perf(auth,api): skip getSession when no session cookie is present

Better-auth's getSession was running on every request — including API-key,
public, MCP, and SDK traffic — and hitting Postgres even when no session
cookie was attached. Under pool contention this manifested as a hard 5s
wall: ~25% of /v1/query calls returned 500 "Failed to get session" at
duration_ms=5010, the rest of the slow tail also clustered there. The
/public/v1/flags/bulk endpoint showed the same pattern.

Add hasSessionCookie(headers) in @databuddy/auth that checks for the
better-auth session_token / session_data cookie names, and short-circuit
the four hot getSession call sites:

- packages/rpc/src/orpc.ts createRPCContext (covers all /rpc/*)
- apps/api/src/routes/query.ts (/v1/query)
- apps/api/src/middleware/website-auth.ts (/public/v1/flags/bulk and
  other website-scoped routes)
- apps/api/src/lib/auth-wide-event.ts (per-request auth wide event)

Author: izadoesdev

apps/api/src/lib/auth-wide-event.ts

@@ -3,7 +3,7 @@ import {
 	isApiKeyPresent,
 	resolveApiKey,
 } from "@databuddy/api-keys/resolve";
-import { auth } from "@databuddy/auth";
+import { auth, hasSessionCookie } from "@databuddy/auth";
 import { mergeWideEvent, record } from "./tracing";
 
 export interface ResolvedAuth {
@@ -21,9 +21,12 @@ export async function applyAuthWideEvent(headers: Headers): Promise<void> {
 	const fields: Record<string, string | number | boolean> = {};
 
 	const hasKey = isApiKeyPresent(headers);
+	const sessionCookiePresent = hasSessionCookie(headers);
 	const [session, apiKeyResult] = await record("auth", () =>
 		Promise.all([
-			auth.api.getSession({ headers }).catch(() => null),
+			sessionCookiePresent
+				? auth.api.getSession({ headers }).catch(() => null)
+				: null,
 			hasKey ? resolveApiKey(headers) : null,
 		])
 	);

apps/api/src/middleware/website-auth.ts

@@ -3,7 +3,7 @@ import {
 	hasWebsiteScope,
 	isApiKeyPresent,
 } from "@databuddy/api-keys/resolve";
-import { auth } from "@databuddy/auth";
+import { auth, hasSessionCookie } from "@databuddy/auth";
 import { db } from "@databuddy/db";
 import { Elysia } from "elysia";
 import { getResolvedAuth } from "../lib/auth-wide-event";
@@ -67,12 +67,15 @@ export function websiteAuth() {
 				sessionUser = getSessionUser(session);
 				apiKey = preResolved.apiKeyResult?.key ?? null;
 			} else {
+				const sessionCookiePresent = hasSessionCookie(request.headers);
 				const [resolvedApiKey, resolvedSession] = await record(
 					"getAuthContext",
 					() =>
 						Promise.all([
 							apiKeyPresent ? getApiKeyFromHeader(request.headers) : null,
-							auth.api.getSession({ headers: request.headers }),
+							sessionCookiePresent
+								? auth.api.getSession({ headers: request.headers })
+								: null,
 						])
 				);
 				session = resolvedSession;

apps/api/src/routes/query.ts

@@ -1,4 +1,4 @@
-import { auth } from "@databuddy/auth";
+import { auth, hasSessionCookie } from "@databuddy/auth";
 import {
 	type ApiKeyRow,
 	getAccessibleWebsiteIds,
@@ -1057,7 +1057,9 @@ export const query = new Elysia({ prefix: "/v1/query" })
 		const hasApiKey = isApiKeyPresent(request.headers);
 		const [apiKey, session] = await Promise.all([
 			hasApiKey ? getApiKeyFromHeader(request.headers) : null,
-			auth.api.getSession({ headers: request.headers }),
+			hasSessionCookie(request.headers)
+				? auth.api.getSession({ headers: request.headers })
+				: null,
 		]);
 		const user = session?.user ?? null;
 

packages/auth/src/auth.ts

@@ -217,6 +217,19 @@ function forwardAuthLog(
 	log.info(fields);
 }
 
+const SESSION_COOKIE_HINTS = [
+	"better-auth.session_token",
+	"better-auth.session_data",
+];
+
+export function hasSessionCookie(headers: Headers): boolean {
+	const cookie = headers.get("cookie");
+	if (!cookie) {
+		return false;
+	}
+	return SESSION_COOKIE_HINTS.some((hint) => cookie.includes(hint));
+}
+
 export const auth = betterAuth({
 	logger: {
 		log: forwardAuthLog,

packages/rpc/src/orpc.ts

@@ -2,7 +2,7 @@ import {
 	type ApiKeyRow,
 	getApiKeyFromHeader,
 } from "@databuddy/api-keys/resolve";
-import { auth, type User } from "@databuddy/auth";
+import { auth, hasSessionCookie, type User } from "@databuddy/auth";
 import { db } from "@databuddy/db";
 import { os as createOS } from "@orpc/server";
 import { baseErrors } from "./errors";
@@ -60,7 +60,9 @@ export const createRPCContext = async (
 	const [session, apiKey] = preResolved
 		? [preResolved.session, preResolved.apiKey]
 		: await Promise.all([
-				auth.api.getSession({ headers: opts.headers }),
+				hasSessionCookie(opts.headers)
+					? auth.api.getSession({ headers: opts.headers })
+					: Promise.resolve(null),
 				getApiKeyFromHeader(opts.headers),
 			]);