fix(auth): upgrade Better Auth to 1.7.2

[romanbsd]

Why

CompCRM uses Better Auth 1.6.25 while the current runtime packages are 1.7.2.
Better Auth 1.7.2 changes social-link routes, client methods, hook data, and token refresh inputs.

Summary

• Upgrade Better Auth, API key, and SSO packages to 1.7.2.
• Keep the existing Better Auth CLI version because the registry reports an older version.
• Replace removed generic OAuth client APIs with core social APIs.
• Update Slack authorization guards for the new routes and provider fields.
• Resolve mailbox tokens through account identifiers.
• Update Slack integration tests to exercise Better Auth's real routes.

Validation

• bun run check-types
• bun run lint
• bun run lint:slop
• Auth package tests: 42 passed.
• API authentication tests: 5 passed.
• Webpack production build passed.
• git diff --check

---

Summary by cubic

Upgrades Better Auth from 1.6.25 to 1.7.2 and adapts auth flows to its breaking changes.

Changes

• Bump better-auth, @better-auth/api-key, @better-auth/sso, and the auth CLI package to 1.7.2.
• Replace the removed generic OAuth client with the linkSocial client method.
• Move the Slack callback to /api/auth/callback/slack; existing Slack apps must update their redirect URL before this ships.
• The Slack guard now covers /link-social starts and /callback/:id callbacks whose OAuth state identifies a linking transaction, so public Slack sign-in passes through.
• Resolve mailbox access tokens via account identifiers and return a needs-reconnect outcome when no account is found.
• Add migration 20260830221000_better_auth_account_identity to backfill issuer and Microsoft oid identities; it aborts if any Microsoft row lacks a trusted mapping.

^{Written for commit bca062f. Summary will update on new commits.}

[vercel]

@romanbsd is attempting to deploy a commit to the Comp AI - PoC Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 18 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[romanbsd]

Review fixes are consolidated in 0f42139. Public Slack sign-in remains available without a CRM session.

[romanbsd]

All review fixes are consolidated in bca062f. Better Auth remains upgraded to exact version 1.7.2.

[cubic-dev-ai]

1 issue found across 18 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/db/prisma/migrations/20260830221000_better_auth_account_identity/migration.sql">

<violation number="1" location="packages/db/prisma/migrations/20260830221000_better_auth_account_identity/migration.sql:65">
P2: When a non-null Microsoft `idToken` cannot be decoded and the issuer came from an SSO-provider fallback, this guard does not raise because `<> NULL` is UNKNOWN. Use null-safe `IS DISTINCT FROM` comparisons so malformed tokens always abort the migration.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: When a non-null Microsoft idToken cannot be decoded and the issuer came from an SSO-provider fallback, this guard does not raise because <> NULL is UNKNOWN. Use null-safe IS DISTINCT FROM comparisons so malformed tokens always abort the migration.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/db/prisma/migrations/20260830221000_better_auth_account_identity/migration.sql, line 65:

<comment>When a non-null Microsoft `idToken` cannot be decoded and the issuer came from an SSO-provider fallback, this guard does not raise because `<> NULL` is UNKNOWN. Use null-safe `IS DISTINCT FROM` comparisons so malformed tokens always abort the migration.</comment>

<file context>
@@ -0,0 +1,87 @@
+        WHERE "providerId" = 'microsoft'
+          AND (
+              "idToken" IS NULL
+              OR "issuer" <> "better_auth_jwt_payload"("idToken")->>'iss'
+              OR "accountId" <> "better_auth_jwt_payload"("idToken")->>'oid'
+          )
</file context>

Suggested change

	OR "issuer" <> "better_auth_jwt_payload"("idToken")->>'iss'
	OR "accountId" <> "better_auth_jwt_payload"("idToken")->>'oid'
	OR "issuer" IS DISTINCT FROM "better_auth_jwt_payload"("idToken")->>'iss'
	OR "accountId" IS DISTINCT FROM "better_auth_jwt_payload"("idToken")->>'oid'