mirror of
https://github.com/kennethnym/aris.git
synced 2026-03-25 03:11:17 +00:00
Kenneth
35c6371d48
* fix(backend): add CORS middleware and disable CSRF in dev - Add CORS middleware for /api/auth/* and global routes - Disable better-auth CSRF origin check when NODE_ENV != production Co-authored-by: Ona <no-reply@ona.com> * fix: gate permissive CORS to dev only In production, only origins listed in CORS_ORIGINS env var are allowed. In dev, any origin is reflected back. Co-authored-by: Ona <no-reply@ona.com> --------- Co-authored-by: Ona <no-reply@ona.com>
30 lines
669 B
TypeScript
30 lines
669 B
TypeScript
import { betterAuth } from "better-auth"
|
|
import { drizzleAdapter } from "better-auth/adapters/drizzle"
|
|
import { admin } from "better-auth/plugins"
|
|
|
|
import type { Database } from "../db/index.ts"
|
|
|
|
import * as schema from "../db/schema.ts"
|
|
|
|
export function createAuth(db: Database) {
|
|
if (!process.env.BETTER_AUTH_SECRET) {
|
|
throw new Error("BETTER_AUTH_SECRET is not set")
|
|
}
|
|
|
|
return betterAuth({
|
|
database: drizzleAdapter(db, {
|
|
provider: "pg",
|
|
schema,
|
|
}),
|
|
advanced: {
|
|
disableCSRFCheck: process.env.NODE_ENV !== "production",
|
|
},
|
|
emailAndPassword: {
|
|
enabled: true,
|
|
},
|
|
plugins: [admin()],
|
|
})
|
|
}
|
|
|
|
export type Auth = ReturnType<typeof createAuth>
|