better-auth-studio 1.1.3-beta.9 → 1.1.3

package/dist/routes.js

@@ -16,7 +16,8 @@ import { createRequire } from "module";
 import { createMockAccount, createMockSession, createMockUser, createMockVerification, getAuthAdapter, } from "./auth-adapter.js";
 import { getPathAliases, possiblePaths } from "./config.js";
 import { getAuthData } from "./data.js";
-import { initializeGeoService, resolveIPLocationAsync, setGeoDbPath } from "./geo-service.js";
+import { initializeGeoService, resolveIPLocation, resolveIPLocationAsync, setGeoDbPath, } from "./geo-service.js";
+import { evaluateRequestAccess, extractClientIp } from "./utils/access-rules.js";
 import { detectDatabaseWithDialect } from "./utils/database-detection.js";
 import { createStudioSession, decryptSession, encryptSession, isSessionValid, STUDIO_COOKIE_NAME, } from "./utils/session.js";
 const config = {
@@ -315,6 +316,131 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
         const secs = Math.max(1, Math.floor(absMs / 1000));
         return `${secs}s`;
     };
+    let resolvedEventModelName = null;
+    const isEventModelLookupError = (error) => error?.message?.includes("not found in schema") ||
+        error?.message?.includes("not found in model") ||
+        error?.message?.includes("Model") ||
+        error?.code === "P2025" ||
+        error?.code === "42P01";
+    const toEventModelCamelCase = (value) => value.replace(/[_-]([a-z])/g, (_match, char) => char.toUpperCase());
+    const getEventModelCandidates = () => {
+        const baseName = studioConfig?.events?.tableName || "auth_events";
+        const candidates = new Set();
+        const addForms = (value) => {
+            const normalized = value?.trim();
+            if (!normalized)
+                return;
+            const snake = normalized.replace(/-/g, "_");
+            const singularSnake = snake.endsWith("s") ? snake.slice(0, -1) : snake;
+            const pluralSnake = snake.endsWith("s") ? snake : `${snake}s`;
+            const singularCamel = toEventModelCamelCase(singularSnake);
+            const pluralCamel = toEventModelCamelCase(pluralSnake);
+            [
+                normalized,
+                snake,
+                singularSnake,
+                pluralSnake,
+                singularCamel,
+                pluralCamel,
+                singularCamel.charAt(0).toUpperCase() + singularCamel.slice(1),
+                pluralCamel.charAt(0).toUpperCase() + pluralCamel.slice(1),
+            ].forEach((candidate) => {
+                if (candidate) {
+                    candidates.add(candidate);
+                }
+            });
+        };
+        addForms(baseName);
+        addForms(baseName === "auth_events" ? "auth_event" : "auth_events");
+        return Array.from(candidates);
+    };
+    const getEventFieldCandidates = (field) => {
+        switch (field) {
+            case "userId":
+                return ["userId", "user_id"];
+            case "sessionId":
+                return ["sessionId", "session_id"];
+            case "organizationId":
+                return ["organizationId", "organization_id"];
+            case "ipAddress":
+                return ["ipAddress", "ip_address"];
+            case "userAgent":
+                return ["userAgent", "user_agent"];
+            case "displayMessage":
+                return ["displayMessage", "display_message"];
+            case "displaySeverity":
+                return ["displaySeverity", "display_severity"];
+            case "createdAt":
+                return ["createdAt", "created_at"];
+            default:
+                return field ? [field] : [];
+        }
+    };
+    const getEventWhereCandidates = (where) => {
+        if (!Array.isArray(where) || where.length === 0) {
+            return {
+                whereCandidates: [undefined],
+                hasAliasedFields: false,
+            };
+        }
+        let hasAliasedFields = false;
+        let combinations = [[]];
+        for (const clause of where) {
+            const fieldCandidates = getEventFieldCandidates(clause?.field);
+            if (fieldCandidates.length > 1) {
+                hasAliasedFields = true;
+            }
+            const nextCombinations = fieldCandidates.flatMap((fieldName) => combinations.map((existing) => [...existing, { ...clause, field: fieldName }]));
+            if (nextCombinations.length > 0) {
+                combinations = nextCombinations;
+            }
+        }
+        return {
+            whereCandidates: combinations.length > 0 ? combinations : [where],
+            hasAliasedFields,
+        };
+    };
+    const findManyEventRows = async (adapter, options) => {
+        const candidates = Array.from(new Set([resolvedEventModelName, ...getEventModelCandidates()].filter(Boolean)));
+        const { where, ...restOptions } = options;
+        const { whereCandidates, hasAliasedFields } = getEventWhereCandidates(where);
+        let lastLookupError = null;
+        let lastSuccessfulEmptyResult = null;
+        for (const modelName of candidates) {
+            for (let index = 0; index < whereCandidates.length; index += 1) {
+                try {
+                    const result = await adapter.findMany({
+                        ...restOptions,
+                        ...(whereCandidates[index] ? { where: whereCandidates[index] } : {}),
+                        model: modelName,
+                    });
+                    resolvedEventModelName = modelName;
+                    if (Array.isArray(result) &&
+                        result.length === 0 &&
+                        hasAliasedFields &&
+                        index < whereCandidates.length - 1) {
+                        lastSuccessfulEmptyResult = result;
+                        continue;
+                    }
+                    return result;
+                }
+                catch (error) {
+                    if (isEventModelLookupError(error)) {
+                        lastLookupError = error;
+                        continue;
+                    }
+                    throw error;
+                }
+            }
+        }
+        if (lastSuccessfulEmptyResult && !lastLookupError) {
+            return lastSuccessfulEmptyResult;
+        }
+        if (lastLookupError) {
+            throw lastLookupError;
+        }
+        throw new Error("Failed to resolve events model");
+    };
     if (geoDbPath) {
         setGeoDbPath(geoDbPath);
     }
@@ -353,6 +479,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             // For self-hosted studio, wrap the preloaded adapter to match expected interface
             return {
                 ...preloadedAdapter,
+                count: preloadedAdapter.count?.bind(preloadedAdapter),
                 findUnique: preloadedAdapter.findUnique?.bind(preloadedAdapter),
                 findOne: preloadedAdapter.findOne?.bind(preloadedAdapter) ||
                     preloadedAdapter.findUnique?.bind(preloadedAdapter),
@@ -427,6 +554,9 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
     };
     if (isSelfHosted) {
         router.use((req, res, next) => {
+            if (!enforceRequestAccess(req, res)) {
+                return;
+            }
             const path = req.path;
             const publicPaths = [
                 "/api/auth/sign-in",
@@ -514,6 +644,110 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             return true;
         return allowedEmails.includes(email.toLowerCase());
     };
+    const enforceRequestAccess = (req, res) => {
+        if (!isSelfHosted) {
+            return true;
+        }
+        const decision = evaluateRequestAccess({
+            accessConfig,
+            path: req.path,
+            method: req.method,
+            headers: req.headers,
+            ip: req.ip,
+        });
+        if (decision.allowed) {
+            return true;
+        }
+        res.status(403).json({
+            success: false,
+            message: decision.message,
+            reason: decision.reason,
+            ...(decision.ipAddress ? { ipAddress: decision.ipAddress } : {}),
+        });
+        return false;
+    };
+    const finalizeStudioSignIn = (res, user) => {
+        const allowedRoles = getAllowedRoles();
+        if (!allowedRoles.includes(user.role || "")) {
+            return res.status(403).json({
+                success: false,
+                message: `Access denied.`,
+                userRole: user.role || "none",
+            });
+        }
+        if (!isEmailAllowed(user.email)) {
+            return res.status(403).json({
+                success: false,
+                message: "Access denied. Your email is not authorized to access this dashboard.",
+            });
+        }
+        const studioSession = createStudioSession({
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            role: user.role || undefined,
+        }, getSessionDuration());
+        const encryptedSession = encryptSession(studioSession, getSessionSecret());
+        res.cookie(STUDIO_COOKIE_NAME, encryptedSession, {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === "production",
+            sameSite: "lax",
+            maxAge: getSessionDuration(),
+            path: "/",
+        });
+        return res.json({
+            success: true,
+            user: { id: user.id, email: user.email, name: user.name, role: user.role || null },
+        });
+    };
+    const attemptManualCredentialStudioSignIn = async (email, password, adapter) => {
+        if (!adapter?.findMany) {
+            return { ok: false };
+        }
+        const users = await adapter.findMany({
+            model: "user",
+            where: [{ field: "email", value: email }],
+            limit: 1,
+        });
+        if (!users || users.length === 0) {
+            return { ok: false, status: 401, message: "Invalid credentials" };
+        }
+        const userRecord = users[0];
+        const userId = userRecord.id;
+        const accounts = await adapter.findMany({
+            model: "account",
+            where: [{ field: "userId", value: userId }],
+            limit: 10,
+        });
+        const credentialAccount = accounts?.find((acc) => acc.providerId === "credential" || acc.providerId === "email");
+        if (!credentialAccount) {
+            return {
+                ok: false,
+                status: 401,
+                message: "No password set for this account. Please use social login or reset your password.",
+            };
+        }
+        if (!credentialAccount.password) {
+            return {
+                ok: false,
+                status: 401,
+                message: "Password not configured. Please reset your password.",
+            };
+        }
+        const isValidPassword = await verifyPassword(password, credentialAccount.password);
+        if (!isValidPassword) {
+            return { ok: false, status: 401, message: "Invalid credentials" };
+        }
+        return {
+            ok: true,
+            user: {
+                id: userId,
+                email: userRecord.email,
+                name: userRecord.name,
+                role: userRecord.role,
+            },
+        };
+    };
     const verifyStudioSession = (req) => {
         if (!isSelfHosted) {
             return { valid: true };
@@ -551,6 +785,18 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 return res.status(400).json({ success: false, message: "Email and password required" });
             }
             const adapter = await getAuthAdapterWithConfig();
+            if (isSelfHosted && adapter?.findMany) {
+                const manualResult = await attemptManualCredentialStudioSignIn(email, password, adapter);
+                if (manualResult.ok) {
+                    return finalizeStudioSignIn(res, manualResult.user);
+                }
+                if (manualResult.status && manualResult.message) {
+                    return res.status(manualResult.status).json({
+                        success: false,
+                        message: manualResult.message,
+                    });
+                }
+            }
             let signInResult = null;
             let signInError = null;
             try {
@@ -563,67 +809,18 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             }
             if (!signInResult || signInResult.error || signInError) {
                 const errorMessage = signInError || signInResult?.error?.message || "Invalid credentials";
-                if (errorMessage.includes("Invalid password hash") && adapter?.findMany) {
-                    const users = await adapter.findMany({
-                        model: "user",
-                        where: [{ field: "email", value: email }],
-                        limit: 1,
-                    });
-                    if (!users || users.length === 0) {
-                        return res.status(401).json({ success: false, message: "Invalid credentials" });
+                const shouldAttemptManualFallback = !!signInError || errorMessage.includes("Invalid password hash");
+                if (shouldAttemptManualFallback) {
+                    const manualResult = await attemptManualCredentialStudioSignIn(email, password, adapter);
+                    if (manualResult.ok) {
+                        return finalizeStudioSignIn(res, manualResult.user);
                     }
-                    const userId = users[0].id;
-                    const accounts = await adapter.findMany({
-                        model: "account",
-                        where: [{ field: "userId", value: userId }],
-                        limit: 10,
-                    });
-                    const credentialAccount = accounts?.find((acc) => acc.providerId === "credential" || acc.providerId === "email");
-                    if (!credentialAccount) {
-                        return res.status(401).json({
+                    if (manualResult.status && manualResult.message) {
+                        return res.status(manualResult.status).json({
                             success: false,
-                            message: "No password set for this account. Please use social login or reset your password.",
+                            message: manualResult.message,
                         });
                     }
-                    if (!credentialAccount.password) {
-                        return res.status(401).json({
-                            success: false,
-                            message: "Password not configured. Please reset your password.",
-                        });
-                    }
-                    const isValidPassword = await verifyPassword(password, credentialAccount.password);
-                    if (!isValidPassword) {
-                        return res.status(401).json({ success: false, message: "Invalid credentials" });
-                    }
-                    const userRole = users[0].role;
-                    const user = { id: userId, email: users[0].email, name: users[0].name, role: userRole };
-                    const allowedRoles = getAllowedRoles();
-                    if (!allowedRoles.includes(user.role)) {
-                        return res.status(403).json({
-                            success: false,
-                            message: `Access denied.`,
-                            userRole: user.role || "none",
-                        });
-                    }
-                    if (!isEmailAllowed(user.email)) {
-                        return res.status(403).json({
-                            success: false,
-                            message: "Access denied. Your email is not authorized to access this dashboard.",
-                        });
-                    }
-                    const studioSession = createStudioSession(user, getSessionDuration());
-                    const encryptedSession = encryptSession(studioSession, getSessionSecret());
-                    res.cookie(STUDIO_COOKIE_NAME, encryptedSession, {
-                        httpOnly: true,
-                        secure: process.env.NODE_ENV === "production",
-                        sameSite: "lax",
-                        maxAge: getSessionDuration(),
-                        path: "/",
-                    });
-                    return res.json({
-                        success: true,
-                        user: { id: user.id, email: user.email, name: user.name, role: user.role },
-                    });
                 }
                 return res.status(401).json({
                     success: false,
@@ -646,33 +843,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 }
             }
             const user = { ...signInResult.user, role: userRole };
-            const allowedRoles = getAllowedRoles();
-            if (!allowedRoles.includes(user.role)) {
-                return res.status(403).json({
-                    success: false,
-                    message: `Access denied.`,
-                    userRole: user.role || "none",
-                });
-            }
-            if (!isEmailAllowed(user.email)) {
-                return res.status(403).json({
-                    success: false,
-                    message: "Access denied. Your email is not authorized to access this dashboard.",
-                });
-            }
-            const studioSession = createStudioSession(user, getSessionDuration());
-            const encryptedSession = encryptSession(studioSession, getSessionSecret());
-            res.cookie(STUDIO_COOKIE_NAME, encryptedSession, {
-                httpOnly: true,
-                secure: process.env.NODE_ENV === "production",
-                sameSite: "lax",
-                maxAge: getSessionDuration(),
-                path: "/",
-            });
-            return res.json({
-                success: true,
-                user: { id: user.id, email: user.email, name: user.name, role: user.role },
-            });
+            return finalizeStudioSignIn(res, user);
         }
         catch (error) {
             console.error("Sign-in error:", error);
@@ -1230,6 +1401,256 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             res.status(500).json({ error: "Failed to fetch counts" });
         }
     });
+    // Dashboard widget APIs
+    router.get("/api/dashboard/recent-users", async (req, res) => {
+        try {
+            const hoursParam = req.query.hours;
+            const hours = Math.min(8760, Math.max(1, parseInt(hoursParam || "24", 10) || 24));
+            const adapter = await getAuthAdapterWithConfig();
+            if (!adapter || !adapter.findMany) {
+                return res.json({ users: [], total: 0 });
+            }
+            const users = await adapter.findMany({ model: "user", limit: 500 }).catch(() => []);
+            const since = new Date(Date.now() - hours * 60 * 60 * 1000);
+            const recent = (users || []).filter((u) => {
+                const createdAt = u.createdAt ? new Date(u.createdAt) : null;
+                return createdAt && createdAt >= since;
+            });
+            const sorted = recent.sort((a, b) => {
+                const ta = new Date(a.createdAt || 0).getTime();
+                const tb = new Date(b.createdAt || 0).getTime();
+                return tb - ta;
+            });
+            const out = sorted.slice(0, 50);
+            // Enrich with country from latest session IP
+            try {
+                const sessions = await adapter.findMany({ model: "session", limit: 10000 }).catch(() => []);
+                const userIdToCountry = new Map();
+                const byUser = new Map();
+                for (const s of sessions || []) {
+                    const uid = s.userId || s.user_id;
+                    if (!uid)
+                        continue;
+                    if (!byUser.has(uid))
+                        byUser.set(uid, []);
+                    byUser.get(uid).push(s);
+                }
+                for (const [uid, userSessions] of byUser) {
+                    const sortedSessions = userSessions.sort((a, b) => new Date(b.createdAt || 0).getTime() - new Date(a.createdAt || 0).getTime());
+                    const latest = sortedSessions[0];
+                    const ip = latest.ipAddress || latest.ip_address;
+                    if (ip && ip !== "Unknown") {
+                        const loc = resolveIPLocation(ip);
+                        if (loc)
+                            userIdToCountry.set(uid, {
+                                country: loc.country || loc.countryCode || "—",
+                                countryCode: loc.countryCode || "",
+                            });
+                    }
+                }
+                for (const u of out) {
+                    const geo = userIdToCountry.get(u.id);
+                    u.country = geo?.country || "—";
+                    u.countryCode = geo?.countryCode || "";
+                }
+            }
+            catch (_e) { }
+            res.json({ users: out, total: recent.length });
+        }
+        catch (_error) {
+            res.status(500).json({ error: "Failed to fetch recent users", users: [], total: 0 });
+        }
+    });
+    router.get("/api/dashboard/recent-organizations", async (_req, res) => {
+        try {
+            const adapter = await getAuthAdapterWithConfig();
+            if (!adapter || !adapter.findMany) {
+                return res.json({ organizations: [], total: 0 });
+            }
+            const orgs = await adapter.findMany({ model: "organization", limit: 100 }).catch(() => []);
+            const list = (orgs || []).sort((a, b) => {
+                const ta = new Date(a.createdAt || 0).getTime();
+                const tb = new Date(b.createdAt || 0).getTime();
+                return tb - ta;
+            });
+            let withCount = list.slice(0, 20);
+            if (adapter.findMany && typeof adapter.findMany === "function") {
+                const memberCounts = await Promise.all(withCount.map(async (o) => {
+                    try {
+                        const members = await adapter.findMany({
+                            model: "member",
+                            where: [{ field: "organizationId", value: o.id }],
+                            limit: 1000,
+                        });
+                        return { id: o.id, count: Array.isArray(members) ? members.length : 0 };
+                    }
+                    catch {
+                        return { id: o.id, count: 0 };
+                    }
+                }));
+                const countMap = new Map(memberCounts.map((c) => [c.id, c.count]));
+                withCount = withCount.map((o) => ({ ...o, memberCount: countMap.get(o.id) ?? 0 }));
+            }
+            res.json({ organizations: withCount, total: list.length });
+        }
+        catch (_error) {
+            res.json({ organizations: [], total: 0 });
+        }
+    });
+    router.get("/api/dashboard/recent-teams", async (_req, res) => {
+        try {
+            const adapter = await getAuthAdapterWithConfig();
+            if (!adapter || !adapter.findMany) {
+                return res.json({ teams: [], total: 0 });
+            }
+            const teams = await adapter.findMany({ model: "team", limit: 100 }).catch(() => []);
+            const list = (teams || []).sort((a, b) => {
+                const ta = new Date(a.createdAt || 0).getTime();
+                const tb = new Date(b.createdAt || 0).getTime();
+                return tb - ta;
+            });
+            const out = list.slice(0, 20).map((t) => ({
+                id: t.id,
+                name: t.name,
+                slug: t.slug,
+                organizationId: t.organizationId,
+                createdAt: t.createdAt,
+            }));
+            res.json({ teams: out, total: list.length });
+        }
+        catch (_error) {
+            res.json({ teams: [], total: 0 });
+        }
+    });
+    router.get("/api/dashboard/invitations", async (_req, res) => {
+        try {
+            const adapter = await getAuthAdapterWithConfig();
+            if (!adapter || !adapter.findMany) {
+                return res.json({ invitations: [], total: 0 });
+            }
+            const invitations = await adapter
+                .findMany({
+                model: "invitation",
+                where: [{ field: "status", value: "pending" }],
+                limit: 200,
+            })
+                .catch(() => []);
+            const list = Array.isArray(invitations) ? invitations : [];
+            res.json({ invitations: list, total: list.length });
+        }
+        catch (_error) {
+            res.json({ invitations: [], total: 0 });
+        }
+    });
+    router.get("/api/dashboard/geo-distribution", async (_req, res) => {
+        try {
+            const adapter = await getAuthAdapterWithConfig();
+            if (!adapter || !adapter.findMany) {
+                return res.json({ distribution: [], totalUnique: 0 });
+            }
+            const sessions = await adapter.findMany({ model: "session", limit: 50000 }).catch(() => []);
+            const byCountry = new Map();
+            for (const session of sessions || []) {
+                const ip = session.ipAddress || session.ip_address;
+                if (!ip || ip === "Unknown")
+                    continue;
+                const loc = resolveIPLocation(ip);
+                if (!loc)
+                    continue;
+                const key = loc.countryCode || loc.country || "XX";
+                const existing = byCountry.get(key);
+                const userId = session.userId || session.user_id;
+                if (existing) {
+                    if (userId)
+                        existing.userIds.add(userId);
+                }
+                else {
+                    const userIds = new Set();
+                    if (userId)
+                        userIds.add(userId);
+                    byCountry.set(key, {
+                        country: loc.country,
+                        countryCode: loc.countryCode,
+                        count: userIds.size,
+                        userIds,
+                    });
+                }
+            }
+            for (const [, entry] of byCountry) {
+                entry.count = entry.userIds.size;
+            }
+            const distribution = Array.from(byCountry.entries()).map(([code, v]) => ({
+                countryCode: code,
+                country: v.country,
+                uniqueUsers: v.count,
+            }));
+            distribution.sort((a, b) => b.uniqueUsers - a.uniqueUsers);
+            const totalUnique = new Set((sessions || []).map((s) => s.userId || s.user_id).filter(Boolean)).size;
+            res.json({ distribution, totalUnique });
+        }
+        catch (_error) {
+            res.status(500).json({ distribution: [], totalUnique: 0 });
+        }
+    });
+    router.get("/api/dashboard/geo-country-details", async (req, res) => {
+        try {
+            const countryCode = req.query.code || "";
+            if (!countryCode)
+                return res.json({ users: [], sessions: [] });
+            const adapter = await getAuthAdapterWithConfig();
+            if (!adapter || !adapter.findMany)
+                return res.json({ users: [], sessions: [] });
+            const sessions = await adapter.findMany({ model: "session", limit: 50000 }).catch(() => []);
+            const matchingSessions = [];
+            const matchingUserIds = new Set();
+            for (const s of sessions || []) {
+                const ip = s.ipAddress || s.ip_address;
+                if (!ip || ip === "Unknown")
+                    continue;
+                const loc = resolveIPLocation(ip);
+                if (!loc)
+                    continue;
+                const code = loc.countryCode || "";
+                if (code.toUpperCase() !== countryCode.toUpperCase())
+                    continue;
+                const userId = s.userId || s.user_id;
+                if (userId)
+                    matchingUserIds.add(userId);
+                matchingSessions.push({
+                    id: s.id,
+                    userId,
+                    ipAddress: ip,
+                    userAgent: s.userAgent || s.user_agent || null,
+                    createdAt: s.createdAt || s.created_at || null,
+                    expiresAt: s.expiresAt || s.expires_at || null,
+                    city: loc.city,
+                    region: loc.region,
+                    country: loc.country,
+                    countryCode: loc.countryCode,
+                });
+            }
+            const allUsers = await adapter.findMany({ model: "user", limit: 100000 }).catch(() => []);
+            const matchingUsers = (allUsers || [])
+                .filter((u) => matchingUserIds.has(u.id))
+                .map((u) => ({
+                id: u.id,
+                name: u.name || null,
+                email: u.email || null,
+                image: u.image || null,
+                createdAt: u.createdAt || u.created_at || null,
+            }));
+            matchingSessions.sort((a, b) => new Date(b.createdAt || 0).getTime() - new Date(a.createdAt || 0).getTime());
+            res.json({
+                countryCode,
+                users: matchingUsers,
+                sessions: matchingSessions.slice(0, 100),
+                totalSessions: matchingSessions.length,
+            });
+        }
+        catch (_error) {
+            res.status(500).json({ users: [], sessions: [], totalSessions: 0 });
+        }
+    });
     router.get("/api/users/all", async (_req, res) => {
         try {
             const adapter = await getAuthAdapterWithConfig();
@@ -1376,6 +1797,12 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
     router.delete("/api/users/:userId", async (req, res) => {
         try {
             const { userId } = req.params;
+            const session = req.studioSession;
+            if (session && session.userId && session.userId === userId) {
+                return res
+                    .status(400)
+                    .json({ success: false, error: "You cannot delete the currently authenticated user" });
+            }
             const adapter = await getAuthAdapterWithConfig();
             if (!adapter || !adapter.delete) {
                 return res.status(500).json({ error: "Auth adapter not available" });
@@ -1408,7 +1835,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                             id: organization.id,
                             name: organization.name || "Unknown Organization",
                             slug: organization.slug || "unknown",
-                            image: organization.image,
+                            logo: organization.logo,
                             createdAt: organization.createdAt,
                         }
                         : {
@@ -1601,17 +2028,19 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 model: "session",
                 limit: 10000,
             });
-            const userSessions = sessions.filter((session) => session.userId === userId);
+            const userSessions = sessions.filter((session) => (session.userId ?? session.user_id) === userId);
             const formattedSessions = userSessions.map((session) => ({
-                id: session.id,
-                token: session.token,
-                expiresAt: session.expiresAt,
-                ipAddress: session.ipAddress || "Unknown",
-                userAgent: session.userAgent || "Unknown",
-                activeOrganizationId: session.activeOrganizationId,
-                activeTeamId: session.activeTeamId,
-                createdAt: session.createdAt,
-                updatedAt: session.updatedAt,
+                id: session.id ?? session.session_id,
+                token: session.token ?? session.session_token,
+                expiresAt: session.expiresAt ?? session.expires_at ?? session.expires,
+                ipAddress: session.ipAddress ?? session.ip_address ?? session.ip ?? "Unknown",
+                userAgent: session.userAgent ?? session.user_agent ?? null,
+                activeOrganizationId: session.activeOrganizationId ??
+                    session.active_organization_id ??
+                    session.active_organization,
+                activeTeamId: session.activeTeamId ?? session.active_team_id ?? session.active_team,
+                createdAt: session.createdAt ?? session.created_at,
+                updatedAt: session.updatedAt ?? session.updated_at,
             }));
             res.json({ sessions: formattedSessions });
         }
@@ -1672,6 +2101,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                     ? {
                         id: organization.id,
                         name: organization.name,
+                        logo: organization.logo,
                     }
                     : null,
             };
@@ -1701,6 +2131,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 id: organization.id,
                 name: organization.name,
                 slug: organization.slug,
+                logo: organization.logo,
                 metadata: organization.metadata,
                 createdAt: organization.createdAt,
                 updatedAt: organization.updatedAt,
@@ -1823,22 +2254,45 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                         }
                         return event;
                     });
+                    // Fetch total count for this query (unfiltered by pagination)
+                    let total = null;
+                    try {
+                        if (userId || type) {
+                            const countResult = await eventProvider.query({
+                                limit: 100000,
+                                sort: "desc",
+                                userId,
+                                type,
+                                since,
+                            });
+                            total = countResult.events?.length ?? null;
+                        }
+                        else if (eventProvider.count) {
+                            total = await eventProvider.count();
+                        }
+                        else if (eventProvider.getStats) {
+                            const stats = await eventProvider.getStats();
+                            total = stats.total;
+                        }
+                    }
+                    catch {
+                        // Count is best-effort, don't fail the main request
+                    }
                     return res.json({
                         events: transformedEvents,
                         hasMore: result.hasMore,
                         nextCursor: result.nextCursor,
+                        total,
                     });
                 }
                 catch (providerError) {
-                    const isSchemaError = providerError?.message?.includes("not found in schema") ||
-                        providerError?.message?.includes("Model") ||
-                        providerError?.code === "P2025" ||
-                        providerError?.code === "42P01";
+                    const isSchemaError = isEventModelLookupError(providerError);
                     if (isSchemaError) {
-                        return res.status(503).json({
-                            error: "Events not ready",
-                            retryable: true,
-                            details: providerError?.message || String(providerError),
+                        return res.status(200).json({
+                            events: [],
+                            hasMore: false,
+                            total: 0,
+                            ready: false,
                         });
                     }
                     console.error("Event provider query failed:", providerError);
@@ -1856,8 +2310,8 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 return res.status(500).json({ error: "Event provider or adapter not available" });
             }
             const where = [];
-            // Cursor-based pagination
-            if (after) {
+            // Use cursor-based pagination only when offset is not provided
+            if (offset == null && after) {
                 if (sort === "desc") {
                     where.push({ field: "id", operator: "<", value: after });
                 }
@@ -1874,22 +2328,23 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             let events = [];
             if (adapter.findMany) {
                 try {
-                    events = await adapter.findMany({
-                        model: "auth_events",
+                    const findManyOptions = {
                         where,
                         orderBy: [{ field: "timestamp", direction: sort === "desc" ? "desc" : "asc" }],
-                        limit: limit + 1, // Get one extra to check hasMore
-                    });
+                        limit: limit + 1,
+                    };
+                    if (offset != null && offset > 0) {
+                        findManyOptions.offset = offset;
+                    }
+                    events = await findManyEventRows(adapter, findManyOptions);
                 }
                 catch (adapterError) {
-                    if (adapterError?.message?.includes("not found in schema") ||
-                        adapterError?.message?.includes("Model") ||
-                        adapterError?.code === "P2025" ||
-                        adapterError?.code === "42P01") {
-                        return res.status(503).json({
-                            error: "Events not ready",
-                            retryable: true,
-                            details: adapterError?.message || String(adapterError),
+                    if (isEventModelLookupError(adapterError)) {
+                        return res.status(200).json({
+                            events: [],
+                            hasMore: false,
+                            total: 0,
+                            ready: false,
                         });
                     }
                     throw adapterError;
@@ -1939,22 +2394,40 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                     },
                 };
             });
+            // Fetch total count for the adapter path
+            let total = null;
+            try {
+                if (adapter.findMany) {
+                    const countWhere = [];
+                    if (type)
+                        countWhere.push({ field: "type", value: type });
+                    if (userId)
+                        countWhere.push({ field: "userId", value: userId });
+                    const allForCount = await findManyEventRows(adapter, {
+                        where: countWhere.length > 0 ? countWhere : undefined,
+                        limit: 100000,
+                    });
+                    total = Array.isArray(allForCount) ? allForCount.length : null;
+                }
+            }
+            catch {
+                // Count is best-effort
+            }
             res.json({
                 events: transformedEvents,
                 hasMore,
                 nextCursor: hasMore ? transformedEvents[transformedEvents.length - 1].id : null,
+                total,
             });
         }
         catch (error) {
             const msg = error instanceof Error ? error.message : String(error);
-            if (msg?.includes("not found in schema") ||
-                msg?.includes("Model") ||
-                error?.code === "P2025" ||
-                error?.code === "42P01") {
-                return res.status(503).json({
-                    error: "Events not ready",
-                    retryable: true,
-                    details: msg,
+            if (isEventModelLookupError(error) || msg?.includes("not found in schema")) {
+                return res.status(200).json({
+                    events: [],
+                    hasMore: false,
+                    total: 0,
+                    ready: false,
                 });
             }
             console.error("Failed to fetch events:", error);
@@ -1964,8 +2437,9 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             });
         }
     });
-    router.get("/api/events/count", async (_req, res) => {
+    router.get("/api/events/count", async (req, res) => {
         try {
+            const userIdFilter = req.query.userId;
             const { getEventIngestionProvider, isEventIngestionInitialized } = await import("./utils/event-ingestion.js");
             if (!isEventIngestionInitialized()) {
                 try {
@@ -2025,10 +2499,51 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 }
             }
             const eventProvider = getEventIngestionProvider();
-            const isSchemaError = (e) => e?.message?.includes("not found in schema") ||
-                e?.message?.includes("Model") ||
-                e?.code === "P2025" ||
-                e?.code === "42P01";
+            const isSchemaError = (e) => isEventModelLookupError(e);
+            // When filtering by userId, use query() to get filtered count
+            if (userIdFilter) {
+                if (eventProvider?.query) {
+                    try {
+                        const result = await eventProvider.query({
+                            limit: 100000,
+                            sort: "desc",
+                            userId: userIdFilter,
+                        });
+                        const events = result.events ?? [];
+                        const total = events.length;
+                        const failed = events.filter((e) => e.status === "failed" || e.display?.severity === "failed").length;
+                        const warning = events.filter((e) => e.display?.severity === "warning").length;
+                        const info = events.filter((e) => e.display?.severity === "info" || (!e.display?.severity && e.status !== "failed")).length;
+                        const success = total - failed - warning - info;
+                        return res.json({ total, success, failed, warning, info });
+                    }
+                    catch (e) {
+                        if (isSchemaError(e)) {
+                            return res.json({ total: 0, success: 0, failed: 0, warning: 0, info: 0 });
+                        }
+                        throw e;
+                    }
+                }
+                const adapter = await getAuthAdapterWithConfig();
+                if (adapter?.findMany) {
+                    try {
+                        const events = await findManyEventRows(adapter, {
+                            where: [{ field: "userId", value: userIdFilter }],
+                            limit: 100000,
+                        });
+                        const list = Array.isArray(events) ? events : [];
+                        const total = list.length;
+                        return res.json({ total, success: null, failed: null, warning: null, info: null });
+                    }
+                    catch (e) {
+                        if (isSchemaError(e)) {
+                            return res.json({ total: 0, success: 0, failed: 0, warning: 0, info: 0 });
+                        }
+                        throw e;
+                    }
+                }
+                return res.json({ total: 0, success: 0, failed: 0, warning: 0, info: 0 });
+            }
             if (eventProvider?.getStats) {
                 try {
                     const stats = await eventProvider.getStats();
@@ -2036,11 +2551,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 }
                 catch (e) {
                     if (isSchemaError(e)) {
-                        return res.status(503).json({
-                            error: "Events not ready",
-                            retryable: true,
-                            details: e?.message || String(e),
-                        });
+                        return res.json({ total: 0, success: 0, failed: 0, warning: 0, info: 0 });
                     }
                     throw e;
                 }
@@ -2052,11 +2563,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 }
                 catch (e) {
                     if (isSchemaError(e)) {
-                        return res.status(503).json({
-                            error: "Events not ready",
-                            retryable: true,
-                            details: e?.message || String(e),
-                        });
+                        return res.json({ total: 0, success: 0, failed: 0, warning: 0, info: 0 });
                     }
                     throw e;
                 }
@@ -2074,11 +2581,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 }
                 catch (e) {
                     if (isSchemaError(e)) {
-                        return res.status(503).json({
-                            error: "Events not ready",
-                            retryable: true,
-                            details: e?.message || String(e),
-                        });
+                        return res.json({ total: 0, success: 0, failed: 0, warning: 0, info: 0 });
                     }
                     throw e;
                 }
@@ -2086,8 +2589,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             const adapter = await getAuthAdapterWithConfig();
             if (adapter?.findMany) {
                 try {
-                    const events = await adapter.findMany({
-                        model: "auth_events",
+                    const events = await findManyEventRows(adapter, {
                         limit: 100000,
                     });
                     const list = Array.isArray(events) ? events : [];
@@ -2103,11 +2605,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 }
                 catch (e) {
                     if (isSchemaError(e)) {
-                        return res.status(503).json({
-                            error: "Events not ready",
-                            retryable: true,
-                            details: e?.message || String(e),
-                        });
+                        return res.json({ total: 0, success: 0, failed: 0, warning: 0, info: 0 });
                     }
                     throw e;
                 }
@@ -2120,11 +2618,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                 msg?.includes("Model") ||
                 error?.code === "P2025" ||
                 error?.code === "42P01") {
-                return res.status(503).json({
-                    error: "Events not ready",
-                    retryable: true,
-                    details: msg,
-                });
+                return res.json({ total: 0, success: 0, failed: 0, warning: 0, info: 0 });
             }
             console.error("Failed to get events count:", error);
             res.status(500).json({
@@ -2221,8 +2715,14 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
         try {
             const page = parseInt(req.query.page, 10) || 1;
             const limit = parseInt(req.query.limit, 10) || 20;
-            const sessions = await getAuthData(authConfig, "sessions", { page, limit }, configPath, preloadedAdapter);
-            res.json(sessions);
+            const result = await getAuthData(authConfig, "sessions", { page, limit }, configPath, preloadedAdapter);
+            res.json({
+                sessions: result.data || [],
+                total: result.total || 0,
+                page: result.page || page,
+                limit: result.limit || limit,
+                totalPages: result.totalPages || 0,
+            });
         }
         catch (_error) {
             res.status(500).json({ error: "Failed to fetch sessions" });
@@ -2240,6 +2740,12 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
     router.delete("/api/users/:id", async (req, res) => {
         try {
             const { id } = req.params;
+            const session = req.studioSession;
+            if (session && session.userId && session.userId === id) {
+                return res
+                    .status(400)
+                    .json({ success: false, error: "You cannot delete the currently authenticated user" });
+            }
             await getAuthData(authConfig, "deleteUser", { id }, configPath, preloadedAdapter);
             res.json({ success: true });
         }
@@ -3015,6 +3521,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             });
             const table = {
                 name,
+                contextKey: key,
                 displayName: formatDisplayName(name),
                 origin: tableMeta?.plugin?.id ||
                     tableMeta?.pluginId ||
@@ -3049,6 +3556,109 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
         tableEntries.sort((a, b) => (a.order ?? 0) - (b.order ?? 0));
         return { tables: tableEntries };
     }
+    function normalizeModelName(value) {
+        if (!value)
+            return null;
+        return value.trim();
+    }
+    function toSnakeCase(value) {
+        return value
+            .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+            .replace(/[-\s]+/g, "_")
+            .toLowerCase();
+    }
+    function toCamelCase(value) {
+        const normalized = value.replace(/[-\s]+/g, "_");
+        return normalized.replace(/_([a-z0-9])/gi, (_, char) => char.toUpperCase());
+    }
+    function getTableModelCandidates(table) {
+        const names = [table?.name, table?.contextKey]
+            .map((value) => normalizeModelName(value))
+            .filter(Boolean);
+        return Array.from(new Set(names.flatMap((value) => {
+            const snake = toSnakeCase(value);
+            const camel = toCamelCase(value);
+            return [value, snake, camel].filter(Boolean);
+        })));
+    }
+    function isMissingDatabaseModelError(error) {
+        const message = typeof error?.message === "string" ? error.message.toLowerCase() : "";
+        return (error?.code === "P2021" ||
+            error?.code === "P2025" ||
+            error?.code === "42P01" ||
+            message.includes("not found in schema") ||
+            (message.includes("model") && message.includes("not found")) ||
+            (message.includes("relation") && message.includes("does not exist")) ||
+            (message.includes("table") && message.includes("does not exist")) ||
+            message.includes("unknown table") ||
+            message.includes("no such table"));
+    }
+    async function getDatabaseModelCount(adapter, model) {
+        if (typeof adapter?.count === "function") {
+            const count = await adapter.count({ model });
+            return typeof count === "number" ? count : Number(count ?? 0);
+        }
+        if (typeof adapter?.findMany === "function") {
+            const rows = await adapter.findMany({
+                model,
+                limit: 100000,
+            });
+            return Array.isArray(rows) ? rows.length : 0;
+        }
+        return null;
+    }
+    async function resolveAvailableSchemaTables(schema) {
+        const adapter = await getAuthAdapterWithConfig();
+        if (!adapter ||
+            (typeof adapter.findMany !== "function" && typeof adapter.count !== "function")) {
+            return {
+                tables: schema.tables.map((table) => ({
+                    ...table,
+                    model: getTableModelCandidates(table)[0] || table.name,
+                    rowCount: null,
+                })),
+            };
+        }
+        const tables = await Promise.all(schema.tables.map(async (table) => {
+            const candidates = getTableModelCandidates(table);
+            for (const model of candidates) {
+                try {
+                    const rowCount = await getDatabaseModelCount(adapter, model);
+                    return {
+                        ...table,
+                        model,
+                        rowCount,
+                    };
+                }
+                catch (error) {
+                    if (isMissingDatabaseModelError(error)) {
+                        continue;
+                    }
+                    return {
+                        ...table,
+                        model: candidates[0] || table.name,
+                        rowCount: null,
+                    };
+                }
+            }
+            return null;
+        }));
+        return {
+            tables: tables.filter(Boolean),
+        };
+    }
+    function buildDatabaseSchemaSummary(schema) {
+        const tables = schema.tables || [];
+        const coreTableCount = tables.filter((table) => CONTEXT_CORE_TABLES.has(table.name)).length;
+        const pluginTableCount = tables.filter((table) => !CONTEXT_CORE_TABLES.has(table.name)).length;
+        return {
+            tableCount: tables.length,
+            coreTableCount,
+            pluginTableCount,
+            fieldCount: tables.reduce((sum, table) => sum + (table.fields?.length || 0), 0),
+            relationshipCount: tables.reduce((sum, table) => sum + (table.relationships?.length || 0), 0),
+        };
+    }
     async function generateSchemaFromContext(selectedPlugins) {
         try {
             const tables = await loadContextTables();
@@ -3073,28 +3683,34 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             return null;
         }
     }
+    async function generateResolvedDatabaseSchema(selectedPlugins) {
+        const schema = await generateSchemaFromContext(selectedPlugins);
+        if (!schema) {
+            return null;
+        }
+        const resolvedSchema = await resolveAvailableSchemaTables(schema);
+        return {
+            schema: resolvedSchema,
+            summary: buildDatabaseSchemaSummary(resolvedSchema),
+        };
+    }
     router.get("/api/database/schema", async (req, res) => {
         try {
-            const adapter = await getAuthAdapterWithConfig();
             const { plugins } = req.query;
             let selectedPlugins = [];
             if (plugins && typeof plugins === "string") {
                 selectedPlugins = plugins.split(",").filter(Boolean);
             }
-            if (!adapter) {
-                return res.json({
-                    schema: null,
-                    error: "Auth adapter not available",
-                });
-            }
-            const schema = await generateSchemaFromContext(selectedPlugins);
-            if (!schema) {
+            const resolvedDatabaseSchema = await generateResolvedDatabaseSchema(selectedPlugins);
+            if (!resolvedDatabaseSchema) {
                 return res.json({
                     success: false,
                     schema: null,
+                    summary: null,
                     error: "Failed to load schema from Better Auth context. Please ensure your auth configuration is properly set up.",
                 });
             }
+            const { schema, summary } = resolvedDatabaseSchema;
             // Extract available plugins from schema
             const availablePlugins = Array.from(new Set(schema.tables
                 .map((table) => table.origin)
@@ -3102,6 +3718,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             res.json({
                 success: true,
                 schema: schema,
+                summary,
                 availablePlugins: availablePlugins,
                 selectedPlugins: selectedPlugins,
             });
@@ -3511,6 +4128,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
             }
             const transformedInvitations = await Promise.all(invitations.map(async (invitation) => {
                 let organizationName = "Unknown";
+                let organizationLogo;
                 let teamName;
                 try {
                     if (invitation.organizationId &&
@@ -3522,6 +4140,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                                 where: [{ field: "id", value: invitation.organizationId }],
                             });
                             organizationName = org?.name || "Unknown";
+                            organizationLogo = org?.logo;
                         }
                         catch (_orgError) {
                             // Ignore org fetch errors
@@ -3548,6 +4167,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                     status: invitation.status || "pending",
                     organizationId: invitation.organizationId,
                     organizationName,
+                    organizationLogo,
                     teamId: invitation.teamId,
                     teamName,
                     inviterId: invitation.inviterId,
@@ -4631,7 +5251,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                     const organizationData = {
                         name: organizationName,
                         slug: generateSlug(organizationName),
-                        image: `https://api.dicebear.com/7.x/identicon/svg?seed=${randomSuffix}`,
+                        logo: `https://api.dicebear.com/7.x/identicon/svg?seed=${randomSuffix}`,
                         createdAt: new Date(),
                         updatedAt: new Date(),
                     };
@@ -4642,7 +5262,7 @@ export function createRoutes(authConfig, configPath, geoDbPath, preloadedAdapter
                             id: organization.id,
                             name: organization.name,
                             slug: organization.slug,
-                            image: organization.image,
+                            logo: organization.logo,
                             createdAt: organization.createdAt,
                         },
                     });
@@ -6689,6 +7309,7 @@ export async function handleStudioApiRequest(ctx) {
         }
         catch { }
     }
+    const isSelfHosted = !!preloadedAdapter;
     const authOptions = ctx.auth?.options || null;
     const router = createRoutes(ctx.auth, ctx.configPath || "", undefined, preloadedAdapter, authOptions, ctx.accessConfig, ctx.auth, ctx.studioConfig);
     const [pathname, queryString] = ctx.path.split("?");
@@ -6700,6 +7321,26 @@ export async function handleStudioApiRequest(ctx) {
                 query[key] = decodeURIComponent(value || "");
         });
     }
+    if (isSelfHosted) {
+        const accessDecision = evaluateRequestAccess({
+            accessConfig: ctx.accessConfig,
+            path: pathname,
+            method: ctx.method,
+            headers: ctx.headers,
+            ip: ctx.ip,
+        });
+        if (!accessDecision.allowed) {
+            return {
+                status: 403,
+                data: {
+                    success: false,
+                    message: accessDecision.message,
+                    reason: accessDecision.reason,
+                    ...(accessDecision.ipAddress ? { ipAddress: accessDecision.ipAddress } : {}),
+                },
+            };
+        }
+    }
     try {
         const route = findMatchingRoute(router, pathname, ctx.method);
         if (!route) {
@@ -6723,6 +7364,7 @@ export async function handleStudioApiRequest(ctx) {
             path: pathname,
             originalUrl: ctx.path,
             headers: ctx.headers,
+            ip: ctx.ip || extractClientIp(ctx.headers) || undefined,
             body: ctx.body,
             query: query,
             params: route.params,
@@ -6800,4 +7442,3 @@ function extractParams(routePath, requestPath) {
     });
     return params;
 }
-//# sourceMappingURL=routes.js.map