Biovity uses Better Auth for authentication with custom user fields and email/password provider.
Base configuration
The authentication system is configured in lib/auth.ts (server) and lib/auth-client.ts (client).
Server configuration
import { betterAuth } from "better-auth"
import { pool } from "@/lib/db"
export const auth = betterAuth({
database: pool,
rateLimit: {
enabled: true,
window: 60, // 1 minute
max: 10, // 10 requests per minute per IP
},
emailAndPassword: {
enabled: true,
},
// ... additional configuration
})
Client configuration
import { createAuthClient } from "better-auth/react"
import { inferAdditionalFields } from "better-auth/client/plugins"
export const authClient = createAuthClient({
baseURL: process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000",
plugins: [
inferAdditionalFields({
user: {
type: { type: "string", required: true },
profession: { type: "string", required: true },
avatar: { type: "string", required: false },
isActive: { type: "boolean", required: false },
organizationId: { type: "string", required: false },
},
}),
],
})
API endpoints
All authentication endpoints are served through the Next.js API route at /api/auth/*.
app/api/auth/[...all]/route.ts
import { toNextJsHandler } from "better-auth/next-js"
import { auth } from "@/lib/auth"
export const { POST, GET } = toNextJsHandler(auth)
Available endpoints
| Endpoint | Method | Description |
|---|
/api/auth/sign-in/email | POST | Email/password login |
/api/auth/sign-up/email | POST | Email/password registration |
/api/auth/sign-out | POST | End user session |
/api/auth/session | GET | Get current session |
Security features
Rate limiting
Rate limiting is enabled to prevent brute force attacks:
Time window in seconds for rate limit calculation
Maximum requests allowed per IP address within the window
Session management
Sessions are configured with the following parameters:
Session expiration time in seconds (7 days)
Session refresh interval in seconds (1 day). Sessions automatically refresh after 1 day of activity.
Enable cookie-based session caching
Cookie cache duration in seconds (5 minutes)
Secure cookies
Cookies are configured to use secure flags in production:
advanced: {
useSecureCookies: process.env.NODE_ENV === "production",
}
Custom user fields
Biovity extends the default Better Auth user model with additional fields:
User type: employee or organization
User’s professional designation or field
URL to user’s profile avatar image
Account activation status
Associated organization ID for employee users
Email verification token (internal use only)
Database schema
Better Auth uses custom field mappings for PostgreSQL:
User table
user: {
modelName: "user",
fields: {
email: "email",
name: "name",
emailVerified: "isEmailVerified",
createdAt: "createdAt",
updatedAt: "updatedAt",
},
}
Session table
session: {
modelName: "session",
fields: {
userId: "user_id",
expiresAt: "expires_at",
token: "token",
ipAddress: "ip_address",
userAgent: "user_agent",
createdAt: "created_at",
updatedAt: "updated_at",
},
}
Logging
Logging level is environment-dependent:
logger: {
level: process.env.NODE_ENV === "production" ? "error" : "debug",
}