feat: reset app on Better Auth v3 foundation

.env.template

@@ -2,38 +2,10 @@
 DATABASE_URL=""
 
 # Authentication
-NEXTAUTH_URL=""
-NEXTAUTH_SECRET=""
-AUTH_TRUST_HOST="true"
-
-# GitHub App (required for GitHub login and repository import)
-GITHUB_APP_ID=""
-GITHUB_APP_PRIVATE_KEY=""
-GITHUB_APP_WEBHOOK_SECRET=""
-GITHUB_APP_CLIENT_ID=""
-GITHUB_APP_CLIENT_SECRET=""
-NEXT_PUBLIC_GITHUB_APP_NAME=""
-
-# Sealos OAuth (optional)
-SEALOS_JWT_SECRET=""
-
-# Feature Flags
-ENABLE_PASSWORD_AUTH=""
-ENABLE_GITHUB_AUTH="true"
-ENABLE_SEALOS_AUTH=""
-
-# Reconciliation
-DATABASE_LOCK_DURATION_SECONDS=""
-MAX_DATABASES_PER_RECONCILE=""
-SANDBOX_LOCK_DURATION_SECONDS=""
-MAX_SANDBOXES_PER_RECONCILE=""
-
-# Kubernetes
-RUNTIME_IMAGE=""
-
-# AI Proxy
-AIPROXY_ENDPOINT=""
-ANTHROPIC_BASE_URL=""
+BETTER_AUTH_URL="http://localhost:3000"
+BETTER_AUTH_SECRET=""
+GITHUB_CLIENT_ID=""
+GITHUB_CLIENT_SECRET=""
 
 # Logging
 LOG_LEVEL="info"

.github/workflows/ci.yml

@@ -16,13 +16,32 @@ env:
   NODE_VERSION: "22.12.0"
   PNPM_VERSION: "10.20.0"
   NEXT_TELEMETRY_DISABLED: 1
-  SKIP_ENV_VALIDATION: 1
+  DATABASE_URL: postgresql://postgres:postgres@localhost:5432/fulling_test
+  BETTER_AUTH_URL: http://127.0.0.1:3000
+  BETTER_AUTH_SECRET: ci-better-auth-secret-at-least-32-characters
+  GITHUB_CLIENT_ID: test-github-client-id
+  GITHUB_CLIENT_SECRET: test-github-client-secret
 
 jobs:
   lint-test-build:
     name: Lint, Test, Build
     runs-on: ubuntu-latest
 
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: fulling_test
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_USER: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d fulling_test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -41,11 +60,20 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Deploy database baseline
+        run: pnpm prisma:migrate
+
       - name: Run linter
         run: pnpm lint
 
       - name: Run tests
         run: pnpm test
 
+      - name: Install Playwright Chromium
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Run browser tests
+        run: pnpm test:e2e
+
       - name: Build project
         run: pnpm build

.gitignore

@@ -13,6 +13,9 @@
 
 # testing
 /coverage
+/playwright-report/
+/test-results/
+/e2e/.auth/
 
 # next.js
 /.next/
@@ -42,8 +45,12 @@ yarn-error.log*
 *.pem
 *.crt
 *.pfx
-kubeconfig
-*kubeconfig*
+/kubeconfig
+/kubeconfig.yaml
+/kubeconfig.yml
+*.kubeconfig
+*.kubeconfig.yaml
+*.kubeconfig.yml
 credentials.json
 secrets.yaml
 secrets.yml

AGENTS.md

@@ -12,8 +12,8 @@ Read [docs/architecture.md](./docs/architecture.md) before product or architectu
 
 - Next.js 16 (App Router) + React 19 + TypeScript
 - Tailwind CSS v4 + Shadcn/UI
-- Node.js 22 + Prisma + NextAuth v5
-- Kubernetes + PostgreSQL (KubeBlocks)
+- Node.js 22 + Prisma + Better Auth
+- Kubernetes + PostgreSQL
 
 ## Code Conventions
 
@@ -25,11 +25,13 @@ Read [docs/architecture.md](./docs/architecture.md) before product or architectu
 
 ## Current Implementation Context
 
-- Existing code still contains v2 project/resource abstractions. Do not treat them as v3 product architecture.
-- **Asynchronous reconciliation** exists in current code: API → Database → Reconciliation Job → Event → K8s Operation
-- **Always use user-specific K8s service**: `const k8sService = await getK8sServiceForUser(userId)`
-- **Optimistic locking** in Repository layer
-- **Non-blocking APIs**: endpoints only update DB, return immediately
+- GitHub is the only authentication provider.
+- Better Auth stores users, provider accounts, and sessions in PostgreSQL.
+- Each user may store one plaintext kubeconfig; browser APIs never return it.
+- **Always use the user-specific K8s service**:
+  `const k8sService = await getK8sServiceForUser(userId)`.
+- The current user-level kubeconfig is a foundation boundary, not the final v3
+  Workspace Runtime ownership model.
 
 ## UI Direction
 
@@ -43,9 +45,9 @@ Avoid generic AI copywriting cliches such as "Elevate", "Seamless", and
 ## Key Files
 
 - [docs/architecture.md](./docs/architecture.md) — v3 system architecture and product model
-- `lib/k8s/k8s-service-helper.ts` — User-specific K8s service
-- `lib/events/` + `lib/jobs/` — Reconciliation core
-- `instrumentation.ts` — Application startup
+- `lib/auth/` — Better Auth and application session boundary
+- `lib/kubeconfig/` — User credential persistence
+- `lib/k8s/` — Validation and user-specific Kubernetes service
 
 ## Image Tagging Policy
 
@@ -90,9 +92,10 @@ Do not use ambiguous moving tags such as `main`, `stable`, `prod`, `release`,
 ## Development Commands
 
 ```bash
-pnpm dev              # Start dev server
-pnpm build            # Build for production
-pnpm lint             # Run ESLint
-npx prisma generate   # Generate Prisma client
-npx prisma db push    # Push schema to database
+corepack pnpm dev              # Start dev server
+corepack pnpm build            # Build for production
+corepack pnpm lint             # Run ESLint
+corepack pnpm test             # Run Vitest
+corepack pnpm test:e2e         # Run Playwright
+corepack pnpm prisma:migrate   # Deploy the baseline migration
 ```