feat(api-service, dashboard): Better auth integration DRAFT

[scopsy]

What changed? Why was the change needed?

EE: https://github.com/novuhq/packages-enterprise/pull/381

Screenshots

Expand for optional sections

Related enterprise PR

Special notes for your reviewer

[netlify]

✅ Deploy Preview for dashboard-v2-novu-staging canceled.

Name	Link
🔨 Latest commit	cab81dd
🔍 Latest deploy log	https://app.netlify.com/projects/dashboard-v2-novu-staging/deploys/697612bdea585300080ef5e3

[github-actions]

Hey there and thank you for opening this pull request! 👋

We require pull request titles to follow specific formatting rules and it looks like your proposed title needs to be adjusted.

Your PR title is: feat(api-service, dashboard): Better auth integration DRAFT

Requirements:

1. Follow the Conventional Commits specification
2. As a team member, include Linear ticket ID at the end: fixes TICKET-ID or include it in your branch name

Expected format: feat(scope): Add fancy new feature fixes NOV-123

Details:

PR title must end with 'fixes TICKET-ID' (e.g., 'fixes NOV-123') or include ticket ID in branch name

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/novuhq/novu@9711

npm i https://pkg.pr.new/novuhq/novu/@novu/providers@9711

npm i https://pkg.pr.new/novuhq/novu/@novu/shared@9711

commit: cab81dd

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@apps/dashboard/src/components/subscribers/schema.ts`:
- Line 35: The subscriberId schema currently applies .min(1) before .trim(), so
whitespace-only strings can pass length validation; update the chain on
subscriberId (z.string()) to call .trim() before .min(1, 'SubscriberId is
required') so input is trimmed prior to length validation and whitespace-only
values are rejected.

🧹 Nitpick comments (11)

.claude/skills/better-auth-best-practices/SKILL.md (5)

14-18: Add blank lines around the “Environment Variables” heading.
This violates MD022 (blank lines around headings).

✅ Proposed fix

 ## Quick Reference
-
 ### Environment Variables
+
 - `BETTER_AUTH_SECRET` - Encryption secret (min 32 chars). Generate: `openssl rand -base64 32`

---

20-24: Add blank lines around the “File Location” heading.
This violates MD022.

✅ Proposed fix

 Only define `baseURL`/`secret` in config if env vars are NOT set.
-
 ### File Location
+
 CLI looks for `auth.ts` in: `./`, `./lib`, `./utils`, or under `./src`. Use `--config` for custom path.

---

24-27: Add blank lines around the “CLI Commands” heading.
This violates MD022.

✅ Proposed fix

 CLI looks for `auth.ts` in: `./`, `./lib`, `./utils`, or under `./src`. Use `--config` for custom path.
-
 ### CLI Commands
+
 - `npx `@better-auth/cli`@latest migrate` - Apply schema (built-in adapter)

---

121-125: Specify a language on the fenced code block.
MD040 flags missing language.

✅ Proposed fix

-```
+```ts
 import { twoFactor } from "better-auth/plugins/two-factor"

</details>

---

`162-166`: **Ensure the file ends with a single trailing newline.**  
MD047 expects exactly one newline at EOF.

</blockquote></details>
<details>
<summary>apps/dashboard/src/components/subscribers/subscriber-overview-form.tsx (1)</summary><blockquote>

`158-168`: **Consider wrapping `JSON.parse` in try-catch for defensive error handling.**

While the `SubscriberFormSchema` validates that `data` is valid JSON before submission, `JSON.parse` on line 162 could still throw if an edge case bypasses validation (e.g., form state manipulation). Consider wrapping in try-catch for robustness:

<details>
<summary>Suggested defensive handling</summary>

```diff
       if (typedKey === 'data') {
-        const data = formData.data ? JSON.parse(formData.data) : {};
-
-        return { ...acc, data: data && Object.keys(data).length > 0 ? data : {} };
+        let data = {};
+        if (formData.data) {
+          try {
+            data = JSON.parse(formData.data);
+          } catch {
+            data = {};
+          }
+        }
+
+        return { ...acc, data: Object.keys(data).length > 0 ? data : {} };
       }

apps/dashboard/src/components/contexts/schema.ts (1)

16-30: Consider extracting the JSON validation logic to reduce duplication.

The JSON validation refine logic is duplicated between CreateContextFormSchema and EditContextFormSchema. This same pattern also appears in subscribers/schema.ts. Consider extracting to a reusable helper:

Suggested refactor

// In a shared validation utils file
const isValidJsonString = (str: string | undefined | null): boolean => {
  if (!str) return true;
  try {
    JSON.parse(str);
    return true;
  } catch {
    return false;
  }
};

// Usage
const jsonDataField = z
  .string()
  .refine(isValidJsonString, { message: 'Custom data must be a valid JSON' })
  .optional();

apps/dashboard/src/components/contexts/create-context-form.tsx (1)

93-99: Consider wrapping JSON.parse in try-catch for defensive error handling.

While the schema validates JSON before submission, adding a try-catch around JSON.parse on line 93 would provide additional safety against edge cases:

Suggested defensive handling

-    const parsedData = formData.data ? JSON.parse(formData.data) : {};
+    let parsedData = {};
+    if (formData.data) {
+      try {
+        parsedData = JSON.parse(formData.data);
+      } catch {
+        // Schema validation should prevent this, but handle gracefully
+        parsedData = {};
+      }
+    }

apps/dashboard/src/components/contexts/context-overview.tsx (1)

126-132: Consider wrapping JSON.parse in try-catch for consistency.

Same pattern as the other context forms - while schema validation should catch invalid JSON, defensive error handling would be beneficial:

Suggested defensive handling

-      const parsedData = formData.data ? JSON.parse(formData.data) : {};
+      let parsedData = {};
+      if (formData.data) {
+        try {
+          parsedData = JSON.parse(formData.data);
+        } catch {
+          parsedData = {};
+        }
+      }

.cursor/skills/better-auth-best-practices/SKILL.md (2)

57-57: Clarify model name casing convention.

The example states "If Prisma model is User" but then recommends modelName: "user" (lowercase). This could confuse developers about whether Better Auth expects lowercase model references regardless of ORM casing, or if the modelName should match the Prisma model case exactly.

Consider adding a brief note clarifying the casing convention, for example:

• "Better Auth expects lowercase model names in configuration, even when the ORM model is PascalCase"
• Or provide the exact rule Better Auth follows for model name resolution

---

1-10: Consider adding Better Auth version context.

Since Better Auth APIs can evolve across versions and the PR mentions v1.4.10, consider adding a version note to help future developers understand which version this documentation applies to. This could be added near the top or in the metadata section.

Example:

**Better Auth Version:** v1.4.10+

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Reorder .trim() before .min(1) to validate trimmed input.

The current order .min(1).trim() validates the length before trimming, which allows whitespace-only inputs like " " to pass the min(1) check, then get trimmed to an empty string—bypassing the required validation.

🐛 Proposed fix

-  subscriberId: z.string().min(1, 'SubscriberId is required').trim(),
+  subscriberId: z.string().trim().min(1, 'SubscriberId is required'),

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	subscriberId: z.string().min(1, 'SubscriberId is required').trim(),
	subscriberId: z.string().trim().min(1, 'SubscriberId is required'),

🤖 Prompt for AI Agents

In `@apps/dashboard/src/components/subscribers/schema.ts` at line 35, The
subscriberId schema currently applies .min(1) before .trim(), so whitespace-only
strings can pass length validation; update the chain on subscriberId
(z.string()) to call .trim() before .min(1, 'SubscriberId is required') so input
is trimmed prior to length validation and whitespace-only values are rejected.