feat(auth): implement script-only auth and db modules for admin user creation

- Added `auth-for-script.ts` and `db.ts` to provide minimal, script-compatible instances of authentication and database access, avoiding server-only imports.
- Updated `create-admin.ts` to utilize the new script-only modules for creating the initial admin user, enhancing compatibility with tsx execution.
- Added `server-only` dependency to `package.json` and updated `pnpm-lock.yaml` accordingly.

Author: kzndotsh

package.json

@@ -114,6 +114,7 @@
     "react-scan": "^0.4.3",
     "recharts": "2.15.4",
     "schema-dts": "^1.1.5",
+    "server-only": "^0.0.1",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.4.0",
     "tw-animate-css": "^1.4.0",

pnpm-lock.yaml

@@ -2,22 +2,26 @@ import "dotenv/config";
 
 import { eq } from "drizzle-orm";
 
-import { auth } from "@/auth";
-import { db } from "@/db";
 import { user } from "@/db/schema/auth";
 
+import { auth } from "./lib/auth-for-script";
+import { db } from "./lib/db";
+
 // ============================================================================
 // Create Admin User Script
 // ============================================================================
 // This script creates the initial admin user for the Portal application.
-// It uses Better Auth's signUpEmail API to create the user, then directly
-// updates the database to set the role to "admin" (since we don't have
-// an admin yet to use the admin API's setRole method).
+// It uses script-only db and auth (scripts/lib/) so it can run under tsx
+// without pulling in "server-only" modules. It calls Better Auth's signUpEmail
+// then updates the user role to "admin" in the database.
 //
 // Usage:
 //   pnpm create-admin
 //
 // Environment Variables:
+//   DATABASE_URL - Required. PostgreSQL connection string.
+//   BETTER_AUTH_SECRET - Required. Same secret as the app.
+//   BETTER_AUTH_URL - Optional (default: http://localhost:3000).
 //   ADMIN_EMAIL - Email for the admin user (default: "admin@portal.com")
 //   ADMIN_PASSWORD - Password for the admin user (default: "admin123")
 //   ADMIN_NAME - Name for the admin user (default: "Admin User")

scripts/create-admin.ts

@@ -0,0 +1,31 @@
+/**
+ * Minimal Better Auth instance for scripts (create-admin, etc.).
+ * Does not import "server-only" or the full auth config, so it can run under tsx.
+ * Only includes what signUpEmail needs: database adapter, basePath, baseURL, secret.
+ */
+import "dotenv/config";
+
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+
+import { db } from "./db";
+import { schema } from "@/db/schema";
+
+const baseURL = process.env.BETTER_AUTH_URL ?? "http://localhost:3000";
+const secret = process.env.BETTER_AUTH_SECRET;
+
+if (!secret) {
+  throw new Error(
+    "BETTER_AUTH_SECRET is required. Set it in .env or pass it when running the script."
+  );
+}
+
+export const auth = betterAuth({
+  database: drizzleAdapter(db, { provider: "pg", schema }),
+  basePath: "/api/auth",
+  baseURL,
+  secret,
+  emailAndPassword: {
+    enabled: true,
+  },
+});

scripts/lib/auth-for-script.ts

@@ -0,0 +1,26 @@
+/**
+ * Script-only database client.
+ * Does not import "server-only", so it can be used by tsx scripts (create-admin, etc.)
+ * without pulling in Next.js server-only modules.
+ */
+import "dotenv/config";
+
+import { drizzle } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
+
+import { keys } from "@/db/keys";
+import { relations } from "@/db/relations";
+import { schema } from "@/db/schema";
+
+const env = keys();
+const connectionString = env.DATABASE_URL;
+
+if (!connectionString) {
+  throw new Error(
+    "DATABASE_URL is required. Set it in .env or pass it when running the script."
+  );
+}
+
+const pool = new Pool({ connectionString });
+
+export const db = drizzle({ client: pool, schema, relations });