fix(auth): never set AUTH_URL to empty, and catch the case that broke

[kunjhirapara]

Production reported "auth": true while every Auth.js route returned 500. Both halves of that were mine.

The empty string

AUTH_URL: ${AUTH_URL:-} was the obvious way to make the variable optional in compose. It sets it to the empty string — a set variable — which is strictly worse than an absent one, in two ways at once:

1. It shadows the default the Dockerfile bakes in from NEXT_PUBLIC_APP_URL.
2. It stops @auth/core's trust-host expression at the first term:

config.trustHost ??= !!(envObject.AUTH_URL ?? envObject.AUTH_TRUST_HOST ?? envObject.VERCEL ?? ...)

?? falls through only on null/undefined. "" stops the chain, and !!"" is false. With trustHost: false, assertConfig returns UntrustedHost for every request — rendered to the user as "There was a problem with the server configuration", which is indistinguishable from a missing secret. That is exactly where the debugging went.

It now defaults to NEXT_PUBLIC_APP_URL, so it stays overridable without ever being blank.

The check that should have caught it

getAuthReadiness said the deployment was fine. A green light that is wrong is worse than no light — it teaches people to stop looking at it. It now encodes both faults it missed:

Trusted host. It mirrors the trustHost expression including the ?? semantics, and distinguishes "AUTH_URL is set but empty" from "AUTH_URL is not set". The first is not something anyone guesses while debugging, so the message has to say it.

Half-configured OAuth providers. The previous version deliberately ignored the OAuth credentials, reasoning that a deployment with no Google app still supports credentials and magic-link sign-in. That is true only when the provider is absent entirely. An id without its secret makes Auth.js throw while building the provider list, which takes down every sign-in method — including the ones that need no provider at all. So id XOR secret is now fatal, while neither remains fine.

missing becomes problems, since these are diagnoses rather than a list of absent names. Still names and sentences only, never values — /api/health is public.

Verification

• 269/269 tests pass (13 new, covering both failure modes and the empty-vs-absent distinction), tsc --noEmit clean, production build green.
• docker-compose.yml parses; AUTH_URL resolves to ${AUTH_URL:-$NEXT_PUBLIC_APP_URL}.

Deploying

The compose change has to reach the VM — this is a docker-compose.yml fix, so a new image alone will not carry it. After redeploy, /api/auth/providers returning the provider list instead of 500 is the confirmation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.