feat(db+auth): add pg pool, admin_users email/provider migration, refactor auth lookup

- Create src/lib/db.ts (shared pg.Pool, query/withTx helpers, server-only)
- Add @types/pg devDep
- Migration 204: add email, auth_provider, auth_subject columns to
  admin_users; backfill from auth.users; new upsert_admin_user accepts
  multi-provider args; new get_admin_user_for_session RPC resolves
  Auth.js session id (UUID or Google sub) to an admin row
- Refactor getAdminUser() to use pg + new RPC; auto-provisions on first
  Google sign-in using session.user.email
- Refactor updatePasswordAction to call update_user_password via pg
  (drops the Supabase REST hop)
- Delete orphaned src/actions/login.ts (replaced by auth-actions.ts)
- Drop remaining DEV_FORCE_UID references in users.ts; dev path now
  uses dev_session cookie (the only cookie the dev flow can set)
- Update AdminUser type: user_id is now string | null (Google users
  have no Supabase auth id); add email + auth_provider fields
- Fix downstream type errors: StopProductAssignment.callerUid accepts
  null; pickup.ts performedBy widens to string | null
- Bump vitest config, tests/, and other earlier cleanup changes

src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,4 @@
+// Auth.js v5 route handler — re-exports the GET/POST handlers from src/lib/auth.ts
+// Mounted at /api/auth/* (signin, signout, callback, session, csrf, providers, etc.)
+import { handlers } from "@/lib/auth";
+export const { GET, POST } = handlers;

src/app/api/auth/uid/route.ts

@@ -1,11 +0,0 @@
-import { NextResponse } from "next/server";
-import { cookies } from "next/headers";
-
-export async function GET() {
-  const cookieStore = await cookies();
-  const uid =
-    cookieStore.get("rc_auth_uid")?.value ??
-    cookieStore.get("rc_uid")?.value ??
-    null;
-  return NextResponse.json({ uid });
-}

src/app/api/debug-admin-users/route.ts

@@ -1,45 +0,0 @@
-import { NextResponse } from "next/server";
-
-export async function GET() {
-  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY ?? "";
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL ?? "";
-
-  if (!serviceKey || !supabaseUrl) {
-    return NextResponse.json({ error: "Missing env vars", serviceKey: !!serviceKey, supabaseUrl: !!supabaseUrl }, { status: 500 });
-  }
-
-  // Test 1: just a simple health endpoint that doesn't require the key
-  let healthResult = null;
-  try {
-    const res = await fetch(`${supabaseUrl}/rest/v1/`, {
-      headers: { apikey: serviceKey },
-    });
-    healthResult = { status: res.status, ok: res.ok };
-  } catch (e: any) {
-    healthResult = { error: e?.message };
-  }
-
-  // Test 2: try admin_users with POST (bypasses RLS select policies)
-  let adminResult = null;
-  try {
-    const res = await fetch(
-      `${supabaseUrl}/rest/v1/admin_users?select=id,user_id,role,email,display_name&limit=5`,
-      {
-        method: "GET",
-        headers: {
-          apikey: serviceKey,
-          "Content-Type": "application/json",
-          Prefer: "return=representation",
-        },
-      }
-    );
-    const body = await res.text();
-    let parsed = null;
-    try { parsed = JSON.parse(body); } catch { parsed = body; }
-    adminResult = { status: res.status, body: parsed };
-  } catch (e: any) {
-    adminResult = { error: e?.message };
-  }
-
-  return NextResponse.json({ healthResult, adminResult, serviceKeyLen: serviceKey.length });
-}

src/app/api/debug-auth/route.ts

@@ -1,48 +0,0 @@
-import { NextResponse } from "next/server";
-import { cookies } from "next/headers";
-
-export async function GET() {
-  const cookieStore = await cookies();
-  const allCookies = cookieStore.getAll();
-  const rcAuthUid = cookieStore.get("rc_auth_uid")?.value;
-  const rcUid = cookieStore.get("rc_uid")?.value;
-  const rcAccessToken = cookieStore.get("rc_access_token")?.value;
-
-  let adminUsersStatus = "not_tried";
-  let adminUsersResult: string | null = null;
-
-  if (rcAuthUid) {
-    const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-    const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
-    if (supabaseUrl && serviceKey) {
-      try {
-        const res = await fetch(
-          `${supabaseUrl}/rest/v1/admin_users?user_id=eq.${rcAuthUid}&limit=1`,
-          { headers: { apikey: serviceKey, "Content-Type": "application/json" } }
-        );
-        adminUsersStatus = String(res.status);
-        const data = await res.json().catch(() => null);
-        adminUsersResult = JSON.stringify(data);
-      } catch (e) {
-        adminUsersStatus = "error: " + (e instanceof Error ? e.message : String(e));
-      }
-    } else {
-      adminUsersStatus = "missing_env_vars";
-    }
-  } else {
-    adminUsersStatus = "no_rc_auth_uid_cookie";
-  }
-
-  return NextResponse.json({
-    cookies: {
-      rc_auth_uid: rcAuthUid ? `${rcAuthUid.slice(0, 10)}...` : null,
-      rc_uid: rcUid ? `${rcUid.slice(0, 10)}...` : null,
-      rc_access_token: rcAccessToken ? "present" : null,
-      all_cookie_names: allCookies.map(c => c.name),
-    },
-    admin_users: {
-      status: adminUsersStatus,
-      result: adminUsersResult,
-    },
-  });
-}

src/app/api/debug-cookie/route.ts

@@ -1,18 +0,0 @@
-import { NextResponse } from "next/server";
-import { cookies } from "next/headers";
-
-export const dynamic = "force-dynamic";
-
-export async function GET() {
-  const cookieStore = await cookies();
-  const allCookies = cookieStore.getAll();
-  const rcAuthUid = cookieStore.get("rc_auth_uid")?.value;
-  const rcUid = cookieStore.get("rc_uid")?.value;
-
-  return NextResponse.json({
-    received_cookies: allCookies.map(c => ({ name: c.name, value_len: c.value.length })),
-    rc_auth_uid: rcAuthUid ? `${rcAuthUid.slice(0, 8)}...` : "MISSING",
-    rc_uid: rcUid ? `${rcUid.slice(0, 8)}...` : "MISSING",
-    raw_rc_auth_uid: rcAuthUid ?? null,
-  });
-}

src/app/api/debug-env/route.ts

@@ -1,31 +0,0 @@
-import { NextResponse } from "next/server";
-
-export async function GET() {
-  const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const key = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
-  const nodeEnv = process.env.NODE_ENV;
-
-  const result = {
-    NODE_ENV: nodeEnv,
-    NEXT_PUBLIC_SUPABASE_URL: url ? `${url.substring(0, 40)}... (SET)` : "MISSING",
-    NEXT_PUBLIC_SUPABASE_ANON_KEY: key ? `${key.substring(0, 20)}... (SET)` : "MISSING",
-    SUPABASE_SERVICE_ROLE_KEY: serviceKey ? `${serviceKey.substring(0, 20)}... (SET)` : "MISSING",
-    supabaseClientCanCreate: false as boolean,
-    error: null as string | null,
-  };
-
-  if (url && key) {
-    try {
-      const { createClient } = await import("@supabase/supabase-js");
-      const client = createClient(url, key);
-      result.supabaseClientCanCreate = true;
-    } catch (e: any) {
-      result.error = e?.message ?? String(e);
-    }
-  } else {
-    result.error = "Missing env vars";
-  }
-
-  return NextResponse.json(result, { status: 200 });
-}

src/app/api/debug-get-admin-users/route.ts

@@ -1,34 +0,0 @@
-import { NextResponse } from "next/server";
-import { getAdminUser } from "@/lib/admin-permissions";
-
-export async function GET() {
-  // Test the REST call directly from this endpoint
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
-  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
-  const uid = "c023efb3-e3ef-4156-bed6-d17b92ea8aca";
-
-  let restResult = null;
-  try {
-    const res = await fetch(
-      `${supabaseUrl}/rest/v1/admin_users?user_id=eq.${uid}&limit=1`,
-      { headers: { apikey: serviceKey, "Content-Type": "application/json" } }
-    );
-    const data = await res.json().catch(() => null);
-    restResult = { status: res.status, data, keyLen: serviceKey.length };
-  } catch (e: any) {
-    restResult = { error: e?.message };
-  }
-
-  const adminUser = await getAdminUser();
-  return NextResponse.json({
-    adminUser: adminUser ? {
-      id: adminUser.id,
-      user_id: adminUser.user_id,
-      role: adminUser.role,
-      brand_id: adminUser.brand_id,
-      active: adminUser.active,
-    } : null,
-    restResult,
-    supabaseUrl: supabaseUrl ? "SET" : "MISSING",
-  });
-}

src/app/api/debug-hello/route.ts

@@ -1,9 +0,0 @@
-import { NextResponse } from "next/server";
-
-export async function GET() {
-  return NextResponse.json({
-    ts: new Date().toISOString(),
-    deployment: "debug-hello",
-    msg: "hello from latest build"
-  });
-}

src/app/api/debug-me/route.ts

@@ -1,80 +0,0 @@
-import { NextResponse } from "next/server";
-import { cookies } from "next/headers";
-
-export const dynamic = "force-dynamic";
-
-export async function GET() {
-  const cookieStore = await cookies();
-  const uid = cookieStore.get("rc_auth_uid")?.value ?? cookieStore.get("rc_uid")?.value;
-
-  if (!uid) {
-    return NextResponse.json({ error: "No uid cookie found" }, { status: 400 });
-  }
-
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
-
-  if (!supabaseUrl || !serviceKey) {
-    return NextResponse.json({
-      uid,
-      error: "Missing env vars",
-      supabaseUrl: supabaseUrl ?? "MISSING",
-      serviceKeyPresent: !!serviceKey,
-    });
-  }
-
-  // Exact same lookup as getAdminUser
-  const lookupRes = await fetch(
-    `${supabaseUrl}/rest/v1/admin_users?user_id=eq.${uid}&limit=1`,
-    { headers: { apikey: serviceKey, "Content-Type": "application/json" } }
-  );
-
-  let adminUsers: unknown[] = [];
-  let lookupOk = lookupRes.ok;
-  let lookupStatus = lookupRes.status;
-  let lookupData: unknown = null;
-
-  if (lookupRes.ok) {
-    lookupData = await lookupRes.json().catch(() => []);
-    adminUsers = Array.isArray(lookupData) ? lookupData : [];
-  } else {
-    lookupData = await lookupRes.text().catch(() => "unknown error");
-  }
-
-  if (adminUsers.length > 0) {
-    return NextResponse.json({
-      uid,
-      result: "found",
-      adminUser: adminUsers[0],
-    });
-  }
-
-  // Try auto-create
-  const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  if (!UUID_REGEX.test(uid)) {
-    return NextResponse.json({ uid, result: "invalid_uuid" });
-  }
-
-  const postRes = await fetch(`${supabaseUrl}/rest/v1/admin_users`, {
-    method: "POST",
-    headers: { apikey: serviceKey, "Content-Type": "application/json", Prefer: "return=representation" },
-    body: JSON.stringify({
-      user_id: uid, role: "platform_admin", brand_id: null, active: true,
-      can_manage_products: true, can_manage_stops: true, can_manage_orders: true,
-      can_manage_pickup: true, can_manage_messages: true, can_manage_refunds: true,
-      can_manage_users: true, can_manage_water_log: true, can_manage_reports: true,
-      can_manage_settings: true, must_change_password: false
-    }),
-  });
-
-  return NextResponse.json({
-    uid,
-    result: "auto_created",
-    lookupOk,
-    lookupStatus,
-    adminUsersFound: adminUsers.length,
-    postStatus: postRes.status,
-    postOk: postRes.ok,
-    postData: postRes.ok ? await postRes.json().catch(() => null) : await postRes.text().catch(() => null),
-  });
-}

src/app/api/force-admin/route.ts

@@ -1,31 +0,0 @@
-import { NextResponse } from "next/server";
-
-const DEV_ADMIN_UID = "dev-user-00000000-0000-0000-0000-000000000001";
-const DEV_ROLES = ["platform_admin", "brand_admin", "store_employee"];
-
-export async function GET(request: Request) {
-  const url = new URL(request.url);
-  const role = url.searchParams.get("role") ?? "platform_admin";
-  const safeRole = DEV_ROLES.includes(role) ? role : "platform_admin";
-
-  const origin = url.origin;
-
-  const response = NextResponse.redirect(new URL("/admin", origin));
-
-  const cookieOptions = {
-    path: "/",
-    maxAge: 60 * 60 * 24 * 30,
-    sameSite: "lax" as const,
-  };
-
-  response.cookies.set("dev_session", safeRole, {
-    ...cookieOptions,
-    httpOnly: false,
-  });
-  response.cookies.set("rc_auth_uid", DEV_ADMIN_UID, {
-    ...cookieOptions,
-    httpOnly: false,
-  });
-
-  return response;
-}

src/app/api/login/route.ts

@@ -1,47 +0,0 @@
-import { NextResponse } from "next/server";
-import { cookies } from "next/headers";
-
-export async function POST(request: Request) {
-  const { email, password } = await request.json().catch(() => ({}));
-
-  if (!email || !password) {
-    return NextResponse.json({ error: "Email and password are required." }, { status: 400 });
-  }
-
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-  if (!supabaseUrl || !supabaseAnonKey) {
-    return NextResponse.json({ error: "Server misconfiguration." }, { status: 500 });
-  }
-
-  const authRes = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=password`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", apikey: supabaseAnonKey },
-    body: JSON.stringify({ email, password }),
-  });
-
-  const authData = await authRes.json().catch(() => null);
-
-  if (!authRes.ok || !authData?.access_token) {
-    const msg = authData?.error_description ?? authData?.error ?? "Invalid credentials.";
-    return NextResponse.json({ ok: false, error: msg }, { status: 401 });
-  }
-
-  const userId = authData.user?.id ?? authData.user_id;
-  if (!userId) {
-    return NextResponse.json({ ok: false, error: "Auth succeeded but user ID missing." }, { status: 500 });
-  }
-
-  // Set cookie + return JSON — client reads this and navigates
-  const isProd = process.env.NODE_ENV === "production";
-  const response = NextResponse.json({ ok: true });
-  response.cookies.set("rc_auth_uid", userId, {
-    path: "/",
-    maxAge: 60 * 60 * 24 * 30,
-    httpOnly: true,
-    sameSite: "lax",
-    secure: isProd,
-  });
-
-  return response;
-}

src/app/api/logout/route.ts

@@ -1,12 +0,0 @@
-import { NextResponse } from "next/server";
-import { cookies } from "next/headers";
-
-export async function POST() {
-  const cookieStore = await cookies();
-  // Clear all auth cookies (new + legacy)
-  cookieStore.delete("rc_access_token");
-  cookieStore.delete("rc_uid");
-  cookieStore.delete("rc_auth_uid");
-  cookieStore.delete("rc_auth_token");
-  return NextResponse.json({ success: true });
-}

src/app/api/set-auth-cookie/route.ts

@@ -1,22 +0,0 @@
-import { NextResponse } from "next/server";
-import { cookies } from "next/headers";
-
-export async function POST(request: Request) {
-  const { userId } = await request.json().catch(() => ({}));
-
-  if (!userId) {
-    return NextResponse.json({ error: "Missing userId" }, { status: 400 });
-  }
-
-  const cookieStore = await cookies();
-  const isProd = process.env.NODE_ENV === "production";
-  cookieStore.set("rc_auth_uid", userId, {
-    path: "/",
-    maxAge: 60 * 60 * 24 * 30,
-    httpOnly: true,
-    sameSite: isProd ? "strict" : "lax",
-    secure: isProd,
-  });
-
-  return NextResponse.json({ ok: true });
-}

src/app/api/supabase-test/route.ts

@@ -1,43 +0,0 @@
-import { createClient } from "@supabase/supabase-js";
-
-const url = process.env.NEXT_PUBLIC_SUPABASE_URL ?? "";
-const key = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ?? "";
-
-export async function GET() {
-  // Try creating supabase client — if it throws, capture the exact error
-  let status: string;
-  let canCreate = false;
-  let errMessage = "";
-
-  if (!url || !key) {
-    status = "MISSING_ENV_VARS";
-    errMessage = `url=${url ? "SET" : "MISSING"}, key=${key ? "SET" : "MISSING"}`;
-  } else {
-    try {
-      createClient(url, key);
-      canCreate = true;
-      status = "OK";
-    } catch (e: any) {
-      errMessage = e?.message ?? String(e);
-      status = "CREATE_CLIENT_FAILED";
-    }
-  }
-
-  const body = JSON.stringify({
-    status,
-    canCreate,
-    errMessage,
-    envVars: {
-      NODE_ENV: process.env.NODE_ENV,
-      urlSet: !!url,
-      urlPrefix: url ? url.substring(0, 30) : null,
-      keySet: !!key,
-      keyPrefix: key ? key.substring(0, 10) : null,
-    },
-  }, null, 2);
-
-  return new Response(body, {
-    status: status === "OK" ? 200 : 500,
-    headers: { "Content-Type": "application/json" },
-  });
-}