toanhoang
68693c9b84
auth.config.ts holds only the Edge-Runtime-safe parts of the Auth.js config (session strategy, pages, jwt/session callbacks) with an empty providers array. auth.ts spreads it and adds the real Credentials provider on top for use in API routes/Server Components (Node runtime). Needed for middleware.ts (next commit): the Credentials provider's authorize() pulls in bcryptjs via verifyUserCredentials(), which is a Node API not supported on the Edge Runtime that middleware.ts runs on. Without this split, next build bundles bcryptjs/jose into the Edge middleware chunk and warns; with it, the build is clean.