Merge commit from fork
getSession() calls @auth/core, which returns a 500 with a JSON body of
{ message: "There was a problem with the server configuration..." } when
the provider configuration is invalid (e.g. a provider missing both
`issuer` and `authorization` endpoints). The next-auth wrappers read that
body with .json() without checking the response status, so the error object
was assigned to req.auth. Truthiness checks such as `!!auth` / `if (!req.auth)`
- the pattern shown in the docs - then evaluated as authenticated for every
request, failing open and exposing protected routes during a misconfiguration.
Parse the session response through a helper that returns null on any non-OK
response, so all auth() entry points (RSC, middleware inline/wrapper, API
routes) fail closed. Add a regression test reproducing the InvalidEndpoints
misconfiguration.
Fixes GHSA-8fpg-xm3f-6cx3
