fix(auth): remove the unused Expo server plugin and custom-scheme trusted origins

apps/api/package.json

@@ -21,7 +21,6 @@
   "dependencies": {
     "@archiver/archiver": "0.3.0",
     "@better-auth/core": "1.7.16",
-    "@better-auth/expo": "1.7.16",
     "@better-auth/i18n": "1.7.16",
     "@better-auth/oauth-provider": "1.7.16",
     "@better-auth/passkey": "1.7.16",

apps/api/src/auth-oauth-provider.test.ts

@@ -69,7 +69,6 @@ describe("managed OAuth provider policy", () => {
     const coreLock = packageLock.split("\n  packages/core:")[1]?.split("\n  packages/")[0] ?? "";
     const apiPackages = [
       "@better-auth/core",
-      "@better-auth/expo",
       "@better-auth/i18n",
       "@better-auth/oauth-provider",
       "@better-auth/passkey",
@@ -224,4 +223,20 @@ describe("managed OAuth provider policy", () => {
       pluginIds?.indexOf("custom-session") ?? -1,
     );
   });
+
+  // The installed app signs in through `/mobile-auth` and a PKCE-bound code.
+  // Expo's server plugin would add an authorization proxy and copy the session
+  // cookie into redirects to any trusted custom scheme.
+  it("serves no Expo authorization proxy and trusts only web origins", async () => {
+    const { auth } = await import("./auth");
+    const pluginIds = auth.options.plugins?.map((plugin) => plugin.id);
+
+    expect(pluginIds).not.toContain("expo");
+    expect(auth.api).not.toHaveProperty("expoAuthorizationProxy");
+    expect(auth.options.trustedOrigins).not.toHaveLength(0);
+    for (const origin of auth.options.trustedOrigins as string[]) {
+      expect(new URL(origin).origin).toBe(origin);
+      expect(["http:", "https:"]).toContain(new URL(origin).protocol);
+    }
+  });
 });

apps/api/src/auth.ts

@@ -1,4 +1,3 @@
-import { expo } from "@better-auth/expo";
 import { i18n } from "@better-auth/i18n";
 import { oauthProvider } from "@better-auth/oauth-provider";
 import { passkey } from "@better-auth/passkey";
@@ -98,13 +97,10 @@ const authOptions = {
   }),
   baseURL: envString("BETTER_AUTH_URL", "http://localhost:3001"),
   secret,
-  trustedOrigins: [
-    ...configuredTrustedWebOrigins(),
-    "openmapx://",
-    ...(process.env.NODE_ENV === "development"
-      ? ["exp://", "exp://**", "exp://192.168.*.*:*/**"]
-      : []),
-  ],
+  // Web origins only. The installed app never receives a Better Auth redirect:
+  // `/mobile-auth` returns to the app's scheme itself, with a PKCE-bound code
+  // instead of a session, so no custom scheme belongs in this list.
+  trustedOrigins: configuredTrustedWebOrigins(),
   appName: "OpenMapX",
   user: {
     deleteUser: {
@@ -278,9 +274,6 @@ const authOptions = {
     // only legitimate holder redeems it immediately. Stored hashed so a database
     // read never yields a usable token.
     oneTimeToken({ expiresIn: 2, storeToken: "hashed" }),
-    // Kept for server-side compatibility with Expo's redirect handling. No Expo
-    // native auth client is initialised: native never holds a session.
-    expo(),
     emailHarmony({ allowNormalizedSignin: true }),
     passkey({
       rpID: envString("PASSKEY_RP_ID", "localhost"),

pnpm-workspace.yaml

@@ -41,7 +41,6 @@ minimumReleaseAgeExclude:
   - "better-auth@1.7.16"
   - "@better-auth/core@1.7.16"
   - "@better-auth/drizzle-adapter@1.7.16"
-  - "@better-auth/expo@1.7.16"
   - "@better-auth/i18n@1.7.16"
   - "@better-auth/kysely-adapter@1.7.16"
   - "@better-auth/memory-adapter@1.7.16"
@@ -168,14 +167,9 @@ overrides:
   # installs it. These peers serve entry points nothing here imports, and the
   # API's production install carried them: Expo, React Native and Hermes
   # through drizzle-orm's `drizzle-orm/expo-sqlite` (only apps/mobile installs
-  # expo-sqlite, and it does not use drizzle-orm) and @better-auth/expo's
-  # `/client`; Next.js, Vue and Vitest through better-auth's `/next-js`, `/vue`
-  # and `/test`. Remove an entry before importing the entry point it serves.
-  "@better-auth/expo>expo-constants": "-"
-  "@better-auth/expo>expo-linking": "-"
-  "@better-auth/expo>expo-network": "-"
-  "@better-auth/expo>expo-secure-store": "-"
-  "@better-auth/expo>expo-web-browser": "-"
+  # expo-sqlite, and it does not use drizzle-orm); Next.js, Vue and Vitest
+  # through better-auth's `/next-js`, `/vue` and `/test`. Remove an entry
+  # before importing the entry point it serves.
   "better-auth>drizzle-kit": "-"
   "better-auth>next": "-"
   "better-auth>vitest": "-"