Use `Response` from third-parties without dropping `set-cookie` header

[benmccann]

Describe the problem

We'd like to add better-auth to the CLI: sveltejs/cli#658

Right now you do something along the lines of:

import { betterAuth } from 'better-auth';
import { drizzleAdapter } from 'better-auth/adapters/drizzle';
import { db } from '../db';
import * as schema from '../db/schema/auth';
import { sveltekitCookies } from 'better-auth/svelte-kit';
import { getRequestEvent } from '$app/server';

export const auth = betterAuth({
    database: drizzleAdapter(db, {
        provider: 'pg',
        schema
    }),
    emailAndPassword: {
        enabled: true,
        minPasswordLength: 5
    },
    plugins: [sveltekitCookies(getRequestEvent)]
});

It would be a bit nicer if sveltekitCookies were not required. It's really just a workaround for the fact that we don't let them provide a set-cookie header: https://github.com/better-auth/better-auth/blob/7dfdfd9a9a6306f18dd56eda7a7b023b031be415/packages/better-auth/src/integrations/svelte-kit.ts. It only saves one line of config and a corresponding import, but it'd be nicer nonetheless

Another use case is that you can't set a cookie and redirect from handle which makes it hard to write common auth handlers where you want to do something like set a flash cookie on a redirect: #8316 (comment)

Describe the proposed solution

Use the set-cookie header contained in a user-provided Response

Alternatives considered

Status quo of sveltekitCookies plugin

Or manual workaround:

	const set_cookie = response.headers.get('set-cookie');
	if (set_cookie) {
		const { name, value, ...options } = parseString(set_cookie);
		cookies.set(name, value, options as never);
	}

Importance

nice to have

Additional Information

The other issue that made better-auth a little cumbersome to use has been fixed on their side: better-auth/better-auth#6219. With the next release this remaining bit of ugliness is now on us

[Conduitry]

Are you proposing just using the set-cookie header as-is? Merging that with other cookies that may have been specified in event.cookies previously? Something else?

[benmccann]

We could error if you try to do both and say you're only allowed to do one or the other

[Rich-Harris]

I don't quite understand what the feature request is here. What does this mean?

Use the set-cookie header contained in a user-provided Response

Possibly related: #13681

[benmccann]

If you use a third-party API that generates a Response, you can't just return that Response in SvelteKit. You first have to do a dance to check if that Response has a set-cookie header and then set it with the SvelteKit API and then you can return the Response. I'd like to make this simpler for users and allow them to just return the Response directly