Description
Remove Better Auth entirely — dashboard is migrating to WorkOS.
Better Auth removal (-2,477 lines):
- Delete
better_auth/ module (instance, dbUtils, plugins, hooks)
- Delete
auth/dash/ routes (catch-all, OAuth metadata, dev_login)
- Delete
refresh_token_grace_period (Better Auth only)
- Remove
BETTER_AUTH_* env vars, dependencies, patches, error codes
- Replace
DB_BETTER_AUTH_FIND/UPDATE with direct Prisma queries in session/info, session/metadata, admin/users/update_metadata
- Remove Better Auth session detection from
resume_marketplace_install
WorkOS JWT auth (+519 lines):
workos_auth.ts — validates JWT via JWKS, checks client_id claim (WorkOS tokens don't use aud)
jwt_auth.ts — makes audience optional in verifier config
authMiddleware.ts — adds getAuthInfoFromWorkosJwt + dashboard proxy path
- New
resolve_user endpoint (v3.1) — verifies WorkOS token, creates user on first login
vercelHandler.ts — strips /internal-dashboard/ prefix from rewritten URLs
addAuthInfo.ts — logs auth_source in telemetry spans
How did I test this PR
- Local dev server with WorkOS access tokens against
/api/v3.1/auth/workos/resolve_user
- Verified JWT signature validation against WorkOS JWKS endpoint
- Verified
client_id claim validation
- Verified user creation flow via
getOrCreateUserWDefaultOrg
- Confirmed all Better Auth references removed via grep
🤖 Generated with Claude Code