chore(auth): route callback diagnostics to Vercel logs, drop auth_debug cookie

[tran-christian]

Summary

Follow-up cleanup for the OAuth session-cookie saga. Now that #841 has proven the pipeline end-to-end, the browser-side auth_debug cookie from #840 is no longer earning its keep. Replacing it with server-side error logs that land in Vercel's runtime log viewer: zero client footprint, no leaked deployment details to analytics/session-replay scripts, and full context when things actually go wrong.

What changed

next.config.js

removeConsole in prod now uses { exclude: ['error'] } instead of stripping everything.

// before
removeConsole: process.env.NODE_ENV === 'production' && process.env.DEBUG_AUTH !== '1'

// after
removeConsole:
  process.env.NODE_ENV === 'production' && process.env.DEBUG_AUTH !== '1'
    ? { exclude: ['error'] }
    : false

console.log/warn/info/debug are still stripped. console.error survives — so real errors from anywhere in the app reach Vercel's runtime logs. DEBUG_AUTH=1 continues to disable stripping entirely for local pnpm build && pnpm start auth-flow repro.

app/auth/callback/route.ts

• Shared diag object captures the same fields the auth_debug cookie carried (forwardedHost, pendingCookieCount, pendingCookieNames, requestCookieNames, publishableKeyPrefix, origin) plus SDK-side signals (hasSession, hasUser).
• Every abnormal branch logs [auth/callback] reason=<branch> with diag via console.error:
  • exchange_failed — adds SDK message + status
  • no_session
  • no_pending_cookies
• no_code is not logged — crawler/direct-URL hits, would be noise.
• auth_debug cookie + debugPayload construction removed from the success path.
• DEBUG_AUTH-gated console.log block removed — its content was a subset of diag and only fires now when something is actually wrong, which is when you'd want it anyway.
• oauth_error removed from failureRedirect's reason union — it was never passed (the GoTrue error path uses a different redirect).

What you'll see in Vercel's log viewer on a future failing sign-in

[auth/callback] reason=no_pending_cookies {
  hasSession: true,
  hasUser: true,
  pendingCookieCount: 0,
  pendingCookieNames: [],
  requestCookieNames: [ 'sb-ilwqylsdqacxmfkisclx-auth-token-code-verifier' ],
  publishableKeyPrefix: 'sb_publishable_aBcDeF',
  forwardedHost: 'www.omshub.org',
  origin: 'https://some-internal-vercel-lb.vercel.app'
}

Successful sign-ins log nothing. Clean and silent.

Non-goals

• Does not change any success-path behavior — cookies still stamped with Domain=omshub.org (from fix(auth): scope session cookies to registrable domain + diagnostic reasons #840), still redirected via x-forwarded-host (from fix(auth): restore canonical Supabase SSR pattern with x-forwarded-host #835).
• Does not touch AuthErrorNotification, page.tsx, or the reason= URL params — those stay useful and visible to the end user.

Test plan

• CI green
• Preview sign-in on Google still works (expect no ?error=, welcome toast, session cookies on Domain=<preview-host>)
• Preview DevTools → Cookies: no auth_debug cookie present anymore
• Force a failure (e.g., navigate to /auth/callback?code=bogus on the preview) → URL gets ?reason=exchange_failed&message=…, Vercel log viewer shows one [auth/callback] reason=exchange_failed {…} error line

Rollback

Revert this commit. No schema, env, or API changes.

Related

• fix(auth): resolve PKCE code_verifier loss during Google OAuth flow #830, fix(auth): stamp session cookies onto redirect response after OAuth/magic link exchange #832, fix(auth): stamp session cookies onto redirect response after OAuth exchange #833, fix(auth): restore canonical Supabase SSR pattern with x-forwarded-host #835 — prior callback fixes (all needed, all still in place)
• fix(auth): scope session cookies to registrable domain + diagnostic reasons #840 — diagnostic patch that made this bug legible (reason= params kept, auth_debug cookie retired here)
• chore(deps): bump @supabase/ssr to ^0.10.2 + supabase-js to ^2.104.0 #841 — @supabase/ssr upgrade, the actual root-cause fix

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
website	Ready	Preview, Comment	Apr 22, 2026 3:35am

[supabase]

This pull request has been ignored for the connected project ilwqylsdqacxmfkisclx because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.