better-auth 1.7.15 → 1.7.16

package/dist/plugins/generic-oauth/index.mjs

@@ -1,3 +1,4 @@
+import { toBoolean } from "../../utils/boolean.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { GENERIC_OAUTH_ERROR_CODES } from "./error-codes.mjs";
 import { auth0 } from "./providers/auth0.mjs";
@@ -31,6 +32,17 @@ const DISCOVERY_RETRY_TIMEOUT_MS = 1e4;
 * plugin may replace `socialProviders`.
 */
 const getPendingDiscovery = (ctx) => ctx.genericOAuthPendingDiscovery;
+/**
+* Reads ID token claims, or null for a token that is not a JWS, so a
+* malformed token fails the sign-in instead of throwing.
+*/
+const readIdTokenClaims = (idToken) => {
+	try {
+		return decodeJwt(idToken);
+	} catch {
+		return null;
+	}
+};
 async function fetchDiscovery(url, headers, timeout) {
 	const result = await betterFetch(url, {
 		method: "GET",
@@ -45,17 +57,17 @@ async function fetchDiscovery(url, headers, timeout) {
 	}
 	return result.data;
 }
-async function fetchUserInfo(tokens, userInfoUrl) {
-	if (tokens.idToken) try {
-		const decoded = decodeJwt(tokens.idToken);
+async function fetchUserInfo(tokens, userInfoUrl, idTokenClaims) {
+	if (tokens.idToken) {
+		const decoded = idTokenClaims ?? readIdTokenClaims(tokens.idToken);
 		if (decoded?.sub && decoded?.email) return {
 			id: decoded.sub,
-			emailVerified: decoded.email_verified,
+			emailVerified: toBoolean(decoded.email_verified),
 			image: decoded.picture,
 			...decoded
 		};
-	} catch {}
-	if (!userInfoUrl) return null;
+	}
+	if (!userInfoUrl || !tokens.accessToken) return null;
 	const userInfo = await betterFetch(userInfoUrl, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tokens.accessToken}` }
@@ -64,7 +76,7 @@ async function fetchUserInfo(tokens, userInfoUrl) {
 	return {
 		...userInfo.data,
 		email: userInfo.data.email,
-		emailVerified: userInfo.data.email_verified ?? false,
+		emailVerified: toBoolean(userInfo.data.email_verified),
 		image: userInfo.data.picture,
 		name: userInfo.data.name
 	};
@@ -140,6 +152,27 @@ const genericOAuth = (options) => {
 			if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
 			if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
 			if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
+			const resolveUserInfo = async (tokens, idTokenClaims) => {
+				const raw = c.getUserInfo ? await c.getUserInfo(tokens) : await fetchUserInfo(tokens, userInfoUrl, idTokenClaims);
+				if (!raw) return null;
+				const requiresSubjectMatch = !c.getUserInfo || raw.sub != null;
+				if (idTokenClaims?.sub !== void 0 && requiresSubjectMatch && String(raw.sub) !== idTokenClaims.sub) return null;
+				const mapped = c.mapProfileToUser ? await c.mapProfileToUser(raw) : {};
+				const user = {
+					email: raw.email,
+					emailVerified: toBoolean(raw.emailVerified),
+					image: raw.image,
+					name: raw.name,
+					...mapped
+				};
+				return {
+					user: {
+						...user,
+						image: user.image ?? void 0
+					},
+					data: raw
+				};
+			};
 			const accountSubject = c.accountSubject;
 			const provider = {
 				id: c.providerId,
@@ -151,7 +184,9 @@ const genericOAuth = (options) => {
 						tokens,
 						profile: genericProfile
 					});
-					return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
+					if (!isOidc) return genericProfile.id ?? "";
+					if (idTokenConfig && tokens.idToken) return readIdTokenClaims(tokens.idToken)?.sub ?? "";
+					return genericProfile.sub ?? "";
 				},
 				idToken: idTokenConfig,
 				requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
@@ -225,31 +260,20 @@ const genericOAuth = (options) => {
 					});
 					return applyDefaultAccessTokenExpiry(tokens, c.accessTokenExpiresIn);
 				},
+				async getUserInfoFromIdToken(idToken) {
+					const claims = provider.idToken ? readIdTokenClaims(idToken) : void 0;
+					if (claims === null) return null;
+					return resolveUserInfo({ idToken }, claims);
+				},
 				async getUserInfo(tokens) {
 					const { expectedIdTokenNonce, ...oauthTokens } = tokens;
-					if (oauthTokens.idToken && provider.idToken) {
-						if (!await verifyProviderIdToken(provider, oauthTokens.idToken, expectedIdTokenNonce)) {
-							ctx.logger.error(`Provider "${c.providerId}": id_token failed verification against the discovery JWKS or expected nonce`);
-							return null;
-						}
+					if (!oauthTokens.idToken || !provider.idToken) return resolveUserInfo(oauthTokens);
+					const claims = await verifyProviderIdToken(provider, oauthTokens.idToken, expectedIdTokenNonce) ? readIdTokenClaims(oauthTokens.idToken) : null;
+					if (!claims) {
+						ctx.logger.error(`Provider "${c.providerId}": id_token failed verification against the discovery JWKS or expected nonce`);
+						return null;
 					}
-					const raw = c.getUserInfo ? await c.getUserInfo(oauthTokens) : await fetchUserInfo(oauthTokens, userInfoUrl);
-					if (!raw) return null;
-					const mapped = c.mapProfileToUser ? await c.mapProfileToUser(raw) : {};
-					const user = {
-						email: raw.email,
-						emailVerified: raw.emailVerified,
-						image: raw.image,
-						name: raw.name,
-						...mapped
-					};
-					return {
-						user: {
-							...user,
-							image: user.image ?? void 0
-						},
-						data: raw
-					};
+					return resolveUserInfo(oauthTokens, claims);
 				},
 				async refreshAccessToken(refreshToken, refreshCtx) {
 					if (!tokenUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.TOKEN_URL_NOT_FOUND);

package/dist/plugins/index.d.mts

@@ -67,6 +67,7 @@ import { twoFactor } from "./two-factor/index.mjs";
 import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
-import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
+import { parseRoles } from "./organization/roles.mjs";
+import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization } from "./organization/organization.mjs";
 import "./organization/index.mjs";
 export { AccessControl, type AdminOptions, type AnonymousOptions, type AnonymousSession, ArrayElement, type Auth0Options, AuthorizeResponse, type BackupCodeOptions, type BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, type BotIdVerification, type CaptchaFoxOptions, type CaptchaOptions, type CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, type DeviceCode, type DeviceCodeRedemptionAuthorization, type DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, type EmailOTPOptions, ExactRoleStatements, type FieldSchema, type GenericOAuthConfig, type GenericOAuthOptions, type GenericOAuthUserInfo, type GoogleRecaptchaOptions, type GumroadOptions, type HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, type HubSpotOptions, type InferAdminRolesFromOption, type InferInvitation, type InferMember, InferOptionSchema, type InferOrganization, type InferOrganizationRolesFromOption, type InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, type InferTeam, type Invitation, type InvitationInput, type InvitationStatus, type JWKOptions, type JWSAlgorithms, type Jwk, type JwtOptions, type KeycloakOptions, LastLoginMethodOptions, type LineOptions, type LoginResult, MagicLinkOptions, type Member, type MemberInput, type MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, type OAuthPopupData, type OAuthPopupMessage, OAuthProxyOptions, type OTPOptions, type OktaOptions, OneTapOptions, OneTimeTokenOptions, type OpenAPIModelSchema, OpenAPIOptions, type OpenAPIParameter, type OpenAPISchema, type Organization, OrganizationCreator, OrganizationEndpoints, type OrganizationInput, type OrganizationOptions, OrganizationPlugin, type OrganizationRole, type OrganizationSchema, POPUP_MARKER_COOKIE, type Path, type PatreonOptions, type PhoneNumberOptions, type Provider, type ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, type SessionWithImpersonatedBy, type SlackOptions, Statements, SubArray, Subset, type TOTPOptions, TWO_FACTOR_ERROR_CODES, type Team, TeamEndpoints, type TeamInput, type TeamMember, type TeamMemberInput, type TestAuthOptions, type TestCookie, type TestHelpers, type TestUtilsOptions, type TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, type UserWithAnonymous, type UserWithPhoneNumber, type UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, type ValidateRequestContext, type VercelBotIdOptions, type YandexOptions, admin, anonymous, auth0, type backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, type defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, type encodeBackupCodes, type generateBackupCodes, generateExportedKeyPair, type generator, genericOAuth, type getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, type invitationSchema, type invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, type memberSchema, microsoftEntraId, type ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, type organizationRoleSchema, type organizationSchema, type otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, type roleSchema, type sec, signJWT, siwe, slack, type teamMemberSchema, type teamSchema, testUtils, toExpJWT, type totp2fa, twoFactor, twoFactorClient, username, type verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/index.mjs

@@ -3,6 +3,7 @@ import { createAccessControl, role } from "./access/access.mjs";
 import { MULTI_SESSION_ERROR_CODES } from "./multi-session/error-codes.mjs";
 import { OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_MESSAGE_TYPE, POPUP_MARKER_COOKIE } from "./oauth-popup/constants.mjs";
 import { OAUTH_POPUP_ERROR_CODES } from "./oauth-popup/error-codes.mjs";
+import { parseRoles } from "./organization/roles.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./two-factor/error-code.mjs";
 import { twoFactorClient } from "./two-factor/client.mjs";
 import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
@@ -40,7 +41,7 @@ import { oneTimeToken } from "./one-time-token/index.mjs";
 import { openAPI } from "./open-api/index.mjs";
 import { getOrgAdapter } from "./organization/adapter.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
-import { organization, parseRoles } from "./organization/organization.mjs";
+import { organization } from "./organization/organization.mjs";
 import { phoneNumber } from "./phone-number/index.mjs";
 import { siwe } from "./siwe/index.mjs";
 import { testUtils } from "./test-utils/index.mjs";

package/dist/plugins/oauth-proxy/index.mjs

@@ -4,10 +4,10 @@ import { originCheck } from "../../api/middlewares/origin-check.mjs";
 import { parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
 import { symmetricDecrypt, symmetricEncrypt } from "../../crypto/index.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { redirectOnError } from "../../oauth2/errors.mjs";
 import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { setOAuthState } from "../../api/state/oauth.mjs";
-import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { getAuthStateVerificationIdentifier, parseGenericState } from "../../state.mjs";
 import { exchangeOAuthCallback } from "../../oauth2/callback.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";

package/dist/plugins/one-tap/index.mjs

@@ -3,10 +3,10 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
 import { toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES } from "../../oauth2/errors.mjs";
+import { toBoolean } from "../../utils/boolean.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
-import { toBoolean } from "../../utils/boolean.mjs";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
 import { isGoogleHostedDomainAllowed, verifyGoogleIdToken } from "@better-auth/core/social-providers";
 import { createAuthEndpoint } from "@better-auth/core/api";

package/dist/plugins/organization/adapter.mjs

@@ -735,6 +735,7 @@ const getOrgAdapter = (context, options) => {
 			return await adapter.create({
 				model: "invitation",
 				data: {
+					...context.options.advanced?.database?.generateId === void 0 && { id: context.generateId({ model: "invitation" }) },
 					status: "pending",
 					expiresAt,
 					createdAt: /* @__PURE__ */ new Date(),

package/dist/plugins/organization/client.d.mts

@@ -241,6 +241,7 @@ export declare const organizationClient: <CO extends OrganizationClientOptions>(
     EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION: import("@better-auth/core/utils/error-codes").RawError<"EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION">;
     EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION: import("@better-auth/core/utils/error-codes").RawError<"EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION">;
     YOU_ARE_NOT_ALLOWED_TO_CANCEL_THIS_INVITATION: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_CANCEL_THIS_INVITATION">;
+    YOU_ARE_NOT_ALLOWED_TO_LIST_INVITATIONS: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_INVITATIONS">;
     INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION: import("@better-auth/core/utils/error-codes").RawError<"INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION">;
     YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE">;
     FAILED_TO_RETRIEVE_INVITATION: import("@better-auth/core/utils/error-codes").RawError<"FAILED_TO_RETRIEVE_INVITATION">;

package/dist/plugins/organization/error-codes.d.mts

@@ -25,6 +25,7 @@ export declare const ORGANIZATION_ERROR_CODES: {
   EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION: import("@better-auth/core/utils/error-codes").RawError<"EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION">;
   EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION: import("@better-auth/core/utils/error-codes").RawError<"EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION">;
   YOU_ARE_NOT_ALLOWED_TO_CANCEL_THIS_INVITATION: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_CANCEL_THIS_INVITATION">;
+  YOU_ARE_NOT_ALLOWED_TO_LIST_INVITATIONS: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_INVITATIONS">;
   INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION: import("@better-auth/core/utils/error-codes").RawError<"INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION">;
   YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE">;
   FAILED_TO_RETRIEVE_INVITATION: import("@better-auth/core/utils/error-codes").RawError<"FAILED_TO_RETRIEVE_INVITATION">;

package/dist/plugins/organization/error-codes.mjs

@@ -26,6 +26,7 @@ const ORGANIZATION_ERROR_CODES = defineErrorCodes({
 	EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION: "Email verification required before accepting or rejecting invitation",
 	EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION: "Email verification required to view or list invitations for the session email",
 	YOU_ARE_NOT_ALLOWED_TO_CANCEL_THIS_INVITATION: "You are not allowed to cancel this invitation",
+	YOU_ARE_NOT_ALLOWED_TO_LIST_INVITATIONS: "You are not allowed to list invitations for this organization",
 	INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION: "Inviter is no longer a member of the organization",
 	YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE: "You are not allowed to invite a user with this role",
 	FAILED_TO_RETRIEVE_INVITATION: "Failed to retrieve invitation",

package/dist/plugins/organization/has-permission.d.mts

@@ -4,9 +4,8 @@ import { GenericEndpointContext } from "@better-auth/core";
 export declare const hasPermission: (input: {
   organizationId: string;
   /**
-   * If true, will use the in-memory cache of the roles.
-   * Keep in mind to use this in a stateless mindset, the purpose of this is to avoid unnecessary database calls when running multiple
-   * hasPermission calls in a row.
+   * Reuse roles already loaded for this organization in the current request.
+   * The cache ends with the request.
    *
    * @default false
    */

package/dist/plugins/organization/has-permission.mjs

@@ -1,34 +1,73 @@
 import { APIError } from "../../api/index.mjs";
 import { defaultRoles } from "./access/statement.mjs";
-import { cacheAllRoles, hasPermissionFn } from "./permission.mjs";
+import { parseRoleList } from "./roles.mjs";
+import { hasPermissionFn } from "./permission.mjs";
+import { defineRequestState, hasRequestState } from "@better-auth/core/context";
 import * as z from "zod";
 //#region src/plugins/organization/has-permission.ts
 const rolePermissionsSchema = z.record(z.string(), z.array(z.string()));
+/**
+* Request-scoped role cache, isolated by adapter and organization options before
+* organization id. Nested calls to another auth instance can share request state,
+* but must never replace the caller's permission definitions.
+*/
+const resolvedOrganizationRoles = defineRequestState(() => /* @__PURE__ */ new WeakMap());
+async function getRequestScopedRolesCache(ctx, options) {
+	if (!await hasRequestState()) return;
+	const adapters = await resolvedOrganizationRoles.get();
+	const configurations = adapters.get(ctx.context.adapter) ?? /* @__PURE__ */ new WeakMap();
+	adapters.set(ctx.context.adapter, configurations);
+	const roles = configurations.get(options) ?? /* @__PURE__ */ new Map();
+	configurations.set(options, roles);
+	return roles;
+}
 const hasPermission = async (input, ctx) => {
-	let acRoles = { ...input.options.roles || defaultRoles };
-	if (ctx && input.organizationId && input.options.dynamicAccessControl?.enabled && input.options.ac && !input.useMemoryCache) {
-		const roles = await ctx.context.adapter.findMany({
-			model: "organizationRole",
-			where: [{
-				field: "organizationId",
-				value: input.organizationId
-			}]
-		});
-		for (const { role, permission: permissionsString } of roles) {
-			const permissions = JSON.parse(permissionsString);
-			const result = rolePermissionsSchema.safeParse(permissions);
-			if (!result.success) {
-				ctx.context.logger.error("[hasPermission] Invalid permissions for role " + role, { permissions });
-				throw new APIError("INTERNAL_SERVER_ERROR", { message: "Invalid permissions for role " + role });
-			}
-			const merged = { ...acRoles[role]?.statements };
-			for (const [key, actions] of Object.entries(result.data)) merged[key] = [.../* @__PURE__ */ new Set([...merged[key] ?? [], ...actions])];
-			acRoles[role] = input.options.ac.newRole(merged);
+	const acRoles = { ...input.options.roles || defaultRoles };
+	const ac = input.options.ac;
+	if (!ctx || !input.organizationId || !input.options.dynamicAccessControl?.enabled || !ac) return hasPermissionFn(input, acRoles);
+	const cache = await getRequestScopedRolesCache(ctx, input.options);
+	const cached = input.useMemoryCache ? cache?.get(input.organizationId) : void 0;
+	if (cached) return hasPermissionFn(input, cached);
+	const roles = await ctx.context.adapter.findMany({
+		model: "organizationRole",
+		where: [{
+			field: "organizationId",
+			value: input.organizationId
+		}]
+	});
+	for (const { role, permission: permissionsString } of roles) {
+		const permissions = JSON.parse(permissionsString);
+		const result = rolePermissionsSchema.safeParse(permissions);
+		if (!result.success) {
+			ctx.context.logger.error("[hasPermission] Invalid permissions for role " + role, { permissions });
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: "Invalid permissions for role " + role });
 		}
+		const merged = { ...acRoles[role]?.statements };
+		for (const [key, actions] of Object.entries(result.data)) merged[key] = [.../* @__PURE__ */ new Set([...merged[key] ?? [], ...actions])];
+		acRoles[role] = ac.newRole(merged);
 	}
-	if (input.useMemoryCache) acRoles = cacheAllRoles.get(input.organizationId) || acRoles;
-	cacheAllRoles.set(input.organizationId, acRoles);
+	cache?.set(input.organizationId, acRoles);
 	return hasPermissionFn(input, acRoles);
 };
+/**
+* Whether a member may see the organization's pending invitations.
+*
+* Invitation ids act as invitation links. Members who can create invitations
+* can mint such links anyway; any other role, including one that may only
+* cancel, must not see them.
+*/
+const canViewInvitations = (input, ctx) => hasPermission({
+	...input,
+	permissions: { invitation: ["create"] }
+}, ctx);
+/**
+* Drops invitations that grant the creator role unless the member holds it,
+* matching the rule that only the creator role can hand it out.
+*/
+const withoutCreatorRoleInvitations = (invitations, input) => {
+	const creatorRole = input.options.creatorRole || "owner";
+	if (parseRoleList(input.role).includes(creatorRole)) return invitations;
+	return invitations.filter((invitation) => !parseRoleList(invitation.role).includes(creatorRole));
+};
 //#endregion
-export { hasPermission };
+export { canViewInvitations, hasPermission, withoutCreatorRoleInvitations };

package/dist/plugins/organization/index.d.mts

@@ -2,5 +2,6 @@ import { OrganizationOptions } from "./types.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "./schema.mjs";
 import { getOrgAdapter } from "./adapter.mjs";
 import { hasPermission } from "./has-permission.mjs";
-import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization.mjs";
+import { parseRoles } from "./roles.mjs";
+import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization } from "./organization.mjs";
 export { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, type InferInvitation, type InferMember, type InferOrganization, type InferOrganizationRolesFromOption, type InferOrganizationZodRolesFromOption, type InferTeam, type Invitation, type InvitationInput, type InvitationStatus, type Member, type MemberInput, type Organization, OrganizationCreator, OrganizationEndpoints, type OrganizationInput, type OrganizationOptions, OrganizationPlugin, type OrganizationRole, type OrganizationSchema, type Team, TeamEndpoints, type TeamInput, type TeamMember, type TeamMemberInput, type defaultRolesSchema, getOrgAdapter, hasPermission, type invitationSchema, type invitationStatus, type memberSchema, organization, type organizationRoleSchema, type organizationSchema, parseRoles, type roleSchema, type teamMemberSchema, type teamSchema };

package/dist/plugins/organization/index.mjs

@@ -1,4 +1,5 @@
+import { parseRoles } from "./roles.mjs";
 import { getOrgAdapter } from "./adapter.mjs";
 import { hasPermission } from "./has-permission.mjs";
-import { organization, parseRoles } from "./organization.mjs";
+import { organization } from "./organization.mjs";
 export { getOrgAdapter, hasPermission, organization, parseRoles };

package/dist/plugins/organization/organization.d.mts

@@ -10,6 +10,7 @@ import { addMember, getActiveMember, getActiveMemberRole, leaveOrganization, lis
 import { checkOrganizationSlug, createOrganization, deleteOrganization, getFullOrganization, getOrganization, listOrganizations, setActiveOrganization, updateOrganization } from "./routes/crud-org.mjs";
 import { addTeamMember, createTeam, listOrganizationTeams, listTeamMembers, listUserTeams, removeTeam, removeTeamMember, setActiveTeam, updateTeam } from "./routes/crud-team.mjs";
 import { hasPermission } from "./has-permission.mjs";
+import { parseRoles } from "./roles.mjs";
 import * as z from "zod";
 //#region src/plugins/organization/organization.d.ts
 declare module "@better-auth/core" {
@@ -51,7 +52,6 @@ export type DefaultOrganizationPlugin<Options extends OrganizationOptions> = {
 export interface OrganizationCreator {
   <Options extends OrganizationOptions>(options?: Options | undefined): DefaultOrganizationPlugin<Options>;
 }
-export declare function parseRoles(roles: string | string[]): string;
 export type DynamicAccessControlEndpoints<O extends OrganizationOptions> = {
   createOrgRole: ReturnType<typeof createOrgRole<O>>;
   deleteOrgRole: ReturnType<typeof deleteOrgRole<O>>;
@@ -417,4 +417,4 @@ export declare function organization<O extends OrganizationOptions & {
 };
 export declare function organization<O extends OrganizationOptions>(options?: O | undefined): DefaultOrganizationPlugin<O>;
 //#endregion
-export { type OrganizationOptions, hasPermission };
+export { type OrganizationOptions, hasPermission, parseRoles };

package/dist/plugins/organization/organization.mjs

@@ -2,6 +2,7 @@ import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { defaultRoles } from "./access/statement.mjs";
 import { ORGANIZATION_ERROR_CODES } from "./error-codes.mjs";
+import { parseRoles } from "./roles.mjs";
 import { getOrgAdapter } from "./adapter.mjs";
 import { shimContext } from "../../utils/shim.mjs";
 import { orgSessionMiddleware } from "./call.mjs";
@@ -15,9 +16,6 @@ import { APIError } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/organization/organization.ts
-function parseRoles(roles) {
-	return Array.isArray(roles) ? roles.join(",") : roles;
-}
 const createHasPermissionBodySchema = z.object({ organizationId: z.string().optional() }).and(z.xor([z.object({ permission: z.record(z.string(), z.array(z.string())) }), z.object({ permissions: z.record(z.string(), z.array(z.string())) })]));
 const createHasPermission = (options) => {
 	return createAuthEndpoint("/organization/has-permission", {

package/dist/plugins/organization/permission.mjs

@@ -1,7 +1,8 @@
+import { parseRoleList } from "./roles.mjs";
 //#region src/plugins/organization/permission.ts
 const hasPermissionFn = (input, acRoles) => {
 	if (!input.permissions) return false;
-	const roles = input.role.split(",");
+	const roles = parseRoleList(input.role);
 	const creatorRole = input.options.creatorRole || "owner";
 	const isCreator = roles.includes(creatorRole);
 	const allowCreatorsAllPermissions = input.allowCreatorAllPermissions || false;
@@ -9,6 +10,5 @@ const hasPermissionFn = (input, acRoles) => {
 	for (const role of roles) if ((acRoles[role]?.authorize(input.permissions))?.success) return true;
 	return false;
 };
-const cacheAllRoles = /* @__PURE__ */ new Map();
 //#endregion
-export { cacheAllRoles, hasPermissionFn };
+export { hasPermissionFn };

package/dist/plugins/organization/roles.d.mts

@@ -0,0 +1,8 @@
+//#region src/plugins/organization/roles.d.ts
+/**
+ * Normalizes a role value into the comma separated string that is stored in
+ * the database. Whitespace around each role name is removed and empty entries
+ * are dropped.
+ */
+export declare function parseRoles(roles: string | string[]): string;
+//#endregion

package/dist/plugins/organization/roles.mjs

@@ -0,0 +1,26 @@
+//#region src/plugins/organization/roles.ts
+/**
+* Splits a role value into a list of trimmed, non-empty role names.
+*
+* Roles are stored as a comma separated string (`"admin,owner"`), and may be
+* submitted either as that string or as an array. Any whitespace around a
+* role name is removed so that `"admin, owner"`, `["admin", " owner"]` and
+* `"admin,owner"` all resolve to the same roles.
+*
+* Every role comparison and every write of a role column must go through this
+* helper (or `parseRoles`), so a padded role name can never be stored in a
+* form that one check matches and another does not.
+*/
+function parseRoleList(roles) {
+	return (Array.isArray(roles) ? roles : [roles]).flatMap((role) => role.split(",")).map((role) => role.trim()).filter(Boolean);
+}
+/**
+* Normalizes a role value into the comma separated string that is stored in
+* the database. Whitespace around each role name is removed and empty entries
+* are dropped.
+*/
+function parseRoles(roles) {
+	return parseRoleList(roles).join(",");
+}
+//#endregion
+export { parseRoleList, parseRoles };

package/dist/plugins/organization/routes/crud-access-control.mjs

@@ -1,5 +1,6 @@
 import { toZodSchema } from "../../../db/to-zod.mjs";
 import { ORGANIZATION_ERROR_CODES } from "../error-codes.mjs";
+import { parseRoleList } from "../roles.mjs";
 import { orgSessionMiddleware } from "../call.mjs";
 import { hasPermission } from "../has-permission.mjs";
 import { APIError } from "@better-auth/core/error";
@@ -260,7 +261,7 @@ const deleteOrgRole = (options) => {
 				operator: "contains"
 			}]
 		})).find((member) => {
-			return member.role.split(",").map((r) => r.trim()).includes(roleToDelete);
+			return parseRoleList(member.role).includes(roleToDelete);
 		})) {
 			ctx.context.logger.error(`[Dynamic Access Control] Cannot delete a role that is assigned to members.`, {
 				role: existingRoleInDB.role,

package/dist/plugins/organization/routes/crud-invites.mjs

@@ -4,10 +4,10 @@ import { toZodSchema } from "../../../db/to-zod.mjs";
 import { getSessionFromCtx } from "../../../api/routes/session.mjs";
 import { defaultRoles } from "../access/statement.mjs";
 import { ORGANIZATION_ERROR_CODES } from "../error-codes.mjs";
+import { parseRoleList, parseRoles } from "../roles.mjs";
 import { getOrgAdapter } from "../adapter.mjs";
 import { orgMiddleware, orgSessionMiddleware } from "../call.mjs";
-import { hasPermission } from "../has-permission.mjs";
-import { parseRoles } from "../organization.mjs";
+import { canViewInvitations, hasPermission, withoutCreatorRoleInvitations } from "../has-permission.mjs";
 import { runWithTransaction } from "@better-auth/core/context";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -99,8 +99,9 @@ const createInvitation = (option) => {
 			organizationId
 		}, ctx)) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_INVITE_USERS_TO_THIS_ORGANIZATION);
 		const creatorRole = ctx.context.orgOptions.creatorRole || "owner";
-		const roles = parseRoles(ctx.body.role);
-		const rolesArray = roles.split(",").map((r) => r.trim()).filter(Boolean);
+		const rolesArray = parseRoleList(ctx.body.role);
+		if (rolesArray.length === 0) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.ROLE_NOT_FOUND);
+		const roles = parseRoles(rolesArray);
 		const defaults = Object.keys(defaultRoles);
 		const customRoles = Object.keys(ctx.context.orgOptions.roles || {});
 		const validStaticRoles = /* @__PURE__ */ new Set([...defaults, ...customRoles]);
@@ -122,7 +123,7 @@ const createInvitation = (option) => {
 				if (stillInvalid.length > 0) throw new APIError("BAD_REQUEST", { message: `${ORGANIZATION_ERROR_CODES.ROLE_NOT_FOUND}: ${stillInvalid.join(", ")}` });
 			} else throw new APIError("BAD_REQUEST", { message: `${ORGANIZATION_ERROR_CODES.ROLE_NOT_FOUND}: ${unknownRoles.join(", ")}` });
 		}
-		if (!member.role.split(",").map((r) => r.trim()).includes(creatorRole) && roles.split(",").includes(creatorRole)) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE);
+		if (!parseRoleList(member.role).includes(creatorRole) && rolesArray.includes(creatorRole)) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE);
 		if (await adapter.findMemberByEmail({
 			email,
 			organizationId
@@ -134,8 +135,9 @@ const createInvitation = (option) => {
 		if (alreadyInvited.length && !ctx.body.resend && !ctx.context.orgOptions.cancelPendingInvitationsOnReInvite) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION);
 		const organization = await adapter.findOrganizationById(organizationId);
 		if (!organization) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND);
-		if (alreadyInvited.length && ctx.body.resend) {
-			const existingInvitation = alreadyInvited[0];
+		const existingInvitation = alreadyInvited[0];
+		if (existingInvitation && ctx.body.resend) {
+			if (!parseRoleList(member.role).includes(creatorRole) && parseRoleList(existingInvitation.role).includes(creatorRole)) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE);
 			const newExpiresAt = getDate(ctx.context.orgOptions.invitationExpiresIn || 172800, "sec");
 			await ctx.context.adapter.update({
 				model: "invitation",
@@ -327,7 +329,7 @@ const acceptInvitation = (options) => createAuthEndpoint("/organization/accept-i
 		const createdMember = await adapter.createMember({
 			organizationId: acceptedI.organizationId,
 			userId: session.user.id,
-			role: acceptedI.role,
+			role: parseRoles(acceptedI.role),
 			createdAt: /* @__PURE__ */ new Date()
 		});
 		await adapter.setActiveOrganization(session.session.token, acceptedI.organizationId, ctx);
@@ -536,12 +538,21 @@ const listInvitations = (options) => createAuthEndpoint("/organization/list-invi
 	const orgId = ctx.query?.organizationId || session.session.activeOrganizationId;
 	if (!orgId) throw APIError.fromStatus("BAD_REQUEST", { message: "Organization ID is required" });
 	const adapter = getOrgAdapter(ctx.context, options);
-	if (!await adapter.findMemberByOrgId({
+	const isMember = await adapter.findMemberByOrgId({
 		userId: session.user.id,
 		organizationId: orgId
-	})) throw APIError.fromStatus("FORBIDDEN", { message: "You are not a member of this organization" });
+	});
+	if (!isMember) throw APIError.fromStatus("FORBIDDEN", { message: "You are not a member of this organization" });
+	if (!await canViewInvitations({
+		role: isMember.role,
+		options: ctx.context.orgOptions,
+		organizationId: orgId
+	}, ctx)) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_LIST_INVITATIONS);
 	const invitations = await adapter.listInvitations({ organizationId: orgId });
-	return ctx.json(invitations);
+	return ctx.json(withoutCreatorRoleInvitations(invitations, {
+		role: isMember.role,
+		options: ctx.context.orgOptions
+	}));
 });
 /**
 * List all invitations a user has received