3 files changed, 70 insertions, 0 deletions
diff --git a/apps/web/src/auth/client.ts b/apps/web/src/auth/client.ts
new file mode 100644
index 00000000..58be51c3
--- /dev/null
+++ b/apps/web/src/auth/client.ts
@@ -0,0 +1,6 @@
+import { createAuthClient } from "better-auth/react";
+import { webEnv } from "@/env/web";
+
+export const { signIn, signUp, useSession } = createAuthClient({
+	baseURL: webEnv.NEXT_PUBLIC_SITE_URL,
+});
diff --git a/apps/web/src/auth/rate-limit.ts b/apps/web/src/auth/rate-limit.ts
new file mode 100644
index 00000000..c10c3819
--- /dev/null
+++ b/apps/web/src/auth/rate-limit.ts
@@ -0,0 +1,21 @@
+import { Ratelimit } from "@upstash/ratelimit";
+import { Redis } from "@upstash/redis";
+import { webEnv } from "@/env/web";
+
+const redis = new Redis({
+	url: webEnv.UPSTASH_REDIS_REST_URL,
+	token: webEnv.UPSTASH_REDIS_REST_TOKEN,
+});
+
+export const baseRateLimit = new Ratelimit({
+	redis,
+	limiter: Ratelimit.slidingWindow(100, "1 m"), // 100 requests per minute
+	analytics: true,
+	prefix: "rate-limit",
+});
+
+export async function checkRateLimit({ request }: { request: Request }) {
+	const ip = request.headers.get("x-forwarded-for") ?? "anonymous";
+	const { success } = await baseRateLimit.limit(ip);
+	return { success, limited: !success };
+}
diff --git a/apps/web/src/auth/server.ts b/apps/web/src/auth/server.ts
new file mode 100644
index 00000000..5e49387a
--- /dev/null
+++ b/apps/web/src/auth/server.ts
@@ -0,0 +1,43 @@
+import { betterAuth, type RateLimit } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { Redis } from "@upstash/redis";
+import { db } from "@/db";
+import { webEnv } from "@/env/web";
+
+const redis = new Redis({
+	url: webEnv.UPSTASH_REDIS_REST_URL,
+	token: webEnv.UPSTASH_REDIS_REST_TOKEN,
+});
+
+export const auth = betterAuth({
+	database: drizzleAdapter(db, {
+		provider: "pg",
+		usePlural: true,
+	}),
+	secret: webEnv.BETTER_AUTH_SECRET,
+	user: {
+		deleteUser: {
+			enabled: true,
+		},
+	},
+	emailAndPassword: {
+		enabled: true,
+	},
+	rateLimit: {
+		storage: "secondary-storage",
+		customStorage: {
+			get: async (key) => {
+				const value = await redis.get(key);
+				return value as RateLimit | undefined;
+			},
+			set: async (key, value) => {
+				await redis.set(key, value);
+			},
+		},
+	},
+	baseURL: webEnv.NEXT_PUBLIC_SITE_URL,
+	appName: "OpenCut",
+	trustedOrigins: [webEnv.NEXT_PUBLIC_SITE_URL],
+});
+
+export type Auth = typeof auth;