114 lines
2.5 KiB
Markdown
114 lines
2.5 KiB
Markdown
# cfw-auth account center operations
|
|
|
|
## Local development
|
|
|
|
Install dependencies once:
|
|
|
|
```bash
|
|
pnpm install
|
|
```
|
|
|
|
Apply local D1 migrations:
|
|
|
|
```bash
|
|
pnpm db:apply:local
|
|
```
|
|
|
|
Start the Worker:
|
|
|
|
```bash
|
|
pnpm dev
|
|
```
|
|
|
|
Wrangler may choose `http://localhost:8787` by default. If that port is already in use, start it on the auth base URL configured in `wrangler.jsonc`:
|
|
|
|
```bash
|
|
pnpm exec wrangler dev --port 8788
|
|
```
|
|
|
|
## Verification
|
|
|
|
Run the full local readiness check before deploying:
|
|
|
|
```bash
|
|
pnpm ready
|
|
```
|
|
|
|
This verifies the generated Better Auth migration, TypeScript, and Vitest suites.
|
|
|
|
After changing Better Auth plugins or persistence-related options, regenerate and review the migration:
|
|
|
|
```bash
|
|
pnpm db:generate
|
|
pnpm ready
|
|
```
|
|
|
|
## Runtime smoke checks
|
|
|
|
With the local Worker running on `http://localhost:8788`, verify the generated API reference and OpenAPI schema:
|
|
|
|
```bash
|
|
curl -i http://localhost:8788/api/auth/reference
|
|
curl -i http://localhost:8788/api/auth/open-api/generate-schema
|
|
```
|
|
|
|
Password reset requests use Better Auth's current `/request-password-reset` endpoint:
|
|
|
|
```bash
|
|
curl -i -X POST http://localhost:8788/api/auth/request-password-reset \
|
|
-H 'Content-Type: application/json' \
|
|
-H 'Origin: http://localhost:8787' \
|
|
--data '{"email":"missing@example.com","redirectTo":"http://localhost:8787/reset-password"}'
|
|
```
|
|
|
|
The deprecated or older `/forget-password` route is not exposed by the current Better Auth configuration.
|
|
|
|
## Configuration
|
|
|
|
Non-secret defaults live in `wrangler.jsonc`:
|
|
|
|
- `BETTER_AUTH_URL`
|
|
- `TRUSTED_ORIGINS`
|
|
- `MAIL_PROVIDER`
|
|
- `MAIL_FROM`
|
|
- `CAPTCHA_PROVIDER`
|
|
|
|
Set secrets with Wrangler:
|
|
|
|
```bash
|
|
wrangler secret put BETTER_AUTH_SECRET
|
|
wrangler secret put RESEND_API_KEY
|
|
wrangler secret put CAPTCHA_SECRET_KEY
|
|
```
|
|
|
|
Optional provider secrets are only needed when enabling the corresponding feature:
|
|
|
|
```bash
|
|
wrangler secret put GOOGLE_CLIENT_ID
|
|
wrangler secret put GOOGLE_CLIENT_SECRET
|
|
wrangler secret put GITHUB_CLIENT_ID
|
|
wrangler secret put GITHUB_CLIENT_SECRET
|
|
```
|
|
|
|
Passkey is enabled when all three RP values are configured:
|
|
|
|
- `PASSKEY_RP_ID`
|
|
- `PASSKEY_RP_NAME`
|
|
- `PASSKEY_ORIGIN`
|
|
|
|
JWT and bearer token endpoints are disabled by default. Enable them only when an API client needs them:
|
|
|
|
- `ENABLE_JWT=true`
|
|
- `ENABLE_BEARER=true`
|
|
|
|
## Deployment
|
|
|
|
Before deployment, apply migrations to the remote D1 database and deploy the Worker:
|
|
|
|
```bash
|
|
wrangler d1 migrations apply cfw-auth --remote
|
|
pnpm deploy
|
|
```
|
|
|
|
After deploy, repeat the runtime smoke checks against the production `BETTER_AUTH_URL`.
|