Auth adapter: Better Auth, Firebase

An AuthAdapter has one method: getUser(req). It returns a QuickbenUser or null. Sign-in, sessions and passwords stay in your auth library.

These are outlines. They are not published packages. Check the auth library’s docs for the current API.

Better Auth

lib/quickben-auth.ts


import type { AuthAdapter } from "@quickben/core";
 
import { auth } from "./auth"; // your betterAuth({ … }) instance
 
export const betterAuthAdapter: AuthAdapter = {
  async getUser(req) {
    const session = await auth.api.getSession({ headers: req.headers });
    if (!session) return null;
    return {
      id: session.user.id,
      email: session.user.email,
      roles: session.user.role ? [session.user.role] : [],
    };
  },
};

Step	Detail
Users collection	Optional. Better Auth stores users in its own tables.
Roles	Map from your Better Auth plugin (for example the admin plugin’s `role`).
Config	`defineConfig({ …, auth: betterAuthAdapter })`

Firebase Authentication

lib/quickben-auth.ts


import { getAuth } from "firebase-admin/auth";
 
import type { AuthAdapter } from "@quickben/core";
 
export const firebaseAdapter: AuthAdapter = {
  async getUser(req) {
    const header = req.headers.get("authorization");
    const token = header?.startsWith("Bearer ") ? header.slice(7) : null;
    if (!token) return null;
    try {
      const decoded = await getAuth().verifyIdToken(token);
      return {
        id: decoded.uid,
        email: decoded.email,
        roles: Array.isArray(decoded.roles) ? decoded.roles : [],
      };
    } catch {
      return null;
    }
  },
};

Step	Detail
Token	ID token in `Authorization: Bearer`, or a session cookie with `verifySessionCookie`.
Roles	Set as custom claims with `setCustomUserClaims(uid, { roles })`.
Invalid token	Return `null`. The request is then anonymous.

Rules for any adapter

Rule	Why it matters to you
Return `null` on any failure	Access rules treat the request as anonymous.
Do not throw for bad tokens	A throw becomes a 500 response instead of a 401.
Keep it fast	It runs on every request.
Extra fields	Add them to `QuickbenUser` with declaration merging.