fix: add has trap to lazy auth proxy so auth routes resolve handler

[ephraimduncan]

Problem

In production (Cloudflare Workers), every POST /api/auth/* returned 500 with TypeError: e8 is not a function, breaking sign-in (observed on /api/auth/sign-in/social).

Root cause

packages/auth/index.ts exposes auth as a lazy new Proxy({}, { get }) to defer createAuth() past build-time env validation. It trapped only get — not has.

better-auth's toNextJsHandler runs this per request:

return "handler" in auth ? auth.handler(request) : auth(request);

With no has trap, "handler" in auth forwards to the empty proxy target {} → false, so better-auth falls through to auth(request). The proxy isn't callable → TypeError: auth is not a function (minified to e8).

This breaks all /api/auth/* HTTP routes (social and email). Server-side auth.api.getSession(...) was unaffected because it goes through the get trap — which is why page session checks kept working and only the sign-in POSTs 500'd.

Fix

Add a has trap that forwards to the real instance:

has(_target, property) {
  return Reflect.has(getAuth(), property);
},

Build-time safe: toNextJsHandler only evaluates "handler" in auth inside its per-request closure, never at module load, so the env-validation decoupling is preserved.

Verification

Reproduced against the actual published better-auth@1.4.10 + toNextJsHandler, posting to /api/auth/sign-in/social:

• Before (get-only proxy): TypeError: auth is not a function — matches prod e8.
• After (with has trap): 200 with {"url":"https://github.com/login/oauth/authorize?..."}.

Note

Deploying this requires a Worker rebuild + redeploy to ship the new bundle. No env/secret/DNS changes needed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	formbase-web	6b8331f	Jun 01 2026, 10:02 AM