Organization: check an arbitrary member’s current permissions server-side

Is this suited for github?

• Yes, this is suited for github

Is your feature request related to a problem? Please describe.

User-generated API keys within an app should be able to remain scoped to the permissions of their creator as defined by the organization plugin's role/permission config.

Each API key request requires the application to evaluate the permissions of the user who created the key, without an active session for that user.

Currently, auth.api.hasPermission requires the member’s session headers. The exported lower-level hasPermission has a couple issues:

1. it isn't a reliable way to check multiple permissions at once: #3011
2. constructing a GenericEndpointContext seems like a sketchy option in app code (appears to be a better-auth internal construct)

Describe the solution you'd like

Proposed API is:

await auth.api.hasMemberPermission({
  body: {
    userId,
    organizationId,
    permissions: {
      document: ['read']
    }
  }
});

The server-only API should:

• load the current organization membership;
• evaluate static and dynamic roles using Better Auth’s authoritative evaluator;
• fail closed for missing membership or malformed/unknown roles;
• require no user session;
• not be exposed as an unauthenticated HTTP endpoint.

This would support API keys, background jobs, delegated credentials, invitation rechecks, and access-report generation without applications implementing a second role evaluator.

Describe alternatives you've considered

• Using auth.api.hasPermission calls with session headers. Seems like the wrong choice for requests that don't originate from the user making a request from an active session
• calling hasPermission directly - requires the internal GenericEndpointContext that I can't make at the app layer
• checkRolePermission doesn't provide a server-backed way to handle dynamic roles or current membership checks
• Copying the user's permissions into an API key - permissions can become stale if the user's permissions change before the API key expires.
• Create a better-auth session for the creator - adds a lot of complexity & overhead for doing a permissions check.
• Manually query the membership and dynamic role tables - couples app code to the better-auth schema and role encoding, plus duplicates functionality that is basically already implemented in better-auth

Additional context

No response