fix: defer auth initialization until after passfile exists

app/lib/auth.ts

@@ -14,36 +14,57 @@ import { ensureOnlyOneUser } from "./auth-middlewares/only-one-user";
 
 export type AuthMiddlewareContext = MiddlewareContext<MiddlewareOptions, AuthContext<BetterAuthOptions>>;
 
-export const auth = betterAuth({
+let _auth: ReturnType<typeof betterAuth> | null = null;
-	secret: await cryptoUtils.deriveSecret("better-auth"),
+
-	hooks: {
+const createAuth = async () => {
-		before: createAuthMiddleware(async (ctx) => {
+	if (_auth) return _auth;
-			await ensureOnlyOneUser(ctx);
+
-			await convertLegacyUserOnFirstLogin(ctx);
+	_auth = betterAuth({
+		secret: await cryptoUtils.deriveSecret("better-auth"),
+		hooks: {
+			before: createAuthMiddleware(async (ctx) => {
+				await ensureOnlyOneUser(ctx);
+				await convertLegacyUserOnFirstLogin(ctx);
+			}),
+		},
+		database: drizzleAdapter(db, {
+			provider: "sqlite",
 		}),
-	},
+		emailAndPassword: {
-	database: drizzleAdapter(db, {
+			enabled: true,
-		provider: "sqlite",
+		},
-	}),
+		user: {
-	emailAndPassword: {
+			modelName: "usersTable",
-		enabled: true,
+			additionalFields: {
-	},
+				username: {
-	user: {
+					type: "string",
-		modelName: "usersTable",
+					returned: true,
-		additionalFields: {
+					required: true,
-			username: {
+				},
-				type: "string",
+				hasDownloadedResticPassword: {
-				returned: true,
+					type: "boolean",
-				required: true,
+					returned: true,
-			},
+				},
-			hasDownloadedResticPassword: {
-				type: "boolean",
-				returned: true,
 			},
 		},
+		session: {
+			modelName: "sessionsTable",
+		},
+		plugins: [username({})],
+	});
+
+	return _auth;
+};
+
+export const auth = {
+	get api() {
+		if (!_auth) throw new Error("Auth not initialized. Call initAuth() first.");
+		return _auth.api;
 	},
-	session: {
+	get handler() {
-		modelName: "sessionsTable",
+		if (!_auth) throw new Error("Auth not initialized. Call initAuth() first.");
+		return _auth.handler;
 	},
-	plugins: [username({})],
+};
-});
+
+export const initAuth = createAuth;

app/server/modules/lifecycle/startup.ts

@@ -50,6 +50,9 @@ export const startup = async () => {
 		logger.error(`Error ensuring restic passfile exists: ${err.message}`);
 	});
 
+	const { initAuth } = await import("~/lib/auth");
+	await initAuth();
+
 	await ensureLatestConfigurationSchema();
 
 	const volumes = await db.query.volumesTable.findMany({