@beignet/provider-auth-better-auth 0.0.26 → 0.0.28

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @beignet/provider-auth-better-auth
 
+## 0.0.28
+
+### Patch Changes
+
+- c7f7f1d: Document optional Next.js 16 cookie-only Better Auth proxy redirects for app-specific protected UI routes.
+
+## 0.0.27
+
+### Patch Changes
+
+- f2461a9: Add lazy Next route server loaders and update generated route files and package docs to avoid booting providers during production build imports.
+
 ## 0.0.26
 
 ### Patch Changes

package/README.md

@@ -179,17 +179,20 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 
 ```ts
 // server/index.ts
-import { createNextServer } from "@beignet/next";
+import { createNextServer, createNextServerLoader } from "@beignet/next";
 import { appPorts } from "@/infra/app-ports";
 import { appContext } from "@/server/context";
 import { routes } from "@/server/routes";
-import { providers } from "./providers";
 
-export const server = await createNextServer({
-  ports: appPorts,
-  providers,
-  context: appContext,
-  routes,
+export const getServer = createNextServerLoader(async () => {
+  const { providers } = await import("./providers");
+
+  return createNextServer({
+    ports: appPorts,
+    providers,
+    context: appContext,
+    routes,
+  });
 });
 ```
 
@@ -269,6 +272,32 @@ It does not expose a Better Auth escape hatch; route handlers that need
 provider-native auth flows should mount Better Auth's own routes separately,
 usually under `app/api/auth/[...all]/route.ts`.
 
+## Auth callbacks and app ports
+
+Better Auth callbacks such as `sendResetPassword` and organization
+invitation emails run outside the Beignet request pipeline. Reach the app's
+mail and logger ports through the booted server instead of constructing a
+parallel mail client:
+
+```typescript
+async sendResetPassword({ user, url }) {
+  // Dynamic import breaks the module cycle (server -> providers -> auth);
+  // getServer() is memoized, so this resolves to a cached instance.
+  const { getServer } = await import("@/server");
+  const { ports } = await getServer();
+  await ports.mailer.send({
+    to: user.email,
+    subject: "Reset your password",
+    text: `Reset your password: ${url}`,
+  });
+}
+```
+
+This keeps auth email on the same instrumented, environment-swappable
+provider as the rest of the app. See the
+[Authentication docs](https://beignetjs.com/authentication) for the full
+pattern.
+
 ## Devtools
 
 When `@beignet/devtools` is installed before this provider, auth checks
@@ -456,11 +485,12 @@ const user = await ctx.ports.auth.requireUser(req);
 Better Auth provides its own route handlers for login, signup, etc. You can mount these alongside your Beignet routes:
 
 ```ts
-// Next.js App Router example
+// app/api/auth/[...all]/route.ts
+import { toNextJsHandler } from "better-auth/next-js";
 import { auth } from "@/lib/better-auth";
 
 // Better Auth handles /api/auth/*
-export const { GET, POST } = auth.handler;
+export const { GET, POST } = toNextJsHandler(auth);
 
 // Your Beignet routes handle /api/app/*
 // (mounted separately)
@@ -468,6 +498,33 @@ export const { GET, POST } = auth.handler;
 
 See the [Better Auth documentation](https://better-auth.com) for details on route configuration.
 
+For Next.js 16 app shells, a root `proxy.ts` can improve redirects by checking
+for the presence of the Better Auth session cookie before rendering protected
+UI routes:
+
+```ts
+import { getSessionCookie } from "better-auth/cookies";
+import { NextResponse, type NextRequest } from "next/server";
+
+export function proxy(request: NextRequest) {
+  const sessionCookie = getSessionCookie(request);
+
+  if (!sessionCookie) {
+    return NextResponse.redirect(new URL("/sign-in", request.url));
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ["/dashboard/:path*", "/settings/:path*"],
+};
+```
+
+This is only an optimistic UX gate. Keep Beignet's server context, auth hooks,
+policies, and use-case helpers as the real authorization boundary, because a
+cookie-only check does not validate the session.
+
 ## Examples
 
 ### Basic setup

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/provider-auth-better-auth",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "type": "module",
   "description": "Better Auth provider for Beignet - adds auth port for authentication and session management",
   "main": "./dist/index.js",