stacklok / toolhive-cloud-ui / 22677753356 / 1

75%

main: 75%

push

github

refactor(auth): rely only on better-auth logic (#382)

* refactor(auth): avoid save accounta data in better-auth

* refactor(auth): remove custom oidc token cookie/crypto/refresh layer

Delete cookie.ts, token.ts, crypto.ts — the custom stateless token
management layer built before Better Auth supported storeAccountCookie.

Better Auth 1.4+ handles all of this natively via storeAccountCookie and
auth.api.getAccessToken(), so the custom layer is no longer needed.

- Remove OidcTokenData and TokenResponse from types.ts (no longer stored
  in custom cookies)
- Remove getOidcProviderAccessToken, getOidcIdToken, saveAccountTokenToCookie,
  databaseHooks, and cookie imports from auth.ts
- Remove getOidcIdToken and saveAccountToken (cookie helpers) from utils.ts
- Reduce proxy.ts to a passthrough (token refresh now handled by Better Auth)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(auth): use auth.api.getAccessToken for token retrieval

Replace the custom getValidOidcToken() and getOidcIdToken() calls with
Better Auth's built-in auth.api.getAccessToken(), which handles token
reading, automatic refresh, and idToken retrieval natively.

- api-client.ts: call auth.api.getAccessToken() instead of getValidOidcToken()
- actions.ts: remove clearOidcTokenAction (Better Auth signOut() clears
  account_data automatically); use auth.api.getAccessToken() to get idToken
  for RP-Initiated Logout
- auth-client.ts: remove clearOidcTokenAction call from signOut()

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test: update test suite for removed auth token layer

- Delete tests for removed modules: auth-cookie-mode, auth (db token tests),
  token, cookie-proxy, crypto
- Update auth-client.test.ts: remove clearOidcTokenAction mock and assertions
- Update utils.test.ts: remove cookie-based getOidcIdToken / saveAccountToken tests
- Update vitest.setup.ts: add auth.api.getAccessToken global mock returning
  "mock-test-token"; remove @/li... (continued)

196 of 279 branches covered (70.25%)

Branch coverage included in aggregate %.

365 of 499 relevant lines covered (73.15%)

12.79 hits per line