Function resolveAuthProviders

apps/host-selfhost/src/auth/index.ts:44–91

(
  dbHandle: SelfHostDbHandle,
)

}

export const resolveAuthProviders = async (
  dbHandle: SelfHostDbHandle,
): Promise<ResolvedAuthProviders> => {
  const betterAuth = await buildBetterAuth(dbHandle.client);
  const betterAuthLayer = Layer.succeed(BetterAuth)(betterAuth);

  // The consent redirect from Better Auth's authorize only carries the opaque
  // client_id; look the registered client_name up (its adapter sees the
  // just-written DCR row) so the approval screen reads "Connect Codex?" not a
  // random id. Self-declared at open DCR — a label, not a trust signal.
  const lookupClientName = async (clientId: string): Promise<string | null> => {
    const ctx = await betterAuth.auth.$context;
    const app = await ctx.adapter.findOne<{ name?: string | null }>({
      model: "oauthApplication",
      where: [{ field: "clientId", value: clientId }],
    });
    return app?.name ?? null;
  };

  // Force the MCP approval screen: inject `prompt=consent` on every MCP
  // authorize so a connecting client is gated on /mcp-consent rather than
  // silently granted a token (see ./force-mcp-consent), and enrich the
  // resulting consent redirect with the registered client name.
  const config = loadConfig();
  const authHandler = async (request: Request): Promise<Response> => {
    const response = await betterAuth.handler(withForcedMcpConsent(request));
    // Turn Better Auth's bare 403 "Invalid origin" into a setup instruction —
    // on a fresh deploy it almost always means the public URL needs configuring.
    const friendlier = await rewriteInvalidOrigin(request, response, config.webBaseUrl);
    if (friendlier) return friendlier;
    if (response.status !== 302) return response;
    const clientId = consentRedirectClientId(response.headers.get("location"));
    if (!clientId) return response;
    const name = await lookupClientName(clientId);
    if (!name) return response;
    // Preserve the rest of the response — notably the signed consent cookie.
    const headers = new Headers(response.headers);
    headers.set("location", withClientName(response.headers.get("location")!, name));
    return new Response(null, { status: 302, headers });
  };

  return {
    identityLayer: betterAuthIdentityLayer.pipe(Layer.provide(betterAuthLayer)),
    memberDirectoryLayer: betterAuthMemberDirectoryLayer.pipe(Layer.provide(betterAuthLayer)),
    authHandler,
    betterAuth,
  };
};