Todo/auth.config.ts

import type { NextAuthConfig } from "next-auth"

export const authConfig = {
  trustHost: true,
  session: {
    strategy: "jwt",
    maxAge: 30 * 24 * 60 * 60, // 30 days in seconds
    updateAge: 24 * 60 * 60, // Update session every 24 hours
  },
  cookies: {
    sessionToken: {
      name: `${process.env.NODE_ENV === 'production' ? '__Secure-' : ''}next-auth.session-token`,
      options: {
        httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
        sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
        path: '/',
        secure: process.env.NODE_ENV === 'production', // Only send cookie over HTTPS in production
      },
    },
  },
  pages: {
    signIn: "/auth/login",
    signOut: "/auth/logout",
    error: "/auth/error",
  },
  callbacks: {
    authorized({ auth, request: { nextUrl } }) {
      const isLoggedIn = !!auth?.user
      
      // Define protected routes
      const isProtectedRoute = 
        nextUrl.pathname === "/" ||
        nextUrl.pathname.startsWith("/list") ||
        nextUrl.pathname.startsWith("/profile") ||
        nextUrl.pathname.startsWith("/invitations")
      
      // Define auth pages (login, register, etc.)
      const isAuthPage = nextUrl.pathname.startsWith("/auth")
      
      // Allow access to auth pages regardless of authentication status
      if (isAuthPage) {
        // If already logged in and trying to access login/register, redirect to home
        if (isLoggedIn && (nextUrl.pathname === "/auth/login" || nextUrl.pathname === "/auth/register")) {
          return Response.redirect(new URL("/", nextUrl))
        }
        return true
      }
      
      // Redirect to login if accessing protected route without authentication
      if (isProtectedRoute && !isLoggedIn) {
        return false // This will redirect to signIn page
      }
      
      // Allow access to public routes
      return true
    },
    async jwt({ token, user }) {
      // Add user ID to token on sign in
      if (user) {
        token.id = user.id
      }
      return token
    },
    async session({ session, token }) {
      // Add user ID to session from token
      if (session.user && token.id) {
        session.user.id = token.id as string
      }
      return session
    },
  },
  providers: [], // Providers will be added in auth.ts
} satisfies NextAuthConfig