fix better auth upgrade

apps/web/package.json

@@ -23,7 +23,7 @@
     "@ai-sdk/provider": "2.0.0",
     "@ai-sdk/react": "2.0.76",
     "@asteasolutions/zod-to-openapi": "8.1.0",
-    "@better-auth/sso": "1.3.7",
+    "@better-auth/sso": "1.3.28",
     "@date-fns/tz": "1.4.1",
     "@dub/analytics": "0.0.32",
     "@formkit/auto-animate": "0.9.0",
@@ -91,7 +91,7 @@
     "@vercel/analytics": "1.5.0",
     "@vercel/speed-insights": "1.2.0",
     "ai": "5.0.76",
-    "better-auth": "1.3.7",
+    "better-auth": "1.3.28",
     "braintrust": "0.4.6",
     "capital-case": "2.0.0",
     "cheerio": "1.0.0",

apps/web/prisma/migrations/20251021213524_better_auth_refresh_token_expires_at/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "Account" ADD COLUMN     "refreshTokenExpiresAt" TIMESTAMP(3);

apps/web/prisma/schema.prisma

@@ -10,22 +10,23 @@ generator client {
 
 // Account, User, Session, and VerificationToken based on: https://authjs.dev/reference/adapter/prisma
 model Account {
-  id                String        @id @default(cuid())
-  createdAt         DateTime      @default(now())
-  updatedAt         DateTime      @updatedAt
-  userId            String
-  provider          String
-  type              String        @default("oidc") // next-auth deprecated field
-  providerAccountId String
-  refresh_token     String?       @db.Text
-  access_token      String?       @db.Text
-  expires_at        DateTime?     @default(now())
-  token_type        String?
-  scope             String?
-  id_token          String?       @db.Text
-  session_state     String?
-  user              User          @relation(fields: [userId], references: [id], onDelete: Cascade)
-  emailAccount      EmailAccount?
+  id                    String        @id @default(cuid())
+  createdAt             DateTime      @default(now())
+  updatedAt             DateTime      @updatedAt
+  userId                String
+  provider              String
+  type                  String        @default("oidc") // next-auth deprecated field
+  providerAccountId     String
+  refresh_token         String?       @db.Text
+  refreshTokenExpiresAt DateTime?
+  access_token          String?       @db.Text
+  expires_at            DateTime?     @default(now())
+  token_type            String?
+  scope                 String?
+  id_token              String?       @db.Text
+  session_state         String?
+  user                  User          @relation(fields: [userId], references: [id], onDelete: Cascade)
+  emailAccount          EmailAccount?
 
   @@unique([provider, providerAccountId])
 }
@@ -402,7 +403,7 @@ model Rule {
   // category condition
   // only apply to (or do not apply to) senders in these categories
   categoryFilterType CategoryFilterType? // deprecated
-  categoryFilters Category[] // deprecated
+  categoryFilters    Category[] // deprecated
 
   systemType SystemType?
 

apps/web/utils/auth.ts

@@ -81,6 +81,7 @@ export const betterAuthConfig = betterAuth({
       accountId: "providerAccountId",
       providerId: "provider",
       refreshToken: "refresh_token",
+      refreshTokenExpiresAt: "refreshTokenExpiresAt",
       accessToken: "access_token",
       accessTokenExpiresAt: "expires_at",
       idToken: "id_token",

package.json

@@ -36,7 +36,7 @@
       "@types/react-dom": "19.0.4"
     },
     "patchedDependencies": {
-      "better-auth@1.3.7": "patches/better-auth@1.3.7.patch"
+      "better-auth@1.3.28": "patches/better-auth@1.3.28.patch"
     }
   }
 }

patches/better-auth@1.3.28.patch

@@ -0,0 +1,12 @@
+diff --git a/dist/shared/better-auth.CjNhg7P4.mjs b/dist/shared/better-auth.CjNhg7P4.mjs
+index 4a8d8eb763db277adc589fa389808926fc6dedcb..273bd0cd8103f0a44b5c65e9f8de74a14c92b7b5 100644
+--- a/dist/shared/better-auth.CjNhg7P4.mjs
++++ b/dist/shared/better-auth.CjNhg7P4.mjs
+@@ -172,6 +172,7 @@ async function setCookieCache(ctx, session, dontRememberMe) {
+       },
+       {}
+     );
++    session.user.image = null;
+     const sessionData = { session: filteredSession, user: session.user };
+     const options = {
+       ...ctx.context.authCookies.sessionData.options,