From 8866335c500a633e719c2af8179416aa65dca0e7 Mon Sep 17 00:00:00 2001
From: Sean O'Connor <sean@soconnor.dev>
Date: Mon, 29 Jun 2026 18:38:35 -0400
Subject: [PATCH] Accept mobile Better Auth session token header

---
 src/lib/auth-server.ts | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/src/lib/auth-server.ts b/src/lib/auth-server.ts
index 75a962f..d952a15 100644
--- a/src/lib/auth-server.ts
+++ b/src/lib/auth-server.ts
@@ -2,7 +2,10 @@ import { headers as nextHeaders } from "next/headers";
 import { auth } from "~/lib/auth";
 
 const MOBILE_AUTH_COOKIE_HEADER = "x-beenvoice-auth-cookie";
+const MOBILE_SESSION_TOKEN_HEADER = "x-beenvoice-session-token";
 const MAX_AUTH_COOKIE_HEADER_LENGTH = 16 * 1024;
+const MAX_SESSION_TOKEN_LENGTH = 255;
+const SESSION_TOKEN_PATTERN = /^[A-Za-z0-9._~+/=-]+$/;
 
 function looksLikeSessionCookie(cookie: string): boolean {
   return cookie.split(";").some((part) => {
@@ -29,16 +32,33 @@ export function headersWithAuthCookieFallback(headers: Headers): Headers {
 
   const mobileCookie = headers.get(MOBILE_AUTH_COOKIE_HEADER)?.trim();
   if (
-    !mobileCookie ||
-    mobileCookie.length > MAX_AUTH_COOKIE_HEADER_LENGTH ||
-    !looksLikeSessionCookie(mobileCookie)
+    mobileCookie &&
+    mobileCookie.length <= MAX_AUTH_COOKIE_HEADER_LENGTH &&
+    looksLikeSessionCookie(mobileCookie)
   ) {
-    return headers;
+    const nextHeaders = new Headers(headers);
+    nextHeaders.set("cookie", mobileCookie);
+    return nextHeaders;
   }
 
-  const nextHeaders = new Headers(headers);
-  nextHeaders.set("cookie", mobileCookie);
-  return nextHeaders;
+  const sessionToken = headers.get(MOBILE_SESSION_TOKEN_HEADER)?.trim();
+  if (
+    sessionToken &&
+    sessionToken.length <= MAX_SESSION_TOKEN_LENGTH &&
+    SESSION_TOKEN_PATTERN.test(sessionToken)
+  ) {
+    const nextHeaders = new Headers(headers);
+    nextHeaders.set(
+      "cookie",
+      [
+        `better-auth.session_token=${sessionToken}`,
+        `__Secure-better-auth.session_token=${sessionToken}`,
+      ].join("; "),
+    );
+    return nextHeaders;
+  }
+
+  return headers;
 }
 
 export function hasSessionCookie(headers: Headers): boolean {