src/server/auth.ts

import 'server-only';
import { betterAuth } from 'better-auth';
import { prismaAdapter } from 'better-auth/adapters/prisma';
import { getDb } from './db';
import type { PrismaClient } from '@/generated/prisma/client';

let instance: ReturnType<typeof createAuth> | undefined;
export function createAuth(
  db: PrismaClient,
  config: { secret: string; baseURL: string },
) {
  const { secret, baseURL } = config;
  return betterAuth({
    appName: 'TeamDesk',
    secret,
    baseURL,
    database: prismaAdapter(db, { provider: 'postgresql' }),
    emailAndPassword: { enabled: true, minPasswordLength: 10 },
    // 不缓存会话到客户端 Cookie：每次业务请求都验证服务端会话，退出后旧会话立即失效。
    session: { cookieCache: { enabled: false } },
    // 密码散列、HttpOnly 会话 Cookie、CSRF/Origin 检查由 Better Auth 处理。
    // 当前不启用邮件验证/找回密码；上线前需配置邮件服务并开启验证。
  });
}
export function getAuth() {
  if (instance) return instance;
  const secret = process.env.BETTER_AUTH_SECRET;
  const baseURL = process.env.BETTER_AUTH_URL;
  if (!secret || secret.length < 32 || !baseURL)
    throw new Error(
      '请配置 BETTER_AUTH_URL 和至少 32 字符的 BETTER_AUTH_SECRET',
    );
  return (instance = createAuth(getDb(), { secret, baseURL }));
}