better-auth 1.2.6-beta.6 → 1.2.6-beta.7

package/dist/plugins/passkey/index.d.ts

@@ -2,9 +2,9 @@ import * as _simplewebauthn_server from '@simplewebauthn/server';
 import { CredentialDeviceType, PublicKeyCredentialCreationOptionsJSON, AuthenticationResponseJSON } from '@simplewebauthn/server';
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { I as InferOptionSchema } from '../../shared/better-auth.CouMuYtz.js';
+import { I as InferOptionSchema } from '../../shared/better-auth.DU2QNVc_.js';
 import '../../shared/better-auth.Bi8FQwDD.js';
-import '../../shared/better-auth.Cr5ixZZK.js';
+import '../../shared/better-auth.BANAxdkL.js';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/phone-number/index.d.cts

@@ -1,8 +1,8 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { U as User, I as InferOptionSchema } from '../../shared/better-auth.BArzzn5a.cjs';
+import { U as User, I as InferOptionSchema } from '../../shared/better-auth.BiQsvaIP.cjs';
 import '../../shared/better-auth.Bi8FQwDD.cjs';
-import '../../shared/better-auth.DpnaS1Ry.cjs';
+import '../../shared/better-auth.B2Fw1vhH.cjs';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/phone-number/index.d.mts

@@ -1,8 +1,8 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { U as User, I as InferOptionSchema } from '../../shared/better-auth.DCCen_rd.mjs';
+import { U as User, I as InferOptionSchema } from '../../shared/better-auth.D-oLmHIj.mjs';
 import '../../shared/better-auth.Bi8FQwDD.mjs';
-import '../../shared/better-auth.-kZ-JqcP.mjs';
+import '../../shared/better-auth.bKwabe3I.mjs';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/phone-number/index.d.ts

@@ -1,8 +1,8 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { U as User, I as InferOptionSchema } from '../../shared/better-auth.CouMuYtz.js';
+import { U as User, I as InferOptionSchema } from '../../shared/better-auth.DU2QNVc_.js';
 import '../../shared/better-auth.Bi8FQwDD.js';
-import '../../shared/better-auth.Cr5ixZZK.js';
+import '../../shared/better-auth.BANAxdkL.js';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/sso/index.d.cts

@@ -1,7 +1,7 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { O as OAuth2Tokens } from '../../shared/better-auth.DpnaS1Ry.cjs';
-import { U as User } from '../../shared/better-auth.BArzzn5a.cjs';
+import { O as OAuth2Tokens } from '../../shared/better-auth.B2Fw1vhH.cjs';
+import { U as User } from '../../shared/better-auth.BiQsvaIP.cjs';
 import '../../shared/better-auth.Bi8FQwDD.cjs';
 import 'jose';
 import 'kysely';

package/dist/plugins/sso/index.d.mts

@@ -1,7 +1,7 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { O as OAuth2Tokens } from '../../shared/better-auth.-kZ-JqcP.mjs';
-import { U as User } from '../../shared/better-auth.DCCen_rd.mjs';
+import { O as OAuth2Tokens } from '../../shared/better-auth.bKwabe3I.mjs';
+import { U as User } from '../../shared/better-auth.D-oLmHIj.mjs';
 import '../../shared/better-auth.Bi8FQwDD.mjs';
 import 'jose';
 import 'kysely';

package/dist/plugins/sso/index.d.ts

@@ -1,7 +1,7 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { O as OAuth2Tokens } from '../../shared/better-auth.Cr5ixZZK.js';
-import { U as User } from '../../shared/better-auth.CouMuYtz.js';
+import { O as OAuth2Tokens } from '../../shared/better-auth.BANAxdkL.js';
+import { U as User } from '../../shared/better-auth.DU2QNVc_.js';
 import '../../shared/better-auth.Bi8FQwDD.js';
 import 'jose';
 import 'kysely';

package/dist/plugins/two-factor/index.d.cts

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 import * as better_call from 'better-call';
-import { U as User, I as InferOptionSchema, d as AuthEndpoint, S as Session, G as GenericEndpointContext, H as HookEndpointContext } from '../../shared/better-auth.BArzzn5a.cjs';
+import { U as User, I as InferOptionSchema, d as AuthEndpoint, S as Session, G as GenericEndpointContext, H as HookEndpointContext } from '../../shared/better-auth.BiQsvaIP.cjs';
 import { L as LiteralString } from '../../shared/better-auth.Bi8FQwDD.cjs';
 import * as _better_fetch_fetch from '@better-fetch/fetch';
-import '../../shared/better-auth.DpnaS1Ry.cjs';
+import '../../shared/better-auth.B2Fw1vhH.cjs';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/two-factor/index.d.mts

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 import * as better_call from 'better-call';
-import { U as User, I as InferOptionSchema, d as AuthEndpoint, S as Session, G as GenericEndpointContext, H as HookEndpointContext } from '../../shared/better-auth.DCCen_rd.mjs';
+import { U as User, I as InferOptionSchema, d as AuthEndpoint, S as Session, G as GenericEndpointContext, H as HookEndpointContext } from '../../shared/better-auth.D-oLmHIj.mjs';
 import { L as LiteralString } from '../../shared/better-auth.Bi8FQwDD.mjs';
 import * as _better_fetch_fetch from '@better-fetch/fetch';
-import '../../shared/better-auth.-kZ-JqcP.mjs';
+import '../../shared/better-auth.bKwabe3I.mjs';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/two-factor/index.d.ts

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 import * as better_call from 'better-call';
-import { U as User, I as InferOptionSchema, d as AuthEndpoint, S as Session, G as GenericEndpointContext, H as HookEndpointContext } from '../../shared/better-auth.CouMuYtz.js';
+import { U as User, I as InferOptionSchema, d as AuthEndpoint, S as Session, G as GenericEndpointContext, H as HookEndpointContext } from '../../shared/better-auth.DU2QNVc_.js';
 import { L as LiteralString } from '../../shared/better-auth.Bi8FQwDD.js';
 import * as _better_fetch_fetch from '@better-fetch/fetch';
-import '../../shared/better-auth.Cr5ixZZK.js';
+import '../../shared/better-auth.BANAxdkL.js';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/username/index.d.cts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 import * as better_call from 'better-call';
-import { I as InferOptionSchema, H as HookEndpointContext } from '../../shared/better-auth.BArzzn5a.cjs';
+import { I as InferOptionSchema, H as HookEndpointContext } from '../../shared/better-auth.BiQsvaIP.cjs';
 import '../../shared/better-auth.Bi8FQwDD.cjs';
-import '../../shared/better-auth.DpnaS1Ry.cjs';
+import '../../shared/better-auth.B2Fw1vhH.cjs';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/username/index.d.mts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 import * as better_call from 'better-call';
-import { I as InferOptionSchema, H as HookEndpointContext } from '../../shared/better-auth.DCCen_rd.mjs';
+import { I as InferOptionSchema, H as HookEndpointContext } from '../../shared/better-auth.D-oLmHIj.mjs';
 import '../../shared/better-auth.Bi8FQwDD.mjs';
-import '../../shared/better-auth.-kZ-JqcP.mjs';
+import '../../shared/better-auth.bKwabe3I.mjs';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/plugins/username/index.d.ts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 import * as better_call from 'better-call';
-import { I as InferOptionSchema, H as HookEndpointContext } from '../../shared/better-auth.CouMuYtz.js';
+import { I as InferOptionSchema, H as HookEndpointContext } from '../../shared/better-auth.DU2QNVc_.js';
 import '../../shared/better-auth.Bi8FQwDD.js';
-import '../../shared/better-auth.Cr5ixZZK.js';
+import '../../shared/better-auth.BANAxdkL.js';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';

package/dist/shared/{better-auth.Dmtp4RCi.mjs → better-auth.A3TjrU8G.mjs}

@@ -1,6 +1,6 @@
 import { g as getDate } from './better-auth.CW6D9eSx.mjs';
 import { d as parseSessionOutput, b as parseUserOutput } from './better-auth.CepcSj5H.mjs';
-import { g as getIp } from './better-auth.DZGc_87_.mjs';
+import { g as getIp } from './better-auth.BrOpzmqo.mjs';
 import { s as safeJSONParse } from './better-auth.tB5eU6EY.mjs';
 import { g as generateId } from './better-auth.BUPPRXfK.mjs';
 import 'zod';

package/dist/shared/{better-auth.DpnaS1Ry.d.cts → better-auth.B2Fw1vhH.d.cts}

@@ -689,7 +689,7 @@ interface TwitterProfile {
         id: string;
         /** The friendly name of this user, as shown on their profile. */
         name: string;
-        /** @note Email is currently unsupported by Twitter.  */
+        /** The email address of this user. */
         email?: string;
         /** The Twitter handle (screen name) of this user. */
         username: string;
@@ -792,9 +792,7 @@ declare const twitter: (options: TwitterOption) => {
         user: {
             id: string;
             name?: string;
-            email
-            /** The URL to the profile image for this user, as shown on the user's profile. */
-            ? /** The URL to the profile image for this user, as shown on the user's profile. */: string | null;
+            email?: string | null;
             image?: string;
             emailVerified: boolean;
             [key: string]: any;

package/dist/shared/{better-auth.Cr5ixZZK.d.ts → better-auth.BANAxdkL.d.ts}

@@ -689,7 +689,7 @@ interface TwitterProfile {
         id: string;
         /** The friendly name of this user, as shown on their profile. */
         name: string;
-        /** @note Email is currently unsupported by Twitter.  */
+        /** The email address of this user. */
         email?: string;
         /** The Twitter handle (screen name) of this user. */
         username: string;
@@ -792,9 +792,7 @@ declare const twitter: (options: TwitterOption) => {
         user: {
             id: string;
             name?: string;
-            email
-            /** The URL to the profile image for this user, as shown on the user's profile. */
-            ? /** The URL to the profile image for this user, as shown on the user's profile. */: string | null;
+            email?: string | null;
             image?: string;
             emailVerified: boolean;
             [key: string]: any;

package/dist/shared/{better-auth.BGUZBbM4.cjs → better-auth.BIjcZ_vt.cjs}

@@ -2,7 +2,7 @@
 
 const date = require('./better-auth.C1hdVENX.cjs');
 const schema = require('./better-auth.C5H9XEzZ.cjs');
-const getRequestIp = require('./better-auth.i9-25Ul9.cjs');
+const getRequestIp = require('./better-auth.BSsp73pg.cjs');
 const json = require('./better-auth.D3mtHEZg.cjs');
 const id = require('./better-auth.Bg6iw3ig.cjs');
 require('zod');

package/dist/shared/{better-auth.2p1C52nv.d.ts → better-auth.BRf6Iynu.d.ts}

@@ -1,4 +1,4 @@
-import { G as GenericEndpointContext } from './better-auth.CouMuYtz.js';
+import { G as GenericEndpointContext } from './better-auth.DU2QNVc_.js';
 
 declare function generateState(c: GenericEndpointContext, link?: {
     email: string;

package/dist/shared/{better-auth.i9-25Ul9.cjs → better-auth.BSsp73pg.cjs}

@@ -24,7 +24,7 @@ function getIp(req, options) {
   ];
   const headers = "headers" in req ? req.headers : req;
   for (const key of keys) {
-    const value = headers.get(key);
+    const value = "get" in headers ? headers.get(key) : headers[key];
     if (typeof value === "string") {
       const ip = value.split(",")[0].trim();
       if (ip) return ip;

package/dist/shared/{better-auth.CvCI1gIa.d.ts → better-auth.BWp5dztg.d.ts}

@@ -1,6 +1,6 @@
 import * as zod from 'zod';
 import * as better_call from 'better-call';
-import { G as GenericEndpointContext, I as InferOptionSchema, H as HookEndpointContext, l as AuthContext } from './better-auth.CouMuYtz.js';
+import { G as GenericEndpointContext, I as InferOptionSchema, H as HookEndpointContext, j as AuthContext } from './better-auth.DU2QNVc_.js';
 import { Statements } from '../plugins/access/index.js';
 
 declare const apiKeySchema: ({ timeWindow, rateLimitMax, }: {

package/dist/shared/{better-auth.BArzzn5a.d.cts → better-auth.BiQsvaIP.d.cts}

@@ -1,7 +1,7 @@
 import { L as LiteralString, d as LiteralUnion, D as DeepPartial, U as UnionToIntersection, S as StripEmptyObjects, O as OmitId, P as PrettifyDeep, b as Prettify, E as Expand } from './better-auth.Bi8FQwDD.cjs';
 import * as zod from 'zod';
 import { ZodSchema, z } from 'zod';
-import { a as OAuthProvider, S as SocialProviders, b as SocialProviderList, O as OAuth2Tokens } from './better-auth.DpnaS1Ry.cjs';
+import { a as OAuthProvider, S as SocialProviders, b as SocialProviderList, O as OAuth2Tokens } from './better-auth.B2Fw1vhH.cjs';
 import { Migration, PostgresPool, MysqlPool, Dialect, Kysely } from 'kysely';
 import * as better_call from 'better-call';
 import { EndpointContext, InputContext, CookieOptions, Endpoint, Middleware } from 'better-call';
@@ -14264,4 +14264,4 @@ type Auth = {
     $context: Promise<AuthContext>;
 };
 
-export { createFieldAttribute as $, type AuthPluginSchema as A, type BetterAuthPlugin as B, type InferSessionAPI as C, type InferAPI as D, levels as E, type FilteredAPI as F, type GenericEndpointContext as G, type HookEndpointContext as H, type InferOptionSchema as I, shouldPublishLog as J, type KyselyDatabaseType as K, type LogLevel as L, type Models as M, type Logger as N, type LogHandlerParams as O, createLogger as P, logger as Q, type RateLimit as R, type Session as S, type FieldAttribute as T, type User as U, type Verification as V, type Where as W, type FieldType as X, createInternalAdapter as Y, type InternalAdapter as Z, type FieldAttributeConfig as _, type InferPluginErrorCodes as a, changeEmail as a$, type InferValueType as a0, type InferFieldsOutput as a1, type InferFieldsInput as a2, type InferFieldsInputClient as a3, type PluginFieldAttribute as a4, type InferFieldsFromPlugins as a5, type InferFieldsFromOptions as a6, type BetterAuthDbSchema as a7, getAuthTables as a8, accountSchema as a9, getEndpoints as aA, router as aB, signInSocial as aC, signInEmail as aD, callbackOAuth as aE, getSession as aF, getSessionFromCtx as aG, sessionMiddleware as aH, requestOnlySessionMiddleware as aI, freshSessionMiddleware as aJ, listSessions as aK, revokeSession as aL, revokeSessions as aM, revokeOtherSessions as aN, signOut as aO, forgetPassword as aP, forgetPasswordCallback as aQ, resetPassword as aR, createEmailVerificationToken as aS, sendVerificationEmailFn as aT, sendVerificationEmail as aU, verifyEmail as aV, updateUser as aW, changePassword as aX, setPassword as aY, deleteUser as aZ, deleteUserCallback as a_, userSchema as aa, sessionSchema as ab, verificationSchema as ac, parseOutputData as ad, getAllFields as ae, parseUserOutput as af, parseAccountOutput as ag, parseSessionOutput as ah, parseInputData as ai, parseUserInput as aj, parseAdditionalUserInput as ak, parseAccountInput as al, parseSessionInput as am, mergeSchema as an, createCookieGetter as ao, getCookies as ap, type BetterAuthCookies as aq, setCookieCache as ar, setSessionCookie as as, deleteSessionCookie as at, parseCookies as au, type EligibleCookies as av, getSessionCookie as aw, getCookieCache as ax, parseSetCookieHeader as ay, setCookieToHeader as az, createAuthEndpoint as b, error as b0, ok as b1, signUpEmail as b2, listUserAccounts as b3, linkSocialAccount as b4, unlinkAccount as b5, refreshToken as b6, originCheckMiddleware as b7, originCheck as b8, createAuthMiddleware as c, type AuthEndpoint as d, type AuthMiddleware as e, type BetterAuthOptions as f, type Adapter as g, BASE_ERROR_CODES as h, type Auth as i, type InferUser as j, type InferSession as k, type AuthContext as l, type WithJsDoc as m, betterAuth as n, optionsMiddleware as o, type AdditionalUserFieldsInput as p, type AdditionalUserFieldsOutput as q, type AdditionalSessionFieldsInput as r, type AdditionalSessionFieldsOutput as s, type InferPluginTypes as t, type Account as u, init as v, type AdapterSchemaCreation as w, type AdapterInstance as x, type SecondaryStorage as y, type FilterActions as z };
+export { createFieldAttribute as $, type AuthPluginSchema as A, type BetterAuthPlugin as B, type InferSessionAPI as C, type InferAPI as D, levels as E, type FilteredAPI as F, type GenericEndpointContext as G, type HookEndpointContext as H, type InferOptionSchema as I, shouldPublishLog as J, type KyselyDatabaseType as K, type LogLevel as L, type Models as M, type Logger as N, type LogHandlerParams as O, createLogger as P, logger as Q, type RateLimit as R, type Session as S, type FieldAttribute as T, type User as U, type Verification as V, type Where as W, type FieldType as X, createInternalAdapter as Y, type InternalAdapter as Z, type FieldAttributeConfig as _, type InferPluginErrorCodes as a, changeEmail as a$, type InferValueType as a0, type InferFieldsOutput as a1, type InferFieldsInput as a2, type InferFieldsInputClient as a3, type PluginFieldAttribute as a4, type InferFieldsFromPlugins as a5, type InferFieldsFromOptions as a6, type BetterAuthDbSchema as a7, getAuthTables as a8, accountSchema as a9, getEndpoints as aA, router as aB, signInSocial as aC, signInEmail as aD, callbackOAuth as aE, getSession as aF, getSessionFromCtx as aG, sessionMiddleware as aH, requestOnlySessionMiddleware as aI, freshSessionMiddleware as aJ, listSessions as aK, revokeSession as aL, revokeSessions as aM, revokeOtherSessions as aN, signOut as aO, forgetPassword as aP, forgetPasswordCallback as aQ, resetPassword as aR, createEmailVerificationToken as aS, sendVerificationEmailFn as aT, sendVerificationEmail as aU, verifyEmail as aV, updateUser as aW, changePassword as aX, setPassword as aY, deleteUser as aZ, deleteUserCallback as a_, userSchema as aa, sessionSchema as ab, verificationSchema as ac, parseOutputData as ad, getAllFields as ae, parseUserOutput as af, parseAccountOutput as ag, parseSessionOutput as ah, parseInputData as ai, parseUserInput as aj, parseAdditionalUserInput as ak, parseAccountInput as al, parseSessionInput as am, mergeSchema as an, createCookieGetter as ao, getCookies as ap, type BetterAuthCookies as aq, setCookieCache as ar, setSessionCookie as as, deleteSessionCookie as at, parseCookies as au, type EligibleCookies as av, getSessionCookie as aw, getCookieCache as ax, parseSetCookieHeader as ay, setCookieToHeader as az, createAuthEndpoint as b, error as b0, ok as b1, signUpEmail as b2, listUserAccounts as b3, linkSocialAccount as b4, unlinkAccount as b5, refreshToken as b6, originCheckMiddleware as b7, originCheck as b8, createAuthMiddleware as c, type AuthEndpoint as d, type AuthMiddleware as e, type BetterAuthOptions as f, type Adapter as g, BASE_ERROR_CODES as h, type Auth as i, type AuthContext as j, type InferUser as k, type InferSession as l, type WithJsDoc as m, betterAuth as n, optionsMiddleware as o, type AdditionalUserFieldsInput as p, type AdditionalUserFieldsOutput as q, type AdditionalSessionFieldsInput as r, type AdditionalSessionFieldsOutput as s, type InferPluginTypes as t, type Account as u, init as v, type AdapterSchemaCreation as w, type AdapterInstance as x, type SecondaryStorage as y, type FilterActions as z };

package/dist/shared/{better-auth.DZGc_87_.mjs → better-auth.BrOpzmqo.mjs}

@@ -22,7 +22,7 @@ function getIp(req, options) {
   ];
   const headers = "headers" in req ? req.headers : req;
   for (const key of keys) {
-    const value = headers.get(key);
+    const value = "get" in headers ? headers.get(key) : headers[key];
     if (typeof value === "string") {
       const ip = value.split(",")[0].trim();
       if (ip) return ip;

package/dist/shared/better-auth.CApEjVDP.cjs

@@ -0,0 +1,21 @@
+'use strict';
+
+const plugins_admin_access_index = require('../plugins/admin/access/index.cjs');
+
+const hasPermission = (input) => {
+  if (input.userId && input.options?.adminUserIds?.includes(input.userId)) {
+    return true;
+  }
+  const roles = (input.role || input.options?.defaultRole || "user").split(",");
+  const acRoles = input.options?.roles || plugins_admin_access_index.defaultRoles;
+  for (const role of roles) {
+    const _role = acRoles[role];
+    const result = _role?.authorize(input.permission);
+    if (result?.success) {
+      return true;
+    }
+  }
+  return false;
+};
+
+exports.hasPermission = hasPermission;

package/dist/shared/{better-auth.CN1HkXUY.cjs → better-auth.CV1L7TPV.cjs}

@@ -23,8 +23,9 @@ require('@better-auth/utils');
 require('@better-auth/utils/hex');
 require('@noble/hashes/utils');
 require('./better-auth.CYeOI8C-.cjs');
-const plugins_organization_access_index = require('../plugins/organization/access/index.cjs');
+const hasPermission = require('./better-auth.DLTzKoOS.cjs');
 const cookies_index = require('../cookies/index.cjs');
+const plugins_organization_access_index = require('../plugins/organization/access/index.cjs');
 
 const shimContext = (originalObject, newContext) => {
   const shimmedObj = {};
@@ -642,19 +643,6 @@ const ORGANIZATION_ERROR_CODES = {
   YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_TEAM: "You are not allowed to update this team"
 };
 
-const hasPermission = (input) => {
-  const roles = input.role.split(",");
-  const acRoles = input.options.roles || plugins_organization_access_index.defaultRoles;
-  for (const role of roles) {
-    const _role = acRoles[role];
-    const result = _role?.authorize(input.permission);
-    if (result?.success) {
-      return true;
-    }
-  }
-  return false;
-};
-
 const createInvitation = (option) => refreshToken.createAuthEndpoint(
   "/organization/invite-member",
   {
@@ -763,7 +751,7 @@ const createInvitation = (option) => refreshToken.createAuthEndpoint(
         message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND
       });
     }
-    const canInvite = hasPermission({
+    const canInvite = hasPermission.hasPermission({
       role: member.role,
       options: ctx.context.orgOptions,
       permission: {
@@ -1038,7 +1026,7 @@ const cancelInvitation = refreshToken.createAuthEndpoint(
         message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND
       });
     }
-    const canCancel = hasPermission({
+    const canCancel = hasPermission.hasPermission({
       role: member.role,
       options: ctx.context.orgOptions,
       permission: {
@@ -1349,12 +1337,6 @@ const removeMember = refreshToken.createAuthEndpoint(
         message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND
       });
     }
-    const role = ctx.context.roles[member.role];
-    if (!role) {
-      throw new betterCall.APIError("BAD_REQUEST", {
-        message: ORGANIZATION_ERROR_CODES.ROLE_NOT_FOUND
-      });
-    }
     const roles = toBeRemovedMember.role.split(",");
     const creatorRole = ctx.context.orgOptions?.creatorRole || "owner";
     const isOwner = roles.includes(creatorRole);
@@ -1377,7 +1359,7 @@ const removeMember = refreshToken.createAuthEndpoint(
         });
       }
     }
-    const canDeleteMember = hasPermission({
+    const canDeleteMember = hasPermission.hasPermission({
       role: member.role,
       options: ctx.context.orgOptions,
       permission: {
@@ -1457,6 +1439,9 @@ const updateMemberRole = (option) => refreshToken.createAuthEndpoint(
   },
   async (ctx) => {
     const session = ctx.context.session;
+    if (!ctx.body.role) {
+      throw new betterCall.APIError("BAD_REQUEST");
+    }
     const organizationId = ctx.body.organizationId || session.session.activeOrganizationId;
     if (!organizationId) {
       throw new betterCall.APIError("BAD_REQUEST", {
@@ -1474,35 +1459,32 @@ const updateMemberRole = (option) => refreshToken.createAuthEndpoint(
         message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND
       });
     }
-    const toBeUpdatedMember = member.role !== ctx.body.memberId ? await adapter.findMemberById(ctx.body.memberId) : member;
+    const toBeUpdatedMember = member.id !== ctx.body.memberId ? await adapter.findMemberById(ctx.body.memberId) : member;
     if (!toBeUpdatedMember) {
       throw new betterCall.APIError("BAD_REQUEST", {
         message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND
       });
     }
-    const role = ctx.context.roles[member.role];
-    if (!role) {
-      throw new betterCall.APIError("BAD_REQUEST", {
-        message: ORGANIZATION_ERROR_CODES.ROLE_NOT_FOUND
-      });
-    }
+    const toBeUpdatedMemberRoles = toBeUpdatedMember.role.split(",");
+    const updatingMemberRoles = member.role.split(",");
     const creatorRole = ctx.context.orgOptions?.creatorRole || "owner";
-    if (toBeUpdatedMember.role === creatorRole && member.role !== creatorRole || roleToSet.includes(creatorRole) && member.role !== creatorRole) {
+    if (toBeUpdatedMemberRoles.includes(creatorRole) && !updatingMemberRoles.includes(creatorRole) || roleToSet.includes(creatorRole) && !updatingMemberRoles.includes(creatorRole)) {
       throw new betterCall.APIError("FORBIDDEN", {
         message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER
       });
     }
-    const canUpdateMember = role.authorize({
-      member: ["update"]
-    }).success || ctx.body.role === "owner" && member.role === "owner";
+    const canUpdateMember = hasPermission.hasPermission({
+      role: member.role,
+      options: ctx.context.orgOptions,
+      permission: {
+        member: ["update"]
+      }
+    });
     if (!canUpdateMember) {
       throw new betterCall.APIError("FORBIDDEN", {
         message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER
       });
     }
-    if (!ctx.body.role) {
-      throw new betterCall.APIError("BAD_REQUEST");
-    }
     const updatedMember = await adapter.updateMember(
       ctx.body.memberId,
       parseRoles(ctx.body.role)
@@ -1879,7 +1861,7 @@ const updateOrganization = refreshToken.createAuthEndpoint(
         message: ORGANIZATION_ERROR_CODES.USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION
       });
     }
-    const canUpdateOrg = hasPermission({
+    const canUpdateOrg = hasPermission.hasPermission({
       permission: {
         organization: ["update"]
       },
@@ -1957,7 +1939,7 @@ const deleteOrganization = refreshToken.createAuthEndpoint(
         }
       });
     }
-    const canDeleteOrg = hasPermission({
+    const canDeleteOrg = hasPermission.hasPermission({
       role: member.role,
       permission: {
         organization: ["delete"]
@@ -2255,7 +2237,7 @@ const createTeam = (options) => refreshToken.createAuthEndpoint(
           message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_INVITE_USERS_TO_THIS_ORGANIZATION
         });
       }
-      const canCreate = hasPermission({
+      const canCreate = hasPermission.hasPermission({
         role: member.role,
         options: ctx.context.orgOptions,
         permission: {
@@ -2327,7 +2309,7 @@ const removeTeam = refreshToken.createAuthEndpoint(
           message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_INVITE_USERS_TO_THIS_ORGANIZATION
         });
       }
-      const canRemove = hasPermission({
+      const canRemove = hasPermission.hasPermission({
         role: member.role,
         options: ctx.context.orgOptions,
         permission: {
@@ -2392,7 +2374,7 @@ const updateTeam = refreshToken.createAuthEndpoint(
         message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_TEAM
       });
     }
-    const canUpdate = hasPermission({
+    const canUpdate = hasPermission.hasPermission({
       role: member.role,
       options: ctx.context.orgOptions,
       permission: {
@@ -2609,7 +2591,7 @@ const organization = (options) => {
               message: ORGANIZATION_ERROR_CODES.USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION
             });
           }
-          const result = hasPermission({
+          const result = hasPermission.hasPermission({
             role: member.role,
             options,
             permission: ctx.body.permission

package/dist/shared/{better-auth.CPKJJalM.cjs → better-auth.CsSpq0zL.cjs}

@@ -10,7 +10,7 @@ require('./better-auth.GpOOav9x.cjs');
 require('defu');
 const date = require('./better-auth.C1hdVENX.cjs');
 const pluginHelper = require('./better-auth.DNqtHmvg.cjs');
-const plugins_admin_access_index = require('../plugins/admin/access/index.cjs');
+const hasPermission = require('./better-auth.CApEjVDP.cjs');
 
 const ADMIN_ERROR_CODES = {
   FAILED_TO_CREATE_USER: "Failed to create user",
@@ -28,22 +28,6 @@ const ADMIN_ERROR_CODES = {
   BANNED_USER: "You have been banned from this application"
 };
 
-const hasPermission = (input) => {
-  if (input.options?.adminUserIds?.includes(input.userId)) {
-    return true;
-  }
-  const roles = (input.role || input.options?.defaultRole || "user").split(",");
-  const acRoles = input.options?.roles || plugins_admin_access_index.defaultRoles;
-  for (const role of roles) {
-    const _role = acRoles[role];
-    const result = _role?.authorize(input.permission);
-    if (result?.success) {
-      return true;
-    }
-  }
-  return false;
-};
-
 function parseRoles(roles) {
   return Array.isArray(roles) ? roles.join(",") : roles;
 }
@@ -177,7 +161,7 @@ const admin = (options) => {
           }
         },
         async (ctx) => {
-          const canSetRole = hasPermission({
+          const canSetRole = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: ctx.context.session.user.role,
             options: opts,
@@ -269,7 +253,7 @@ const admin = (options) => {
             throw ctx.error("UNAUTHORIZED");
           }
           if (session) {
-            const canCreateUser = hasPermission({
+            const canCreateUser = hasPermission.hasPermission({
               userId: session.user.id,
               role: session.user.role,
               options: opts,
@@ -396,7 +380,7 @@ const admin = (options) => {
         },
         async (ctx) => {
           const session = ctx.context.session;
-          const canListUsers = hasPermission({
+          const canListUsers = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: session.user.role,
             options: opts,
@@ -491,7 +475,7 @@ const admin = (options) => {
         },
         async (ctx) => {
           const session = ctx.context.session;
-          const canListSessions = hasPermission({
+          const canListSessions = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: session.user.role,
             options: opts,
@@ -549,7 +533,7 @@ const admin = (options) => {
         },
         async (ctx) => {
           const session = ctx.context.session;
-          const canBanUser = hasPermission({
+          const canBanUser = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: session.user.role,
             options: opts,
@@ -624,7 +608,7 @@ const admin = (options) => {
         },
         async (ctx) => {
           const session = ctx.context.session;
-          const canBanUser = hasPermission({
+          const canBanUser = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: session.user.role,
             options: opts,
@@ -696,7 +680,7 @@ const admin = (options) => {
           }
         },
         async (ctx) => {
-          const canImpersonateUser = hasPermission({
+          const canImpersonateUser = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: ctx.context.session.user.role,
             options: opts,
@@ -835,7 +819,7 @@ const admin = (options) => {
         },
         async (ctx) => {
           const session = ctx.context.session;
-          const canRevokeSession = hasPermission({
+          const canRevokeSession = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: session.user.role,
             options: opts,
@@ -893,7 +877,7 @@ const admin = (options) => {
         },
         async (ctx) => {
           const session = ctx.context.session;
-          const canRevokeSession = hasPermission({
+          const canRevokeSession = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: session.user.role,
             options: opts,
@@ -949,7 +933,7 @@ const admin = (options) => {
         },
         async (ctx) => {
           const session = ctx.context.session;
-          const canDeleteUser = hasPermission({
+          const canDeleteUser = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: session.user.role,
             options: opts,
@@ -1007,7 +991,7 @@ const admin = (options) => {
           }
         },
         async (ctx) => {
-          const canSetUserPassword = hasPermission({
+          const canSetUserPassword = hasPermission.hasPermission({
             userId: ctx.context.session.user.id,
             role: ctx.context.session.user.role,
             options: opts,
@@ -1105,7 +1089,7 @@ const admin = (options) => {
               message: "user not found"
             });
           }
-          const result = hasPermission({
+          const result = hasPermission.hasPermission({
             userId: user.id,
             role: user.role,
             options,