Email + password sign-up, sign-in, sign-out, plus Google OAuth as a peer sign-in method. Password reset and session management. Foundation for everything else — until this works, no user can save anything in Motir. The Story closes by snapshotting the working auth code into both starter templates (nextjs-prisma-vercel-starter and nextjs-prisma-vercel-starter-with-design), making auth a baseline feature of every future Motir-planned project.
Prerequisites: Story 1.0 (Project bootstrap) must be complete — repo scaffold, Prisma, Postgres connection must exist before auth tables can be added. Story 1.0.5 (Design system & brand) must be complete before Subtask 1.1.5 (sign-up / sign-in pages) — those pages must use the canonical Button, Input, and Card primitives, not new components. The two backport Subtasks (1.1.8, 1.1.9) at the end of the Story snapshot the working auth code into both starter templates, so all future Motir-planned projects start with auth wired in.
git checkout story/PROD-1.1-auth then ./scripts/db-up.sh. First-time only: set GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET in .env from your Google Cloud Console OAuth 2.0 client. See the comment in .env.example for the redirect URI to register. Then run pnpm dev./sign-in (since not logged in). You should see both the email/password form AND a "Continue with Google" button./sign-up). Try submitting with a bad password ("123") — you should see an inline error. Submit with a valid email + password (≥8 chars) — you should be redirected to the home page, signed in. Check the browser cookies — there should be a session cookie set./sign-out). You should be redirected back to /sign-in./sign-in, enter the email + password you just created — you should be signed in. Sign out, then try a wrong password — you should see an inline error ("Email or password is wrong") that does NOT reveal whether the email exists./sign-in, click "Continue with Google." Complete Google's consent screen — you should be redirected back and signed in. Check the database: there should be a new google Account row linked to your User./dashboard signed in as the existing User row (no duplicate created). The DB will show ONE User with that email AND two Account rows (credential + google) both tied to it. user.emailVerified will have flipped from false to true on the linking sign-in (Better-Auth's auto-promotion). REVERSE direction (Google-first user trying email/password) is NOT supported by current wiring — OAuth-only users have no credential Account row with a password hash. Documented in PR #19's body as a future enhancement./sign-in, click "Forgot password." Enter your email — you should see a confirmation screen. In your terminal where pnpm dev is running, look for a logged reset link (the dev console email provider prints it to stdout with a [EMAIL] marker). Open that link. Set a new password (≥8 chars) — you should be signed in with the new password. Sign out and sign back in with the new password to confirm.