从 WorkOS 迁移到 Better Auth

import { auth } from "@/lib/auth"; // 您的 auth 实例路径
import { WorkOS } from "@workos-inc/node";

//==============================================================================

/*
  限流配置

  WorkOS 读取 API：每 10 秒 1,000 次请求
  默认设置：使用限制的 80%，以避免边缘情况

  参考：https://workos.com/docs/reference/rate-limits
*/
const TIME_WINDOW_MS = 10 * 1000; // 时间窗口（毫秒，10 秒）
const MAX_REQUESTS_PER_WINDOW = 800; // 每个时间窗口允许的最大 API 调用次数
const USERS_PER_REQUEST = 100; // 每次 API 调用获取多少用户

//==============================================================================

if (!process.env.WORKOS_API_KEY || !process.env.WORKOS_CLIENT_ID) {
  throw new Error(
    "缺少必需的环境变量 WORKOS_API_KEY 和/或 WORKOS_CLIENT_ID",
  );
}
const workos = new WorkOS(process.env.WORKOS_API_KEY);

/**
 * 创建一个速率限制器来跟踪和控制请求速率
 */
const createRateLimiter = (maxRequests: number, windowMs: number) => {
  let requestTimestamps: number[] = [];

  const waitIfNeeded = async (): Promise<void> => {
    const now = Date.now();

    // 移除当前窗口之外的时间戳
    requestTimestamps = requestTimestamps.filter(
      (timestamp) => now - timestamp < windowMs,
    );

    // 如果达到限制，则计算等待时间
    if (requestTimestamps.length >= maxRequests) {
      const oldestTimestamp = requestTimestamps[0]!;
      const waitTime = windowMs - (now - oldestTimestamp) + 1000; // 1 秒缓冲

      console.log(
        `⏳ 节流中（已使用 ${requestTimestamps.length}/${maxRequests} 次调用）。等待 ${Math.ceil(waitTime / 1000)} 秒...`,
      );
      await new Promise((resolve) => setTimeout(resolve, waitTime));

      // 等待后清理旧时间戳
      const newNow = Date.now();
      requestTimestamps = requestTimestamps.filter(
        (timestamp) => newNow - timestamp < windowMs,
      );
    }

    // 记录本次请求
    requestTimestamps.push(Date.now());
  };

  const getStats = (): {
    current: number;
    max: number;
    windowMinutes: number;
  } => {
    const now = Date.now();
    requestTimestamps = requestTimestamps.filter(
      (timestamp) => now - timestamp < windowMs,
    );

    return {
      current: requestTimestamps.length,
      max: maxRequests,
      windowMinutes: windowMs / (60 * 1000),
    };
  };

  return { waitIfNeeded, getStats };
};

/**
 * 安全地将各种日期格式转换为 Date 对象。
 * 如果转换失败则返回当前日期（适用于 createdAt/updatedAt）。
 */
const safeDateConversion = (date?: string | number | Date | null): Date => {
  if (date == null) return new Date();

  if (date instanceof Date) return new Date(date.getTime());

  if (typeof date === "number") {
    if (!Number.isFinite(date)) return new Date();
    return new Date(date);
  }

  if (typeof date === "string") {
    const trimmed = date.trim();
    if (trimmed === "") return new Date();
    const parsed = new Date(trimmed);
    if (isNaN(parsed.getTime())) return new Date();
    return parsed;
  }

  return new Date();
};

/**
 * 安全地将 firstName 和 lastName 转换为完整姓名字符串。
 * 如果两个名字都为空，则返回 "Username"。
 */
const safeNameConversion = (
  firstName?: string | null,
  lastName?: string | null,
): string => {
  const trimmedFirstName = firstName?.trim();
  const trimmedLastName = lastName?.trim();

  if (trimmedFirstName && trimmedLastName) {
    return `${trimmedFirstName} ${trimmedLastName}`;
  }

  if (trimmedFirstName) return trimmedFirstName;
  if (trimmedLastName) return trimmedLastName;

  return "Username";
};

async function migrateFromWorkOS() {
  const ctx = await auth.$context;
  const rateLimiter = createRateLimiter(
    MAX_REQUESTS_PER_WINDOW,
    TIME_WINDOW_MS,
  );

  let totalUsers = 0;
  let migratedUsers = 0;
  let skippedUsers = 0;
  let failedUsers = 0;

  let hasMoreUsers = true;
  let after: string | undefined;
  let batchCount = 0;

  console.log("");
  console.log("=".repeat(40));
  console.log("🚀 开始迁移");
  console.log("");
  console.log(`Settings:`);
  console.log(
    ` - Max API calls: ${MAX_REQUESTS_PER_WINDOW} per ${TIME_WINDOW_MS / 1000}s`,
  );
  console.log(` - Users per call: ${USERS_PER_REQUEST}`);
  console.log("=".repeat(40));
  console.log("");

  while (hasMoreUsers) {
    try {
      await rateLimiter.waitIfNeeded();

      const workosUserList = await workos.userManagement.listUsers({
        limit: USERS_PER_REQUEST,
        after,
      });

      batchCount++;
      console.log(
        `📦 批次 ${batchCount}：从 WorkOS 获取了 ${workosUserList.data.length} 位用户`,
      );

      after = workosUserList.listMetadata.after || undefined;
      hasMoreUsers = !!after;
      totalUsers += workosUserList.data.length;

      for (const workosUser of workosUserList.data) {
        try {
          console.log(`\n正在处理用户：${workosUser.email}`);

          // 按邮箱检查用户是否已存在
          // WorkOS 通过邮箱验证流程确保所有用户邮箱唯一
          const existingUser = await ctx.adapter.findOne<
            typeof auth.$Infer.Session.user
          >({
            model: "user",
            where: [
              {
                field: "email",
                value: workosUser.email,
              },
            ],
          });

          if (existingUser) {
            console.log(
              `🟡 用户已存在，跳过：${workosUser.email}`,
            );
            skippedUsers++;
            continue;
          }

          // 创建用户
          await ctx.adapter.create<typeof auth.$Infer.Session.user>({
            model: "user",
            data: {
              email: workosUser.email,
              emailVerified: workosUser.emailVerified,
              image: workosUser.profilePictureUrl,
              name: safeNameConversion(
                workosUser.firstName,
                workosUser.lastName,
              ),
              createdAt: safeDateConversion(workosUser.createdAt),
              updatedAt: safeDateConversion(workosUser.updatedAt),
              metadata: {
                workosId: workosUser.id,
                ...(workosUser.metadata || {}),
              },
            },
          });

          console.log(`🟢 已迁移用户 ${workosUser.email}`);
          migratedUsers++;
        } catch (error) {
          console.error(
            `🔴 迁移用户 ${workosUser.email} 失败\n`,
            error,
          );
          failedUsers++;
        }
      }

      console.log("");
    } catch (error) {
      console.error("🚨 获取批次时出错：", error);
      throw error;
    }
  }

  console.log("");
  console.log("=".repeat(40));
  console.log("📝 迁移摘要");
  console.log(`处理的用户总数：${totalUsers}`);
  console.log("");
  console.log(`🔴 失败：${failedUsers}`);
  console.log(`🟡 跳过：${skippedUsers}`);
  console.log(`🟢 成功迁移：${migratedUsers}`);
  console.log("=".repeat(40));
}

async function main() {
  try {
    await migrateFromWorkOS();
    process.exit(0);
  } catch (error) {
    console.error("\n迁移失败：", error);
    process.exit(1);
  }
}
main();

bun scripts/migration.ts # 或使用 node、ts-node 等

import { createAuthClient } from "better-auth/react";

export const authClient = createAuthClient({
    plugins: [
        // 如有需要，添加需要客户端的插件
    ]
});

import { auth } from "@/lib/auth";
import { toNextJsHandler } from "better-auth/next-js";

export const { POST, GET } = toNextJsHandler(auth)

const signInUrl = await getSignInUrl();
const signUpUrl = await getSignUpUrl();

import { authkitMiddleware } from '@workos-inc/authkit-nextjs';

export default authkitMiddleware({
  middlewareAuth: {
    enabled: true,
    unauthenticatedPaths: ['/'],
  },
});

export const config = { matcher: ['/', '/account/:page*'] };

import { NextRequest, NextResponse } from "next/server";
import { headers } from "next/headers";
import { auth } from "@/lib/auth";

export async function proxy(request: NextRequest) {
    const session = await auth.api.getSession({
        headers: await headers()
    })

    // 这是推荐的乐观重定向用户的方法
    // 我们建议在每个页面/路由中处理认证检查
    if(!session) {
        return NextResponse.redirect(new URL("/sign-in", request.url));
    }

    return NextResponse.next();
}

export const config = {
  matcher: ["/dashboard"], // 指定中间件适用的路由
};