feat: split auth config into edge-safe auth.config.ts

auth.config.ts holds only the Edge-Runtime-safe parts of the Auth.js
config (session strategy, pages, jwt/session callbacks) with an empty
providers array. auth.ts spreads it and adds the real Credentials
provider on top for use in API routes/Server Components (Node runtime).

Needed for middleware.ts (next commit): the Credentials provider's
authorize() pulls in bcryptjs via verifyUserCredentials(), which is a
Node API not supported on the Edge Runtime that middleware.ts runs on.
Without this split, next build bundles bcryptjs/jose into the Edge
middleware chunk and warns; with it, the build is clean.

src/auth.config.ts

@@ -0,0 +1,40 @@
+import type { NextAuthConfig } from "next-auth";
+
+// Edge-safe subset of the full Auth.js config (src/auth.ts). Deliberately
+// has NO providers here: the Credentials provider's authorize() calls
+// verifyUserCredentials() (src/lib/users.ts), which pulls in bcryptjs — a
+// Node.js API, not Edge-Runtime-compatible (see
+// https://authjs.dev/guides/edge-compatibility). middleware.ts runs on the
+// Edge Runtime in this project's Next.js 14.2.35 and only ever needs to
+// decode/validate the JWT session cookie, never to run a provider's
+// authorize() — so it builds its own lightweight NextAuth instance from
+// just this config (see src/middleware.ts), instead of importing the full
+// src/auth.ts (which previously got bcryptjs/jose Node-API warnings bundled
+// into the Edge middleware build even though that code path never actually
+// ran there). src/auth.ts spreads this same config and adds the real
+// Credentials provider on top, for use everywhere else (API routes, Server
+// Components) where the Node.js runtime is available.
+export default {
+  // Required by NextAuthConfig's type, but deliberately empty here — the
+  // real Credentials provider is added in src/auth.ts, not here. See this
+  // file's top comment for why.
+  providers: [],
+  session: { strategy: "jwt" },
+  pages: {
+    signIn: "/login",
+  },
+  callbacks: {
+    jwt({ token, user }) {
+      if (user) {
+        token.id = user.id;
+      }
+      return token;
+    },
+    session({ session, token }) {
+      if (session.user) {
+        session.user.id = token.id as string;
+      }
+      return session;
+    },
+  },
+} satisfies NextAuthConfig;

src/auth.ts

@@ -1,6 +1,7 @@
 import NextAuth from "next-auth";
 import Credentials from "next-auth/providers/credentials";
 import { verifyUserCredentials } from "@/lib/users";
+import authConfig from "@/auth.config";
 
 // Minimal internal auth — Auth.js v5 (next-auth@beta) Credentials provider
 // only, no OAuth/SSO providers (company SSO was explicitly ruled out — see
@@ -14,11 +15,16 @@ import { verifyUserCredentials } from "@/lib/users";
 // session only needs to carry the user's id (used to identify who did what,
 // not to gate what they can do) — see the module augmentation in
 // src/types/next-auth.d.ts.
+//
+// This is the full config (session strategy + pages + jwt/session callbacks
+// spread in from src/auth.config.ts, plus the real Credentials provider
+// added here). Used by API routes and Server Components, which run on the
+// Node.js runtime. middleware.ts deliberately does NOT import this file —
+// it builds its own lightweight NextAuth instance from src/auth.config.ts
+// alone (no Credentials provider, so no bcryptjs) to stay Edge-Runtime
+// compatible; see that config file's comment for why.
 export const { handlers, signIn, signOut, auth } = NextAuth({
-  session: { strategy: "jwt" },
+  ...authConfig,
-  pages: {
-    signIn: "/login",
-  },
   providers: [
     Credentials({
       credentials: {
@@ -31,18 +37,4 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
       },
     }),
   ],
-  callbacks: {
-    jwt({ token, user }) {
-      if (user) {
-        token.id = user.id;
-      }
-      return token;
-    },
-    session({ session, token }) {
-      if (session.user) {
-        session.user.id = token.id as string;
-      }
-      return session;
-    },
-  },
 });