feat(platform): replace Supabase Auth with Better Auth - #13330

Merged

ntindle merged 85 commits into

devfrom

better-auth-migration

Jul 30, 2026

Commits on Jun 10, 2026

feat(backend): support JWKS-based JWT validation and drop Supabase service deps

ntindle
and
claude
committed
43c7ae6
feat(platform): replace Supabase auth with Better Auth embedded in the frontend

ntindle
and
claude
committed
39d47f3
ci+docs(platform): provision plain Postgres in CI and update docs for Better Auth

ntindle
and
claude
committed
98d74b5
chore: remove stray vitest cache committed from repo root

ntindle
and
claude
committed
24a7e78
fix(frontend): keep Better Auth server code out of client bundles

ntindle
and
claude
committed
6a3645f
fix(platform): address review findings on Better Auth migration

ntindle
and
claude
committed
3980bb0
test(frontend): cover the Better Auth module (actions, config, email, helpers, bridge)

ntindle
and
claude
committed
fbfc4cd
fix(backend): auto-create marketplace Profile in get_or_create_user

ntindle
and
claude
committed
2315e5f
fix(backend): tolerate concurrent default-profile creation

ntindle
and
claude
committed
0e34f2f
fix(frontend): fail auth flows when production SMTP is unconfigured

ntindle
and
claude
committed
e8980ed
fix(backend): upsert test-fixture profiles now that get_or_create_user creates one

ntindle
and
claude
committed
f147790
test(frontend): unit-cover auth flow actions and routes

ntindle
and
claude
committed
6deb6ac
fix(backend): distinguish username collisions from concurrent profile creation

ntindle
and
claude
committed
498a3ae
fix(frontend): roll back the auth session when post-login provisioning fails

ntindle
and
claude
committed
177e8f2
test(frontend): cover rollbackSession

ntindle
and
claude
committed
258ac54
fix(frontend): enable Better Auth email change for the settings page

ntindle
and
claude
committed
5d0c369
refactor(libs): drop dead Supabase module and unused dependencies

ntindle
and
claude
committed
d0e6267
docs(platform): align setup docs with the Better Auth stack

ntindle
and
claude
committed
e52f1a2

Commits on Jun 16, 2026

merge: origin/dev into better-auth-migration

ntindle
and
claude
committed
98230ee
fix(libs): validate JWKS URL format and rekey the client on URL change

ntindle
and
claude
committed
e4f92da
merge: origin/dev into better-auth-migration (catch up)
ntindle
committed
0ec3867

Commits on Jun 18, 2026

feat(frontend): env-driven signup gating (allow-new-accounts + allowlist)

ntindle
and
claude
committed
791ff21

Commits on Jun 27, 2026

merge: origin/dev into better-auth-migration (catch up)

ntindle
and
claude
committed
fbd7b83

Commits on Jul 2, 2026

merge: origin/dev into better-auth-migration (catch up)

ntindle
and
claude
committed
fa8abe3
fix(frontend): bump nodemailer 9.0.1 + vitest 4.1.9 to clear Snyk vulns

ntindle
and
claude
committed
4a09fde
fix(frontend): revert vitest bump, keep nodemailer 9.0.1

ntindle
and
claude
committed
6a316c0

Commits on Jul 5, 2026

Commits on Jul 9, 2026

merge: origin/dev into better-auth-migration (catch up)

ntindle
and
claude
committed
c1bd2be
fix(backend): align user.py profile provisioning with dev (de-dup merge)

ntindle
and
claude
committed
f1550db

Commits on Jul 10, 2026

fix(frontend): logout now clears __Secure- cookies over HTTPS

ntindle
and
claude
committed
c8724a6

Commits on Jul 11, 2026

feat(platform): route Better Auth emails through the backend mailer

ntindle
and
claude
committed
4131f1c
refactor(platform): auth emails via JWKS service tokens, drop AUTH_EMAIL_TOKEN

ntindle
and
claude
committed
a773edb
refactor(backend): forward auth emails to the notification service

ntindle
and
claude
committed
7309eca
Merge remote-tracking branch 'origin/dev' into better-auth-migration
ntindle
committed
32c90a8
fix(frontend): port merged tour-sidebar auth check to useAuth + sync openapi.json

ntindle
and
claude
committed
bb12e72

Commits on Jul 14, 2026

Merge remote-tracking branch 'origin/dev' into better-auth-migration
ntindle
committed
b59eee1
fix(backend): regenerate poetry.lock with poetry 2.2.1 to match CI

ntindle
and
claude
committed
a62e9f6

Commits on Jul 17, 2026

Merge remote-tracking branch 'origin/dev' into better-auth-migration
ntindle
committed
b9af56e
fix(frontend): port EmptySession helpers test off @supabase/supabase-js

ntindle
and
claude
committed
7d0e7ac
ci(platform): fail e2e loudly when rest_server never becomes healthy

ntindle
and
claude
committed
bf998bd

Commits on Jul 22, 2026

Merge remote-tracking branch 'origin/dev' into better-auth-migration
ntindle
committed
cf8292c
fix(backend): address review — PII, HTML escaping, event-loop, LD cache

ntindle
and
claude
committed
aa6a899
test(frontend): fix duplicate signup/callback tests broken by the dev merge

ntindle
and
claude
committed
7a1683b

Commits on Jul 23, 2026

fix(frontend): close OAuth-callback open redirect + review correctness bugs

ntindle
and
claude
committed
c40dbb4
refactor(backend): trusted-origin allowlist for auth-email links (drop *.vercel.app blanket)

ntindle
and
claude
committed
9795f28
fix(frontend): enforce 12-char password floor and converge platform email to verified identity

ntindle
and
claude
committed
0752b9f
fix(platform): address PR review — migration dedup, bridge hardening, waitlist detection, 2nd email divergence

ntindle
and
claude
committed
86aa33b
fix(platform): address PR review — OAuth rollback, admin fail-closed, double reset email

ntindle
and
claude
committed
d30a09f
docs(platform): document JWKS transport-security caveat for self-hosters

ntindle
and
claude
committed
b5a778f
fix(backend/auth): require JWT_JWKS_URL; JWT_VERIFY_KEY now optional

ntindle
and
claude
committed
0b2c071

Commits on Jul 24, 2026

fix(backend/auth): repair autogpt_libs auth test suite + run it in CI

ntindle
and
claude
committed
320d404
fix(frontend): mint backend JWT in-process to fix Copilot infinite-load + add proxy/stream/middleware timeouts

ntindle
and
claude
committed
c149745
fix(backend): route feature-flag AuthUser lookup through DatabaseManager RPC when Prisma isn't locally connected

ntindle
and
claude
committed
a7bf870
fix(frontend): restore change-email confirmation to the current address (anti-takeover)

ntindle
and
claude
committed
39e09db
fix(backend/auth): warn on cleartext JWKS transport; clarify config errors

ntindle
and
claude
committed
6461b39
refactor(backend): group Better Auth models and mark updatedAt columns

ntindle
and
claude
committed
3c6540c
refactor(frontend): de-duplicate JWKS alg and callback tests; clarify auth route name

ntindle
and
claude
committed
8cefacd
ci+docs(platform): pin Postgres to 15 to match prod; fix upgrade guide

ntindle
and
claude
committed
3771a29
refactor(backend): mount auth-email under /api/auth/email and name its operation

ntindle
and
claude
committed
03e1c98
docs(frontend): name the built-in OAuth exchange in the callback route comment

ntindle
and
claude
committed
6e621f1
refactor(backend): use the db_accessors user_db() helper for the feature-flag lookup

ntindle
and
claude
committed
7ae417f
Merge branch 'dev' into better-auth-migration
ntindle
authored
a0b4fa8
fix(backend/auth): declare httpx so the autogpt_libs test suite installs cleanly

ntindle
and
claude
committed
09e291b
fix(frontend): bound the SSR auth-token self-fetch; untrack Supabase CLI artifact

ntindle
and
claude
committed
d1fc1e7
fix(frontend): stop caching backend JWTs across requests so revocation takes effect

ntindle
and
claude
committed
3d557fc
fix(frontend): close backslash open-redirect in the auth ?next= guard

ntindle
and
claude
committed
65b1877
fix(backend/auth): keep the blocking JWKS fetch off the event loop

ntindle
and
claude
committed
4ab2d8a

Commits on Jul 25, 2026

fix(backend): normalize default ports and validate trusted-origin patterns

ntindle
and
claude
committed
52f09f1
fix(frontend): stop duplicate change-email sends, partial profile updates, and dev pool leak

ntindle
and
claude
committed
e3dd470
fix(backend/auth): treat a missing role claim as an ordinary user, not a 500

ntindle
and
claude
committed
5457440
fix(backend): point the websocket auth tests at the async token parser

ntindle
and
claude
committed
a8e510d
fix(frontend): don't consume the legacy cookie when the bridge can't verify it

ntindle
and
claude
committed
9b2f7f0

Commits on Jul 29, 2026

Merge remote-tracking branch 'origin/dev' into better-auth-migration
ntindle
committed
26955b1
refactor(backend): rename transactional-email senders; fix operationId and helper order

ntindle
and
claude
committed
9652ee8
fix(backend/auth): extend migration grace to legacy asymmetric tokens; warn when ES256 is excluded

ntindle
and
claude
committed
7c1cf66
fix(frontend): migrate Experts marketplace components off the removed useSupabase hook

ntindle
and
claude
committed
b2acffe
refactor(platform): rename Better Auth tables to UserAuth* for clarity

ntindle
and
claude
committed
b3ca9c8
fix(backend/auth): fail fast on unviable JWKS transport config

ntindle
and
claude
committed
6ccbaf5
fix(frontend): add tight response-start timeout to the API proxy

ntindle
and
claude
committed
6fec991
refactor(platform): reword review-flagged comments to be timeless and brief

ntindle
and
claude
committed
f62d7e7
fix(frontend): point direct-upload test mock at the moved getWebSocketToken module

ntindle
and
claude
committed
fe68654
fix(frontend): OAuth waitlist rejections now match on the gate's body message

ntindle
and
claude
committed
861fc90
fix(frontend): break legacy-cookie redirect loop when the bridge secret is unset

ntindle
and
claude
committed
ce0136f

Commits on Jul 30, 2026

Merge branch 'dev' into better-auth-migration
ntindle
authored
ffc0264