chore: dependency upgrades, Better Auth migration, and performance improvements

[elasticjava]

Summary

This PR brings the dependency stack up to date, replaces the deprecated Lucia auth library with Better Auth, and includes targeted performance improvements for high-concurrency collaborative sessions.

---

Changes

Security & Stability Fixes (fix(api))

• CORS hardening: replaced origin: true with origin: process.env['FRONTEND_URL'] — only the configured frontend origin is allowed for tRPC REST endpoints (Socket.IO already had its own restricted CORS)
• Cookie security: added secure and sameSite: 'lax' to OAuth state/code_verifier cookies in production
• Memory leak: emptyBoard() now also clears the boardSettings cache to prevent stale read-only settings persisting after a board closes
• Immutability: userJoin() uses spread instead of in-place array mutation
• Debug artifact: removed commented-out setTimeout(() => socket.conn.close()) from client.ts

---

TipTap 3.0.0-beta.16 → 3.20.1 (chore(deps))

All 20 @tiptap/* packages updated from beta to stable 3.x.

API fixes:

• Removed tippyOptions: {} from custom BubbleMenu.addOptions() — the project uses @floating-ui/dom instead of tippy, so this field is not part of the type
• setContent now passes { emitUpdate: false } matching the new SetContentOptions type (prevents potential update loops)
• Added @tiptap/suggestion@^3.20.1 as explicit dependency (required peer dep for extension-mention@3.x)
• Fixed server.connection() cookie type: Record<string, string | undefined> matching cookie@1.x parse return type

---

Drizzle 0.28.6 → 0.45.1 + drizzle-kit 0.19.13 → 0.31.9 (chore(deps))

• Updated drizzle.config.ts: replaced deprecated driver: 'pg' + breakpoints with defineConfig() + dialect: 'postgresql'
• Ran drizzle-kit up to upgrade migration snapshot format
• No query-level breaking changes in the codebase

---

Auth: Lucia v3 → Better Auth 1.5 (feat(auth))

Lucia v3 was officially deprecated in March 2025. This PR replaces it with Better Auth (MIT).

Design: Better Auth is configured with its Drizzle adapter mapped to the existing database tables (accounts as user table, account_session as session table), preserving all foreign key relationships to boards, teams, and invitations without breaking changes.

Schema additions (migration 0008):

• accounts: email_verified, created_at, updated_at
• account_session: token (unique), created_at, updated_at, ip_address, user_agent
• New table oauth_accounts: stores OAuth provider account links (replaces accounts.google_id)
• New table verification: for future email OTP / magic link flows

Migration safety:

• Existing Lucia sessions are cleared (users re-authenticate once after upgrade)
• Existing Google OAuth links are migrated from accounts.google_id → oauth_accounts
• Account linking enabled for smooth Google re-auth of existing users

Other changes:

• arctic and @lucia-auth/adapter-postgresql removed
• OAuth callback (/api/auth/callback/google) is now handled automatically by Better Auth via a Fastify wildcard route (/api/auth/*) with a scoped content-type parser
• Session validation moved to auth.api.getSession() with 5-minute cookie cache — eliminates per-request DB session lookups in tRPC context
• lucia.invalidateUserSessions → getAuth().api.revokeUserSessions in logout/account deletion

Breaking change for existing deployments: all active sessions are invalidated by migration 0008. Users must sign in again after applying the migration.

---

Performance: high-concurrency boards (perf(api))

Targeted optimizations for scenarios with many simultaneous users on a single board:

Fix	Impact
DB connection pool postgres({ max: 20, idle_timeout: 30 })	Handles concurrent DB queries without queuing
Validator Map (O(1) lookup)	Replaces O(n) Array.find() per incoming board message
Socket.IO ping tuning pingTimeout: 15s / pingInterval: 10s	Faster dead-connection detection with manageable overhead
Socket.IO maxHttpBufferSize: 5MB	Supports large board state transfers
close() optimization	findIndex + targeted splice instead of full map() scan over all board nodes

Note: cursor moves already bypass full validation via the existing broadcast message type — no change needed there.

---

Test Plan

• All existing unit tests pass (sync-node-box, web vitest suites)
• Both api and web production builds succeed with no TypeScript errors
• Lint clean across all 7 Nx projects (warnings are pre-existing)

For manual verification after deploying migration 0008:

1. Sign in with Google — should work seamlessly (Better Auth creates session)
2. Open a board with multiple users — real-time collaboration (cursor, actions) should function as before
3. Logout → re-login — session invalidation should work
4. Board admin read-only toggle → reconnect — should not show stale permissions

[juanfran]

Hi, and thanks for your interest in Tapiz.

At the moment, I can’t accept this PR in its current form.

If you want to propose new features for Tapiz, please open a separate issue for each feature first and wait for approval, so I can decide whether it is appropriate for the project. Once a feature/fix has been discussed and approved, you can then open a PR for it.

Also, PRs should be limited to a single feature only, and all commits and comments must be written in English.

Thanks for understanding.