Force Node.js runtime on all auth routes to fix fetch failures on Vercel

The auth callback and API routes were running on Edge runtime by default
in Next.js 16, causing "fetch failed" errors when @supabase/ssr tried to
reach the Supabase token endpoint. Explicitly setting runtime = 'nodejs'
ensures reliable network access for the PKCE code exchange and all auth
operations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: felmonon

src/app/api/auth/delete-account/route.ts

@@ -3,6 +3,8 @@ import { createServerClient } from '@/lib/supabase/server';
 import { createClient } from '@supabase/supabase-js';
 import { checkRateLimit } from '@/lib/rate-limit';
 
+export const runtime = 'nodejs';
+
 const DELETE_CONFIRMATION_TEXT = 'DELETE MY ACCOUNT';
 const RECENT_AUTH_WINDOW_MS = 15 * 60 * 1000;
 

src/app/api/auth/forgot-password/route.ts

@@ -3,6 +3,8 @@ import { createServerClient as createSSRServerClient } from '@supabase/ssr';
 import { checkRateLimit, AUTH_RATE_LIMITS } from '@/lib/rate-limit';
 import { getSiteUrlOrThrow } from '@/lib/site-url';
 
+export const runtime = 'nodejs';
+
 function getClientIP(request: NextRequest): string {
   return (
     request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??

src/app/api/auth/login/route.ts

@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from 'next/server';
 import { createServerClient as createSSRServerClient } from '@supabase/ssr';
 import { checkRateLimit, AUTH_RATE_LIMITS } from '@/lib/rate-limit';
 
+export const runtime = 'nodejs';
+
 function getClientIP(request: NextRequest): string {
   return (
     request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??

src/app/api/auth/magic-link/route.ts

@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from 'next/server';
 import { createServerClient as createSSRServerClient } from '@supabase/ssr';
 import { checkRateLimit, AUTH_RATE_LIMITS } from '@/lib/rate-limit';
 
+export const runtime = 'nodejs';
+
 function getClientIP(request: NextRequest): string {
   return (
     request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??

src/app/api/auth/signup/route.ts

@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from 'next/server';
 import { createServerClient as createSSRServerClient } from '@supabase/ssr';
 import { checkRateLimit, AUTH_RATE_LIMITS } from '@/lib/rate-limit';
 
+export const runtime = 'nodejs';
+
 function getClientIP(request: NextRequest): string {
   return (
     request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??

src/app/auth/callback/route.ts

@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from 'next/server';
 import { createServerClient } from '@supabase/ssr';
 import type { CookieOptions } from '@supabase/ssr';
 
+export const runtime = 'nodejs';
+
 /**
  * Validate the `next` param to prevent open-redirect attacks.
  * Only allows relative paths on the same origin.