fix(auth): rebuild nuxthub postgres adapters per request

Author: onmax

src/module/templates.ts

@@ -23,6 +23,32 @@ interface BuildDatabaseCodeInput {
 
 export function buildDatabaseCode(input: BuildDatabaseCodeInput): string {
   if (input.provider === 'nuxthub') {
+    if (input.hubDialect === 'postgresql') {
+      return `import { db } from '@nuxthub/db'
+import * as schema from './schema.${input.hubDialect}.mjs'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { drizzle } from 'drizzle-orm/postgres-js'
+import postgres from 'postgres'
+
+const dialect = 'pg'
+
+function resolveBetterAuthDb() {
+  const hyperdrive = process.env.POSTGRES || globalThis.__env__?.POSTGRES || globalThis.POSTGRES
+  if (!hyperdrive?.connectionString)
+    return db
+
+  const client = postgres(hyperdrive.connectionString, {
+    prepare: false,
+    onnotice: () => {},
+  })
+
+  return drizzle({ client, schema })
+}
+
+export function createDatabase() { return drizzleAdapter(resolveBetterAuthDb(), { provider: dialect, schema, usePlural: ${input.usePlural}, camelCase: ${input.camelCase} }) }
+export { db }`
+    }
+
     return `import { db } from '@nuxthub/db'
 import * as schema from './schema.${input.hubDialect}.mjs'
 import { drizzleAdapter } from 'better-auth/adapters/drizzle'

src/runtime/server/utils/auth.ts

@@ -251,12 +251,8 @@ export function serverAuth(event?: H3Event): AuthInstance {
   const siteUrl = getBaseURL(event)
   const hasExplicitSiteUrl = runtimeConfig.public.siteUrl && typeof runtimeConfig.public.siteUrl === 'string'
   const cacheKey = hasExplicitSiteUrl ? '__explicit__' : siteUrl
-
-  const cached = _authCache.get(cacheKey)
-  if (cached)
-    return cached
-
   const database = createDatabase()
+
   const userConfig = createServerAuth({ runtimeConfig, db }) as BetterAuthOptions & {
     secondaryStorage?: BetterAuthOptions['secondaryStorage']
   }
@@ -271,6 +267,12 @@ export function serverAuth(event?: H3Event): AuthInstance {
     console.warn(customSecondaryStorage.message)
   }
 
+  if (!database) {
+    const cached = _authCache.get(cacheKey)
+    if (cached)
+      return cached
+  }
+
   const auth = betterAuth({
     ...userConfig,
     ...(database && { database }),
@@ -280,6 +282,8 @@ export function serverAuth(event?: H3Event): AuthInstance {
     trustedOrigins,
   })
 
-  _authCache.set(cacheKey, auth)
+  if (!database)
+    _authCache.set(cacheKey, auth)
+
   return auth
 }

test/nuxthub-hyperdrive-database-template.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest'
+import { buildDatabaseCode } from '../src/module/templates'
+
+describe('buildDatabaseCode', () => {
+  it('uses a dedicated postgres-js client with prepare disabled for nuxthub postgresql', () => {
+    const code = buildDatabaseCode({
+      provider: 'nuxthub',
+      hubDialect: 'postgresql',
+      usePlural: false,
+      camelCase: true,
+    })
+
+    expect(code).toContain("import postgres from 'postgres'")
+    expect(code).toContain('hyperdrive.connectionString')
+    expect(code).toContain('prepare: false')
+    expect(code).toContain('return db')
+    expect(code).toContain('drizzleAdapter(resolveBetterAuthDb()')
+    expect(code).not.toContain('_betterAuthDb')
+  })
+
+  it('keeps the existing generated adapter path for non-postgresql nuxthub databases', () => {
+    const code = buildDatabaseCode({
+      provider: 'nuxthub',
+      hubDialect: 'sqlite',
+      usePlural: false,
+      camelCase: true,
+    })
+
+    expect(code).toContain("import { db } from '@nuxthub/db'")
+    expect(code).toContain('drizzleAdapter(db, { provider: dialect')
+    expect(code).not.toContain("import postgres from 'postgres'")
+    expect(code).not.toContain('prepare: false')
+  })
+})

test/server-auth-database-cache.test.ts

@@ -0,0 +1,77 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const betterAuthMock = vi.fn()
+const createDatabaseMock = vi.fn()
+const createServerAuthMock = vi.fn()
+const useRuntimeConfigMock = vi.fn()
+
+vi.mock('#auth/database', () => ({
+  createDatabase: createDatabaseMock,
+  db: { query: {} },
+}))
+
+vi.mock('#auth/secondary-storage', () => ({
+  createSecondaryStorage: vi.fn(() => undefined),
+}))
+
+vi.mock('#auth/server', () => ({
+  default: createServerAuthMock,
+}))
+
+vi.mock('better-auth', () => ({
+  betterAuth: betterAuthMock,
+}))
+
+vi.mock('nitropack/runtime', () => ({
+  useRuntimeConfig: useRuntimeConfigMock,
+}))
+
+describe('serverAuth database cache behavior', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.clearAllMocks()
+
+    useRuntimeConfigMock.mockReturnValue({
+      public: {
+        siteUrl: 'https://example.com',
+      },
+      auth: {},
+      betterAuthSecret: 'test-secret',
+    })
+
+    createServerAuthMock.mockReturnValue({
+      trustedOrigins: undefined,
+    })
+
+    betterAuthMock.mockImplementation((options: Record<string, unknown>) => ({
+      options,
+      marker: Symbol('auth-instance'),
+    }))
+  })
+
+  it('creates a fresh auth instance on each call when a database adapter is active', async () => {
+    createDatabaseMock.mockReturnValue({ kind: 'database-adapter' })
+
+    const { serverAuth } = await import('../src/runtime/server/utils/auth')
+
+    const first = serverAuth()
+    const second = serverAuth()
+
+    expect(first).not.toBe(second)
+    expect(createDatabaseMock).toHaveBeenCalledTimes(2)
+    expect(betterAuthMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('keeps caching auth instances when no database adapter is configured', async () => {
+    createDatabaseMock.mockReturnValue(undefined)
+
+    const { serverAuth } = await import('../src/runtime/server/utils/auth')
+
+    const first = serverAuth()
+    const second = serverAuth()
+
+    expect(first).toBe(second)
+    expect(createDatabaseMock).toHaveBeenCalledTimes(2)
+    expect(betterAuthMock).toHaveBeenCalledTimes(1)
+  })
+})