Skip to content

Migrate auth from hand-rolled Spring JWT to better-auth (Next.js IdP)… #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
OffCrazyFreak wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Migrate auth from hand-rolled Spring JWT to better-auth (Next.js IdP)… #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 52 additions & 15 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,28 +14,41 @@ Do not prematurely optimize code. Focus on clarity and correctness first. Especi

**Core Framework & Runtime:**

- Next.js: `16.0.10`
- React: `19.2.3`
- React DOM: `19.2.3`
- Next.js: `16.2.2` (App Router, Turbopack)
- React: `19.2.4`
- React DOM: `19.2.4`
- Package manager: pnpm `11.5.2` (settings live in `pnpm-workspace.yaml`, not the package.json `pnpm` field)

**Auth & Data layer:**

- better-auth: `1.6.14` (identity provider; Drizzle adapter; JWT plugin)
- @daveyplate/better-auth-ui: `3.4.0`
- Drizzle ORM: `0.45.2` / drizzle-kit: `0.31.10`
- pg (node-postgres): `8.21.0`
- dotenv: `17.4.2`
- (Auth tables live in Postgres alongside the Spring backend; the Spring backend validates better-auth JWTs via JWKS.)

**Key Libraries:**

- React Query (@tanstack/react-query): `^5.90.12`
- React Hook Form: `^7.68.0`
- React Query (@tanstack/react-query): `5.101.0` (+ devtools `5.101.0`, react-virtual `3.14.2`)
- React Hook Form: `7.77.0` (+ @hookform/resolvers `5.4.0`)
- Recharts: `2.15.4`
- Zod: `^4.1.13`
- Axios: `^1.13.2`
- Sonner (Toast): `^2.0.7`
- Lucide React (Icons): `^0.561.0`
- Tailwind CSS: `^4`
- Radix UI: Latest component versions
- Motion (Animations): `^12.23.26`
- Zod: `4.4.3`
- Axios: `1.17.0`
- Sonner (Toast): `2.0.7`
- Lucide React (Icons): `0.561.0`
- Tailwind CSS: `4.3.0` (with @tailwindcss/postcss)
- Radix UI: `radix-ui` `1.5.0` (+ individual `@radix-ui/react-*` primitives)
- Motion (Animations): `12.40.0`
- cmdk: `1.1.1`, @yudiel/react-qr-scanner: `2.6.0`

**Development Tools:**

- ESLint: Latest
- TypeScript: Latest
- Tailwind CSS with PostCSS: Latest
- TypeScript: `5.9.3`
- ESLint: `9.39.4` (eslint-config-next `16.2.2`)
- Tailwind CSS with PostCSS

**Backend (for context):** Spring Boot `3.1.0` on Java `21`, Spring Security OAuth2 Resource Server (validates better-auth JWTs via JWKS), Spring Data JPA + PostgreSQL.

## Guidelines

Expand All @@ -58,6 +71,30 @@ Add empty rows for better readability between logical blocks of code, my prettie

If I tell you to refactor something into a separate component or function, make sure to check if there already exists a similar component or function in the codebase and reuse it instead of writing a new one. If there is no similar component or function, then create a new one in a separate file, instead of writing it in the same file.

Never edit the package.json or packege-lock.json files directly, but instead use "pnpm add package-name@version" or "pnpm remove package-name" to manage dependencies.

@coderabbitai coderabbitai Bot Jun 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Correct the lockfile name for pnpm projects.

The line contains a typo ("packege-lock.json") and references the wrong lockfile type. pnpm uses pnpm-lock.yaml, not package-lock.json (which is npm's lockfile). Since this project uses pnpm 11.5.2, the guidance should reference the correct lockfile.

📝 Proposed fix 
-Never edit the package.json or packege-lock.json files directly, but instead use "pnpm add package-name@version" or "pnpm remove package-name" to manage dependencies.
+Never edit the package.json or pnpm-lock.yaml files directly, but instead use "pnpm add package-name@version" or "pnpm remove package-name" to manage dependencies.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
Never edit the package.json or packege-lock.json files directly, but instead use "pnpm add package-name@version" or "pnpm remove package-name" to manage dependencies.
Never edit the package.json or pnpm-lock.yaml files directly, but instead use "pnpm add package-name@version" or "pnpm remove package-name" to manage dependencies.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@AGENTS.md` at line 74, Update the sentence that currently reads "Never edit
the package.json or packege-lock.json files directly..." to fix the typo and
reference pnpm's lockfile: change "packege-lock.json" to "pnpm-lock.yaml" and
ensure the line instructs using pnpm commands (e.g., "pnpm add" / "pnpm remove")
rather than editing package.json or pnpm-lock.yaml directly; look for the exact
phrase "Never edit the package.json or packege-lock.json files directly" in
AGENTS.md to locate and update it.


If you need docs about a library, always fetch the most recent documentation from the official website or repository, instead of searching in node modules or other places.

# Backend Development Guidelines

NEVER run "mvn spring-boot:run" or any other development server command, because I always already have my dev server running. Also never run build commands.

# Commit message requirement

At the end of every response that includes code changes, include a suggested Git commit message.

Use this format:

```text
Short summary in imperative mood

Brief explanation of why the change was needed.

Changes:
- Specific change 1
- Specific change 2
- Specific change 3

Notes:
- Optional important detail for reviewers or future maintenance
```
5 changes: 4 additions & 1 deletion backend/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,7 @@ SPRING_DATASOURCE_URL=jdbc:postgresql://localhost:5432/database_name
SPRING_DATASOURCE_USERNAME=username
SPRING_DATASOURCE_PASSWORD=password

JWT_SECRET=your_very_long_jwt_secret_key_here_at_least_256_bits_long
# URL of better-auth's JWKS endpoint, used to validate JWTs.
# Optional locally (defaults to http://localhost:3000/api/auth/jwks).
# In Docker, set to the internal frontend URL, e.g. http://frontend:3000/api/auth/jwks
BETTER_AUTH_JWKS_URI=http://localhost:3000/api/auth/jwks
27 changes: 3 additions & 24 deletions backend/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,11 +66,6 @@
<artifactId>spring-dotenv</artifactId>
<version>3.0.0</version>
</dependency>
<dependency>
<groupId>com.google.api-client</groupId>
<artifactId>google-api-client</artifactId>
<version>2.2.0</version>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
Expand All @@ -86,26 +81,10 @@
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!-- Validates better-auth JWTs via JWKS (backend acts as a resource server) -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.11.5</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-client</artifactId>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
Expand Down
38 changes: 0 additions & 38 deletions backend/src/main/java/disscount/auth/dao/RefreshTokenRepository.java
View file
Open in desktop

This file was deleted.

41 changes: 0 additions & 41 deletions backend/src/main/java/disscount/auth/domain/RefreshToken.java
View file
Open in desktop

This file was deleted.

21 changes: 0 additions & 21 deletions backend/src/main/java/disscount/auth/dto/AuthResponse.java
View file
Open in desktop

This file was deleted.

15 changes: 0 additions & 15 deletions backend/src/main/java/disscount/auth/dto/GoogleAuthRequest.java
View file
Open in desktop

This file was deleted.

14 changes: 0 additions & 14 deletions backend/src/main/java/disscount/auth/dto/LoginRequest.java
View file
Open in desktop

This file was deleted.

25 changes: 0 additions & 25 deletions backend/src/main/java/disscount/auth/dto/RegisterRequest.java
View file
Open in desktop

This file was deleted.

Loading