Multi-tenancy en Next.js con Better Auth Organizations

import { betterAuth } from 'better-auth';
import { organization } from 'better-auth/plugins';
import { prismaAdapter } from 'better-auth/adapters/prisma';
import { db } from '@/lib/db/client';

export const auth = betterAuth({
  database: prismaAdapter(db, { provider: 'postgresql' }),
  emailAndPassword: { enabled: true },
  plugins: [
    organization({
      allowUserToCreateOrganization: true,
      organizationLimit: 5,
    }),
  ],
});

model Organization {
  id          String   @id
  name        String
  slug        String   @unique
  logo        String?
  createdAt   DateTime @default(now())

  members     Member[]
  invitations Invitation[]
}

model Member {
  id             String   @id
  organizationId String
  userId         String
  role           String   // owner | admin | member

  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
  user         User         @relation(fields: [userId], references: [id], onDelete: Cascade)

  @@unique([organizationId, userId])
}

model Invitation {
  id             String   @id
  email          String
  organizationId String
  role           String
  status         String   // pending | accepted | rejected
  expiresAt      DateTime

  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
}

bunx prisma migrate dev --name add-organizations

const org = await auth.api.createOrganization({
  body: {
    name: 'Acme Inc',
    slug: 'acme-inc',
  },
  headers: await headers(),
});

const invitation = await auth.api.inviteToOrganization({
  body: {
    email: 'jane@example.com',
    organizationId: org.id,
    role: 'member',
  },
  headers: await headers(),
});

// Envía email con el link: /accept-invitation?token=invitation.id

await auth.api.acceptInvitation({
  body: { invitationId: token },
  headers: await headers(),
});

await auth.api.setActiveOrganization({
  body: { organizationId: org.id },
  headers: await headers(),
});

const session = await auth.api.getSession({ headers: await headers() });
const activeOrgId = session?.session.activeOrganizationId;

const projects = await db.project.findMany();

const projects = await db.project.findMany({
  where: { organizationId: activeOrgId },
});

export async function getActiveOrgId() {
  const session = await auth.api.getSession({ headers: await headers() });
  if (!session?.session.activeOrganizationId) {
    throw new Error('No active organization');
  }
  return session.session.activeOrganizationId;
}

const orgId = await getActiveOrgId();
const projects = await db.project.findMany({ where: { organizationId: orgId } });

const session = await auth.api.getSession({ headers: await headers() });
const member = await db.member.findFirst({
  where: {
    userId: session.user.id,
    organizationId: activeOrgId,
  },
});

if (member?.role !== 'owner' && member?.role !== 'admin') {
  return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
}