feat(deploy) : serve sudloh.com alongside guide.sudloh.com

lib/auth/server.test.ts

@@ -11,7 +11,7 @@ vi.mock("better-auth/plugins", () => ({ admin: (options: unknown) => options,
   captcha: (options: unknown) => ({ id: "captcha", options }),
   emailOTP: (options: unknown) => ({ id: "email-otp", options }) }));
 
-const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET", "TURNSTILE_SECRET_KEY", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "TRUSTED_CLIENT_IP_HEADER"] as const;
+const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_TRUSTED_ORIGINS", "BETTER_AUTH_SECRET", "GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET", "TURNSTILE_SECRET_KEY", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "TRUSTED_CLIENT_IP_HEADER"] as const;
 const testEnv = process.env as Record<string, string | undefined>;
 const originalEnv = envNames.map((name) => testEnv[name]);
 
@@ -27,6 +27,7 @@ beforeEach(() => {
   mocks.auth.mockReturnValue({ api: { getSession: mocks.session } });
   mocks.session.mockResolvedValue(null);
   delete testEnv.TRUSTED_CLIENT_IP_HEADER;
+  delete testEnv.BETTER_AUTH_TRUSTED_ORIGINS;
 });
 afterEach(() => {
   envNames.forEach((name, index) => {
@@ -37,6 +38,19 @@ afterEach(() => {
 });
 
 describe("actual administrator session boundary", () => {
+  it("resolves auth callbacks on either configured production host", async () => {
+    testEnv.BETTER_AUTH_URL = "https://guide.sudloh.com";
+    testEnv.BETTER_AUTH_TRUSTED_ORIGINS = "https://guide.sudloh.com, https://sudloh.com";
+    (await import("./server")).getAuth();
+    const options = mocks.auth.mock.calls.at(-1)![0];
+    expect(options.baseURL).toEqual({
+      allowedHosts: ["guide.sudloh.com", "guide.sudloh.com", "sudloh.com"],
+      fallback: "https://guide.sudloh.com",
+      protocol: "https",
+    });
+    expect(options.trustedOrigins).toEqual(["https://guide.sudloh.com", "https://sudloh.com"]);
+  });
+
   it("does not grant access when the old demo flag is enabled", async () => {
     testEnv.BUZZ_DEMO_MODE = "true";
     const { getAdminSession, requireAdmin } = await import("./server");

lib/auth/server.ts

@@ -47,6 +47,9 @@ function hasAuthConfiguration(): boolean {
 
 function createAuth() {
   const google = googleCredentials();
+  const baseURL = required("BETTER_AUTH_URL");
+  const trustedOrigins = process.env.BETTER_AUTH_TRUSTED_ORIGINS
+    ?.split(",").map((origin) => origin.trim()).filter(Boolean);
   return betterAuth({
     appName: "Buzz Guide",
     database: drizzleAdapter(getDb(), {
@@ -59,11 +62,12 @@ function createAuth() {
       },
       transaction: true,
     }),
-    baseURL: required("BETTER_AUTH_URL"),
-    trustedOrigins: process.env.BETTER_AUTH_TRUSTED_ORIGINS
-      ?.split(",")
-      .map((origin) => origin.trim())
-      .filter(Boolean),
+    baseURL: trustedOrigins?.length ? {
+      allowedHosts: [baseURL, ...trustedOrigins].map((origin) => new URL(origin).host),
+      fallback: baseURL,
+      protocol: new URL(baseURL).protocol === "https:" ? "https" : "http",
+    } : baseURL,
+    trustedOrigins,
     secret: required("BETTER_AUTH_SECRET"),
     socialProviders: google ? { google } : undefined,
     account: {