@strapi-community/plugin-better-auth-dashboard 1.0.0 → 1.1.0

package/README.md

@@ -86,6 +86,125 @@ pnpm develop
 
 The dashboard is now available in the Strapi admin panel.
 
+## MCP server integration
+
+This plugin can expose Better Auth **admin and analytics tools** on Strapi's
+native [MCP server](https://docs.strapi.io/cms/features/strapi-mcp-server), so AI
+clients can list, inspect, update and ban users and read sign-up analytics
+through `POST /mcp`. It requires Strapi `>= 5.47`.
+
+Every tool calls the Better Auth `dash()` plugin endpoints — the **same calls the
+dashboard UI makes** — so Better Auth's own business logic runs (validation, ban
+side-effects, stats aggregation). It therefore relies on the same setup the
+dashboard already requires: `dash()` + `jwt()` configured and the default
+`basePath` (`/api/auth`).
+
+The integration is **opt-in** and gated by two switches:
+
+```typescript title="config/server.ts"
+export default ({ env }) => ({
+  // ...existing config
+  mcp: { enabled: true }, // Strapi's own MCP server (serves POST /mcp)
+});
+```
+
+```typescript title="config/plugins.ts"
+export default {
+  "better-auth-dashboard": {
+    config: {
+      mcp: { enabled: true }, // register this plugin's Better Auth tools
+    },
+  },
+};
+```
+
+> [!NOTE]
+> On Strapi versions below 5.47 (no MCP server) the plugin simply skips tool
+> registration — enabling the flag is harmless.
+
+### Authentication & permissions
+
+MCP clients authenticate with an **admin API token** (created in
+_Settings → API Tokens_) sent as `Authorization: Bearer <token>`. Every tool is
+gated by the **same permissions as the dashboard UI** — the token's admin role
+must hold the relevant `Better Auth Dashboard` permissions:
+
+| Permission | Tools it unlocks |
+| ---------- | ---------------- |
+| `user.read` | `better_auth_list_users`, `better_auth_get_user` |
+| `user.update` | `better_auth_update_user`, `better_auth_ban_user`, `better_auth_unban_user` |
+| `overview.read` | `better_auth_user_stats`, `better_auth_signups_graph` |
+
+### Available tools
+
+User tools identify the target by its **Better Auth user id** (as returned by
+`better_auth_list_users`), exactly like the dashboard.
+
+| Tool | Description |
+| ---- | ----------- |
+| `better_auth_list_users` | List and search users (`search` matches name/email); returns users + total |
+| `better_auth_get_user` | Fetch a single user by Better Auth `userId`, with session/account counts |
+| `better_auth_update_user` | Update a user's `name` / `email` / `image` / `emailVerified` |
+| `better_auth_ban_user` | Ban a user (optional reason + expiry in days); Better Auth revokes sessions¹ |
+| `better_auth_unban_user` | Lift a user's ban¹ |
+| `better_auth_user_stats` | Totals + day/week/month sign-ups (with % deltas) + active users |
+| `better_auth_signups_graph` | Sign-up time series (new/active/total users) by `day`/`week`/`month` |
+
+¹ Registered only when the Better Auth [`admin`](https://www.better-auth.com/docs/plugins/admin)
+plugin is configured (the `banned` field it adds must exist on the `user` schema).
+
+## Third-party dash API gateway
+
+If you want to call the Better Auth `dash()` endpoints from a third-party service
+(not the admin panel, not MCP), enable the **opt-in gateway**. It exposes the full
+dash surface under `/api/better-auth-dashboard/dash/*`, authenticated with a
+**Strapi API token**, and forwards each request through the same signed-JWT
+mechanism the dashboard uses — so Better Auth's own logic runs.
+
+```typescript title="config/plugins.ts"
+export default {
+  "better-auth-dashboard": {
+    config: {
+      dashApi: { enabled: true }, // default: false
+    },
+  },
+};
+```
+
+> [!NOTE]
+> Like the MCP integration, this is opt-in at registration: when `dashApi.enabled`
+> is false (the default) the routes are never mounted, so requests to them 404.
+
+Authentication is Strapi's standard content-api token auth: send a Strapi API
+token (Settings → API Tokens) as a Bearer token. Use a **Full access** token, or a
+**Custom** token granted this gateway route's permission. The endpoint path after
+`/dash/` is the dash endpoint; per-user/org context goes in a base64(JSON)
+`X-Dash-Context` header, exactly like the dashboard client:
+
+```bash
+# Analytics
+curl "$STRAPI/api/better-auth-dashboard/dash/user-stats" \
+  -H "Authorization: Bearer $API_TOKEN"
+
+# List users
+curl "$STRAPI/api/better-auth-dashboard/dash/list-users?limit=50" \
+  -H "Authorization: Bearer $API_TOKEN"
+
+# Ban a user (userId passed via X-Dash-Context)
+curl -X POST "$STRAPI/api/better-auth-dashboard/dash/ban-user" \
+  -H "Authorization: Bearer $API_TOKEN" \
+  -H "X-Dash-Context: $(echo -n '{"userId":"42"}' | base64)" \
+  -H "Content-Type: application/json" \
+  -d '{"banReason":"abuse"}'
+```
+
+> [!WARNING]
+> This is a **generic passthrough to the whole dash surface** (including user
+> deletion and organization management) exposed as a single route, so granting it
+> grants the entire dash API — the gateway does not scope per dash endpoint. A
+> Full access token reaches everything. Create a **dedicated** token for the
+> integration and treat it as privileged. Leave `dashApi` disabled if unused.
+
 ## Pages
 
 | Tab | Description |
@@ -140,7 +259,7 @@ Available APIs:
 
 `isAvailable` defaults to `true`. Its result is cached for five minutes, combined with permission checks, and applied to both navigation and direct route access. Errors are treated as unavailable.
 
-See the [Dashboard documentation](https://strapi-community.github.io/plugin-better-auth/docs/better-auth/dashboard#dashboard-screen-api) for the complete API reference and extension guidance.
+See the [Dashboard screen API documentation](https://strapi-community.github.io/plugin-better-auth/docs/dashboard/screen-api) for the complete API reference and extension guidance.
 
 ## Requirements
 
@@ -150,7 +269,7 @@ See the [Dashboard documentation](https://strapi-community.github.io/plugin-bett
 
 ## Resources
 
-- [Documentation](https://strapi-community.github.io/plugin-better-auth/docs/better-auth/dashboard)
+- [Documentation](https://strapi-community.github.io/plugin-better-auth/docs/dashboard)
 - [Better Auth Documentation](https://better-auth.com)
 - [Strapi Documentation](https://docs.strapi.io)
 

package/dist/admin/{Root-CgVBJuoM.mjs → Root-C-dQhq8o.mjs}

@@ -2,7 +2,7 @@ import { jsx, jsxs, Fragment } from "react/jsx-runtime";
 import { useId, useState, useEffect, useMemo } from "react";
 import { useQueryClient, QueryClient, QueryClientProvider } from "react-query";
 import { NavLink, Outlet, useMatch, Navigate } from "react-router-dom";
-import { g as getTranslation, a as getDashLinks, P as PLUGIN_ID, b as getDashLinkAvailabilityQueryKey, r as resolveDashLinkAvailability, D as DASH_LINK_AVAILABILITY_STALE_TIME } from "./index-BI2WIsds.mjs";
+import { g as getTranslation, a as getDashLinks, P as PLUGIN_ID, b as getDashLinkAvailabilityQueryKey, r as resolveDashLinkAvailability, D as DASH_LINK_AVAILABILITY_STALE_TIME } from "./index-DAkkUU0o.mjs";
 import { Typography, ScrollArea, Box, Flex, Badge, SubNav as SubNav$1, Divider } from "@strapi/design-system";
 import { useAuth, Layouts, Page, BackButton } from "@strapi/strapi/admin";
 import { useIntl } from "react-intl";

package/dist/admin/{Root-CsiOnzlB.js → Root-CMQ7swi6.js}

@@ -4,7 +4,7 @@ const jsxRuntime = require("react/jsx-runtime");
 const react = require("react");
 const reactQuery = require("react-query");
 const reactRouterDom = require("react-router-dom");
-const index = require("./index-BCBu-0nr.js");
+const index = require("./index-Bko3vlk0.js");
 const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
 const reactIntl = require("react-intl");

package/dist/admin/{index-DvfwvCj0.mjs → index-B5jiojjV.mjs}

@@ -5,7 +5,7 @@ import { createContext, useContext, useState, useRef, useEffect } from "react";
 import { useIntl } from "react-intl";
 import { useQuery } from "react-query";
 import styled, { useTheme } from "styled-components";
-import { c as PERMISSIONS, P as PLUGIN_ID, g as getTranslation, d as client } from "./index-BI2WIsds.mjs";
+import { c as PERMISSIONS, P as PLUGIN_ID, g as getTranslation, d as client } from "./index-DAkkUU0o.mjs";
 import { A as Avatar } from "./Avatar-zlMTAZh3.mjs";
 const SegmentedControlContext = createContext(null);
 const Root = ({ value, onChange, label, children }) => /* @__PURE__ */ jsx(SegmentedControlContext.Provider, { value: { value, onChange }, children: /* @__PURE__ */ jsx(

package/dist/admin/{index-BCBu-0nr.js → index-Bko3vlk0.js}

@@ -378,7 +378,7 @@ const plugin = {
         id: `${PLUGIN_ID}.plugin.name`,
         defaultMessage: "Auth Dashboard"
       },
-      Component: async () => Promise.resolve().then(() => require("./Root-CsiOnzlB.js")),
+      Component: async () => Promise.resolve().then(() => require("./Root-CMQ7swi6.js")),
       permissions: [
         ...PERMISSIONS.overview,
         ...PERMISSIONS.user,
@@ -402,7 +402,7 @@ const plugin = {
         defaultMessage: "Overview"
       },
       to: "/overview",
-      Component: () => Promise.resolve().then(() => require("./index-DQdn5s8q.js")),
+      Component: () => Promise.resolve().then(() => require("./index-hbz3gTsi.js")),
       permissions: PERMISSIONS.overview
     });
     dash.addDashLink("general", {
@@ -412,7 +412,7 @@ const plugin = {
         defaultMessage: "User Management"
       },
       to: "/users",
-      Component: () => Promise.resolve().then(() => require("./index-D9ttdrT3.js")),
+      Component: () => Promise.resolve().then(() => require("./index-D1nrIz0Y.js")),
       permissions: PERMISSIONS.user
     });
     dash.addDashLink("general", {
@@ -422,7 +422,7 @@ const plugin = {
         defaultMessage: "Organization Management"
       },
       to: "/organizations",
-      Component: () => Promise.resolve().then(() => require("./index-CPSoAbZt.js")),
+      Component: () => Promise.resolve().then(() => require("./index-CSyPvFnN.js")),
       permissions: PERMISSIONS.organization,
       isAvailable: async () => hasPlugin(await getDashConfig(), "organization")
     });

package/dist/admin/{index-CPSoAbZt.js → index-CSyPvFnN.js}

@@ -7,9 +7,9 @@ const admin = require("@strapi/strapi/admin");
 const react = require("react");
 const reactIntl = require("react-intl");
 const reactQuery = require("react-query");
-const index = require("./index-BCBu-0nr.js");
+const index = require("./index-Bko3vlk0.js");
 const Avatar = require("./Avatar-CdT7eBCh.js");
-const useModelSchema = require("./useModelSchema-BogQah8f.js");
+const useModelSchema = require("./useModelSchema-DON5XCju.js");
 function UserCombobox({
   label,
   hint,
@@ -467,10 +467,12 @@ function OrganizationDetail({
   });
   const strapiOrgQuery = reactQuery.useQuery({
     queryKey: ["dash-strapi-org", organizationId],
-    enabled: !!orgQuery.data,
+    enabled: !!schemaQuery.data,
     queryFn: async () => {
+      const relationFields = Object.entries(schemaQuery.data).filter(([, attr]) => attr.type === "relation").map(([fieldName]) => fieldName);
+      const populateParam = relationFields.length > 0 ? `&populate=${encodeURIComponent(relationFields.join(","))}` : "";
       const { data } = await get(
-        `/better-auth-dashboard/db?uid=plugin::better-auth.organization&filters[id][$eq]=${organizationId}&pagination[pageSize]=1`
+        `/better-auth-dashboard/db?uid=plugin::better-auth.organization&filters[id][$eq]=${organizationId}&pagination[pageSize]=1${populateParam}`
       );
       return data.results?.[0] ?? null;
     }

package/dist/admin/{index-gFqHlMLP.mjs → index-CvNwHg1k.mjs}

@@ -5,9 +5,9 @@ import { useNotification, useFetchClient, Page, useRBAC, Layouts } from "@strapi
 import { useState } from "react";
 import { useIntl } from "react-intl";
 import { useQuery, useQueryClient, useMutation } from "react-query";
-import { d as client, g as getTranslation, e as getAuthHeaders, u as useDashConfig, c as PERMISSIONS, P as PLUGIN_ID, h as hasPlugin } from "./index-BI2WIsds.mjs";
+import { d as client, g as getTranslation, e as getAuthHeaders, u as useDashConfig, c as PERMISSIONS, P as PLUGIN_ID, h as hasPlugin } from "./index-DAkkUU0o.mjs";
 import { A as Avatar } from "./Avatar-zlMTAZh3.mjs";
-import { S as SheetDialog, F as FormSection, a as SectionLabel, M as MediaPickerField, u as useModelSchema, w as withContext, E as EditLayout, C as CustomFieldsSection, b as EditSidebar, c as MetaItem, d as MetaKey, e as MonoChip, f as MetaVal, g as EditViewSidePanels, A as AccountRow, P as ProviderBadge, D as DangerRow, W as WarnCard, h as PreviewPill, R as RoleBadge, i as ConfirmDialog, j as Code } from "./useModelSchema-C6bxNjW4.mjs";
+import { S as SheetDialog, F as FormSection, a as SectionLabel, M as MediaPickerField, u as useModelSchema, w as withContext, E as EditLayout, C as CustomFieldsSection, b as EditSidebar, c as MetaItem, d as MetaKey, e as MonoChip, f as MetaVal, g as EditViewSidePanels, A as AccountRow, P as ProviderBadge, D as DangerRow, W as WarnCard, h as PreviewPill, R as RoleBadge, i as ConfirmDialog, j as Code } from "./useModelSchema-Bo8WEBwb.mjs";
 function useUsers(options = {}) {
   const { limit = 25, offset = 0, search } = options;
   const { formatMessage } = useIntl();

package/dist/admin/{index-D9ttdrT3.js → index-D1nrIz0Y.js}

@@ -7,9 +7,9 @@ const admin = require("@strapi/strapi/admin");
 const react = require("react");
 const reactIntl = require("react-intl");
 const reactQuery = require("react-query");
-const index = require("./index-BCBu-0nr.js");
+const index = require("./index-Bko3vlk0.js");
 const Avatar = require("./Avatar-CdT7eBCh.js");
-const useModelSchema = require("./useModelSchema-BogQah8f.js");
+const useModelSchema = require("./useModelSchema-DON5XCju.js");
 function useUsers(options = {}) {
   const { limit = 25, offset = 0, search } = options;
   const { formatMessage } = reactIntl.useIntl();

package/dist/admin/{index-BI2WIsds.mjs → index-DAkkUU0o.mjs}

@@ -377,7 +377,7 @@ const plugin = {
         id: `${PLUGIN_ID}.plugin.name`,
         defaultMessage: "Auth Dashboard"
       },
-      Component: async () => import("./Root-CgVBJuoM.mjs"),
+      Component: async () => import("./Root-C-dQhq8o.mjs"),
       permissions: [
         ...PERMISSIONS.overview,
         ...PERMISSIONS.user,
@@ -401,7 +401,7 @@ const plugin = {
         defaultMessage: "Overview"
       },
       to: "/overview",
-      Component: () => import("./index-DvfwvCj0.mjs"),
+      Component: () => import("./index-B5jiojjV.mjs"),
       permissions: PERMISSIONS.overview
     });
     dash.addDashLink("general", {
@@ -411,7 +411,7 @@ const plugin = {
         defaultMessage: "User Management"
       },
       to: "/users",
-      Component: () => import("./index-gFqHlMLP.mjs"),
+      Component: () => import("./index-CvNwHg1k.mjs"),
       permissions: PERMISSIONS.user
     });
     dash.addDashLink("general", {
@@ -421,7 +421,7 @@ const plugin = {
         defaultMessage: "Organization Management"
       },
       to: "/organizations",
-      Component: () => import("./index-VyHXoQ6p.mjs"),
+      Component: () => import("./index-NF35nlqQ.mjs"),
       permissions: PERMISSIONS.organization,
       isAvailable: async () => hasPlugin(await getDashConfig(), "organization")
     });

package/dist/admin/{index-VyHXoQ6p.mjs → index-NF35nlqQ.mjs}

@@ -5,9 +5,9 @@ import { useNotification, useFetchClient, Page, useRBAC, Layouts } from "@strapi
 import { useState } from "react";
 import { useIntl } from "react-intl";
 import { useQuery, useQueryClient, useMutation } from "react-query";
-import { d as client, g as getTranslation, e as getAuthHeaders, f as useOrganizationOptions, c as PERMISSIONS, P as PLUGIN_ID } from "./index-BI2WIsds.mjs";
+import { d as client, g as getTranslation, e as getAuthHeaders, f as useOrganizationOptions, c as PERMISSIONS, P as PLUGIN_ID } from "./index-DAkkUU0o.mjs";
 import { A as Avatar } from "./Avatar-zlMTAZh3.mjs";
-import { w as withContext, S as SheetDialog, F as FormSection, a as SectionLabel, M as MediaPickerField, u as useModelSchema, E as EditLayout, C as CustomFieldsSection, b as EditSidebar, c as MetaItem, d as MetaKey, e as MonoChip, f as MetaVal, g as EditViewSidePanels, A as AccountRow, P as ProviderBadge, i as ConfirmDialog, j as Code } from "./useModelSchema-C6bxNjW4.mjs";
+import { w as withContext, S as SheetDialog, F as FormSection, a as SectionLabel, M as MediaPickerField, u as useModelSchema, E as EditLayout, C as CustomFieldsSection, b as EditSidebar, c as MetaItem, d as MetaKey, e as MonoChip, f as MetaVal, g as EditViewSidePanels, A as AccountRow, P as ProviderBadge, i as ConfirmDialog, j as Code } from "./useModelSchema-Bo8WEBwb.mjs";
 function UserCombobox({
   label,
   hint,
@@ -465,10 +465,12 @@ function OrganizationDetail({
   });
   const strapiOrgQuery = useQuery({
     queryKey: ["dash-strapi-org", organizationId],
-    enabled: !!orgQuery.data,
+    enabled: !!schemaQuery.data,
     queryFn: async () => {
+      const relationFields = Object.entries(schemaQuery.data).filter(([, attr]) => attr.type === "relation").map(([fieldName]) => fieldName);
+      const populateParam = relationFields.length > 0 ? `&populate=${encodeURIComponent(relationFields.join(","))}` : "";
       const { data } = await get(
-        `/better-auth-dashboard/db?uid=plugin::better-auth.organization&filters[id][$eq]=${organizationId}&pagination[pageSize]=1`
+        `/better-auth-dashboard/db?uid=plugin::better-auth.organization&filters[id][$eq]=${organizationId}&pagination[pageSize]=1${populateParam}`
       );
       return data.results?.[0] ?? null;
     }

package/dist/admin/{index-DQdn5s8q.js → index-hbz3gTsi.js}

@@ -7,7 +7,7 @@ const react = require("react");
 const reactIntl = require("react-intl");
 const reactQuery = require("react-query");
 const styled = require("styled-components");
-const index = require("./index-BCBu-0nr.js");
+const index = require("./index-Bko3vlk0.js");
 const Avatar = require("./Avatar-CdT7eBCh.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);

package/dist/admin/index.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
-const index = require("./index-BCBu-0nr.js");
+const index = require("./index-Bko3vlk0.js");
 exports.default = index.plugin;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { p } from "./index-BI2WIsds.mjs";
+import { p } from "./index-DAkkUU0o.mjs";
 export {
   p as default
 };

package/dist/admin/{useModelSchema-C6bxNjW4.mjs → useModelSchema-Bo8WEBwb.mjs}

@@ -2,7 +2,7 @@ import { jsx, jsxs, Fragment } from "react/jsx-runtime";
 import { Dialog, Button, Typography, Flex, Grid, Box, Badge, Field, TextInput, Modal, Combobox, ComboboxOption, IconButton, Checkbox, SingleSelect, SingleSelectOption, NumberInput, JSONInput, Textarea } from "@strapi/design-system";
 import { WarningCircle, Clock, Images, Trash } from "@strapi/icons";
 import { useIntl } from "react-intl";
-import { g as getTranslation, i as getMediaLibraryComponent, j as getEditViewSidePanels } from "./index-BI2WIsds.mjs";
+import { g as getTranslation, i as getMediaLibraryComponent, j as getEditViewSidePanels } from "./index-DAkkUU0o.mjs";
 import { useState, useRef } from "react";
 import styled, { keyframes } from "styled-components";
 import { useFetchClient } from "@strapi/strapi/admin";

package/dist/admin/{useModelSchema-BogQah8f.js → useModelSchema-DON5XCju.js}

@@ -3,7 +3,7 @@ const jsxRuntime = require("react/jsx-runtime");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
 const reactIntl = require("react-intl");
-const index = require("./index-BCBu-0nr.js");
+const index = require("./index-Bko3vlk0.js");
 const react = require("react");
 const styled = require("styled-components");
 const admin = require("@strapi/strapi/admin");