Remove Stack Auth from the old app: no sign-in, no handler, no dependency

[esthor]

_{Preview · Change Stack · Checks · Files: +21 −485 in 17 files}

What

Step 9 of the admin audit: the old Next app drops Stack Auth (Neon Auth). With the admin and profiles gone (#207), nothing needed a signed-in user.

• Removed:
  • StackProvider and StackTheme from app/src/app/layout.tsx. ThemeProvider and the toaster stay.
  • the getUser() calls: page-layout.tsx no longer reads a user, and components/auth-nav.tsx is deleted
  • app/src/app/handler/** (Stack's sign-in pages)
  • lib/stack.tsx, lib/auth/config.ts (and mainConfig.database.neonAuth), lib/client-user.ts and lib/users.ts
  • the @stackframe/stack dependency (bun remove; bun.lock loses 277 lines)
  • the three NEXT_PUBLIC_STACK_* / STACK_SECRET_SERVER_KEY lines in app/example.env
  • /handler from robots.ts
• The nav. The header keeps About us, Past speakers and the theme toggle. The Sign In button and the mobile Sign In/Sign Out entries are gone.
• Tests. robots.test.ts checks /api/cron. In the legacy-URL manifest, /handler/[...stack] now notes the old site answers 404.
• Unchanged:
  • app/src/lib/cutover/redirect.ts sends /handler/* to allthings.dev, where the Worker answers 410 (Answer sign-in, profile and admin paths with 410 Gone on the Worker #194).
  • The schema still names neon_auth.users_sync and the tables that reference it: dropping them would be a migration, and none is part of this.

Env vars. This PR doesn't touch the Vercel env. Once it is deployed, nothing reads NEXT_PUBLIC_STACK_PROJECT_ID, NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY or STACK_SECRET_SERVER_KEY, and better-env validate no longer requires them.

Why

Erik: remove the old admin and its sign-in now. They're dead weight while we refactor.

Verify

cd app && bun run typecheck && bun test   # 161 pass
cd web && bun test tests/legacy-urls.test.ts tests/cutover.test.ts tests/short-slugs.test.ts   # 108 pass

On the Vercel preview: the public pages render as before, with no Sign In button, and /handler/sign-in answers 404.

Summary by CodeRabbit

• Changes
  • Sign-in and sign-out links and authentication controls have been removed from the app’s navigation.
  • Authentication pages are no longer available and return a 404 error.
  • The app no longer requires Neon Auth credentials in its example environment configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: allthingsweb-dev/allthingsweb/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0d3d9549-2ed7-431d-bbab-4b437c4a6f57

📥 Commits

Reviewing files that changed from the base of the PR and between 2d48d48 and 4298837.

⛔ Files ignored due to path filters (1)

• app/bun.lock is excluded by !**/*.lock

📒 Files selected for processing (16)

• app/example.env
• app/package.json
• app/src/app/handler/[...stack]/page.tsx
• app/src/app/handler/loading.tsx
• app/src/app/layout.tsx
• app/src/components/auth-nav.tsx
• app/src/components/page-layout.tsx
• app/src/components/top-nav.tsx
• app/src/lib/auth/config.ts
• app/src/lib/client-user.ts
• app/src/lib/config.ts
• app/src/lib/robots.ts
• app/src/lib/stack.tsx
• app/src/lib/users.ts
• app/tests/robots.test.ts
• web/tests/support/legacy-urls.ts

💤 Files with no reviewable changes (11)

• app/src/lib/client-user.ts
• app/src/lib/auth/config.ts
• app/src/app/handler/[...stack]/page.tsx
• app/src/lib/users.ts
• app/src/lib/robots.ts
• app/src/app/handler/loading.tsx
• app/src/lib/stack.tsx
• app/example.env
• app/package.json
• app/src/lib/config.ts
• app/src/components/auth-nav.tsx

Limit details: You’ve used the included review currently available. Your 112 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: 🚀 Deploy
• GitHub Check: 🌐 Web
• GitHub Check: 🧱 Core

---

📝 Walkthrough

Walkthrough

The app removes Stack Auth configuration, runtime integration, user helpers, authentication navigation controls, and handler routes. The robots test and legacy URL catalog are updated for the removed routes.

Changes

Stack Auth removal

Layer / File(s)	Summary
Remove Stack Auth configuration and helpers app/example.env, app/package.json, app/src/lib/auth/config.ts, app/src/lib/stack.tsx, app/src/lib/client-user.ts, app/src/lib/users.ts, app/src/lib/config.ts	The Stack Auth dependency, environment configuration, server app, client-user conversion, and user lookup helpers are removed. mainConfig.database no longer includes neonAuth.
Remove provider and navigation authentication UI app/src/app/layout.tsx, app/src/components/auth-nav.tsx, app/src/components/page-layout.tsx, app/src/components/top-nav.tsx	The root layout no longer wraps content in Stack providers. Page layout and navigation no longer fetch or render sign-in and sign-out controls.
Remove handler routes and update checks app/src/app/handler/..., app/src/lib/robots.ts, app/tests/robots.test.ts, web/tests/support/legacy-urls.ts	The Stack handler page and loading component are removed. /handler is removed from the robots disallow paths, and the URL catalog expects 404 responses for the handler and sign-in routes.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 42988

The old app no longer offers sign-in, as intended. No actionable issue remains in the supplied evidence; the PR is mergeable after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 42988

The inspected changes remove sign-in functionality and user-aware navigation, not access checks protecting surviving pages. The operational cron endpoint retains independent authorization. No introduced security issue was established, but deployed credential and identity-provider retirement remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The inspected runtime change is confined to removing the legacy app's Stack integration and authentication presentation. The web change updates a test catalog, not Worker runtime authority or routing.

Security Findings and Attack Paths

• inferred — The inspected removal does not establish an authorization-bypass path: the deleted identity checks selected navigation controls rather than guarding page content or privileged operations. This conclusion is limited to the traced consumers and controls.

Trust Boundaries and Controls

• observed — The state-changing cron endpoint independently requires its configured bearer secret. Missing configuration returns 500 and invalid credentials return 401 before synchronization begins. This control is unchanged from the PR base and does not depend on Stack authentication.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the primary change: removing Stack Auth, sign-in functionality, the handler, and its dependency from the old app.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 5
• Charged: $1.25
• View usage details

Note

This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. View usage-based billing.

---

_{Comment @coderabbitai help to get the list of available commands.}