34 lines
1.6 KiB
TypeScript
34 lines
1.6 KiB
TypeScript
import { betterAuth } from 'better-auth'
|
|
import { pikkuBetterAuth } from '#pikku'
|
|
|
|
/**
|
|
* Better Auth configuration — email + password sign-in.
|
|
*
|
|
* `pikkuBetterAuth` has no side effects: the pikku CLI statically inspects this single
|
|
* exported `auth` const and generates the catch-all `/api/auth/**` HTTP wiring,
|
|
* the session-bridge middleware, and a `wireSecret` for `BETTER_AUTH_SECRET` (and
|
|
* one per social provider, if you add any) — so the auth routes and secret
|
|
* requirements flow through normal inspection into the deploy manifest.
|
|
*
|
|
* The factory runs once when singleton services are built, pulling the secret
|
|
* (and the database) off the injected `services`; the resolved instance is then
|
|
* available to every function as `services.auth`. Better Auth is given the app's
|
|
* own kysely: the CamelCasePlugin maps Better Auth's camelCase field names onto
|
|
* the snake_case columns created in db/sqlite/0001-init.sql, keeping the whole DB
|
|
* on one naming convention. To offer Google / GitHub / ... add a `socialProviders`
|
|
* entry (and a button on the login page) — the CLI will wire its secret too.
|
|
*/
|
|
export const auth = pikkuBetterAuth(async ({ kysely, secrets }) => {
|
|
const BETTER_AUTH_SECRET = await secrets.getSecret('BETTER_AUTH_SECRET')
|
|
|
|
return betterAuth({
|
|
secret: BETTER_AUTH_SECRET,
|
|
database: { db: kysely, type: 'sqlite' },
|
|
emailAndPassword: { enabled: true },
|
|
// Stateless session: CLI splits out betterAuthStatelessSession so non-auth
|
|
// units verify the signed cookie instead of bundling better-auth. pikku #737.
|
|
session: { cookieCache: { enabled: true } },
|
|
advanced: { database: { generateId: 'uuid' } },
|
|
})
|
|
})
|