autosync_backend2 1.2.104 → 1.2.105

package/dist/index.js

@@ -155020,12 +155020,12 @@ var require_sign2 = __commonJS((exports, module) => {
     exp: { isValid: isNumber2, message: '"exp" should be a number of seconds' },
     nbf: { isValid: isNumber2, message: '"nbf" should be a number of seconds' }
   };
-  function validate3(schema4, allowUnknown, object2, parameterName) {
+  function validate3(schema5, allowUnknown, object2, parameterName) {
     if (!isPlainObject6(object2)) {
       throw new Error('Expected "' + parameterName + '" to be a plain object.');
     }
     Object.keys(object2).forEach(function(key) {
-      const validator = schema4[key];
+      const validator = schema5[key];
       if (!validator) {
         if (!allowUnknown) {
           throw new Error('"' + key + '" is not allowed in "' + parameterName + '"');
@@ -285190,6 +285190,7 @@ var bigint = /^-?\d+n?$/;
 var integer = /^-?\d+$/;
 var number = /^-?\d+(?:\.\d+)?/;
 var boolean = /^(?:true|false)$/i;
+var _undefined = /^undefined$/i;
 var lowercase2 = /^[^A-Z]*$/;
 var uppercase2 = /^[^a-z]*$/;
 
@@ -286099,6 +286100,25 @@ var $ZodBigInt = /* @__PURE__ */ $constructor3("$ZodBigInt", (inst, def) => {
     return payload;
   };
 });
+var $ZodUndefined = /* @__PURE__ */ $constructor3("$ZodUndefined", (inst, def) => {
+  $ZodType3.init(inst, def);
+  inst._zod.pattern = _undefined;
+  inst._zod.values = new Set([undefined]);
+  inst._zod.optin = "optional";
+  inst._zod.optout = "optional";
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (typeof input === "undefined")
+      return payload;
+    payload.issues.push({
+      expected: "undefined",
+      code: "invalid_type",
+      input,
+      inst
+    });
+    return payload;
+  };
+});
 var $ZodAny = /* @__PURE__ */ $constructor3("$ZodAny", (inst, def) => {
   $ZodType3.init(inst, def);
   inst._zod.parse = (payload) => payload;
@@ -287348,6 +287368,12 @@ function _coercedBigint(Class4, params) {
     ...normalizeParams3(params)
   });
 }
+function _undefined2(Class4, params) {
+  return new Class4({
+    type: "undefined",
+    ...normalizeParams3(params)
+  });
+}
 function _any(Class4) {
   return new Class4({
     type: "any"
@@ -287910,6 +287936,13 @@ var ZodBigInt = /* @__PURE__ */ $constructor3("ZodBigInt", (inst, def) => {
   inst.maxValue = bag.maximum ?? null;
   inst.format = bag.format ?? null;
 });
+var ZodUndefined = /* @__PURE__ */ $constructor3("ZodUndefined", (inst, def) => {
+  $ZodUndefined.init(inst, def);
+  ZodType3.init(inst, def);
+});
+function _undefined3(params) {
+  return _undefined2(ZodUndefined, params);
+}
 var ZodAny = /* @__PURE__ */ $constructor3("ZodAny", (inst, def) => {
   $ZodAny.init(inst, def);
   ZodType3.init(inst, def);
@@ -293833,6 +293866,25 @@ function parseUserInput(options, user, action) {
   const schema = getAllFields(options, "user");
   return parseInputData(user || {}, { fields: schema, action });
 }
+function mergeSchema(schema, newSchema) {
+  if (!newSchema) {
+    return schema;
+  }
+  for (const table in newSchema) {
+    const newModelName = newSchema[table]?.modelName;
+    if (newModelName) {
+      schema[table].modelName = newModelName;
+    }
+    for (const field in schema[table].fields) {
+      const newField = newSchema[table]?.fields?.[field];
+      if (!newField) {
+        continue;
+      }
+      schema[table].fields[field].fieldName = newField;
+    }
+  }
+  return schema;
+}
 
 // node_modules/defu/dist/defu.mjs
 function isPlainObject4(value) {
@@ -307567,6 +307619,24 @@ var bearer = (options) => {
     }
   };
 };
+// node_modules/better-auth/dist/shared/better-auth.DQI8AD7d.mjs
+var getEndpointResponse = async (ctx) => {
+  const returned = ctx.context.returned;
+  if (!returned) {
+    return null;
+  }
+  if (returned instanceof Response) {
+    if (returned.status !== 200) {
+      return null;
+    }
+    return await returned.clone().json();
+  }
+  if (returned instanceof APIError) {
+    return null;
+  }
+  return returned;
+};
+
 // node_modules/better-auth/dist/plugins/admin/access/index.mjs
 var defaultStatements2 = {
   user: [
@@ -307601,6 +307671,30 @@ var userAc = defaultAc2.newRole({
   user: [],
   session: []
 });
+var defaultRoles3 = {
+  admin: adminAc2,
+  user: userAc
+};
+
+// node_modules/better-auth/dist/shared/better-auth.bkwPl2G4.mjs
+var hasPermission = (input) => {
+  if (input.userId && input.options?.adminUserIds?.includes(input.userId)) {
+    return true;
+  }
+  if (!input.permissions && !input.permission) {
+    return false;
+  }
+  const roles = (input.role || input.options?.defaultRole || "user").split(",");
+  const acRoles = input.options?.roles || defaultRoles3;
+  for (const role3 of roles) {
+    const _role = acRoles[role3];
+    const result = _role?.authorize(input.permission ?? input.permissions);
+    if (result?.success) {
+      return true;
+    }
+  }
+  return false;
+};
 
 // node_modules/better-auth/dist/shared/better-auth.BdecEc2O.mjs
 var ADMIN_ERROR_CODES = defineErrorCodes({
@@ -307623,6 +307717,1167 @@ var ADMIN_ERROR_CODES = defineErrorCodes({
   YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: "You are not allowed to update users",
   YOU_CANNOT_REMOVE_YOURSELF: "You cannot remove yourself"
 });
+var schema3 = {
+  user: {
+    fields: {
+      role: {
+        type: "string",
+        required: false,
+        input: false
+      },
+      banned: {
+        type: "boolean",
+        defaultValue: false,
+        required: false,
+        input: false
+      },
+      banReason: {
+        type: "string",
+        required: false,
+        input: false
+      },
+      banExpires: {
+        type: "date",
+        required: false,
+        input: false
+      }
+    }
+  },
+  session: {
+    fields: {
+      impersonatedBy: {
+        type: "string",
+        required: false
+      }
+    }
+  }
+};
+function parseRoles(roles) {
+  return Array.isArray(roles) ? roles.join(",") : roles;
+}
+var admin = (options) => {
+  const opts = {
+    defaultRole: options?.defaultRole ?? "user",
+    adminRoles: options?.adminRoles ?? ["admin"],
+    bannedUserMessage: options?.bannedUserMessage ?? "You have been banned from this application. Please contact support if you believe this is an error.",
+    ...options
+  };
+  const adminMiddleware = createAuthMiddleware(async (ctx) => {
+    const session = await getSessionFromCtx(ctx);
+    if (!session) {
+      throw new APIError("UNAUTHORIZED");
+    }
+    return {
+      session
+    };
+  });
+  return {
+    id: "admin",
+    init() {
+      return {
+        options: {
+          databaseHooks: {
+            user: {
+              create: {
+                async before(user) {
+                  return {
+                    data: {
+                      role: options?.defaultRole ?? "user",
+                      ...user
+                    }
+                  };
+                }
+              }
+            },
+            session: {
+              create: {
+                async before(session, ctx) {
+                  if (!ctx) {
+                    return;
+                  }
+                  const user = await ctx.context.internalAdapter.findUserById(session.userId);
+                  if (user.banned) {
+                    if (user.banExpires && new Date(user.banExpires).getTime() < Date.now()) {
+                      await ctx.context.internalAdapter.updateUser(session.userId, {
+                        banned: false,
+                        banReason: null,
+                        banExpires: null
+                      });
+                      return;
+                    }
+                    if (ctx && (ctx.path.startsWith("/callback") || ctx.path.startsWith("/oauth2/callback"))) {
+                      const redirectURI = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
+                      throw ctx.redirect(`${redirectURI}?error=banned&error_description=${opts.bannedUserMessage}`);
+                    }
+                    throw new APIError("FORBIDDEN", {
+                      message: opts.bannedUserMessage,
+                      code: "BANNED_USER"
+                    });
+                  }
+                }
+              }
+            }
+          }
+        }
+      };
+    },
+    hooks: {
+      after: [
+        {
+          matcher(context) {
+            return context.path === "/list-sessions";
+          },
+          handler: createAuthMiddleware(async (ctx) => {
+            const response = await getEndpointResponse(ctx);
+            if (!response) {
+              return;
+            }
+            const newJson = response.filter((session) => {
+              return !session.impersonatedBy;
+            });
+            return ctx.json(newJson);
+          })
+        }
+      ]
+    },
+    endpoints: {
+      setRole: createAuthEndpoint("/admin/set-role", {
+        method: "POST",
+        body: object({
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          }),
+          role: union3([
+            string6().meta({
+              description: "The role to set. `admin` or `user` by default"
+            }),
+            array3(string6().meta({
+              description: "The roles to set. `admin` or `user` by default"
+            }))
+          ]).meta({
+            description: "The role to set, this can be a string or an array of strings. Eg: `admin` or `[admin, user]`"
+          })
+        }),
+        requireHeaders: true,
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "setRole",
+            summary: "Set the role of a user",
+            description: "Set the role of a user",
+            responses: {
+              200: {
+                description: "User role updated",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        user: {
+                          $ref: "#/components/schemas/User"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          $Infer: {
+            body: {}
+          }
+        }
+      }, async (ctx) => {
+        const canSetRole = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: ctx.context.session.user.role,
+          options: opts,
+          permissions: {
+            user: ["set-role"]
+          }
+        });
+        if (!canSetRole) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE
+          });
+        }
+        const updatedUser = await ctx.context.internalAdapter.updateUser(ctx.body.userId, {
+          role: parseRoles(ctx.body.role)
+        }, ctx);
+        return ctx.json({
+          user: updatedUser
+        });
+      }),
+      getUser: createAuthEndpoint("/admin/get-user", {
+        method: "GET",
+        query: object({
+          id: string6().meta({
+            description: "The id of the User"
+          })
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "getUser",
+            summary: "Get an existing user",
+            description: "Get an existing user",
+            responses: {
+              200: {
+                description: "User",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        user: {
+                          $ref: "#/components/schemas/User"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const { id } = ctx.query;
+        const canGetUser = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: ctx.context.session.user.role,
+          options: opts,
+          permissions: {
+            user: ["get"]
+          }
+        });
+        if (!canGetUser) {
+          throw ctx.error("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_GET_USER,
+            code: "YOU_ARE_NOT_ALLOWED_TO_GET_USER"
+          });
+        }
+        const user = await ctx.context.internalAdapter.findUserById(id);
+        if (!user) {
+          throw new APIError("NOT_FOUND", {
+            message: BASE_ERROR_CODES.USER_NOT_FOUND
+          });
+        }
+        return parseUserOutput(ctx.context.options, user);
+      }),
+      createUser: createAuthEndpoint("/admin/create-user", {
+        method: "POST",
+        body: object({
+          email: string6().meta({
+            description: "The email of the user"
+          }),
+          password: string6().meta({
+            description: "The password of the user"
+          }),
+          name: string6().meta({
+            description: "The name of the user"
+          }),
+          role: union3([
+            string6().meta({
+              description: "The role of the user"
+            }),
+            array3(string6().meta({
+              description: "The roles of user"
+            }))
+          ]).optional().meta({
+            description: `A string or array of strings representing the roles to apply to the new user. Eg: "user"`
+          }),
+          data: record(string6(), any()).optional().meta({
+            description: "Extra fields for the user. Including custom additional fields."
+          })
+        }),
+        metadata: {
+          openapi: {
+            operationId: "createUser",
+            summary: "Create a new user",
+            description: "Create a new user",
+            responses: {
+              200: {
+                description: "User created",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        user: {
+                          $ref: "#/components/schemas/User"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          $Infer: {
+            body: {}
+          }
+        }
+      }, async (ctx) => {
+        const session = await getSessionFromCtx(ctx);
+        if (!session && (ctx.request || ctx.headers)) {
+          throw ctx.error("UNAUTHORIZED");
+        }
+        if (session) {
+          const canCreateUser = hasPermission({
+            userId: session.user.id,
+            role: session.user.role,
+            options: opts,
+            permissions: {
+              user: ["create"]
+            }
+          });
+          if (!canCreateUser) {
+            throw new APIError("FORBIDDEN", {
+              message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS
+            });
+          }
+        }
+        const existUser = await ctx.context.internalAdapter.findUserByEmail(ctx.body.email);
+        if (existUser) {
+          throw new APIError("BAD_REQUEST", {
+            message: ADMIN_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL
+          });
+        }
+        const user = await ctx.context.internalAdapter.createUser({
+          email: ctx.body.email,
+          name: ctx.body.name,
+          role: (ctx.body.role && parseRoles(ctx.body.role)) ?? options?.defaultRole ?? "user",
+          ...ctx.body.data
+        }, ctx);
+        if (!user) {
+          throw new APIError("INTERNAL_SERVER_ERROR", {
+            message: ADMIN_ERROR_CODES.FAILED_TO_CREATE_USER
+          });
+        }
+        const hashedPassword = await ctx.context.password.hash(ctx.body.password);
+        await ctx.context.internalAdapter.linkAccount({
+          accountId: user.id,
+          providerId: "credential",
+          password: hashedPassword,
+          userId: user.id
+        }, ctx);
+        return ctx.json({
+          user
+        });
+      }),
+      adminUpdateUser: createAuthEndpoint("/admin/update-user", {
+        method: "POST",
+        body: object({
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          }),
+          data: record(any(), any()).meta({
+            description: "The user data to update"
+          })
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "updateUser",
+            summary: "Update a user",
+            description: "Update a user's details",
+            responses: {
+              200: {
+                description: "User updated",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        user: {
+                          $ref: "#/components/schemas/User"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const canUpdateUser = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: ctx.context.session.user.role,
+          options: opts,
+          permissions: {
+            user: ["update"]
+          }
+        });
+        if (!canUpdateUser) {
+          throw ctx.error("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS,
+            code: "YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS"
+          });
+        }
+        if (Object.keys(ctx.body.data).length === 0) {
+          throw new APIError("BAD_REQUEST", {
+            message: ADMIN_ERROR_CODES.NO_DATA_TO_UPDATE
+          });
+        }
+        if (ctx.body.data?.role) {
+          ctx.body.data.role = parseRoles(ctx.body.data.role);
+        }
+        const updatedUser = await ctx.context.internalAdapter.updateUser(ctx.body.userId, ctx.body.data, ctx);
+        return ctx.json(updatedUser);
+      }),
+      listUsers: createAuthEndpoint("/admin/list-users", {
+        method: "GET",
+        use: [adminMiddleware],
+        query: object({
+          searchValue: string6().optional().meta({
+            description: 'The value to search for. Eg: "some name"'
+          }),
+          searchField: _enum2(["email", "name"]).meta({
+            description: 'The field to search in, defaults to email. Can be `email` or `name`. Eg: "name"'
+          }).optional(),
+          searchOperator: _enum2(["contains", "starts_with", "ends_with"]).meta({
+            description: 'The operator to use for the search. Can be `contains`, `starts_with` or `ends_with`. Eg: "contains"'
+          }).optional(),
+          limit: string6().meta({
+            description: "The number of users to return"
+          }).or(number2()).optional(),
+          offset: string6().meta({
+            description: "The offset to start from"
+          }).or(number2()).optional(),
+          sortBy: string6().meta({
+            description: "The field to sort by"
+          }).optional(),
+          sortDirection: _enum2(["asc", "desc"]).meta({
+            description: "The direction to sort by"
+          }).optional(),
+          filterField: string6().meta({
+            description: "The field to filter by"
+          }).optional(),
+          filterValue: string6().meta({
+            description: "The value to filter by"
+          }).or(number2()).or(boolean2()).optional(),
+          filterOperator: _enum2(["eq", "ne", "lt", "lte", "gt", "gte", "contains"]).meta({
+            description: "The operator to use for the filter"
+          }).optional()
+        }),
+        metadata: {
+          openapi: {
+            operationId: "listUsers",
+            summary: "List users",
+            description: "List users",
+            responses: {
+              200: {
+                description: "List of users",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        users: {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/User"
+                          }
+                        },
+                        total: {
+                          type: "number"
+                        },
+                        limit: {
+                          type: "number"
+                        },
+                        offset: {
+                          type: "number"
+                        }
+                      },
+                      required: ["users", "total"]
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const session = ctx.context.session;
+        const canListUsers = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: session.user.role,
+          options: opts,
+          permissions: {
+            user: ["list"]
+          }
+        });
+        if (!canListUsers) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_LIST_USERS
+          });
+        }
+        const where = [];
+        if (ctx.query?.searchValue) {
+          where.push({
+            field: ctx.query.searchField || "email",
+            operator: ctx.query.searchOperator || "contains",
+            value: ctx.query.searchValue
+          });
+        }
+        if (ctx.query?.filterValue) {
+          where.push({
+            field: ctx.query.filterField || "email",
+            operator: ctx.query.filterOperator || "eq",
+            value: ctx.query.filterValue
+          });
+        }
+        try {
+          const users = await ctx.context.internalAdapter.listUsers(Number(ctx.query?.limit) || undefined, Number(ctx.query?.offset) || undefined, ctx.query?.sortBy ? {
+            field: ctx.query.sortBy,
+            direction: ctx.query.sortDirection || "asc"
+          } : undefined, where.length ? where : undefined);
+          const total = await ctx.context.internalAdapter.countTotalUsers(where.length ? where : undefined);
+          return ctx.json({
+            users,
+            total,
+            limit: Number(ctx.query?.limit) || undefined,
+            offset: Number(ctx.query?.offset) || undefined
+          });
+        } catch (e) {
+          return ctx.json({
+            users: [],
+            total: 0
+          });
+        }
+      }),
+      listUserSessions: createAuthEndpoint("/admin/list-user-sessions", {
+        method: "POST",
+        use: [adminMiddleware],
+        body: object({
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          })
+        }),
+        metadata: {
+          openapi: {
+            operationId: "listUserSessions",
+            summary: "List user sessions",
+            description: "List user sessions",
+            responses: {
+              200: {
+                description: "List of user sessions",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        sessions: {
+                          type: "array",
+                          items: {
+                            $ref: "#/components/schemas/Session"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const session = ctx.context.session;
+        const canListSessions = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: session.user.role,
+          options: opts,
+          permissions: {
+            session: ["list"]
+          }
+        });
+        if (!canListSessions) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS
+          });
+        }
+        const sessions = await ctx.context.internalAdapter.listSessions(ctx.body.userId);
+        return {
+          sessions
+        };
+      }),
+      unbanUser: createAuthEndpoint("/admin/unban-user", {
+        method: "POST",
+        body: object({
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          })
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "unbanUser",
+            summary: "Unban a user",
+            description: "Unban a user",
+            responses: {
+              200: {
+                description: "User unbanned",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        user: {
+                          $ref: "#/components/schemas/User"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const session = ctx.context.session;
+        const canBanUser = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: session.user.role,
+          options: opts,
+          permissions: {
+            user: ["ban"]
+          }
+        });
+        if (!canBanUser) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS
+          });
+        }
+        const user = await ctx.context.internalAdapter.updateUser(ctx.body.userId, {
+          banned: false,
+          banExpires: null,
+          banReason: null,
+          updatedAt: /* @__PURE__ */ new Date
+        });
+        return ctx.json({
+          user
+        });
+      }),
+      banUser: createAuthEndpoint("/admin/ban-user", {
+        method: "POST",
+        body: object({
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          }),
+          banReason: string6().meta({
+            description: "The reason for the ban"
+          }).optional(),
+          banExpiresIn: number2().meta({
+            description: "The number of seconds until the ban expires"
+          }).optional()
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "banUser",
+            summary: "Ban a user",
+            description: "Ban a user",
+            responses: {
+              200: {
+                description: "User banned",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        user: {
+                          $ref: "#/components/schemas/User"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const session = ctx.context.session;
+        const canBanUser = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: session.user.role,
+          options: opts,
+          permissions: {
+            user: ["ban"]
+          }
+        });
+        if (!canBanUser) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS
+          });
+        }
+        const foundUser = await ctx.context.internalAdapter.findUserById(ctx.body.userId);
+        if (!foundUser) {
+          throw new APIError("NOT_FOUND", {
+            message: BASE_ERROR_CODES.USER_NOT_FOUND
+          });
+        }
+        if (ctx.body.userId === ctx.context.session.user.id) {
+          throw new APIError("BAD_REQUEST", {
+            message: ADMIN_ERROR_CODES.YOU_CANNOT_BAN_YOURSELF
+          });
+        }
+        const user = await ctx.context.internalAdapter.updateUser(ctx.body.userId, {
+          banned: true,
+          banReason: ctx.body.banReason || options?.defaultBanReason || "No reason",
+          banExpires: ctx.body.banExpiresIn ? getDate(ctx.body.banExpiresIn, "sec") : options?.defaultBanExpiresIn ? getDate(options.defaultBanExpiresIn, "sec") : undefined,
+          updatedAt: /* @__PURE__ */ new Date
+        }, ctx);
+        await ctx.context.internalAdapter.deleteSessions(ctx.body.userId);
+        return ctx.json({
+          user
+        });
+      }),
+      impersonateUser: createAuthEndpoint("/admin/impersonate-user", {
+        method: "POST",
+        body: object({
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          })
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "impersonateUser",
+            summary: "Impersonate a user",
+            description: "Impersonate a user",
+            responses: {
+              200: {
+                description: "Impersonation session created",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        session: {
+                          $ref: "#/components/schemas/Session"
+                        },
+                        user: {
+                          $ref: "#/components/schemas/User"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const canImpersonateUser = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: ctx.context.session.user.role,
+          options: opts,
+          permissions: {
+            user: ["impersonate"]
+          }
+        });
+        if (!canImpersonateUser) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS
+          });
+        }
+        const targetUser = await ctx.context.internalAdapter.findUserById(ctx.body.userId);
+        if (!targetUser) {
+          throw new APIError("NOT_FOUND", {
+            message: "User not found"
+          });
+        }
+        const session = await ctx.context.internalAdapter.createSession(targetUser.id, ctx, true, {
+          impersonatedBy: ctx.context.session.user.id,
+          expiresAt: options?.impersonationSessionDuration ? getDate(options.impersonationSessionDuration, "sec") : getDate(60 * 60, "sec")
+        }, true);
+        if (!session) {
+          throw new APIError("INTERNAL_SERVER_ERROR", {
+            message: ADMIN_ERROR_CODES.FAILED_TO_CREATE_USER
+          });
+        }
+        const authCookies = ctx.context.authCookies;
+        deleteSessionCookie(ctx);
+        const dontRememberMeCookie = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);
+        const adminCookieProp = ctx.context.createAuthCookie("admin_session");
+        await ctx.setSignedCookie(adminCookieProp.name, `${ctx.context.session.session.token}:${dontRememberMeCookie || ""}`, ctx.context.secret, authCookies.sessionToken.options);
+        await setSessionCookie(ctx, {
+          session,
+          user: targetUser
+        }, true);
+        return ctx.json({
+          session,
+          user: targetUser
+        });
+      }),
+      stopImpersonating: createAuthEndpoint("/admin/stop-impersonating", {
+        method: "POST",
+        requireHeaders: true
+      }, async (ctx) => {
+        const session = await getSessionFromCtx(ctx);
+        if (!session) {
+          throw new APIError("UNAUTHORIZED");
+        }
+        if (!session.session.impersonatedBy) {
+          throw new APIError("BAD_REQUEST", {
+            message: "You are not impersonating anyone"
+          });
+        }
+        const user = await ctx.context.internalAdapter.findUserById(session.session.impersonatedBy);
+        if (!user) {
+          throw new APIError("INTERNAL_SERVER_ERROR", {
+            message: "Failed to find user"
+          });
+        }
+        const adminCookieName = ctx.context.createAuthCookie("admin_session").name;
+        const adminCookie = await ctx.getSignedCookie(adminCookieName, ctx.context.secret);
+        if (!adminCookie) {
+          throw new APIError("INTERNAL_SERVER_ERROR", {
+            message: "Failed to find admin session"
+          });
+        }
+        const [adminSessionToken, dontRememberMeCookie] = adminCookie?.split(":");
+        const adminSession = await ctx.context.internalAdapter.findSession(adminSessionToken);
+        if (!adminSession || adminSession.session.userId !== user.id) {
+          throw new APIError("INTERNAL_SERVER_ERROR", {
+            message: "Failed to find admin session"
+          });
+        }
+        await ctx.context.internalAdapter.deleteSession(session.session.token);
+        await setSessionCookie(ctx, adminSession, !!dontRememberMeCookie);
+        return ctx.json(adminSession);
+      }),
+      revokeUserSession: createAuthEndpoint("/admin/revoke-user-session", {
+        method: "POST",
+        body: object({
+          sessionToken: string6().meta({
+            description: "The session token"
+          })
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "revokeUserSession",
+            summary: "Revoke a user session",
+            description: "Revoke a user session",
+            responses: {
+              200: {
+                description: "Session revoked",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        success: {
+                          type: "boolean"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const session = ctx.context.session;
+        const canRevokeSession = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: session.user.role,
+          options: opts,
+          permissions: {
+            session: ["revoke"]
+          }
+        });
+        if (!canRevokeSession) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS
+          });
+        }
+        await ctx.context.internalAdapter.deleteSession(ctx.body.sessionToken);
+        return ctx.json({
+          success: true
+        });
+      }),
+      revokeUserSessions: createAuthEndpoint("/admin/revoke-user-sessions", {
+        method: "POST",
+        body: object({
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          })
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "revokeUserSessions",
+            summary: "Revoke all user sessions",
+            description: "Revoke all user sessions",
+            responses: {
+              200: {
+                description: "Sessions revoked",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        success: {
+                          type: "boolean"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const session = ctx.context.session;
+        const canRevokeSession = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: session.user.role,
+          options: opts,
+          permissions: {
+            session: ["revoke"]
+          }
+        });
+        if (!canRevokeSession) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS
+          });
+        }
+        await ctx.context.internalAdapter.deleteSessions(ctx.body.userId);
+        return ctx.json({
+          success: true
+        });
+      }),
+      removeUser: createAuthEndpoint("/admin/remove-user", {
+        method: "POST",
+        body: object({
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          })
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "removeUser",
+            summary: "Remove a user",
+            description: "Delete a user and all their sessions and accounts. Cannot be undone.",
+            responses: {
+              200: {
+                description: "User removed",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        success: {
+                          type: "boolean"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const session = ctx.context.session;
+        const canDeleteUser = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: session.user.role,
+          options: opts,
+          permissions: {
+            user: ["delete"]
+          }
+        });
+        if (!canDeleteUser) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS
+          });
+        }
+        if (ctx.body.userId === ctx.context.session.user.id) {
+          throw new APIError("BAD_REQUEST", {
+            message: ADMIN_ERROR_CODES.YOU_CANNOT_REMOVE_YOURSELF
+          });
+        }
+        const user = await ctx.context.internalAdapter.findUserById(ctx.body.userId);
+        if (!user) {
+          throw new APIError("NOT_FOUND", {
+            message: "User not found"
+          });
+        }
+        await ctx.context.internalAdapter.deleteUser(ctx.body.userId);
+        return ctx.json({
+          success: true
+        });
+      }),
+      setUserPassword: createAuthEndpoint("/admin/set-user-password", {
+        method: "POST",
+        body: object({
+          newPassword: string6().meta({
+            description: "The new password"
+          }),
+          userId: exports_coerce.string().meta({
+            description: "The user id"
+          })
+        }),
+        use: [adminMiddleware],
+        metadata: {
+          openapi: {
+            operationId: "setUserPassword",
+            summary: "Set a user's password",
+            description: "Set a user's password",
+            responses: {
+              200: {
+                description: "Password set",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        status: {
+                          type: "boolean"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }, async (ctx) => {
+        const canSetUserPassword = hasPermission({
+          userId: ctx.context.session.user.id,
+          role: ctx.context.session.user.role,
+          options: opts,
+          permissions: {
+            user: ["set-password"]
+          }
+        });
+        if (!canSetUserPassword) {
+          throw new APIError("FORBIDDEN", {
+            message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD
+          });
+        }
+        const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
+        await ctx.context.internalAdapter.updatePassword(ctx.body.userId, hashedPassword);
+        return ctx.json({
+          status: true
+        });
+      }),
+      userHasPermission: createAuthEndpoint("/admin/has-permission", {
+        method: "POST",
+        body: object({
+          userId: exports_coerce.string().optional().meta({
+            description: `The user id. Eg: "user-id"`
+          }),
+          role: string6().optional().meta({
+            description: `The role to check permission for. Eg: "admin"`
+          })
+        }).and(union3([
+          object({
+            permission: record(string6(), array3(string6())),
+            permissions: _undefined3()
+          }),
+          object({
+            permission: _undefined3(),
+            permissions: record(string6(), array3(string6()))
+          })
+        ])),
+        metadata: {
+          openapi: {
+            description: "Check if the user has permission",
+            requestBody: {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      permission: {
+                        type: "object",
+                        description: "The permission to check",
+                        deprecated: true
+                      },
+                      permissions: {
+                        type: "object",
+                        description: "The permission to check"
+                      }
+                    },
+                    required: ["permissions"]
+                  }
+                }
+              }
+            },
+            responses: {
+              "200": {
+                description: "Success",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        error: {
+                          type: "string"
+                        },
+                        success: {
+                          type: "boolean"
+                        }
+                      },
+                      required: ["success"]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          $Infer: {
+            body: {}
+          }
+        }
+      }, async (ctx) => {
+        if (!ctx.body?.permission && !ctx.body?.permissions) {
+          throw new APIError("BAD_REQUEST", {
+            message: "invalid permission check. no permission(s) were passed."
+          });
+        }
+        const session = await getSessionFromCtx(ctx);
+        if (!session && (ctx.request || ctx.headers)) {
+          throw new APIError("UNAUTHORIZED");
+        }
+        if (!session && !ctx.body.userId && !ctx.body.role) {
+          throw new APIError("BAD_REQUEST", {
+            message: "user id or role is required"
+          });
+        }
+        const user = session?.user || (ctx.body.role ? { id: ctx.body.userId || "", role: ctx.body.role } : null) || await ctx.context.internalAdapter.findUserById(ctx.body.userId);
+        if (!user) {
+          throw new APIError("BAD_REQUEST", {
+            message: "user not found"
+          });
+        }
+        const result = hasPermission({
+          userId: user.id,
+          role: user.role,
+          options,
+          permissions: ctx.body.permissions ?? ctx.body.permission
+        });
+        return ctx.json({
+          error: null,
+          success: result
+        });
+      })
+    },
+    $ERROR_CODES: ADMIN_ERROR_CODES,
+    schema: mergeSchema(schema3, opts.schema),
+    options
+  };
+};
 // node_modules/better-auth/dist/shared/better-auth.DDuRjwGK.mjs
 var minute2 = 60;
 var hour2 = minute2 * 60;
@@ -307645,16 +308900,16 @@ function getTypeFromZodType2(zodType) {
   return allowedType.has(type) ? type : "string";
 }
 function getFieldSchema(field) {
-  const schema3 = {
+  const schema4 = {
     type: field.type === "date" ? "string" : field.type
   };
   if (field.defaultValue !== undefined) {
-    schema3.default = typeof field.defaultValue === "function" ? "Generated at runtime" : field.defaultValue;
+    schema4.default = typeof field.defaultValue === "function" ? "Generated at runtime" : field.defaultValue;
   }
   if (field.input === false) {
-    schema3.readOnly = true;
+    schema4.readOnly = true;
   }
-  return schema3;
+  return schema4;
 }
 function getParameters2(options) {
   const parameters = [];
@@ -308091,8 +309346,8 @@ var openAPI = (options) => {
       generateOpenAPISchema: createAuthEndpoint("/open-api/generate-schema", {
         method: "GET"
       }, async (ctx) => {
-        const schema3 = await generator2(ctx.context, ctx.context.options);
-        return ctx.json(schema3);
+        const schema4 = await generator2(ctx.context, ctx.context.options);
+        return ctx.json(schema4);
       }),
       openAPIReference: createAuthEndpoint(path, {
         method: "GET",
@@ -308103,8 +309358,8 @@ var openAPI = (options) => {
         if (options?.disableDefaultReference) {
           throw new APIError("NOT_FOUND");
         }
-        const schema3 = await generator2(ctx.context, ctx.context.options);
-        return new Response(getHTML2(schema3, options?.theme), {
+        const schema4 = await generator2(ctx.context, ctx.context.options);
+        return new Response(getHTML2(schema4, options?.theme), {
           headers: {
             "Content-Type": "text/html"
           }
@@ -308354,18 +309609,18 @@ class CasingCache {
   getColumnCasing(column) {
     if (!column.keyAsName)
       return column.name;
-    const schema4 = column.table[Table.Symbol.Schema] ?? "public";
+    const schema5 = column.table[Table.Symbol.Schema] ?? "public";
     const tableName = column.table[Table.Symbol.OriginalName];
-    const key = `${schema4}.${tableName}.${column.name}`;
+    const key = `${schema5}.${tableName}.${column.name}`;
     if (!this.cache[key]) {
       this.cacheTable(column.table);
     }
     return this.cache[key];
   }
   cacheTable(table) {
-    const schema4 = table[Table.Symbol.Schema] ?? "public";
+    const schema5 = table[Table.Symbol.Schema] ?? "public";
     const tableName = table[Table.Symbol.OriginalName];
-    const tableKey = `${schema4}.${tableName}`;
+    const tableKey = `${schema5}.${tableName}`;
     if (!this.cachedTables[tableKey]) {
       for (const column of Object.values(table[Table.Symbol.Columns])) {
         const columnKey = `${tableKey}.${column.name}`;
@@ -308748,7 +310003,7 @@ class PgDialect {
   }
   buildRelationalQueryWithoutPK({
     fullSchema,
-    schema: schema4,
+    schema: schema5,
     tableNamesMap,
     table,
     tableConfig,
@@ -308842,17 +310097,17 @@ class PgDialect {
         queryConfig: selectedRelationConfigValue,
         relation
       } of selectedRelations) {
-        const normalizedRelation = normalizeRelation(schema4, tableNamesMap, relation);
+        const normalizedRelation = normalizeRelation(schema5, tableNamesMap, relation);
         const relationTableName = getTableUniqueName(relation.referencedTable);
         const relationTableTsName = tableNamesMap[relationTableName];
         const relationTableAlias = `${tableAlias}_${selectedRelationTsKey}`;
         const joinOn2 = and(...normalizedRelation.fields.map((field2, i2) => eq(aliasedTableColumn(normalizedRelation.references[i2], relationTableAlias), aliasedTableColumn(field2, tableAlias))));
         const builtRelation = this.buildRelationalQueryWithoutPK({
           fullSchema,
-          schema: schema4,
+          schema: schema5,
           tableNamesMap,
           table: fullSchema[relationTableTsName],
-          tableConfig: schema4[relationTableTsName],
+          tableConfig: schema5[relationTableTsName],
           queryConfig: is(relation, One) ? selectedRelationConfigValue === true ? { limit: 1 } : { ...selectedRelationConfigValue, limit: 1 } : selectedRelationConfigValue,
           tableAlias: relationTableAlias,
           joinOn: joinOn2,
@@ -309360,9 +310615,9 @@ class QueryBuilder {
 
 // node_modules/drizzle-orm/pg-core/view.js
 class DefaultViewBuilderCore {
-  constructor(name, schema4) {
+  constructor(name, schema5) {
     this.name = name;
-    this.schema = schema4;
+    this.schema = schema5;
   }
   static [entityKind] = "PgDefaultViewBuilderCore";
   config = {};
@@ -309400,8 +310655,8 @@ class ViewBuilder extends DefaultViewBuilderCore {
 class ManualViewBuilder extends DefaultViewBuilderCore {
   static [entityKind] = "PgManualViewBuilder";
   columns;
-  constructor(name, columns, schema4) {
-    super(name, schema4);
+  constructor(name, columns, schema5) {
+    super(name, schema5);
     this.columns = getTableColumns(pgTable(name, columns));
   }
   existing() {
@@ -309439,9 +310694,9 @@ class ManualViewBuilder extends DefaultViewBuilderCore {
 }
 
 class MaterializedViewBuilderCore {
-  constructor(name, schema4) {
+  constructor(name, schema5) {
     this.name = name;
-    this.schema = schema4;
+    this.schema = schema5;
   }
   static [entityKind] = "PgMaterializedViewBuilderCore";
   config = {};
@@ -309496,8 +310751,8 @@ class MaterializedViewBuilder extends MaterializedViewBuilderCore {
 class ManualMaterializedViewBuilder extends MaterializedViewBuilderCore {
   static [entityKind] = "PgManualMaterializedViewBuilder";
   columns;
-  constructor(name, columns, schema4) {
-    super(name, schema4);
+  constructor(name, columns, schema5) {
+    super(name, schema5);
     this.columns = getTableColumns(pgTable(name, columns));
   }
   existing() {
@@ -309571,17 +310826,17 @@ class PgMaterializedView extends PgViewBase {
     };
   }
 }
-function pgViewWithSchema(name, selection, schema4) {
+function pgViewWithSchema(name, selection, schema5) {
   if (selection) {
-    return new ManualViewBuilder(name, selection, schema4);
+    return new ManualViewBuilder(name, selection, schema5);
   }
-  return new ViewBuilder(name, schema4);
+  return new ViewBuilder(name, schema5);
 }
-function pgMaterializedViewWithSchema(name, selection, schema4) {
+function pgMaterializedViewWithSchema(name, selection, schema5) {
   if (selection) {
-    return new ManualMaterializedViewBuilder(name, selection, schema4);
+    return new ManualMaterializedViewBuilder(name, selection, schema5);
   }
-  return new MaterializedViewBuilder(name, schema4);
+  return new MaterializedViewBuilder(name, schema5);
 }
 
 // node_modules/drizzle-orm/pg-core/utils.js
@@ -310029,9 +311284,9 @@ class PgCountBuilder extends SQL {
 
 // node_modules/drizzle-orm/pg-core/query-builders/query.js
 class RelationalQueryBuilder {
-  constructor(fullSchema, schema4, tableNamesMap, table, tableConfig, dialect2, session) {
+  constructor(fullSchema, schema5, tableNamesMap, table, tableConfig, dialect2, session) {
     this.fullSchema = fullSchema;
-    this.schema = schema4;
+    this.schema = schema5;
     this.tableNamesMap = tableNamesMap;
     this.table = table;
     this.tableConfig = tableConfig;
@@ -310048,10 +311303,10 @@ class RelationalQueryBuilder {
 }
 
 class PgRelationalQuery extends QueryPromise {
-  constructor(fullSchema, schema4, tableNamesMap, table, tableConfig, dialect2, session, config5, mode) {
+  constructor(fullSchema, schema5, tableNamesMap, table, tableConfig, dialect2, session, config5, mode) {
     super();
     this.fullSchema = fullSchema;
-    this.schema = schema4;
+    this.schema = schema5;
     this.tableNamesMap = tableNamesMap;
     this.table = table;
     this.tableConfig = tableConfig;
@@ -310139,13 +311394,13 @@ class PgRaw extends QueryPromise {
 
 // node_modules/drizzle-orm/pg-core/db.js
 class PgDatabase {
-  constructor(dialect2, session, schema4) {
+  constructor(dialect2, session, schema5) {
     this.dialect = dialect2;
     this.session = session;
-    this._ = schema4 ? {
-      schema: schema4.schema,
-      fullSchema: schema4.fullSchema,
-      tableNamesMap: schema4.tableNamesMap,
+    this._ = schema5 ? {
+      schema: schema5.schema,
+      fullSchema: schema5.fullSchema,
+      tableNamesMap: schema5.tableNamesMap,
       session
     } : {
       schema: undefined,
@@ -310156,7 +311411,7 @@ class PgDatabase {
     this.query = {};
     if (this._.schema) {
       for (const [tableName, columns] of Object.entries(this._.schema)) {
-        this.query[tableName] = new RelationalQueryBuilder(schema4.fullSchema, this._.schema, this._.tableNamesMap, schema4.fullSchema[tableName], columns, dialect2, session);
+        this.query[tableName] = new RelationalQueryBuilder(schema5.fullSchema, this._.schema, this._.tableNamesMap, schema5.fullSchema[tableName], columns, dialect2, session);
       }
     }
     this.$cache = { invalidate: async (_params) => {} };
@@ -310296,15 +311551,15 @@ function alias(table, alias2) {
 
 // node_modules/drizzle-orm/pg-core/sequence.js
 class PgSequence {
-  constructor(seqName, seqOptions, schema4) {
+  constructor(seqName, seqOptions, schema5) {
     this.seqName = seqName;
     this.seqOptions = seqOptions;
-    this.schema = schema4;
+    this.schema = schema5;
   }
   static [entityKind] = "PgSequence";
 }
-function pgSequenceWithSchema(name, options, schema4) {
-  return new PgSequence(name, options, schema4);
+function pgSequenceWithSchema(name, options, schema5) {
+  return new PgSequence(name, options, schema5);
 }
 
 // node_modules/drizzle-orm/pg-core/schema.js
@@ -310447,9 +311702,9 @@ class PgSession {
 }
 
 class PgTransaction extends PgDatabase {
-  constructor(dialect2, session, schema4, nestedIndex = 0) {
-    super(dialect2, session, schema4);
-    this.schema = schema4;
+  constructor(dialect2, session, schema5, nestedIndex = 0) {
+    super(dialect2, session, schema5);
+    this.schema = schema5;
     this.nestedIndex = nestedIndex;
   }
   static [entityKind] = "PgTransaction";
@@ -310618,10 +311873,10 @@ class NodePgPreparedQuery extends PgPreparedQuery {
 }
 
 class NodePgSession extends PgSession {
-  constructor(client, dialect2, schema4, options = {}) {
+  constructor(client, dialect2, schema5, options = {}) {
     super(dialect2);
     this.client = client;
-    this.schema = schema4;
+    this.schema = schema5;
     this.options = options;
     this.logger = options.logger ?? new NoopLogger;
     this.cache = options.cache ?? new NoopCache;
@@ -310680,8 +311935,8 @@ class NodePgDriver {
     this.options = options;
   }
   static [entityKind] = "NodePgDriver";
-  createSession(schema4) {
-    return new NodePgSession(this.client, this.dialect, schema4, {
+  createSession(schema5) {
+    return new NodePgSession(this.client, this.dialect, schema5, {
       logger: this.options.logger,
       cache: this.options.cache
     });
@@ -310699,18 +311954,18 @@ function construct(client, config5 = {}) {
   } else if (config5.logger !== false) {
     logger2 = config5.logger;
   }
-  let schema4;
+  let schema5;
   if (config5.schema) {
     const tablesConfig = extractTablesRelationalConfig(config5.schema, createTableRelationsHelpers);
-    schema4 = {
+    schema5 = {
       fullSchema: config5.schema,
       schema: tablesConfig.tables,
       tableNamesMap: tablesConfig.tableNamesMap
     };
   }
   const driver2 = new NodePgDriver(client, dialect2, { logger: logger2, cache: config5.cache });
-  const session = driver2.createSession(schema4);
-  const db = new NodePgDatabase(dialect2, session, schema4);
+  const session = driver2.createSession(schema5);
+  const db = new NodePgDatabase(dialect2, session, schema5);
   db.$client = client;
   db.$cache = config5.cache;
   if (db.$cache) {
@@ -310918,7 +312173,11 @@ var user = pgTable("user", {
   companyId: uuid5().notNull(),
   branchId: uuid5().notNull(),
   kind: userKindEnum("kind").notNull().default("CUSTOMER"),
-  employeeId: uuid5()
+  employeeId: uuid5(),
+  role: text("role"),
+  banned: boolean4("banned").default(false),
+  banReason: text("ban_reason"),
+  banExpires: timestamp("ban_expires")
 });
 var session = pgTable("session", {
   id: text("id").primaryKey(),
@@ -331886,7 +333145,7 @@ var auth2 = betterAuth({
     },
     revokeSessionsOnPasswordReset: true
   },
-  plugins: [openAPI(), bearer()],
+  plugins: [openAPI(), bearer(), admin()],
   basePath: "/api",
   secondaryStorage,
   logger: {
@@ -332267,57 +333526,57 @@ function mapEnumValues(values) {
   return Object.fromEntries(values.map((value) => [value, value]));
 }
 function columnToSchema(column, t2) {
-  let schema4;
+  let schema5;
   if (isWithEnum(column)) {
-    schema4 = column.enumValues.length ? t2.Enum(mapEnumValues(column.enumValues)) : t2.String();
+    schema5 = column.enumValues.length ? t2.Enum(mapEnumValues(column.enumValues)) : t2.String();
   }
-  if (!schema4) {
+  if (!schema5) {
     if (isColumnType(column, ["PgGeometry", "PgPointTuple"])) {
-      schema4 = t2.Tuple([t2.Number(), t2.Number()]);
+      schema5 = t2.Tuple([t2.Number(), t2.Number()]);
     } else if (isColumnType(column, ["PgGeometryObject", "PgPointObject"])) {
-      schema4 = t2.Object({ x: t2.Number(), y: t2.Number() });
+      schema5 = t2.Object({ x: t2.Number(), y: t2.Number() });
     } else if (isColumnType(column, ["PgHalfVector", "PgVector"])) {
-      schema4 = t2.Array(t2.Number(), column.dimensions ? {
+      schema5 = t2.Array(t2.Number(), column.dimensions ? {
         minItems: column.dimensions,
         maxItems: column.dimensions
       } : undefined);
     } else if (isColumnType(column, ["PgLine"])) {
-      schema4 = t2.Tuple([t2.Number(), t2.Number(), t2.Number()]);
+      schema5 = t2.Tuple([t2.Number(), t2.Number(), t2.Number()]);
     } else if (isColumnType(column, ["PgLineABC"])) {
-      schema4 = t2.Object({
+      schema5 = t2.Object({
         a: t2.Number(),
         b: t2.Number(),
         c: t2.Number()
       });
     } else if (isColumnType(column, ["PgArray"])) {
-      schema4 = t2.Array(columnToSchema(column.baseColumn, t2), column.size ? {
+      schema5 = t2.Array(columnToSchema(column.baseColumn, t2), column.size ? {
         minItems: column.size,
         maxItems: column.size
       } : undefined);
     } else if (column.dataType === "array") {
-      schema4 = t2.Array(t2.Any());
+      schema5 = t2.Array(t2.Any());
     } else if (column.dataType === "number") {
-      schema4 = numberColumnToSchema(column, t2);
+      schema5 = numberColumnToSchema(column, t2);
     } else if (column.dataType === "bigint") {
-      schema4 = bigintColumnToSchema(column, t2);
+      schema5 = bigintColumnToSchema(column, t2);
     } else if (column.dataType === "boolean") {
-      schema4 = t2.Boolean();
+      schema5 = t2.Boolean();
     } else if (column.dataType === "date") {
-      schema4 = t2.Date();
+      schema5 = t2.Date();
     } else if (column.dataType === "string") {
-      schema4 = stringColumnToSchema(column, t2);
+      schema5 = stringColumnToSchema(column, t2);
     } else if (column.dataType === "json") {
-      schema4 = jsonSchema;
+      schema5 = jsonSchema;
     } else if (column.dataType === "custom") {
-      schema4 = t2.Any();
+      schema5 = t2.Any();
     } else if (column.dataType === "buffer") {
-      schema4 = bufferSchema;
+      schema5 = bufferSchema;
     }
   }
-  if (!schema4) {
-    schema4 = t2.Any();
+  if (!schema5) {
+    schema5 = t2.Any();
   }
-  return schema4;
+  return schema5;
 }
 function numberColumnToSchema(column, t2) {
   let unsigned = column.getSQLType().includes("unsigned");
@@ -332461,8 +333720,8 @@ function handleColumns(columns, refinements, conditions, factory) {
       continue;
     }
     const column = is(selected, Column) ? selected : undefined;
-    const schema4 = column ? columnToSchema(column, factory?.typeboxInstance ?? Type) : Type.Any();
-    const refined = typeof refinement === "function" ? refinement(schema4) : schema4;
+    const schema5 = column ? columnToSchema(column, factory?.typeboxInstance ?? Type) : Type.Any();
+    const refined = typeof refinement === "function" ? refinement(schema5) : schema5;
     if (conditions.never(column)) {
       continue;
     } else {
@@ -332525,8 +333784,8 @@ function createSchemaFactory(options) {
 var { createSelectSchema, createUpdateSchema, createInsertSchema: createInsertSchema2 } = createSchemaFactory({
   typeboxInstance: t
 });
-var OmitBaseSchema2 = (schema4) => {
-  return t.Omit(schema4, ["id", "createdAt", "updatedAt"]);
+var OmitBaseSchema2 = (schema5) => {
+  return t.Omit(schema5, ["id", "createdAt", "updatedAt"]);
 };
 
 // src/routes/bt/invoice/model.ts
@@ -333171,9 +334430,9 @@ var phoneRegex = /^\d{8}$/;
 var CompanyBranchModel;
 ((CompanyBranchModel) => {
   const createSchema = createInsertSchema2(companyBranchTable, {
-    phone: (schema4) => t.RegExp(phoneRegex, { ...schema4 }),
-    email: (schema4) => t.String({ ...schema4, format: "email" }),
-    merchantId: (schema4) => t.Optional(schema4)
+    phone: (schema5) => t.RegExp(phoneRegex, { ...schema5 }),
+    email: (schema5) => t.String({ ...schema5, format: "email" }),
+    merchantId: (schema5) => t.Optional(schema5)
   });
   const updateSchema = createUpdateSchema(companyBranchTable);
   const selectSchema = createSelectSchema(companyBranchTable);
@@ -343007,7 +344266,7 @@ var $generate = function(options) {
 var UserLogic;
 ((UserLogic) => {
   UserLogic.select = async (query, user2) => {
-    const filter = and(eq(user.branchId, query.branchId ?? "").if(query.branchId && user2.kind !== "CUSTOMER"), eq(user.branchId, user2.branchId).if(user2.kind === "CUSTOMER"), eq(user.companyId, user2.companyId).if(user2.kind !== "ADMIN"));
+    const filter = and(eq(user.branchId, query.branchId ?? "").if(query.branchId && user2.kind !== "CUSTOMER"), eq(user.branchId, user2.branchId).if(user2.kind === "CUSTOMER"), eq(user.companyId, user2.companyId).if(user2.kind !== "ADMIN"), eq(user.banned, query.banned ?? false).if(query.banned !== undefined));
     const columns = getTableColumns(user);
     const baseQuery = db_default.select({
       ...columns,
@@ -343077,9 +344336,10 @@ var UserLogic;
         throw status("Not Found", "\u0425\u044D\u0440\u044D\u0433\u043B\u044D\u0433\u0447 \u043E\u043B\u0434\u0441\u043E\u043D\u0433\u04AF\u0439.");
       }
       if (body.password) {
-        await auth2.api.resetPassword({
+        await auth2.api.setUserPassword({
           body: {
-            newPassword: body.password
+            newPassword: body.password,
+            userId: updatedUser.id
           }
         });
       }
@@ -343095,7 +344355,7 @@ var create2 = createInsertSchema2(user);
 var update = createUpdateSchema(user);
 var selectUserSchema = t.Composite([
   PaginationSchema,
-  t.Partial(t.Pick(select, ["branchId"]))
+  t.Partial(t.Pick(select, ["branchId", "banned"]))
 ]);
 var createUserSchema = t.Composite([
   t.Pick(create2, ["name", "email", "kind", "employeeId"]),