Authentication

Included flows#

src/auth/auth.ts configures Better Auth with the Drizzle adapter and admin plugin:

• email and password registration;
• email verification;
• login and logout;
• password reset and password change;
• email change confirmation;
• active session listing and revocation;
• conditional Google OAuth;
• account deletion;
• administrator roles and bans.

Required values#

BETTER_AUTH_SECRET=replace-with-a-long-random-secret
VITE_BASE_URL=http://127.0.0.1:3000

The setup CLI creates a strong Better Auth secret for new projects.

Google OAuth#

GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...

The Google button and provider configuration are active only when both values exist. Register the exact production callback URL with Google before deployment.

Administrator bootstrap#

ADMIN_EMAILS=owner@example.com,ops@example.com

Matching addresses become administrators when their user record is created. Changing the variable later does not retroactively change existing users; use the admin domain or database for that.

Session checks#

Protected pages use getCurrentSession in route loading. Server APIs use requireSession or requireAdmin. Never rely on client-only UI visibility for authorization.

Account deletion#

The deletion flow removes user-owned R2 objects first, then lets relational cascades clean up D1 records. This ordering prevents orphaned private files.

Production checks#

1. Verify a real email through the selected mail provider.
2. Test password recovery on the production domain.
3. Confirm OAuth redirect and allowed origins.
4. Revoke an active session from another browser.
5. Delete a disposable account and confirm D1 and R2 cleanup.