feat(auth): @mosaic/auth — BetterAuth email/password setup (#68)

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

packages/auth/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@mosaic/auth",
   "version": "0.0.0",
+  "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -16,7 +17,13 @@
     "test": "vitest run"
   },
   "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.0.0",
     "typescript": "^5.8.0",
     "vitest": "^2.0.0"
+  },
+  "dependencies": {
+    "@mosaic/db": "workspace:^",
+    "better-auth": "^1.5.5"
   }
 }

packages/auth/src/auth.ts

@@ -0,0 +1,42 @@
+import { betterAuth } from 'better-auth';
+import { drizzleAdapter } from 'better-auth/adapters/drizzle';
+import type { Db } from '@mosaic/db';
+
+export interface AuthConfig {
+  db: Db;
+  baseURL?: string;
+  secret?: string;
+}
+
+export function createAuth(config: AuthConfig) {
+  const { db, baseURL, secret } = config;
+
+  return betterAuth({
+    database: drizzleAdapter(db, {
+      provider: 'pg',
+      usePlural: true,
+    }),
+    baseURL: baseURL ?? process.env['BETTER_AUTH_URL'] ?? 'http://localhost:4000',
+    secret: secret ?? process.env['BETTER_AUTH_SECRET'],
+    basePath: '/api/auth',
+    emailAndPassword: {
+      enabled: true,
+    },
+    user: {
+      additionalFields: {
+        role: {
+          type: 'string',
+          required: false,
+          defaultValue: 'member',
+          input: false,
+        },
+      },
+    },
+    session: {
+      expiresIn: 60 * 60 * 24 * 7, // 7 days
+      updateAge: 60 * 60 * 24, // refresh daily
+    },
+  });
+}
+
+export type Auth = ReturnType<typeof createAuth>;

packages/auth/src/index.ts

@@ -1 +1 @@
-export const VERSION = '0.0.0';
+export { createAuth, type Auth, type AuthConfig } from './auth.js';