fix(auth): create missing UserOptions for OAuth users

src/lib/auth.ts

@@ -12,6 +12,7 @@ import {
 } from "~/utils/encryption";
 import { parseUA, DEVICE_SALT_COOKIE_NAME } from "~/utils/devices";
 import { normalizeEmail } from "~/utils/email";
+import { isRunningInDocker } from "~/utils/docker";
 import { sendMailWithTemplate } from "~/utils/mail";
 import { MailTemplateKey } from "~/utils/enums";
 import { parse } from "cookie";
@@ -516,6 +517,24 @@ export async function onUserCreateBefore(
 	};
 }
 
+// Keep Better Auth-created users consistent with users created through
+// ztnet's regular registration flow, which creates UserOptions eagerly.
+export async function onUserCreateAfter(user: Record<string, unknown>): Promise<void> {
+	if (typeof user.id !== "string" || !user.id) {
+		throw new Error("Cannot create UserOptions: user ID is missing");
+	}
+
+	const localControllerUrl = isRunningInDocker()
+		? "http://zerotier:9993"
+		: "http://127.0.0.1:9993";
+
+	await prisma.userOptions.upsert({
+		where: { userId: user.id },
+		update: {},
+		create: { userId: user.id, localControllerUrl },
+	});
+}
+
 export const auth = betterAuth({
 	database: prismaAdapter(prisma, {
 		provider: "postgresql",
@@ -608,6 +627,7 @@ export const auth = betterAuth({
 		user: {
 			create: {
 				before: onUserCreateBefore,
+				after: onUserCreateAfter,
 			},
 		},
 		session: {

src/server/api/routers/authRouter.ts

@@ -382,10 +382,25 @@ export const authRouter = createTRPCRouter({
 			UserDevice?: UserDevice[];
 			currentDeviceId?: string;
 		};
-		user.options.localControllerUrlPlaceholder = isRunningInDocker()
+		const localControllerUrl = isRunningInDocker()
 			? "http://zerotier:9993"
 			: "http://127.0.0.1:9993";
 
+		// OAuth users created before UserOptions was added to the Better Auth
+		// creation hook may not have an options row. Backfill it on first access.
+		if (!user.options) {
+			user.options = await ctx.prisma.userOptions.upsert({
+				where: { userId: user.id },
+				update: {},
+				create: {
+					userId: user.id,
+					localControllerUrl,
+				},
+			});
+		}
+
+		user.options.localControllerUrlPlaceholder = localControllerUrl;
+
 		// Set secret environment status
 		user.options.urlFromEnv = !!process.env.ZT_ADDR;
 		user.options.secretFromEnv = !!process.env.ZT_SECRET;