@lobehub/lobehub 2.0.0-next.125 → 2.0.0-next.127

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 # Changelog
 
+## [Version 2.0.0-next.127](https://github.com/lobehub/lobe-chat/compare/v2.0.0-next.126...v2.0.0-next.127)
+
+<sup>Released on **2025-11-27**</sup>
+
+#### 🐛 Bug Fixes
+
+- **misc**: Better-auth fallback next-auth providers env.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### What's fixed
+
+- **misc**: Better-auth fallback next-auth providers env, closes [#10459](https://github.com/lobehub/lobe-chat/issues/10459) ([e167075](https://github.com/lobehub/lobe-chat/commit/e167075))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
+## [Version 2.0.0-next.126](https://github.com/lobehub/lobe-chat/compare/v2.0.0-next.125...v2.0.0-next.126)
+
+<sup>Released on **2025-11-27**</sup>
+
+#### 🐛 Bug Fixes
+
+- **misc**: Align docker auth defaults and better-auth docs.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### What's fixed
+
+- **misc**: Align docker auth defaults and better-auth docs, closes [#10457](https://github.com/lobehub/lobe-chat/issues/10457) ([1375314](https://github.com/lobehub/lobe-chat/commit/1375314))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
 ## [Version 2.0.0-next.125](https://github.com/lobehub/lobe-chat/compare/v2.0.0-next.124...v2.0.0-next.125)
 
 <sup>Released on **2025-11-27**</sup>

package/Dockerfile

@@ -38,6 +38,7 @@ FROM base AS builder
 ARG USE_CN_MIRROR
 ARG NEXT_PUBLIC_BASE_PATH
 ARG NEXT_PUBLIC_ENABLE_BETTER_AUTH
+ARG NEXT_PUBLIC_ENABLE_NEXT_AUTH
 ARG NEXT_PUBLIC_ENABLE_CLERK_AUTH
 ARG NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY
 ARG NEXT_PUBLIC_SENTRY_DSN
@@ -52,7 +53,8 @@ ARG FEATURE_FLAGS
 ENV NEXT_PUBLIC_BASE_PATH="${NEXT_PUBLIC_BASE_PATH}" \
     FEATURE_FLAGS="${FEATURE_FLAGS}"
 
-ENV NEXT_PUBLIC_ENABLE_BETTER_AUTH="${NEXT_PUBLIC_ENABLE_BETTER_AUTH:-1}" \
+ENV NEXT_PUBLIC_ENABLE_BETTER_AUTH="${NEXT_PUBLIC_ENABLE_BETTER_AUTH:-0}" \
+    NEXT_PUBLIC_ENABLE_NEXT_AUTH="${NEXT_PUBLIC_ENABLE_NEXT_AUTH:-1}" \
     NEXT_PUBLIC_ENABLE_CLERK_AUTH="${NEXT_PUBLIC_ENABLE_CLERK_AUTH:-0}" \
     NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY="${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY}" \
     CLERK_WEBHOOK_SECRET="whsec_xxx" \

package/changelog/v1.json

@@ -1,4 +1,22 @@
 [
+  {
+    "children": {
+      "fixes": [
+        "Better-auth fallback next-auth providers env."
+      ]
+    },
+    "date": "2025-11-27",
+    "version": "2.0.0-next.127"
+  },
+  {
+    "children": {
+      "fixes": [
+        "Align docker auth defaults and better-auth docs."
+      ]
+    },
+    "date": "2025-11-27",
+    "version": "2.0.0-next.126"
+  },
   {
     "children": {
       "features": [

package/docs/self-hosting/advanced/auth.mdx

@@ -46,6 +46,13 @@ To enable Better Auth in LobeChat, set the following environment variables:
 | `NEXT_PUBLIC_AUTH_URL`           | Optional | The URL accessible from the browser for Better Auth callbacks. Only set this if the default generated URL is incorrect |
 | `AUTH_SSO_PROVIDERS`             | Optional | Comma-separated list of enabled SSO providers, e.g., `google,github,microsoft`                                         |
 
+<Callout type={'warning'}>
+  If you build/deploy with the official Docker image, the defaults keep **NextAuth enabled** and **Better
+  Auth disabled** (`NEXT_PUBLIC_ENABLE_NEXT_AUTH=1`, `NEXT_PUBLIC_ENABLE_BETTER_AUTH=0`) to avoid unexpected
+  login redirects. To switch to Better Auth, set both build args and runtime envs explicitly:
+  `NEXT_PUBLIC_ENABLE_BETTER_AUTH=1` and `NEXT_PUBLIC_ENABLE_NEXT_AUTH=0`, then rebuild the image.
+</Callout>
+
 ### Supported SSO Providers
 
 | Provider              | Value                   | Environment Variables                                                                                     |

package/docs/self-hosting/advanced/auth.zh-CN.mdx

@@ -44,6 +44,13 @@ LobeChat 与 Clerk 做了深度集成，能够为用户提供一个更加安全
 | `NEXT_PUBLIC_AUTH_URL`           | 可选 | 浏览器可访问的 Better Auth 回调 URL。仅在默认生成的 URL 不正确时设置    |
 | `AUTH_SSO_PROVIDERS`             | 可选 | 启用的 SSO 提供商列表，以逗号分隔，例如 `google,github,microsoft` |
 
+<Callout type={'warning'}>
+  若使用官方 Docker 镜像构建 / 部署，默认是 **开启 NextAuth、关闭 Better Auth**
+  （`NEXT_PUBLIC_ENABLE_NEXT_AUTH=1`、`NEXT_PUBLIC_ENABLE_BETTER_AUTH=0`），以避免意外跳转到新版登录页。
+  如果要切换到 Better Auth，请同时显式设置构建参数和运行时环境变量：
+  `NEXT_PUBLIC_ENABLE_BETTER_AUTH=1`、`NEXT_PUBLIC_ENABLE_NEXT_AUTH=0`，并重新构建镜像。
+</Callout>
+
 ### 支持的 SSO 提供商
 
 | 提供商                   | 值                       | 环境变量                                                                                                      |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/lobehub",
-  "version": "2.0.0-next.125",
+  "version": "2.0.0-next.127",
   "description": "LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application.",
   "keywords": [
     "framework",

package/src/envs/auth.test.ts

@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { getAuthConfig } from './auth';
+
+const ORIGINAL_ENV = { ...process.env };
+const ORIGINAL_WINDOW = globalThis.window;
+
+describe('getAuthConfig fallbacks', () => {
+  beforeEach(() => {
+    // reset env to a clean clone before each test
+    process.env = { ...ORIGINAL_ENV };
+    globalThis.window = ORIGINAL_WINDOW;
+  });
+
+  afterEach(() => {
+    process.env = { ...ORIGINAL_ENV };
+    globalThis.window = ORIGINAL_WINDOW;
+  });
+
+  it('should fall back to NEXT_AUTH_SSO_PROVIDERS when AUTH_SSO_PROVIDERS is empty string', () => {
+    process.env.AUTH_SSO_PROVIDERS = '';
+    process.env.NEXT_AUTH_SSO_PROVIDERS = 'logto,github';
+
+    // Simulate server runtime so @t3-oss/env treats this as server-side access
+    // (happy-dom sets window by default in Vitest)
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-expect-error - allow overriding for test
+    globalThis.window = undefined;
+
+    const config = getAuthConfig();
+
+    expect(config.AUTH_SSO_PROVIDERS).toBe('logto,github');
+  });
+
+  it('should fall back to NEXT_AUTH_SECRET when AUTH_SECRET is empty string', () => {
+    process.env.AUTH_SECRET = '';
+    process.env.NEXT_AUTH_SECRET = 'nextauth-secret';
+
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-expect-error - allow overriding for test
+    globalThis.window = undefined;
+
+    const config = getAuthConfig();
+
+    expect(config.AUTH_SECRET).toBe('nextauth-secret');
+  });
+
+  it('should fall back to NEXTAUTH_URL origin when NEXT_PUBLIC_AUTH_URL is empty string', () => {
+    process.env.NEXT_PUBLIC_AUTH_URL = '';
+    process.env.NEXTAUTH_URL = 'https://example.com/api/auth';
+
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-expect-error - allow overriding for test
+    globalThis.window = undefined;
+
+    const config = getAuthConfig();
+
+    expect(config.NEXT_PUBLIC_AUTH_URL).toBe('https://example.com');
+  });
+});

package/src/envs/auth.ts

@@ -237,14 +237,14 @@ export const getAuthConfig = () => {
       NEXT_PUBLIC_ENABLE_BETTER_AUTH: process.env.NEXT_PUBLIC_ENABLE_BETTER_AUTH === '1',
       // Fallback to NEXTAUTH_URL origin for seamless migration from next-auth
       NEXT_PUBLIC_AUTH_URL:
-        process.env.NEXT_PUBLIC_AUTH_URL ??
+        process.env.NEXT_PUBLIC_AUTH_URL ||
         (process.env.NEXTAUTH_URL ? new URL(process.env.NEXTAUTH_URL).origin : undefined),
       NEXT_PUBLIC_AUTH_EMAIL_VERIFICATION: process.env.NEXT_PUBLIC_AUTH_EMAIL_VERIFICATION === '1',
       NEXT_PUBLIC_ENABLE_MAGIC_LINK: process.env.NEXT_PUBLIC_ENABLE_MAGIC_LINK === '1',
       // Fallback to NEXT_AUTH_SECRET for seamless migration from next-auth
-      AUTH_SECRET: process.env.AUTH_SECRET ?? process.env.NEXT_AUTH_SECRET,
+      AUTH_SECRET: process.env.AUTH_SECRET || process.env.NEXT_AUTH_SECRET,
       // Fallback to NEXT_AUTH_SSO_PROVIDERS for seamless migration from next-auth
-      AUTH_SSO_PROVIDERS: process.env.AUTH_SSO_PROVIDERS ?? process.env.NEXT_AUTH_SSO_PROVIDERS,
+      AUTH_SSO_PROVIDERS: process.env.AUTH_SSO_PROVIDERS || process.env.NEXT_AUTH_SSO_PROVIDERS,
 
       // better-auth env for Cognito provider is different from next-auth's one
       AUTH_COGNITO_DOMAIN: process.env.AUTH_COGNITO_DOMAIN,