feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/auth/callback/route.ts

@@ -1,25 +0,0 @@
-import { createClient } from '@/lib/supabase/server'
-import { NextResponse } from 'next/server'
-import type { EmailOtpType } from '@supabase/supabase-js'
-
-export async function GET(request: Request) {
-  const { searchParams } = new URL(request.url)
-  const code = searchParams.get('code')
-  const token_hash = searchParams.get('token_hash')
-  const type = searchParams.get('type') as EmailOtpType | null
-  const nextRaw = searchParams.get('next') ?? '/'
-  const next = nextRaw.startsWith('/') && !nextRaw.startsWith('//') ? nextRaw : '/'
-  const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? '').replace(/\/$/, '')
-
-  const supabase = await createClient()
-
-  if (code) {
-    const { error } = await supabase.auth.exchangeCodeForSession(code)
-    if (!error) return NextResponse.redirect(`${appUrl}${next}`)
-  } else if (token_hash && type) {
-    const { error } = await supabase.auth.verifyOtp({ token_hash, type })
-    if (!error) return NextResponse.redirect(`${appUrl}${next}`)
-  }
-
-  return NextResponse.redirect(`${appUrl}/login?error=auth_callback_failed`)
-}

app/api/auth/change-password/route.ts

@@ -0,0 +1,32 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { getSession } from '@/lib/auth/get-session'
+import { asAdmin } from '@/lib/db/with-user'
+import { users } from '@/lib/db/schema'
+import { eq } from 'drizzle-orm'
+import { verifyPassword, hashPassword } from '@/lib/auth/password'
+
+export async function POST(req: NextRequest) {
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const { currentPassword, newPassword } = await req.json()
+  if (!currentPassword || !newPassword || newPassword.length < 8) {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+  }
+
+  const [user] = await asAdmin(db =>
+    db.select({ passwordHash: users.passwordHash })
+      .from(users).where(eq(users.id, session.sub)).limit(1)
+  )
+
+  if (!user || !await verifyPassword(currentPassword, user.passwordHash)) {
+    return NextResponse.json({ error: 'Current password is incorrect' }, { status: 400 })
+  }
+
+  const newHash = await hashPassword(newPassword)
+  await asAdmin(db => db.update(users).set({ passwordHash: newHash }).where(eq(users.id, session.sub)))
+
+  return NextResponse.json({ ok: true })
+}

app/api/auth/login/route.ts

@@ -0,0 +1,61 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { asAdmin } from '@/lib/db/with-user'
+import { users } from '@/lib/db/schema'
+import { eq } from 'drizzle-orm'
+import { verifyPassword } from '@/lib/auth/password'
+import { createSession } from '@/lib/auth/session'
+
+export async function POST(req: NextRequest) {
+  const { email, password } = await req.json()
+  if (!email || !password) {
+    return NextResponse.json({ error: 'Email and password required' }, { status: 400 })
+  }
+
+  const [user] = await asAdmin(db =>
+    db.select({
+      id: users.id,
+      email: users.email,
+      name: users.name,
+      role: users.role,
+      siteId: users.siteId,
+      passwordHash: users.passwordHash,
+      active: users.active,
+    }).from(users).where(eq(users.email, email.toLowerCase())).limit(1)
+  )
+
+  if (!user || !user.active) {
+    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 })
+  }
+
+  if (!user.passwordHash) {
+    return NextResponse.json({ error: 'Account not configured — contact admin' }, { status: 401 })
+  }
+
+  const valid = await verifyPassword(password, user.passwordHash)
+  if (!valid) {
+    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 })
+  }
+
+  // Update last_login_at
+  await asAdmin(db => db.update(users).set({ lastLoginAt: new Date() }).where(eq(users.id, user.id)))
+
+  const token = await createSession({
+    sub: user.id,
+    role: user.role,
+    siteId: user.siteId ?? null,
+    name: user.name,
+  })
+
+  const appUrl = process.env.APP_URL ?? ''
+  const res = NextResponse.json({ ok: true })
+  res.cookies.set('ims_session', token, {
+    httpOnly: true,
+    secure: appUrl.startsWith('https'),
+    sameSite: 'lax',
+    maxAge: 8 * 60 * 60,
+    path: '/',
+  })
+  return res
+}

app/api/auth/logout/route.ts

@@ -0,0 +1,13 @@
+export const dynamic = 'force-dynamic'
+
+import { NextResponse } from 'next/server'
+
+export async function POST() {
+  const res = NextResponse.json({ ok: true })
+  res.cookies.set('ims_session', '', {
+    httpOnly: true,
+    maxAge: 0,
+    path: '/',
+  })
+  return res
+}

app/api/auth/reset-confirm/route.ts

@@ -0,0 +1,41 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { asAdmin } from '@/lib/db/with-user'
+import { users, passwordResetTokens } from '@/lib/db/schema'
+import { eq, and, gt, isNull } from 'drizzle-orm'
+import { createHash } from 'crypto'
+import { hashPassword } from '@/lib/auth/password'
+
+export async function POST(req: NextRequest) {
+  const { token, password } = await req.json()
+  if (!token || !password || password.length < 8) {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+  }
+
+  const tokenHash = createHash('sha256').update(token).digest('hex')
+  const now = new Date()
+
+  const [row] = await asAdmin(db =>
+    db.select({ id: passwordResetTokens.id, userId: passwordResetTokens.userId })
+      .from(passwordResetTokens)
+      .where(and(
+        eq(passwordResetTokens.tokenHash, tokenHash),
+        gt(passwordResetTokens.expiresAt, now),
+        isNull(passwordResetTokens.usedAt),
+      )).limit(1)
+  )
+
+  if (!row) {
+    return NextResponse.json({ error: 'Invalid or expired token' }, { status: 400 })
+  }
+
+  const newHash = await hashPassword(password)
+
+  await asAdmin(async db => {
+    await db.update(users).set({ passwordHash: newHash }).where(eq(users.id, row.userId))
+    await db.update(passwordResetTokens).set({ usedAt: now }).where(eq(passwordResetTokens.id, row.id))
+  })
+
+  return NextResponse.json({ ok: true })
+}

app/api/auth/reset-request/route.ts

@@ -0,0 +1,37 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { asAdmin } from '@/lib/db/with-user'
+import { users, passwordResetTokens } from '@/lib/db/schema'
+import { eq } from 'drizzle-orm'
+import { createHash, randomBytes } from 'crypto'
+import { sendPasswordResetEmail } from '@/lib/notifications/mailer'
+
+export async function POST(req: NextRequest) {
+  const { email } = await req.json()
+  if (!email) return NextResponse.json({ ok: true })  // don't reveal user existence
+
+  const [user] = await asAdmin(db =>
+    db.select({ id: users.id, name: users.name }).from(users)
+      .where(eq(users.email, email.toLowerCase())).limit(1)
+  )
+
+  if (!user) return NextResponse.json({ ok: true })  // silent
+
+  const rawToken = randomBytes(32).toString('hex')
+  const tokenHash = createHash('sha256').update(rawToken).digest('hex')
+  const expiresAt = new Date(Date.now() + 60 * 60 * 1000)  // 1 hour
+
+  await asAdmin(db => db.insert(passwordResetTokens).values({
+    userId: user.id,
+    tokenHash,
+    expiresAt,
+  }))
+
+  const appUrl = process.env.APP_URL ?? ''
+  const resetLink = `${appUrl}/reset-password?token=${rawToken}`
+
+  await sendPasswordResetEmail({ to: email, name: user.name, resetLink })
+
+  return NextResponse.json({ ok: true })
+}