From 46679865e3379480d0a3960ef0533a30edb5a5b2 Mon Sep 17 00:00:00 2001
From: Chris Farhood <chris@farhood.org>
Date: Mon, 6 Jul 2026 21:09:46 -0400
Subject: [PATCH] auth: env-gated email/password (debug the token exchange
 headlessly)

---
 src/auth.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/auth.ts b/src/auth.ts
index 26d0713..695cae8 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -52,6 +52,9 @@ export const auth = betterAuth({
   logger: { level: (process.env.LOG_LEVEL as "debug" | "info") ?? "info" },
   trustedOrigins: (process.env.TRUSTED_ORIGINS ?? "").split(",").filter(Boolean),
   database: pool,
+  // Temporary, env-gated: lets us mint a session headlessly to debug the OAuth
+  // token exchange without a browser. Off unless DEBUG_EMAIL_PASSWORD=true.
+  emailAndPassword: { enabled: process.env.DEBUG_EMAIL_PASSWORD === "true" },
   socialProviders,
   plugins: [
     // oauth-provider looks up the jwt plugin (for JWKS-verifiable access tokens)