Add next-auth with OIDC

apps/dbagent/package.json

@@ -40,6 +40,7 @@
     "kysely": "^0.27.5",
     "lucide-react": "^0.476.0",
     "next": "^15.1.7",
+    "next-auth": "5.0.0-beta.25",
     "next-themes": "^0.4.4",
     "pg": "^8.13.3",
     "react": "19.0.0",

apps/dbagent/src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,2 @@
+import { handlers } from '~/auth';
+export const { GET, POST } = handlers;

apps/dbagent/src/auth.ts

@@ -0,0 +1,21 @@
+import NextAuth from 'next-auth';
+import { env } from './lib/env/server';
+
+export const { handlers, signIn, signOut, auth } = NextAuth({
+  providers: [
+    {
+      id: 'openid',
+      name: 'OpenID',
+      type: 'oidc',
+      options: {
+        clientId: env.AUTH_OPENID_ID,
+        clientSecret: env.AUTH_OPENID_SECRET,
+        issuer: env.AUTH_OPENID_ISSUER
+      }
+    }
+  ],
+  secret: env.AUTH_SECRET,
+  session: {
+    strategy: 'jwt'
+  }
+});

apps/dbagent/src/lib/db/db.ts

@@ -1,6 +1,6 @@
 import { drizzle } from 'drizzle-orm/node-postgres';
 import { Pool } from 'pg';
-import { env } from '../env/db';
+import { env } from '../env/server';
 
 export const pool = new Pool({
   connectionString: env.DATABASE_URL,

apps/dbagent/src/lib/env/general.ts → apps/dbagent/src/lib/env/client.ts

@@ -1,5 +1,4 @@
 /* eslint-disable no-process-env */
-
 import { z } from 'zod';
 
 const schema = z.object({

apps/dbagent/src/lib/env/server.ts

@@ -0,0 +1,30 @@
+/* eslint-disable no-process-env */
+import 'server-only';
+import { z } from 'zod';
+import { env as clientEnv } from './client';
+
+const schema = z.object({
+  // The URL of the database that we use to store data
+  DATABASE_URL: z.string(),
+
+  // The OpenID client settings
+  AUTH_SECRET: z.string(),
+  AUTH_OPENID_ID: z.string(),
+  AUTH_OPENID_SECRET: z.string(),
+  AUTH_OPENID_ISSUER: z.string(),
+
+  // LLM API credentials
+  OPENAI_API_KEY: z.string(),
+  DEEPSEEK_API_KEY: z.string(),
+  ANTHROPIC_API_KEY: z.string(),
+
+  // How many schedules can run in parallel
+  MAX_PARALLEL_RUNS: z.number().default(20),
+
+  // How long to wait for a schedule to finish before assuming it's dead and running it again
+  TIMEOUT_FOR_RUNNING_SCHEDULE_SECS: z.number().default(15 * 60)
+});
+
+const serverEnv = schema.parse(process.env);
+
+export const env = { ...clientEnv, ...serverEnv };

apps/dbagent/src/lib/monitoring/scheduler.ts

@@ -6,7 +6,7 @@ import {
   setScheduleStatusRunning,
   updateScheduleRunData
 } from '~/lib/db/schedules';
-import { env } from '../env/scheduler';
+import { env } from '../env/server';
 import { runSchedule } from './runner';
 
 export function shouldRunSchedule(schedule: Schedule, now: Date): boolean {

apps/dbagent/src/lib/notifications/slack-webhook.ts

@@ -1,7 +1,7 @@
 import { DbConnection } from '../db/connections';
 import { getIntegration } from '../db/integrations';
 import { Schedule } from '../db/schedules';
-import { env } from '../env/general';
+import { env } from '../env/client';
 
 export type NotificationLevel = 'info' | 'warning' | 'alert';
 

apps/dbagent/src/middleware.ts

@@ -0,0 +1 @@
+export { auth as middleware } from '~/auth';