Function makeAuthOptions

apps/host-selfhost/src/auth/better-auth.ts:74–307

(client: Client, getOrganizationId: () => string, gate?: SignupGate)

// ---------------------------------------------------------------------------

const makeAuthOptions = (client: Client, getOrganizationId: () => string, gate?: SignupGate) => {
  const config = loadConfig();
  // A `Secure` session cookie is never sent back over plain HTTP, so an HTTP
  // alias can sign in and then look signed out on every later request. Drop the
  // attribute when ANY trusted origin is HTTP. This is not a new relaxation for
  // the common cases: Better Auth already infers `useSecureCookies` from the
  // baseURL scheme, so an all-HTTPS instance still gets `true` and the plain
  // `http://localhost` default still gets `false`. It only changes the mixed
  // case an operator opts into with EXECUTOR_TRUSTED_ORIGINS.
  const hasInsecureTrustedOrigin = config.trustedOrigins.some((origin) =>
    origin.startsWith("http://"),
  );
  // Warn only for that mixed case. An HTTP-only instance (local dev, a LAN
  // deploy) never had Secure cookies to lose, and warning there would fire on
  // every default boot.
  const downgradesCanonicalCookies =
    hasInsecureTrustedOrigin && config.webBaseUrl.startsWith("https://");
  if (downgradesCanonicalCookies && !warnedInsecureTrustedOrigin) {
    warnedInsecureTrustedOrigin = true;
    console.warn(
      "[executor] EXECUTOR_TRUSTED_ORIGINS contains an http:// origin, so session cookies drop the Secure attribute for every origin — including the https:// canonical URL. Use https:// aliases to keep session cookies transport-secure.",
    );
  }
  // Always resolved (generated + persisted when no env is set); this guards only
  // an explicitly-set env secret that is too weak.
  const secret = config.authSecret;
  if (secret.length < 32) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: a multi-user auth server must not boot with a weak session secret
    throw new Error("BETTER_AUTH_SECRET (or AUTH_SECRET), if set, must be at least 32 characters");
  }
  return {
    // Hand Better Auth the SAME libSQL client SelfHostDb already opened — NOT a
    // fresh `{ url }` connection. `{ client }` makes LibsqlDialect adopt the
    // existing handle (closeClient=false, so SelfHostDb keeps ownership). One
    // connection means one WAL: see the header comment for why a second
    // connection is the self-host data-loss bug.
    //
    // The cast bridges a dependency skew: @libsql/kysely-libsql pins an older
    // @libsql/core (0.8) than @libsql/client (0.17), so the two `Client` types
    // differ — only in `.sync()` (embedded-replica replication, unused here).
    // The dialect calls execute/batch/transaction/close, which are identical
    // across both versions, so sharing the 0.17 client is sound at runtime.
    database: {
      // oxlint-disable-next-line executor/no-double-cast -- boundary: the two @libsql/core versions' Client types are structurally identical for the calls the dialect makes (see above); no schema/decode applies to a native client handle.
      dialect: new LibsqlDialect({ client } as unknown as LibsqlDialectConfig),
      type: "sqlite" as const,
    },
    secret,
    // The canonical browser Origin is config.webBaseUrl; explicitly configured
    // aliases may also send cookie-authenticated requests. CLI/MCP bearer
    // requests carry no Origin and are unaffected. We deliberately do NOT derive
    // either value from the request `Host`: matching the ecosystem (Windmill
    // `BASE_URL`, n8n `WEBHOOK_URL`), a pinned origin keeps host-header injection
    // out of OAuth redirects and links. Additional trusted origins affect only
    // Better Auth's request validation; generated links and OAuth callbacks stay
    // pinned to config.webBaseUrl.
    baseURL: config.webBaseUrl,
    trustedOrigins: [...config.trustedOrigins],