Auth Configuration

1. The Specialized Auth Bounded Context

The auth Bounded Context is a specialized module. Unlike standard 4-layer DDD modules, it acts strictly as an infrastructural bridge wrapping the Better Auth library. You MUST adhere to the following file responsibilities:

Server Configuration (
auth.ts
): The single source of truth for the Server Configuration (adapters, plugins, session logic).
Client Configuration (
auth-client.ts
): The Client Configuration. Exports
```
createAuthClient
```
for use in
```
"use client"
```
components to invoke sign-in flows (e.g.,
```
signIn.magicLink
```
).
Session Wrapper (
getSession.ts
): A wrapper utility that bridges the session to Domain Use Cases, preventing direct dependencies on Next.js headers inside the Domain.
UI Components: UI components exclusive to authentication (Login views, magic link forms).
Email Templates: React Email templates used for outbound transactional emails.

2. Server Configuration Rules (

auth.ts

)

When modifying

auth.ts

, you MUST follow these constraints:

Drizzle Adapter: The
```
drizzleAdapter
```
MUST be used. It MUST map to the PostgreSQL schema via
```
src/shared/infrastructure/postgres/schema.ts
```
(or
```
drizzle-postgres/
```
as configured).

UUID Generation: Because this project enforces strict Domain-Driven Design (DDD) using UUIDv7 as identity primitives, you MUST override the default random string generation in Better Auth.

typescript

advanced: {
  generateId: false, // Let Postgres/Drizzle default generate the UUIDv7
}
// or if strictly handled within the library:
advanced: {
  database: {
    generateId: "uuid", // Assuming standard UUID mapping
  }
}

Environment Variables: All secret keys (e.g.,
```
GOOGLE_CLIENT_ID
```
,
```
RESEND_API_KEY
```
) MUST be imported directly from
```
src/shared/infrastructure/load-env.ts
```
. You MUST NOT use
```
process.env
```
.
Plugins: For passwordless entry, use the
```
magicLink
```
and
```
emailOTP
```
plugins.

3. Email Infrastructure (Resend &

react-email

)

You MUST NOT use the library's default basic email sender logic.

Both
```
magicLink
```
and
```
emailOTP
```
plugins MUST be configured to use Resend.
The
```
resend
```
instance MUST be imported from the centralized service container.
The email HTML bodies MUST be generated using React components. You MUST NOT write raw HTML string templates inside
```
auth.ts
```
.
Dependencies: You MUST use the
```
@react-email/components
```
library (which includes components like
```
<Html>
```
,
```
<Head>
```
,
```
<Button>
```
) to build these templates safely. The templates are rendered to static markup before being sent via Resend.

4. OAuth Providers (Google Login)

When setting up Google authentication or other social providers:

You MUST fetch and read the official documentation at
```
https://better-auth.com/docs/authentication/google
```
to understand the setup process.
You MUST provide the user with clear, step-by-step instructions on how to configure the Google Cloud Console (OAuth consent screen, Authorized JavaScript origins, and Redirect URIs).
You MUST ask the user to obtain the
```
GOOGLE_CLIENT_ID
```
and
```
GOOGLE_CLIENT_SECRET
```
and add them to their
```
.env
```
file, ensuring they are also strictly managed via
```
src/shared/infrastructure/load-env.ts
```
.

5. Retrieving Auth State in Next.js

In Server Actions

You MUST protect Server Actions. Obtaining the user session MUST be the very first operation inside the action.

typescript

import { auth } from "@/auth/auth";
import { headers } from "next/headers";

// Inside the server action
const session = await auth.api.getSession({ headers: await headers() });
if (!session) {
  return { success: false, error: "UNAUTHORIZED" };
}

In Server Components

Server Components can fetch the session the same way to dictate layout logic or pass user data down the tree.

typescript

import { auth } from "@/auth/auth";
import { headers } from "next/headers";

const session = await auth.api.getSession({ headers: await headers() });

In Client Components

Client components MUST use hooks generated by

auth-client.ts

(e.g.,

useSession()

) if they need reactive auth state.

6. Bridging Auth to Use Cases

Domain Use Cases MUST NOT know about

Better Auth

, HTTP headers, or Next.js. Any Use Case requiring the current user's ID MUST receive it as part of its isolated

Params

payload.

The Server Action acts as the adapter:

Server Action calls
```
auth.api.getSession()
```
.
Extracts
```
session.user.id
```
.

Passes the ID standardly via

serviceContainer.module.useCase.execute({ userId: session.user.id, ...params })

7. References

For practical examples, you MUST refer to:

Auth Reference: A complete reference showing how the the
```
drizzleAdapter
```
, schemas, Resend integration, and
```
magicLink
```
/
```
emailOTP
```
plugins are combined following these strict rules.

auth

NPX Install

Tags

SKILL.md Content

Auth Configuration

1. The Specialized Auth Bounded Context

2. Server Configuration Rules (
`auth.ts`
)

3. Email Infrastructure (Resend &
`react-email`
)

4. OAuth Providers (Google Login)

5. Retrieving Auth State in Next.js

In Server Actions

In Server Components

In Client Components

6. Bridging Auth to Use Cases

7. References

auth

NPX Install

Tags

SKILL.md Content

Auth Configuration

1. The Specialized Auth Bounded Context

2. Server Configuration Rules (auth.ts)

3. Email Infrastructure (Resend & react-email)

4. OAuth Providers (Google Login)

5. Retrieving Auth State in Next.js

In Server Actions

In Server Components

In Client Components

6. Bridging Auth to Use Cases

7. References

2. Server Configuration Rules (
`auth.ts`
)

3. Email Infrastructure (Resend &
`react-email`
)