🎉 initial commit

src/lib/auth-instance.ts

@@ -0,0 +1,43 @@
+import { betterAuth } from 'better-auth'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { admin } from 'better-auth/plugins/admin'
+import { tanstackStartCookies } from 'better-auth/tanstack-start'
+
+import { db } from '#/db'
+import * as schema from '#/db/schema'
+
+function createAuth() {
+  const secret = process.env.BETTER_AUTH_SECRET
+
+  if (!secret) {
+    throw new Error('BETTER_AUTH_SECRET environment variable is not set')
+  }
+
+  return betterAuth({
+    secret,
+    database: drizzleAdapter(db, {
+      provider: 'pg',
+      schema,
+    }),
+    emailAndPassword: {
+      enabled: true,
+      // Staff accounts are provisioned via the seed script, not public self sign-up.
+      disableSignUp: true,
+    },
+    session: {
+      expiresIn: 60 * 60 * 12,
+    },
+    // `tanstackStartCookies` must stay last so it sees every other plugin's Set-Cookie headers.
+    plugins: [admin(), tanstackStartCookies()],
+  })
+}
+
+let authInstance: ReturnType<typeof createAuth> | undefined
+
+// Lazily constructed so nothing here runs at module load time — a top-level
+// `betterAuth(...)` call would get pulled into the client bundle (and with it
+// the Postgres driver) by any route file that imports a sibling export.
+export function getAuth() {
+  authInstance ??= createAuth()
+  return authInstance
+}