@baseplate-dev/plugin-auth 1.0.7 → 1.0.8

package/dist/better-auth/generators/fastify/better-auth-module/generated/index.d.ts

@@ -2,14 +2,18 @@ export declare const BETTER_AUTH_BETTER_AUTH_MODULE_GENERATED: {
     imports: {
         task: import("@baseplate-dev/sync").GeneratorTask<{
             betterAuthModuleImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                auth: {};
+                Auth: {
+                    isTypeOnly: true;
+                };
+                AuthServiceDeps: {
+                    isTypeOnly: true;
+                };
                 betterAuthPlugin: {};
+                buildAuth: {};
                 cookiePrefix: {};
+                createBetterAuthUserSessionService: {};
                 toWebHeaders: {};
             }>>;
-            userSessionServiceImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                userSessionService: {};
-            }>>;
         }, {
             paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").BetterAuthBetterAuthModulePaths>;
         }, undefined>;
@@ -27,6 +31,21 @@ export declare const BETTER_AUTH_BETTER_AUTH_MODULE_GENERATED: {
         task: import("@baseplate-dev/sync").GeneratorTask<{
             betterAuthBetterAuthModuleRenderers: import("@baseplate-dev/sync").ProviderExport<import("./template-renderers.js").BetterAuthBetterAuthModuleRenderers>;
         }, {
+            appRuntimeImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                AppRuntime: {
+                    isTypeOnly: true;
+                };
+                AppServices: {
+                    isTypeOnly: true;
+                };
+                createAppRuntime: {};
+                InternalServices: {
+                    isTypeOnly: true;
+                };
+                RuntimeServices: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 AuthContext: {
                     isTypeOnly: true;
@@ -54,7 +73,35 @@ export declare const BETTER_AUTH_BETTER_AUTH_MODULE_GENERATED: {
                 };
             }>>;
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                config: {};
+                getConfig: {};
+                isDevelopment: {};
+            }>>;
+            emailModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createEmailService: {};
+                createEmailTransport: {};
+                EmailAdapter: {
+                    isTypeOnly: true;
+                };
+                EmailAttachment: {
+                    isTypeOnly: true;
+                };
+                EmailRawOptions: {
+                    isTypeOnly: true;
+                };
+                EmailSendOptions: {
+                    isTypeOnly: true;
+                };
+                EmailService: {
+                    isTypeOnly: true;
+                };
+                EmailTransport: {
+                    isTypeOnly: true;
+                };
+                sendEmailQueue: {};
+                sendEmailWorker: {};
+                TransformedEmailMessage: {
+                    isTypeOnly: true;
+                };
             }>>;
             paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").BetterAuthBetterAuthModulePaths>;
             pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
@@ -76,6 +123,8 @@ export declare const BETTER_AUTH_BETTER_AUTH_MODULE_GENERATED: {
     };
     templates: {
         auth: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_ACCOUNT_VERIFICATION_EMAIL: {};
+            TPL_PASSWORD_RESET_EMAIL: {};
             TPL_USER_ROLE_MODEL: {};
         }, {
             authRolesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
@@ -90,14 +139,57 @@ export declare const BETTER_AUTH_BETTER_AUTH_MODULE_GENERATED: {
                 };
             }>>;
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                config: {};
+                getConfig: {};
+                isDevelopment: {};
+            }>>;
+            emailModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createEmailService: {};
+                createEmailTransport: {};
+                EmailAdapter: {
+                    isTypeOnly: true;
+                };
+                EmailAttachment: {
+                    isTypeOnly: true;
+                };
+                EmailRawOptions: {
+                    isTypeOnly: true;
+                };
+                EmailSendOptions: {
+                    isTypeOnly: true;
+                };
+                EmailService: {
+                    isTypeOnly: true;
+                };
+                EmailTransport: {
+                    isTypeOnly: true;
+                };
+                sendEmailQueue: {};
+                sendEmailWorker: {};
+                TransformedEmailMessage: {
+                    isTypeOnly: true;
+                };
             }>>;
             prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 prisma: {};
             }>>;
         }, Record<never, Record<never, never>>>;
-        betterAuthPlugin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, {
-            auth: {};
+        betterAuthPlugin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+            appRuntimeImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                AppRuntime: {
+                    isTypeOnly: true;
+                };
+                AppServices: {
+                    isTypeOnly: true;
+                };
+                createAppRuntime: {};
+                InternalServices: {
+                    isTypeOnly: true;
+                };
+                RuntimeServices: {
+                    isTypeOnly: true;
+                };
+            }>>;
+        }, {
             headersUtils: {};
         }>;
         headersUtils: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;

package/dist/better-auth/generators/fastify/better-auth-module/generated/template-renderers.d.ts

@@ -23,6 +23,21 @@ export declare const BETTER_AUTH_BETTER_AUTH_MODULE_RENDERERS: {
     task: import("@baseplate-dev/sync").GeneratorTask<{
         betterAuthBetterAuthModuleRenderers: import("@baseplate-dev/sync").ProviderExport<BetterAuthBetterAuthModuleRenderers>;
     }, {
+        appRuntimeImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            AppRuntime: {
+                isTypeOnly: true;
+            };
+            AppServices: {
+                isTypeOnly: true;
+            };
+            createAppRuntime: {};
+            InternalServices: {
+                isTypeOnly: true;
+            };
+            RuntimeServices: {
+                isTypeOnly: true;
+            };
+        }>>;
         authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             AuthContext: {
                 isTypeOnly: true;
@@ -50,7 +65,35 @@ export declare const BETTER_AUTH_BETTER_AUTH_MODULE_RENDERERS: {
             };
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
+        }>>;
+        emailModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createEmailService: {};
+            createEmailTransport: {};
+            EmailAdapter: {
+                isTypeOnly: true;
+            };
+            EmailAttachment: {
+                isTypeOnly: true;
+            };
+            EmailRawOptions: {
+                isTypeOnly: true;
+            };
+            EmailSendOptions: {
+                isTypeOnly: true;
+            };
+            EmailService: {
+                isTypeOnly: true;
+            };
+            EmailTransport: {
+                isTypeOnly: true;
+            };
+            sendEmailQueue: {};
+            sendEmailWorker: {};
+            TransformedEmailMessage: {
+                isTypeOnly: true;
+            };
         }>>;
         paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").BetterAuthBetterAuthModulePaths>;
         pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{

package/dist/better-auth/generators/fastify/better-auth-module/generated/template-renderers.js

@@ -1,14 +1,17 @@
 import { typescriptFileProvider } from '@baseplate-dev/core-generators';
-import { authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, pothosImportsProvider, prismaImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appRuntimeImportsProvider, authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, pothosImportsProvider, prismaImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { emailModuleImportsProvider } from '@baseplate-dev/plugin-email';
 import { createGeneratorTask, createProviderType } from '@baseplate-dev/sync';
 import { BETTER_AUTH_BETTER_AUTH_MODULE_PATHS } from './template-paths.js';
 import { BETTER_AUTH_BETTER_AUTH_MODULE_TEMPLATES } from './typed-templates.js';
 const betterAuthBetterAuthModuleRenderers = createProviderType('better-auth-better-auth-module-renderers');
 const betterAuthBetterAuthModuleRenderersTask = createGeneratorTask({
     dependencies: {
+        appRuntimeImports: appRuntimeImportsProvider,
         authContextImports: authContextImportsProvider,
         authRolesImports: authRolesImportsProvider,
         configServiceImports: configServiceImportsProvider,
+        emailModuleImports: emailModuleImportsProvider,
         paths: BETTER_AUTH_BETTER_AUTH_MODULE_PATHS.provider,
         pothosImports: pothosImportsProvider,
         prismaImports: prismaImportsProvider,
@@ -18,7 +21,7 @@ const betterAuthBetterAuthModuleRenderersTask = createGeneratorTask({
     exports: {
         betterAuthBetterAuthModuleRenderers: betterAuthBetterAuthModuleRenderers.export(),
     },
-    run({ authContextImports, authRolesImports, configServiceImports, paths, pothosImports, prismaImports, typescriptFile, userSessionTypesImports, }) {
+    run({ appRuntimeImports, authContextImports, authRolesImports, configServiceImports, emailModuleImports, paths, pothosImports, prismaImports, typescriptFile, userSessionTypesImports, }) {
         return {
             providers: {
                 betterAuthBetterAuthModuleRenderers: {
@@ -29,6 +32,7 @@ const betterAuthBetterAuthModuleRenderersTask = createGeneratorTask({
                             importMapProviders: {
                                 authRolesImports,
                                 configServiceImports,
+                                emailModuleImports,
                                 prismaImports,
                             },
                             ...options,
@@ -38,6 +42,9 @@ const betterAuthBetterAuthModuleRenderersTask = createGeneratorTask({
                         render: (options) => typescriptFile.renderTemplateFile({
                             template: BETTER_AUTH_BETTER_AUTH_MODULE_TEMPLATES.betterAuthPlugin,
                             destination: paths.betterAuthPlugin,
+                            importMapProviders: {
+                                appRuntimeImports,
+                            },
                             generatorPaths: paths,
                             ...options,
                         }),

package/dist/better-auth/generators/fastify/better-auth-module/generated/ts-import-providers.d.ts

@@ -1,28 +1,46 @@
 import type { TsImportMapProviderFromSchema } from '@baseplate-dev/core-generators';
 export declare const betterAuthModuleImportsSchema: {
-    auth: {};
+    Auth: {
+        isTypeOnly: true;
+    };
+    AuthServiceDeps: {
+        isTypeOnly: true;
+    };
     betterAuthPlugin: {};
+    buildAuth: {};
     cookiePrefix: {};
+    createBetterAuthUserSessionService: {};
     toWebHeaders: {};
 };
 export type BetterAuthModuleImportsProvider = TsImportMapProviderFromSchema<typeof betterAuthModuleImportsSchema>;
 export declare const betterAuthModuleImportsProvider: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-    auth: {};
+    Auth: {
+        isTypeOnly: true;
+    };
+    AuthServiceDeps: {
+        isTypeOnly: true;
+    };
     betterAuthPlugin: {};
+    buildAuth: {};
     cookiePrefix: {};
+    createBetterAuthUserSessionService: {};
     toWebHeaders: {};
 }>>;
 export declare const BETTER_AUTH_BETTER_AUTH_MODULE_IMPORTS: {
     task: import("@baseplate-dev/sync").GeneratorTask<{
         betterAuthModuleImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            auth: {};
+            Auth: {
+                isTypeOnly: true;
+            };
+            AuthServiceDeps: {
+                isTypeOnly: true;
+            };
             betterAuthPlugin: {};
+            buildAuth: {};
             cookiePrefix: {};
+            createBetterAuthUserSessionService: {};
             toWebHeaders: {};
         }>>;
-        userSessionServiceImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            userSessionService: {};
-        }>>;
     }, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").BetterAuthBetterAuthModulePaths>;
     }, undefined>;

package/dist/better-auth/generators/fastify/better-auth-module/generated/ts-import-providers.js

@@ -1,11 +1,13 @@
 import { createTsImportMap, createTsImportMapSchema, packageScope, } from '@baseplate-dev/core-generators';
-import { userSessionServiceImportsProvider, userSessionServiceImportsSchema, } from '@baseplate-dev/fastify-generators';
 import { createGeneratorTask, createReadOnlyProviderType, } from '@baseplate-dev/sync';
 import { BETTER_AUTH_BETTER_AUTH_MODULE_PATHS } from './template-paths.js';
 export const betterAuthModuleImportsSchema = createTsImportMapSchema({
-    auth: {},
+    Auth: { isTypeOnly: true },
+    AuthServiceDeps: { isTypeOnly: true },
     betterAuthPlugin: {},
+    buildAuth: {},
     cookiePrefix: {},
+    createBetterAuthUserSessionService: {},
     toWebHeaders: {},
 });
 export const betterAuthModuleImportsProvider = createReadOnlyProviderType('better-auth-module-imports');
@@ -15,18 +17,19 @@ const betterAuthBetterAuthModuleImportsTask = createGeneratorTask({
     },
     exports: {
         betterAuthModuleImports: betterAuthModuleImportsProvider.export(packageScope),
-        userSessionServiceImports: userSessionServiceImportsProvider.export(packageScope),
     },
     run({ paths }) {
         return {
             providers: {
                 betterAuthModuleImports: createTsImportMap(betterAuthModuleImportsSchema, {
-                    auth: paths.auth,
+                    Auth: paths.auth,
+                    AuthServiceDeps: paths.auth,
                     betterAuthPlugin: paths.betterAuthPlugin,
+                    buildAuth: paths.auth,
                     cookiePrefix: paths.auth,
+                    createBetterAuthUserSessionService: paths.userSessionService,
                     toWebHeaders: paths.headersUtils,
                 }),
-                userSessionServiceImports: createTsImportMap(userSessionServiceImportsSchema, { userSessionService: paths.userSessionService }),
             },
         };
     },

package/dist/better-auth/generators/fastify/better-auth-module/generated/typed-templates.d.ts

@@ -1,5 +1,7 @@
 export declare const BETTER_AUTH_BETTER_AUTH_MODULE_TEMPLATES: {
     auth: import("@baseplate-dev/core-generators").TsTemplateFile<{
+        TPL_ACCOUNT_VERIFICATION_EMAIL: {};
+        TPL_PASSWORD_RESET_EMAIL: {};
         TPL_USER_ROLE_MODEL: {};
     }, {
         authRolesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
@@ -14,14 +16,57 @@ export declare const BETTER_AUTH_BETTER_AUTH_MODULE_TEMPLATES: {
             };
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
+        }>>;
+        emailModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createEmailService: {};
+            createEmailTransport: {};
+            EmailAdapter: {
+                isTypeOnly: true;
+            };
+            EmailAttachment: {
+                isTypeOnly: true;
+            };
+            EmailRawOptions: {
+                isTypeOnly: true;
+            };
+            EmailSendOptions: {
+                isTypeOnly: true;
+            };
+            EmailService: {
+                isTypeOnly: true;
+            };
+            EmailTransport: {
+                isTypeOnly: true;
+            };
+            sendEmailQueue: {};
+            sendEmailWorker: {};
+            TransformedEmailMessage: {
+                isTypeOnly: true;
+            };
         }>>;
         prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             prisma: {};
         }>>;
     }, Record<never, Record<never, never>>>;
-    betterAuthPlugin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, {
-        auth: {};
+    betterAuthPlugin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+        appRuntimeImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            AppRuntime: {
+                isTypeOnly: true;
+            };
+            AppServices: {
+                isTypeOnly: true;
+            };
+            createAppRuntime: {};
+            InternalServices: {
+                isTypeOnly: true;
+            };
+            RuntimeServices: {
+                isTypeOnly: true;
+            };
+        }>>;
+    }, {
         headersUtils: {};
     }>;
     headersUtils: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;

package/dist/better-auth/generators/fastify/better-auth-module/generated/typed-templates.js

@@ -1,26 +1,37 @@
 import { createTsTemplateFile } from '@baseplate-dev/core-generators';
-import { authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, pothosImportsProvider, prismaImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appRuntimeImportsProvider, authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, pothosImportsProvider, prismaImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { emailModuleImportsProvider } from '@baseplate-dev/plugin-email';
 import path from 'node:path';
 const auth = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
         authRolesImports: authRolesImportsProvider,
         configServiceImports: configServiceImportsProvider,
+        emailModuleImports: emailModuleImportsProvider,
         prismaImports: prismaImportsProvider,
     },
     name: 'auth',
-    projectExports: { auth: {}, cookiePrefix: {} },
+    projectExports: {
+        Auth: { isTypeOnly: true },
+        AuthServiceDeps: { isTypeOnly: true },
+        buildAuth: {},
+        cookiePrefix: {},
+    },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/auth.ts'),
     },
-    variables: { TPL_USER_ROLE_MODEL: {} },
+    variables: {
+        TPL_ACCOUNT_VERIFICATION_EMAIL: {},
+        TPL_PASSWORD_RESET_EMAIL: {},
+        TPL_USER_ROLE_MODEL: {},
+    },
 });
 const betterAuthPlugin = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
-    importMapProviders: {},
+    importMapProviders: { appRuntimeImports: appRuntimeImportsProvider },
     name: 'better-auth-plugin',
     projectExports: { betterAuthPlugin: {} },
-    referencedGeneratorTemplates: { auth: {}, headersUtils: {} },
+    referencedGeneratorTemplates: { headersUtils: {} },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/plugins/better-auth.plugin.ts'),
     },
@@ -55,7 +66,7 @@ const userSessionService = createTsTemplateFile({
         userSessionTypesImports: userSessionTypesImportsProvider,
     },
     name: 'user-session-service',
-    projectExports: { userSessionService: {} },
+    projectExports: { createBetterAuthUserSessionService: {} },
     referencedGeneratorTemplates: { auth: {}, headersUtils: {} },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/user-session.service.ts'),

package/dist/better-auth/generators/fastify/better-auth-module/templates/module/plugins/better-auth.plugin.ts

@@ -1,11 +1,14 @@
 // @ts-nocheck
 
-import { auth } from '$auth';
+import type { AppServices } from '%appRuntimeImports';
+
 import { toWebHeaders } from '$headersUtils';
 import fp from 'fastify-plugin';
 
-export const betterAuthPlugin = fp(
-  (fastify, _opts, done) => {
+export const betterAuthPlugin = fp<{
+  services: Pick<AppServices, 'betterAuth'>;
+}>(
+  (fastify, { services }, done) => {
     fastify.all('/auth/*', async (request, reply) => {
       const url = new URL(request.url, `http://${request.headers.host}`);
 
@@ -15,7 +18,7 @@ export const betterAuthPlugin = fp(
         ...(request.body ? { body: JSON.stringify(request.body) } : {}),
       });
 
-      const response = await auth.handler(req);
+      const response = await services.betterAuth.handler(req);
 
       reply.status(response.status);
       for (const [key, value] of response.headers.entries())

package/dist/better-auth/generators/fastify/better-auth-module/templates/module/services/auth.ts

@@ -1,14 +1,19 @@
 // @ts-nocheck
 
 import type { AuthRole } from '%authRolesImports';
+import type { EmailService } from '%emailModuleImports';
 
 import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { config } from '%configServiceImports';
+import { getConfig } from '%configServiceImports';
 import { prisma } from '%prismaImports';
 import { betterAuth } from 'better-auth';
 import { prismaAdapter } from 'better-auth/adapters/prisma';
 import { customSession } from 'better-auth/plugins';
 
+// Read at module scope: this module already requires backend env at import
+// via the Prisma client.
+const config = getConfig();
+
 /**
  * Returns the cookie prefix for Better Auth.
  * In development, scopes cookies to the server port to avoid collisions
@@ -19,44 +24,84 @@ export const cookiePrefix =
     ? `better-auth-${config.SERVER_PORT}`
     : 'better-auth';
 
-export const auth = betterAuth({
-  database: prismaAdapter(prisma, { provider: 'postgresql' }),
-  secret: config.BETTER_AUTH_SECRET,
-  baseURL: config.BETTER_AUTH_URL,
-  basePath: '/auth',
-  emailAndPassword: { enabled: true },
-  session: {
-    cookieCache: { enabled: true, maxAge: 5 * 60 },
-  },
-  advanced: {
-    cookiePrefix,
-    database: {
-      generateId: false,
+/**
+ * Dependencies `auth` needs at construction time.
+ */
+export interface AuthServiceDeps {
+  email: EmailService;
+}
+
+export type Auth = ReturnType<typeof buildAuth>;
+
+/**
+ * Constructs a fresh {@link Auth} instance from the given deps. Called once
+ * per AppRuntime, inside `createAppRuntime()`, and exposed as
+ * `services.betterAuth` - not memoized here, since a runtime's services are
+ * only ever built once for the runtime's lifetime.
+ */
+// eslint-disable-next-line @typescript-eslint/explicit-function-return-type -- return type is self-referential (Auth is derived from it above); betterAuth()'s inferred generic return type can't be spelled out by hand
+export const buildAuth = ({ email }: AuthServiceDeps) =>
+  betterAuth({
+    database: prismaAdapter(prisma, { provider: 'postgresql' }),
+    secret: config.BETTER_AUTH_SECRET,
+    baseURL: config.BETTER_AUTH_URL,
+    basePath: '/auth',
+    emailAndPassword: {
+      enabled: true,
+      async sendResetPassword({ token, user }) {
+        const resetLink = `${config.AUTH_FRONTEND_URL}/auth/reset-password?token=${token}`;
+        await email.send(TPL_PASSWORD_RESET_EMAIL, {
+          to: user.email,
+          data: { resetLink },
+        });
+      },
+      resetPasswordTokenExpiresIn: 3600,
     },
-  },
-  trustedOrigins: config.ALLOWED_ORIGINS.split(',')
-    .map((o) => o.trim())
-    .filter(Boolean),
-  user: {
-    modelName: 'User',
-  },
-  plugins: [
-    customSession(async ({ user, session }) => {
-      const userRoles = await TPL_USER_ROLE_MODEL.findMany({
-        where: { userId: user.id },
-      });
-
-      const roles = [
-        ...new Set([...DEFAULT_USER_ROLES, ...userRoles.map((r) => r.role)]),
-      ] as AuthRole[];
-
-      return {
-        user,
-        session: {
-          ...session,
-          roles,
-        },
-      };
-    }),
-  ],
-});
+    emailVerification: {
+      sendOnSignUp: true,
+      async sendVerificationEmail({ token, user }) {
+        const verifyLink = `${config.AUTH_FRONTEND_URL}/auth/verify-email?token=${token}`;
+        await email.send(TPL_ACCOUNT_VERIFICATION_EMAIL, {
+          to: user.email,
+          data: { verifyLink },
+        });
+      },
+    },
+    session: {
+      cookieCache: { enabled: true, maxAge: 5 * 60 },
+    },
+    advanced: {
+      cookiePrefix,
+      database: {
+        generateId: false,
+      },
+    },
+    trustedOrigins: config.ALLOWED_ORIGINS.split(',')
+      .map((o) => o.trim())
+      .filter(Boolean),
+    user: {
+      modelName: 'User',
+      changeEmail: {
+        enabled: true,
+      },
+    },
+    plugins: [
+      customSession(async ({ user, session }) => {
+        const userRoles = await TPL_USER_ROLE_MODEL.findMany({
+          where: { userId: user.id },
+        });
+
+        const roles = [
+          ...new Set([...DEFAULT_USER_ROLES, ...userRoles.map((r) => r.role)]),
+        ] as AuthRole[];
+
+        return {
+          user,
+          session: {
+            ...session,
+            roles,
+          },
+        };
+      }),
+    ],
+  });