fix: Resolve Prisma Edge Runtime error in middleware

- Move all auth configuration to auth.config.ts to avoid Prisma imports in Edge Runtime
- Update middleware to use NextAuth with edge-compatible config
- Consolidate session, cookies, and callback configuration in auth.config.ts
- Update auth.ts to extend authConfig and only add Prisma-dependent providers
- This fixes the 'PrismaClient is not configured to run in Edge Runtime' error

The middleware now properly works with NextAuth v5 beta without trying to load Prisma in the Edge Runtime.

auth.config.ts

@@ -1,6 +1,22 @@
 import type { NextAuthConfig } from "next-auth"
 
 export const authConfig = {
+  session: {
+    strategy: "jwt",
+    maxAge: 30 * 24 * 60 * 60, // 30 days in seconds
+    updateAge: 24 * 60 * 60, // Update session every 24 hours
+  },
+  cookies: {
+    sessionToken: {
+      name: `${process.env.NODE_ENV === 'production' ? '__Secure-' : ''}next-auth.session-token`,
+      options: {
+        httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
+        sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
+        path: '/',
+        secure: process.env.NODE_ENV === 'production', // Only send cookie over HTTPS in production
+      },
+    },
+  },
   pages: {
     signIn: "/auth/login",
     signOut: "/auth/logout",
@@ -9,20 +25,48 @@ export const authConfig = {
   callbacks: {
     authorized({ auth, request: { nextUrl } }) {
       const isLoggedIn = !!auth?.user
-      const isOnAuthPage = nextUrl.pathname.startsWith("/auth")
       
-      // Allow access to auth pages when not logged in
-      if (isOnAuthPage) {
+      // Define protected routes
+      const isProtectedRoute = 
+        nextUrl.pathname === "/" ||
+        nextUrl.pathname.startsWith("/list") ||
+        nextUrl.pathname.startsWith("/profile") ||
+        nextUrl.pathname.startsWith("/invitations")
+      
+      // Define auth pages (login, register, etc.)
+      const isAuthPage = nextUrl.pathname.startsWith("/auth")
+      
+      // Allow access to auth pages regardless of authentication status
+      if (isAuthPage) {
+        // If already logged in and trying to access login/register, redirect to home
+        if (isLoggedIn && (nextUrl.pathname === "/auth/login" || nextUrl.pathname === "/auth/register")) {
+          return Response.redirect(new URL("/", nextUrl))
+        }
         return true
       }
       
-      // Redirect to login if not authenticated
-      if (!isLoggedIn) {
-        return false
+      // Redirect to login if accessing protected route without authentication
+      if (isProtectedRoute && !isLoggedIn) {
+        return false // This will redirect to signIn page
       }
       
+      // Allow access to public routes
       return true
     },
+    async jwt({ token, user }) {
+      // Add user ID to token on sign in
+      if (user) {
+        token.id = user.id
+      }
+      return token
+    },
+    async session({ session, token }) {
+      // Add user ID to session from token
+      if (session.user && token.id) {
+        session.user.id = token.id as string
+      }
+      return session
+    },
   },
   providers: [], // Providers will be added in auth.ts
 } satisfies NextAuthConfig