@lobehub/lobehub 2.0.0-next.124 → 2.0.0-next.125

package/src/components/NextAuth/AuthIcons.tsx

@@ -1,4 +1,4 @@
-import { Google } from '@lobehub/icons';
+import { Aws, Google, Microsoft } from '@lobehub/icons';
 import {
   Auth0,
   Authelia,
@@ -19,10 +19,12 @@ const iconComponents: { [key: string]: React.ElementType } = {
   'authentik': Authentik.Color,
   'casdoor': Casdoor.Color,
   'cloudflare': Cloudflare.Color,
+  'cognito': Aws.Color,
   'default': NextAuth.Color,
   'github': Github,
   'google': Google.Color,
   'logto': Logto.Color,
+  'microsoft': Microsoft.Color,
   'microsoft-entra-id': MicrosoftEntra.Color,
   'zitadel': Zitadel.Color,
 };

package/src/envs/auth.ts

@@ -11,6 +11,12 @@ declare global {
       CLERK_SECRET_KEY?: string;
       CLERK_WEBHOOK_SECRET?: string;
 
+      // ===== Auth (shared by Better Auth / Next Auth) ===== //
+      AUTH_SECRET?: string;
+      NEXT_PUBLIC_AUTH_URL?: string;
+      NEXT_PUBLIC_AUTH_EMAIL_VERIFICATION?: string;
+      AUTH_SSO_PROVIDERS?: string;
+
       // ===== Next Auth ===== //
       NEXT_AUTH_SECRET?: string;
 
@@ -20,11 +26,78 @@ declare global {
 
       NEXT_AUTH_SSO_SESSION_STRATEGY?: string;
 
-      // Github
-      GITHUB_CLIENT_ID?: string;
-      GITHUB_CLIENT_SECRET?: string;
+      // ===== Next Auth Provider Credentials ===== //
+      AUTH_GOOGLE_ID?: string;
+      AUTH_GOOGLE_SECRET?: string;
+
+      AUTH_GITHUB_ID?: string;
+      AUTH_GITHUB_SECRET?: string;
+
+      AUTH_COGNITO_ID?: string;
+      AUTH_COGNITO_SECRET?: string;
+      AUTH_COGNITO_ISSUER?: string;
+      AUTH_COGNITO_DOMAIN?: string;
+      AUTH_COGNITO_REGION?: string;
+      AUTH_COGNITO_USERPOOL_ID?: string;
+
+      AUTH_MICROSOFT_ID?: string;
+      AUTH_MICROSOFT_SECRET?: string;
+
+      AUTH_AUTH0_ID?: string;
+      AUTH_AUTH0_SECRET?: string;
+      AUTH_AUTH0_ISSUER?: string;
+
+      AUTH_AUTHELIA_ID?: string;
+      AUTH_AUTHELIA_SECRET?: string;
+      AUTH_AUTHELIA_ISSUER?: string;
+
+      AUTH_AUTHENTIK_ID?: string;
+      AUTH_AUTHENTIK_SECRET?: string;
+      AUTH_AUTHENTIK_ISSUER?: string;
+
+      AUTH_CASDOOR_ID?: string;
+      AUTH_CASDOOR_SECRET?: string;
+      AUTH_CASDOOR_ISSUER?: string;
+
+      AUTH_CLOUDFLARE_ZERO_TRUST_ID?: string;
+      AUTH_CLOUDFLARE_ZERO_TRUST_SECRET?: string;
+      AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER?: string;
+
+      AUTH_FEISHU_APP_ID?: string;
+      AUTH_FEISHU_APP_SECRET?: string;
+
+      AUTH_GENERIC_OIDC_ID?: string;
+      AUTH_GENERIC_OIDC_SECRET?: string;
+      AUTH_GENERIC_OIDC_ISSUER?: string;
+
+      AUTH_KEYCLOAK_ID?: string;
+      AUTH_KEYCLOAK_SECRET?: string;
+      AUTH_KEYCLOAK_ISSUER?: string;
+
+      AUTH_LOGTO_ID?: string;
+      AUTH_LOGTO_SECRET?: string;
+      AUTH_LOGTO_ISSUER?: string;
+
+      AUTH_MICROSOFT_ENTRA_ID_ID?: string;
+      AUTH_MICROSOFT_ENTRA_ID_SECRET?: string;
+      AUTH_MICROSOFT_ENTRA_ID_TENANT_ID?: string;
+      AUTH_MICROSOFT_ENTRA_ID_BASE_URL?: string;
+
+      AUTH_OKTA_ID?: string;
+      AUTH_OKTA_SECRET?: string;
+      AUTH_OKTA_ISSUER?: string;
+
+      AUTH_WECHAT_ID?: string;
+      AUTH_WECHAT_SECRET?: string;
+
+      AUTH_ZITADEL_ID?: string;
+      AUTH_ZITADEL_SECRET?: string;
+      AUTH_ZITADEL_ISSUER?: string;
+
+      AUTH_AZURE_AD_ID?: string;
+      AUTH_AZURE_AD_SECRET?: string;
+      AUTH_AZURE_AD_TENANT_ID?: string;
 
-      // Azure AD
       AZURE_AD_CLIENT_ID?: string;
       AZURE_AD_CLIENT_SECRET?: string;
       AZURE_AD_TENANT_ID?: string;
@@ -40,30 +113,113 @@ declare global {
 export const getAuthConfig = () => {
   return createEnv({
     client: {
+      // ---------------------------------- clerk ----------------------------------
+      NEXT_PUBLIC_ENABLE_CLERK_AUTH: z.boolean().optional().default(false),
       NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: z.string().optional(),
-      /**
-       * whether to enabled clerk
-       */
-      NEXT_PUBLIC_ENABLE_CLERK_AUTH: z.boolean().optional(),
 
+      // ---------------------------------- better auth ----------------------------------
+      NEXT_PUBLIC_ENABLE_BETTER_AUTH: z.boolean().optional(),
+      NEXT_PUBLIC_AUTH_URL: z.string().optional(),
+      NEXT_PUBLIC_AUTH_EMAIL_VERIFICATION: z.boolean().optional().default(false),
+      NEXT_PUBLIC_ENABLE_MAGIC_LINK: z.boolean().optional().default(false),
+
+      // ---------------------------------- next auth ----------------------------------
       NEXT_PUBLIC_ENABLE_NEXT_AUTH: z.boolean().optional(),
     },
     server: {
-      // Clerk
+      // ---------------------------------- clerk ----------------------------------
       CLERK_SECRET_KEY: z.string().optional(),
       CLERK_WEBHOOK_SECRET: z.string().optional(),
 
-      // NEXT-AUTH
+      // ---------------------------------- better auth ----------------------------------
+      AUTH_SECRET: z.string().optional(),
+      AUTH_SSO_PROVIDERS: z.string().optional().default(''),
+
+      // ---------------------------------- next auth ----------------------------------
       NEXT_AUTH_SECRET: z.string().optional(),
       NEXT_AUTH_SSO_PROVIDERS: z.string().optional().default('auth0'),
       NEXT_AUTH_DEBUG: z.boolean().optional().default(false),
       NEXT_AUTH_SSO_SESSION_STRATEGY: z.enum(['jwt', 'database']).optional().default('jwt'),
 
-      // Azure AD
+      AUTH_GOOGLE_ID: z.string().optional(),
+      AUTH_GOOGLE_SECRET: z.string().optional(),
+
+      AUTH_GITHUB_ID: z.string().optional(),
+      AUTH_GITHUB_SECRET: z.string().optional(),
+
+      AUTH_COGNITO_ID: z.string().optional(),
+      AUTH_COGNITO_SECRET: z.string().optional(),
+      AUTH_COGNITO_ISSUER: z.string().optional(),
+      AUTH_COGNITO_DOMAIN: z.string().optional(),
+      AUTH_COGNITO_REGION: z.string().optional(),
+      AUTH_COGNITO_USERPOOL_ID: z.string().optional(),
+
+      AUTH_MICROSOFT_ID: z.string().optional(),
+      AUTH_MICROSOFT_SECRET: z.string().optional(),
+
+      AUTH_AUTH0_ID: z.string().optional(),
+      AUTH_AUTH0_SECRET: z.string().optional(),
+      AUTH_AUTH0_ISSUER: z.string().optional(),
+
+      AUTH_AUTHELIA_ID: z.string().optional(),
+      AUTH_AUTHELIA_SECRET: z.string().optional(),
+      AUTH_AUTHELIA_ISSUER: z.string().optional(),
+
+      AUTH_AUTHENTIK_ID: z.string().optional(),
+      AUTH_AUTHENTIK_SECRET: z.string().optional(),
+      AUTH_AUTHENTIK_ISSUER: z.string().optional(),
+
+      AUTH_CASDOOR_ID: z.string().optional(),
+      AUTH_CASDOOR_SECRET: z.string().optional(),
+      AUTH_CASDOOR_ISSUER: z.string().optional(),
+
+      AUTH_CLOUDFLARE_ZERO_TRUST_ID: z.string().optional(),
+      AUTH_CLOUDFLARE_ZERO_TRUST_SECRET: z.string().optional(),
+      AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER: z.string().optional(),
+
+      AUTH_FEISHU_APP_ID: z.string().optional(),
+      AUTH_FEISHU_APP_SECRET: z.string().optional(),
+
+      AUTH_GENERIC_OIDC_ID: z.string().optional(),
+      AUTH_GENERIC_OIDC_SECRET: z.string().optional(),
+      AUTH_GENERIC_OIDC_ISSUER: z.string().optional(),
+
+      AUTH_KEYCLOAK_ID: z.string().optional(),
+      AUTH_KEYCLOAK_SECRET: z.string().optional(),
+      AUTH_KEYCLOAK_ISSUER: z.string().optional(),
+
+      AUTH_LOGTO_ID: z.string().optional(),
+      AUTH_LOGTO_SECRET: z.string().optional(),
+      AUTH_LOGTO_ISSUER: z.string().optional(),
+
+      AUTH_MICROSOFT_ENTRA_ID_ID: z.string().optional(),
+      AUTH_MICROSOFT_ENTRA_ID_SECRET: z.string().optional(),
+      AUTH_MICROSOFT_ENTRA_ID_TENANT_ID: z.string().optional(),
+      AUTH_MICROSOFT_ENTRA_ID_BASE_URL: z.string().optional(),
+
+      AUTH_OKTA_ID: z.string().optional(),
+      AUTH_OKTA_SECRET: z.string().optional(),
+      AUTH_OKTA_ISSUER: z.string().optional(),
+
+      AUTH_WECHAT_ID: z.string().optional(),
+      AUTH_WECHAT_SECRET: z.string().optional(),
+
+      AUTH_ZITADEL_ID: z.string().optional(),
+      AUTH_ZITADEL_SECRET: z.string().optional(),
+      AUTH_ZITADEL_ISSUER: z.string().optional(),
+
+      AUTH_AZURE_AD_ID: z.string().optional(),
+      AUTH_AZURE_AD_SECRET: z.string().optional(),
+      AUTH_AZURE_AD_TENANT_ID: z.string().optional(),
+
       AZURE_AD_CLIENT_ID: z.string().optional(),
       AZURE_AD_CLIENT_SECRET: z.string().optional(),
       AZURE_AD_TENANT_ID: z.string().optional(),
 
+      ZITADEL_CLIENT_ID: z.string().optional(),
+      ZITADEL_CLIENT_SECRET: z.string().optional(),
+      ZITADEL_ISSUER: z.string().optional(),
+
       LOGTO_WEBHOOK_SIGNING_KEY: z.string().optional(),
 
       // Casdoor
@@ -77,18 +233,109 @@ export const getAuthConfig = () => {
       CLERK_SECRET_KEY: process.env.CLERK_SECRET_KEY,
       CLERK_WEBHOOK_SECRET: process.env.CLERK_WEBHOOK_SECRET,
 
-      // Next Auth
+      // ---------------------------------- better auth ----------------------------------
+      NEXT_PUBLIC_ENABLE_BETTER_AUTH: process.env.NEXT_PUBLIC_ENABLE_BETTER_AUTH === '1',
+      // Fallback to NEXTAUTH_URL origin for seamless migration from next-auth
+      NEXT_PUBLIC_AUTH_URL:
+        process.env.NEXT_PUBLIC_AUTH_URL ??
+        (process.env.NEXTAUTH_URL ? new URL(process.env.NEXTAUTH_URL).origin : undefined),
+      NEXT_PUBLIC_AUTH_EMAIL_VERIFICATION: process.env.NEXT_PUBLIC_AUTH_EMAIL_VERIFICATION === '1',
+      NEXT_PUBLIC_ENABLE_MAGIC_LINK: process.env.NEXT_PUBLIC_ENABLE_MAGIC_LINK === '1',
+      // Fallback to NEXT_AUTH_SECRET for seamless migration from next-auth
+      AUTH_SECRET: process.env.AUTH_SECRET ?? process.env.NEXT_AUTH_SECRET,
+      // Fallback to NEXT_AUTH_SSO_PROVIDERS for seamless migration from next-auth
+      AUTH_SSO_PROVIDERS: process.env.AUTH_SSO_PROVIDERS ?? process.env.NEXT_AUTH_SSO_PROVIDERS,
+
+      // better-auth env for Cognito provider is different from next-auth's one
+      AUTH_COGNITO_DOMAIN: process.env.AUTH_COGNITO_DOMAIN,
+      AUTH_COGNITO_REGION: process.env.AUTH_COGNITO_REGION,
+      AUTH_COGNITO_USERPOOL_ID: process.env.AUTH_COGNITO_USERPOOL_ID,
+
+      // ---------------------------------- next auth ----------------------------------
       NEXT_PUBLIC_ENABLE_NEXT_AUTH: process.env.NEXT_PUBLIC_ENABLE_NEXT_AUTH === '1',
       NEXT_AUTH_SSO_PROVIDERS: process.env.NEXT_AUTH_SSO_PROVIDERS,
       NEXT_AUTH_SECRET: process.env.NEXT_AUTH_SECRET,
       NEXT_AUTH_DEBUG: !!process.env.NEXT_AUTH_DEBUG,
       NEXT_AUTH_SSO_SESSION_STRATEGY: process.env.NEXT_AUTH_SSO_SESSION_STRATEGY || 'jwt',
 
-      // Azure AD
+      // Next Auth Provider Credentials
+      AUTH_GOOGLE_ID: process.env.AUTH_GOOGLE_ID,
+      AUTH_GOOGLE_SECRET: process.env.AUTH_GOOGLE_SECRET,
+
+      AUTH_GITHUB_ID: process.env.AUTH_GITHUB_ID,
+      AUTH_GITHUB_SECRET: process.env.AUTH_GITHUB_SECRET,
+
+      AUTH_MICROSOFT_ID: process.env.AUTH_MICROSOFT_ID,
+      AUTH_MICROSOFT_SECRET: process.env.AUTH_MICROSOFT_SECRET,
+
+      AUTH_COGNITO_ID: process.env.AUTH_COGNITO_ID,
+      AUTH_COGNITO_SECRET: process.env.AUTH_COGNITO_SECRET,
+      AUTH_COGNITO_ISSUER: process.env.AUTH_COGNITO_ISSUER,
+
+      AUTH_AUTH0_ID: process.env.AUTH_AUTH0_ID,
+      AUTH_AUTH0_SECRET: process.env.AUTH_AUTH0_SECRET,
+      AUTH_AUTH0_ISSUER: process.env.AUTH_AUTH0_ISSUER,
+
+      AUTH_AUTHELIA_ID: process.env.AUTH_AUTHELIA_ID,
+      AUTH_AUTHELIA_SECRET: process.env.AUTH_AUTHELIA_SECRET,
+      AUTH_AUTHELIA_ISSUER: process.env.AUTH_AUTHELIA_ISSUER,
+
+      AUTH_AUTHENTIK_ID: process.env.AUTH_AUTHENTIK_ID,
+      AUTH_AUTHENTIK_SECRET: process.env.AUTH_AUTHENTIK_SECRET,
+      AUTH_AUTHENTIK_ISSUER: process.env.AUTH_AUTHENTIK_ISSUER,
+
+      AUTH_CASDOOR_ID: process.env.AUTH_CASDOOR_ID,
+      AUTH_CASDOOR_SECRET: process.env.AUTH_CASDOOR_SECRET,
+      AUTH_CASDOOR_ISSUER: process.env.AUTH_CASDOOR_ISSUER,
+
+      AUTH_CLOUDFLARE_ZERO_TRUST_ID: process.env.AUTH_CLOUDFLARE_ZERO_TRUST_ID,
+      AUTH_CLOUDFLARE_ZERO_TRUST_SECRET: process.env.AUTH_CLOUDFLARE_ZERO_TRUST_SECRET,
+      AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER: process.env.AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER,
+
+      AUTH_FEISHU_APP_ID: process.env.AUTH_FEISHU_APP_ID,
+      AUTH_FEISHU_APP_SECRET: process.env.AUTH_FEISHU_APP_SECRET,
+
+      AUTH_GENERIC_OIDC_ID: process.env.AUTH_GENERIC_OIDC_ID,
+      AUTH_GENERIC_OIDC_SECRET: process.env.AUTH_GENERIC_OIDC_SECRET,
+      AUTH_GENERIC_OIDC_ISSUER: process.env.AUTH_GENERIC_OIDC_ISSUER,
+
+      AUTH_KEYCLOAK_ID: process.env.AUTH_KEYCLOAK_ID,
+      AUTH_KEYCLOAK_SECRET: process.env.AUTH_KEYCLOAK_SECRET,
+      AUTH_KEYCLOAK_ISSUER: process.env.AUTH_KEYCLOAK_ISSUER,
+
+      AUTH_LOGTO_ID: process.env.AUTH_LOGTO_ID,
+      AUTH_LOGTO_SECRET: process.env.AUTH_LOGTO_SECRET,
+      AUTH_LOGTO_ISSUER: process.env.AUTH_LOGTO_ISSUER,
+
+      AUTH_MICROSOFT_ENTRA_ID_ID: process.env.AUTH_MICROSOFT_ENTRA_ID_ID,
+      AUTH_MICROSOFT_ENTRA_ID_SECRET: process.env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
+      AUTH_MICROSOFT_ENTRA_ID_TENANT_ID: process.env.AUTH_MICROSOFT_ENTRA_ID_TENANT_ID,
+      AUTH_MICROSOFT_ENTRA_ID_BASE_URL: process.env.AUTH_MICROSOFT_ENTRA_ID_BASE_URL,
+
+      AUTH_OKTA_ID: process.env.AUTH_OKTA_ID,
+      AUTH_OKTA_SECRET: process.env.AUTH_OKTA_SECRET,
+      AUTH_OKTA_ISSUER: process.env.AUTH_OKTA_ISSUER,
+
+      AUTH_WECHAT_ID: process.env.AUTH_WECHAT_ID,
+      AUTH_WECHAT_SECRET: process.env.AUTH_WECHAT_SECRET,
+
+      AUTH_ZITADEL_ID: process.env.AUTH_ZITADEL_ID,
+      AUTH_ZITADEL_SECRET: process.env.AUTH_ZITADEL_SECRET,
+      AUTH_ZITADEL_ISSUER: process.env.AUTH_ZITADEL_ISSUER,
+
+      AUTH_AZURE_AD_ID: process.env.AUTH_AZURE_AD_ID,
+      AUTH_AZURE_AD_SECRET: process.env.AUTH_AZURE_AD_SECRET,
+      AUTH_AZURE_AD_TENANT_ID: process.env.AUTH_AZURE_AD_TENANT_ID,
+
+      // legacy Azure AD envs for backward compatibility
       AZURE_AD_CLIENT_ID: process.env.AZURE_AD_CLIENT_ID,
       AZURE_AD_CLIENT_SECRET: process.env.AZURE_AD_CLIENT_SECRET,
       AZURE_AD_TENANT_ID: process.env.AZURE_AD_TENANT_ID,
 
+      ZITADEL_CLIENT_ID: process.env.ZITADEL_CLIENT_ID,
+      ZITADEL_CLIENT_SECRET: process.env.ZITADEL_CLIENT_SECRET,
+      ZITADEL_ISSUER: process.env.ZITADEL_ISSUER,
+
       // LOGTO
       LOGTO_WEBHOOK_SIGNING_KEY: process.env.LOGTO_WEBHOOK_SIGNING_KEY,
 

package/src/envs/email.ts

@@ -0,0 +1,37 @@
+/* eslint-disable sort-keys-fix/sort-keys-fix */
+import { createEnv } from '@t3-oss/env-nextjs';
+import { z } from 'zod';
+
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace NodeJS {
+    interface ProcessEnv {
+      SMTP_HOST?: string;
+      SMTP_PASS?: string;
+      SMTP_PORT?: string;
+      SMTP_SECURE?: string;
+      SMTP_USER?: string;
+    }
+  }
+}
+
+export const getEmailConfig = () => {
+  return createEnv({
+    server: {
+      SMTP_HOST: z.string().optional(),
+      SMTP_PORT: z.coerce.number().optional(),
+      SMTP_SECURE: z.boolean().optional(),
+      SMTP_USER: z.string().optional(),
+      SMTP_PASS: z.string().optional(),
+    },
+    runtimeEnv: {
+      SMTP_HOST: process.env.SMTP_HOST,
+      SMTP_PORT: process.env.SMTP_PORT ? Number(process.env.SMTP_PORT) : undefined,
+      SMTP_SECURE: process.env.SMTP_SECURE === 'true',
+      SMTP_USER: process.env.SMTP_USER,
+      SMTP_PASS: process.env.SMTP_PASS,
+    },
+  });
+};
+
+export const emailEnv = getEmailConfig();

package/src/features/User/UserPanel/PanelContent.tsx

@@ -1,10 +1,12 @@
-import { Link } from 'react-router-dom';
+import { enableBetterAuth, enableNextAuth } from '@lobechat/const';
 import { useRouter } from 'next/navigation';
 import { memo } from 'react';
 import { Flexbox } from 'react-layout-kit';
+import { Link } from 'react-router-dom';
 
 import BrandWatermark from '@/components/BrandWatermark';
 import Menu from '@/components/Menu';
+import { isDesktop } from '@/const/version';
 import { useUserStore } from '@/store/user';
 import { authSelectors } from '@/store/user/selectors';
 
@@ -14,8 +16,6 @@ import UserLoginOrSignup from '../UserLoginOrSignup';
 import LangButton from './LangButton';
 import ThemeButton from './ThemeButton';
 import { useMenu } from './useMenu';
-import { enableNextAuth } from '@/const/auth';
-import { isDesktop } from '@/const/version';
 
 const PanelContent = memo<{ closePopover: () => void }>(({ closePopover }) => {
   const router = useRouter();
@@ -31,8 +31,9 @@ const PanelContent = memo<{ closePopover: () => void }>(({ closePopover }) => {
   const handleSignOut = () => {
     signOut();
     closePopover();
-    // NextAuth doesn't need to redirect to login page
-    if (enableNextAuth) return;
+    // NextAuth and Better Auth handle redirect in their own signOut methods
+    if (enableNextAuth || enableBetterAuth) return;
+    // Clerk uses /login page
     router.push('/login');
   };
 

package/src/features/User/__tests__/PanelContent.test.tsx

@@ -1,6 +1,6 @@
 import { act, render, screen } from '@testing-library/react';
 import { MemoryRouter } from 'react-router-dom';
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
 import { useUserStore } from '@/store/user';
 
@@ -67,13 +67,22 @@ vi.mock('@/const/version', () => ({
   isDesktop: false,
 }));
 
-// 定义一个变量来存储 enableAuth 的值
-let enableAuth = true;
+// Use vi.hoisted to ensure variables exist before vi.mock factory executes
+const { enableAuth, enableClerk, enableNextAuth } = vi.hoisted(() => ({
+  enableAuth: { value: true },
+  enableClerk: { value: false },
+  enableNextAuth: { value: false },
+}));
 
-// 模拟 @/const/auth 模块
 vi.mock('@/const/auth', () => ({
   get enableAuth() {
-    return enableAuth;
+    return enableAuth.value;
+  },
+  get enableClerk() {
+    return enableClerk.value;
+  },
+  get enableNextAuth() {
+    return enableNextAuth.value;
   },
 }));
 
@@ -145,7 +154,7 @@ describe('PanelContent', () => {
     });
 
     it('should render BrandWatermark when disable auth', () => {
-      enableAuth = false;
+      enableAuth.value = false;
 
       act(() => {
         useUserStore.setState({ isSignedIn: false });

package/src/features/User/__tests__/UserAvatar.test.tsx

@@ -9,18 +9,29 @@ import UserAvatar from '../UserAvatar';
 
 vi.mock('zustand/traditional');
 
-// 定义一个变量来存储 enableAuth 的值
-let enableAuth = true;
+// Use vi.hoisted to ensure variables exist before vi.mock factory executes
+const { enableAuth, enableClerk, enableNextAuth } = vi.hoisted(() => ({
+  enableAuth: { value: true },
+  enableClerk: { value: false },
+  enableNextAuth: { value: false },
+}));
 
-// 模拟 @/const/auth 模块
 vi.mock('@/const/auth', () => ({
   get enableAuth() {
-    return enableAuth;
+    return enableAuth.value;
+  },
+  get enableClerk() {
+    return enableClerk.value;
+  },
+  get enableNextAuth() {
+    return enableNextAuth.value;
   },
 }));
 
 afterEach(() => {
-  enableAuth = true;
+  enableAuth.value = true;
+  enableClerk.value = false;
+  enableNextAuth.value = false;
 });
 
 describe('UserAvatar', () => {
@@ -71,7 +82,7 @@ describe('UserAvatar', () => {
 
   describe('disable Auth', () => {
     it('should show LobeChat and default avatar when the user is not logged in and disabled auth', () => {
-      enableAuth = false;
+      enableAuth.value = false;
       act(() => {
         useUserStore.setState({ enableAuth: () => false, isSignedIn: false, user: undefined });
       });

package/src/features/User/__tests__/useMenu.test.tsx

@@ -48,22 +48,24 @@ vi.mock('./useNewVersion', () => ({
   useNewVersion: vi.fn(() => false),
 }));
 
-// 定义一个变量来存储 enableAuth 的值
-let enableAuth = true;
-let enableClerk = true;
-// 模拟 @/const/auth 模块
+// Use vi.hoisted to ensure variables exist before vi.mock factory executes
+const { enableAuth, enableClerk } = vi.hoisted(() => ({
+  enableAuth: { value: true },
+  enableClerk: { value: true },
+}));
+
 vi.mock('@/const/auth', () => ({
   get enableAuth() {
-    return enableAuth;
+    return enableAuth.value;
   },
   get enableClerk() {
-    return enableClerk;
+    return enableClerk.value;
   },
 }));
 
 afterEach(() => {
-  enableAuth = true;
-  enableClerk = true;
+  enableAuth.value = true;
+  enableClerk.value = true;
 });
 
 describe('useMenu', () => {
@@ -71,8 +73,8 @@ describe('useMenu', () => {
     act(() => {
       useUserStore.setState({ isSignedIn: true, enableAuth: () => true });
     });
-    enableAuth = true;
-    enableClerk = false;
+    enableAuth.value = true;
+    enableClerk.value = false;
 
     const { result } = renderHook(() => useMenu(), { wrapper });
 
@@ -90,7 +92,7 @@ describe('useMenu', () => {
     act(() => {
       useUserStore.setState({ isSignedIn: false, enableAuth: () => false });
     });
-    enableAuth = false;
+    enableAuth.value = false;
 
     const { result } = renderHook(() => useMenu(), { wrapper });
 
@@ -108,7 +110,7 @@ describe('useMenu', () => {
     act(() => {
       useUserStore.setState({ isSignedIn: false, enableAuth: () => true });
     });
-    enableAuth = true;
+    enableAuth.value = true;
 
     const { result } = renderHook(() => useMenu(), { wrapper });
 

package/src/layout/AuthProvider/BetterAuth/UserUpdater.tsx

@@ -0,0 +1,51 @@
+'use client';
+
+import { memo, useEffect } from 'react';
+import { createStoreUpdater } from 'zustand-utils';
+
+import { useSession } from '@/libs/better-auth/auth-client';
+import { useUserStore } from '@/store/user';
+import { LobeUser } from '@/types/user';
+
+/**
+ * Sync Better-Auth session state to Zustand store
+ */
+const UserUpdater = memo(() => {
+  const { data: session, isPending, error } = useSession();
+
+  const isLoaded = !isPending;
+  const isSignedIn = !!session?.user && !error;
+
+  const betterAuthUser = session?.user;
+  const useStoreUpdater = createStoreUpdater(useUserStore);
+
+  useStoreUpdater('isLoaded', isLoaded);
+  useStoreUpdater('isSignedIn', isSignedIn);
+
+  // Sync user data from Better-Auth session to Zustand store
+  useEffect(() => {
+    if (betterAuthUser) {
+      const userAvatar = useUserStore.getState().user?.avatar;
+
+      const lobeUser = {
+        // Preserve avatar from settings, don't override with auth provider value
+        avatar: userAvatar || '',
+        email: betterAuthUser.email,
+        fullName: betterAuthUser.fullName,
+        id: betterAuthUser.id,
+        username: betterAuthUser.name,
+      } as LobeUser;
+
+      // Update user data in store
+      useUserStore.setState({ user: lobeUser });
+      return;
+    }
+
+    // Clear user data when session becomes unavailable
+    useUserStore.setState({ user: undefined });
+  }, [betterAuthUser]);
+
+  return null;
+});
+
+export default UserUpdater;

package/src/layout/AuthProvider/BetterAuth/index.tsx

@@ -0,0 +1,14 @@
+import { PropsWithChildren } from 'react';
+
+import UserUpdater from './UserUpdater';
+
+const BetterAuth = ({ children }: PropsWithChildren) => {
+  return (
+    <>
+      {children}
+      <UserUpdater />
+    </>
+  );
+};
+
+export default BetterAuth;

package/src/layout/AuthProvider/index.tsx

@@ -3,6 +3,7 @@ import { PropsWithChildren } from 'react';
 import { isDesktop } from '@/const/version';
 import { authEnv } from '@/envs/auth';
 
+import BetterAuth from './BetterAuth';
 import Clerk from './Clerk';
 import { MarketAuthProvider } from './MarketAuth';
 import NextAuth from './NextAuth';
@@ -13,6 +14,8 @@ const AuthProvider = ({ children }: PropsWithChildren) => {
   let InnerAuthProvider;
   if (authEnv.NEXT_PUBLIC_ENABLE_CLERK_AUTH) {
     InnerAuthProvider = ({ children }: PropsWithChildren) => <Clerk>{children}</Clerk>;
+  } else if (authEnv.NEXT_PUBLIC_ENABLE_BETTER_AUTH) {
+    InnerAuthProvider = ({ children }: PropsWithChildren) => <BetterAuth>{children}</BetterAuth>;
   } else if (authEnv.NEXT_PUBLIC_ENABLE_NEXT_AUTH) {
     InnerAuthProvider = ({ children }: PropsWithChildren) => <NextAuth>{children}</NextAuth>;
   } else {

package/src/libs/better-auth/auth-client.ts

@@ -0,0 +1,34 @@
+import {
+  genericOAuthClient,
+  inferAdditionalFields,
+  magicLinkClient,
+} from 'better-auth/client/plugins';
+import { createAuthClient } from 'better-auth/react';
+
+import type { auth } from '@/auth';
+import { getAuthConfig } from '@/envs/auth';
+
+const { NEXT_PUBLIC_AUTH_URL } = getAuthConfig();
+const enableMagicLink = getAuthConfig().NEXT_PUBLIC_ENABLE_MAGIC_LINK;
+
+export const {
+  linkSocial,
+  accountInfo,
+  listAccounts,
+  requestPasswordReset,
+  resetPassword,
+  sendVerificationEmail,
+  signIn,
+  signOut,
+  signUp,
+  unlinkAccount,
+  useSession,
+} = createAuthClient({
+  /** The base URL of the server (optional if you're using the same domain) */
+  baseURL: NEXT_PUBLIC_AUTH_URL,
+  plugins: [
+    inferAdditionalFields<typeof auth>(),
+    genericOAuthClient(),
+    ...(enableMagicLink ? [magicLinkClient()] : []),
+  ],
+});