better-auth 1.6.22 → 1.6.24

package/dist/db/get-migration.mjs

@@ -55,7 +55,11 @@ const map = {
 	},
 	sqlite: {
 		string: ["TEXT"],
-		number: ["INTEGER", "REAL"],
+		number: [
+			"INTEGER",
+			"REAL",
+			"BIGINT"
+		],
 		boolean: ["INTEGER", "BOOLEAN"],
 		date: ["DATE", "INTEGER"],
 		json: ["TEXT"]
@@ -314,9 +318,9 @@ async function getMigrations(config) {
 				else col = col.defaultTo(sql`CURRENT_TIMESTAMP`);
 				return col;
 			});
-			if (field.index) {
-				const builder = db.schema.createIndex(`${table.table}_${fieldName}_${field.unique ? "uidx" : "idx"}`).on(table.table).columns([fieldName]);
-				deferredIndexes.push(field.unique ? builder.unique() : builder);
+			if (field.index && !field.unique) {
+				const builder = db.schema.createIndex(`${table.table}_${fieldName}_idx`).on(table.table).columns([fieldName]);
+				deferredIndexes.push(builder);
 			}
 		}
 		migrations.push(dbT);

package/dist/db/get-schema.d.mts

@@ -1,6 +1,5 @@
 import { BetterAuthOptions } from "@better-auth/core";
 import { DBFieldAttribute } from "@better-auth/core/db";
-
 //#region src/db/get-schema.d.ts
 declare function getSchema(config: BetterAuthOptions): Record<string, {
   fields: Record<string, DBFieldAttribute>;

package/dist/db/internal-adapter.d.mts

@@ -2,7 +2,6 @@ import { DatabaseHooksEntry } from "./with-hooks.mjs";
 import { AuthContext, BetterAuthOptions, InternalAdapter } from "@better-auth/core";
 import { InternalLogger } from "@better-auth/core/env";
 import { DBAdapter } from "@better-auth/core/db/adapter";
-
 //#region src/db/internal-adapter.d.ts
 declare const createInternalAdapter: (adapter: DBAdapter<BetterAuthOptions>, ctx: {
   options: Omit<BetterAuthOptions, "logger">;

package/dist/db/internal-adapter.mjs

@@ -177,6 +177,11 @@ const createInternalAdapter = (adapter, ctx) => {
 				ipAddress: headers ? getIp(headers, options) || "" : "",
 				userAgent: headers?.get("user-agent") || "",
 				...rest,
+				/**
+				* If the user doesn't want to be remembered
+				* set the session to expire in 1 day.
+				* The cookie will be set to expire at the end of the session
+				*/
 				expiresAt: dontRememberMe ? getDate(3600 * 24, "sec") : getDate(sessionExpiration, "sec"),
 				userId,
 				token: generateId(32),
@@ -385,6 +390,11 @@ const createInternalAdapter = (adapter, ctx) => {
 				value: userId
 			}], "account", void 0);
 		},
+		/**
+		* Delete an account by its primary key.
+		*
+		* @param id - The account row's primary key (the `id` column, not the `accountId` column).
+		*/
 		deleteAccount: async (id) => {
 			await deleteWithHooks([{
 				field: "id",
@@ -637,6 +647,31 @@ const createInternalAdapter = (adapter, ctx) => {
 				value: storedIdentifier
 			}], "verification", void 0);
 		},
+		/**
+		* Atomically consume a single-use verification row by `identifier` and
+		* return it. The first concurrent caller receives the latest row for the
+		* identifier; every other caller racing against it receives `null`.
+		*
+		* Race-safe replacement for the `findVerificationValue` then
+		* `deleteVerificationByIdentifier` pair. Callers MUST gate any state
+		* change (issue session, mint token, change password) on a non-null
+		* return value, because consuming one row invalidates the whole
+		* identifier and stale rows cannot be replayed.
+		*
+		* Rows past their `expiresAt` are treated as already invalid: the row
+		* is still deleted (so it cannot be replayed later) but `null` is
+		* returned. Callers do not need their own `expiresAt` gate.
+		*
+		* The secondary-storage-only path (`storeInDatabase: false`) is atomic
+		* only when the configured storage implements `getAndDelete`; otherwise
+		* it falls back to an in-process lock around `get` then `delete` and
+		* warns once, since that fallback cannot coordinate across processes.
+		*
+		* FIXME(consume-atomic): make `SecondaryStorage.getAndDelete` required
+		* in the next breaking release, or require database-backed verification
+		* storage for security-sensitive consume paths, so the non-atomic
+		* fallback can be removed entirely.
+		*/
 		consumeVerificationValue: async (identifier) => {
 			const storageOption = getStorageOption(identifier, options.verification?.storeIdentifier);
 			const storedIdentifier = await processIdentifier(identifier, storageOption);
@@ -661,7 +696,8 @@ const createInternalAdapter = (adapter, ctx) => {
 						logger.warn("Secondary storage does not implement `getAndDelete`, so single-use verification values cannot be consumed atomically across processes. Implement `getAndDelete` or use database-backed verification storage to guarantee single use.");
 					}
 					return withVerificationConsumeLock(key, async () => {
-						const parsed = hydrateCachedVerification(await secondaryStorage.get(key));
+						const raw = await secondaryStorage.get(key);
+						const parsed = hydrateCachedVerification(raw);
 						if (!parsed) return null;
 						await secondaryStorage.delete(key);
 						return parsed;
@@ -719,6 +755,30 @@ const createInternalAdapter = (adapter, ctx) => {
 			if (!consumed || consumed.expiresAt < /* @__PURE__ */ new Date()) return null;
 			return consumed;
 		},
+		/**
+		* First-writer-wins create keyed by a deterministic primary key derived
+		* from `identifier`. Returns `true` when this caller created the row and
+		* `false` when a row for the same identifier already existed.
+		*
+		* The dual of `consumeVerificationValue`: where consume races to delete a
+		* marker exactly once, reserve races to create a marker exactly once. Use
+		* it for replay tombstones (a SAML assertion id, a JWT `jti`) where the
+		* first caller wins and every later caller must observe that the marker is
+		* already taken.
+		*
+		* The `verification.identifier` column is non-unique, so uniqueness comes
+		* from a deterministic primary key (`SHA-256` of `reserve:<identifier>`).
+		* The database path is atomic: the primary key turns the INSERT into the
+		* first-writer-wins gate, and a duplicate is detected portably by
+		* re-reading the row rather than matching adapter-specific errors. The
+		* secondary-storage-only path has no primary key to enforce uniqueness, so
+		* it is best-effort under concurrency.
+		*
+		* The atomic guarantee requires the configured adapter to reject a
+		* duplicate primary key on insert, which every real database enforces. The
+		* in-memory adapter does not enforce primary-key uniqueness, so reservation
+		* is best-effort there (it is intended for development and tests).
+		*/
 		reserveVerificationValue: async (data) => {
 			const reservationId = base64Url.encode(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), { padding: false });
 			const storageOption = getStorageOption(data.identifier, options.verification?.storeIdentifier);

package/dist/db/revoke-unproven-account-access.d.mts

@@ -1,5 +1,4 @@
 import { GenericEndpointContext } from "@better-auth/core";
-
 //#region src/db/revoke-unproven-account-access.d.ts
 /**
  * Strip every credential and session a pre-existing account accrued before

package/dist/db/schema.d.mts

@@ -1,7 +1,7 @@
 import { Account, Session as Session$1, User as User$1 } from "../types/models.mjs";
+import "../types/index.mjs";
 import { BetterAuthOptions } from "@better-auth/core";
 import { BetterAuthPluginDBSchema, DBFieldAttribute } from "@better-auth/core/db";
-
 //#region src/db/schema.d.ts
 declare function parseUserOutput<T extends User$1>(options: BetterAuthOptions, user: T): T;
 /**
@@ -57,6 +57,6 @@ declare function mergeSchema<S extends BetterAuthPluginDBSchema>(schema: S, newS
   fields?: {
     [P: string]: string;
   } | undefined;
-} | undefined } | undefined): S;
+} | undefined; } | undefined): S;
 //#endregion
 export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/db/to-zod.d.mts

@@ -1,17 +1,13 @@
 import { DBFieldAttribute } from "@better-auth/core/db";
 import * as z from "zod";
-
 //#region src/db/to-zod.d.ts
-declare function toZodSchema<Fields extends Record<string, DBFieldAttribute | never>, IsClientSide extends boolean>({
-  fields,
-  isClientSide
-}: {
+declare function toZodSchema<Fields extends Record<string, DBFieldAttribute | never>, IsClientSide extends boolean>({ fields, isClientSide }: {
   fields: Fields;
   /**
    * If true, then any fields that have `input: false` will be removed from the schema to prevent user input.
    */
   isClientSide: IsClientSide;
-}): z.ZodObject<RemoveNeverProps<{ [key in keyof Fields]: FieldAttributeToSchema<Fields[key], IsClientSide> }>, z.core.$strip>;
+}): z.ZodObject<RemoveNeverProps<{ [key in keyof Fields]: FieldAttributeToSchema<Fields[key], IsClientSide>; }>, z.core.$strip>;
 type FieldAttributeToSchema<Field extends DBFieldAttribute | Record<string, never>, isClientSide extends boolean = false> = Field extends {
   type: any;
 } ? GetInput<isClientSide, Field, GetRequired<Field, GetType<Field>>> : Record<string, never>;
@@ -30,6 +26,6 @@ type GetRequired<F extends DBFieldAttribute, Schema extends z.core.SomeType> = F
 type GetInput<isClientSide extends boolean, Field extends DBFieldAttribute, Schema extends z.core.SomeType> = Field extends {
   input: false;
 } ? isClientSide extends true ? never : Schema : Schema;
-type RemoveNeverProps<T> = { [K in keyof T as [T[K]] extends [never] ? never : K]: T[K] };
+type RemoveNeverProps<T> = { [K in keyof T as [T[K]] extends [never] ? never : K]: T[K]; };
 //#endregion
 export { FieldAttributeToSchema, toZodSchema };

package/dist/db/with-hooks.d.mts

@@ -1,7 +1,6 @@
 import { BetterAuthOptions } from "@better-auth/core";
 import { BaseModelNames } from "@better-auth/core/db";
 import { DBAdapter, Where } from "@better-auth/core/db/adapter";
-
 //#region src/db/with-hooks.d.ts
 type DatabaseHooksEntry = {
   source: string;

package/dist/index.d.mts

@@ -11,6 +11,7 @@ import { generateState, parseState } from "./oauth2/state.mjs";
 import { StateData, generateGenericState, parseGenericState } from "./state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
 import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./utils/url.mjs";
+import "./utils/index.mjs";
 import { APIError } from "./api/index.mjs";
 import { StandardSchemaV1 } from "@better-auth/core";
 import { getCurrentAdapter } from "@better-auth/core/context";
@@ -25,6 +26,6 @@ export * from "@better-auth/core/utils/error-codes";
 export * from "@better-auth/core/utils/id";
 export * from "@better-auth/core/utils/json";
 export * from "@better-auth/core/social-providers";
-export * from "better-call";
-export * from "zod";
-export { APIError, Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, Auth, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, ClientAtomListener, ClientStore, DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, ExtractPluginField, FilteredAPI, HIDE_METADATA, HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginFieldFromTuple, InferPluginIDs, InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, JoinConfig, JoinOption, OverrideMerge, Prettify, PrettifyDeep, RateLimit, RequiredKeysOf, Session, SessionQueryParams, type StandardSchemaV1, StateData, StoreIdentifierOption, StripEmptyObjects, type TelemetryEvent, UnionToIntersection, User, Verification, Where, betterAuth, createTelemetry, generateGenericState, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };
+export type * from "better-call";
+export type * from "zod";
+export { APIError, type Account, type AdditionalSessionFieldsInput, type AdditionalUserFieldsInput, type Auth, type BetterAuthAdvancedOptions, type BetterAuthClientOptions, type BetterAuthClientPlugin, type BetterAuthCookies, type BetterAuthOptions, type BetterAuthPlugin, type BetterAuthRateLimitOptions, type ClientAtomListener, type ClientStore, type DBAdapter, type DBAdapterInstance, type DBAdapterSchemaCreation, type DBTransactionAdapter, type ExtractPluginField, FilteredAPI, HIDE_METADATA, type HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, type InferOptionSchema, type InferPluginContext, type InferPluginErrorCodes, type InferPluginFieldFromTuple, type InferPluginIDs, type InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, type IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, type JoinConfig, type JoinOption, type OverrideMerge, type Prettify, type PrettifyDeep, type RateLimit, type RequiredKeysOf, type Session, SessionQueryParams, type StandardSchemaV1, type StateData, type StoreIdentifierOption, type StripEmptyObjects, type TelemetryEvent, type UnionToIntersection, type User, type Verification, type Where, betterAuth, createTelemetry, generateGenericState, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/dist/integrations/next-js.d.mts

@@ -1,6 +1,3 @@
-import * as _better_auth_core0 from "@better-auth/core";
-import * as better_call0 from "better-call";
-
 //#region src/integrations/next-js.d.ts
 declare function toNextJsHandler(auth: {
   handler: (request: Request) => Promise<Response>;
@@ -16,12 +13,12 @@ declare const nextCookies: () => {
   version: string;
   hooks: {
     before: {
-      matcher(ctx: _better_auth_core0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(ctx: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
     after: {
-      matcher(ctx: _better_auth_core0.HookEndpointContext): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(ctx: import("@better-auth/core").HookEndpointContext): true;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
 };

package/dist/integrations/node.d.mts

@@ -1,11 +1,10 @@
 import { Auth } from "../types/auth.mjs";
-import * as node_http0 from "node:http";
+import "../types/index.mjs";
 import { IncomingHttpHeaders } from "node:http";
-
 //#region src/integrations/node.d.ts
 declare const toNodeHandler: (auth: {
   handler: Auth["handler"];
-} | Auth["handler"]) => (req: node_http0.IncomingMessage, res: node_http0.ServerResponse) => Promise<void>;
+} | Auth["handler"]) => (req: import("node:http").IncomingMessage, res: import("node:http").ServerResponse) => Promise<void>;
 declare function fromNodeHeaders(nodeHeaders: IncomingHttpHeaders): Headers;
 //#endregion
 export { fromNodeHeaders, toNodeHandler };

package/dist/integrations/svelte-kit.d.mts

@@ -1,7 +1,5 @@
 import { BetterAuthOptions } from "../types/index.mjs";
-import * as better_call0 from "better-call";
 import { RequestEvent } from "@sveltejs/kit";
-
 //#region src/integrations/svelte-kit.d.ts
 declare const toSvelteKitHandler: (auth: {
   handler: (request: Request) => Response | Promise<Response>;
@@ -9,12 +7,7 @@ declare const toSvelteKitHandler: (auth: {
 }) => (event: {
   request: Request;
 }) => Response | Promise<Response>;
-declare const svelteKitHandler: ({
-  auth,
-  event,
-  resolve,
-  building
-}: {
+declare const svelteKitHandler: ({ auth, event, resolve, building }: {
   auth: {
     handler: (request: Request) => Response | Promise<Response>;
     options: BetterAuthOptions;
@@ -30,7 +23,7 @@ declare const sveltekitCookies: (getRequestEvent: () => RequestEvent<any, any>)
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
 };

package/dist/integrations/tanstack-start-solid.d.mts

@@ -1,6 +1,3 @@
-import * as _better_auth_core0 from "@better-auth/core";
-import * as better_call0 from "better-call";
-
 //#region src/integrations/tanstack-start-solid.d.ts
 /**
  * TanStack Start cookie plugin for Solid.js.
@@ -24,8 +21,8 @@ declare const tanstackStartCookies: () => {
   version: string;
   hooks: {
     after: {
-      matcher(ctx: _better_auth_core0.HookEndpointContext): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(ctx: import("@better-auth/core").HookEndpointContext): true;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
 };

package/dist/integrations/tanstack-start.d.mts

@@ -1,6 +1,3 @@
-import * as _better_auth_core0 from "@better-auth/core";
-import * as better_call0 from "better-call";
-
 //#region src/integrations/tanstack-start.d.ts
 /**
  * TanStack Start cookie plugin for React.
@@ -24,8 +21,8 @@ declare const tanstackStartCookies: () => {
   version: string;
   hooks: {
     after: {
-      matcher(ctx: _better_auth_core0.HookEndpointContext): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(ctx: import("@better-auth/core").HookEndpointContext): true;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
 };

package/dist/oauth2/link-account.d.mts

@@ -1,6 +1,6 @@
 import { Account, User } from "../types/models.mjs";
+import "../types/index.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-
 //#region src/oauth2/link-account.d.ts
 declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
   userInfo: Omit<User, "createdAt" | "updatedAt">;

package/dist/oauth2/state.d.mts

@@ -1,5 +1,4 @@
 import { GenericEndpointContext } from "@better-auth/core";
-
 //#region src/oauth2/state.d.ts
 declare function generateState(c: GenericEndpointContext, link: {
   email: string;

package/dist/oauth2/utils.d.mts

@@ -1,5 +1,4 @@
 import { AuthContext } from "@better-auth/core";
-
 //#region src/oauth2/utils.d.ts
 declare function decryptOAuthToken(token: string, ctx: AuthContext): string | Promise<string>;
 declare function setTokenUtil(token: string | null | undefined, ctx: AuthContext): string | Promise<string> | null | undefined;

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.22";
+var version = "1.6.24";
 //#endregion
 export { version };

package/dist/plugins/access/access.d.mts

@@ -1,5 +1,4 @@
 import { ExactRoleStatements, Role, RoleInput, Statements } from "./types.mjs";
-
 //#region src/plugins/access/access.d.ts
 type AuthorizeResponse = {
   success: false;

package/dist/plugins/access/types.d.mts

@@ -1,21 +1,20 @@
 import { AuthorizeResponse, createAccessControl } from "./access.mjs";
 import { LiteralString } from "@better-auth/core";
-
 //#region src/plugins/access/types.d.ts
 type ArrayElement<T> = T extends readonly (infer E)[] ? E : never;
 type SubArray<T extends unknown[] | readonly unknown[] | any[]> = T[number][] | ReadonlyArray<T[number]>;
-type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly string[] | readonly LiteralString[]>> = { [P in K]: SubArray<R[P]> };
+type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly string[] | readonly LiteralString[]>> = { [P in K]: SubArray<R[P]>; };
 type Statements = {
   readonly [resource: string]: readonly LiteralString[];
 };
-type RoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]?: SubArray<TStatements[P]> };
+type RoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]?: SubArray<TStatements[P]>; };
 type RoleInput<TStatements extends Statements, TRoleStatements extends Statements> = TRoleStatements & (string extends keyof TRoleStatements ? {} : RoleStatements<TStatements> & Record<Exclude<keyof TRoleStatements, keyof TStatements>, never>);
-type ExactRoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]: readonly [...TStatements[P]] };
+type ExactRoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]: readonly [...TStatements[P]]; };
 type AccessControl<TStatements extends Statements = Statements> = ReturnType<typeof createAccessControl<TStatements>>;
 type RoleAuthorizeRequest<TStatements extends Statements> = { [P in keyof TStatements]?: SubArray<TStatements[P]> | {
   actions: SubArray<TStatements[P]>;
   connector: "OR" | "AND";
-} };
+}; };
 type Role<TRoleStatements extends Statements = Record<string, any>, TAuthorizeStatements extends Statements = TRoleStatements> = {
   authorize: (request: RoleAuthorizeRequest<TAuthorizeStatements>, connector?: ("OR" | "AND") | undefined) => AuthorizeResponse;
   statements: TRoleStatements;

package/dist/plugins/additional-fields/client.d.mts

@@ -1,6 +1,5 @@
 import { BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { DBFieldAttribute } from "@better-auth/core/db";
-
 //#region src/plugins/additional-fields/client.d.ts
 declare const inferAdditionalFields: <T, S extends {
   user?: {

package/dist/plugins/admin/access/statement.d.mts

@@ -1,4 +1,5 @@
 import { ExactRoleStatements, Role, RoleInput, Statements } from "../../access/types.mjs";
+import "../../index.mjs";
 //#region src/plugins/admin/access/statement.d.ts
 declare const defaultStatements: {
   readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];