@beignet/provider-auth-better-auth 0.0.27 → 0.0.29

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @beignet/provider-auth-better-auth
 
+## 0.0.29
+
+## 0.0.28
+
+### Patch Changes
+
+- c7f7f1d: Document optional Next.js 16 cookie-only Better Auth proxy redirects for app-specific protected UI routes.
+
 ## 0.0.27
 
 ### Patch Changes

package/README.md

@@ -272,6 +272,32 @@ It does not expose a Better Auth escape hatch; route handlers that need
 provider-native auth flows should mount Better Auth's own routes separately,
 usually under `app/api/auth/[...all]/route.ts`.
 
+## Auth callbacks and app ports
+
+Better Auth callbacks such as `sendResetPassword` and organization
+invitation emails run outside the Beignet request pipeline. Reach the app's
+mail and logger ports through the booted server instead of constructing a
+parallel mail client:
+
+```typescript
+async sendResetPassword({ user, url }) {
+  // Dynamic import breaks the module cycle (server -> providers -> auth);
+  // getServer() is memoized, so this resolves to a cached instance.
+  const { getServer } = await import("@/server");
+  const { ports } = await getServer();
+  await ports.mailer.send({
+    to: user.email,
+    subject: "Reset your password",
+    text: `Reset your password: ${url}`,
+  });
+}
+```
+
+This keeps auth email on the same instrumented, environment-swappable
+provider as the rest of the app. See the
+[Authentication docs](https://beignetjs.com/authentication) for the full
+pattern.
+
 ## Devtools
 
 When `@beignet/devtools` is installed before this provider, auth checks
@@ -459,11 +485,12 @@ const user = await ctx.ports.auth.requireUser(req);
 Better Auth provides its own route handlers for login, signup, etc. You can mount these alongside your Beignet routes:
 
 ```ts
-// Next.js App Router example
+// app/api/auth/[...all]/route.ts
+import { toNextJsHandler } from "better-auth/next-js";
 import { auth } from "@/lib/better-auth";
 
 // Better Auth handles /api/auth/*
-export const { GET, POST } = auth.handler;
+export const { GET, POST } = toNextJsHandler(auth);
 
 // Your Beignet routes handle /api/app/*
 // (mounted separately)
@@ -471,6 +498,33 @@ export const { GET, POST } = auth.handler;
 
 See the [Better Auth documentation](https://better-auth.com) for details on route configuration.
 
+For Next.js 16 app shells, a root `proxy.ts` can improve redirects by checking
+for the presence of the Better Auth session cookie before rendering protected
+UI routes:
+
+```ts
+import { getSessionCookie } from "better-auth/cookies";
+import { NextResponse, type NextRequest } from "next/server";
+
+export function proxy(request: NextRequest) {
+  const sessionCookie = getSessionCookie(request);
+
+  if (!sessionCookie) {
+    return NextResponse.redirect(new URL("/sign-in", request.url));
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ["/dashboard/:path*", "/settings/:path*"],
+};
+```
+
+This is only an optimistic UX gate. Keep Beignet's server context, auth hooks,
+policies, and use-case helpers as the real authorization boundary, because a
+cookie-only check does not validate the session.
+
 ## Examples
 
 ### Basic setup

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/provider-auth-better-auth",
-  "version": "0.0.27",
+  "version": "0.0.29",
   "type": "module",
   "description": "Better Auth provider for Beignet - adds auth port for authentication and session management",
   "main": "./dist/index.js",