO,CAACmB,MAAM,CAAC;oBACvBT,YAAYP,kBAAkBQ,IAAI;oBAClCjB,SAAS;wBAAE0B,iBAAiB;oBAAK;oBACjCC,MAAM;wBACJ,CAACf,mBAAmB,EAAEX,IAAIkB,EAAE,CAACS,QAAQ;wBACrC,CAACd,kBAAkB,EAAEU;wBACrB,CAACX,oBAAoB,EAAE;wBACvB,CAACF,gBAAgB,EAAEV,IAAIkB,EAAE;oBAC3B;oBACAhB;gBACF;YACF,EAAE,OAAO0B,OAAO;gBACdC,QAAQD,KAAK,CAAC,sCAAsCA;YACtD;QACF;QAEA,IAAI3B,cAAc,UAAU;YAC1B,IAAI;gBACF,MAAM6B,WAAW,MAAM5B,IAAIG,OAAO,CAAC0B,IAAI,CAAC;oBACtChB,YAAYP,kBAAkBQ,IAAI;oBAClCjB,SAAS;wBAAE0B,iBAAiB;oBAAK;oBACjCR,OAAO;oBACPf;oBACA8B,OAAO;wBACLC,KAAK;4BACH;gCAAE,CAACvB,gBAAgB,EAAE;oCAAEwB,QAAQlC,IAAIkB,EAAE;gCAAC;4BAAE;4BACxC;gCAAE,CAACN,oBAAoB,EAAE;oCAAEsB,QAAQ;gCAAa;4BAAE;yBACnD;oBACH;gBACF;gBAEA,MAAMzB,UAAUqB,SAASK,IAAI,CAACC,EAAE,CAAC;gBACjC,IAAI3B,SAAS;oBACX,MAAMP,IAAIG,OAAO,CAACgC,MAAM,CAAC;wBACvBtB,YAAYP,kBAAkBQ,IAAI;wBAClCjB,SAAS;4BAAE0B,iBAAiB;wBAAK;wBACjCC,MAAM;4BACJ,CAACb,kBAAkB,EAAEU;wBACvB;wBACAL,IAAIT,QAAQS,EAAE;wBACdhB;oBACF;gBACF;YACF,EAAE,OAAO0B,OAAO;gBACdC,QAAQD,KAAK,CAAC,wCAAwCA;YACxD;QACF;QAEA,OAAO5B;IACT;IAEA,OAAOF;AACT"}

package/dist/better-auth/plugin/lib/build-collections/users/index.d.ts

@@ -0,0 +1,3 @@
+import type { CollectionConfig } from 'payload';
+import type { BuildCollectionProps } from '../../../types';
+export declare function buildUsersCollection({ incomingCollections, pluginOptions, resolvedSchemas, }: BuildCollectionProps): CollectionConfig;