fix: keep one Better Auth instance so provider sign-in returns to the app

[viganogabriele]

The bug

Opening an application that signs in through this IdP, then clicking Continue with PoliNetwork APS (Microsoft), left the user back on our own page instead of returning them to the application. The sign-in itself worked — a session was created — but the OpenID Connect authorization it was meant to complete was silently dropped, so the application never received its authorization code and kept asking the user to log in.

Clearing browser storage looked like a fix, but it was a coincidence: it only changes which path the second attempt takes. Once a session cookie exists, /oauth2/authorize skips the sign-in page and goes straight to consent — the broken step never runs.

The cause

Better Auth carries the in-flight authorization across the provider redirect in per-request state. defineRequestState() keys that state with a module-private token minted once per module evaluation.

The server build was producing two evaluations of the modules that own those tokens:

_ssr/router-*.mjs                            ← better-auth inlined into the SSR bundle
_libs/@better-auth/oauth-provider+[...].mjs  ← a second copy inlined into the plugin chunk
_libs/@better-auth/core+[...].mjs            ← and a second copy of the core request-state module

So on /sign-in/social the OAuth provider plugin stored the pending authorization under one set of keys, and Better Auth's generateState() read another and found nothing. The sign-in state persisted for the provider round trip therefore had no serverContext:

{ "callbackURL": "/", "codeVerifier": "…", "idTokenNonce": "…", "oauthState": "…" }

With nothing recorded to resume, the provider callback just honoured callbackURL and dropped the user on /. The same split broke the other half of the handoff — the plugin's post-callback hook read getOAuthState() from its own copy and also saw nothing. No error was raised on either path.

The fix

Bundle every Better Auth package together via ssr.noExternal, so one module instance — and one set of keys — serves the whole flow. The packages are matched by name pattern (better-auth, @better-auth/*), so a plugin added later is covered without editing the list. After the change, every module owning per-request state appears exactly once in .output/server.

Because the failure is silent and the cause is a bundler setting that can shift on any dependency upgrade (several are pinned to latest), pnpm build now also runs scripts/check-server-bundle.mjs. It finds every defineRequestState() call in the built server and fails the build — and so the image build in CI — if any of them, or the core request-state module, appears more than once. Because it looks at every call rather than a fixed list, new request state added by a Better Auth upgrade is checked too. The check has its own tests.

Why not keep better-auth external instead (#8)

#8 fixes the same bug the other way round, with ssr.external: ["better-auth"]. That also works today, but it makes the build carry a second copy of TanStack Start's server code (better-auth/tanstack-start imports @tanstack/react-start/server). Cookies still work only because TanStack happens to keep its request store on a global key. TanStack Start bundles packages like better-auth on purpose to avoid exactly this, so this PR works with that instead of against it. Putting both settings in at once brings the bug back (external wins for better-auth, and the OAuth plugin's own state gets two copies), so only one of them can land.

Verification

Reproduced and verified end to end against a production build (pnpm build + scripts/start.mjs), a real Postgres, a stub Entra-shaped OpenID Provider, a registered OIDC client, and a real Chromium driving the actual pages.

	before	after
first sign-in, fresh browser	lands on /, application gets nothing	lands on /consent, then …/cb?code=…&state=…
build with the packages split	—	build fails with an actionable message

Also confirmed in vp dev, which had the same split: on main the Better Auth state module runs twice, with this change once. With main's config, the new check fails and names each duplicated piece of state. vp check and vp test pass.

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 04568252-7d93-4bc7-8bde-47b94c9ca55a

📥 Commits

Reviewing files that changed from the base of the PR and between 5b70bfd and 0360e0a.

📒 Files selected for processing (4)

• package.json
• scripts/check-server-bundle.mjs
• scripts/check-server-bundle.test.mjs
• vite.config.ts

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lorenzocorallo]

Checked by building main, #8 and #9 and counting copies of Better Auth's request state in dev and in the built server. main has two copies (the bug), this PR has one. I pushed one commit: the packages are now matched by pattern, and the build check now looks at every defineRequestState() call instead of two fixed text markers, with tests.