Better Auth - Backfill scripts

apps/web/app/(ee)/api/cron/better-auth/migrate-accounts/route.ts

@@ -0,0 +1,52 @@
+import { qstash } from "@/lib/cron";
+import { withCron } from "@/lib/cron/with-cron";
+import { prisma } from "@/lib/prisma";
+import { APP_DOMAIN_WITH_NGROK } from "@dub/utils";
+import { logAndRespond } from "../../utils";
+
+export const dynamic = "force-dynamic";
+export const maxDuration = 300;
+
+const BATCH_SIZE = 1000;
+const ITERATIONS = 10;
+
+// POST /api/cron/better-auth/migrate-accounts
+export const POST = withCron(async () => {
+  for (let i = 0; i < ITERATIONS; i++) {
+    const count = await prisma.$executeRaw`
+      UPDATE Account
+      SET
+        accountId = COALESCE(accountId, providerAccountId),
+        providerId = COALESCE(providerId, provider),
+        accessToken = COALESCE(accessToken, access_token),
+        refreshToken = COALESCE(refreshToken, refresh_token),
+        idToken = COALESCE(idToken, id_token)
+      WHERE
+        accountId IS NULL
+        AND providerAccountId IS NOT NULL
+      ORDER BY id
+      LIMIT ${BATCH_SIZE}
+    `;
+
+    console.log(`Migrated ${count} accounts.`);
+
+    if (count === 0) {
+      return logAndRespond("Finished migrating accounts.");
+    }
+  }
+
+  const qstashResponse = await qstash.publishJSON({
+    method: "POST",
+    url: `${APP_DOMAIN_WITH_NGROK}/api/cron/better-auth/migrate-accounts`,
+    delay: "10s",
+    retries: 0,
+    flowControl: {
+      key: "better-auth-migrate-accounts",
+      parallelism: 1,
+    },
+  });
+
+  return logAndRespond(
+    `Scheduled next batch of accounts to migrate ${qstashResponse.messageId}`,
+  );
+});

apps/web/app/(ee)/api/cron/better-auth/migrate-credentials/route.ts

@@ -0,0 +1,76 @@
+import { qstash } from "@/lib/cron";
+import { withCron } from "@/lib/cron/with-cron";
+import { prisma } from "@/lib/prisma";
+import { APP_DOMAIN_WITH_NGROK } from "@dub/utils";
+import { logAndRespond } from "../../utils";
+
+export const dynamic = "force-dynamic";
+export const maxDuration = 300;
+
+const BATCH_SIZE = 1000;
+const ITERATIONS = 10;
+
+// POST /api/cron/better-auth/migrate-credentials
+export const POST = withCron(async () => {
+  for (let i = 0; i < ITERATIONS; i++) {
+    const users = await prisma.user.findMany({
+      where: {
+        passwordHash: {
+          not: null,
+        },
+        accounts: {
+          none: {
+            providerId: "credential",
+          },
+        },
+      },
+      select: {
+        id: true,
+        passwordHash: true,
+      },
+      orderBy: {
+        id: "asc",
+      },
+      take: BATCH_SIZE,
+    });
+
+    if (users.length === 0) {
+      return logAndRespond("Finished migrating credentials.");
+    }
+
+    const { count } = await prisma.account.createMany({
+      skipDuplicates: true,
+      data: users.map((user) => ({
+        userId: user.id,
+        accountId: user.id,
+        providerId: "credential",
+        password: user.passwordHash,
+      })),
+    });
+
+    console.log(`Migrated ${count} credentials.`);
+
+    // No rows inserted while candidates remain means the batch cannot progress.
+    if (count === 0) {
+      return logAndRespond(
+        `Stopped migrating credentials: ${users.length} users matched but no accounts were created.`,
+        { logLevel: "error" },
+      );
+    }
+  }
+
+  const qstashResponse = await qstash.publishJSON({
+    method: "POST",
+    url: `${APP_DOMAIN_WITH_NGROK}/api/cron/better-auth/migrate-credentials`,
+    delay: "10s",
+    retries: 0,
+    flowControl: {
+      key: "better-auth-migrate-credentials",
+      parallelism: 1,
+    },
+  });
+
+  return logAndRespond(
+    `Scheduled next batch of credentials to migrate ${qstashResponse.messageId}`,
+  );
+});

apps/web/app/(ee)/api/cron/better-auth/migrate-users/route.ts

@@ -0,0 +1,50 @@
+import { qstash } from "@/lib/cron";
+import { withCron } from "@/lib/cron/with-cron";
+import { prisma } from "@/lib/prisma";
+import { APP_DOMAIN_WITH_NGROK } from "@dub/utils";
+import { logAndRespond } from "../../utils";
+
+export const dynamic = "force-dynamic";
+export const maxDuration = 300;
+
+const BATCH_SIZE = 1000;
+const ITERATIONS = 10;
+
+// POST /api/cron/better-auth/migrate-users
+export const POST = withCron(async () => {
+  for (let i = 0; i < ITERATIONS; i++) {
+    const { count } = await prisma.user.updateMany({
+      where: {
+        emailVerified: {
+          not: null,
+        },
+        emailVerifiedBa: false,
+      },
+      data: {
+        emailVerifiedBa: true,
+      },
+      limit: BATCH_SIZE,
+    });
+
+    console.log(`Migrated ${count} users.`);
+
+    if (count === 0) {
+      return logAndRespond("Finished migrating users.");
+    }
+  }
+
+  const qstashResponse = await qstash.publishJSON({
+    method: "POST",
+    url: `${APP_DOMAIN_WITH_NGROK}/api/cron/better-auth/migrate-users`,
+    delay: "10s",
+    retries: 0,
+    flowControl: {
+      key: "better-auth-migrate-users",
+      parallelism: 1,
+    },
+  });
+
+  return logAndRespond(
+    `Scheduled next batch of users to migrate ${qstashResponse.messageId}`,
+  );
+});

apps/web/app/api/auth/reset-password/route.ts

@@ -51,6 +51,7 @@ export async function POST(req: NextRequest) {
         email: identifier,
       },
       select: {
+        id: true,
         emailVerified: true,
         passwordHash: true,
       },
@@ -72,6 +73,8 @@ export async function POST(req: NextRequest) {
       }
     }
 
+    const newPasswordHash = await hashPassword(password);
+
     await prisma.$transaction([
       // Delete the token
       prisma.passwordResetToken.deleteMany({
@@ -86,14 +89,25 @@ export async function POST(req: NextRequest) {
           email: identifier,
         },
         data: {
-          passwordHash: await hashPassword(password),
+          passwordHash: newPasswordHash,
           lockedAt: null, // Unlock the account after a successful password reset
           ...(!user.emailVerified && {
             emailVerified: new Date(),
             emailVerifiedBa: true,
           }),
         },
       }),
+
+      // Dual write: keep Better Auth credential Account.password in sync
+      prisma.account.updateMany({
+        where: {
+          userId: user.id,
+          providerId: "credential",
+        },
+        data: {
+          password: newPasswordHash,
+        },
+      }),
     ]);
 
     // Send the email to inform the user that their password has been reset

apps/web/app/api/user/password/route.ts

@@ -43,13 +43,26 @@ export const PATCH = withSession(async ({ req, session }) => {
     });
   }
 
-  await Promise.all([
+  const newPasswordHash = await hashPassword(newPassword);
+
+  await prisma.$transaction([
     prisma.user.update({
       where: {
         id: session.user.id,
       },
       data: {
-        passwordHash: await hashPassword(newPassword),
+        passwordHash: newPasswordHash,
+      },
+    }),
+
+    // Dual write: keep Better Auth credential Account.password in sync
+    prisma.account.updateMany({
+      where: {
+        userId: session.user.id,
+        providerId: "credential",
+      },
+      data: {
+        password: newPasswordHash,
       },
     }),