Migrate from the better-auth agent plugin

// BEFORE: lib/auth.ts (better-auth + agent plugin)
import { betterAuth } from 'better-auth';
import { agent } from '@better-auth/agent-auth';

export const auth = betterAuth({
  database: { provider: 'postgresql', url: process.env.DATABASE_URL },
  emailAndPassword: { enabled: true },
  plugins: [agent()],
});

// AFTER: lib/theauth.ts
import { createTheAuth } from '@glinr/theauth';

export const theauth = await createTheAuth({
  database: { provider: 'postgres', url: process.env.DATABASE_URL! },
  secret: process.env.THEAUTH_SECRET!,
  baseUrl: process.env.AUTH_BASE_URL!,
  auth: { session: { secret: process.env.SESSION_SECRET! } },
  username: { password: { minLength: 8 } }, // TheAuth's password auth is username-based, see /auth/username
  // No agent plugin, it is core.
});

// BEFORE (better-auth + agent plugin)
const agent = await auth.api.createAgent({
  userId: user.id,
  name: 'github-reader',
  kind: 'service',
  scopes: ['github:read'],
});

// agent.accessToken is the bearer. Store it.

// AFTER (TheAuth)
const agent = await theauth.agent.create({
  ownerId: user.id,
  name: 'github-reader',
  type: 'service',
  permissions: [
    {
      resource: 'mcp:github:*',
      actions: ['read'],
      constraints: { maxCallsPerHour: 500 },
    },
  ],
});

// agent.token (kv_ plus base64url of 32 random bytes) is the bearer. Returned once,
// only its SHA-256 hash is stored. Rotate with theauth.agent.rotate(agent.id) to cut
// a new one; the old token stops validating as soon as the new hash is written.

// BEFORE (better-auth + agent plugin)
const result = await auth.api.verifyAgentToken(token);
if (!result.valid) return new Response('Unauthorized', { status: 401 });

if (!result.scopes.includes('github:read')) {
  return new Response('Forbidden', { status: 403 });
}

// AFTER (TheAuth)
const result = await theauth.authorizeByToken(token, {
  action: 'read',
  resource: 'mcp:github:repos',
});

if (!result.allowed) {
  return new Response(result.reason ?? 'Forbidden', { status: 403 });
}

// Every call is audited. result.auditId points at the row.

// BEFORE: single-hop only. You create a new agent whose scopes are a subset of the parent.
const child = await auth.api.createAgent({
  userId: user.id,
  name: 'child-agent',
  kind: 'service',
  scopes: ['github:read'], // must be a subset of parent
});

// AFTER: explicit chain with depth and expiry
const chain = await theauth.delegate({
  fromAgent: parent.id,
  toAgent: child.id,
  permissions: [{ resource: 'mcp:github:*', actions: ['read'] }],
  maxDepth: 2,
  expiresAt: new Date(Date.now() + 60 * 60 * 1000),
});

// Revoke the link, and every link downstream of `child`, in one call:
await theauth.delegation.revoke(chain.id);

const score = await theauth.trust.computeScore(agent.id);

if (score.level === 'untrusted' || score.level === 'limited') {
  // Route through the approval flow instead of auto-execute.
  await theauth.approval.request({
    agentId: agent.id,
    userId: agent.ownerId,
    action: 'delete',
    resource: 'file:prod-data/*',
  });
  return { queued: true };
}

import { createTheAuth } from '@glinr/theauth';
import { createMcpModule } from '@glinr/theauth/mcp';
import { theAuthNextjs } from '@glinr/theauth-nextjs';
import { mcpStore } from './mcp-store'; // storeClient, findClient, storeAuthorizationCode, ...

const theauth = await createTheAuth({
  database: { provider: 'postgres', url: process.env.DATABASE_URL! },
  mcp: { enabled: true }, // creates the MCP server registry table only
});

const mcp = createMcpModule({
  config: {
    enabled: true,
    issuer: 'https://auth.yourapp.com',
    // Public origin plus the adapter mount path
    baseUrl: 'https://auth.yourapp.com/api/theauth',
    signingSecret: process.env.MCP_SIGNING_SECRET!, // at least 32 characters
  },
  ...mcpStore,
});

export const { GET, POST, PATCH, DELETE, OPTIONS } = theAuthNextjs(theauth, { mcp });

// scripts/import-agents.ts
import { theauth } from '../lib/theauth.js';

interface LegacyAgent {
  userId: string;
  name: string;
  kind: 'service' | 'user-agent';
  scopes: string[]; // e.g. ['github:read']
}

export async function importAgent(legacy: LegacyAgent) {
  const agent = await theauth.agent.create({
    ownerId: legacy.userId, // must already exist in theauth_users
    name: legacy.name,
    type: legacy.kind === 'service' ? 'service' : 'autonomous',
    permissions: legacy.scopes.map((scope) => {
      // 'github:read' becomes resource 'mcp:github:*' with action 'read'
      const idx = scope.lastIndexOf(':');
      const resource = scope.slice(0, idx);
      const action = scope.slice(idx + 1);
      return { resource: `mcp:${resource}:*`, actions: [action] };
    }),
    metadata: { importedFrom: 'better-auth-agent-plugin' },
  });

  // agent.token is shown once. Deliver it to the service that used the old accessToken.
  return agent;
}

pnpm --filter @glinr/theauth-example-migrate-from-better-auth-agent-plugin start
pnpm --filter @glinr/theauth-example-migrate-from-better-auth-agent-plugin test