Exercise 1: Setting Up the Credentials Provider — Possible Solution
====================================================================

CONFIGURATION
------------------------------
// auth.config.ts
import { defineConfig } from 'auth-astro';
import Credentials from '@auth/core/providers/credentials';
import bcrypt from 'bcryptjs';
import { db } from './db/client';
import { adminUsers } from './db/schema';
import { eq } from 'drizzle-orm';

export default defineConfig({
  providers: [
    Credentials({
      credentials: {
        email: { label: 'Email' },
        password: { label: 'Password', type: 'password' },
      },
      async authorize(credentials) {
        const [user] = await db.select().from(adminUsers).where(eq(adminUsers.email, credentials.email));
        if (!user) return null;

        const valid = await bcrypt.compare(credentials.password, user.passwordHash);
        return valid ? { id: user.id, email: user.email } : null;
      },
    }),
  ],
});

CONFIRMATION
------------------------------
Submitting the real admin email with the correct password causes
authorize() to find the matching adminUsers row, bcrypt.compare()
returns true, and a real user object is returned - a session is
established. Submitting the same email with any incorrect password
causes bcrypt.compare() to return false, authorize() returns null,
and the login attempt fails with no session created.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly configures the Credentials provider's own authorize()
callback, and correctly traces both the success and failure paths
through bcrypt.compare()'s own return value.