Keep trusting localhost when BETTER_AUTH_URL is a tenant's host

The Visionaries setup doc told devs to set BETTER_AUTH_URL to the
Visionaries host. Better Auth only trusted localhost because it was the
base URL, so with that setting, signing in to the default tenant at
localhost:3000 failed with 403 "Invalid origin" and the login page did
nothing. Outside production, trust localhost regardless of the base URL.

The doc now says to leave BETTER_AUTH_URL at the template value, since
every local tenant works with it, and to change it only when Better
Auth-built links such as the password reset link need to open on the
Visionaries host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EsE8hW2Sa81QXuqHAStNNa

Author: claude

docs/VISIONARIES_DEVELOPMENT.md

@@ -12,12 +12,20 @@ email configuration for ordinary development.
 
 Add `visionariestothethrone.lvh.me` to the comma-separated `ALLOWED_DEV_ORIGINS`
 value in your local `.env` (preserve any existing entries). Restart Next.js after
-changing it. For this tenant's auth work, set:
+changing it.
+
+Leave `BETTER_AUTH_URL` at the template's `http://localhost:3000`. Visionaries,
+ServiceStart at `localhost:3000`, and the other seeded tenants all work with it
+at the same time. Change it only when you need links that Better Auth builds,
+such as the password reset link, to open on the Visionaries host:
 
 ```dotenv
 BETTER_AUTH_URL=http://visionariestothethrone.lvh.me:3000
 ```
 
+`localhost:3000` keeps working with either value. Restart Next.js after changing
+it.
+
 With your **local development database** configured, run:
 
 ```bash

lib/auth.ts

@@ -28,21 +28,28 @@ const baseURL = process.env.BETTER_AUTH_URL || getBaseUrl();
  * Tenants are served from subdomains of the tenant root domain (`<slug>.lvh.me`
  * in local development). Better Auth only trusts its base URL by default and
  * rejects cookie-bearing requests from other origins, so trust the tenant
- * hosts too. These are static patterns rather than a per-request function
- * because Better Auth stores per-request origins on a context shared by
- * concurrent requests.
+ * hosts too. Outside production, also trust localhost, which serves the
+ * default tenant locally, so it keeps working when BETTER_AUTH_URL points at
+ * another tenant's host. These are static patterns rather than a per-request
+ * function because Better Auth stores per-request origins on a context shared
+ * by concurrent requests.
  */
-function tenantTrustedOrigins(): string[] {
-  const { protocol, port } = new URL(baseURL);
+export function tenantTrustedOrigins(authBaseURL: string): string[] {
+  const { protocol, port } = new URL(authBaseURL);
   const suffix = port ? `:${port}` : "";
+  const isProduction = process.env.NODE_ENV === "production";
   const roots = [getTenantRootDomain()];
-  if (process.env.NODE_ENV !== "production" && !roots.includes("lvh.me")) {
+  if (!isProduction && !roots.includes("lvh.me")) {
     roots.push("lvh.me");
   }
-  return roots.flatMap((root) => [
+  const origins = roots.flatMap((root) => [
     `${protocol}//${root}${suffix}`,
     `${protocol}//*.${root}${suffix}`,
   ]);
+  if (!isProduction) {
+    origins.push(`${protocol}//localhost${suffix}`);
+  }
+  return origins;
 }
 
 export const auth = betterAuth({
@@ -177,7 +184,7 @@ export const auth = betterAuth({
     },
   },
   baseURL,
-  trustedOrigins: tenantTrustedOrigins(),
+  trustedOrigins: tenantTrustedOrigins(baseURL),
   database: drizzleAdapter(db, {
     provider: "pg",
     usePlural: true,

tests/unit/lib/auth.test.ts

@@ -1,8 +1,8 @@
 // @vitest-environment node
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { and, eq } from "drizzle-orm";
 import db from "@/lib/db";
-import { auth } from "@/lib/auth";
+import { auth, tenantTrustedOrigins } from "@/lib/auth";
 import { eventRsvps, members, MemberType, shiftRSVPs } from "@/lib/schema";
 import {
   addMember,
@@ -207,6 +207,29 @@ describe("trusted origins", () => {
   });
 });
 
+describe(tenantTrustedOrigins, () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("keeps trusting localhost when the base URL is a tenant's host", () => {
+    const origins = tenantTrustedOrigins(
+      "http://visionariestothethrone.lvh.me:3000",
+    );
+
+    expect(origins).toContain("http://localhost:3000");
+    expect(origins).toContain("http://*.lvh.me:3000");
+  });
+
+  it("doesn't trust localhost in production", () => {
+    vi.stubEnv("NODE_ENV", "production");
+
+    const origins = tenantTrustedOrigins("https://acme.servicestart.com");
+
+    expect(origins.some((origin) => origin.includes("localhost"))).toBe(false);
+  });
+});
+
 describe("member type", () => {
   it("is returned with the member", async () => {
     const org = await createOrganization("member-type-read");