From a242d439f5974ba8b96548fee5395911aa7ccb09 Mon Sep 17 00:00:00 2001 From: LongYinan Date: Tue, 24 Mar 2026 22:17:00 +0800 Subject: [PATCH] fix: skip auth middleware for internal /__-prefixed routes When auth is enabled, the global auth middleware runs on all Hono routes including internal ones like /__scheduled, /__queue, and /__void/*. When the CronScheduler DO dispatches cron jobs via worker.fetch(), the request hostname is "internal" (not localhost), causing resolveSecret() to throw if BETTER_AUTH_SECRET is not set. Add an early return in runVoidAuthMiddleware for paths starting with /__ to bypass auth on internal platform routes. Co-Authored-By: Claude Opus 4.6 (1M context) --- packages/void/src/runtime/better-auth-shared.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/packages/void/src/runtime/better-auth-shared.ts b/packages/void/src/runtime/better-auth-shared.ts index 4774a09dc..c76c19eb1 100644 --- a/packages/void/src/runtime/better-auth-shared.ts +++ b/packages/void/src/runtime/better-auth-shared.ts @@ -285,6 +285,15 @@ export function createVoidAuthRuntime( databaseOverride?: NonNullable, disposeOverride?: () => Promise, ): Promise { + // Skip auth for internal routes (cron, queue, migration, binding proxy). + // Still set user/session to null so downstream middleware that checks + // these context variables gets the expected sentinel (not undefined). + if (c.req.path.startsWith("/__")) { + c.set("user", null); + c.set("session", null); + return next(); + } + const { auth, dispose } = await createVoidAuth( c.req.raw, c.env as VoidAuthEnv,