auth: request tracing + configurable Better Auth log level (debug OAuth flow)

src/auth.ts

@@ -50,6 +50,7 @@ export const auth = betterAuth({
   // its default basePath while generated URLs/issuer keep the /auth prefix.
   baseURL: required("BETTER_AUTH_URL"),
   secret: required("BETTER_AUTH_SECRET"),
+  logger: { level: (process.env.LOG_LEVEL as "debug" | "info") ?? "info" },
   trustedOrigins: (process.env.TRUSTED_ORIGINS ?? "").split(",").filter(Boolean),
   database: pool,
   socialProviders,

src/server.ts

@@ -54,6 +54,12 @@ ${auth.options.socialProviders && "apple" in auth.options.socialProviders ? soci
 
 const server = createServer((req, res) => {
   const url = new URL(req.url ?? "/", "http://localhost");
+  if (url.pathname !== "/healthz") {
+    // Request-level trace (path only, no query — avoids logging codes/tokens).
+    // eslint-disable-next-line no-console
+    console.log(`[req] ${req.method} ${url.pathname}`);
+    res.on("finish", () => console.log(`[res] ${req.method} ${url.pathname} -> ${res.statusCode}`));
+  }
   if (url.pathname === "/healthz") {
     res.writeHead(200, { "content-type": "application/json" });
     res.end('{"status":"ok"}');