Better Auth

# Database
DATABASE_URL=postgresql://user:password@localhost:5432/dbname

# Better Auth
BETTER_AUTH_SECRET=your-secret-key-min-32-chars-generate-with-openssl-rand-base64-32
BETTER_AUTH_URL=http://localhost:3000

# Frontend URL (if separate from backend)
NEXT_PUBLIC_BETTER_AUTH_URL=http://localhost:3000

# GitHub OAuth
AUTH_GITHUB_CLIENT_ID=your_github_client_id
AUTH_GITHUB_CLIENT_SECRET=your_github_client_secret

# Google OAuth
AUTH_GOOGLE_CLIENT_ID=your_google_client_id
AUTH_GOOGLE_CLIENT_SECRET=your_google_client_secret

# Microsoft OAuth
AUTH_MICROSOFT_CLIENT_ID=your_microsoft_client_id
AUTH_MICROSOFT_CLIENT_SECRET=your_microsoft_client_secret
AUTH_MICROSOFT_TENANT_ID=common

# Facebook OAuth
AUTH_FACEBOOK_CLIENT_ID=your_facebook_client_id
AUTH_FACEBOOK_CLIENT_SECRET=your_facebook_client_secret

# Discord OAuth
AUTH_DISCORD_CLIENT_ID=your_discord_client_id
AUTH_DISCORD_CLIENT_SECRET=your_discord_client_secret

# LinkedIn OAuth
AUTH_LINKEDIN_CLIENT_ID=your_linkedin_client_id
AUTH_LINKEDIN_CLIENT_SECRET=your_linkedin_client_secret

# Apple Sign In
AUTH_APPLE_CLIENT_ID=your_apple_client_id
AUTH_APPLE_CLIENT_SECRET=your_apple_client_secret
AUTH_APPLE_KEY_ID=your_apple_key_id
AUTH_APPLE_TEAM_ID=your_apple_team_id

# Email Configuration (for magic links and verification)
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=your-smtp-user
SMTP_PASSWORD=your-smtp-password
SMTP_FROM=noreply@example.com
SMTP_FROM_NAME=Your App Name

# Redis (for session storage in production)
REDIS_URL=redis://localhost:6379

# Session Configuration
SESSION_EXPIRY=604800 # 7 days in seconds

# 2FA Configuration
TWO_FACTOR_ISSUER=YourApp

# Organization Configuration
ORGANIZATION_ENABLED=true

# Rate Limiting
RATE_LIMIT_MAX=100
RATE_LIMIT_WINDOW=900000 # 15 minutes in ms


import {
  Controller,
  Post,
  Body,
  Get,
  Req,
  UseGuards,
  HttpCode,
  HttpStatus,
} from '@nestjs/common';
import { AuthService } from './auth.service';
import { AuthGuard } from './auth.guard';

@Controller('auth')
export class AuthController {
  constructor(private authService: AuthService) {}

  @Get('session')
  @HttpCode(HttpStatus.OK)
  async getSession(@Req() req) {
    const token = req.headers.authorization?.replace('Bearer ', '');
    return this.authService.getSession(token);
  }

  @Post('sign-out')
  @UseGuards(AuthGuard)
  @HttpCode(HttpStatus.OK)
  async signOut(@Req() req) {
    // Requires authentication to prevent session enumeration attacks
    return this.authService.revokeSession(req.session.sessionToken);
  }

  @Get('sessions')
  @UseGuards(AuthGuard)
  async getSessions(@Req() req) {
    return this.authService.getUserSessions(req.user.id);
  }

  @Post('sessions/revoke-all')
  @UseGuards(AuthGuard)
  @HttpCode(HttpStatus.OK)
  async revokeAll(@Req() req) {
    return this.authService.revokeAllSessions(req.user.id);
  }

  @Post('verify-email')
  @HttpCode(HttpStatus.OK)
  async sendVerificationEmail(@Body() body: { email: string }) {
    return this.authService.sendVerificationEmail(body.email);
  }

  @Post('reset-password')
  @HttpCode(HttpStatus.OK)
  async resetPassword(
    @Body() body: { token: string; newPassword: string }
  ) {
    // IMPORTANT: Token must be a cryptographically secure random string
    // sent to the user's email address via a forgot-password flow
    return this.authService.resetPassword(body.token, body.newPassword);
  }
}


import {
  Injectable,
  CanActivate,
  ExecutionContext,
  UnauthorizedException,
} from '@nestjs/common';
import { auth } from './auth.instance';

@Injectable()
export class AuthGuard implements CanActivate {
  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();
    const token = request.headers.authorization?.replace('Bearer ', '');

    if (!token) {
      throw new UnauthorizedException('No token provided');
    }

    const session = await auth.api.getSession({
      headers: new Headers({
        authorizati