fix(auth): add the account.issuer field better-auth 1.7 expects

src/components/auth/login-form.tsx

@@ -4,6 +4,7 @@ import { useEffect, useState, useTransition } from "react";
 import { useRouter } from "next/navigation";
 import { Fingerprint } from "lucide-react";
 import { authClient } from "@/lib/auth/client";
+import { authErrorMessage } from "@/lib/auth/error-message";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -64,7 +65,8 @@ export function LoginForm({ callbackUrl }: LoginFormProps) {
       });
 
       if (error) {
-        setError(AUTH_ERRORS[error.code ?? ""] ?? "Something went wrong. Please try again.");
+        console.error("Sign-in failed", error);
+        setError(authErrorMessage(error, AUTH_ERRORS));
         return;
       }
 

src/components/auth/signup-form.tsx

@@ -3,6 +3,7 @@
 import { useState, useTransition } from "react";
 import { useRouter } from "next/navigation";
 import { authClient } from "@/lib/auth/client";
+import { authErrorMessage } from "@/lib/auth/error-message";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -37,7 +38,11 @@ export function SignupForm() {
       });
 
       if (error) {
-        setError(AUTH_ERRORS[error.code ?? ""] ?? "Something went wrong. Please try again.");
+        // Keep the full detail in the browser console — the visible copy is
+        // deliberately short, but a self-hoster debugging a 500 wants both this
+        // and the matching server log line.
+        console.error("Sign-up failed", error);
+        setError(authErrorMessage(error, AUTH_ERRORS));
         return;
       }
 

src/db/migrations/0009_numerous_monster_badoon.sql

@@ -0,0 +1,11 @@
+-- better-auth 1.7 added `account.issuer`, which namespaces an identity to the
+-- authority that issued it. It is not optional: sign-in looks up the credential
+-- account with `issuer = 'local:credential'` in the WHERE clause, so an existing
+-- row left NULL here is an account nobody can log into any more. Add nullable,
+-- backfill every existing row, then enforce NOT NULL.
+--
+-- Ledgr configures no social providers, so in practice every row is a credential
+-- account; the CASE covers a fork that added one before upgrading.
+ALTER TABLE "account" ADD COLUMN "issuer" text;--> statement-breakpoint
+UPDATE "account" SET "issuer" = CASE WHEN "provider_id" = 'credential' THEN 'local:credential' ELSE 'local:oauth:' || "provider_id" END WHERE "issuer" IS NULL;--> statement-breakpoint
+ALTER TABLE "account" ALTER COLUMN "issuer" SET NOT NULL;