Route Buzz Guide login through Sudloh Account

lib/auth/server.ts

@@ -3,7 +3,7 @@ import "server-only";
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { nextCookies } from "better-auth/next-js";
-import { admin, captcha, emailOTP } from "better-auth/plugins";
+import { admin, captcha, emailOTP, genericOAuth } from "better-auth/plugins";
 import { headers } from "next/headers";
 import { cache } from "react";
 
@@ -32,7 +32,25 @@ function hasAuthConfiguration(): boolean {
   );
 }
 
+export function isSudlohOidcEnabled(): boolean {
+  const clientId = process.env.SUDLOH_OIDC_CLIENT_ID;
+  const clientSecret = process.env.SUDLOH_OIDC_CLIENT_SECRET;
+  if (!clientId && !clientSecret) return false;
+  if (!clientId || !clientSecret || !process.env.SUDLOH_OIDC_REDIRECT_URI) {
+    throw new Error("Sudloh OIDC requires a client ID, client secret, and exact redirect URI.");
+  }
+  return true;
+}
+
 function createAuth() {
+  const oidcEnabled = isSudlohOidcEnabled();
+  const oidcOnly = oidcEnabled && process.env.SUDLOH_OIDC_ONLY === "true";
+  if (oidcEnabled) {
+    const callback = `${required("BETTER_AUTH_URL").replace(/\/$/, "")}/api/auth/callback/sudloh`;
+    if (process.env.SUDLOH_OIDC_REDIRECT_URI !== callback) {
+      throw new Error(`SUDLOH_OIDC_REDIRECT_URI must be ${callback}`);
+    }
+  }
   return betterAuth({
     appName: "Buzz Guide",
     database: drizzleAdapter(getDb(), {
@@ -52,8 +70,8 @@ function createAuth() {
       .filter(Boolean),
     secret: required("BETTER_AUTH_SECRET"),
     emailAndPassword: {
-      enabled: true,
-      disableSignUp: false,
+      enabled: !oidcOnly,
+      disableSignUp: oidcOnly,
       requireEmailVerification: true,
       minPasswordLength: 6,
       maxPasswordLength: 128,
@@ -70,6 +88,7 @@ function createAuth() {
         },
       },
     },
+    account: { accountLinking: { disableImplicitLinking: true } },
     emailVerification: {
       sendOnSignUp: false,
       autoSignInAfterVerification: true,
@@ -95,13 +114,25 @@ function createAuth() {
       },
     },
     plugins: [
-      emailOTP({
+      ...(oidcEnabled ? [genericOAuth({ config: [{
+        providerId: "sudloh",
+        clientId: process.env.SUDLOH_OIDC_CLIENT_ID!,
+        clientSecret: process.env.SUDLOH_OIDC_CLIENT_SECRET!,
+        redirectURI: process.env.SUDLOH_OIDC_REDIRECT_URI!,
+        discoveryUrl: `${(process.env.SUDLOH_OIDC_ISSUER || "https://account.sudloh.com/api/auth").replace(/\/$/, "")}/.well-known/openid-configuration`,
+        scopes: ["openid", "profile", "email"],
+        authentication: "basic",
+        requireIdTokenVerification: true,
+        requireEmailVerification: true,
+        disableProviderLogout: true,
+      }] })] : []),
+      ...(!oidcOnly ? [emailOTP({
         sendVerificationOnSignUp: true,
         storeOTP: "hashed",
         sendVerificationOTP: async ({ email, otp }) => {
           await sendAuthEmail(email, "รหัสยืนยัน Buzz Guide", `รหัสยืนยันอีเมลของคุณคือ ${otp}\n\nรหัสนี้หมดอายุใน 5 นาที`);
         },
-      }),
+      })] : []),
       ...(process.env.NODE_ENV === "development" ? [] : [
         captcha({
           provider: "cloudflare-turnstile",