44 lines
1.3 KiB
TypeScript
44 lines
1.3 KiB
TypeScript
import { betterAuth } from 'better-auth'
|
|
import { drizzleAdapter } from 'better-auth/adapters/drizzle'
|
|
import { admin } from 'better-auth/plugins/admin'
|
|
import { tanstackStartCookies } from 'better-auth/tanstack-start'
|
|
|
|
import { db } from '#/db'
|
|
import * as schema from '#/db/schema'
|
|
|
|
function createAuth() {
|
|
const secret = process.env.BETTER_AUTH_SECRET
|
|
|
|
if (!secret) {
|
|
throw new Error('BETTER_AUTH_SECRET environment variable is not set')
|
|
}
|
|
|
|
return betterAuth({
|
|
secret,
|
|
database: drizzleAdapter(db, {
|
|
provider: 'pg',
|
|
schema,
|
|
}),
|
|
emailAndPassword: {
|
|
enabled: true,
|
|
// Staff accounts are provisioned via the seed script, not public self sign-up.
|
|
disableSignUp: true,
|
|
},
|
|
session: {
|
|
expiresIn: 60 * 60 * 12,
|
|
},
|
|
// `tanstackStartCookies` must stay last so it sees every other plugin's Set-Cookie headers.
|
|
plugins: [admin(), tanstackStartCookies()],
|
|
})
|
|
}
|
|
|
|
let authInstance: ReturnType<typeof createAuth> | undefined
|
|
|
|
// Lazily constructed so nothing here runs at module load time — a top-level
|
|
// `betterAuth(...)` call would get pulled into the client bundle (and with it
|
|
// the Postgres driver) by any route file that imports a sibling export.
|
|
export function getAuth() {
|
|
authInstance ??= createAuth()
|
|
return authInstance
|
|
}
|