fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)

* test(next-auth): use Reflect.deleteProperty to satisfy no-dynamic-delete lint

* test(next-auth): repair v4 test suite (dependency drift)

The v4 test suite had been red since ~Oct 2025 due to dependency drift.
Three independent root causes, all unrelated to test logic:

- Pin headers-polyfill to 3.0.4 via pnpm override. @mswjs/interceptors@0.16.6
  does `require("headers-polyfill/lib")`, but headers-polyfill >=3.1.x ships an
  `exports` map that blocks the deep import, breaking all 7 client suites.
- Compile the core jest project's JSX with Preact's automatic runtime
  (swc.preact.config.js). The default pages are Preact components rendered by
  `preact-render-to-string`; the React runtime emitted React elements that
  render to an empty body, failing assert.test.ts.
- Mock `../src/core` instead of `jest.spyOn(core, "AuthHandler")` in
  getServerSession.test.ts. SWC compiles named exports to non-configurable
  getters, so spyOn threw "Cannot redefine property".

Also update the stale "Send e-mail to first address only" email test to assert
that an address list with multiple `@` symbols is now rejected, matching the
hardened normalizer.

Author: Bekacru

package.json

@@ -63,7 +63,8 @@
   "packageManager": "pnpm@7.13.3",
   "pnpm": {
     "overrides": {
-      "undici": "5.11.0"
+      "undici": "5.11.0",
+      "headers-polyfill": "3.0.4"
     }
   }
 }

packages/next-auth/config/jest.config.js

@@ -1,4 +1,9 @@
 const swcConfig = require("./swc.config")
+// The default server pages are Preact components rendered with
+// `preact-render-to-string`. Their JSX must be compiled with Preact's
+// automatic runtime; the React runtime produces React elements that
+// `preact-render-to-string` renders as an empty body.
+const swcPreactConfig = require("./swc.preact.config")
 
 /** @type {import('jest').Config} */
 module.exports = {
@@ -8,7 +13,7 @@ module.exports = {
       testMatch: ["<rootDir>/tests/**/*.test.ts"],
       rootDir: ".",
       transform: {
-        "\\.(js|jsx|ts|tsx)$": ["@swc/jest", swcConfig],
+        "\\.(js|jsx|ts|tsx)$": ["@swc/jest", swcPreactConfig],
       },
       coveragePathIgnorePatterns: ["tests"],
       testEnvironment: "@edge-runtime/jest-environment",

packages/next-auth/config/swc.preact.config.js

@@ -0,0 +1,9 @@
+/** @type {import("@swc/core").Config} */
+module.exports = {
+  jsc: {
+    parser: { syntax: "typescript", tsx: true },
+    transform: {
+      react: { runtime: "automatic", importSource: "preact" },
+    },
+  },
+}

packages/next-auth/tests/detect-origin.test.ts

@@ -15,13 +15,13 @@ describe("detectOrigin", () => {
   beforeEach(() => {
     for (const key of ENV_KEYS) {
       saved[key] = process.env[key]
-      delete process.env[key]
+      Reflect.deleteProperty(process.env, key)
     }
   })
 
   afterEach(() => {
     for (const key of ENV_KEYS) {
-      if (saved[key] === undefined) delete process.env[key]
+      if (saved[key] === undefined) Reflect.deleteProperty(process.env, key)
       else process.env[key] = saved[key]
     }
   })

packages/next-auth/tests/email.test.ts

@@ -40,13 +40,15 @@ it("Send e-mail to the only address correctly", async () => {
   )
 })
 
-it("Send e-mail to first address only", async () => {
+it("Reject an address list containing multiple `@` symbols", async () => {
   const { secret, csrf } = await createCSRF()
   const sendVerificationRequest = jest.fn()
   const signIn = jest.fn(() => true)
 
-  const firstEmail = "email@email.com"
-  const email = `${firstEmail},email@email2.com`
+  // Two real `@` symbols (one per address) must be rejected rather than
+  // silently delivering the magic link to the first address, which would let
+  // an attacker smuggle a second recipient past the single-`@` check.
+  const email = "email@email.com,email@email2.com"
   const { res } = await handler(
     {
       adapter: mockAdapter(),
@@ -64,19 +66,10 @@ it("Send e-mail to first address only", async () => {
     }
   )
 
+  expect(signIn).toBeCalledTimes(0)
+  expect(sendVerificationRequest).toBeCalledTimes(0)
   expect(res.redirect).toBe(
-    "http://localhost:3000/api/auth/verify-request?provider=email&type=email"
-  )
-
-  expect(signIn).toBeCalledTimes(1)
-  expect(signIn).toHaveBeenCalledWith(
-    expect.objectContaining({
-      user: expect.objectContaining({ email: firstEmail }),
-    })
-  )
-
-  expect(sendVerificationRequest).toHaveBeenCalledWith(
-    expect.objectContaining({ identifier: firstEmail })
+    "http://localhost:3000/api/auth/error?error=EmailSignin"
   )
 })
 

packages/next-auth/tests/getServerSession.test.ts

@@ -3,6 +3,18 @@ import { MissingSecret } from "../src/core/errors"
 import { getServerSession } from "../src/next"
 import { mockLogger } from "./lib"
 
+// `AuthHandler` is compiled to a non-configurable CommonJS export, so it cannot
+// be replaced with `jest.spyOn`. Mock the module instead, defaulting to the
+// real implementation so unrelated tests in this file are unaffected.
+jest.mock("../src/core", () => {
+  const actual = jest.requireActual("../src/core")
+  return {
+    __esModule: true,
+    ...actual,
+    AuthHandler: jest.fn(actual.AuthHandler),
+  }
+})
+
 const originalWarn = console.warn
 let logger = mockLogger()
 
@@ -61,13 +73,13 @@ describe("Treat secret correctly", () => {
 
 describe("Return correct data", () => {
   afterEach(() => {
-    jest.restoreAllMocks()
+    const actual = jest.requireActual("../src/core")
+    ;(core.AuthHandler as jest.Mock).mockImplementation(actual.AuthHandler)
   })
 
   it("Should return null if there is no session", async () => {
-    const spy = jest.spyOn(core, "AuthHandler")
     // @ts-expect-error
-    spy.mockReturnValue({ body: {} })
+    ;(core.AuthHandler as jest.Mock).mockReturnValue({ body: {} })
 
     const session = await getServerSession(req, res, {
       providers: [],
@@ -91,9 +103,8 @@ describe("Return correct data", () => {
       },
     }
 
-    const spy = jest.spyOn(core, "AuthHandler")
     // @ts-expect-error
-    spy.mockReturnValue(mockedResponse)
+    ;(core.AuthHandler as jest.Mock).mockReturnValue(mockedResponse)
 
     const session = await getServerSession(req, res, {
       providers: [],