examples/react/start-basic-better-auth/.gitignore (1)

1-6: LGTM; consider widening env ignores to .env.* (while keeping .env.example).
Current rules are fine; if you want to prevent accidental commits of .env.development / .env.production, consider adding .env.* and a negation for .env.example.

examples/react/start-basic-better-auth/tsconfig.json (1)

1-24: Strict TS config looks good; consider adding forceConsistentCasingInFileNames.
This helps avoid case-only import bugs that show up on CI/Linux but not on macOS/Windows.

Proposed diff

 {
   "compilerOptions": {
     "target": "ES2022",
     "lib": ["ES2022", "DOM", "DOM.Iterable"],
     "module": "ESNext",
     "skipLibCheck": true,
     "moduleResolution": "bundler",
     "allowImportingTsExtensions": true,
     "resolveJsonModule": true,
     "isolatedModules": true,
     "noEmit": true,
     "jsx": "react-jsx",
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noFallthroughCasesInSwitch": true,
+    "forceConsistentCasingInFileNames": true,
     "allowSyntheticDefaultImports": true,
     "baseUrl": ".",
     "paths": {
       "~/*": ["./src/*"]
     }
   },
   "include": ["src", "env.d.ts", "vite.config.ts"]
 }

examples/react/start-basic-better-auth/vite.config.ts (1)

9-10: Consider removing strictPort for better developer experience.

Setting strictPort: true will cause the dev server to fail immediately if port 10000 is already in use. For an example project, this might be overly strict and could frustrate developers who have other services running on that port. Consider removing this option or setting it to false to allow Vite to find an available port automatically.

♻️ More flexible configuration

  server: {
    port: 10000,
-    strictPort: true,
  },

examples/react/start-basic-better-auth/src/routes/__root.tsx (1)

100-105: Optional chaining is redundant within the conditional block.

Since routeContext.session is already verified as truthy on line 100, the optional chaining on routeContext.session?.user?.name and routeContext.session?.user?.email is redundant. While this doesn't cause issues, simplifying to routeContext.session.user?.name improves code clarity.

♻️ Simplify optional chaining

  {routeContext.session ? (
    <>
      <span className="text-gray-600">
-        {routeContext.session?.user?.name ||
-          routeContext.session?.user?.email}
+        {routeContext.session.user?.name ||
+          routeContext.session.user?.email}
      </span>

examples/react/start-basic-better-auth/.env.example (1)

1-3: Consider adding secret generation instructions.

The comment mentions the minimum length requirement, but developers might benefit from guidance on how to generate a secure secret. Consider adding a comment with a command they can run.

📝 Enhanced documentation

 # Better Auth Configuration
-BETTER_AUTH_SECRET=your-secret-key-here-min-32-chars-long
+# Generate a secure secret with: openssl rand -base64 32
+BETTER_AUTH_SECRET=your-secret-key-here-min-32-chars-long

examples/react/start-basic-better-auth/src/router.tsx (1)

11-12: Use consistent component reference pattern.

The defaultErrorComponent uses a direct component reference while defaultNotFoundComponent wraps the component in an inline arrow function. This inconsistency creates a new component instance on each evaluation and could interfere with hot module replacement during development.

♻️ Make component references consistent

    defaultPreload: "intent",
    defaultErrorComponent: DefaultCatchBoundary,
-    defaultNotFoundComponent: () => <NotFound />,
+    defaultNotFoundComponent: NotFound,
    scrollRestoration: true,

examples/react/start-basic-better-auth/src/routes/login.tsx (1)

14-19: Consider error handling for authentication failures.

The authClient.signIn.social() call has no error handling. If the OAuth flow fails (network error, user denies permission, etc.), the user receives no feedback.

♻️ Recommended enhancement with error handling

 function Login() {
+  const [error, setError] = React.useState<string | null>(null);
+
   const handleGitHubSignIn = () => {
-    authClient.signIn.social({
-      provider: "github",
-      callbackURL: "/",
-    });
+    setError(null);
+    authClient.signIn.social({
+      provider: "github",
+      callbackURL: "/",
+    }).catch((err) => {
+      setError("Failed to sign in. Please try again.");
+      console.error("Sign-in error:", err);
+    });
   };

   return (
     <div className="max-w-md mx-auto mt-10">
       <h1 className="text-2xl font-bold mb-6 text-center">Sign In</h1>

+      {error && (
+        <div className="mb-4 p-3 bg-red-100 text-red-700 rounded">
+          {error}
+        </div>
+      )}
+
       <div className="space-y-4">

examples/react/start-basic-better-auth/src/routes/index.tsx (1)

27-33: Validate image URLs to prevent potential security risks.

The user avatar is rendered directly from user.image without validation. While GitHub OAuth typically returns trusted URLs, it's a good practice to validate image sources to prevent potential SSRF or content injection if the OAuth provider's data is compromised or the provider is changed.

Consider adding URL validation or using a Content Security Policy to restrict image sources to trusted domains (e.g., GitHub's CDN).

examples/react/start-basic-better-auth/src/routes/protected.tsx (2)

3-10: Preserve “return to” intent on auth redirect (better UX).
Right now unauthenticated users always land on /login with no way to return to /protected after signing in; consider passing a search param (e.g. next=/protected) and consuming it in the login flow.

Proposed change

 export const Route = createFileRoute("/protected")({
   beforeLoad: ({ context }) => {
     if (!context.session) {
-      throw redirect({ to: "/login" });
+      throw redirect({
+        to: "/login",
+        search: { next: "/protected" },
+      });
     }
   },
   component: Protected,
 });

---

33-41: Harden avatar rendering (privacy/perf).
Consider adding loading="lazy", referrerPolicy="no-referrer" (common for 3rd-party avatars), and explicit width/height to reduce layout shift.

examples/react/start-basic-better-auth/src/components/DefaultCatchBoundary.tsx (1)

39-48: Optional: make “Go Back” more robust when history is empty.
window.history.back() can no-op on first-entry pages; consider falling back to router.navigate({ to: '/' }) (or just let the Link navigate) when history.length <= 1.

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Learnt from: CR
Repo: TanStack/router PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-06T15:03:07.223Z
Learning: Applies to **/*.{js,ts,tsx} : Implement ESLint rules for router best practices using the ESLint plugin router

Learnt from: nlynzaad
Repo: TanStack/router PR: 5402
File: packages/router-generator/tests/generator/no-formatted-route-tree/routeTree.nonnested.snapshot.ts:19-21
Timestamp: 2025-10-08T08:11:47.088Z
Learning: Test snapshot files in the router-generator tests directory (e.g., files matching the pattern `packages/router-generator/tests/generator/**/routeTree*.snapshot.ts` or `routeTree*.snapshot.js`) should not be modified or have issues flagged, as they are fixtures used to verify the generator's output and are intentionally preserved as-is.

Learnt from: CR
Repo: TanStack/router PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-06T15:03:07.223Z
Learning: Applies to **/*.{ts,tsx} : Use TypeScript strict mode with extensive type safety for all code

Learnt from: nlynzaad
Repo: TanStack/router PR: 5732
File: packages/start-client-core/src/client/hydrateStart.ts:6-9
Timestamp: 2025-11-02T16:16:24.898Z
Learning: In packages/start-client-core/src/client/hydrateStart.ts, the `import/no-duplicates` ESLint disable is necessary for imports from `#tanstack-router-entry` and `#tanstack-start-entry` because both aliases resolve to the same placeholder file (`fake-start-entry.js`) in package.json during static analysis, even though they resolve to different files at runtime.

Learnt from: nlynzaad
Repo: TanStack/router PR: 6215
File: e2e/react-start/custom-basepath/package.json:13-17
Timestamp: 2025-12-25T13:04:55.492Z
Learning: In the TanStack Router repository, e2e test scripts are specifically designed to run in CI (which uses a Unix environment), so Unix-specific commands (like `rm -rf`, `&` for backgrounding, and direct environment variable assignments without `cross-env`) are acceptable in e2e test npm scripts.

Learnt from: schiller-manuel
Repo: TanStack/router PR: 5330
File: e2e/react-start/custom-basepath/src/routeTree.gen.ts:58-61
Timestamp: 2025-10-01T18:31:35.420Z
Learning: Do not review files named `routeTree.gen.ts` in TanStack Router repositories, as these are autogenerated files that should not be manually modified.

Learnt from: schiller-manuel
Repo: TanStack/router PR: 6120
File: packages/router-generator/src/generator.ts:654-657
Timestamp: 2025-12-17T02:17:55.086Z
Learning: In `packages/router-generator/src/generator.ts`, pathless_layout routes must receive a `path` property when they have a `cleanedPath`, even though they are non-path routes. This is necessary because child routes inherit the path from their parent, and without this property, child routes would not have the correct full path at runtime.

Learnt from: Sheraff
Repo: TanStack/router PR: 6171
File: packages/router-core/src/new-process-route-tree.ts:898-898
Timestamp: 2025-12-21T12:52:35.231Z
Learning: In `packages/router-core/src/new-process-route-tree.ts`, the matching logic intentionally allows paths without trailing slashes to match index routes with trailing slashes (e.g., `/a` can match `/a/` route), but not vice-versa (e.g., `/a/` cannot match `/a` layout route). This is implemented via the condition `!pathIsIndex || node.kind === SEGMENT_TYPE_INDEX` and is a deliberate design decision to provide better UX by being permissive with missing trailing slashes.

Learnt from: CR
Repo: TanStack/router PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-06T15:03:07.223Z
Learning: Use file-based routing in `src/routes/` directories or code-based routing with route definitions