Replace next-auth with Better Auth, migrate DB columns to camelCase

- Replace next-auth v5 beta with better-auth v1.6.2 (stable releases)
- Add multi-provider OAuth support with admin UI configuration
- New oauthProviders table with encrypted secrets (AES-256-GCM)
- Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable
- OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers
- Settings page "Authentication Providers" section for admin management
- Account linking uses new accounts table (multi-provider per user)
- Username plugin for credentials sign-in (replaces email@localhost pattern)
- bcrypt password compatibility (existing hashes work)
- Database-backed sessions via Kysely adapter (bun:sqlite direct)
- Configurable rate limiting via AUTH_RATE_LIMIT_* env vars
- All DB columns migrated from snake_case to camelCase
- All TypeScript types/models migrated to camelCase properties
- Removed casing: "snake_case" from Drizzle config
- Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId}
- package-lock.json removed and gitignored (using bun.lock)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/v1/oauth-providers/[id]/route.ts

@@ -0,0 +1,120 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
+import { getOAuthProvider, updateOAuthProvider, deleteOAuthProvider } from "@/src/lib/models/oauth-providers";
+import type { OAuthProvider } from "@/src/lib/models/oauth-providers";
+import { createAuditEvent } from "@/src/lib/models/audit";
+import { invalidateProviderCache } from "@/src/lib/auth-server";
+
+function redactSecrets(provider: OAuthProvider) {
+  const clientId = provider.clientId;
+  return {
+    ...provider,
+    clientId: clientId.length > 4 ? "••••" + clientId.slice(-4) : "••••",
+    clientSecret: "••••••••",
+  };
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    await requireApiAdmin(request);
+    const { id } = await params;
+    const provider = await getOAuthProvider(id);
+    if (!provider) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+    return NextResponse.json(redactSecrets(provider));
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const { userId } = await requireApiAdmin(request);
+    const { id } = await params;
+    const body = await request.json();
+
+    const existing = await getOAuthProvider(id);
+    if (!existing) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+
+    // Env-sourced providers can only have `enabled` toggled
+    if (existing.source === "env") {
+      const allowedKeys = ["enabled"];
+      const bodyKeys = Object.keys(body).filter((k) => body[k] !== undefined);
+      const disallowed = bodyKeys.filter((k) => !allowedKeys.includes(k));
+      if (disallowed.length > 0) {
+        return NextResponse.json(
+          { error: `Environment-sourced providers can only update: ${allowedKeys.join(", ")}` },
+          { status: 400 }
+        );
+      }
+    }
+
+    const updated = await updateOAuthProvider(id, body);
+    if (!updated) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+
+    invalidateProviderCache();
+
+    await createAuditEvent({
+      userId,
+      action: "update",
+      entityType: "oauth_provider",
+      entityId: null,
+      summary: `Updated OAuth provider "${updated.name}"`,
+      data: JSON.stringify({ providerId: updated.id, fields: Object.keys(body) }),
+    });
+
+    return NextResponse.json(redactSecrets(updated));
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const { userId } = await requireApiAdmin(request);
+    const { id } = await params;
+
+    const existing = await getOAuthProvider(id);
+    if (!existing) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+
+    if (existing.source === "env") {
+      return NextResponse.json(
+        { error: "Cannot delete an environment-sourced OAuth provider" },
+        { status: 400 }
+      );
+    }
+
+    await deleteOAuthProvider(id);
+
+    invalidateProviderCache();
+
+    await createAuditEvent({
+      userId,
+      action: "delete",
+      entityType: "oauth_provider",
+      entityId: null,
+      summary: `Deleted OAuth provider "${existing.name}"`,
+      data: JSON.stringify({ providerId: existing.id, name: existing.name }),
+    });
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}

app/api/v1/oauth-providers/route.ts

@@ -0,0 +1,71 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
+import { listOAuthProviders, createOAuthProvider } from "@/src/lib/models/oauth-providers";
+import type { OAuthProvider } from "@/src/lib/models/oauth-providers";
+import { createAuditEvent } from "@/src/lib/models/audit";
+import { invalidateProviderCache } from "@/src/lib/auth-server";
+
+function redactSecrets(provider: OAuthProvider) {
+  const clientId = provider.clientId;
+  return {
+    ...provider,
+    clientId: clientId.length > 4 ? "••••" + clientId.slice(-4) : "••••",
+    clientSecret: "••••••••",
+  };
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    await requireApiAdmin(request);
+    const providers = await listOAuthProviders();
+    return NextResponse.json(providers.map(redactSecrets));
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const { userId } = await requireApiAdmin(request);
+    const body = await request.json();
+
+    if (!body.name || typeof body.name !== "string") {
+      return NextResponse.json({ error: "name is required" }, { status: 400 });
+    }
+    if (!body.clientId || typeof body.clientId !== "string") {
+      return NextResponse.json({ error: "clientId is required" }, { status: 400 });
+    }
+    if (!body.clientSecret || typeof body.clientSecret !== "string") {
+      return NextResponse.json({ error: "clientSecret is required" }, { status: 400 });
+    }
+
+    const provider = await createOAuthProvider({
+      name: body.name,
+      type: body.type ?? "oidc",
+      clientId: body.clientId,
+      clientSecret: body.clientSecret,
+      issuer: body.issuer ?? null,
+      authorizationUrl: body.authorizationUrl ?? null,
+      tokenUrl: body.tokenUrl ?? null,
+      userinfoUrl: body.userinfoUrl ?? null,
+      scopes: body.scopes ?? "openid email profile",
+      autoLink: body.autoLink ?? false,
+      source: "ui",
+    });
+
+    invalidateProviderCache();
+
+    await createAuditEvent({
+      userId,
+      action: "create",
+      entityType: "oauth_provider",
+      entityId: null,
+      summary: `Created OAuth provider "${provider.name}"`,
+      data: JSON.stringify({ providerId: provider.id, name: provider.name, type: provider.type }),
+    });
+
+    return NextResponse.json(redactSecrets(provider), { status: 201 });
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}

app/api/v1/openapi.json/route.ts

@@ -1982,7 +1982,7 @@ const spec = {
       },
       User: {
         type: "object",
-        description: "User account (password_hash is never exposed)",
+        description: "User account (passwordHash is never exposed)",
         properties: {
           id: { type: "integer" },
           email: { type: "string" },
@@ -1990,12 +1990,12 @@ const spec = {
           role: { type: "string", enum: ["admin", "user", "viewer"] },
           provider: { type: "string", example: "credentials" },
           subject: { type: "string" },
-          avatar_url: { type: ["string", "null"] },
+          avatarUrl: { type: ["string", "null"] },
           status: { type: "string", enum: ["active", "inactive"] },
-          created_at: { type: "string", format: "date-time" },
-          updated_at: { type: "string", format: "date-time" },
+          createdAt: { type: "string", format: "date-time" },
+          updatedAt: { type: "string", format: "date-time" },
         },
-        required: ["id", "email", "role", "provider", "subject", "status", "created_at", "updated_at"],
+        required: ["id", "email", "role", "provider", "subject", "status", "createdAt", "updatedAt"],
       },
       AuditLogEvent: {
         type: "object",

app/api/v1/users/[id]/route.ts

@@ -3,7 +3,7 @@ import { requireApiUser, requireApiAdmin, apiErrorResponse, ApiAuthError } from
 import { getUserById, updateUserProfile, updateUserRole, updateUserStatus, deleteUser } from "@/src/lib/models/user";
 
 function stripPasswordHash(user: Record<string, unknown>) {
-  const { password_hash: _, ...rest } = user;
+  const { passwordHash: _, ...rest } = user;
   void _;
   return rest;
 }
@@ -62,9 +62,9 @@ export async function PUT(
     const profileFields: Record<string, unknown> = {};
     if (body.email !== undefined) profileFields.email = body.email;
     if (body.name !== undefined) profileFields.name = body.name;
-    if (body.avatar_url !== undefined) profileFields.avatar_url = body.avatar_url;
+    if (body.avatarUrl !== undefined) profileFields.avatarUrl = body.avatarUrl;
     if (Object.keys(profileFields).length > 0) {
-      await updateUserProfile(targetId, profileFields as { email?: string; name?: string | null; avatar_url?: string | null });
+      await updateUserProfile(targetId, profileFields as { email?: string; name?: string | null; avatarUrl?: string | null });
     }
 
     const user = await getUserById(targetId);

app/api/v1/users/route.ts

@@ -3,7 +3,7 @@ import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
 import { listUsers } from "@/src/lib/models/user";
 
 function stripPasswordHash(user: Record<string, unknown>) {
-  const { password_hash: _, ...rest } = user;
+  const { passwordHash: _, ...rest } = user;
   void _;
   return rest;
 }