OIDC compliance issue: JWT includes additionalFields causing parsing errors
## Problem
The `convex()` plugin includes all user fields (including `additionalFields`) in the JWT via `...user`, which causes the error: ## Problem
The `convex()` plugin includes all user fields (including `additionalFields`) in the JWT via `...user`, which causes the error:"Could not parse as OIDC ID token. Token might not be an OIDC-compliant JWT."
This happens because Convex expects OIDC-compliant JWT tokens, but the plugin includes custom fields like:
- `stripeCustomerId`
- `userRole`
- `banned`
- `sessionId`
- etc.
## Expected Behavior
The JWT should only contain OIDC standard claims:
- `sub` (subject/user ID) - REQUIRED
- `name`, `email`, `email_verified`, `picture` (optional)
- `iat` (issued at)
## Proposed Solution
Add an `oidcCompliant: boolean` option to the `convex()` plugin that ensures only OIDC standard claims are included in the JWT.
See: [OPTIONS_FOR_DEVS_EN.md](link-to-your-doc) for detailed implementation.
## Environment
- `@convex-dev/better-auth` version: [your version]
- Convex version: [your version]
- Node version: [your version]
## Additional Context
This is blocking authentication in production on Vercel. We've created a workaround with a custom plugin, but it would be better to have this fixed in the official package. This happens because Convex expects OIDC-compliant JWT tokens, but the plugin includes custom fields like:
- `stripeCustomerId`
- `userRole`
- `banned`
- `sessionId`
- etc.
## Expected Behavior
The JWT should only contain OIDC standard claims:
- `sub` (subject/user ID) - REQUIRED
- `name`, `email`, `email_verified`, `picture` (optional)
- `iat` (issued at)
## Proposed Solution
Add an `oidcCompliant: boolean` option to the `convex()` plugin that ensures only OIDC standard claims are included in the JWT.
See: [OPTIONS_FOR_DEVS_EN.md](link-to-your-doc) for detailed implementation.
## Environment
- `@convex-dev/better-auth` version: [your version]
- Convex version: [your version]
- Node version: [your version]
## Additional Context
This is blocking authentication in production on Vercel. We've created a workaround with a custom plugin, but it would be better to have this fixed in the official package.
