@dubeyvishal/orbital-cli 1.5.9 → 1.6.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dubeyvishal/orbital-cli",
-  "version": "1.5.9",
+  "version": "1.6.10",
   "description": "A fullstack CLI-based AI platform with chat mode, multi-tool agents, and agentic AI workflows. Includes GitHub login with device authorization, secure authentication, and modular client–server architecture for building intelligent automation tools.",
   "author": "Vishal Dubey",
   "license": "MIT",

package/server/src/config/api.js

@@ -18,5 +18,5 @@ export const FRONTEND_URL = stripTrailingSlash(
 );
 
 export const AUTH_BASE_URL = stripTrailingSlash(
-  process.env.BETTER_AUTH_BASE_URL || API_BASE
+  process.env.BETTER_AUTH_BASE_URL || FRONTEND_URL || API_BASE
 );

package/server/src/index.js

@@ -16,19 +16,29 @@ const CLIENT_ORIGIN = FRONTEND_URL;
 
 app.use(express.json());
 
-// Skip Express cors for /api/auth/* routes — better-auth handles its own CORS.
-const corsMiddleware = cors({
-  origin: CLIENT_ORIGIN,
-  methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-  credentials: true,
-});
-app.use((req, res, next) => {
-  if (req.path.startsWith("/api/auth/")) return next();
-  corsMiddleware(req, res, next);
+// ── CORS: single source of truth for every route ──────────────────────
+app.use(
+  cors({
+    origin: CLIENT_ORIGIN,
+    methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+    credentials: true,
+  })
+);
+
+// Wrap the better-auth handler so it can never override the origin with "*".
+const authHandler = toNodeHandler(auth);
+app.all("/api/auth/*splat", (req, res) => {
+  const _setHeader = res.setHeader.bind(res);
+  res.setHeader = function (name, value) {
+    // Force the correct origin for any CORS header better-auth sets.
+    if (name.toLowerCase() === "access-control-allow-origin") {
+      return _setHeader(name, CLIENT_ORIGIN);
+    }
+    return _setHeader(name, value);
+  };
+  authHandler(req, res);
 });
 
-app.all("/api/auth/*splat", toNodeHandler(auth));
-
 app.use("/auth", authRoutes);
 
 app.get("/api/me" , async (req, res)=>{

package/server/src/lib/auth.js

@@ -3,7 +3,7 @@ import { betterAuth } from "better-auth";
 import { prismaAdapter } from "better-auth/adapters/prisma";
 import { deviceAuthorization } from "better-auth/plugins";
 import prisma from "./db.js";
-import { API_BASE, FRONTEND_URL } from "../config/api.js";
+import { AUTH_BASE_URL, FRONTEND_URL } from "../config/api.js";
 
 const CLIENT_ORIGIN =
   process.env.CLIENT_ORIGIN ||
@@ -15,7 +15,7 @@ export const auth = betterAuth({
     provider: "postgresql",
   }),
 
-  baseURL: API_BASE,
+  baseURL: AUTH_BASE_URL,
   basePath: "/api/auth",
 
   trustedOrigins: [CLIENT_ORIGIN],