[Medformatik]

What changed and why

The API registered Better Auth's Expo server plugin "for compatibility with Expo's redirect handling", but nothing has used it since the Expo auth client was removed in #1. This PR removes the plugin, its @better-auth/expo dependency, and the custom-scheme entries in trustedOrigins that only Expo-style redirects needed.

The installed app (as of #757–#759) signs in like this: SystemAuthSession opens /mobile-auth in the system browser. Better Auth's own callbacks go to a same-origin path there. The page then returns to openmapx://auth/callback itself, with a short-lived code bound to a PKCE verifier the app keeps in memory. Native code calls the API without credentials, and the app's bundle rules keep better-auth out of native code.

The plugin did three things, and none of them is needed:

• It served /expo-authorization-proxy, the endpoint behind GHSA-4wq4-2ppv-q3hg (critical, fixed in 1.7.16 by fix(deps): upgrade Better Auth to 1.7.16 for the 2026-11-03 security release #761). Nothing calls it.
• It copied an expo-origin header into Origin when a request had none. Nothing sends that header, and requests from the WebView carry the web origin.
• After an OAuth callback, magic link or email verification, it appended the session cookie to any redirect to a trusted custom scheme. With openmapx:// trusted, a callback URL on that scheme would have put a working session into a deep link that another Android app can register for. The handoff exists to keep exactly that out of the URL.

trustedOrigins is now just the configured CORS_ORIGIN web origins. Removing openmapx:// (and the development-only exp:// patterns) means Better Auth rejects callback URLs on those schemes. The web app never sends one: its callbacks are paths or the page origin. Development app builds use openmapx-dev, which was never listed and works the same way. The OAuth provider plugin's own isTrustedOrigin checks validate HTTPS jwks_uri values only.

A new policy test asserts there is no expo plugin and no expoAuthorizationProxy endpoint, and that every trusted origin is an exact HTTP(S) origin. It fails against the code as merged in #761 and passes here.

Verification

• pnpm verify:full: lint, workspace types, policy, OpenAPI and all 24,748 portable tests pass.
• pnpm test:database api-privacy: 27 files and 149 tests pass, including auth-postgres.test.ts. The run used a disposable PostGIS 18-3.6 container at the CI digest, with the production Drizzle migrations applied first.
• auth:generate with auth@1.7.16: the formatted schema matches the committed auth-schema.ts.
• pnpm install --frozen-lockfile passes with @better-auth/expo gone from both the lockfile and the release-age exemptions.
• Not run: an installed-app sign-in through /mobile-auth on a device or emulator, and browser OAuth and passkey sign-in. The handoff code path does not change, but this PR does not exercise it end to end.

Release and upgrade impact

Product impact: ordinary

No migration or configuration change. The auth schema regenerates unchanged, and the OpenAPI document never listed the proxy endpoint.

No package release: this changes only apps/api and workspace dependency configuration; neither public package's sources change and neither depends on Better Auth.