MichilisandClaude Opus 5
733d2459df
Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie sessions, validated against the database on every request so revocation, bans and role changes take effect immediately. Backend: - betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and the admin plugin; auth-schema.ts maps Better Auth's models onto the existing `users` table so user IDs and their foreign keys survive intact. - routes/auth.ts is gone; Better Auth serves the standard endpoints and authExt.ts carries the flows it doesn't cover. - auth.ts shrinks to session resolution and helpers; sessions/revocation in dashboard.ts now read and delete `auth_sessions` rows directly. - Schema adds the Better Auth core + admin columns (email_verified, image, banned, ban_reason, ban_expires), with migrations and tests. - rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES. - passwordPolicy.ts centralises password validation. - Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible with Better Auth. Frontend: - auth-client.ts plus a reworked AuthContext and api/client.ts move to cookie-based sessions; no more bearer tokens in requests or middleware. photo-api: - Validate Better Auth session cookies against the shared auth_sessions table instead of verifying JWTs; JWT_SECRET is no longer needed for user auth, and PHOTO_VIEW_SECRET now signs gallery view tokens. BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the deprecated JWT_SECRET stays only as the photo-api view-token fallback. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
23 lines
879 B
TypeScript
23 lines
879 B
TypeScript
import { createAuthClient } from 'better-auth/react';
|
|
import { magicLinkClient, adminClient, inferAdditionalFields } from 'better-auth/client/plugins';
|
|
|
|
// Better Auth client. Sessions are httpOnly cookies set by the backend; with
|
|
// NEXT_PUBLIC_API_URL unset everything is same-origin through the Next.js
|
|
// rewrites (see next.config.js), so cookies flow automatically.
|
|
export const authClient = createAuthClient({
|
|
baseURL: process.env.NEXT_PUBLIC_API_URL || '',
|
|
plugins: [
|
|
magicLinkClient(),
|
|
adminClient(),
|
|
inferAdditionalFields({
|
|
user: {
|
|
phone: { type: 'string', required: false },
|
|
languagePreference: { type: 'string', required: false },
|
|
rucNumber: { type: 'string', required: false },
|
|
isClaimed: { type: 'boolean', required: false },
|
|
accountStatus: { type: 'string', required: false },
|
|
},
|
|
}),
|
|
],
|
|
});
|