feat(auth): configure Email OTP, Passkey, Last Login Method, and Admin with RBAC

lib/auth.ts

@@ -3,6 +3,8 @@ import { admin, emailOTP, lastLoginMethod } from 'better-auth/plugins'
 import { passkey } from '@better-auth/passkey'
 import { drizzleAdapter } from '@better-auth/drizzle-adapter'
 import { db } from '@/lib/db/index'
+import { ac, admin as adminRole, contributor, user } from '@/lib/auth/permissions'
+import { sendOTP, OTP_EXPIRY_SECONDS } from '@/lib/auth/email'
 
 export const auth = betterAuth({
     experimental: { joins: true },
@@ -12,18 +14,30 @@ export const auth = betterAuth({
     plugins: [
         emailOTP({
             async sendVerificationOTP({ email, otp, type }) {
-                if (type === 'sign-in') {
-                    // TODO: send the OTP to the user's email address
-                } else if (type === 'email-verification') {
-                    // TODO: send the OTP to the user's email address for email verification
-                } else {
-                    // TODO: send the OTP to the user's email address for password reset
-                }
-            }
+                await sendOTP({ email, otp, type })
+            },
+            otpLength: 6,
+            expiresIn: OTP_EXPIRY_SECONDS,
+            allowedAttempts: 5,
+        }),
+        passkey({
+            rpID: process.env.RP_ID ?? 'localhost',
+            rpName: 'DeckyVault',
+            origin: process.env.BETTER_AUTH_URL ?? 'http://localhost:3000',
+        }),
+        lastLoginMethod({
+            storeInDatabase: true,
+        }),
+        admin({
+            ac,
+            roles: {
+                admin: adminRole,
+                contributor,
+                user,
+            },
+            defaultRole: 'user',
+            adminRoles: ['admin'],
         }),
-        passkey(),
-        lastLoginMethod(),
-        admin()
     ],
     socialProviders: {
         google: {
@@ -55,5 +69,8 @@ export const auth = betterAuth({
             trustedProviders: ['google', 'discord'],
             allowDifferentEmails: true
         }
-    }
+    },
+    emailAndPassword: {
+        enabled: true,
+    },
 })

lib/auth/email.ts

@@ -0,0 +1,47 @@
+export const OTP_EXPIRY_SECONDS = 300
+
+type OTPParams = {
+  email: string
+  otp: string
+  type: "sign-in" | "email-verification" | "forget-password" | "change-email"
+}
+
+const subjects: Record<OTPParams["type"], string> = {
+  "sign-in": "Sign in to DeckyVault",
+  "email-verification": "Verify your DeckyVault email",
+  "forget-password": "Reset your DeckyVault password",
+  "change-email": "Change your DeckyVault email",
+}
+
+export async function sendOTP({ email, otp, type }: OTPParams) {
+  const subject = subjects[type]
+
+  // If RESEND_API_KEY is set, use Resend. Otherwise, log to console in dev.
+  if (process.env.RESEND_API_KEY) {
+    try {
+      const { Resend } = await import("resend")
+      const resend = new Resend(process.env.RESEND_API_KEY)
+
+      await resend.emails.send({
+        from: process.env.EMAIL_FROM ?? "DeckyVault <noreply@deckyvault.xyz>",
+        to: email,
+        subject,
+        html: `
+          <div style="font-family: sans-serif; max-width: 400px; margin: 0 auto;">
+            <h2 style="color: #eb3779;">${subject}</h2>
+            <p>Your verification code is:</p>
+            <p style="font-size: 32px; font-weight: bold; letter-spacing: 8px; color: #571b8b;">${otp}</p>
+            <p style="color: #666; font-size: 14px;">This code expires in ${OTP_EXPIRY_SECONDS / 60} minutes. If you didn't request this, ignore this email.</p>
+          </div>
+        `,
+      })
+    } catch (error) {
+      console.error("[EMAIL OTP] Failed to send via Resend:", error)
+      throw new Error("Failed to send verification email")
+    }
+  } else if (process.env.NODE_ENV === "development") {
+    console.log(`[EMAIL OTP] To: ${email} | Type: ${type} | OTP: ${otp}`)
+  } else {
+    throw new Error("RESEND_API_KEY is not configured")
+  }
+}