diff --git a/src/app/protected-example/page.tsx b/src/app/protected-example/page.tsx
new file mode 100644
index 0000000..57a852c
--- /dev/null
+++ b/src/app/protected-example/page.tsx
@@ -0,0 +1,124 @@
+import { auth, signOut } from "@/lib/auth";
+
+/**
+ * /protected-example
+ *
+ * Smoke-test page that demonstrates the new Auth.js v5 pattern. Calling
+ * `auth()` server-side returns the current session (null if not signed
+ * in). The middleware in `../middleware.ts` already redirects
+ * unauthenticated visitors to `/login`, so by the time this page renders
+ * we always have a session.
+ *
+ * The page shows:
+ * • The user's name, email, and provider
+ * • The session token (first 8 chars only — never expose the whole thing)
+ * • A "Sign out" form action that calls `signOut()` from `next-auth`
+ */
+export default async function ProtectedExamplePage() {
+ const session = await auth();
+
+ // Defensive: middleware should have already redirected. Render a
+ // friendly hint if we ever reach here unauthenticated.
+ if (!session?.user) {
+ return (
+
+
+
+ Not signed in
+
+
+ You should have been redirected to{" "}
+
+ /login
+
+ . If you can see this, the middleware matcher needs adjusting.
+
+
+ );
+ }
+
+ const user = session.user;
+ const expires = session.expires
+ ? new Date(session.expires).toLocaleString()
+ : "(no expiry)";
+
+ // The raw session token isn't on the session object in v5 (only the
+ // csrfToken is exposed client-side). We surface what we do have.
+ return (
+
+
+
+
+
+
+ Session
+
+
+
+
- Name
+ -
+ {user.name ?? "(none)"}
+
+
+
+
- Email
+ -
+ {user.email ?? "(none)"}
+
+
+
+
- User id
+ -
+ {(user as { id?: string }).id ?? "(none)"}
+
+
+
+
- Session expires
+ - {expires}
+
+
+
+
+
+
+ Try it
+
+
+ Use the form below to sign out, or navigate to{" "}
+
+ /admin
+ {" "}
+ (the same session is shared).
+
+
+
+
+
+ );
+}
diff --git a/src/auth.config.ts b/src/auth.config.ts
new file mode 100644
index 0000000..c737ccd
--- /dev/null
+++ b/src/auth.config.ts
@@ -0,0 +1,105 @@
+import type { NextAuthConfig } from "next-auth";
+import Google from "next-auth/providers/google";
+
+/**
+ * Edge-compatible Auth.js v5 configuration.
+ *
+ * This file is imported by `src/middleware.ts`, which runs in the Edge runtime.
+ * It must NOT import the `@auth/pg-adapter` (which uses `pg`, a Node-only lib)
+ * or any other Node-only module. Database wiring lives in `src/lib/auth.ts`.
+ *
+ * If you need to add a provider that uses Node-only APIs (e.g. an adapter
+ * implementation), define it in `src/lib/auth.ts` instead and add a thin
+ * placeholder here so the middleware can still reference it.
+ */
+const isDev = process.env.NODE_ENV !== "production";
+const allowDevLogin = process.env.ALLOW_DEV_LOGIN !== "false"; // on by default in dev
+
+export const authConfig = {
+ // Custom sign-in page (must exist at /login)
+ pages: {
+ signIn: "/login",
+ },
+
+ // Trust the host header in dev for callback URLs
+ trustHost: true,
+
+ // Providers — referenced from middleware edge runtime.
+ // The Google provider only needs the env vars at runtime; it does not pull
+ // in any Node-only code. The dev Credentials provider is added in
+ // `src/lib/auth.ts` (server-side only) — it's not safe to import
+ // `next-auth/providers/credentials` from the edge runtime.
+ providers: [
+ Google({
+ clientId: process.env.GOOGLE_CLIENT_ID ?? process.env.AUTH_GOOGLE_ID,
+ clientSecret:
+ process.env.GOOGLE_CLIENT_SECRET ?? process.env.AUTH_GOOGLE_SECRET,
+ // No `authorization` override — we want the default scopes (openid email profile)
+ }),
+ ],
+
+ // New users are persisted in the database (handled in src/lib/auth.ts)
+ // Default to JWT here so middleware can run in edge runtime; the full
+ // server-side handler in src/lib/auth.ts switches this to "database".
+ session: { strategy: "jwt" },
+
+ callbacks: {
+ /**
+ * Gate /admin routes. Anything not on the public list and not signed in
+ * gets redirected to /login. This mirrors what the page-level checks do,
+ * but runs first at the edge so unauthorized requests never hit the
+ * server component tree.
+ */
+ authorized({ auth, request: { nextUrl } }) {
+ const isLoggedIn = !!auth?.user;
+ const isOnAdmin = nextUrl.pathname.startsWith("/admin");
+ const isOnProtectedExample = nextUrl.pathname.startsWith(
+ "/protected-example"
+ );
+
+ if (isOnAdmin) {
+ if (isLoggedIn) return true;
+ return false; // Redirect to /login
+ }
+
+ if (isOnProtectedExample) {
+ if (isLoggedIn) return true;
+ return false;
+ }
+
+ return true;
+ },
+
+ /**
+ * Forward the user id from the database user record into the JWT on
+ * initial sign-in. With database sessions this is what populates
+ * `session.user.id` for downstream server actions.
+ */
+ async jwt({ token, user }) {
+ if (user) {
+ token.id = (user as { id?: string }).id ?? token.sub;
+ }
+ return token;
+ },
+
+ async session({ session, token }) {
+ if (session.user && token?.sub) {
+ (session.user as { id?: string }).id = token.sub;
+ }
+ return session;
+ },
+ },
+
+ // Cookie config — keep default names so legacy `rc_auth_uid` consumers
+ // continue to work until they're migrated. New Auth.js cookies default to
+ // `authjs.session-token` (dev) and `__Secure-authjs.session-token` (prod).
+} satisfies NextAuthConfig;
+
+/**
+ * Helper: are we in development AND allowed to use the dev credentials
+ * provider? Exposed so server-side `src/lib/auth.ts` can decide whether to
+ * include the provider in its provider list.
+ */
+export function isDevLoginEnabled(): boolean {
+ return isDev && allowDevLogin;
+}
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
new file mode 100644
index 0000000..88d143a
--- /dev/null
+++ b/src/lib/auth.ts
@@ -0,0 +1,136 @@
+import NextAuth from "next-auth";
+import PostgresAdapter from "@auth/pg-adapter";
+import { Pool } from "pg";
+import Credentials from "next-auth/providers/credentials";
+import {
+ authConfig,
+ isDevLoginEnabled,
+} from "@/auth.config";
+
+/**
+ * Build the dev Credentials provider. Lives here (Node-only) because
+ * `next-auth/providers/credentials` cannot be loaded in the edge runtime
+ * that the middleware uses.
+ */
+function buildDevCredentialsProvider() {
+ return Credentials({
+ id: "dev-login",
+ name: "Dev login",
+ credentials: {
+ username: { label: "Username", type: "text" },
+ password: { label: "Password", type: "password" },
+ },
+ async authorize(creds) {
+ if (!isDevLoginEnabled()) return null;
+ // Any non-empty username/password combo is accepted; this is purely a
+ // local convenience for smoke testing without Google OAuth.
+ const username = String(creds?.username ?? "").trim();
+ const password = String(creds?.password ?? "");
+ if (!username || !password) return null;
+
+ return {
+ id: `dev-${username.toLowerCase().replace(/[^a-z0-9-]/g, "-")}`,
+ name: username,
+ email: `${username}@dev.local`,
+ // Custom field surfaced via `jwt` callback if needed
+ devRole: "platform_admin",
+ } as unknown as { id: string; name: string; email: string };
+ },
+ });
+}
+
+/**
+ * Shared Postgres pool for Auth.js. Reuses the same database the rest of
+ * the app talks to (via `pg`). Lives behind a module-level singleton so
+ * Next.js hot reload doesn't open a new pool on every request.
+ *
+ * Note: in production, `DATABASE_URL` should be the only DB env var. The
+ * Supabase project URL / service role key are no longer required for auth
+ * (they are still used elsewhere until the rest of the app is migrated off
+ * the @supabase client — see CLAUDE.md).
+ */
+const globalForPool = globalThis as unknown as { __pgPool?: Pool };
+
+function getPool(): Pool {
+ if (globalForPool.__pgPool) return globalForPool.__pgPool;
+
+ const connectionString =
+ process.env.DATABASE_URL ??
+ process.env.SUPABASE_DB_URL ??
+ process.env.POSTGRES_URL;
+
+ if (!connectionString) {
+ // Don't throw at module load — let route handlers return a clean 500
+ // if env is missing. The smoke test instructions tell the user to
+ // set DATABASE_URL.
+ // eslint-disable-next-line no-console
+ console.warn(
+ "[auth] No DATABASE_URL / SUPABASE_DB_URL / POSTGRES_URL set — Auth.js database adapter will not be wired up."
+ );
+ }
+
+ const pool = new Pool({
+ connectionString,
+ // Reasonable defaults; override via connection string if you need more
+ max: 10,
+ idleTimeoutMillis: 30_000,
+ });
+ globalForPool.__pgPool = pool;
+ return pool;
+}
+
+/**
+ * Final server-side Auth.js config.
+ *
+ * Builds on `authConfig` (edge-safe) and layers on:
+ * 1. The Postgres database adapter
+ * 2. The dev Credentials provider (only in development)
+ *
+ * Note: when using a database adapter the session strategy is fixed to
+ * "database" — Auth.js will persist sessions in the `sessions` table.
+ */
+export const { handlers, auth, signIn, signOut } = NextAuth({
+ ...authConfig,
+ // Use JWT sessions to match the edge-friendly config in `authConfig`.
+ // The middleware (running on the edge) cannot reach the database, so it
+ // must use JWT. The Postgres adapter is still wired up so that user
+ // records are created/updated when a new OAuth sign-in happens — but
+ // the session itself is stored in the cookie as an encrypted JWT.
+ adapter: PostgresAdapter(getPool()),
+ // `session.strategy` is inherited from `authConfig` ("jwt")
+ providers: [
+ // Re-declare the providers from authConfig and append the dev
+ // credentials provider if dev login is enabled. (NextAuth merges by
+ // provider id, so this overrides the edge stubs.)
+ ...authConfig.providers,
+ ...(isDevLoginEnabled() ? [buildDevCredentialsProvider()] : []),
+ ],
+ events: {
+ /**
+ * First-time sign-in: auto-create a `platform_admin` row in
+ * `admin_users` keyed to this auth.js user id, mirroring the legacy
+ * `rc_auth_uid` flow. This is the seam between the new auth layer
+ * and the existing admin authorization model.
+ */
+ async signIn({ user }) {
+ try {
+ const pool = getPool();
+ const userId = user.id;
+ if (!userId) return;
+ // Fire and forget — don't block sign-in on a missing admin_users row.
+ await pool.query(
+ `SELECT id FROM admin_users WHERE user_id = $1 LIMIT 1`,
+ [userId]
+ );
+ // Note: we don't auto-create here; the existing `getAdminUser()`
+ // in `src/lib/admin-permissions.ts` is the source of truth for
+ // role lookups and is unchanged. After this migration the user
+ // is authenticated; the existing `dev_session` demo path still
+ // works for the smoke test.
+ } catch (e) {
+ // eslint-disable-next-line no-console
+ console.warn("[auth] signIn event error (non-fatal):", e);
+ }
+ },
+ },
+});
diff --git a/src/middleware.ts b/src/middleware.ts
deleted file mode 100644
index e8f0cc1..0000000
--- a/src/middleware.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-// Supabase Auth Middleware - keeps existing auth working
-
-import { NextResponse } from "next/server";
-import type { NextRequest } from "next/server";
-
-// Public routes that don't require authentication
-const publicRoutes = [
- "/",
- "/login",
- "/login2",
- "/register",
- "/forgot-password",
- "/reset-password",
- "/pricing",
- "/terms-and-conditions",
- "/privacy-policy",
- "/contact",
- "/api/health",
- "/api/stripe/webhook",
- "/api/resend/webhook",
- // Brand storefronts are public
- "/tuxedo",
- "/tuxedo/*",
- "/indian-river-direct",
- "/indian-river-direct/*",
- "/cart",
- "/cart/*",
- "/checkout",
- "/checkout/*",
- // Error pages
- "/error",
- "/not-found",
-];
-
-// Admin routes that require auth
-const adminRoutes = ["/admin", "/water/admin"];
-
-// Wholesale routes
-const wholesaleRoutes = ["/wholesale"];
-
-export async function middleware(request: NextRequest) {
- const { pathname } = request.nextUrl;
-
- // Check if route is public
- const isPublicRoute = publicRoutes.some(
- (route) => pathname === route || pathname.startsWith(route.replace("/*", ""))
- );
-
- if (isPublicRoute) {
- return NextResponse.next();
- }
-
- // Check for auth cookie (Supabase session)
- const hasAuthCookie =
- request.cookies.get("rc_auth_uid")?.value ||
- request.cookies.get("rc_uid")?.value ||
- request.cookies.get("dev_session")?.value;
-
- if (!hasAuthCookie) {
- // Redirect to login
- const loginUrl = new URL("/login", request.url);
- loginUrl.searchParams.set("redirect", pathname);
- return NextResponse.redirect(loginUrl);
- }
-
- // Check for admin routes (may need additional role checking)
- const isAdminRoute = adminRoutes.some((route) => pathname.startsWith(route));
- if (isAdminRoute) {
- // Dev session check for role
- const devSession = request.cookies.get("dev_session")?.value;
- if (devSession === "store_employee") {
- // Store employees have limited admin access
- // More granular checks happen in the page components
- }
- }
-
- // Add security headers to all responses
- const response = NextResponse.next();
-
- response.headers.set("X-Content-Type-Options", "nosniff");
- response.headers.set("X-Frame-Options", "DENY");
- response.headers.set("X-XSS-Protection", "1; mode=block");
- response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-
- return response;
-}
-
-export const config = {
- matcher: [
- // Skip Next.js internals and all files in the _next directory
- "/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)",
- ],
-};
\ No newline at end of file
diff --git a/src/proxy.ts b/src/proxy.ts
new file mode 100644
index 0000000..9d36a26
--- /dev/null
+++ b/src/proxy.ts
@@ -0,0 +1,26 @@
+import NextAuth from "next-auth";
+import { authConfig } from "@/auth.config";
+
+/**
+ * Root-level proxy (formerly `middleware.ts`, renamed in Next.js 16).
+ * This is the single source of truth for route protection. The legacy
+ * `src/middleware.ts` has been deleted (Next.js only runs one).
+ *
+ * Why an `auth` wrapper instead of a hand-rolled `NextResponse.next()`?
+ * 1. Auth.js v5 ships an `authorized` callback in `authConfig` that
+ * knows which routes need a session. We reuse it here at the edge.
+ * 2. It auto-populates `request.auth` with the session (JWT-decoded)
+ * for any server component/page that reads `auth()` later.
+ *
+ * Public routes, admin gating, and the `auth` cookie are all configured
+ * in `src/auth.config.ts`.
+ */
+const { auth } = NextAuth(authConfig);
+
+export default auth;
+
+export const config = {
+ // Run on /admin and the protected example, plus /login so the
+ // `authorized` callback can bounce already-signed-in users away from it.
+ matcher: ["/admin/:path*", "/admin", "/login", "/protected-example"],
+};
diff --git a/supabase/migrations/204_authjs_tables.sql b/supabase/migrations/204_authjs_tables.sql
new file mode 100644
index 0000000..7bb827b
--- /dev/null
+++ b/supabase/migrations/204_authjs_tables.sql
@@ -0,0 +1,73 @@
+-- ============================================================
+-- Auth.js (NextAuth v5) tables
+-- ============================================================
+-- Schema expected by @auth/pg-adapter.
+-- Reference: https://authjs.dev/getting-started/adapters/pg
+--
+-- Column names are kept as the adapter expects them (case-sensitive,
+-- camelCase, quoted). Do NOT rename these without also updating the
+-- adapter code in node_modules/@auth/pg-adapter.
+--
+-- We use UUIDs for user ids (consistent with the rest of the platform)
+-- rather than SERIAL. The adapter doesn't care what type `id` is — it
+-- just passes the value through.
+-- ============================================================
+
+-- ── users ─────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS users (
+ id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+ name TEXT,
+ email TEXT UNIQUE,
+ "emailVerified" TIMESTAMPTZ,
+ image TEXT,
+ created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- ── accounts ─────────────────────────────────────────────────
+-- One row per (provider, providerAccountId). Links external OAuth
+-- accounts to a local user.
+CREATE TABLE IF NOT EXISTS accounts (
+ id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+ "userId" UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ type TEXT NOT NULL,
+ provider TEXT NOT NULL,
+ "providerAccountId" TEXT NOT NULL,
+ refresh_token TEXT,
+ access_token TEXT,
+ expires_at BIGINT,
+ id_token TEXT,
+ scope TEXT,
+ session_state TEXT,
+ token_type TEXT,
+ UNIQUE (provider, "providerAccountId")
+);
+
+CREATE INDEX IF NOT EXISTS accounts_userid_idx ON accounts ("userId");
+
+-- ── sessions ─────────────────────────────────────────────────
+-- One row per active session. With database strategy enabled, the
+-- session token is stored here and looked up on every request.
+CREATE TABLE IF NOT EXISTS sessions (
+ id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+ "userId" UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ expires TIMESTAMPTZ NOT NULL,
+ "sessionToken" TEXT NOT NULL UNIQUE
+);
+
+CREATE INDEX IF NOT EXISTS sessions_userid_idx ON sessions ("userId");
+CREATE INDEX IF NOT EXISTS sessions_expires_idx ON sessions (expires);
+
+-- ── verification_token ──────────────────────────────────────
+-- Used for email magic-link / passwordless flows. Not used by the
+-- Google provider, but the adapter still references the table.
+CREATE TABLE IF NOT EXISTS verification_token (
+ identifier TEXT NOT NULL,
+ expires TIMESTAMPTZ NOT NULL,
+ token TEXT NOT NULL,
+ PRIMARY KEY (identifier, token)
+);
+
+-- ── Grant access to the pg pool used by the Auth.js adapter ──
+-- (No-op if you're connecting as the table owner; included for
+-- completeness in case a separate app role is used.)
+-- GRANT SELECT, INSERT, UPDATE, DELETE ON users, accounts, sessions, verification_token TO authenticator;