Conversation
Exercising anything behind a session — the rail chip, `/api/me`, `AUTH_REQUIRED`, the identity a run executes as — meant registering an OIDC client on Arcade's IdP and doing the redirect dance. `DEV_AUTH=true` now hands `/api/auth/*` to `src/dev-auth.ts`, which answers in Better Auth's own shapes: signed in by default, signing out is a cookie, and signing back in clears it. So `authClient` and everything that reads a session need no dev branch, and there is no session store — nothing to migrate, no rows in the auth tables, no `BETTER_AUTH_URL` to get right. It runs as `DEV_AUTH_USER`, defaulting to `ARCADE_USER_ID` so turning it on does not quietly move which Arcade account tools execute as. It wins over `oidc`, because a machine with credentials in `.env` is exactly the one that wants to skip the dance, and it refuses when `NODE_ENV=production` — nothing here authenticates anybody, so that check is the whole security model. `/api/me` returns `mode: "oidc" | "dev" | "off"` in place of `configured: boolean`: one field for the one question the login page and every route actually ask, now that "login works" and "OIDC is configured" have come apart. Co-Authored-By: Claude <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…v auth Two reasons login could not complete on a Vercel preview. `authBaseURL()` fell through to `http://localhost:3000` for anything without `BETTER_AUTH_URL` or `PORTLESS_URL`, and that is the host Better Auth puts in the `redirect_uri` it hands the IdP. It does not fail loudly: the IdP rejects an unregistered URI, or the browser is sent to a machine that isn't there. Production sets `BETTER_AUTH_URL` and works; previews did not, so every preview asked Ory to redirect to localhost. A deployment now names itself from Vercel's env, preferring `VERCEL_BRANCH_URL` over `VERCEL_URL` because an OIDC client registers exact redirect URIs and a per-deployment host is one nobody can register. Which is also why a preview wants dev auth: no preview URL can be registered ahead of time, so real login there is a dead end. `DEV_AUTH=true` was refused anyway, because it checked `NODE_ENV` and Vercel builds previews with `NODE_ENV=production`. It now checks the production *deployment* — `VERCEL_ENV` where that exists, `NODE_ENV` otherwise. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exercising anything behind a session — the rail chip,
/api/me,AUTH_REQUIRED, the identity a run executes as — used to mean registering an OIDC client on Arcade's IdP and doing the redirect dance;DEV_AUTH=truenow hands/api/auth/*tosrc/dev-auth.ts, which answers in Better Auth's own shapes, soauthClientand everything that reads a session need no dev branch. Signed in is the default, signing out is a cookie and signing back in clears it, so there is no session store — nothing to migrate, no rows in the auth tables, noBETTER_AUTH_URLto get right. It runs asDEV_AUTH_USER(defaulting toARCADE_USER_ID, so it does not quietly move which Arcade account tools execute as), wins overoidcbecause a machine with credentials in.envis exactly the one that wants to skip the dance, and refuses whenNODE_ENV=production— nothing here authenticates anybody, so that check is the whole security model./api/mereturnsmode: "oidc" | "dev" | "off"in place ofconfigured: boolean, one field for the one question the login page and every route actually ask now that "login works" and "OIDC is configured" have come apart.Verified through the frontend host, not just tests:
/api/me→mode: devwith the user,get-session→ a session payload,sign-out→ the cookie,get-sessionwith it →null,sign-in/oauth2→{redirect:true,url:"/"}clearing it;src/dev-auth.test.tscovers those paths plus the production refusal and that an absolutecallbackURLcannot turn sign-in into an open redirect, and is the one suite needing no API key.🤖 Generated with Claude Code