[1.5.3] ACCOUNT_NOT_FOUND

  let account: Awaited<ReturnType<typeof auth.api.accountInfo>> | null = null;
  try {
    account = await auth.api.accountInfo({ headers });
  } catch (err) {
    console.log(err);
    await auth.api.signOut({ headers });
    throw redirect({ to: '/sign-in' });
  }

export const auth = betterAuth({
  socialProviders: {
    microsoft: {
      clientId: process.env.MICROSOFT_CLIENT_ID,
      clientSecret: process.env.MICROSOFT_CLIENT_SECRET,
      tenantId: process.env.MICROSOFT_TENANT_ID,
      redirectURI: process.env.MICROSOFT_REDIRECT_URI,
      authority: 'https://login.microsoftonline.com',
      scope: ['openid', 'profile', 'email', 'offline_access', process.env.MICROSOFT_SCOPE_API],
      prompt: 'select_account',
      disableDefaultScope: true,
      getUserInfo: async ({ accessToken }) => {
        interface AzureAccessToken {
          oid: string;
          name: string;
          email?: string;
          roles?: string[];
          upn: string;
        }

        const decoded = jwtDecode<AzureAccessToken>(accessToken as string);

        return {
          user: {
            id: decoded.oid,
            name: decoded.name,
            email: decoded?.email ?? decoded.upn,
            emailVerified: false,
            image: undefined,
          },
          data: decoded,
        };
      },
    },
  },
  session: {
    cookieCache: {
      enabled: true,
      maxAge: 7 * 24 * 60 * 60,
      strategy: 'jwe',
      refreshCache: {
        updateAge: 1 * 24 * 60 * 60,
      },
      version: '2',
    },
  },
  account: {
    storeStateStrategy: 'cookie',
    storeAccountCookie: true,
    updateAccountOnSignIn: true,
  },
  plugins: [tanstackStartCookies()],
});