first project commit

apps/operator-pwa/lib/auth.config.ts

@@ -0,0 +1,40 @@
+import type { NextAuthConfig } from 'next-auth';
+
+/**
+ * Edge-safe portion of the Auth.js config. The middleware imports THIS, never
+ * the full `auth.ts` — Credentials providers and the Prisma client are not
+ * edge-compatible, so they live exclusively in auth.ts which runs in the
+ * Node.js runtime (route handlers).
+ */
+export const authConfig = {
+  trustHost: true,
+  session: { strategy: 'jwt' },
+  pages: {
+    // No login UI in this scaffold phase. See auth.ts for the placeholder.
+  },
+  callbacks: {
+    async jwt({ token, user }) {
+      if (user) {
+        // user is the value returned from `authorize()` in the Credentials provider.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const u = user as any;
+        token.id = u.id;
+        token.role = u.role;
+        token.tenantId = u.tenantId;
+      }
+      return token;
+    },
+    async session({ session, token }) {
+      if (token && session.user) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (session.user as any).id = token.id;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (session.user as any).role = token.role;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (session.user as any).tenantId = token.tenantId;
+      }
+      return session;
+    },
+  },
+  providers: [],
+} satisfies NextAuthConfig;

apps/operator-pwa/lib/auth.ts

@@ -0,0 +1,93 @@
+import NextAuth from 'next-auth';
+import Credentials from 'next-auth/providers/credentials';
+import { prisma } from '@repo/db';
+import type { SessionUser } from '@repo/api';
+import { env } from '../env';
+import { authConfig } from './auth.config';
+
+/**
+ * ============================================================================
+ *  Auth.js v5 — PLACEHOLDER configuration for the scaffold phase.
+ * ============================================================================
+ *
+ *  The Credentials provider below accepts ANY email that exists in the User
+ *  table (seeded by `pnpm db:seed`). NO PASSWORD CHECK is performed. This is
+ *  deliberately minimal — just enough to populate the tRPC context with a real
+ *  Auth.js session — and MUST be replaced with real authentication before any
+ *  non-dev deployment.
+ *
+ *  Auto sign-in
+ *  ------------
+ *  See `resolveUser()` below. When AUTH_DEV_AUTOLOGIN=true, server-side code
+ *  that has no session falls back to the seeded admin user. This is a back
+ *  door and is gated by an explicit env flag whose default in .env.example is
+ *  FALSE.
+ *
+ *      !!! NEVER set AUTH_DEV_AUTOLOGIN=true in production. !!!
+ *
+ *  In production with AUTH_DEV_AUTOLOGIN unset/false, requests without a
+ *  signed Auth.js session resolve to user=null, and protectedProcedure throws
+ *  401.
+ * ============================================================================
+ */
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+  ...authConfig,
+  secret: env.AUTH_SECRET,
+  providers: [
+    Credentials({
+      name: 'Email (placeholder)',
+      credentials: {
+        email: { label: 'Email', type: 'email' },
+      },
+      async authorize(credentials) {
+        const email = credentials?.email;
+        if (typeof email !== 'string' || !email) return null;
+        const user = await prisma.user.findFirst({ where: { email } });
+        if (!user) return null;
+        // NO password verification — placeholder only.
+        return {
+          id: user.id,
+          email: user.email,
+          name: user.email,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          role: user.role as any,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          tenantId: user.tenantId as any,
+        };
+      },
+    }),
+  ],
+});
+
+/**
+ * Resolve the current user for server-side code (RSC, route handlers, tRPC).
+ * Single chokepoint that combines the real Auth.js session with the dev-only
+ * auto-login fallback. Application code MUST use this and not call `auth()`
+ * directly when it expects to honour AUTH_DEV_AUTOLOGIN.
+ */
+export async function resolveUser(): Promise<SessionUser | null> {
+  const session = await auth();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const u = session?.user as any;
+  if (u?.id && u?.tenantId) {
+    return { id: u.id, email: u.email, role: u.role, tenantId: u.tenantId };
+  }
+
+  if (env.AUTH_DEV_AUTOLOGIN) {
+    // Dev back door. Production guards: env flag default is false; this branch
+    // is also a no-op if the seed user doesn't exist.
+    const admin = await prisma.user.findFirst({ where: { email: 'admin@demo.local' } });
+    if (admin) {
+      return {
+        id: admin.id,
+        email: admin.email,
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        role: admin.role as any,
+        tenantId: admin.tenantId,
+      };
+    }
+  }
+
+  return null;
+}

apps/operator-pwa/lib/trpc/client.ts

@@ -0,0 +1,12 @@
+'use client';
+
+import { createTRPCReact } from '@trpc/react-query';
+import type { AppRouter } from '@repo/api';
+
+/**
+ * Typed tRPC React Query hooks for client components.
+ *
+ *   import { trpc } from '@/lib/trpc/client';
+ *   const { data } = trpc.ping.ping.useQuery();
+ */
+export const trpc = createTRPCReact<AppRouter>();

apps/operator-pwa/lib/trpc/server.ts

@@ -0,0 +1,30 @@
+import 'server-only';
+import { cache } from 'react';
+import { headers } from 'next/headers';
+import {
+  appRouter,
+  createCallerFactory,
+  createTRPCContext,
+  type AppRouter,
+} from '@repo/api';
+import type { inferRouterInputs, inferRouterOutputs } from '@trpc/server';
+import { resolveUser } from '../auth';
+
+/**
+ * RSC-side tRPC caller. Bypasses HTTP — runs the router directly inside the
+ * server component. Use this for reads in Server Components / Server Actions.
+ *
+ * For client-side reads/mutations, see `./client.ts` (TanStack Query hooks).
+ */
+const createContext = cache(async () => {
+  const user = await resolveUser();
+  const h = await headers();
+  return createTRPCContext({ user, headers: h });
+});
+
+const createCaller = createCallerFactory(appRouter);
+
+export const api = createCaller(createContext);
+
+export type RouterInputs = inferRouterInputs<AppRouter>;
+export type RouterOutputs = inferRouterOutputs<AppRouter>;