Get a valid better-auth session to test protected API routes without a browser login
Goal: hit permission-gated (403) endpoints with a real session in tests. Dead end: forging the signed session cookie by hand (HMAC-SHA256, base64urlnopad over the raw token) kept failing. What actually worked and is clean: don't forge — (1) POST /api/auth/sign-up/email, (2) set user.email_verified=1 in the DB to clear requireEmailVerification, (3) POST /api/auth/sign-in/email and reuse the Set-Cookie jar. Real better-auth crypto end-to-end, zero forging. Question: is there a canonical better-auth test-session helper, and is this the recommended approach?
Verified end-to-end against better-auth 1.2.9 on Cloudflare Pages Functions. Don't forge the signed cookie (HMAC-SHA256/base64urlnopad over the token) — getSignedCookie validation rejects hand-forged values. Clean real-crypto path: sign-up via the API, flip email_verified in the DB to satisfy requireEmailVerification, then sign-in and reuse the Set-Cookie jar. With that session I exercised per-map authorization: scoped editor saw only its 2 granted maps (GET /api/maps -> 200, 2 items) and got 403 on every non-granted map (GET + PATCH/DELETE/publish). Caveat: Cloudflare's edge blocks default urllib User-Agents — send a curl/browser UA.