src/lib/auth.ts

import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import { drizzle } from 'drizzle-orm/postgres-js';
import postgres from 'postgres';
import * as schema from "./db/schema";

const pool = postgres(process.env.DIRECT_URL!, {
    ssl: 'require',
});
const authDb = drizzle(pool, {
    casing: 'snake_case',
});

export const auth = betterAuth({
    database: drizzleAdapter(authDb, {
        provider: "pg",
        schema: {
            user: schema.users,
            session: schema.sessions,
            account: schema.accounts,
            verification: schema.verifications,
        },
    }),
    account: {
        accountLinking: {
            enabled: true,
            trustedProviders: ["google"],
        },
        encryptOAuthTokens: false,
    },
    // Transitioning to Google-only authentication
    emailAndPassword: {
        enabled: false,
    },
    socialProviders: {
        google: {
            clientId: process.env.GOOGLE_CLIENT_ID || "",
            clientSecret: process.env.GOOGLE_CLIENT_SECRET || "",
            scope: ["https://www.googleapis.com/auth/youtube.readonly"],
        }
    },
    advanced: {
        useSecureCookies: process.env.NODE_ENV === "production", // Secure in prod, insecure in dev
    },
    trustedOrigins: [
        "http://localhost:3000",
        "http://127.0.0.1:3000",
        ...(process.env.BETTER_AUTH_URL ? [process.env.BETTER_AUTH_URL] : [])
    ],
    secret: process.env.BETTER_AUTH_SECRET || (process.env.CI ? "dummy_secret_for_ci_build" : undefined),
    baseURL: process.env.BETTER_AUTH_URL || (process.env.CI ? "http://localhost:3000" : undefined),
});