Upgrade Better Auth to 1.7.4 and realign the auth schema (#836)

Better Auth 1.7.3 reverted the account.issuer column that 1.7.0 through
1.7.2 introduced; accounts are keyed on (providerId, accountId) again as
in 1.6. Migration 0007 shipped the issuer column as NOT NULL, so on 1.7.3+
every sign-up and account link would fail on that constraint. Migration
0013 drops the unique index first, as the upgrade guide requires, then
drops the column. The ORCID accountIssuer option is gone and the OAuth
relay carries and looks up the (providerId, accountId) key only.

1.7.3 also validates the drizzle schema on init in every environment and
rejects auth requests on a mismatch. That surfaced three twoFactor
columns the plugin has expected since 1.7.0 but our table never had:
verified, failedVerificationCount and lockedUntil. Production has no
two-factor enrolments yet, so nobody hit it, but the first verify would
have failed. The same migration adds them.

Also in 1.7.3 and 1.7.4: a Cloudflare social provider, isPasswordCompromised
for custom flows, a getSession fix when cookie caching is off, and
Vitest 5 support in the test utilities.

Deploy note: CI migrates before it deploys, so the outgoing 1.7.2 worker
runs against the new schema for the length of the deploy. Only sign-ups
and account links in that window are affected.

Verified: typecheck, lint, shared 332, workers 126, web unit 630, web
server 322, web build all pass.

Author: InfinityBowman

packages/db/src/schema.ts

@@ -138,7 +138,6 @@ export const account = sqliteTable(
     id: text('id').primaryKey(),
     accountId: text('accountId').notNull(),
     providerId: text('providerId').notNull(),
-    issuer: text('issuer').notNull(),
     userId: text('userId')
       .notNull()
       .$type<UserId>()
@@ -153,10 +152,7 @@ export const account = sqliteTable(
     createdAt: integer('createdAt', { mode: 'timestamp' }).default(sql`(unixepoch())`),
     updatedAt: integer('updatedAt', { mode: 'timestamp' }).default(sql`(unixepoch())`),
   },
-  t => [
-    index('account_userId_idx').on(t.userId),
-    uniqueIndex('account_issuer_accountId_uidx').on(t.issuer, t.accountId),
-  ],
+  t => [index('account_userId_idx').on(t.userId)],
 );
 
 // Verification table
@@ -312,6 +308,10 @@ export const twoFactor = sqliteTable('twoFactor', {
     .references(() => user.id, { onDelete: 'cascade' }),
   secret: text('secret').notNull(),
   backupCodes: text('backupCodes').notNull(), // JSON array of backup codes
+  // Better Auth 1.7 verifies enrolment and locks out repeated failed codes
+  verified: integer('verified', { mode: 'boolean' }).default(true),
+  failedVerificationCount: integer('failedVerificationCount').default(0),
+  lockedUntil: integer('lockedUntil', { mode: 'timestamp' }),
   createdAt: integer('createdAt', { mode: 'timestamp' }).default(sql`(unixepoch())`),
   updatedAt: integer('updatedAt', { mode: 'timestamp' }).default(sql`(unixepoch())`),
 });

packages/web/migrations/0013_better_auth_1_7_schema.sql

@@ -0,0 +1,5 @@
+DROP INDEX `account_issuer_accountId_uidx`;--> statement-breakpoint
+ALTER TABLE `account` DROP COLUMN `issuer`;--> statement-breakpoint
+ALTER TABLE `twoFactor` ADD `verified` integer DEFAULT true;--> statement-breakpoint
+ALTER TABLE `twoFactor` ADD `failedVerificationCount` integer DEFAULT 0;--> statement-breakpoint
+ALTER TABLE `twoFactor` ADD `lockedUntil` integer;