Fix Builder MP

src/app/bills/[id]/page.tsx

@@ -42,7 +42,15 @@
 export default async function BillDetail({ params }: Params) {
   const { id } = await params;
 
-  const session = await getServerSession(authOptions);
+  // The session only gates the admin "Edit" link — a misconfigured auth setup
+  // (e.g. missing NEXTAUTH_SECRET, which throws in production) must not take
+  // down the public bill page.
+  let session = null;
+  try {
+    session = await getServerSession(authOptions);
+  } catch (error) {
+    console.error("Failed to resolve session for bill page:", error);
+  }
   const headerList = await headers();
   const host =
     headerList.get("x-forwarded-host") || headerList.get("host") || "";
@@ -161,7 +169,7 @@
     params: Promise<{ id: string }>;
     searchParams: Promise<{ q?: string }>;
   },
   _parent: ResolvingMetadata,
 ): Promise<Metadata> {
   const { id } = await params;
   const sp = await searchParams;

src/app/bills/lib/auth-guards.ts

@@ -26,7 +26,15 @@ export async function requireAuthenticatedUser() {
     return { session: null, dbUser: null };
   }
 
-  const session = await getServerSession(authOptions);
+  // Fail closed: if the session can't be resolved (e.g. missing
+  // NEXTAUTH_SECRET throws in production), treat the user as signed out
+  // instead of surfacing a 500.
+  let session = null;
+  try {
+    session = await getServerSession(authOptions);
+  } catch (error) {
+    console.error("Failed to resolve session in auth guard:", error);
+  }
 
   if (!session?.user?.email) {
     redirect(`${BASE_PATH}/unauthorized`);