feat: refine Better Auth deploy support

Author: yyx990803

docs/guide/auth.md

@@ -139,15 +139,15 @@ When auth is active, Void configures Better Auth with these conventions:
 - mount path: `/api/auth/*`
 - email/password enabled by default unless `auth.providers` is set without `"email"`
 - `auth.providers` can enable any built-in Better Auth social provider
-- deployed apps need an auth secret via `BETTER_AUTH_SECRET` or `AUTH_SECRET`
+- deployed apps need an auth secret via `BETTER_AUTH_SECRET`
 - D1/SQLite uses the app `DB` binding
 - PostgreSQL apps (`"database": "pg"`) use the app `HYPERDRIVE` binding
 
 Auth sessions live in the same database system as the rest of the app. `AUTH_KV` is no longer used.
 
-On Void Cloud, Void auto-creates `BETTER_AUTH_SECRET` for auth-enabled apps if you have not set `BETTER_AUTH_SECRET` or `AUTH_SECRET` yourself through project secrets.
+On Void Cloud, Void auto-creates `BETTER_AUTH_SECRET` for auth-enabled apps if you have not set `BETTER_AUTH_SECRET` yourself through project secrets.
 
-Localhost dev uses a built-in fallback secret automatically. Outside the managed Void Cloud deploy flow, set `BETTER_AUTH_SECRET` or `AUTH_SECRET` yourself.
+Localhost dev uses a built-in fallback secret automatically. Outside the managed Void Cloud deploy flow, set `BETTER_AUTH_SECRET` yourself.
 
 ## Customization
 

packages/void/src/cli/package.ts

@@ -133,6 +133,7 @@ export function packageBuild(
 
   // Build manifest from inferred bindings
   const manifest: DeployManifest = { version: 3, bindings: {} };
+  if (bindings.needsAuth) manifest.auth = true;
   if (bindings.needsD1 || bindings.needsAuth) {
     if (dialect === "postgresql") {
       manifest.bindings.hyperdrive = ["HYPERDRIVE"];

packages/void/src/cli/types.ts

@@ -53,6 +53,7 @@ export interface WebSocketManifestMeta {
 
 export interface DeployManifest {
   version: number;
+  auth?: boolean;
   bindings: {
     d1?: string[];
     kv?: string[];

packages/void/src/runtime/better-auth-shared.ts

@@ -23,7 +23,6 @@ export interface VoidAuthEnv extends Record<string, unknown> {
   DATABASE_URL?: string;
   HYPERDRIVE?: { connectionString?: string };
   BETTER_AUTH_SECRET?: string;
-  AUTH_SECRET?: string;
   GITHUB_OAUTH_ID?: string;
   GITHUB_OAUTH_SECRET?: string;
   GOOGLE_OAUTH_ID?: string;
@@ -76,17 +75,15 @@ function resolveSecret(request: Request, env: VoidAuthEnv): string {
   const explicit =
     typeof env.BETTER_AUTH_SECRET === "string" && env.BETTER_AUTH_SECRET.length > 0
       ? env.BETTER_AUTH_SECRET
-      : typeof env.AUTH_SECRET === "string" && env.AUTH_SECRET.length > 0
-        ? env.AUTH_SECRET
-        : undefined;
+      : undefined;
   if (explicit) return explicit;
 
   const url = new URL(request.url);
   if (isLocalHost(url.hostname)) {
     return "void-dev-better-auth-secret-1234567890";
   }
 
-  throw new Error("Missing Better Auth secret. Set BETTER_AUTH_SECRET or AUTH_SECRET.");
+  throw new Error("Missing Better Auth secret. Set BETTER_AUTH_SECRET.");
 }
 
 function readEnvString(env: VoidAuthEnv, ...keys: string[]): string | undefined {

packages/void/test/unit/better-auth.test.ts

@@ -64,4 +64,34 @@ describe("resolveVoidAuthOptions", () => {
       ),
     ).rejects.toThrow('Missing auth credentials for provider "google"');
   });
+
+  it("requires BETTER_AUTH_SECRET outside localhost", async () => {
+    await expect(
+      resolveVoidAuthOptions(
+        new Request("https://example.com/api/auth"),
+        {
+          AUTH_SECRET: "legacy-secret",
+        },
+        {
+          dialect: "sqlite",
+          providers: null,
+        },
+        {} as never,
+      ),
+    ).rejects.toThrow("Missing Better Auth secret. Set BETTER_AUTH_SECRET.");
+  });
+
+  it("uses the localhost fallback when BETTER_AUTH_SECRET is missing", async () => {
+    const { options } = await resolveVoidAuthOptions(
+      new Request("http://localhost:3000/api/auth"),
+      {},
+      {
+        dialect: "sqlite",
+        providers: null,
+      },
+      {} as never,
+    );
+
+    expect(options.secret).toBe("void-dev-better-auth-secret-1234567890");
+  });
 });

packages/void/test/unit/package.test.ts

@@ -118,6 +118,25 @@ describe("packageBuild", () => {
     const manifest = JSON.parse(manifestRaw);
     expect(manifest.version).toBe(3);
   });
+
+  it("marks auth-enabled deploys in the manifest", () => {
+    const workerDir = join(TMP, "worker");
+    mkdirSync(workerDir, { recursive: true });
+    writeFileSync(join(workerDir, "index.js"), "export default {}");
+
+    const form = packageBuild(TMP, "worker", {
+      needsD1: false,
+      needsKV: false,
+      needsR2: false,
+      needsAuth: true,
+      needsQueues: false,
+      needsAI: false,
+    });
+
+    const manifestRaw = form.get("manifest") as string;
+    const manifest = JSON.parse(manifestRaw);
+    expect(manifest.auth).toBe(true);
+  });
 });
 
 describe("computeAssetHash", () => {