test: check the Better Auth packages stay in one server bundle

[viganogabriele]

What this PR is now

This PR started as a fix for the same bug as #9: when someone who was not already signed in here signed in to an application through this provider, they authenticated with Google or PoliNetwork APS and then landed on this app's home page, instead of going back to the application that sent them.

#9 fixed it first, in the opposite way to this PR, and has been merged. This PR is now rebased on top of it and only adds a test for #9's setting.

Why the original change was dropped

The original change kept better-auth out of the Vite server bundle (ssr.external: ["better-auth"]). It fixed the bug, but:

• It made the build carry a second copy of TanStack Start's server code, because better-auth/tanstack-start imports @tanstack/react-start/server. Cookies still worked only because TanStack happens to keep its request store on a global key.
• Together with fix: keep one Better Auth instance so provider sign-in returns to the app #9's ssr.noExternal, it brings the bug back. external wins for better-auth, and the OAuth plugin's own request state ends up in two copies. I checked this by building with both settings: fix: keep one Better Auth instance so provider sign-in returns to the app #9's build check fails.

So only one of the two could land, and #9's approach is the one that works with TanStack Start instead of against it.

What this PR adds

vite.config.test.ts reads every better-auth / @better-auth/* package from package.json and checks that ssr.noExternal bundles each of them and their subpaths, and that none is marked external.

#9's scripts/check-server-bundle.mjs catches a duplicate in the built output, but only when you run a build. This test catches the setting that causes it under vp test, without building. It fails on the old main config and on this PR's original config.

Checks

• vp check: clean.
• vp test: 46 passed.
• The new test fails with the vite.config.ts from before fix: keep one Better Auth instance so provider sign-in returns to the app #9 and with the original ssr.external version of this PR.

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 5c115d76-8e54-4b70-ba29-8a4a99055bd1

📥 Commits

Reviewing files that changed from the base of the PR and between 5b70bfd and d84a093.

📒 Files selected for processing (2)

• vite.config.test.ts
• vite.config.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

Vite SSR now externalizes better-auth instead of bundling it into the server graph. A test checks that the server configuration includes better-auth in ssr.external.

Changes

SSR externalization

Layer / File(s)	Summary
Configure and verify SSR externalization vite.config.ts, vite.config.test.ts	The Vite SSR configuration externalizes better-auth. A test checks that ssr.external includes it.

Priority: ➖ Normal

Change: Bug fix

Merge Risk: ⚪ Minimal · up to d84a0

Externalizing the shared better-auth package is intended to let provider callbacks resume the initiating OAuth request. No actionable merge-blocking risk is evident; proceed with normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to d84a0

The change affects 2 systems.

Changed systems: vite.config.ts, vite.config.test.ts

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — vite.config.ts (service) was modified; 1 changed file maps to changed impact.
• observed — vite.config.test.ts (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in vite.config.test.ts: Adds a test that checks the server configuration lists better-auth in ssr.external.
• observed — Modified behavior in vite.config.ts: Adds an SSR externalization rule for better-auth; it is no longer bundled into the server graph.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the Better Auth server-bundle behavior under test. It relates to the SSR externalization change and the goal of sharing one server-side Better Auth instance.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lorenzocorallo]

Rebased on #9, which fixed the same bug the other way round. The original ssr.external change would have brought the bug back next to #9's setting, so it's dropped. What's left is a test that checks every Better Auth package in package.json is kept in the server bundle. It fails on both old configs.