payload-auth 1.0.0

package/dist/better-auth/plugin/collections/users/endpoints/refresh-token.js

@@ -0,0 +1,106 @@
+import { setCookieCache } from 'better-auth/cookies';
+import { getFieldsToSign, refreshOperation } from 'payload';
+import { getPayloadAuth } from '../../../lib/get-payload-auth';
+export const getRefreshTokenEndpoint = (options)=>{
+    const userSlug = options?.userSlug;
+    const endpoint = {
+        path: '/refresh-token',
+        method: 'post',
+        handler: async (req)=>{
+            const payload = await getPayloadAuth(req.payload.config);
+            const betterAuth = payload.betterAuth;
+            const authContext = await betterAuth?.$context;
+            const userCollection = payload.collections[userSlug];
+            if (!betterAuth || !authContext) {
+                return new Response(JSON.stringify({
+                    message: 'BetterAuth not initialized'
+                }), {
+                    status: 500
+                });
+            }
+            const sessionTokenName = authContext.authCookies.sessionToken.name;
+            const cookieHeader = req.headers.get('cookie') || '';
+            const hasSessionToken = cookieHeader.includes(`${sessionTokenName}=`);
+            if (!hasSessionToken) {
+                try {
+                    const result = await refreshOperation({
+                        collection: userCollection,
+                        req
+                    });
+                    return new Response(JSON.stringify(result), {
+                        status: 200
+                    });
+                } catch (error) {
+                    console.error('Token refresh failed:', error);
+                    return new Response(JSON.stringify({
+                        message: 'Token refresh failed'
+                    }), {
+                        status: 401
+                    });
+                }
+            }
+            // @ts-ignore - @TODO, fix type of .api
+            const session = await betterAuth.api.getSession({
+                headers: req.headers,
+                query: {
+                    disableCookieCache: true
+                }
+            });
+            if (!session?.session?.userId) {
+                return new Response(JSON.stringify({
+                    message: 'No user in session'
+                }), {
+                    status: 401
+                });
+            }
+            const user = await payload.findByID({
+                collection: userSlug,
+                id: session.session.userId
+            });
+            if (!user) {
+                return new Response(JSON.stringify({
+                    message: 'No user found'
+                }), {
+                    status: 401
+                });
+            }
+            const cookieCacheFields = getFieldsToSign({
+                collectionConfig: userCollection.config,
+                email: user.email,
+                user: user
+            });
+            const responseData = {
+                refreshedToken: null,
+                setCookie: !!authContext.options.session?.cookieCache?.enabled,
+                strategy: 'better-auth',
+                user: {
+                    ...user,
+                    collection: userSlug
+                }
+            };
+            const response = new Response(JSON.stringify(responseData), {
+                status: 200
+            });
+            const ctx = {
+                context: authContext,
+                setCookie (name, value, options) {
+                    const path = options?.path || '/';
+                    const maxAge = options?.maxAge ? `; Max-Age=${options.maxAge}` : '';
+                    const httpOnly = options?.httpOnly ? '; HttpOnly' : '';
+                    const secure = options?.secure ? '; Secure' : '';
+                    const sameSite = options?.sameSite ? `; SameSite=${options.sameSite}` : '; SameSite=Lax';
+                    response.headers.set('Set-Cookie', `${name}=${value}; Path=${path}${maxAge}${httpOnly}${secure}${sameSite}`);
+                    return name;
+                }
+            };
+            await setCookieCache(ctx, {
+                session: session.session,
+                user: cookieCacheFields
+            });
+            return response;
+        }
+    };
+    return endpoint;
+};
+
+//# sourceMappingURL=refresh-token.js.map

package/dist/better-auth/plugin/collections/users/endpoints/refresh-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/plugin/collections/users/endpoints/refresh-token.ts"],"sourcesContent":["import { setCookieCache } from 'better-auth/cookies'\nimport { CollectionSlug, type Endpoint, getFieldsToSign, refreshOperation, User } from 'payload'\nimport { GenericEndpointContext } from 'better-auth/types'\nimport { EndpointWithBetterAuth } from '../../../types'\nimport { getPayloadAuth } from '../../../lib/get-payload-auth'\n\ntype RefreshTokenEndpointOptions = {\n  userSlug: CollectionSlug\n}\n\nexport const getRefreshTokenEndpoint = (options?: RefreshTokenEndpointOptions): Endpoint => {\n  const userSlug = options?.userSlug\n\n  const endpoint: EndpointWithBetterAuth = {\n    path: '/refresh-token',\n    method: 'post',\n    handler: async (req) => {\n      const payload = await getPayloadAuth(req.payload.config)\n      const betterAuth = payload.betterAuth\n      const authContext = await betterAuth?.$context\n      const userCollection = payload.collections[userSlug as CollectionSlug]\n\n      if (!betterAuth || !authContext) {\n        return new Response(JSON.stringify({ message: 'BetterAuth not initialized' }), {\n          status: 500,\n        })\n      }\n\n      const sessionTokenName = authContext.authCookies.sessionToken.name\n      const cookieHeader = req.headers.get('cookie') || ''\n      const hasSessionToken = cookieHeader.includes(`${sessionTokenName}=`)\n\n      if (!hasSessionToken) {\n        try {\n          const result = await refreshOperation({ collection: userCollection, req })\n          return new Response(JSON.stringify(result), { status: 200 })\n        } catch (error) {\n          console.error('Token refresh failed:', error)\n          return new Response(JSON.stringify({ message: 'Token refresh failed' }), { status: 401 })\n        }\n      }\n\n      // @ts-ignore - @TODO, fix type of .api\n      const session = await betterAuth.api.getSession({\n        headers: req.headers,\n        query: { disableCookieCache: true },\n      })\n\n      if (!session?.session?.userId) {\n        return new Response(JSON.stringify({ message: 'No user in session' }), { status: 401 })\n      }\n\n      const user = await payload.findByID({\n        collection: userSlug as string,\n        id: session.session.userId,\n      })\n\n      if (!user) {\n        return new Response(JSON.stringify({ message: 'No user found' }), { status: 401 })\n      }\n\n      const cookieCacheFields = getFieldsToSign({\n        collectionConfig: userCollection.config,\n        email: user.email,\n        user: user as User,\n      })\n\n      const responseData = {\n        refreshedToken: null,\n        setCookie: !!authContext.options.session?.cookieCache?.enabled,\n        strategy: 'better-auth',\n        user: { ...user, collection: userSlug },\n      }\n\n      const response = new Response(JSON.stringify(responseData), {\n        status: 200,\n      })\n\n      const ctx = {\n        context: authContext,\n        setCookie(name, value, options) {\n          const path = options?.path || '/'\n          const maxAge = options?.maxAge ? `; Max-Age=${options.maxAge}` : ''\n          const httpOnly = options?.httpOnly ? '; HttpOnly' : ''\n          const secure = options?.secure ? '; Secure' : ''\n          const sameSite = options?.sameSite ? `; SameSite=${options.sameSite}` : '; SameSite=Lax'\n\n          response.headers.set(\n            'Set-Cookie',\n            `${name}=${value}; Path=${path}${maxAge}${httpOnly}${secure}${sameSite}`,\n          )\n          return name\n        },\n      } as GenericEndpointContext\n\n      await setCookieCache(ctx, {\n        session: session.session,\n        user: cookieCacheFields as any,\n      })\n\n      return response\n    },\n  }\n\n  return endpoint as unknown as Endpoint\n}\n"],"names":["setCookieCache","getFieldsToSign","refreshOperation","getPayloadAuth","getRefreshTokenEndpoint","options","userSlug","endpoint","path","method","handler","req","payload","config","betterAuth","authContext","$context","userCollection","collections","Response","JSON","stringify","message","status","sessionTokenName","authCookies","sessionToken","name","cookieHeader","headers","get","hasSessionToken","includes","result","collection","error","console","session","api","getSession","query","disableCookieCache","userId","user","findByID","id","cookieCacheFields","collectionConfig","email","responseData","refreshedToken","setCookie","cookieCache","enabled","strategy","response","ctx","context","value","maxAge","httpOnly","secure","sameSite","set"],"mappings":"AAAA,SAASA,cAAc,QAAQ,sBAAqB;AACpD,SAAwCC,eAAe,EAAEC,gBAAgB,QAAc,UAAS;AAGhG,SAASC,cAAc,QAAQ,gCAA+B;AAM9D,OAAO,MAAMC,0BAA0B,CAACC;IACtC,MAAMC,WAAWD,SAASC;IAE1B,MAAMC,WAAmC;QACvCC,MAAM;QACNC,QAAQ;QACRC,SAAS,OAAOC;YACd,MAAMC,UAAU,MAAMT,eAAeQ,IAAIC,OAAO,CAACC,MAAM;YACvD,MAAMC,aAAaF,QAAQE,UAAU;YACrC,MAAMC,cAAc,MAAMD,YAAYE;YACtC,MAAMC,iBAAiBL,QAAQM,WAAW,CAACZ,SAA2B;YAEtE,IAAI,CAACQ,cAAc,CAACC,aAAa;gBAC/B,OAAO,IAAII,SAASC,KAAKC,SAAS,CAAC;oBAAEC,SAAS;gBAA6B,IAAI;oBAC7EC,QAAQ;gBACV;YACF;YAEA,MAAMC,mBAAmBT,YAAYU,WAAW,CAACC,YAAY,CAACC,IAAI;YAClE,MAAMC,eAAejB,IAAIkB,OAAO,CAACC,GAAG,CAAC,aAAa;YAClD,MAAMC,kBAAkBH,aAAaI,QAAQ,CAAC,GAAGR,iBAAiB,CAAC,CAAC;YAEpE,IAAI,CAACO,iBAAiB;gBACpB,IAAI;oBACF,MAAME,SAAS,MAAM/B,iBAAiB;wBAAEgC,YAAYjB;wBAAgBN;oBAAI;oBACxE,OAAO,IAAIQ,SAASC,KAAKC,SAAS,CAACY,SAAS;wBAAEV,QAAQ;oBAAI;gBAC5D,EAAE,OAAOY,OAAO;oBACdC,QAAQD,KAAK,CAAC,yBAAyBA;oBACvC,OAAO,IAAIhB,SAASC,KAAKC,SAAS,CAAC;wBAAEC,SAAS;oBAAuB,IAAI;wBAAEC,QAAQ;oBAAI;gBACzF;YACF;YAEA,uCAAuC;YACvC,MAAMc,UAAU,MAAMvB,WAAWwB,GAAG,CAACC,UAAU,CAAC;gBAC9CV,SAASlB,IAAIkB,OAAO;gBACpBW,OAAO;oBAAEC,oBAAoB;gBAAK;YACpC;YAEA,IAAI,CAACJ,SAASA,SAASK,QAAQ;gBAC7B,OAAO,IAAIvB,SAASC,KAAKC,SAAS,CAAC;oBAAEC,SAAS;gBAAqB,IAAI;oBAAEC,QAAQ;gBAAI;YACvF;YAEA,MAAMoB,OAAO,MAAM/B,QAAQgC,QAAQ,CAAC;gBAClCV,YAAY5B;gBACZuC,IAAIR,QAAQA,OAAO,CAACK,MAAM;YAC5B;YAEA,IAAI,CAACC,MAAM;gBACT,OAAO,IAAIxB,SAASC,KAAKC,SAAS,CAAC;oBAAEC,SAAS;gBAAgB,IAAI;oBAAEC,QAAQ;gBAAI;YAClF;YAEA,MAAMuB,oBAAoB7C,gBAAgB;gBACxC8C,kBAAkB9B,eAAeJ,MAAM;gBACvCmC,OAAOL,KAAKK,KAAK;gBACjBL,MAAMA;YACR;YAEA,MAAMM,eAAe;gBACnBC,gBAAgB;gBAChBC,WAAW,CAAC,CAACpC,YAAYV,OAAO,CAACgC,OAAO,EAAEe,aAAaC;gBACvDC,UAAU;gBACVX,MAAM;oBAAE,GAAGA,IAAI;oBAAET,YAAY5B;gBAAS;YACxC;YAEA,MAAMiD,WAAW,IAAIpC,SAASC,KAAKC,SAAS,CAAC4B,eAAe;gBAC1D1B,QAAQ;YACV;YAEA,MAAMiC,MAAM;gBACVC,SAAS1C;gBACToC,WAAUxB,IAAI,EAAE+B,KAAK,EAAErD,OAAO;oBAC5B,MAAMG,OAAOH,SAASG,QAAQ;oBAC9B,MAAMmD,SAAStD,SAASsD,SAAS,CAAC,UAAU,EAAEtD,QAAQsD,MAAM,EAAE,GAAG;oBACjE,MAAMC,WAAWvD,SAASuD,WAAW,eAAe;oBACpD,MAAMC,SAASxD,SAASwD,SAAS,aAAa;oBAC9C,MAAMC,WAAWzD,SAASyD,WAAW,CAAC,WAAW,EAAEzD,QAAQyD,QAAQ,EAAE,GAAG;oBAExEP,SAAS1B,OAAO,CAACkC,GAAG,CAClB,cACA,GAAGpC,KAAK,CAAC,EAAE+B,MAAM,OAAO,EAAElD,OAAOmD,SAASC,WAAWC,SAASC,UAAU;oBAE1E,OAAOnC;gBACT;YACF;YAEA,MAAM3B,eAAewD,KAAK;gBACxBnB,SAASA,QAAQA,OAAO;gBACxBM,MAAMG;YACR;YAEA,OAAOS;QACT;IACF;IAEA,OAAOhD;AACT,EAAC"}

package/dist/better-auth/plugin/collections/users/hooks/after-login.d.ts

@@ -0,0 +1,11 @@
+import { CollectionAfterLoginHook } from 'payload';
+type AfterLoginOptions = {
+    usersCollectionSlug: string;
+    sessionsCollectionSlug: string;
+};
+/**
+ * This hook is used to sync the admin login token with better-auth session token
+ * It also creates a new session in better-auth
+ */
+export declare const getAfterLoginHook: (options: AfterLoginOptions) => CollectionAfterLoginHook;
+export {};

package/dist/better-auth/plugin/collections/users/hooks/after-login.js

@@ -0,0 +1,71 @@
+import { generateId } from 'better-auth';
+import { createAuthMiddleware } from 'better-auth/api';
+import { setCookieCache } from 'better-auth/cookies';
+import { parseSetCookie } from 'next/dist/compiled/@edge-runtime/cookies';
+import { cookies } from 'next/headers';
+import { getPayloadAuth } from '../../../lib/get-payload-auth';
+import { getIp } from '../../../helpers/get-ip';
+import { prepareSessionData } from '../../../lib/prepare-session-data';
+/**
+ * This hook is used to sync the admin login token with better-auth session token
+ * It also creates a new session in better-auth
+ */ export const getAfterLoginHook = (options)=>{
+    const hook = async ({ collection, context, req, token, user })=>{
+        const config = req.payload.config;
+        const payload = await getPayloadAuth(config);
+        const cookieStore = await cookies();
+        const authContext = await payload.betterAuth.$context;
+        const sessionExpiration = payload.betterAuth.options.session?.expiresIn || 60 * 60 * 24 * 7 // 7 days
+        ;
+        // we can't use internal adapter as we can cause a race condition unless we pass req to the payload.create
+        const session = await payload.create({
+            collection: options.sessionsCollectionSlug,
+            data: {
+                ipAddress: getIp(req.headers, payload.betterAuth.options) || '',
+                userAgent: req.headers?.get('user-agent') || '',
+                user: user.id,
+                token: generateId(32),
+                expiresAt: new Date(Date.now() + sessionExpiration * 1000)
+            },
+            req
+        });
+        const betterAuthHandleRequest = createAuthMiddleware(async (ctx)=>{
+            ctx.context = {
+                ...authContext,
+                user: user
+            };
+            await ctx.setSignedCookie(ctx.context.authCookies.sessionToken.name, session.token, ctx.context.secret, ctx.context.authCookies.sessionToken.options);
+            const filteredSessionData = await prepareSessionData({
+                newSession: {
+                    session,
+                    user
+                },
+                payloadConfig: config,
+                collectionSlugs: {
+                    userCollectionSlug: options.usersCollectionSlug,
+                    sessionCollectionSlug: options.sessionsCollectionSlug
+                }
+            });
+            await setCookieCache(ctx, filteredSessionData);
+            if ('responseHeaders' in ctx) {
+                return ctx.responseHeaders;
+            }
+            return null;
+        });
+        const responseHeaders = await betterAuthHandleRequest(req);
+        const responseCookies = responseHeaders?.getSetCookie().map((cookie)=>parseSetCookie(cookie)).filter(Boolean);
+        if (responseCookies) {
+            for (const cookieData of responseCookies){
+                const { name, value, ...options } = cookieData;
+                cookieStore.set({
+                    ...options,
+                    name,
+                    value: decodeURIComponent(value)
+                });
+            }
+        }
+    };
+    return hook;
+};
+
+//# sourceMappingURL=after-login.js.map

package/dist/better-auth/plugin/collections/users/hooks/after-login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/plugin/collections/users/hooks/after-login.ts"],"sourcesContent":["import { generateId, Session } from 'better-auth'\nimport { createAuthMiddleware } from 'better-auth/api'\nimport { setCookieCache } from 'better-auth/cookies'\nimport { parseSetCookie, type ResponseCookie } from 'next/dist/compiled/@edge-runtime/cookies'\nimport { cookies } from 'next/headers'\nimport { CollectionAfterLoginHook } from 'payload'\nimport { getPayloadAuth } from '../../../lib/get-payload-auth'\nimport { getIp } from '../../../helpers/get-ip'\nimport { prepareSessionData } from '../../../lib/prepare-session-data'\n\ntype AfterLoginOptions = {\n  usersCollectionSlug: string\n  sessionsCollectionSlug: string\n}\n\n/**\n * This hook is used to sync the admin login token with better-auth session token\n * It also creates a new session in better-auth\n */\nexport const getAfterLoginHook = (options: AfterLoginOptions): CollectionAfterLoginHook => {\n  const hook: CollectionAfterLoginHook = async ({ collection, context, req, token, user }) => {\n    const config = req.payload.config\n    const payload = await getPayloadAuth(config)\n    const cookieStore = await cookies()\n    const authContext = await payload.betterAuth.$context\n\n    const sessionExpiration = payload.betterAuth.options.session?.expiresIn || 60 * 60 * 24 * 7 // 7 days\n    // we can't use internal adapter as we can cause a race condition unless we pass req to the payload.create\n    const session = (await payload.create({\n      collection: options.sessionsCollectionSlug,\n      data: {\n        ipAddress: getIp(req.headers, payload.betterAuth.options) || '',\n        userAgent: req.headers?.get('user-agent') || '',\n        user: user.id,\n        token: generateId(32),\n        expiresAt: new Date(Date.now() + sessionExpiration * 1000),\n      },\n      req,\n    })) as Session\n\n    const betterAuthHandleRequest = createAuthMiddleware(async (ctx): Promise<Headers | null> => {\n      ctx.context = { ...authContext, user: user }\n      await ctx.setSignedCookie(\n        ctx.context.authCookies.sessionToken.name,\n        session.token,\n        ctx.context.secret,\n        ctx.context.authCookies.sessionToken.options,\n      )\n      const filteredSessionData = await prepareSessionData({\n        newSession: { session, user },\n        payloadConfig: config,\n        collectionSlugs: {\n          userCollectionSlug: options.usersCollectionSlug,\n          sessionCollectionSlug: options.sessionsCollectionSlug,\n        },\n      })\n      await setCookieCache(ctx, filteredSessionData as any)\n      if ('responseHeaders' in ctx) {\n        return ctx.responseHeaders as Headers\n      }\n      return null\n    })\n\n    const responseHeaders = await betterAuthHandleRequest(req)\n    const responseCookies = responseHeaders\n      ?.getSetCookie()\n      .map((cookie) => parseSetCookie(cookie))\n      .filter(Boolean) as ResponseCookie[]\n\n    if (responseCookies) {\n      for (const cookieData of responseCookies) {\n        const { name, value, ...options } = cookieData\n        cookieStore.set({\n          ...options,\n          name,\n          value: decodeURIComponent(value),\n        })\n      }\n    }\n  }\n\n  return hook as CollectionAfterLoginHook\n}\n"],"names":["generateId","createAuthMiddleware","setCookieCache","parseSetCookie","cookies","getPayloadAuth","getIp","prepareSessionData","getAfterLoginHook","options","hook","collection","context","req","token","user","config","payload","cookieStore","authContext","betterAuth","$context","sessionExpiration","session","expiresIn","create","sessionsCollectionSlug","data","ipAddress","headers","userAgent","get","id","expiresAt","Date","now","betterAuthHandleRequest","ctx","setSignedCookie","authCookies","sessionToken","name","secret","filteredSessionData","newSession","payloadConfig","collectionSlugs","userCollectionSlug","usersCollectionSlug","sessionCollectionSlug","responseHeaders","responseCookies","getSetCookie","map","cookie","filter","Boolean","cookieData","value","set","decodeURIComponent"],"mappings":"AAAA,SAASA,UAAU,QAAiB,cAAa;AACjD,SAASC,oBAAoB,QAAQ,kBAAiB;AACtD,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,cAAc,QAA6B,2CAA0C;AAC9F,SAASC,OAAO,QAAQ,eAAc;AAEtC,SAASC,cAAc,QAAQ,gCAA+B;AAC9D,SAASC,KAAK,QAAQ,0BAAyB;AAC/C,SAASC,kBAAkB,QAAQ,oCAAmC;AAOtE;;;CAGC,GACD,OAAO,MAAMC,oBAAoB,CAACC;IAChC,MAAMC,OAAiC,OAAO,EAAEC,UAAU,EAAEC,OAAO,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE;QACrF,MAAMC,SAASH,IAAII,OAAO,CAACD,MAAM;QACjC,MAAMC,UAAU,MAAMZ,eAAeW;QACrC,MAAME,cAAc,MAAMd;QAC1B,MAAMe,cAAc,MAAMF,QAAQG,UAAU,CAACC,QAAQ;QAErD,MAAMC,oBAAoBL,QAAQG,UAAU,CAACX,OAAO,CAACc,OAAO,EAAEC,aAAa,KAAK,KAAK,KAAK,EAAE,SAAS;;QACrG,0GAA0G;QAC1G,MAAMD,UAAW,MAAMN,QAAQQ,MAAM,CAAC;YACpCd,YAAYF,QAAQiB,sBAAsB;YAC1CC,MAAM;gBACJC,WAAWtB,MAAMO,IAAIgB,OAAO,EAAEZ,QAAQG,UAAU,CAACX,OAAO,KAAK;gBAC7DqB,WAAWjB,IAAIgB,OAAO,EAAEE,IAAI,iBAAiB;gBAC7ChB,MAAMA,KAAKiB,EAAE;gBACblB,OAAOd,WAAW;gBAClBiC,WAAW,IAAIC,KAAKA,KAAKC,GAAG,KAAKb,oBAAoB;YACvD;YACAT;QACF;QAEA,MAAMuB,0BAA0BnC,qBAAqB,OAAOoC;YAC1DA,IAAIzB,OAAO,GAAG;gBAAE,GAAGO,WAAW;gBAAEJ,MAAMA;YAAK;YAC3C,MAAMsB,IAAIC,eAAe,CACvBD,IAAIzB,OAAO,CAAC2B,WAAW,CAACC,YAAY,CAACC,IAAI,EACzClB,QAAQT,KAAK,EACbuB,IAAIzB,OAAO,CAAC8B,MAAM,EAClBL,IAAIzB,OAAO,CAAC2B,WAAW,CAACC,YAAY,CAAC/B,OAAO;YAE9C,MAAMkC,sBAAsB,MAAMpC,mBAAmB;gBACnDqC,YAAY;oBAAErB;oBAASR;gBAAK;gBAC5B8B,eAAe7B;gBACf8B,iBAAiB;oBACfC,oBAAoBtC,QAAQuC,mBAAmB;oBAC/CC,uBAAuBxC,QAAQiB,sBAAsB;gBACvD;YACF;YACA,MAAMxB,eAAemC,KAAKM;YAC1B,IAAI,qBAAqBN,KAAK;gBAC5B,OAAOA,IAAIa,eAAe;YAC5B;YACA,OAAO;QACT;QAEA,MAAMA,kBAAkB,MAAMd,wBAAwBvB;QACtD,MAAMsC,kBAAkBD,iBACpBE,eACDC,IAAI,CAACC,SAAWnD,eAAemD,SAC/BC,OAAOC;QAEV,IAAIL,iBAAiB;YACnB,KAAK,MAAMM,cAAcN,gBAAiB;gBACxC,MAAM,EAAEV,IAAI,EAAEiB,KAAK,EAAE,GAAGjD,SAAS,GAAGgD;gBACpCvC,YAAYyC,GAAG,CAAC;oBACd,GAAGlD,OAAO;oBACVgC;oBACAiB,OAAOE,mBAAmBF;gBAC5B;YACF;QACF;IACF;IAEA,OAAOhD;AACT,EAAC"}

package/dist/better-auth/plugin/collections/users/hooks/after-logout.d.ts

@@ -0,0 +1,6 @@
+import type { CollectionAfterLogoutHook } from 'payload';
+type AfterLogoutOptions = {
+    sessionsCollectionSlug: string;
+};
+export declare const getAfterLogoutHook: (options: AfterLogoutOptions) => CollectionAfterLogoutHook;
+export {};

package/dist/better-auth/plugin/collections/users/hooks/after-logout.js

@@ -0,0 +1,49 @@
+import { cookies } from 'next/headers';
+import { getPayloadAuth } from '../../../lib/get-payload-auth';
+export const getAfterLogoutHook = (options)=>{
+    const hook = async ({ req })=>{
+        const cookieStore = await cookies();
+        const payload = await getPayloadAuth(req.payload.config);
+        const authContext = await payload.betterAuth.$context;
+        const sessionTokenName = authContext.authCookies.sessionToken.name;
+        const sessionDataName = authContext.authCookies.sessionData.name;
+        const dontRememberTokenName = authContext.authCookies.dontRememberToken.name;
+        const sessionCookieValue = cookieStore.get(sessionTokenName)?.value;
+        if (sessionCookieValue) {
+            const payload = req.payload;
+            const [token] = sessionCookieValue.split('.');
+            const { docs: sessions } = await payload.find({
+                collection: options.sessionsCollectionSlug,
+                where: {
+                    token: {
+                        equals: token
+                    }
+                },
+                limit: 1
+            });
+            const session = sessions.at(0);
+            if (session) {
+                await payload.delete({
+                    collection: options.sessionsCollectionSlug,
+                    id: session.id
+                });
+            }
+        }
+        const baseMultiSessionName = sessionTokenName + '_multi';
+        const multiSessionCookies = cookieStore.getAll();
+        multiSessionCookies.forEach((cookie)=>{
+            if (cookie.name.startsWith(baseMultiSessionName)) {
+                cookieStore.delete(cookie.name);
+            }
+        });
+        //TODO: this is a hack to delete the admin session cookie
+        // we need to find a better way to do this (BETTER AUTH HARDCODED THIS)
+        cookieStore.delete('admin_session');
+        cookieStore.delete(sessionTokenName);
+        cookieStore.delete(sessionDataName);
+        cookieStore.delete(dontRememberTokenName);
+    };
+    return hook;
+};
+
+//# sourceMappingURL=after-logout.js.map

package/dist/better-auth/plugin/collections/users/hooks/after-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/plugin/collections/users/hooks/after-logout.ts"],"sourcesContent":["import { cookies } from 'next/headers'\nimport type { CollectionAfterLogoutHook } from 'payload'\nimport type { CollectionHookWithBetterAuth } from '../../../types'\nimport { getPayloadAuth } from '../../../lib/get-payload-auth'\n\ntype CollectionAfterLogoutHookWithBetterAuth =\n  CollectionHookWithBetterAuth<CollectionAfterLogoutHook>\n\ntype AfterLogoutOptions = {\n  sessionsCollectionSlug: string\n}\n\nexport const getAfterLogoutHook = (options: AfterLogoutOptions): CollectionAfterLogoutHook => {\n  const hook: CollectionAfterLogoutHookWithBetterAuth = async ({ req }) => {\n    const cookieStore = await cookies()\n    const payload = await getPayloadAuth(req.payload.config)\n    const authContext = await payload.betterAuth.$context\n    const sessionTokenName = authContext.authCookies.sessionToken.name\n\n    const sessionDataName = authContext.authCookies.sessionData.name\n    const dontRememberTokenName = authContext.authCookies.dontRememberToken.name\n\n    const sessionCookieValue = cookieStore.get(sessionTokenName)?.value\n    if (sessionCookieValue) {\n      const payload = req.payload\n      const [token] = sessionCookieValue.split('.')\n      const { docs: sessions } = await payload.find({\n        collection: options.sessionsCollectionSlug,\n        where: {\n          token: { equals: token },\n        },\n        limit: 1,\n      })\n      const session = sessions.at(0)\n      if (session) {\n        await payload.delete({\n          collection: options.sessionsCollectionSlug,\n          id: session.id,\n        })\n      }\n    }\n\n    const baseMultiSessionName = sessionTokenName + '_multi'\n    const multiSessionCookies = cookieStore.getAll()\n    multiSessionCookies.forEach((cookie) => {\n      if (cookie.name.startsWith(baseMultiSessionName)) {\n        cookieStore.delete(cookie.name)\n      }\n    })\n\n    //TODO: this is a hack to delete the admin session cookie\n    // we need to find a better way to do this (BETTER AUTH HARDCODED THIS)\n    cookieStore.delete('admin_session')\n\n    cookieStore.delete(sessionTokenName)\n    cookieStore.delete(sessionDataName)\n    cookieStore.delete(dontRememberTokenName)\n  }\n\n  return hook as CollectionAfterLogoutHook\n}\n"],"names":["cookies","getPayloadAuth","getAfterLogoutHook","options","hook","req","cookieStore","payload","config","authContext","betterAuth","$context","sessionTokenName","authCookies","sessionToken","name","sessionDataName","sessionData","dontRememberTokenName","dontRememberToken","sessionCookieValue","get","value","token","split","docs","sessions","find","collection","sessionsCollectionSlug","where","equals","limit","session","at","delete","id","baseMultiSessionName","multiSessionCookies","getAll","forEach","cookie","startsWith"],"mappings":"AAAA,SAASA,OAAO,QAAQ,eAAc;AAGtC,SAASC,cAAc,QAAQ,gCAA+B;AAS9D,OAAO,MAAMC,qBAAqB,CAACC;IACjC,MAAMC,OAAgD,OAAO,EAAEC,GAAG,EAAE;QAClE,MAAMC,cAAc,MAAMN;QAC1B,MAAMO,UAAU,MAAMN,eAAeI,IAAIE,OAAO,CAACC,MAAM;QACvD,MAAMC,cAAc,MAAMF,QAAQG,UAAU,CAACC,QAAQ;QACrD,MAAMC,mBAAmBH,YAAYI,WAAW,CAACC,YAAY,CAACC,IAAI;QAElE,MAAMC,kBAAkBP,YAAYI,WAAW,CAACI,WAAW,CAACF,IAAI;QAChE,MAAMG,wBAAwBT,YAAYI,WAAW,CAACM,iBAAiB,CAACJ,IAAI;QAE5E,MAAMK,qBAAqBd,YAAYe,GAAG,CAACT,mBAAmBU;QAC9D,IAAIF,oBAAoB;YACtB,MAAMb,UAAUF,IAAIE,OAAO;YAC3B,MAAM,CAACgB,MAAM,GAAGH,mBAAmBI,KAAK,CAAC;YACzC,MAAM,EAAEC,MAAMC,QAAQ,EAAE,GAAG,MAAMnB,QAAQoB,IAAI,CAAC;gBAC5CC,YAAYzB,QAAQ0B,sBAAsB;gBAC1CC,OAAO;oBACLP,OAAO;wBAAEQ,QAAQR;oBAAM;gBACzB;gBACAS,OAAO;YACT;YACA,MAAMC,UAAUP,SAASQ,EAAE,CAAC;YAC5B,IAAID,SAAS;gBACX,MAAM1B,QAAQ4B,MAAM,CAAC;oBACnBP,YAAYzB,QAAQ0B,sBAAsB;oBAC1CO,IAAIH,QAAQG,EAAE;gBAChB;YACF;QACF;QAEA,MAAMC,uBAAuBzB,mBAAmB;QAChD,MAAM0B,sBAAsBhC,YAAYiC,MAAM;QAC9CD,oBAAoBE,OAAO,CAAC,CAACC;YAC3B,IAAIA,OAAO1B,IAAI,CAAC2B,UAAU,CAACL,uBAAuB;gBAChD/B,YAAY6B,MAAM,CAACM,OAAO1B,IAAI;YAChC;QACF;QAEA,yDAAyD;QACzD,uEAAuE;QACvET,YAAY6B,MAAM,CAAC;QAEnB7B,YAAY6B,MAAM,CAACvB;QACnBN,YAAY6B,MAAM,CAACnB;QACnBV,YAAY6B,MAAM,CAACjB;IACrB;IAEA,OAAOd;AACT,EAAC"}

package/dist/better-auth/plugin/collections/users/hooks/before-login.d.ts

@@ -0,0 +1,5 @@
+import { CollectionBeforeLoginHook } from 'payload';
+/**
+ * This hook blocks login attempts if email verification is required and the user's email is not verified
+ */
+export declare const getBeforeLoginHook: () => CollectionBeforeLoginHook;

package/dist/better-auth/plugin/collections/users/hooks/before-login.js

@@ -0,0 +1,18 @@
+import { APIError } from 'payload';
+import { getPayloadAuth } from '../../../lib/get-payload-auth';
+/**
+ * This hook blocks login attempts if email verification is required and the user's email is not verified
+ */ export const getBeforeLoginHook = ()=>{
+    const hook = async ({ req, user })=>{
+        const config = req.payload.config;
+        const payload = await getPayloadAuth(config);
+        const requireEmailVerification = payload.betterAuth.options.emailAndPassword?.requireEmailVerification ?? false;
+        if (requireEmailVerification && !user.emailVerified) {
+            throw new APIError('Email verification required. Please verify your email before logging in.', 403);
+        }
+        return user;
+    };
+    return hook;
+};
+
+//# sourceMappingURL=before-login.js.map

package/dist/better-auth/plugin/collections/users/hooks/before-login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/plugin/collections/users/hooks/before-login.ts"],"sourcesContent":["import { APIError, CollectionBeforeLoginHook } from 'payload'\nimport { getPayloadAuth } from '../../../lib/get-payload-auth'\n\n/**\n * This hook blocks login attempts if email verification is required and the user's email is not verified\n */\nexport const getBeforeLoginHook = (): CollectionBeforeLoginHook => {\n  const hook: CollectionBeforeLoginHook = async ({ req, user }) => {\n    const config = req.payload.config\n    const payload = await getPayloadAuth(config)\n\n    const requireEmailVerification =\n      payload.betterAuth.options.emailAndPassword?.requireEmailVerification ?? false\n\n    if (requireEmailVerification && !user.emailVerified) {\n      throw new APIError(\n        'Email verification required. Please verify your email before logging in.',\n        403,\n      )\n    }\n\n    return user\n  }\n\n  return hook\n}\n"],"names":["APIError","getPayloadAuth","getBeforeLoginHook","hook","req","user","config","payload","requireEmailVerification","betterAuth","options","emailAndPassword","emailVerified"],"mappings":"AAAA,SAASA,QAAQ,QAAmC,UAAS;AAC7D,SAASC,cAAc,QAAQ,gCAA+B;AAE9D;;CAEC,GACD,OAAO,MAAMC,qBAAqB;IAChC,MAAMC,OAAkC,OAAO,EAAEC,GAAG,EAAEC,IAAI,EAAE;QAC1D,MAAMC,SAASF,IAAIG,OAAO,CAACD,MAAM;QACjC,MAAMC,UAAU,MAAMN,eAAeK;QAErC,MAAME,2BACJD,QAAQE,UAAU,CAACC,OAAO,CAACC,gBAAgB,EAAEH,4BAA4B;QAE3E,IAAIA,4BAA4B,CAACH,KAAKO,aAAa,EAAE;YACnD,MAAM,IAAIZ,SACR,4EACA;QAEJ;QAEA,OAAOK;IACT;IAEA,OAAOF;AACT,EAAC"}

package/dist/better-auth/plugin/collections/users/hooks/clean-up-user-after-delete.d.ts

@@ -0,0 +1,5 @@
+import type { CollectionAfterDeleteHook } from 'payload';
+import type { CollectionHookWithBetterAuth } from '../../../types';
+type CollectionAfterDeleteHookWithBetterAuth = CollectionHookWithBetterAuth<CollectionAfterDeleteHook>;
+export declare const cleanUpUserAfterDelete: CollectionAfterDeleteHookWithBetterAuth;
+export {};

package/dist/better-auth/plugin/collections/users/hooks/clean-up-user-after-delete.js

@@ -0,0 +1,33 @@
+export const cleanUpUserAfterDelete = async ({ doc, req })=>{
+    try {
+        const { payload } = req;
+        const betterAuthContext = await payload.betterAuth.$context;
+        const userId = doc.id;
+        const beforeDelete = betterAuthContext.options.user?.deleteUser?.beforeDelete;
+        if (typeof beforeDelete === 'function') {
+            await beforeDelete(doc, req);
+        }
+        await betterAuthContext.internalAdapter.deleteSessions(userId);
+        await betterAuthContext.internalAdapter.deleteAccounts(userId);
+        if (payload.collections.verifications) {
+            await payload.delete({
+                collection: payload.collections.verifications.config.slug,
+                where: {
+                    value: {
+                        like: `"${userId}"`
+                    }
+                }
+            });
+        }
+        const afterDelete = betterAuthContext.options.user?.deleteUser?.afterDelete;
+        if (typeof afterDelete === 'function') {
+            await afterDelete(doc, req);
+        }
+        return doc;
+    } catch (error) {
+        console.error('Error in user afterDelete hook:', error);
+        return doc;
+    }
+};
+
+//# sourceMappingURL=clean-up-user-after-delete.js.map

package/dist/better-auth/plugin/collections/users/hooks/clean-up-user-after-delete.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/plugin/collections/users/hooks/clean-up-user-after-delete.ts"],"sourcesContent":["import type { CollectionAfterDeleteHook } from 'payload'\nimport type { CollectionHookWithBetterAuth } from '../../../types'\n\ntype CollectionAfterDeleteHookWithBetterAuth =\n  CollectionHookWithBetterAuth<CollectionAfterDeleteHook>\n\nexport const cleanUpUserAfterDelete: CollectionAfterDeleteHookWithBetterAuth = async ({\n  doc,\n  req,\n}) => {\n  try {\n    const { payload } = req\n    const betterAuthContext = await payload.betterAuth.$context\n    const userId = doc.id\n    const beforeDelete = betterAuthContext.options.user?.deleteUser?.beforeDelete\n    if (typeof beforeDelete === 'function') {\n      await beforeDelete(doc, req as Request)\n    }\n    await betterAuthContext.internalAdapter.deleteSessions(userId)\n    await betterAuthContext.internalAdapter.deleteAccounts(userId)\n    if (payload.collections.verifications) {\n      await payload.delete({\n        collection: payload.collections.verifications.config.slug,\n        where: {\n          value: {\n            like: `\"${userId}\"`,\n          },\n        },\n      })\n    }\n    const afterDelete = betterAuthContext.options.user?.deleteUser?.afterDelete\n    if (typeof afterDelete === 'function') {\n      await afterDelete(doc, req as Request)\n    }\n    return doc\n  } catch (error) {\n    console.error('Error in user afterDelete hook:', error)\n    return doc\n  }\n}\n"],"names":["cleanUpUserAfterDelete","doc","req","payload","betterAuthContext","betterAuth","$context","userId","id","beforeDelete","options","user","deleteUser","internalAdapter","deleteSessions","deleteAccounts","collections","verifications","delete","collection","config","slug","where","value","like","afterDelete","error","console"],"mappings":"AAMA,OAAO,MAAMA,yBAAkE,OAAO,EACpFC,GAAG,EACHC,GAAG,EACJ;IACC,IAAI;QACF,MAAM,EAAEC,OAAO,EAAE,GAAGD;QACpB,MAAME,oBAAoB,MAAMD,QAAQE,UAAU,CAACC,QAAQ;QAC3D,MAAMC,SAASN,IAAIO,EAAE;QACrB,MAAMC,eAAeL,kBAAkBM,OAAO,CAACC,IAAI,EAAEC,YAAYH;QACjE,IAAI,OAAOA,iBAAiB,YAAY;YACtC,MAAMA,aAAaR,KAAKC;QAC1B;QACA,MAAME,kBAAkBS,eAAe,CAACC,cAAc,CAACP;QACvD,MAAMH,kBAAkBS,eAAe,CAACE,cAAc,CAACR;QACvD,IAAIJ,QAAQa,WAAW,CAACC,aAAa,EAAE;YACrC,MAAMd,QAAQe,MAAM,CAAC;gBACnBC,YAAYhB,QAAQa,WAAW,CAACC,aAAa,CAACG,MAAM,CAACC,IAAI;gBACzDC,OAAO;oBACLC,OAAO;wBACLC,MAAM,CAAC,CAAC,EAAEjB,OAAO,CAAC,CAAC;oBACrB;gBACF;YACF;QACF;QACA,MAAMkB,cAAcrB,kBAAkBM,OAAO,CAACC,IAAI,EAAEC,YAAYa;QAChE,IAAI,OAAOA,gBAAgB,YAAY;YACrC,MAAMA,YAAYxB,KAAKC;QACzB;QACA,OAAOD;IACT,EAAE,OAAOyB,OAAO;QACdC,QAAQD,KAAK,CAAC,mCAAmCA;QACjD,OAAOzB;IACT;AACF,EAAC"}

package/dist/better-auth/plugin/collections/users/hooks/on-verified-change.d.ts

@@ -0,0 +1,2 @@
+import { CollectionBeforeChangeHook } from 'payload';
+export declare const onVerifiedChange: CollectionBeforeChangeHook;

package/dist/better-auth/plugin/collections/users/hooks/on-verified-change.js

@@ -0,0 +1,14 @@
+export const onVerifiedChange = async ({ data, originalDoc })=>{
+    const isVerifiedChangingToTrue = Boolean(data._verified) && !Boolean(originalDoc?._verified);
+    const isEmailVerifiedChangingToTrue = Boolean(data.emailVerified) && !Boolean(originalDoc?.emailVerified);
+    if (!isVerifiedChangingToTrue && !isEmailVerifiedChangingToTrue) {
+        return data;
+    }
+    return {
+        ...data,
+        _verified: true,
+        emailVerified: true
+    };
+};
+
+//# sourceMappingURL=on-verified-change.js.map

package/dist/better-auth/plugin/collections/users/hooks/on-verified-change.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/plugin/collections/users/hooks/on-verified-change.ts"],"sourcesContent":["import { CollectionBeforeChangeHook } from 'payload'\n\nexport const onVerifiedChange: CollectionBeforeChangeHook = async ({ data, originalDoc }) => {\n  const isVerifiedChangingToTrue = Boolean(data._verified) && !Boolean(originalDoc?._verified)\n  const isEmailVerifiedChangingToTrue =\n    Boolean(data.emailVerified) && !Boolean(originalDoc?.emailVerified)\n\n  if (!isVerifiedChangingToTrue && !isEmailVerifiedChangingToTrue) {\n    return data\n  }\n\n  return {\n    ...data,\n    _verified: true,\n    emailVerified: true,\n  }\n}\n"],"names":["onVerifiedChange","data","originalDoc","isVerifiedChangingToTrue","Boolean","_verified","isEmailVerifiedChangingToTrue","emailVerified"],"mappings":"AAEA,OAAO,MAAMA,mBAA+C,OAAO,EAAEC,IAAI,EAAEC,WAAW,EAAE;IACtF,MAAMC,2BAA2BC,QAAQH,KAAKI,SAAS,KAAK,CAACD,QAAQF,aAAaG;IAClF,MAAMC,gCACJF,QAAQH,KAAKM,aAAa,KAAK,CAACH,QAAQF,aAAaK;IAEvD,IAAI,CAACJ,4BAA4B,CAACG,+BAA+B;QAC/D,OAAOL;IACT;IAEA,OAAO;QACL,GAAGA,IAAI;QACPI,WAAW;QACXE,eAAe;IACjB;AACF,EAAC"}

package/dist/better-auth/plugin/collections/users/hooks/sync-account.d.ts

@@ -0,0 +1,7 @@
+import type { CollectionAfterChangeHook } from 'payload';
+type SyncAccountOptions = {
+    userSlug: string;
+    accountSlug: string;
+};
+export declare const getSyncAccountHook: (options: SyncAccountOptions) => CollectionAfterChangeHook;
+export {};

package/dist/better-auth/plugin/collections/users/hooks/sync-account.js

@@ -0,0 +1,82 @@
+import { BETTER_AUTH_CONTEXT_KEY } from 'payload-auth/better-auth/adapter';
+export const getSyncAccountHook = (options)=>{
+    const hook = async ({ doc, req, operation, context })=>{
+        if (context?.syncPasswordToUser) return doc;
+        if (operation !== 'create' && operation !== 'update') return doc;
+        const user = await req.payload.findByID({
+            collection: options.userSlug,
+            id: doc.id,
+            depth: 0,
+            req,
+            showHiddenFields: true
+        });
+        if (!user || !user.hash || !user.salt) return doc;
+        const passwordValue = `${user.salt}:${user.hash}`;
+        const userField = req.payload.betterAuth.options.account?.fields?.userId || 'userId';
+        if (operation === 'create' && !(BETTER_AUTH_CONTEXT_KEY in context)) {
+            try {
+                await req.payload.create({
+                    collection: options.accountSlug,
+                    data: {
+                        [userField]: doc.id,
+                        accountId: doc.id.toString(),
+                        providerId: 'credential',
+                        password: passwordValue,
+                        context: {
+                            syncAccountHook: true
+                        }
+                    },
+                    req
+                });
+            } catch (error) {
+                console.error('Failed to create account for user:', error);
+            }
+        }
+        if (operation === 'update') {
+            try {
+                const accounts = await req.payload.find({
+                    collection: options.accountSlug,
+                    where: {
+                        and: [
+                            {
+                                [userField]: {
+                                    equals: doc.id
+                                }
+                            },
+                            {
+                                providerId: {
+                                    equals: 'credential'
+                                }
+                            }
+                        ]
+                    },
+                    req,
+                    depth: 0,
+                    context: {
+                        syncAccountHook: true
+                    }
+                });
+                const account = accounts.docs.at(0);
+                if (account) {
+                    await req.payload.update({
+                        collection: options.accountSlug,
+                        id: account.id,
+                        data: {
+                            password: passwordValue
+                        },
+                        req,
+                        context: {
+                            syncAccountHook: true
+                        }
+                    });
+                }
+            } catch (error) {
+                console.error('Failed to sync hash/salt to account:', error);
+            }
+        }
+        return doc;
+    };
+    return hook;
+};
+
+//# sourceMappingURL=sync-account.js.map

package/dist/better-auth/plugin/collections/users/hooks/sync-account.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/plugin/collections/users/hooks/sync-account.ts"],"sourcesContent":["import type { CollectionAfterChangeHook } from 'payload'\nimport type { CollectionHookWithBetterAuth } from '../../../types'\nimport { BETTER_AUTH_CONTEXT_KEY } from 'payload-auth/better-auth/adapter'\n\ntype CollectionAfterChangeHookWithBetterAuth =\n  CollectionHookWithBetterAuth<CollectionAfterChangeHook>\n\ntype SyncAccountOptions = {\n  userSlug: string\n  accountSlug: string\n}\n\nexport const getSyncAccountHook = (options: SyncAccountOptions): CollectionAfterChangeHook => {\n  const hook: CollectionAfterChangeHookWithBetterAuth = async ({\n    doc,\n    req,\n    operation,\n    context,\n  }) => {\n    if (context?.syncPasswordToUser) return doc\n\n    if (operation !== 'create' && operation !== 'update') return doc\n\n    const user = await req.payload.findByID({\n      collection: options.userSlug,\n      id: doc.id,\n      depth: 0,\n      req,\n      showHiddenFields: true,\n    })\n\n    if (!user || !user.hash || !user.salt) return doc\n\n    const passwordValue = `${user.salt}:${user.hash}`\n    const userField = req.payload.betterAuth.options.account?.fields?.userId || 'userId'\n\n    if (operation === 'create' && !(BETTER_AUTH_CONTEXT_KEY in context)) {\n      try {\n        await req.payload.create({\n          collection: options.accountSlug,\n          data: {\n            [userField]: doc.id,\n            accountId: doc.id.toString(),\n            providerId: 'credential',\n            password: passwordValue,\n            context: { syncAccountHook: true },\n          },\n          req,\n        })\n      } catch (error) {\n        console.error('Failed to create account for user:', error)\n      }\n    }\n\n    if (operation === 'update') {\n      try {\n        const accounts = await req.payload.find({\n          collection: options.accountSlug,\n          where: {\n            and: [{ [userField]: { equals: doc.id } }, { providerId: { equals: 'credential' } }],\n          },\n          req,\n          depth: 0,\n          context: { syncAccountHook: true },\n        })\n\n        const account = accounts.docs.at(0)\n        if (account) {\n          await req.payload.update({\n            collection: options.accountSlug,\n            id: account.id,\n            data: {\n              password: passwordValue,\n            },\n            req,\n            context: { syncAccountHook: true },\n          })\n        }\n      } catch (error) {\n        console.error('Failed to sync hash/salt to account:', error)\n      }\n    }\n\n    return doc\n  }\n\n  return hook as CollectionAfterChangeHook\n}\n"],"names":["BETTER_AUTH_CONTEXT_KEY","getSyncAccountHook","options","hook","doc","req","operation","context","syncPasswordToUser","user","payload","findByID","collection","userSlug","id","depth","showHiddenFields","hash","salt","passwordValue","userField","betterAuth","account","fields","userId","create","accountSlug","data","accountId","toString","providerId","password","syncAccountHook","error","console","accounts","find","where","and","equals","docs","at","update"],"mappings":"AAEA,SAASA,uBAAuB,QAAQ,mCAAkC;AAU1E,OAAO,MAAMC,qBAAqB,CAACC;IACjC,MAAMC,OAAgD,OAAO,EAC3DC,GAAG,EACHC,GAAG,EACHC,SAAS,EACTC,OAAO,EACR;QACC,IAAIA,SAASC,oBAAoB,OAAOJ;QAExC,IAAIE,cAAc,YAAYA,cAAc,UAAU,OAAOF;QAE7D,MAAMK,OAAO,MAAMJ,IAAIK,OAAO,CAACC,QAAQ,CAAC;YACtCC,YAAYV,QAAQW,QAAQ;YAC5BC,IAAIV,IAAIU,EAAE;YACVC,OAAO;YACPV;YACAW,kBAAkB;QACpB;QAEA,IAAI,CAACP,QAAQ,CAACA,KAAKQ,IAAI,IAAI,CAACR,KAAKS,IAAI,EAAE,OAAOd;QAE9C,MAAMe,gBAAgB,GAAGV,KAAKS,IAAI,CAAC,CAAC,EAAET,KAAKQ,IAAI,EAAE;QACjD,MAAMG,YAAYf,IAAIK,OAAO,CAACW,UAAU,CAACnB,OAAO,CAACoB,OAAO,EAAEC,QAAQC,UAAU;QAE5E,IAAIlB,cAAc,YAAY,CAAEN,CAAAA,2BAA2BO,OAAM,GAAI;YACnE,IAAI;gBACF,MAAMF,IAAIK,OAAO,CAACe,MAAM,CAAC;oBACvBb,YAAYV,QAAQwB,WAAW;oBAC/BC,MAAM;wBACJ,CAACP,UAAU,EAAEhB,IAAIU,EAAE;wBACnBc,WAAWxB,IAAIU,EAAE,CAACe,QAAQ;wBAC1BC,YAAY;wBACZC,UAAUZ;wBACVZ,SAAS;4BAAEyB,iBAAiB;wBAAK;oBACnC;oBACA3B;gBACF;YACF,EAAE,OAAO4B,OAAO;gBACdC,QAAQD,KAAK,CAAC,sCAAsCA;YACtD;QACF;QAEA,IAAI3B,cAAc,UAAU;YAC1B,IAAI;gBACF,MAAM6B,WAAW,MAAM9B,IAAIK,OAAO,CAAC0B,IAAI,CAAC;oBACtCxB,YAAYV,QAAQwB,WAAW;oBAC/BW,OAAO;wBACLC,KAAK;4BAAC;gCAAE,CAAClB,UAAU,EAAE;oCAAEmB,QAAQnC,IAAIU,EAAE;gCAAC;4BAAE;4BAAG;gCAAEgB,YAAY;oCAAES,QAAQ;gCAAa;4BAAE;yBAAE;oBACtF;oBACAlC;oBACAU,OAAO;oBACPR,SAAS;wBAAEyB,iBAAiB;oBAAK;gBACnC;gBAEA,MAAMV,UAAUa,SAASK,IAAI,CAACC,EAAE,CAAC;gBACjC,IAAInB,SAAS;oBACX,MAAMjB,IAAIK,OAAO,CAACgC,MAAM,CAAC;wBACvB9B,YAAYV,QAAQwB,WAAW;wBAC/BZ,IAAIQ,QAAQR,EAAE;wBACda,MAAM;4BACJI,UAAUZ;wBACZ;wBACAd;wBACAE,SAAS;4BAAEyB,iBAAiB;wBAAK;oBACnC;gBACF;YACF,EAAE,OAAOC,OAAO;gBACdC,QAAQD,KAAK,CAAC,wCAAwCA;YACxD;QACF;QAEA,OAAO7B;IACT;IAEA,OAAOD;AACT,EAAC"}

package/dist/better-auth/plugin/helpers/generate-verify-email-url.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Generates a verification URL for email verification
+ *
+ * This utility function creates a JWT token containing the user's email and
+ * expiration information, signs it with the provided secret, and constructs
+ * a verification URL with the token as a query parameter.
+ *
+ * @param userEmail - The email address of the user to verify
+ * @param secret - The secret used to sign the JWT
+ * @param expiresIn - Duration in seconds for token expiration (default: 3600)
+ * @param verifyRouteUrl - The base URL for the verification endpoint
+ * @param callbackURL - Optional callback URL after verification (default: "/")
+ * @returns The complete verification URL with token
+ *
+ * @example
+ * const url = await generateVerifyEmailUrl({
+ *   userEmail: 'user@example.com',
+ *   secret: 'your-secret-key',
+ *   verifyRouteUrl: 'https://your-app.com/api/auth/verify-email',
+ *   callbackURL: '/profile'
+ * });
+ */
+export declare const generateVerifyEmailUrl: ({ userEmail, secret, expiresIn, verifyRouteUrl, callbackURL, }: {
+    userEmail: string;
+    secret: string;
+    expiresIn?: number;
+    verifyRouteUrl: string;
+    callbackURL?: string;
+}) => Promise<string>;

package/dist/better-auth/plugin/helpers/generate-verify-email-url.js

@@ -0,0 +1,46 @@
+import { SignJWT } from 'jose';
+/**
+ * Generates a verification URL for email verification
+ *
+ * This utility function creates a JWT token containing the user's email and
+ * expiration information, signs it with the provided secret, and constructs
+ * a verification URL with the token as a query parameter.
+ *
+ * @param userEmail - The email address of the user to verify
+ * @param secret - The secret used to sign the JWT
+ * @param expiresIn - Duration in seconds for token expiration (default: 3600)
+ * @param verifyRouteUrl - The base URL for the verification endpoint
+ * @param callbackURL - Optional callback URL after verification (default: "/")
+ * @returns The complete verification URL with token
+ *
+ * @example
+ * const url = await generateVerifyEmailUrl({
+ *   userEmail: 'user@example.com',
+ *   secret: 'your-secret-key',
+ *   verifyRouteUrl: 'https://your-app.com/api/auth/verify-email',
+ *   callbackURL: '/profile'
+ * });
+ */ export const generateVerifyEmailUrl = async ({ userEmail, secret, expiresIn = 3600, verifyRouteUrl, callbackURL = '/' })=>{
+    if (!userEmail) {
+        throw new Error('userEmail is required to generate a verification URL');
+    }
+    if (!secret) {
+        throw new Error('secret is required to sign the JWT token');
+    }
+    if (!verifyRouteUrl) {
+        throw new Error('verifyRouteUrl is required to generate a verification URL');
+    }
+    // Create and sign the JWT token
+    const jwt = await new SignJWT({
+        email: userEmail,
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor(Date.now() / 1000) + expiresIn
+    }).setProtectedHeader({
+        alg: 'HS256'
+    }).sign(new TextEncoder().encode(secret));
+    // Build the verification URL
+    const verifyUrl = `${verifyRouteUrl}?token=${jwt}${callbackURL ? `&callbackURL=${encodeURIComponent(callbackURL)}` : ''}`;
+    return verifyUrl;
+};
+
+//# sourceMappingURL=generate-verify-email-url.js.map

package/dist/better-auth/plugin/helpers/generate-verify-email-url.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/plugin/helpers/generate-verify-email-url.ts"],"sourcesContent":["import { SignJWT } from 'jose'\n\n/**\n * Generates a verification URL for email verification\n *\n * This utility function creates a JWT token containing the user's email and\n * expiration information, signs it with the provided secret, and constructs\n * a verification URL with the token as a query parameter.\n *\n * @param userEmail - The email address of the user to verify\n * @param secret - The secret used to sign the JWT\n * @param expiresIn - Duration in seconds for token expiration (default: 3600)\n * @param verifyRouteUrl - The base URL for the verification endpoint\n * @param callbackURL - Optional callback URL after verification (default: \"/\")\n * @returns The complete verification URL with token\n *\n * @example\n * const url = await generateVerifyEmailUrl({\n *   userEmail: 'user@example.com',\n *   secret: 'your-secret-key',\n *   verifyRouteUrl: 'https://your-app.com/api/auth/verify-email',\n *   callbackURL: '/profile'\n * });\n */\nexport const generateVerifyEmailUrl = async ({\n  userEmail,\n  secret,\n  expiresIn = 3600,\n  verifyRouteUrl,\n  callbackURL = '/',\n}: {\n  userEmail: string\n  secret: string\n  expiresIn?: number\n  verifyRouteUrl: string\n  callbackURL?: string\n}): Promise<string> => {\n  if (!userEmail) {\n    throw new Error('userEmail is required to generate a verification URL')\n  }\n\n  if (!secret) {\n    throw new Error('secret is required to sign the JWT token')\n  }\n\n  if (!verifyRouteUrl) {\n    throw new Error('verifyRouteUrl is required to generate a verification URL')\n  }\n\n  // Create and sign the JWT token\n  const jwt = await new SignJWT({\n    email: userEmail,\n    iat: Math.floor(Date.now() / 1000),\n    exp: Math.floor(Date.now() / 1000) + expiresIn,\n  })\n    .setProtectedHeader({ alg: 'HS256' })\n    .sign(new TextEncoder().encode(secret))\n\n  // Build the verification URL\n  const verifyUrl = `${verifyRouteUrl}?token=${jwt}${callbackURL ? `&callbackURL=${encodeURIComponent(callbackURL)}` : ''}`\n\n  return verifyUrl\n}\n"],"names":["SignJWT","generateVerifyEmailUrl","userEmail","secret","expiresIn","verifyRouteUrl","callbackURL","Error","jwt","email","iat","Math","floor","Date","now","exp","setProtectedHeader","alg","sign","TextEncoder","encode","verifyUrl","encodeURIComponent"],"mappings":"AAAA,SAASA,OAAO,QAAQ,OAAM;AAE9B;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,MAAMC,yBAAyB,OAAO,EAC3CC,SAAS,EACTC,MAAM,EACNC,YAAY,IAAI,EAChBC,cAAc,EACdC,cAAc,GAAG,EAOlB;IACC,IAAI,CAACJ,WAAW;QACd,MAAM,IAAIK,MAAM;IAClB;IAEA,IAAI,CAACJ,QAAQ;QACX,MAAM,IAAII,MAAM;IAClB;IAEA,IAAI,CAACF,gBAAgB;QACnB,MAAM,IAAIE,MAAM;IAClB;IAEA,gCAAgC;IAChC,MAAMC,MAAM,MAAM,IAAIR,QAAQ;QAC5BS,OAAOP;QACPQ,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;QAC7BC,KAAKJ,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQV;IACvC,GACGY,kBAAkB,CAAC;QAAEC,KAAK;IAAQ,GAClCC,IAAI,CAAC,IAAIC,cAAcC,MAAM,CAACjB;IAEjC,6BAA6B;IAC7B,MAAMkB,YAAY,GAAGhB,eAAe,OAAO,EAAEG,MAAMF,cAAc,CAAC,aAAa,EAAEgB,mBAAmBhB,cAAc,GAAG,IAAI;IAEzH,OAAOe;AACT,EAAC"}

package/dist/better-auth/plugin/helpers/get-ip.d.ts

@@ -0,0 +1,2 @@
+import type { BetterAuthOptions } from 'better-auth';
+export declare function getIp(headers: Headers, options: BetterAuthOptions): string | null;

package/dist/better-auth/plugin/helpers/get-ip.js

@@ -0,0 +1,31 @@
+export function getIp(headers, options) {
+    if (options.advanced?.ipAddress?.disableIpTracking) {
+        return null;
+    }
+    const testIP = '127.0.0.1';
+    if ((process.env.NODE_ENV === 'test' || process.env.NODE_ENV === 'development') ?? false) {
+        return testIP;
+    }
+    const ipHeaders = options.advanced?.ipAddress?.ipAddressHeaders;
+    const keys = ipHeaders || [
+        'x-client-ip',
+        'x-forwarded-for',
+        'cf-connecting-ip',
+        'fastly-client-ip',
+        'x-real-ip',
+        'x-cluster-client-ip',
+        'x-forwarded',
+        'forwarded-for',
+        'forwarded'
+    ];
+    for (const key of keys){
+        const value = headers.get(key);
+        if (typeof value === 'string') {
+            const ip = value.split(',')[0].trim();
+            if (ip) return ip;
+        }
+    }
+    return null;
+}
+
+//# sourceMappingURL=get-ip.js.map

package/dist/better-auth/plugin/helpers/get-ip.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/plugin/helpers/get-ip.ts"],"sourcesContent":["import type { BetterAuthOptions } from 'better-auth'\n\nexport function getIp(headers: Headers, options: BetterAuthOptions): string | null {\n  if (options.advanced?.ipAddress?.disableIpTracking) {\n    return null\n  }\n  const testIP = '127.0.0.1'\n  if ((process.env.NODE_ENV === 'test' || process.env.NODE_ENV === 'development') ?? false) {\n    return testIP\n  }\n  const ipHeaders = options.advanced?.ipAddress?.ipAddressHeaders\n  const keys = ipHeaders || [\n    'x-client-ip',\n    'x-forwarded-for',\n    'cf-connecting-ip',\n    'fastly-client-ip',\n    'x-real-ip',\n    'x-cluster-client-ip',\n    'x-forwarded',\n    'forwarded-for',\n    'forwarded',\n  ]\n  for (const key of keys) {\n    const value = headers.get(key)\n    if (typeof value === 'string') {\n      const ip = value.split(',')[0].trim()\n      if (ip) return ip\n    }\n  }\n  return null\n}\n"],"names":["getIp","headers","options","advanced","ipAddress","disableIpTracking","testIP","process","env","NODE_ENV","ipHeaders","ipAddressHeaders","keys","key","value","get","ip","split","trim"],"mappings":"AAEA,OAAO,SAASA,MAAMC,OAAgB,EAAEC,OAA0B;IAChE,IAAIA,QAAQC,QAAQ,EAAEC,WAAWC,mBAAmB;QAClD,OAAO;IACT;IACA,MAAMC,SAAS;IACf,IAAI,AAACC,CAAAA,QAAQC,GAAG,CAACC,QAAQ,KAAK,UAAUF,QAAQC,GAAG,CAACC,QAAQ,KAAK,aAAY,KAAM,OAAO;QACxF,OAAOH;IACT;IACA,MAAMI,YAAYR,QAAQC,QAAQ,EAAEC,WAAWO;IAC/C,MAAMC,OAAOF,aAAa;QACxB;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD;IACD,KAAK,MAAMG,OAAOD,KAAM;QACtB,MAAME,QAAQb,QAAQc,GAAG,CAACF;QAC1B,IAAI,OAAOC,UAAU,UAAU;YAC7B,MAAME,KAAKF,MAAMG,KAAK,CAAC,IAAI,CAAC,EAAE,CAACC,IAAI;YACnC,IAAIF,IAAI,OAAOA;QACjB;IACF;IACA,OAAO;AACT"}