fix: harden identity HTTP transport

core/src/identity/runtime.ts

@@ -23,6 +23,30 @@ const runtimeErrorMessages: Readonly<Record<IdentityRuntimeErrorCode, string>> =
 
 const identityDatabaseProbeTimeoutMs = 3_000;
 
+/**
+ * A fixed, generic replacement for whatever Better Auth actually logged. Better Auth's own log
+ * call sites are not a stable contract Core can audit line by line, and several of them pass a
+ * raw internal exception or interpolate user-controlled input directly into the message (for
+ * example the origin-check middleware logs `Invalid origin: ${originHeader}`). Rather than trying
+ * to sanitize Better Auth's message/argument payload case by case, the payload is dropped
+ * entirely and only this fixed string is ever written.
+ */
+const sanitizedBetterAuthLogMessage = "[identity] Better Auth reported an error.";
+
+/**
+ * Explicitly replaces Better Auth's default logger so its own message text and arguments — which
+ * may include a raw exception, SQL, a connection string, a host/port, a filesystem path, a
+ * session token, a password, or a user-controlled origin/referer header — are never written
+ * anywhere. Only the fixed, generic message above is ever emitted, and only for error-level
+ * events; this is deliberately not just "quiet under NODE_ENV=test": the same replacement applies
+ * in every environment, so production logging is exactly as sanitized as test logging.
+ */
+function sanitizedBetterAuthLogger(level: string): void {
+  if (level === "error") {
+    console.error(sanitizedBetterAuthLogMessage);
+  }
+}
+
 /** Never carries the underlying Better Auth error, database error, cause, stack, secret, or URL. */
 export class IdentityRuntimeError extends Error {
   readonly code: IdentityRuntimeErrorCode;
@@ -113,6 +137,19 @@ export function createIdentityRuntime(
 
   const auth = constructBetterAuth(() =>
     betterAuth({
+      advanced: {
+        // Better Auth's own default is environment-sensitive: `skipOriginCheck` falls back to
+        // `true` whenever `isTest()` is true (NODE_ENV=test, which Vitest sets, or TEST=1) unless
+        // `disableOriginCheck` is explicitly set — and origin skip in turn also silently skips
+        // CSRF validation as long as `disableCSRFCheck` is left unset (Better Auth's documented
+        // backward-compatibility coupling). Left implicit, this means origin/CSRF protection is
+        // silently *off* under the test runner and *on* in production: the exact same code path
+        // behaves differently in the two places it matters most to verify. Setting both flags to
+        // `false` explicitly removes the `isTest()` branch entirely, so the identical protection
+        // is enforced in every environment, including under Vitest.
+        disableCSRFCheck: false,
+        disableOriginCheck: false,
+      },
       baseURL: options.config.baseUrl,
       database: drizzleAdapter(options.db, {
         provider: "pg",
@@ -122,6 +159,29 @@ export function createIdentityRuntime(
         autoSignIn: false,
         disableSignUp: false,
         enabled: true,
+        // Pinned explicitly rather than left on Better Auth's fallback default (`|| 8` / `|| 128`
+        // in the pinned release): an implicit default can change silently on a future Better Auth
+        // upgrade, and Ekklesia's own tests assert this exact 8–128 boundary.
+        maxPasswordLength: 128,
+        minPasswordLength: 8,
+      },
+      logger: {
+        disabled: false,
+        level: "error",
+        log: (level) => sanitizedBetterAuthLogger(level),
+      },
+      // A second, independent layer alongside `logger` above: the pinned release's own transport
+      // dependency (`better-call`'s router) has an unconditional `console.error("# SERVER_ERROR:
+      // ", error)` fallback for any thrown value it does not recognize as one of Better Auth's own
+      // `APIError`s — this fires *before* Better Auth's `logger` option is ever consulted, so no
+      // logger configuration can reach it. `onAPIError.throw: true` closes that gap: Better Auth's
+      // own `APIError`s (wrong password, invalid origin, disabled sign-up, ...) still resolve to
+      // their normal HTTP response completely unaffected, but a genuinely unexpected failure (for
+      // example a database outage) now propagates out of `auth.handler()` instead of being caught
+      // and printed raw internally, so it reaches `handleAuthRequest`'s own try/catch below and
+      // becomes a sanitized `IdentityRuntimeError` like any other unexpected failure.
+      onAPIError: {
+        throw: true,
       },
       rateLimit: {
         enabled: true,