fix: defer auth initialization until after passfile exists

app/lib/auth.ts

@@ -14,7 +14,12 @@ import { ensureOnlyOneUser } from "./auth-middlewares/only-one-user";
 
 export type AuthMiddlewareContext = MiddlewareContext<MiddlewareOptions, AuthContext<BetterAuthOptions>>;
 
-export const auth = betterAuth({
+let _auth: ReturnType<typeof betterAuth> | null = null;
+
+const createAuth = async () => {
+	if (_auth) return _auth;
+
+	_auth = betterAuth({
 		secret: await cryptoUtils.deriveSecret("better-auth"),
 		hooks: {
 			before: createAuthMiddleware(async (ctx) => {
@@ -47,3 +52,19 @@ export const auth = betterAuth({
 		},
 		plugins: [username({})],
 	});
+
+	return _auth;
+};
+
+export const auth = {
+	get api() {
+		if (!_auth) throw new Error("Auth not initialized. Call initAuth() first.");
+		return _auth.api;
+	},
+	get handler() {
+		if (!_auth) throw new Error("Auth not initialized. Call initAuth() first.");
+		return _auth.handler;
+	},
+};
+
+export const initAuth = createAuth;

app/server/modules/lifecycle/startup.ts

@@ -50,6 +50,9 @@ export const startup = async () => {
 		logger.error(`Error ensuring restic passfile exists: ${err.message}`);
 	});
 
+	const { initAuth } = await import("~/lib/auth");
+	await initAuth();
+
 	await ensureLatestConfigurationSchema();
 
 	const volumes = await db.query.volumesTable.findMany({