Wire better-auth onto D1 via better-auth-cloudflare

apps/server/.env.example

@@ -1,4 +1,4 @@
-# Database (Neon — runtime until D1 cutover)
+# Database
 DATABASE_URL=
 
 # D1 tooling (`drizzle-kit push` / `studio` against the Worker D1 binding)

apps/server/drizzle.config.ts

@@ -1,10 +1,10 @@
 import { defineConfig } from "drizzle-kit";
 
-// D1 tooling config. Application repositories use the Worker D1 binding (#109);
-// better-auth remains on Neon until cutover (#110 / #112).
-// `generate` needs only the sqlite dialect. `push`/`studio` use the D1 HTTP driver
-// when Cloudflare credentials are set; otherwise a local sqlite file so the
-// commands still work without a Cloudflare account.
+// D1 tooling config. Auth (#110) and application repositories (#109) both use
+// the Worker D1 binding; Neon removal is #112. `generate` needs only the sqlite
+// dialect. `push`/`studio` use the D1 HTTP driver when Cloudflare credentials
+// are set; otherwise a local sqlite file so the commands still work without an
+// account.
 const accountId = process.env.CLOUDFLARE_ACCOUNT_ID;
 const databaseId = process.env.CLOUDFLARE_DATABASE_ID;
 const token = process.env.CLOUDFLARE_D1_TOKEN;

apps/server/package.json

@@ -10,9 +10,10 @@
     "wrangler:types": "wrangler types --cwd src",
     "db:studio": "dotenvx run -- drizzle-kit studio",
     "db:migrate": "dotenvx run -- drizzle-kit migrate",
-    "auth:generate": "dotenvx run -- bun x @better-auth/cli generate -y --config src/auth/index.ts --output src/db/neon/schema.ts"
+    "auth:generate": "dotenvx run -- bun x @better-auth/cli generate -y --config src/auth/cli.ts --output src/db/models/auth.ts"
   },
   "dependencies": {
+    "@better-auth/drizzle-adapter": "1.6.21",
     "@better-auth/expo": "catalog:auth",
     "@cyrus/connections": "workspace:*",
     "@cyrus/schemas": "workspace:*",
@@ -23,6 +24,7 @@
     "@soorya-u/better-auth-ws-ticket": "catalog:auth",
     "@t3-oss/env-core": "catalog:env",
     "better-auth": "catalog:auth",
+    "better-auth-cloudflare": "0.3.1",
     "better-result": "catalog:core",
     "drizzle-orm": "catalog:database",
     "evlog": "catalog:observability",

apps/server/src/auth/cli.ts

@@ -0,0 +1,18 @@
+import { betterAuth } from "better-auth";
+import { withCloudflare } from "better-auth-cloudflare";
+import { authOptions } from "./options";
+
+/**
+ * CLI schema generation (`auth:generate`) — no D1 binding outside the Worker.
+ *
+ * @public
+ */
+export const auth = betterAuth({
+	...withCloudflare(
+		{
+			autoDetectIpAddress: false,
+			geolocationTracking: false,
+		},
+		authOptions
+	),
+});

apps/server/src/auth/index.test.ts

@@ -0,0 +1,153 @@
+import { SELF } from "cloudflare:test";
+import { describe, expect, test } from "vitest";
+
+const ORIGIN = "https://example.com";
+const CLIENT_ID = "cyrusd";
+const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const SESSION_COOKIE_PATTERN =
+	/(?:__Secure-)?better-auth\.session_token=([^;]+)/;
+
+function authHeaders(
+	extra: Record<string, string> = {}
+): Record<string, string> {
+	return {
+		origin: ORIGIN,
+		referer: `${ORIGIN}/`,
+		...extra,
+	};
+}
+
+function sessionCookieFromResponse(response: Response): string {
+	const setCookies =
+		typeof response.headers.getSetCookie === "function"
+			? response.headers.getSetCookie()
+			: [response.headers.get("set-cookie")].filter((value): value is string =>
+					Boolean(value)
+				);
+
+	for (const header of setCookies) {
+		const match = header.match(SESSION_COOKIE_PATTERN);
+		if (match?.[0] && match[1]) {
+			// Preserve __Secure- prefix when present — better-auth sets it on HTTPS.
+			const nameAndValue = match[0];
+			return nameAndValue;
+		}
+	}
+
+	throw new Error(
+		`Missing session cookie. set-cookie headers: ${JSON.stringify(setCookies)}`
+	);
+}
+
+async function signUpAndSignIn(email: string, password: string) {
+	const signUp = await SELF.fetch(
+		"https://example.com/api/auth/sign-up/email",
+		{
+			method: "POST",
+			headers: authHeaders({ "content-type": "application/json" }),
+			body: JSON.stringify({ email, name: "D1 Auth User", password }),
+		}
+	);
+	expect(signUp.ok || signUp.status === 422).toBe(true);
+
+	const signIn = await SELF.fetch(
+		"https://example.com/api/auth/sign-in/email",
+		{
+			method: "POST",
+			headers: authHeaders({ "content-type": "application/json" }),
+			body: JSON.stringify({ email, password }),
+		}
+	);
+	expect(signIn.ok).toBe(true);
+
+	const body = (await signIn.json()) as { user?: { id: string } };
+	const userId = body.user?.id;
+	expect(userId).toBeTruthy();
+	if (!userId) {
+		throw new Error("sign-in response missing user id");
+	}
+
+	const sessionCookie = sessionCookieFromResponse(signIn);
+
+	const sessionCheck = await SELF.fetch(
+		"https://example.com/api/auth/get-session",
+		{ headers: authHeaders({ cookie: sessionCookie }) }
+	);
+	const sessionBody = (await sessionCheck.json()) as {
+		user?: { id: string };
+	} | null;
+	expect(sessionBody?.user?.id).toBe(userId);
+
+	return {
+		sessionCookie,
+		userId,
+	};
+}
+
+describe("device authorization against D1", () => {
+	test("completes request → approve → token against D1-backed auth data", async () => {
+		const email = `d1-auth-${crypto.randomUUID()}@cyrus.test`;
+		const password = "d1-auth-test-password-32chars-min";
+		const session = await signUpAndSignIn(email, password);
+
+		const codeResponse = await SELF.fetch(
+			"https://example.com/api/auth/device/code",
+			{
+				method: "POST",
+				headers: authHeaders({ "content-type": "application/json" }),
+				body: JSON.stringify({
+					client_id: CLIENT_ID,
+					scope: "openid profile email",
+				}),
+			}
+		);
+		expect(codeResponse.ok).toBe(true);
+
+		const codeBody = (await codeResponse.json()) as {
+			device_code: string;
+			user_code: string;
+		};
+		expect(codeBody.device_code).toBeTruthy();
+		expect(codeBody.user_code).toBeTruthy();
+
+		const formattedUserCode = codeBody.user_code.replace(/-/g, "");
+
+		const claim = await SELF.fetch(
+			`https://example.com/api/auth/device?user_code=${encodeURIComponent(formattedUserCode)}`,
+			{ headers: authHeaders({ cookie: session.sessionCookie }) }
+		);
+		expect(claim.ok).toBe(true);
+
+		const approve = await SELF.fetch(
+			"https://example.com/api/auth/device/approve",
+			{
+				method: "POST",
+				headers: authHeaders({
+					"content-type": "application/json",
+					cookie: session.sessionCookie,
+				}),
+				body: JSON.stringify({ userCode: formattedUserCode }),
+			}
+		);
+		expect(approve.ok).toBe(true);
+
+		const tokenResponse = await SELF.fetch(
+			"https://example.com/api/auth/device/token",
+			{
+				method: "POST",
+				headers: authHeaders({ "content-type": "application/json" }),
+				body: JSON.stringify({
+					grant_type: GRANT_TYPE,
+					device_code: codeBody.device_code,
+					client_id: CLIENT_ID,
+				}),
+			}
+		);
+		expect(tokenResponse.ok).toBe(true);
+
+		const tokenBody = (await tokenResponse.json()) as {
+			access_token?: string;
+		};
+		expect(tokenBody.access_token).toBeTruthy();
+	});
+});

apps/server/src/auth/index.ts

@@ -1,63 +1,33 @@
-import { expo } from "@better-auth/expo";
-import { betterAuthDesktop } from "@soorya-u/better-auth-desktop/server";
-import { wsTicketPlugin } from "@soorya-u/better-auth-ws-ticket/server";
+import { env } from "cloudflare:workers";
 import { betterAuth } from "better-auth";
-import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { bearer, deviceAuthorization, oAuthProxy } from "better-auth/plugins";
-import { log } from "evlog";
-import { env } from "../config/env";
-// Neon path (expand): keep Postgres until auth D1 cutover (#110 / #112).
-import { db } from "../db/neon";
+import { withCloudflare } from "better-auth-cloudflare";
+import { drizzle } from "drizzle-orm/d1";
 // biome-ignore lint/performance/noNamespaceImport: drizzle adapter requires schema as namespace
-import * as schema from "../db/neon/schema";
+import * as schema from "../db/models";
+import { authOptions } from "./options";
 
-const emailAndPassword =
-	env.NODE_ENV === "production"
-		? {}
-		: {
-				emailAndPassword: {
-					enabled: true,
-					autoSignIn: true,
-				},
-			};
+// drizzle-orm 1.0 dropped the client `schema` option; the adapter still needs it.
+const db = drizzle(env.DB);
 
 export const auth = betterAuth({
-	appName: "Cyrus",
-	basePath: "/api/auth",
-	database: drizzleAdapter(db, { provider: "pg", schema }),
-	...emailAndPassword,
-	trustedOrigins: [...env.ALLOWED_ORIGINS, env.PRODUCTION_URL],
-	socialProviders: {
-		github: {
-			clientId: env.OAUTH_GITHUB_CLIENT_ID,
-			clientSecret: env.OAUTH_GITHUB_CLIENT_SECRET,
-		},
-	},
-	secret: env.BETTER_AUTH_SECRET,
-	baseURL: env.WEB_APP_URL,
-	advanced: {
-		defaultCookieAttributes: {
-			sameSite: "lax",
-			httpOnly: true,
-			secure: env.NODE_ENV === "production",
+	...withCloudflare(
+		{
+			autoDetectIpAddress: true,
+			// Session table has no geolocation columns — keep schema as-is (#110).
+			geolocationTracking: false,
+			cf: {},
+			d1: {
+				// better-auth-cloudflare types against drizzle-orm ^0.45; this
+				// workspace pins 1.0 — DrizzleD1Database is structurally the same
+				// at runtime but distinct across the two package instances.
+				db: db as never,
+				options: {
+					schema,
+					// D1 has no interactive transactions.
+					transaction: false,
+				},
+			},
 		},
-	},
-	logger: {
-		log: (level, message, ...args) => log[level]({ message, ...args }),
-		level: env.LOG_LEVEL,
-	},
-	plugins: [
-		expo(),
-		betterAuthDesktop({
-			clientID: "cyrus-desktop",
-			webCallbackUrl: `${env.WEB_APP_URL}/auth/callback`,
-		}),
-		oAuthProxy({
-			productionURL: env.PRODUCTION_URL,
-			secret: env.OAUTH_PROXY_SECRET,
-		}),
-		deviceAuthorization({ verificationUri: `${env.WEB_APP_URL}/auth/device` }),
-		bearer(),
-		wsTicketPlugin(),
-	],
+		authOptions
+	),
 });

apps/server/src/auth/options.ts

@@ -0,0 +1,61 @@
+import { expo } from "@better-auth/expo";
+import { betterAuthDesktop } from "@soorya-u/better-auth-desktop/server";
+import { wsTicketPlugin } from "@soorya-u/better-auth-ws-ticket/server";
+import type { BetterAuthOptions } from "better-auth";
+import { bearer, deviceAuthorization, oAuthProxy } from "better-auth/plugins";
+import { log } from "evlog";
+import { env } from "../config/env";
+
+const emailAndPassword =
+	env.NODE_ENV === "production"
+		? {}
+		: {
+				emailAndPassword: {
+					enabled: true,
+					autoSignIn: true,
+				},
+			};
+
+export const authOptions = {
+	appName: "Cyrus",
+	basePath: "/api/auth",
+	...emailAndPassword,
+	trustedOrigins: [...env.ALLOWED_ORIGINS, env.PRODUCTION_URL],
+	socialProviders: {
+		github: {
+			clientId: env.OAUTH_GITHUB_CLIENT_ID,
+			clientSecret: env.OAUTH_GITHUB_CLIENT_SECRET,
+		},
+	},
+	secret: env.BETTER_AUTH_SECRET,
+	baseURL: env.WEB_APP_URL,
+	advanced: {
+		defaultCookieAttributes: {
+			sameSite: "lax" as const,
+			httpOnly: true,
+			secure: env.NODE_ENV === "production",
+		},
+	},
+	logger: {
+		log: (
+			level: "debug" | "info" | "warn" | "error",
+			message: string,
+			...args: unknown[]
+		) => log[level]({ message, ...args }),
+		level: env.LOG_LEVEL,
+	},
+	plugins: [
+		expo(),
+		betterAuthDesktop({
+			clientID: "cyrus-desktop",
+			webCallbackUrl: `${env.WEB_APP_URL}/auth/callback`,
+		}),
+		oAuthProxy({
+			productionURL: env.PRODUCTION_URL,
+			secret: env.OAUTH_PROXY_SECRET,
+		}),
+		deviceAuthorization({ verificationUri: `${env.WEB_APP_URL}/auth/device` }),
+		bearer(),
+		wsTicketPlugin(),
+	],
+} satisfies BetterAuthOptions;

apps/server/src/db/apply-migrations.ts

@@ -0,0 +1,8 @@
+import { applyD1Migrations, env } from "cloudflare:test";
+import type { D1Migration } from "@cloudflare/vitest-pool-workers";
+
+type TestEnv = Cloudflare.Env & { TEST_MIGRATIONS: D1Migration[] };
+
+// Setup runs outside isolated storage and may run multiple times.
+// applyD1Migrations only applies migrations that haven't already been applied.
+await applyD1Migrations(env.DB, (env as TestEnv).TEST_MIGRATIONS);