feat(website): replace auth-astro with better-auth

[fhennig]

resolves #1189, #682, #1188

Summary

• Replaces auth-astro + @auth/core with better-auth, running in stateless mode (no database required, JWT-based sessions)
• Removes the custom patch (patches/auth-astro+4.2.0.patch) that was needed to fix TypeScript issues in auth-astro

Changes

• src/auth.ts (new) — better-auth config with GitHub OAuth provider
• src/pages/api/auth/[...all].ts (new) — catch-all route handling all auth requests
• src/middleware/authMiddleware.ts (new) — runs on every request, calls getSession once and populates Astro.locals
• src/backendApi/backendProxy.ts — reads context.locals.user?.githubId via APIContext
• src/components/auth/LoginButton.tsx — signIn('github', ...) → authClient.signIn.social({ provider: 'github', ... })
• src/auth/logout.ts — custom @auth/core logout → auth.api.signOut({ headers, asResponse: true })
• All pages updated to read from Astro.locals instead of calling auth.api.getSession directly
• astro.config.mjs — removed auth() Astro integration

GitHub user ID handling

better-auth's session.user.id is a randomly generated internal ID, not the GitHub numeric user ID. The backend uses the GitHub numeric ID for ownership checks (e.g. who can edit a collection).

The solution: user.additionalFields + mapProfileToUser in auth.ts store the GitHub numeric ID directly on the user object as githubId at login time:

user: {
    additionalFields: {
        githubId: { type: 'string', input: false }
    }
},
socialProviders: {
    github: {
        mapProfileToUser: (profile) => ({ githubId: String(profile.id) })
    }
}

String() is needed because profile.id from GitHub is a number, but the backend stores and compares user IDs as strings. Without the coercion, ownership checks fail due to type mismatch.

This means session.user.githubId is the GitHub numeric ID (as a string) everywhere — no secondary lookups needed. The auth middleware sets it on Astro.locals.user once per request, and all pages and the backend proxy read it from there.

E2E test cookie helper

tests/helpers/auth.ts provides createAuthCookies(accountPayload, sessionPayload) and setupAuthCookie(page, name) to craft valid better-auth session cookies for Playwright tests without a real OAuth flow. The cookies are signed/encrypted using the same AUTH_SECRET the server uses. cookieCache (JWE, 1hr) is enabled so getSession can validate the crafted session_data cookie without an in-memory store lookup.

New Cookies

better-auth sets 3 cookies. A session_token, session_data and account_data. Session data and account data are JWE, encrypted data.

Test plan

• Sign in with GitHub works end-to-end
• Logout works
• Ownership checks work correctly (edit/delete only available for your own collections)
• Protected pages (/collections, /subscriptions) show the login prompt when logged out
• E2E tests pass: npm run e2e

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboards	Ready	Preview, Comment	May 14, 2026 9:07am

[fengelniederhammer]

Found a few things, but looks good otherwise 👍

[fengelniederhammer]

LGTM 👍

[fengelniederhammer]

AI: 🔵 nit: Typo — "see not above" → "see note above".\n\nsuggestion\n user: AuthUser | null; // we use our own user type, see note above\n

[fengelniederhammer]

AI: 🔵 nit: Typo — "completly" → "completely".\n\nsuggestion\n // information is in a session cookie; the server is completely stateless.\n

[Copilot]

Pull request overview

Migrates the Astro website authentication stack from auth-astro/@auth/core to better-auth (stateless/JWT cookie cache), centralizing session resolution in middleware and updating UI/API code to consume Astro.locals.

Changes:

• Introduces better-auth configuration + catch-all auth API route, and adds an auth middleware that populates Astro.locals.
• Updates pages/components/backend proxy to read login state and GitHub numeric ID (githubId) from Astro.locals.user.
• Reworks Playwright E2E auth helper to craft valid better-auth cookies; removes the legacy auth-astro patch and integration wiring.

Reviewed changes

Copilot reviewed 28 out of 30 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
website/tests/helpers/auth.ts	Replaces AuthJS JWT cookie helper with better-auth cookie crafting utilities for E2E.
website/tests/collections/collectionForm.spec.ts	Aligns test user ID with E2E_GITHUB_ID.
website/src/pages/subscriptions/index.astro	Switches login check to Astro.locals.user.
website/src/pages/subscriptions/create.astro	Switches login check to Astro.locals.user.
website/src/pages/logout.astro	Uses better-auth sign-out response cookies via Set-Cookie headers.
website/src/pages/collections/[organism]/index.astro	Switches login check to Astro.locals.user.
website/src/pages/collections/[organism]/create.astro	Switches login check to Astro.locals.user.
website/src/pages/collections/[organism]/[id]/index.astro	Uses Astro.locals.user?.githubId for ownership/user context.
website/src/pages/collections/[organism]/[id]/edit.astro	Uses Astro.locals.user?.githubId for ownership checks and gating.
website/src/pages/api/auth/[...all].ts	Adds catch-all route delegating to auth.handler.
website/src/middleware/authMiddleware.ts	Adds middleware to resolve session once per request and populate locals.
website/src/middleware.ts	Wires auth middleware into global middleware sequence.
website/src/layouts/base/header/HamburgerMenu.astro	Uses Astro.locals.user for logged-in UI and username display.
website/src/env.d.ts	Defines App.Locals and a derived App.AuthUser type for locals.user.
website/src/config.ts	Adds trustedOrigins to config schema + accessor for better-auth.
website/src/components/auth/UserDropdown.astro	Changes props to accept user instead of session.
website/src/components/auth/LoginState.astro	Uses Astro.locals.user and passes user to dropdown.
website/src/components/auth/LoginButton.tsx	Replaces auth-astro client signIn with better-auth client social sign-in.
website/src/backendApi/backendProxy.ts	Reads context.locals.user?.githubId instead of calling getSession.
website/src/auth/logout.ts	Replaces custom AuthJS signout request with auth.api.signOut.
website/src/auth.ts	Adds better-auth configuration including githubId mapping + cookie cache.
website/src/auth.config.mjs	Removes legacy auth-astro config file.
website/README.md	Documents AUTH_SECRET env var for better-auth.
website/patches/auth-astro+4.2.0.patch	Removes no-longer-needed patch-package patch for auth-astro.
website/package.json	Removes auth-astro/@auth/core, adds better-auth, removes postinstall patch step.
website/package-lock.json	Lockfile updates reflecting dependency migration.
website/astro.config.mjs	Removes auth-astro integration.
Dockerfile_website	Stops copying patches; continues copying backend config resources to /config.
backend/src/main/resources/application-dashboards-staging.yaml	Adds dashboards.auth.trustedOrigins for staging.
backend/src/main/resources/application-dashboards-prod.yaml	Adds dashboards.auth.trustedOrigins for prod.

Files not reviewed (1)

• website/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.