create-vexcms 0.1.0-alpha.8 → 0.1.0-alpha.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-vexcms",
-  "version": "0.1.0-alpha.8",
+  "version": "0.1.0-alpha.9",
   "description": "Scaffold a new VexCMS project",
   "keywords": [
     "cms",

package/templates/base-nextjs/package.json

@@ -24,11 +24,11 @@
     "@t3-oss/env-nextjs": "0.13.11",
     "@tanstack/react-form": "1.33.1",
     "@tanstack/react-query": "5.101.2",
-    "@vexcms/better-auth": "~0.1.0-alpha.8",
-    "@vexcms/core": "~0.1.0-alpha.8",
-    "@vexcms/file-storage-convex": "~0.1.0-alpha.8",
-    "@vexcms/next": "~0.1.0-alpha.8",
-    "@vexcms/react": "~0.1.0-alpha.8",
+    "@vexcms/better-auth": "~0.1.0-alpha.9",
+    "@vexcms/core": "~0.1.0-alpha.9",
+    "@vexcms/file-storage-convex": "~0.1.0-alpha.9",
+    "@vexcms/next": "~0.1.0-alpha.9",
+    "@vexcms/react": "~0.1.0-alpha.9",
     "better-auth": "1.6.23",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
@@ -52,7 +52,7 @@
     "@types/node": "20.19.43",
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
-    "@vexcms/cli": "~0.1.0-alpha.8",
+    "@vexcms/cli": "~0.1.0-alpha.9",
     "babel-plugin-react-compiler": "1.0.0",
     "eslint": "9.39.5",
     "eslint-config-next": "15.5.9",

package/templates/base-nextjs/src/auth/serverUtils.ts

@@ -2,9 +2,23 @@ import { api } from "@convex/_generated/api"
 import { fetchQuery } from "convex/nextjs"
 import { cookies } from "next/headers"
 
+const SESSION_COOKIE = "better-auth.session_token"
+
+/**
+ * Read the Better Auth session token from cookies.
+ *
+ * Better Auth prefixes its cookies with `__Secure-` whenever the resolved
+ * `baseURL` is https. Locally over http the cookie is
+ * `better-auth.session_token`; on a real domain it is
+ * `__Secure-better-auth.session_token`. Reading only the bare name works in
+ * development and silently returns `null` in production — no error, just an
+ * anonymous caller. Check the prefixed name first, as Better Auth's own reader
+ * does.
+ */
 export async function getSessionToken() {
   const cookieStore = await cookies()
-  const sessionTokenCookie = cookieStore.get("better-auth.session_token")?.value
+  const sessionTokenCookie =
+    cookieStore.get(`__Secure-${SESSION_COOKIE}`)?.value ?? cookieStore.get(SESSION_COOKIE)?.value
 
   if (!sessionTokenCookie) {return null}