Wire better-auth onto D1 via better-auth-cloudflare - #123
Conversation
Cut auth persistence off Neon so the device-authorization flow runs against the Worker D1 binding, with plugins unchanged and the wrapper pinned to an exact version. Co-authored-by: Cursor <cursoragent@cursor.com>
Treat the Workers migration setup as an entry, ignore the vitest relative setup path knip can't resolve from the repo root, and mark the better-auth CLI export as public API. Co-authored-by: Cursor <cursoragent@cursor.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 56 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughBetter Auth is migrated from Neon/Postgres to Cloudflare D1. Database environment validation, Drizzle configuration, generated auth models, migration application, shared auth options, CLI wiring, worker test setup, and device authorization coverage are updated. ChangesD1-backed Better Auth
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
soorya-u
changed the title
…ocal. Pin better-auth-cloudflare / drizzle-adapter on @cyrus/server only, type authOptions with BetterAuthOptions, and drop the noisy .env.example notes. Co-authored-by: Cursor <cursoragent@cursor.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
apps/server/tsconfig.json (1)
6-7: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueVerify
buntypes are actually needed before keeping them with Workers test types.
apps/servertargets Cloudflare Workers, and the added@cloudflare/vitest-pool-workers/typesprovide the test globals."bun"is only necessary if code explicitly relies on Bun APIs orbun:test; otherwise it can introduce unnecessary runtime typings and potential global overlap.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/server/tsconfig.json` around lines 6 - 7, Review the apps/server TypeScript configuration and remove "bun" from the types array unless the server code explicitly uses Bun APIs or bun:test; retain `@cloudflare/vitest-pool-workers/types` for Workers test globals.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/server/src/auth/index.ts`:
- Around line 84-96: Replace the db: db as never workaround in the
withCloudflare configuration with a compatible adapter integration: upgrade/use
the newer `@better-auth/drizzle-adapter` 1.7+ path or switch to the
provider-backed D1 adapter so the workspace’s drizzle-orm version is supported.
Remove the never cast while preserving the existing schema and transaction
options.
In `@knip.json`:
- Line 6: Move the ignore configuration from the root knip settings into the
apps/server configuration, and change it to match the actual unresolved import
specifier used by the server migration code rather than a file path. Do not use
ignoreUnresolved for suppressing the file itself; use the appropriate file-level
ignore setting if that is the intended behavior.
---
Nitpick comments:
In `@apps/server/tsconfig.json`:
- Around line 6-7: Review the apps/server TypeScript configuration and remove
"bun" from the types array unless the server code explicitly uses Bun APIs or
bun:test; retain `@cloudflare/vitest-pool-workers/types` for Workers test globals.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e6e6fb5d-db7c-4fa4-bacc-9bb35e0ee261
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (13)
apps/server/.env.exampleapps/server/drizzle.config.tsapps/server/package.jsonapps/server/src/auth/index.test.tsapps/server/src/auth/index.tsapps/server/src/db/apply-migrations.tsapps/server/src/db/neon/index.tsapps/server/src/db/neon/schema.tsapps/server/src/index.tsapps/server/src/middleware/logging.tsapps/server/tsconfig.jsonknip.jsonvitest.config.ts
💤 Files with no reviewable changes (2)
- apps/server/src/db/neon/index.ts
- apps/server/src/db/neon/schema.ts
One Worker D1 binding means a WeakMap keyed by database was overkill. Co-authored-by: Cursor <cursoragent@cursor.com>
Drop getAuth; bind better-auth to env.DB at module scope and move the CLI generate config to auth/cli.ts so Node can still load it. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/server/src/auth/options.ts`:
- Around line 39-46: The logger callback’s object construction incorrectly
spreads the variadic args array into numeric-keyed properties. Update the
logger.log implementation to preserve the message while handling extra args as
meaningful structured metadata, using the existing log[level] call and the
callback’s `(level, message, ...args)` contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e54b64da-ea6c-4bfd-8ad8-0b51b16b0aea
📒 Files selected for processing (5)
apps/server/package.jsonapps/server/src/auth/cli.tsapps/server/src/auth/index.tsapps/server/src/auth/options.tsknip.json
🚧 Files skipped from review as they are similar to previous changes (2)
- knip.json
- apps/server/package.json
Read nested Drizzle migration files via Vite glob in the Workers setup file instead of binding them from vitest.config, and tidy the auth schema wiring. Co-authored-by: Cursor <cursoragent@cursor.com>
Split Cloudflare kit vars into db/env with a discriminated final schema and wire drizzle-kit plus app env through it. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Pass better-auth logger extras as an args array instead of spreading, drop unused Bun types from the server tsconfig, and scope the Vitest setup-file Knip ignore to the root workspace. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/server/src/config/env.ts (1)
3-30: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winMake
DATABASE_URLoptional on startup, and only require it for Neon-backed health checks.
apps/server/src/index.tsimports./middleware/index, which pulls incorsMiddleware,partyserverMiddleware, and auth modules that all import the composed config; thereforeDATABASE_URLis still validated during Worker startup when D1-only environments do not provide it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/server/src/config/env.ts` around lines 3 - 30, Update the composed env schema in createEnv and the imported dbEnv configuration so DATABASE_URL is optional during startup, then add validation at the Neon-backed health-check boundary to require it before use. Preserve D1-only startup without DATABASE_URL and ensure Neon health checks still fail clearly when the value is missing.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@apps/server/src/config/env.ts`:
- Around line 3-30: Update the composed env schema in createEnv and the imported
dbEnv configuration so DATABASE_URL is optional during startup, then add
validation at the Neon-backed health-check boundary to require it before use.
Preserve D1-only startup without DATABASE_URL and ensure Neon health checks
still fail clearly when the value is missing.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6d5195a1-0915-44f3-97f7-18a9bda66574
📒 Files selected for processing (10)
apps/server/drizzle.config.tsapps/server/src/auth/cli.tsapps/server/src/auth/index.test.tsapps/server/src/auth/index.tsapps/server/src/config/env.tsapps/server/src/db/env.tsapps/server/src/db/migrations/apply.tsapps/server/src/db/models/index.tsknip.jsonvitest.config.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- apps/server/src/auth/cli.ts
- apps/server/src/auth/index.ts
- apps/server/src/auth/index.test.ts
1 participant
Summary
DBD1 binding viabetter-auth-cloudflare'swithCloudflare()helper (plugins unchanged)better-auth-cloudflareto exact0.3.1and drop the Neon-only auth schema now that auth tables live on SQLite/D1Closes #110.
Test plan
bun --filter @cyrus/server check:typesbunx vitest run --project='@cyrus/server'(device-auth + existing Hub/signaling tests)bun run test:unitbun check:knipwrangler devwith local D1 (env.DB) and device login worksDATABASE_URLis still only needed for health until Cut the sync server's application data over to D1 #109 / Remove the Neon/Postgres path and document production cutover #112Made with Cursor
Summary by CodeRabbit
New Features
Refactor
Tests