@xk2800/nextjs-template 0.6.1-beta.0 → 0.6.1-beta.2

package/dist/auth/index.js

@@ -1,34 +1,32 @@
 'use strict';
 
+var components = require('@react-email/components');
+var jsxRuntime = require('react/jsx-runtime');
 require('server-only');
 var betterAuth = require('better-auth');
 var drizzle = require('better-auth/adapters/drizzle');
+var cuid2 = require('@paralleldrive/cuid2');
 var drizzleOrm = require('drizzle-orm');
 var serverless = require('@neondatabase/serverless');
 var neonHttp = require('drizzle-orm/neon-http');
 var nodePostgres = require('drizzle-orm/node-postgres');
 var pg = require('pg');
 var pgCore = require('drizzle-orm/pg-core');
-var cuid2 = require('@paralleldrive/cuid2');
 var zod = require('zod');
-var bcrypt = require('bcrypt');
 var plugins = require('better-auth/plugins');
-var passkey = require('better-auth/plugins/passkey');
+var passkey = require('@better-auth/passkey');
 var api = require('better-auth/api');
 var uaParserJs = require('ua-parser-js');
 var geoip = require('geoip-lite');
-var resend$1 = require('resend');
-var components = require('@react-email/components');
-var jsxRuntime = require('react/jsx-runtime');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var bcrypt__default = /*#__PURE__*/_interopDefault(bcrypt);
 var geoip__default = /*#__PURE__*/_interopDefault(geoip);
 
 var __defProp = Object.defineProperty;
 var __defProps = Object.defineProperties;
 var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __propIsEnum = Object.prototype.propertyIsEnumerable;
@@ -45,17 +43,162 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// components/email/email-template-passkey-change.tsx
+var email_template_passkey_change_exports = {};
+__export(email_template_passkey_change_exports, {
+  EmailTemplatePasskeyChange: () => EmailTemplatePasskeyChange
+});
+function EmailTemplatePasskeyChange({
+  firstName,
+  action,
+  device,
+  location,
+  ipAddress,
+  when,
+  manageUrl
+}) {
+  const verb = action === "added" ? "added to" : "removed from";
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Tailwind, { children: /* @__PURE__ */ jsxRuntime.jsx(components.Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "rounded-xl bg-[#f8f9fa] p-10", children: [
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Heading, { className: "mb-3 text-center text-2xl font-bold text-[#1a1a1a]", children: [
+        "A passkey was ",
+        action
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "mb-6 text-base leading-6 text-[#666666]", children: [
+        "Hi ",
+        firstName,
+        ", a passkey was just ",
+        verb,
+        " your account."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "mb-6 rounded-lg bg-white p-5", children: [
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Device:" }),
+          " ",
+          device
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Approx. location:" }),
+          " ",
+          location
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "IP address:" }),
+          " ",
+          ipAddress
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "When:" }),
+          " ",
+          when
+        ] })
+      ] }),
+      manageUrl && /* @__PURE__ */ jsxRuntime.jsx(components.Section, { className: "mb-6 text-center", children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: manageUrl,
+          className: "rounded-lg bg-[#1a1a1a] px-6 py-3 text-sm font-bold text-white no-underline",
+          children: "Review your passkeys"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Text, { className: "text-sm leading-[22px] text-[#666666]", children: "If this was you, no action is needed. If you don't recognize it, change your password now and review your passkeys and active sessions." })
+    ] }) }) }) })
+  ] });
+}
+var init_email_template_passkey_change = __esm({
+  "components/email/email-template-passkey-change.tsx"() {
+  }
+});
+
+// components/email/email-template-reset-password.tsx
+var email_template_reset_password_exports = {};
+__export(email_template_reset_password_exports, {
+  EmailTemplateResetPassword: () => EmailTemplateResetPassword
+});
+function EmailTemplateResetPassword({ firstName, url }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Body, { style: { backgroundColor: "#ffffff", fontFamily: "Arial, sans-serif" }, children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { style: { margin: "0 auto", padding: "20px 0 48px", maxWidth: "560px" }, children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { style: { backgroundColor: "#f8f9fa", borderRadius: "12px", padding: "40px", textAlign: "center" }, children: [
+      /* @__PURE__ */ jsxRuntime.jsx(components.Heading, { style: { fontSize: "28px", fontWeight: "bold", marginBottom: "12px", color: "#1a1a1a" }, children: "Reset your password" }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { style: { fontSize: "16px", color: "#666666", marginBottom: "32px", lineHeight: "24px" }, children: [
+        "Hi ",
+        firstName,
+        ", we got a request to reset your password. This link expires in an hour \u2014 if you didn't ask for this, you can safely ignore this email."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Section, { style: { marginBottom: "32px" }, children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: url,
+          style: {
+            backgroundColor: "#000000",
+            color: "#ffffff",
+            padding: "12px 32px",
+            borderRadius: "6px",
+            textDecoration: "none",
+            fontSize: "16px",
+            fontWeight: "bold"
+          },
+          children: "Reset password"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { style: { fontSize: "13px", color: "#999999", lineHeight: "20px", wordBreak: "break-all" }, children: [
+        "Or paste this link into your browser:",
+        /* @__PURE__ */ jsxRuntime.jsx("br", {}),
+        /* @__PURE__ */ jsxRuntime.jsx("a", { href: url, style: { color: "#000000", textDecoration: "underline" }, children: url })
+      ] })
+    ] }) }) })
+  ] });
+}
+var init_email_template_reset_password = __esm({
+  "components/email/email-template-reset-password.tsx"() {
+  }
+});
+
+// components/email/email-template-verify-email.tsx
+var email_template_verify_email_exports = {};
+__export(email_template_verify_email_exports, {
+  EmailTemplateVerifyEmail: () => EmailTemplateVerifyEmail
+});
+function EmailTemplateVerifyEmail({ firstName, url }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Tailwind, { children: /* @__PURE__ */ jsxRuntime.jsx(components.Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "rounded-xl bg-[#f8f9fa] p-10 text-center", children: [
+      /* @__PURE__ */ jsxRuntime.jsx(components.Heading, { className: "mb-3 text-[28px] font-bold text-[#1a1a1a]", children: "Confirm your email" }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "mb-8 text-base leading-6 text-[#666666]", children: [
+        "Hi ",
+        firstName,
+        ", click the button below to verify this email address. If you didn't create an account, you can safely ignore this email."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Section, { className: "mb-8", children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: url,
+          className: "rounded-md bg-black px-8 py-3 text-base font-bold text-white no-underline",
+          children: "Verify email"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "text-[13px] leading-5 break-all text-[#999999]", children: [
+        "Or paste this link into your browser:",
+        /* @__PURE__ */ jsxRuntime.jsx("br", {}),
+        /* @__PURE__ */ jsxRuntime.jsx(components.Link, { href: url, className: "text-black underline", children: url })
+      ] })
+    ] }) }) }) })
+  ] });
+}
+var init_email_template_verify_email = __esm({
+  "components/email/email-template-verify-email.tsx"() {
+  }
+});
+
 // server/db/schema.ts
 var schema_exports = {};
 __export(schema_exports, {
@@ -159,7 +302,11 @@ var twoFactors = pgCore.pgTable("twoFactor", {
   id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
   secret: pgCore.text("secret").notNull(),
   backupCodes: pgCore.text("backupCodes").notNull(),
-  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" })
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  // Added in better-auth 1.7 (TOTP lockout). Defaults match the plugin's.
+  verified: pgCore.boolean("verified").default(true),
+  failedVerificationCount: pgCore.integer("failedVerificationCount").default(0),
+  lockedUntil: pgCore.timestamp("lockedUntil")
 });
 var passkeys = pgCore.pgTable("passkey", {
   id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
@@ -487,128 +634,13 @@ async function getEffectiveAuthFlags() {
 }
 var EMAIL_FROM = "Acme <onboarding@xavierkhew.xyz>";
 var resend;
-function getResend() {
-  if (!resend) resend = new resend$1.Resend(config.RESEND_API_KEY);
+async function getResend() {
+  if (!resend) {
+    const { Resend } = await import('resend');
+    resend = new Resend(config.RESEND_API_KEY);
+  }
   return resend;
 }
-function EmailTemplateResetPassword({ firstName, url }) {
-  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
-    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
-    /* @__PURE__ */ jsxRuntime.jsx(components.Body, { style: { backgroundColor: "#ffffff", fontFamily: "Arial, sans-serif" }, children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { style: { margin: "0 auto", padding: "20px 0 48px", maxWidth: "560px" }, children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { style: { backgroundColor: "#f8f9fa", borderRadius: "12px", padding: "40px", textAlign: "center" }, children: [
-      /* @__PURE__ */ jsxRuntime.jsx(components.Heading, { style: { fontSize: "28px", fontWeight: "bold", marginBottom: "12px", color: "#1a1a1a" }, children: "Reset your password" }),
-      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { style: { fontSize: "16px", color: "#666666", marginBottom: "32px", lineHeight: "24px" }, children: [
-        "Hi ",
-        firstName,
-        ", we got a request to reset your password. This link expires in an hour \u2014 if you didn't ask for this, you can safely ignore this email."
-      ] }),
-      /* @__PURE__ */ jsxRuntime.jsx(components.Section, { style: { marginBottom: "32px" }, children: /* @__PURE__ */ jsxRuntime.jsx(
-        components.Button,
-        {
-          href: url,
-          style: {
-            backgroundColor: "#000000",
-            color: "#ffffff",
-            padding: "12px 32px",
-            borderRadius: "6px",
-            textDecoration: "none",
-            fontSize: "16px",
-            fontWeight: "bold"
-          },
-          children: "Reset password"
-        }
-      ) }),
-      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { style: { fontSize: "13px", color: "#999999", lineHeight: "20px", wordBreak: "break-all" }, children: [
-        "Or paste this link into your browser:",
-        /* @__PURE__ */ jsxRuntime.jsx("br", {}),
-        /* @__PURE__ */ jsxRuntime.jsx("a", { href: url, style: { color: "#000000", textDecoration: "underline" }, children: url })
-      ] })
-    ] }) }) })
-  ] });
-}
-function EmailTemplateVerifyEmail({ firstName, url }) {
-  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
-    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
-    /* @__PURE__ */ jsxRuntime.jsx(components.Tailwind, { children: /* @__PURE__ */ jsxRuntime.jsx(components.Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "rounded-xl bg-[#f8f9fa] p-10 text-center", children: [
-      /* @__PURE__ */ jsxRuntime.jsx(components.Heading, { className: "mb-3 text-[28px] font-bold text-[#1a1a1a]", children: "Confirm your email" }),
-      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "mb-8 text-base leading-6 text-[#666666]", children: [
-        "Hi ",
-        firstName,
-        ", click the button below to verify this email address. If you didn't create an account, you can safely ignore this email."
-      ] }),
-      /* @__PURE__ */ jsxRuntime.jsx(components.Section, { className: "mb-8", children: /* @__PURE__ */ jsxRuntime.jsx(
-        components.Button,
-        {
-          href: url,
-          className: "rounded-md bg-black px-8 py-3 text-base font-bold text-white no-underline",
-          children: "Verify email"
-        }
-      ) }),
-      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "text-[13px] leading-5 break-all text-[#999999]", children: [
-        "Or paste this link into your browser:",
-        /* @__PURE__ */ jsxRuntime.jsx("br", {}),
-        /* @__PURE__ */ jsxRuntime.jsx(components.Link, { href: url, className: "text-black underline", children: url })
-      ] })
-    ] }) }) }) })
-  ] });
-}
-function EmailTemplatePasskeyChange({
-  firstName,
-  action,
-  device,
-  location,
-  ipAddress,
-  when,
-  manageUrl
-}) {
-  const verb = action === "added" ? "added to" : "removed from";
-  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
-    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
-    /* @__PURE__ */ jsxRuntime.jsx(components.Tailwind, { children: /* @__PURE__ */ jsxRuntime.jsx(components.Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "rounded-xl bg-[#f8f9fa] p-10", children: [
-      /* @__PURE__ */ jsxRuntime.jsxs(components.Heading, { className: "mb-3 text-center text-2xl font-bold text-[#1a1a1a]", children: [
-        "A passkey was ",
-        action
-      ] }),
-      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "mb-6 text-base leading-6 text-[#666666]", children: [
-        "Hi ",
-        firstName,
-        ", a passkey was just ",
-        verb,
-        " your account."
-      ] }),
-      /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "mb-6 rounded-lg bg-white p-5", children: [
-        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
-          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Device:" }),
-          " ",
-          device
-        ] }),
-        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
-          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Approx. location:" }),
-          " ",
-          location
-        ] }),
-        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
-          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "IP address:" }),
-          " ",
-          ipAddress
-        ] }),
-        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 text-sm leading-5 text-[#1a1a1a]", children: [
-          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "When:" }),
-          " ",
-          when
-        ] })
-      ] }),
-      manageUrl && /* @__PURE__ */ jsxRuntime.jsx(components.Section, { className: "mb-6 text-center", children: /* @__PURE__ */ jsxRuntime.jsx(
-        components.Button,
-        {
-          href: manageUrl,
-          className: "rounded-lg bg-[#1a1a1a] px-6 py-3 text-sm font-bold text-white no-underline",
-          children: "Review your passkeys"
-        }
-      ) }),
-      /* @__PURE__ */ jsxRuntime.jsx(components.Text, { className: "text-sm leading-[22px] text-[#666666]", children: "If this was you, no action is needed. If you don't recognize it, change your password now and review your passkeys and active sessions." })
-    ] }) }) }) })
-  ] });
-}
 
 // server/auth.ts
 async function logFailedLogin(ctx) {
@@ -645,11 +677,12 @@ async function notifyPasskeyChange(ctx, action) {
       userAgent: (_b = (_a = ctx.headers) == null ? void 0 : _a.get("user-agent")) != null ? _b : null
     });
     if (!config.RESEND_API_KEY) return;
-    await getResend().emails.send({
+    const { EmailTemplatePasskeyChange: EmailTemplatePasskeyChange2 } = await Promise.resolve().then(() => (init_email_template_passkey_change(), email_template_passkey_change_exports));
+    await (await getResend()).emails.send({
       from: EMAIL_FROM,
       to: [user.email],
       subject: action === "added" ? "A passkey was added to your account" : "A passkey was removed from your account",
-      react: EmailTemplatePasskeyChange({
+      react: EmailTemplatePasskeyChange2({
         firstName: user.name || "there",
         action,
         device: formatDeviceInfo(parseUserAgent((_d = (_c = ctx.headers) == null ? void 0 : _c.get("user-agent")) != null ? _d : null)),
@@ -708,22 +741,16 @@ function createAuth(overrides = {}) {
     emailAndPassword: {
       enabled: emailAndPasswordEnabled,
       requireEmailVerification: false,
-      // Use bcrypt to maintain compatibility with existing user passwords
-      async hash(password) {
-        return await bcrypt__default.default.hash(password, 10);
-      },
-      async verify({ hash, password }) {
-        return await bcrypt__default.default.compare(password, hash);
-      },
       // `url` is fully composed by better-auth (baseURL + verification token +
       // callbackURL) — see app/(auth)/forgot-password and reset-password for
       // the pages this points at.
       async sendResetPassword({ user, url }) {
-        await getResend().emails.send({
+        const { EmailTemplateResetPassword: EmailTemplateResetPassword2 } = await Promise.resolve().then(() => (init_email_template_reset_password(), email_template_reset_password_exports));
+        await (await getResend()).emails.send({
           from: EMAIL_FROM,
           to: [user.email],
           subject: "Reset your password",
-          react: EmailTemplateResetPassword({ firstName: user.name || "there", url })
+          react: EmailTemplateResetPassword2({ firstName: user.name || "there", url })
         });
       }
     },
@@ -735,11 +762,12 @@ function createAuth(overrides = {}) {
     emailVerification: {
       autoSignInAfterVerification: true,
       async sendVerificationEmail({ user, url }) {
-        await getResend().emails.send({
+        const { EmailTemplateVerifyEmail: EmailTemplateVerifyEmail2 } = await Promise.resolve().then(() => (init_email_template_verify_email(), email_template_verify_email_exports));
+        await (await getResend()).emails.send({
           from: EMAIL_FROM,
           to: [user.email],
           subject: "Confirm your email",
-          react: EmailTemplateVerifyEmail({ firstName: user.name || "there", url })
+          react: EmailTemplateVerifyEmail2({ firstName: user.name || "there", url })
         });
       }
     },
@@ -760,7 +788,9 @@ function createAuth(overrides = {}) {
     },
     // Advanced options
     advanced: {
-      generateId: () => __require("@paralleldrive/cuid2").createId()
+      database: {
+        generateId: () => cuid2.createId()
+      }
     },
     // Every new session row corresponds to a sign-in (credential or OAuth) —
     // use that as the "last logged in" signal rather than session updates,
@@ -922,8 +952,6 @@ function createAuth(overrides = {}) {
       errorURL: "/login"
     },
     plugins: [
-      // checks to see if oneTap is enabled and if google provider is available, then add the oneTap plugin
-      ...config.AUTH_ENABLE_ONE_TAP && Boolean(socialProviders.google) ? [plugins.oneTap()] : [],
       // Registered for impersonation (auth.api.impersonateUser / stopImpersonating)
       // only — role/ban/delete stay on our own custom routes above. adminRoles
       // matches our existing role column so the plugin's own permission checks
@@ -949,7 +977,11 @@ function createAuth(overrides = {}) {
         rpID: new URL(baseURL).hostname,
         rpName: config.APP_NAME,
         origin: baseURL
-      })
+      }),
+      // checks to see if oneTap is enabled and if google provider is available, then add the oneTap plugin.
+      // Keep this spread last: a leading spread turns `plugins` from a tuple into a plain
+      // array and better-auth 1.7 then drops plugin fields (e.g. session.impersonatedBy).
+      ...config.AUTH_ENABLE_ONE_TAP && Boolean(socialProviders.google) ? [plugins.oneTap()] : []
     ]
   });
 }