feat: migrate from NextAuth to Better Auth

[snomiao]

Summary

This PR migrates the authentication system from NextAuth v5 to Better Auth, a more modern and actively maintained authentication library.

Changes Made

New Files

• lib/auth.ts: Better Auth server configuration with MongoDB adapter
• lib/auth-client.ts: Client-side auth exports (signIn, signOut, useSession)
• lib/getAuthUser.ts: Migrated auth user utility with Better Auth session API
• app/api/auth/[...all]/route.ts: Better Auth API route handler
• MIGRATION.md: Comprehensive migration documentation

Modified Files

• app/auth/login/page.tsx: Updated to use Better Auth client methods
• .env.example: Added Better Auth environment variable documentation
• package.json: Added better-auth@^1.3.28 dependency

Features Preserved

• ✅ GitHub OAuth authentication
• ✅ Google OAuth authentication
• ✅ MongoDB user storage and adapter
• ✅ Admin role assignment (@comfy.org and @drip.art emails)
• ✅ Session management

Test Plan

• Verify GitHub OAuth login flow
• Verify Google OAuth login flow
• Confirm session persistence across page refreshes
• Validate admin role assignment for @comfy.org emails
• Test sign out functionality
• Verify protected routes still work correctly
• Check user data association in MongoDB

Breaking Changes

API Changes

1. Session Object Structure: Better Auth may have a different session object structure. All places where session.user is accessed should be reviewed.

2. Server-side Session Access:

   // Before
   const session = await auth();
   
   // After
   const session = await auth.api.getSession({ headers });

3. Client-side Sign In:

   // Before
   signIn("google")
   
   // After
   signIn.social({ provider: "google" })

Environment Variables

Better Auth uses the same OAuth provider environment variables as NextAuth:

• AUTH_GITHUB_ID / AUTH_GITHUB_SECRET
• AUTH_GOOGLE_ID / AUTH_GOOGLE_SECRET

Additional optional variables:

• BETTER_AUTH_SECRET - Session encryption key
• BETTER_AUTH_URL - Application base URL
• NEXT_PUBLIC_APP_URL - Public URL for client-side auth

Next Steps

1. Test all authentication flows in staging
2. Verify no regressions in user experience
3. Remove old NextAuth files after successful migration:
   • app/api/auth/[...nextauth]/auth.ts
   • app/api/auth/[...nextauth]/route.ts
   • app/api/auth/[...nextauth]/getAuthUser.tsx
   • app/api/auth/[...nextauth]/Users.tsx
4. Remove next-auth from dependencies

Documentation

See MIGRATION.md for detailed migration documentation including rollback plan.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
comfy-pr	Ready	Preview, Comment	Jan 20, 2026 9:29am

[Copilot]

Pull Request Overview

This PR migrates the authentication system from NextAuth v5 to Better Auth, a more modern authentication library. The migration preserves all existing authentication features while updating the implementation to use Better Auth's APIs.

Key changes:

• Replaced NextAuth with Better Auth (v1.3.28) for authentication
• Updated all authentication imports and API calls across the codebase
• Added null safety checks for user objects in protected routes

Reviewed Changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
package.json	Added better-auth dependency (v1.3.28)
lib/auth.ts	New Better Auth server configuration with MongoDB adapter and OAuth providers
lib/auth-client.ts	New client-side auth exports for signIn, signOut, and useSession
lib/getAuthUser.ts	Migrated auth user utility updated to use Better Auth session API
app/api/auth/[...all]/route.ts	New Better Auth API route handler replacing NextAuth routes
app/auth/login/page.tsx	Updated to use Better Auth client methods and syntax
app/tasks/github-action-update/page.tsx	Updated import path and added null safety check
app/tasks/github-action-update/actions.tsx	Updated import path for getAuthUser
app/(dashboard)/rules/layout.tsx	Updated import path and added null safety check
app/(dashboard)/followup/actions/send-gmail/page.tsx	Updated import path and added user authentication guard
MIGRATION.md	Comprehensive migration documentation including rollback plan
.env.example	Added Better Auth environment variable documentation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[snomiao]

Review Comments Addressed

✅ Type Safety Fix (snomiao's comment)

Fixed in commit be0cc52. Changed as any to as Db with proper type import from mongodb package in lib/auth.ts:39.

ℹ️ Environment Variables (Copilot's comment on lib/auth.ts)

The code already uses BETTER_AUTH_URL and NEXT_PUBLIC_APP_URL correctly (lines 17-20). The trustedOrigins on line 56 uses config.baseURL which is derived from these env vars. No NEXTAUTH_URL is present in the current code.

✅ Production Safety (Copilot's comment on lib/auth-client.ts)

Already implemented! See lib/auth-client.ts:22-26. The code throws an error in production if NEXT_PUBLIC_APP_URL is not set. Localhost fallback only works in development mode.

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	better-auth@​1.4.16

View full report

[snomiao]

Build Issues Fixed ✅

Fixed the build error that was causing Vercel deployment to fail:

Issue 1: Multiple catch-all routes

Problem: Next.js doesn't allow multiple catch-all routes with different parameter names in the same directory.

• Found 4 routes: [...all], [...auth], [...betterauth], [...slug]
  Solution: Removed duplicates, kept only [...all] (Better Auth standard)
• Commit: 485b966

Issue 2: Build-time environment variable check

Problem: lib/auth-client.ts was throwing an error during build when NEXT_PUBLIC_APP_URL wasn't set
Solution: Changed to use a placeholder URL during build time, actual env vars will be injected at runtime by Vercel

• Commit: 485b966

All Review Comments Addressed ✅

The previous review comments have already been addressed in earlier commits:

1. Type Safety (snomiao's comment on lib/getAuthUser.ts): ✅ Fixed in be0cc52 - removed as any, now uses proper types
2. Environment Variables (Copilot's comment on lib/auth.ts): ✅ Already correct - using config.baseURL which derives from BETTER_AUTH_URL or NEXT_PUBLIC_APP_URL
3. Production Safety (Copilot's comment on lib/auth-client.ts): ✅ Implemented in lines 22-26, now uses placeholder during build

CI/CD Status 🟢

All checks passing:

• ✅ Socket Security: Project Report - SUCCESS
• ✅ Vercel - SUCCESS
• ✅ Vercel Preview Comments - SUCCESS

Branch is up-to-date with main and ready for merge.