feat : update

lib/auth/server.test.ts

@@ -8,9 +8,10 @@ vi.mock("better-auth", () => ({ betterAuth: mocks.auth }));
 vi.mock("better-auth/adapters/drizzle", () => ({ drizzleAdapter: () => ({}) }));
 vi.mock("better-auth/next-js", () => ({ nextCookies: () => ({}) }));
 vi.mock("better-auth/plugins", () => ({ admin: (options: unknown) => options, captcha: () => ({}),
+  genericOAuth: (options: unknown) => ({ id: "generic-oauth", options }),
   emailOTP: (options: unknown) => ({ id: "email-otp", options }) }));
 
-const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "BUZZ_DEMO_MODE", "RESEND_API_KEY"] as const;
+const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "SUDLOH_OIDC_CLIENT_ID", "SUDLOH_OIDC_CLIENT_SECRET", "SUDLOH_OIDC_REDIRECT_URI", "SUDLOH_OIDC_ISSUER", "SUDLOH_OIDC_ONLY"] as const;
 const testEnv = process.env as Record<string, string | undefined>;
 const originalEnv = envNames.map((name) => testEnv[name]);
 
@@ -22,6 +23,11 @@ beforeEach(() => {
   testEnv.BETTER_AUTH_SECRET = "a-test-secret-with-more-than-32-characters";
   mocks.auth.mockReturnValue({ api: { getSession: mocks.session } });
   mocks.session.mockResolvedValue(null);
+  delete testEnv.SUDLOH_OIDC_CLIENT_ID;
+  delete testEnv.SUDLOH_OIDC_CLIENT_SECRET;
+  delete testEnv.SUDLOH_OIDC_REDIRECT_URI;
+  delete testEnv.SUDLOH_OIDC_ISSUER;
+  delete testEnv.SUDLOH_OIDC_ONLY;
 });
 afterEach(() => {
   envNames.forEach((name, index) => {
@@ -56,6 +62,45 @@ describe("actual administrator session boundary", () => {
     expect(options.rateLimit.customStorage.consume).toBeTypeOf("function");
     expect(options.databaseHooks).toBeUndefined();
   });
+  it("adds verified Sudloh sign-in while retaining email sign-in", async () => {
+    testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
+    testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
+    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
+    const { getAuth, isSudlohOidcEnabled } = await import("./server");
+    expect(isSudlohOidcEnabled()).toBe(true);
+    getAuth();
+    const options = mocks.auth.mock.calls.at(-1)![0];
+    expect(options.emailAndPassword).toMatchObject({ enabled: true, disableSignUp: false });
+    expect(options.account.accountLinking.disableImplicitLinking).toBe(true);
+    expect(options.account.accountLinking.enabled).not.toBe(false);
+    expect(options.plugins.some((plugin: { id?: string }) => plugin.id === "email-otp")).toBe(true);
+    expect(options.plugins.find((plugin: { id?: string }) => plugin.id === "generic-oauth").options.config[0]).toMatchObject({
+      providerId: "sudloh", authentication: "basic", requireIdTokenVerification: true,
+      requireEmailVerification: true, disableProviderLogout: true,
+      scopes: ["openid", "profile", "email"],
+      redirectURI: "https://guide.example.test/api/auth/callback/sudloh",
+    });
+  });
+  it("disables local sign-in after the OIDC cutover flag is set", async () => {
+    testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
+    testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
+    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
+    testEnv.SUDLOH_OIDC_ONLY = "true";
+    (await import("./server")).getAuth();
+    const options = mocks.auth.mock.calls.at(-1)![0];
+    expect(options.emailAndPassword).toMatchObject({ enabled: false, disableSignUp: true });
+    expect(options.plugins.some((plugin: { id?: string }) => plugin.id === "email-otp")).toBe(false);
+  });
+  it("rejects incomplete or mismatched Sudloh client configuration", async () => {
+    const { getAuth, isSudlohOidcEnabled } = await import("./server");
+    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
+    expect(isSudlohOidcEnabled()).toBe(false);
+    testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
+    expect(isSudlohOidcEnabled).toThrow("client ID, client secret, and exact redirect URI");
+    testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
+    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://wrong.example.test/api/auth/callback/sudloh";
+    expect(getAuth).toThrow("SUDLOH_OIDC_REDIRECT_URI must be");
+  });
   it("requires verification and sends auth links from the configured sender", async () => {
     testEnv.RESEND_API_KEY = "test-key";
     const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(null, { status: 200 }));