import type { NextAuthConfig } from "next-auth";

// Edge-safe subset of the full Auth.js config (src/auth.ts). Deliberately
// has NO providers here: the Credentials provider's authorize() calls
// verifyUserCredentials() (src/lib/users.ts), which pulls in bcryptjs — a
// Node.js API, not Edge-Runtime-compatible (see
// https://authjs.dev/guides/edge-compatibility). middleware.ts runs on the
// Edge Runtime in this project's Next.js 14.2.35 and only ever needs to
// decode/validate the JWT session cookie, never to run a provider's
// authorize() — so it builds its own lightweight NextAuth instance from
// just this config (see src/middleware.ts), instead of importing the full
// src/auth.ts (which previously got bcryptjs/jose Node-API warnings bundled
// into the Edge middleware build even though that code path never actually
// ran there). src/auth.ts spreads this same config and adds the real
// Credentials provider on top, for use everywhere else (API routes, Server
// Components) where the Node.js runtime is available.
export default {
  // Required by NextAuthConfig's type, but deliberately empty here — the
  // real Credentials provider is added in src/auth.ts, not here. See this
  // file's top comment for why.
  providers: [],
  session: { strategy: "jwt" },
  pages: {
    signIn: "/login",
  },
  callbacks: {
    jwt({ token, user }) {
      if (user) {
        token.id = user.id;
      }
      return token;
    },
    session({ session, token }) {
      if (session.user) {
        session.user.id = token.id as string;
      }
      return session;
    },
  },
} satisfies NextAuthConfig;