Varde

This repository holds everything hosted: the marketing site, user accounts, and (later) cloud anchors and billing. Varde's core technology lives in the public repo and stays open source (AGPL-3.0-or-later) forever.

Stack

• Next.js (App Router) + TypeScript + Tailwind CSS v4 — Vercel-ready
• HeroUI (@heroui/react v3 + @heroui-pro/react) components, themed to the Varde palette — the Pro package downloads its artifacts via a postinstall that needs HEROUI_AUTH_TOKEN (CI/CD license key, see .env.example)
• better-auth — email+password today, OAuth-ready (socialProviders)
• Drizzle ORM + Turso (libSQL) — chosen over Prisma because it's a thin schema-in-TypeScript layer with zero codegen step in the app itself (drizzle-kit only runs for schema changes), a first-class better-auth adapter, and Turso's generous free tier. Local dev runs on a plain file:./varde.db SQLite — no server needed.
• Polar for payments — merchant of record (they handle global VAT, invoicing, refunds, disputes), wired via the official @polar-sh/better-auth plugin. Dormant until POLAR_* env vars are set.
• pnpm — committed pnpm-lock.yaml; Vercel auto-detects it

Layout

src/
  app/            routes: /, /pricing, /download, /auth/*, /account, /api/auth/*
  components/     nav, footer, brand marks, auth form
  db/             Drizzle schema (better-auth tables)
  lib/            auth server config, auth client, db pool
public/brand/     logo kit copied from grendalaget/varde (MIT)
infra/            reserved for hosted-infra provisioning (anchor fleet later); the cp deploy lives in grendalaget/varde at infra/cp
services/         (future) plan-sync workers

Local development

pnpm install
cp .env.example .env        # set BETTER_AUTH_SECRET (`openssl rand -base64 32`);
                            # leave TURSO_* unset for the local file db
pnpm db:push                # create the auth tables in file:./varde.db
pnpm dev

No docker needed for the database. To point at a real Turso db instead, set TURSO_DATABASE_URL + TURSO_AUTH_TOKEN in .env.

Then http://localhost:3000 — sign up at /auth/sign-up, then /account.

Useful scripts

Command	What it does
pnpm dev	Next dev server (Turbopack)
pnpm build	production build
pnpm lint	eslint
pnpm typecheck	tsc --noEmit
pnpm db:push	push the Drizzle schema to TURSO_DATABASE_URL/file:./varde.db
pnpm db:generate	emit SQL migrations into drizzle/
pnpm auth:schema	regenerate src/db/schema.ts from better-auth

Auth design

better-auth owns sign-up/sign-in/sessions. Email+password is enabled now; GitHub/Google OAuth plug in via socialProviders in src/lib/auth.ts — the account table already stores provider tokens.

On HTTPS, all Better Auth cookies use the __Host-varde. prefix, Secure, HttpOnly, Path=/, and no Domain attribute. Local HTTP development uses host-only varde. cookies without Secure. Better Auth 1.7.7's automatic __Secure- naming is disabled so it cannot hide the browser-enforced __Host- prefix; the secure attribute is set explicitly. Cross-subdomain cookies stay disabled, including for previews.

The CP does not read site cookies. /federate/cp reads the site session on its own host, then redirects to the CP with a five-minute federation token in the URL fragment. The CP exchanges that token for its own session. /api/cp/* uses a server-side exchange, and desktop sign-in also mints a federation token. Docs are same-origin routes under /docs, not a separate docs authentication host. No sibling subdomain needs the site's session cookie.

Deploying this cookie-name change signs existing site users out once. Old domain-wide better-auth cookies are deliberately not accepted or migrated: a fallback would restore the sibling-subdomain attack surface. Existing CP sessions are independent. Old cookies can remain until their normal expiry, but the site ignores their old names. Before enabling untrusted hosted apps, revoke existing Better Auth sessions once (DELETE FROM session in the site's database). Renaming cookies alone does not revoke their signed values: a stolen legacy value could be replayed under the new name. This is an operator rollout step, not something to repeat on every deployment. Users must sign in again on the canonical site host. Serve production auth over HTTPS and keep the exact-origin allowlist; hosted apps under *.play.varde.games are same-site but must never be trusted origins.

All mutating API exports use withSameOrigin from src/lib/csrf.ts before session lookup or side effects. Better Auth and the guard share the base URL resolver and exact trusted-origin list in src/lib/auth-origins.ts: production defaults to https://varde.games, previews to their deployment URL, and explicit BETTER_AUTH_URL wins. The list includes the base origin, varde.games, www.varde.games, localhost development, and the exact configured Vercel deployment and branch origins. It never trusts wildcard subdomains. Without Origin, only Sec-Fetch-Site: same-origin or none is accepted. Untrusted sibling origins, null, missing metadata and arbitrary bearer headers do not bypass this guard. Only POST /api/auth/polar/webhooks is exempt: Polar authenticates its raw body by signature before billing updates. The desktop token route reads a browser session, so it is guarded, not a machine-endpoint exemption.

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗