BuildBase on TanStack Start: hosted sign-in without replacing better-auth

npm i @buildbase/sdk

# .env
VITE_BUILDBASE_ORG_ID=demo-org-id
VITE_BUILDBASE_CLIENT_ID=demo-client-id
BUILDBASE_CLIENT_SECRET=demo-client-secret   # server only
# VITE_BUILDBASE_SERVER_URL defaults to https://api.console.buildbase.app

// src/server/buildbase-auth.ts
import { ApiVersion, AuthApi, BuildBase } from '@buildbase/sdk';
import type { BetterAuthPlugin } from 'better-auth';
import { APIError, createAuthEndpoint } from 'better-auth/api';
import { setSessionCookie } from 'better-auth/cookies';
import { z } from 'zod';

export const buildbaseAuth = (options: BuildBaseAuthOptions) => {
  const authApi = () => new AuthApi({ serverUrl: options.serverUrl, version: ApiVersion.V1 });
  // No round trip it cannot finish: without these, sign-in answers 503.
  const configured = () => {
    const { orgId, clientId, clientSecret } = options;
    if (!orgId || !clientId || !clientSecret) throw new APIError('SERVICE_UNAVAILABLE');
    return { orgId, clientId, clientSecret };
  };

  return {
    id: 'buildbase',
    schema: {
      // The BuildBase session behind each better-auth session.
      session: { fields: { buildbaseSessionId: { type: 'string', required: false } } },
    },
    endpoints: {
      buildbaseSignIn: createAuthEndpoint(
        '/buildbase/sign-in',
        { method: 'GET', query: z.object({ redirectTo: z.string().optional() }) },
        async (ctx) => {
          const { orgId, clientId } = configured();
          const state = crypto.randomUUID();
          const redirectTo = sameOriginPath(ctx.query.redirectTo, ctx.context.baseURL);
          await ctx.setSignedCookie('buildbase_state', JSON.stringify({ state, redirectTo }),
            ctx.context.secret, { httpOnly: true, sameSite: 'lax', path: '/', maxAge: 600,
              secure: ctx.context.baseURL.startsWith('https') });
          const callback = `${ctx.context.baseURL}/buildbase/callback`;
          const { redirectUrl } = await authApi().requestAuth({
            orgId,
            clientId,
            redirect: { success: callback, error: callback },
            state,
          });
          throw ctx.redirect(redirectUrl);
        },
      ),
      buildbaseCallback: /* step 3 */,
    },
    hooks: { before: [/* step 4 */] },
  } satisfies BetterAuthPlugin;
};

// src/server/auth.tsx
plugins: [
  admin({ /* your roles and permissions, unchanged */ }),
  buildbaseAuth({
    serverUrl: envClient.VITE_BUILDBASE_SERVER_URL,
    orgId: envClient.VITE_BUILDBASE_ORG_ID,
    clientId: envClient.VITE_BUILDBASE_CLIENT_ID,
    clientSecret: envServer.BUILDBASE_CLIENT_SECRET,
  }),
],

async (ctx) => {
  const { orgId, clientId, clientSecret } = configured();
  const raw = await ctx.getSignedCookie('buildbase_state', ctx.context.secret);
  const saved = raw ? JSON.parse(raw) : null;
  const { code, state } = ctx.query;
  if (!code || !saved || !state || state !== saved.state) {
    throw ctx.redirect('/login/error?error=STATE_MISMATCH');
  }

  const res = await fetch(`${options.serverUrl}/api/v1/auth/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ code, orgId, clientId, clientSecret }),
  });
  if (!res.ok) throw ctx.redirect('/login/error?error=INVALID_CODE');
  const buildbaseSessionId = (await res.json()).data.sessionId;

  const profile = await BuildBase({ serverUrl: options.serverUrl, orgId })
    .withSession(buildbaseSessionId)
    .users.getProfile();
  const rawId = profile.id ?? profile._id;
  if (!rawId || !profile.email)
    throw new Error('BuildBase profile has no ID or email.');
  const accountId = String(rawId);
  const email = profile.email.toLowerCase();
  const adapter = ctx.context.internalAdapter;

  const owner = await adapter.findAccountOwnerByKey({
    providerId: 'buildbase',
    accountId,
  });
  let user = owner?.kind === 'owned' ? owner.user : null;
  if (!user) {
    const existing = await adapter.findUserByEmail(email);
    if (existing) {
      // A user from before BuildBase, with the same email, is adopted.
      await adapter.linkAccount({
        userId: existing.user.id,
        providerId: 'buildbase',
        accountId,
      });
      user = existing.user;
    } else {
      ({ user } = await adapter.createOAuthUser(
        // The example also sets Start UI's onboardedAt, so new users skip onboarding.
        {
          email,
          name: profile.name || email.split('@')[0],
          emailVerified: true,
        },
        { providerId: 'buildbase', accountId }
      ));
    }
  }

  const session = await adapter.createSession(user.id, false, {
    buildbaseSessionId,
  });
  await setSessionCookie(ctx, { session, user });
  throw ctx.redirect(saved.redirectTo);
};

import { createAuthMiddleware, getSessionFromCtx } from 'better-auth/api';

hooks: {
  before: [{
    matcher: (ctx) => ctx.path === '/sign-out',
    handler: createAuthMiddleware(async (ctx) => {
      const current = await getSessionFromCtx(ctx).catch(() => null);
      const id = (current?.session as { buildbaseSessionId?: string } | undefined)
        ?.buildbaseSessionId;
      if (id) await authApi().logout(id).catch(() => undefined);
    }),
  }],
},

npm i @buildbase/sdk