authjs-implementation

activetype/docdomain/auth

TL;DR

Museum Ibu Marsinah auth file map (~/Project/lumendev-core). Reusable pattern: [[Resources/Tech/Auth.js/Auth.js Next.js JWT Google MongoDB adapter pattern]]. Operator detail: repo docs/utility/authentication.md, AGENTS.md.

Stack split

Layer	File	Role
Edge-safe config	`src/auth.config.ts`	Google, JWT/session callbacks (`id`, `role`), `trustHost` — no MongoDB
Full app auth	`src/auth.ts`	Adapter + Credentials provider, OAuth role sync
Middleware	`src/middleware.ts`	Selective public `/` vs `/admin`, `POST /api/bookings`

Unlike [[Projects/lumendev-invoice/context/authjs-implementation|Invoice]], the museum app does not lock the entire site — only admin and booking API.

Roles

ADMIN_EMAILS env → admin on sign-in (Google or credentials)
POST /api/auth/register → always user
JWT carries role for middleware (req.auth.user.role)

HTTP routes

Path	Implementation
Auth catch-all	`src/app/api/auth/[...nextauth]/route.ts`
Register	`src/app/api/auth/register/route.ts`
Sign-in UI	`src/app/sign-in/page.tsx`
Register UI	`src/app/daftar/page.tsx`
Admin stub	`src/app/admin/page.tsx`
Booking auth stub	`src/app/api/bookings/route.ts` — `POST` → 501 after `requireRole`

Guards

src/lib/requireSession.ts — requireSession(), requireRole(roles)
Middleware enforces /admin and POST /api/bookings before handlers run

MongoDB

Adapter client: src/lib/mongodb-auth.ts
App users: src/models/User.ts on users collection (role, passwordHash)
Mongoose app data: src/lib/mongodb.ts

Invoice map: [[Projects/lumendev-invoice/context/authjs-implementation]]
Changelog: [[Projects/lumendev-museum-ibu-marsinah/changelog/2026-05-21-auth-admin-user-roles]]