Scaffold Next.js 16 app + wire NextAuth Credentials to auth core

Minimal but real App Router app that builds (next build exit 0):
- src/lib/auth.ts: NextAuth v5 Credentials provider calling checkLogin()
  (argon2id/bcrypt + md5->argon2id upgrade gated by CONVERT_PASSWORDS), JWT
  session, /api/auth/[...nextauth] route handler.
- src/app: root layout, home (force-dynamic, reads hotel_name via siteSettings),
  /login client form (signIn).
- next.config.ts: pinned turbopack.root, serverExternalPackages for the Prisma
  MariaDB adapter; tsconfig set up for Next.

Routes: / (dynamic), /login, /api/auth. Verified: next build exit 0, 28 tests.
Still needs DB+APP_KEY to run auth end-to-end. i18n/middleware/pages to follow.

.gitignore

@@ -1,5 +1,7 @@
 node_modules/
 .turbo/
+.next/
+next-env.d.ts
 .env
 *.tsbuildinfo
 # Prisma client is generated by `prisma generate`

next.config.ts

@@ -0,0 +1,12 @@
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {
+  // This app lives inside the Laravel repo tree (which has its own lockfiles);
+  // pin the Turbopack root so Next doesn't infer a parent directory.
+  turbopack: { root: import.meta.dirname },
+  // Prisma + the MariaDB driver adapter are native/server-only — keep them out
+  // of the bundle (same approach as the habbo-next reference).
+  serverExternalPackages: ["@prisma/adapter-mariadb", "mariadb", "@prisma/client"],
+};
+
+export default nextConfig;

package.json

@@ -5,6 +5,9 @@
   "engines": { "node": ">=22" },
   "packageManager": "[email protected]",
   "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
     "prisma:generate": "prisma generate",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
@@ -16,11 +19,17 @@
     "@prisma/client": "^7.8.0",
     "bcryptjs": "^3.0.2",
     "hash-wasm": "^4.12.0",
+    "next": "^16.2.9",
+    "next-auth": "5.0.0-beta.31",
     "otplib": "^12.0.1",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "zod": "^3.24.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
     "dotenv": "^16.4.0",
     "prisma": "^7.8.0",
     "tsx": "^4.19.0",

src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from "@/lib/auth";
+
+export const { GET, POST } = handlers;

src/app/layout.tsx

@@ -0,0 +1,15 @@
+import type { Metadata } from "next";
+import type { ReactNode } from "react";
+
+export const metadata: Metadata = {
+  title: "AtomCMS",
+  description: "AtomCMS — retro hotel CMS (Next.js conversion)",
+};
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

src/app/login/page.tsx

@@ -0,0 +1,49 @@
+"use client";
+
+import { signIn } from "next-auth/react";
+import { type FormEvent, useState } from "react";
+
+export default function LoginPage() {
+  const [username, setUsername] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState(false);
+
+  async function onSubmit(e: FormEvent) {
+    e.preventDefault();
+    setError(null);
+    setPending(true);
+    const res = await signIn("credentials", { username, password, redirect: false });
+    setPending(false);
+    if (!res || res.error) {
+      setError("Invalid username or password");
+      return;
+    }
+    window.location.href = "/";
+  }
+
+  return (
+    <main style={{ fontFamily: "system-ui", padding: "2rem", maxWidth: 360 }}>
+      <h1>Login</h1>
+      <form onSubmit={onSubmit} style={{ display: "grid", gap: "0.5rem" }}>
+        <input
+          value={username}
+          onChange={(e) => setUsername(e.target.value)}
+          placeholder="Username"
+          autoComplete="username"
+        />
+        <input
+          type="password"
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+          placeholder="Password"
+          autoComplete="current-password"
+        />
+        <button type="submit" disabled={pending}>
+          {pending ? "Signing in…" : "Sign in"}
+        </button>
+      </form>
+      {error && <p style={{ color: "crimson" }}>{error}</p>}
+    </main>
+  );
+}

src/app/page.tsx

@@ -0,0 +1,17 @@
+import Link from "next/link";
+import { siteSettings } from "@/lib/services/site-settings";
+
+// Reads settings from the DB at request time — never at build.
+export const dynamic = "force-dynamic";
+
+export default async function HomePage() {
+  const hotelName = (await siteSettings.get("hotel_name", "Atom")) ?? "Atom";
+
+  return (
+    <main style={{ fontFamily: "system-ui", padding: "2rem", maxWidth: 640 }}>
+      <h1>Welcome to {hotelName}</h1>
+      <p>AtomCMS → Next.js conversion. Foundation, full Prisma schema and auth core are in place.</p>
+      <Link href="/login">Login →</Link>
+    </main>
+  );
+}

src/env.ts

@@ -9,6 +9,13 @@ const schema = z.object({
   DATABASE_POOL_SIZE: z.coerce.number().int().positive().default(40),
   DATABASE_IDLE_TIMEOUT_MS: z.coerce.number().int().positive().default(300_000),
   HOTEL_NAME: z.string().default("Atom"),
+  // NextAuth v5 reads AUTH_SECRET itself; declared here for documentation/typing.
+  AUTH_SECRET: z.string().min(1).optional(),
+  // Mirrors Laravel config('habbo.site.convert_passwords') — enables md5->argon2id.
+  CONVERT_PASSWORDS: z
+    .string()
+    .optional()
+    .transform((v) => v === "true" || v === "1"),
 });
 
 type Env = z.infer<typeof schema>;

src/lib/auth.ts

@@ -0,0 +1,49 @@
+import NextAuth from "next-auth";
+import Credentials from "next-auth/providers/credentials";
+import { checkLogin } from "@/lib/auth/password";
+import { prisma } from "@/lib/prisma";
+import { env } from "@/env";
+
+export const { handlers, signIn, signOut, auth } = NextAuth({
+  trustHost: true,
+  session: { strategy: "jwt", maxAge: 24 * 60 * 60 },
+  pages: { signIn: "/login" },
+  providers: [
+    Credentials({
+      credentials: {
+        username: { label: "Username", type: "text" },
+        password: { label: "Password", type: "password" },
+      },
+      authorize: async (credentials) => {
+        const username = String(credentials?.username ?? "").trim();
+        const password = String(credentials?.password ?? "");
+        if (!username || !password) return null;
+
+        const user = await prisma.user.findUnique({ where: { username } });
+        if (!user) return null;
+
+        // Byte-compatible AtomCMS check (argon2id/bcrypt + md5->argon2id upgrade).
+        const res = await checkLogin(password, user.password, {
+          convertPasswords: env.CONVERT_PASSWORDS,
+        });
+        if (!res.valid) return null;
+
+        if (res.upgradedHash) {
+          await prisma.user.update({
+            where: { id: user.id },
+            data: { password: res.upgradedHash },
+          });
+        }
+
+        return { id: String(user.id), name: user.username };
+      },
+    }),
+  ],
+  callbacks: {
+    // NextAuth stores the user id in token.sub automatically; surface it on the session.
+    session({ session, token }) {
+      if (token.sub && session.user) session.user.id = token.sub;
+      return session;
+    },
+  },
+});

src/types/next-auth.d.ts

@@ -0,0 +1,7 @@
+import type { DefaultSession } from "next-auth";
+
+declare module "next-auth" {
+  interface Session {
+    user: { id: string } & DefaultSession["user"];
+  }
+}

tsconfig.json

@@ -1,20 +1,42 @@
 {
   "compilerOptions": {
     "target": "ES2022",
-    "lib": ["ES2022"],
+    "lib": [
-    "module": "ESNext",
+      "dom",
-    "moduleResolution": "Bundler",
+      "dom.iterable",
+      "esnext"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
     "strict": true,
-    "noUncheckedIndexedAccess": true,
     "noEmit": true,
     "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "skipLibCheck": true,
+    "jsx": "react-jsx",
-    "types": ["node"],
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
     "baseUrl": ".",
-    "paths": { "@/*": ["./src/*"] }
+    "paths": {
+      "@/*": [
+        "./src/*"
+      ]
+    }
   },
-  "include": ["src", "scripts", "prisma.config.ts", "vitest.config.ts"],
+  "include": [
-  "exclude": ["node_modules"]
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
 }