feat(auth): internal issued token

lib/auth.ts

@@ -3,8 +3,10 @@ import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { admin } from "better-auth/plugins";
 import { headers } from "next/headers";
+import { uuidv7 } from "uuidv7";
 import { db } from "$/db"; // your drizzle instance
 import * as schema from "$/db/schema";
+import { redis } from "./db/redis";
 
 export const auth = betterAuth({
   emailAndPassword: {
@@ -29,11 +31,26 @@ export async function adminCheck() {
 
   if (env.NO_AUTH_CHECK) return null;
 
+  const head = await headers();
+
+  const internalAuth = head.get("X-Internal-Auth");
+  if (internalAuth && (await redis!.get(`internalToken:${internalAuth}`)))
+    return {
+      email: "internal@localhost",
+      name: "[email protected]",
+    } satisfies Partial<typeof auth.$Infer.Session.user>;
+
   const session = await auth.api.getSession({
-    headers: await headers(),
+    headers: head,
   });
 
   // console.log(session);
 
   return session?.user.role === "admin" ? session.user : null;
 }
+
+export async function issueInternalToken() {
+  const token = uuidv7();
+  await redis!.setex(`internalToken:${token}`, 600, "valid");
+  return token;
+}