refactor(auth): single-source Better Auth config + split package exports (#45)

.github/workflows/be-auth.yml

@@ -5,12 +5,14 @@ on:
     branches: [ main ]
     paths:
       - 'apps/backend/auth/**'
+      - 'packages/auth/**'
       - 'docker-compose.setup.yml'
       - '.github/workflows/be-auth.yml'
   pull_request:
     branches: [ main ]
     paths:
       - 'apps/backend/auth/**'
+      - 'packages/auth/**'
       - 'docker-compose.setup.yml'
       - '.github/workflows/be-auth.yml'
   workflow_dispatch:
@@ -34,6 +36,10 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Run @reloop/auth export isolation tests
+        run: bun run test
+        working-directory: packages/auth
+
       - name: Run auth characterization tests
         run: bun run test
         working-directory: apps/backend/auth

apps/backend/auth/src/auth.config.ts

@@ -1,22 +1,14 @@
+import { authServerConfig } from "@reloop/auth/server/config";
+
+/**
+ * Auth service process config.
+ * Shared Better Auth / env keys come from {@link authServerConfig}
+ * (single source of truth). Service-only fields live here.
+ */
 export const authConfig = {
+	...authServerConfig,
 	port: Number(process.env.PORT || "8000"),
-	PG_URL:
-		process.env.PG_URL || "postgresql://reloop:reloop123@localhost:5432/reloop",
-	REDIS_URL: process.env.REDIS_URL || "redis://:reloop123@localhost:6379",
-	BASE_URL: process.env.BASE_URL || "https://local.reloop.sh",
-	NODE_ENV: process.env.NODE_ENV || "development",
 	NODE_TLS_REJECT_UNAUTHORIZED: process.env.NODE_TLS_REJECT_UNAUTHORIZED || "0",
-	BETTER_AUTH_SECRET:
-		process.env.BETTER_AUTH_SECRET || "tENkVU4GrhckuRw4Bcfh93EWgXOFcszn",
-	GOOGLE_CLIENT_ID: process.env.GOOGLE_CLIENT_ID,
-	GOOGLE_CLIENT_SECRET: process.env.GOOGLE_CLIENT_SECRET,
-	GITHUB_CLIENT_ID: process.env.GITHUB_CLIENT_ID,
-	GITHUB_CLIENT_SECRET: process.env.GITHUB_CLIENT_SECRET,
-	DEFAULT_OTP: process.env.DEFAULT_OTP,
-	DISABLE_SIGNUP: process.env.DISABLE_SIGNUP,
-	/** When true, new accounts require a valid platform signup invite. */
-	REQUIRE_SIGNUP_INVITE: process.env.REQUIRE_SIGNUP_INVITE === "true",
-	NATS_URL: process.env.NATS_URL || "nats://localhost:4222",
 	OTEL_EXPORTER_OTLP_ENDPOINT: process.env.OTEL_EXPORTER_OTLP_ENDPOINT || "",
 	OTEL_EXPORTER_OTLP_HEADERS: process.env.OTEL_EXPORTER_OTLP_HEADERS || "",
 };

apps/backend/auth/src/landing.ts

@@ -1,6 +1,6 @@
+import { authRedis as redis } from "@reloop/auth/server";
 import { db } from "@reloop/db/client";
 import { Elysia } from "elysia";
-import { redis } from "./lib/redis";
 
 export const landing = new Elysia()
 	.get("/", async () => {