From bf3164fb2b4ee66dcb2a70b5fa19c779c9fe7900 Mon Sep 17 00:00:00 2001
From: imeepos <imeepos@outlook.com>
Date: Wed, 10 Jun 2026 03:26:42 -0700
Subject: [PATCH] test: cover better auth migration config

---
 src/auth.migration.ts     | 61 +++++++++++++++++++++++++++++++++++++++
 tests/auth-config.test.ts | 26 +++++++++++++++++
 2 files changed, 87 insertions(+)
 create mode 100644 src/auth.migration.ts

diff --git a/src/auth.migration.ts b/src/auth.migration.ts
new file mode 100644
index 0000000..a8fc173
--- /dev/null
+++ b/src/auth.migration.ts
@@ -0,0 +1,61 @@
+import { DatabaseSync } from "node:sqlite";
+import { passkey } from "@better-auth/passkey";
+import { betterAuth } from "better-auth";
+import type { BetterAuthPlugin } from "better-auth";
+import {
+  admin,
+  emailOTP,
+  haveIBeenPwned,
+  lastLoginMethod,
+  multiSession,
+  openAPI,
+  twoFactor,
+} from "better-auth/plugins";
+import { passwordPolicy } from "./password";
+
+const migrationBaseURL = "http://localhost:8788";
+
+export const migrationPlugins: BetterAuthPlugin[] = [
+  openAPI(),
+  haveIBeenPwned({
+    customPasswordCompromisedMessage: "This password has appeared in a data breach.",
+  }),
+  emailOTP({
+    otpLength: 6,
+    expiresIn: 300,
+    allowedAttempts: 3,
+    storeOTP: "hashed",
+    sendVerificationOnSignUp: true,
+    overrideDefaultEmailVerification: false,
+    sendVerificationOTP: async () => {},
+  }),
+  twoFactor(),
+  multiSession({ maximumSessions: 10 }),
+  lastLoginMethod({ storeInDatabase: true }),
+  admin(),
+  passkey({
+    rpID: "localhost",
+    rpName: "cfw-auth",
+    origin: migrationBaseURL,
+  }),
+];
+
+export const auth = betterAuth({
+  database: new DatabaseSync(":memory:"),
+  baseURL: migrationBaseURL,
+  secret: "migration-schema-generation-only",
+  emailAndPassword: {
+    enabled: true,
+    ...passwordPolicy,
+    requireEmailVerification: true,
+    revokeSessionsOnPasswordReset: true,
+  },
+  emailVerification: {
+    sendOnSignUp: true,
+    sendOnSignIn: true,
+    autoSignInAfterVerification: true,
+  },
+  plugins: migrationPlugins,
+});
+
+export default auth;
diff --git a/tests/auth-config.test.ts b/tests/auth-config.test.ts
index e38522a..f69d9dd 100644
--- a/tests/auth-config.test.ts
+++ b/tests/auth-config.test.ts
@@ -174,3 +174,29 @@ describe("passkey config", () => {
     expect(plugins.map((plugin) => plugin.id)).toContain("passkey");
   });
 });
+
+describe("Better Auth migration config", () => {
+  it("exports a static auth instance for the Better Auth CLI", async () => {
+    const module = await import("../src/auth.migration");
+    expect(module.auth).toBeDefined();
+    expect(module.default).toBe(module.auth);
+    expect(typeof module.auth.handler).toBe("function");
+  });
+
+  it("keeps schema-affecting plugins enabled for generated migrations", async () => {
+    const { migrationPlugins } = await import("../src/auth.migration");
+    const pluginIds = migrationPlugins.map((plugin) => plugin.id);
+
+    expect(pluginIds).toEqual(
+      expect.arrayContaining([
+        "open-api",
+        "email-otp",
+        "two-factor",
+        "multi-session",
+        "last-login-method",
+        "admin",
+        "passkey",
+      ]),
+    );
+  });
+});