fix(auth): forward rotated refresh-token cookie automatically in getAuth - #21
Merged
Merged
Conversation
getAuth now forwards Better Auth's rotated (chunked) account cookie by default via TanStack Start's getResponseHeaders().append, instead of requiring every app to wire the forwardSetCookie hook. When the hook was omitted the browser kept replaying the pre-rotation refresh token; past the issuer's theft-detection grace window that tore down the token family, so token-derived data (organizations) came back empty until a full re-login. That is the "logged in long enough and the dashboard goes empty" bug, silently present in every app that forgot the hook. forwardSetCookie is retained as an optional override (non-TanStack hosts, custom behavior); when supplied it wins, so apps that already wire it are unaffected and there is no double-forward. The TanStack import is a lazy, optional runtime peer: a consumer without it that supplies no override keeps the prior no-op rather than crashing.
The post-build patch that strips Bun's injected top-level
`import { createRequire } from "node:module"` (and makes node:* lazy) ran
only on build/index.js. The per-domain `auth` entry is imported by apps'
SSR code and can land in their client graph, so once getAuth gained a
dynamic import Bun injected `createRequire` into build/auth/index.js and it
went unpatched, breaking consumers' `vite build`
("createRequire is not exported by __vite-browser-external", hit in runa).
Apply the existing patch to every node-target bundle via a shared helper.
…undlers
getAuth's lazy `import("@tanstack/react-start/server")` is server-only, but
apps that pull providers/auth into their client graph made Vite follow the
literal specifier into TanStack's SSR internals (node:stream / async_hooks)
and fail the browser build (hit in runa after the createRequire fix). The
post-build patch now rewrites the literal to an IIFE-returned specifier with
@vite-ignore, so bundlers cannot statically follow it; it stays a runtime
import that only executes on the server.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
getAuthnow forwards Better Auth's rotated (chunked) account cookie by default via TanStack Start'sgetResponseHeaders().append, instead of requiring every app to wire theforwardSetCookiehook.Why
When the hook was omitted, the browser kept replaying the pre-rotation refresh token. Past the issuer's theft-detection grace window, that tears down the whole token family, so every later refresh returns
invalid_grantand token-derived data (organizations) comes back empty until a full cookie-clearing re-login. This is the "logged in long enough and the dashboard goes empty / No workspaces yet" bug.It was silently present in 21 of 24 Omni apps that call
createGetAuth(only blink, fractal, herald wired the hook). Making forwarding the default means the per-app fix collapses to a providers version bump, and no future app can forget it.Design
forwardSetCookieis retained as an optional override (non-TanStack hosts, custom behavior). When supplied it wins, so the 3 apps that already wire it are unaffected and there is no double-forward.@tanstack/react-startadded to optionalpeerDependencies). A consumer without it that supplies no override keeps the prior no-op rather than crashing, so providers stays framework-agnostic.Tests
Set-Cookiechunk verbatim to the override.Rollout
After merge, repin
@omnidotdev/providersto the merged SHA across the 21 affected apps (version bump only, no per-app code change needed).