Auth plugin gaps for workspace/org configuration

Start by tracing the auth plugin routes and configuration for listOrganizations, client errors, invitation verification, and createTeam; the issue does not name source files or tests. The linked PR in the child project provides context for the workspace settings use case. Done means meeting the listed acceptance criteria, including the optional unified workspace endpoint if that scope is chosen.

While building out the org/team workspace settings page in a child project, we ran into several gaps in the auth plugin that either require extra round-trips, force fragile client-side workarounds, or create confusing UX. These are functionalities that the plugin contract doesn't expose (or exposes in a way that is hard to use) for a standard "workspace settings" UX.

Gaps

1. listOrganizations does not include the caller's membership role

The listOrganizations route returns org metadata (id, name, slug, logo, metadata, createdAt) but not the caller's role in each org. To know whether the user is an owner/admin/member of the currently active org in a switcher/settings page, we have to make a separate getActiveMember call.

Requested change: Include the caller's membership record (at minimum role, ideally memberId) in each item returned by listOrganizations.

2. Auth client errors lack machine-readable codes

Better Auth server errors are thrown with well-defined error codes (e.g. EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION), but the client error object the UI receives only reliably contains a human-readable message. This forces string matching like:

error.message.toLowerCase().includes("email verification required")

which is brittle across versions/locales.

Requested change: Expose the server error code (and ideally status) on the error object returned to the client, so callers can branch on error.code === "EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION".

3. No runtime/config toggle for requireEmailVerificationOnInvitation

The auth plugin configures Better Auth's organization plugin with requireEmailVerificationOnInvitation: true. This makes listUserInvitations (and accept/reject invitation actions) fail for SIWN and passkey users, because those auth methods create synthetic emails with emailVerified: false. There is no exposed config to relax this for wallet/passkey-only apps.

Requested change: Make requireEmailVerificationOnInvitation configurable via plugin options, or automatically bypass the requirement for sessions whose email is synthetic/verified-by-wallet.

4. No single "active workspace" endpoint

To render a workspace settings page we currently need:

• organization.list() for the org list
• auth.getActiveMember() for the user's role
• auth.getContext() / teamWorkspaceQueryOptions for teams and active team
• organization.listUserInvitations() for pending invites

Requested change: Consider a single getWorkspace endpoint that returns the user's organizations, active organization, active member role, teams, active team, and pending invitations in one call.

5. createTeam does not add the creator as a team member

When a user calls auth.createTeam, the team is created but the creator is not added as a member. The context's teams list is built from teamMember rows, so the newly created team does not appear for the creator until they explicitly call addTeamMember with their own userId. The UI currently has to work around this by calling createTeam followed immediately by addTeamMember for the current user.

Requested change: createTeam should automatically add the calling user as a member (owner/admin role) of the new team, or expose a separate createTeamAndJoin convenience route.

Acceptance criteria

• listOrganizations includes caller role per org.
• Client error objects expose stable code and status fields.
• requireEmailVerificationOnInvitation is configurable or bypassed for synthetic SIWN/passkey emails.
• createTeam automatically adds the creator as a team member (or a convenience route is provided).
• (Optional) A unified workspace context endpoint reduces the call graph for settings pages.

Context

• Child project: nearbuilders.org
• Affected route: /settings/workspace
• Related PR: https://github.com/NEARBuilders/nearbuilders.org/pull/308