feat(provider): add Zoom provider (#2110)

* feat(provider): add Zoom provider

* Update src/providers/zoom.js

Co-authored-by: Balázs Orbán <info@balazsorban.com>

* Update src/providers/zoom.js

Co-authored-by: Balázs Orbán <info@balazsorban.com>

* Update www/docs/providers/zoom.md

Co-authored-by: Balázs Orbán <info@balazsorban.com>

* fix: syntax error

* Update www/docs/providers/zoom.md

Co-authored-by: Balázs Orbán <info@balazsorban.com>

* Update www/docs/providers/zoom.md

Co-authored-by: Balázs Orbán <info@balazsorban.com>

* Update www/docs/providers/zoom.md

Co-authored-by: Balázs Orbán <info@balazsorban.com>

* remove the default protection setting of Zoom for now

Co-authored-by: Balázs Orbán <info@balazsorban.com>

.github/workflows/build.yml

@@ -1,32 +0,0 @@
-# Simple check that the build is valid and no linting errors.
-# Currently is run as a seperate workflow as it's fast to fail.
-name: Lint/Build
-
-on:
-  push:
-    branches:
-      - main
-      - beta
-      - next
-  pull_request:
-    branches:
-      - main
-      - beta
-      - next
-
-jobs:
-  lint-and-build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [12, 14, 16]
-    steps:
-      - uses: actions/checkout@v2
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
-        with:
-          node-version: ${{ matrix.node-version }}
-      - name: Install dependencies
-        uses: bahmutov/npm-install@v1
-      - run: npm run lint
-      - run: npm run build

.github/workflows/codeql-analysis.yml

@@ -1,67 +1,27 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
+name: Code Analysis
 
 on:
   push:
-    branches: [ main, beta, next ]
+    branches: [main, beta, next]
   pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ main ]
+    branches: [main]
   schedule:
-    - cron: '43 17 * * 2'
+    - cron: "43 17 * * 2"
 
 jobs:
   analyze:
-    name: Analyze
+    name: Verify
     runs-on: ubuntu-latest
-
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'javascript' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
-
+        language: ["javascript"]
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: ${{ matrix.language }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1

.github/workflows/integration.yml

@@ -1,57 +0,0 @@
-name: Integration Test
-
-on:
-  push:
-    branches:
-      - main
-      - beta
-      - next
-  pull_request:
-
-jobs:
-  test:
-    # Only run tests integration against Pull Requests from branches in
-    # this repository. We do this as integration tests require access to
-    # secrets in GitHub and they are not exposed to tests run against
-    # forks (for security reasons), so integration test against
-    # Pull Requests from external repos just fail and generate noise.
-    if: github.event.pull_request.head.repo.full_name == github.repository
-
-    # We use self-hosted runners as cloud based runnners (e.g. AWS, GPC)
-    # fail due to IP Address checks done by providers, which enforce
-    # CAPTCHA checks on login request from cloud compute IP addresses to
-    # prevent abuse.
-    runs-on: self-hosted
-
-    # Target time is under 5 minutes to run all tests. If it takes longer than
-    # 10 minutes should look at running tests in parallel. No individual flow
-    # should take longer than 5 minutes to build and run.
-    timeout-minutes: 10
-
-    strategy:
-      matrix:
-        node-version: [12, 14, 16]
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
-        with:
-          node-version: ${{ matrix.node-version }}
-
-      - name: Install dependencies
-        uses: bahmutov/npm-install@v1
-
-      # Run tests (build library, build + start test app in Docker, run tests)
-      - run: npm test
-        # TODO Tests should exit out if env vars not set (currently hangs)
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-          NEXTAUTH_TWITTER_ID: ${{secrets.NEXTAUTH_TWITTER_ID}}
-          NEXTAUTH_TWITTER_SECRET: ${{secrets.NEXTAUTH_TWITTER_SECRET}}
-          NEXTAUTH_TWITTER_USERNAME: ${{secrets.NEXTAUTH_TWITTER_USERNAME}}
-          NEXTAUTH_TWITTER_PASSWORD: ${{secrets.NEXTAUTH_TWITTER_PASSWORD}}
-          NEXTAUTH_GITHUB_ID: ${{secrets.NEXTAUTH_GITHUB_ID}}
-          NEXTAUTH_GITHUB_SECRET: ${{secrets.NEXTAUTH_GITHUB_SECRET}}
-          NEXTAUTH_GITHUB_USERNAME: ${{secrets.NEXTAUTH_GITHUB_USERNAME}}
-          NEXTAUTH_GITHUB_PASSWORD: ${{secrets.NEXTAUTH_GITHUB_PASSWORD}}

.github/workflows/labeler.yml

@@ -1,11 +1,13 @@
-name: "Pull Request Labeler"
+name: PR Labeler
+
 on:
-- pull_request_target
+  - pull_request_target
 
 jobs:
   triage:
+    name: Triage
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@main
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+      - uses: actions/labeler@main
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/release.yml

@@ -1,4 +1,5 @@
-name: Release
+name: Release Flow
+
 on:
   push:
     branches:
@@ -7,20 +8,35 @@ on:
       - "next"
       - "3.x"
   pull_request:
+
 jobs:
-  release:
-    name: "Release"
+  test:
+    name: Tests
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Init
         uses: actions/checkout@v2
-      - name: Setup Node.js
+      - name: Setup Node
         uses: actions/setup-node@v1
-        with:
-          node-version: 14
-      - name: Install dependencies
+      - name: Dependencies
         uses: bahmutov/npm-install@v1
-      - run: npx semantic-release@17
+      - name: Run tests
+        run: npm test
+      - name: Build
+        run: npm run build
+  release:
+    name: Release
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Init
+        uses: actions/checkout@v2
+      - name: Setup Node
+        uses: actions/setup-node@v1
+      - name: Dependencies
+        uses: bahmutov/npm-install@v1
+      - name: Release
+        run: npx semantic-release@17
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
           NPM_TOKEN: ${{secrets.NPM_TOKEN}}

.github/workflows/types.yml

@@ -1,27 +0,0 @@
-name: Types
-
-on:
-  push:
-    branches:
-      - main
-      - beta
-      - next
-  pull_request:
-    branches:
-      - main
-      - beta
-      - next
-
-jobs:
-  lint-and-build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Use Node.js
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14
-      - name: Install dependencies
-        uses: bahmutov/npm-install@v1
-      - name: Check types
-        run: npm run test:types

.husky/.gitignore

@@ -0,0 +1 @@
+_

.husky/pre-commit

@@ -0,0 +1,4 @@
+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+
+npx pretty-quick --staged

README.md

@@ -7,11 +7,8 @@
    Open Source. Full Stack. Own Your Data.
    </p>
    <p align="center" style="align: center;">
-      <a href="https://github.com/nextauthjs/next-auth/actions?query=workflow%3ARelease">
-        <img src="https://github.com/nextauthjs/next-auth/workflows/Release/badge.svg" alt="Release" />
-      </a>
-      <a href="https://github.com/nextauthjs/next-auth/actions?query=workflow%3A%22Integration+Test%22">
-        <img src="https://github.com/nextauthjs/next-auth/workflows/Integration%20Test/badge.svg" alt="Integration Test" />
+      <a href="https://github.com/nextauthjs/next-auth/actions/workflows/release.yml?query=workflow%3ARelease">
+        <img src="https://github.com/nextauthjs/next-auth/actions/workflows/release.yml/badge.svg" alt="Release" />
       </a>
       <a href="https://bundlephobia.com/result?p=next-auth">
         <img src="https://img.shields.io/bundlephobia/minzip/next-auth" alt="Bundle Size"/>

app/.env.local.example

@@ -4,7 +4,7 @@
 NEXTAUTH_URL=http://localhost:3000
 
 # You can use `openssl rand -hex 32` or 
-# https://generate-secret.now.sh/32 to generate a secret.
+# https://generate-secret.vercel.app/32 to generate a secret.
 # Note: Changing a secret may invalidate existing sessions
 # and/or verificaion tokens.
 SECRET= 

app/pages/api/examples/jwt.js

@@ -4,6 +4,6 @@ import jwt from 'next-auth/jwt'
 const secret = process.env.SECRET
 
 export default async (req, res) => {
-  const token = await jwt.getToken({ req, secret })
+  const token = await jwt.getToken({ req, secret, encryption: true })
   res.send(JSON.stringify(token, null, 2))
 }

config/babel.config.js

@@ -18,5 +18,16 @@ module.exports = {
       test: ["../src/server/pages/**"],
       presets: ["preact"],
     },
+    {
+      test: ["../src/**/*.test.js"],
+      presets: [
+        [
+          "@babel/preset-react",
+          {
+            runtime: "automatic",
+          },
+        ],
+      ],
+    },
   ],
 }

config/jest-setup.js

@@ -0,0 +1,2 @@
+import "@testing-library/jest-dom"
+import "whatwg-fetch"

config/jest.config.js

@@ -0,0 +1,8 @@
+module.exports = {
+  transform: {
+    "\\.js$": ["babel-jest", { configFile: "./config/babel.config.js" }],
+  },
+  roots: ["../src"],
+  setupFilesAfterEnv: ["./jest-setup.js"],
+  testMatch: ["**/*.test.js"],
+}

package.json

@@ -37,7 +37,8 @@
     "watch": "npm run watch:js | npm run watch:css",
     "watch:js": "babel --config-file ./config/babel.config.js --watch src --out-dir dist",
     "watch:css": "postcss --config config/postcss.config.js --watch src/**/*.css --base src --dir dist",
-    "test": "echo \"Write some tests...\"; npm run test:types",
+    "test": "jest --config ./config/jest.config.js",
+    "test:ci": "npm run lint && npm run test:types && npm run test -- --ci",
     "test:types": "dtslint types --onlyTestTsNext",
     "prepublishOnly": "npm run build",
     "lint": "eslint .",
@@ -90,15 +91,20 @@
     "@babel/core": "^7.9.6",
     "@babel/plugin-proposal-optional-catch-binding": "^7.14.2",
     "@babel/plugin-transform-runtime": "^7.13.15",
-    "@babel/preset-env": "^7.14.2",
+    "@babel/preset-env": "^7.9.6",
+    "@babel/preset-react": "^7.13.13",
     "@semantic-release/commit-analyzer": "^8.0.1",
     "@semantic-release/github": "^7.2.0",
     "@semantic-release/npm": "7.0.8",
     "@semantic-release/release-notes-generator": "^9.0.1",
+    "@testing-library/jest-dom": "^5.12.0",
+    "@testing-library/react": "^11.2.6",
+    "@testing-library/user-event": "^13.1.9",
     "@types/react": "^17.0.0",
     "@typescript-eslint/eslint-plugin": "^4.22.0",
     "@typescript-eslint/parser": "^4.22.0",
     "autoprefixer": "^9.7.6",
+    "babel-jest": "^26.6.3",
     "babel-preset-preact": "^2.0.0",
     "conventional-changelog-conventionalcommits": "4.4.0",
     "cssnano": "^4.1.10",
@@ -108,16 +114,22 @@
     "eslint-config-prettier": "^8.2.0",
     "eslint-config-standard-with-typescript": "^19.0.1",
     "eslint-plugin-import": "^2.22.1",
+    "eslint-plugin-jest": "^24.3.6",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-promise": "^4.3.1",
     "eslint-plugin-standard": "^5.0.0",
+    "husky": "^6.0.0",
+    "jest": "^26.6.3",
+    "msw": "^0.28.2",
     "next": "^10.0.5",
     "postcss-cli": "^7.1.1",
     "postcss-nested": "^4.2.1",
     "prettier": "^2.2.1",
+    "pretty-quick": "^3.1.0",
     "react": "^17.0.1",
     "react-dom": "^17.0.1",
-    "typescript": "^4.1.3"
+    "typescript": "^4.1.3",
+    "whatwg-fetch": "^3.6.2"
   },
   "prettier": {
     "semi": false
@@ -144,7 +156,23 @@
       "localStorage": "readonly",
       "location": "readonly",
       "fetch": "readonly"
-    }
+    },
+    "overrides": [
+      {
+        "files": [
+          "./**/*test.js"
+        ],
+        "env": {
+          "jest/globals": true
+        },
+        "extends": [
+          "plugin:jest/recommended"
+        ],
+        "plugins": [
+          "jest"
+        ]
+      }
+    ]
   },
   "release": {
     "branches": [

src/client/__tests__/mocks.js

@@ -0,0 +1,87 @@
+import { setupServer } from "msw/node"
+import { rest } from "msw"
+import { randomBytes } from "crypto"
+
+export const mockSession = {
+  user: {
+    image: null,
+    name: "John",
+    email: "john@email.com",
+  },
+  expires: 123213139,
+}
+
+export const mockProviders = {
+  github: {
+    id: "github",
+    name: "Github",
+    type: "oauth",
+    signinUrl: "path/to/signin",
+    callbackUrl: "path/to/callback",
+  },
+  credentials: {
+    id: "credentials",
+    name: "Credentials",
+    type: "credentials",
+    authorize: null,
+    credentials: null,
+  },
+  email: {
+    id: "email",
+    type: "email",
+    name: "Email",
+  },
+}
+
+export const mockCSRFToken = {
+  csrfToken: randomBytes(32).toString("hex"),
+}
+
+export const mockGithubResponse = {
+  ok: true,
+  status: 200,
+  url: "https://path/to/github/url",
+}
+
+export const mockCredentialsResponse = {
+  ok: true,
+  status: 200,
+  url: "https://path/to/credentials/url",
+}
+
+export const mockEmailResponse = {
+  ok: true,
+  status: 200,
+  url: "https://path/to/email/url",
+}
+
+export const mockSignOutResponse = {
+  ok: true,
+  status: 200,
+  url: "https://path/to/signout/url",
+}
+
+export const server = setupServer(
+  rest.post("/api/auth/signout", (req, res, ctx) =>
+    res(ctx.status(200), ctx.json(mockSignOutResponse))
+  ),
+  rest.get("/api/auth/session", (req, res, ctx) =>
+    res(ctx.status(200), ctx.json(mockSession))
+  ),
+  rest.get("/api/auth/csrf", (req, res, ctx) =>
+    res(ctx.status(200), ctx.json(mockCSRFToken))
+  ),
+  rest.get("/api/auth/providers", (req, res, ctx) =>
+    res(ctx.status(200), ctx.json(mockProviders))
+  ),
+  rest.post("/api/auth/signin/github", (req, res, ctx) =>
+    res(ctx.status(200), ctx.json(mockGithubResponse))
+  ),
+  rest.post("/api/auth/callback/credentials", (req, res, ctx) =>
+    res(ctx.status(200), ctx.json(mockCredentialsResponse))
+  ),
+  rest.post("/api/auth/signin/email", (req, res, ctx) =>
+    res(ctx.status(200), ctx.json(mockEmailResponse))
+  ),
+  rest.post("/api/auth/_log", (req, res, ctx) => res(ctx.status(200)))
+)

src/client/__tests__/session.test.js

@@ -0,0 +1,97 @@
+import { render, screen, waitFor } from "@testing-library/react"
+import { rest } from "msw"
+import { server, mockSession } from "./mocks"
+import logger from "../../lib/logger"
+import { useState, useEffect } from "react"
+import { getSession } from ".."
+import { getBroadcastEvents } from "./utils"
+
+jest.mock("../../lib/logger", () => ({
+  __esModule: true,
+  default: {
+    warn: jest.fn(),
+    debug: jest.fn(),
+    error: jest.fn(),
+  },
+  proxyLogger(logger) {
+    return logger
+  },
+}))
+
+beforeAll(() => server.listen())
+
+beforeEach(() => {
+  // eslint-disable-next-line no-proto
+  jest.spyOn(window.localStorage.__proto__, "setItem")
+})
+
+afterEach(() => {
+  server.resetHandlers()
+  jest.restoreAllMocks()
+})
+
+afterAll(() => server.close())
+
+test("if it can fetch the session, it should store it in `localStorage`", async () => {
+  render(<SessionFlow />)
+
+  // In the start, there is no session
+  const noSession = await screen.findByText("No session")
+  expect(noSession).toBeInTheDocument()
+
+  // After we fetched the session, it should have been rendered by `<SessionFlow />`
+  const session = await screen.findByText(new RegExp(mockSession.user.name))
+  expect(session).toBeInTheDocument()
+
+  const broadcastCalls = getBroadcastEvents()
+  const [broadcastedEvent] = broadcastCalls
+
+  expect(broadcastCalls).toHaveLength(1)
+  expect(broadcastCalls).toHaveLength(1)
+  expect(broadcastedEvent.eventName).toBe("nextauth.message")
+  expect(broadcastedEvent.value).toStrictEqual({
+    data: {
+      trigger: "getSession",
+    },
+    event: "session",
+  })
+})
+
+test("if there's an error fetching the session, it should log it", async () => {
+  server.use(
+    rest.get("/api/auth/session", (req, res, ctx) => {
+      return res(ctx.status(500), ctx.body("Server error"))
+    })
+  )
+
+  render(<SessionFlow />)
+
+  await waitFor(() => {
+    expect(logger.error).toHaveBeenCalledTimes(1)
+    expect(logger.error).toBeCalledWith(
+      "CLIENT_FETCH_ERROR",
+      "session",
+      new SyntaxError("Unexpected token S in JSON at position 0")
+    )
+  })
+})
+
+function SessionFlow() {
+  const [session, setSession] = useState(null)
+  useEffect(() => {
+    async function fetchUserSession() {
+      try {
+        const result = await getSession({})
+        setSession(result)
+      } catch (e) {
+        console.error(e)
+      }
+    }
+    fetchUserSession()
+  }, [])
+
+  if (session) {
+    return <pre>{JSON.stringify(session, null, 2)}</pre>
+  }
+  return <p>No session</p>
+}

src/client/__tests__/sign-in.test.js

@@ -0,0 +1,290 @@
+import { useState } from "react"
+import userEvent from "@testing-library/user-event"
+import { render, screen, waitFor } from "@testing-library/react"
+import logger from "../../lib/logger"
+import {
+  server,
+  mockCredentialsResponse,
+  mockEmailResponse,
+  mockGithubResponse,
+} from "./mocks"
+import { signIn } from ".."
+import { rest } from "msw"
+
+const { location } = window
+
+jest.mock("../../lib/logger", () => ({
+  __esModule: true,
+  default: {
+    warn: jest.fn(),
+    debug: jest.fn(),
+    error: jest.fn(),
+  },
+  proxyLogger(logger) {
+    return logger
+  },
+}))
+
+beforeAll(() => {
+  server.listen()
+  delete window.location
+  window.location = {
+    ...location,
+    replace: jest.fn(),
+    reload: jest.fn(),
+  }
+})
+
+beforeEach(() => {
+  jest.resetAllMocks()
+  server.resetHandlers()
+})
+
+afterAll(() => {
+  window.location = location
+  server.close()
+})
+
+const callbackUrl = "https://redirects/to"
+
+test.each`
+  provider | type
+  ${""}    | ${"no"}
+  ${"foo"} | ${"unknown"}
+`(
+  "if $type provider, it redirects to the default sign-in page",
+  async ({ provider }) => {
+    render(<SignInFlow providerId={provider} callbackUrl={callbackUrl} />)
+
+    userEvent.click(screen.getByRole("button"))
+
+    await waitFor(() => {
+      expect(window.location.replace).toHaveBeenCalledTimes(1)
+      expect(window.location.replace).toHaveBeenCalledWith(
+        `/api/auth/signin?callbackUrl=${encodeURIComponent(callbackUrl)}`
+      )
+    })
+  }
+)
+
+test.each`
+  provider | type
+  ${""}    | ${"no"}
+  ${"foo"} | ${"unknown"}
+`(
+  "if $type provider supplied and no callback URL, redirects using the current location",
+  async ({ provider }) => {
+    render(<SignInFlow providerId={provider} />)
+
+    userEvent.click(screen.getByRole("button"))
+
+    await waitFor(() => {
+      expect(window.location.replace).toHaveBeenCalledTimes(1)
+      expect(window.location.replace).toHaveBeenCalledWith(
+        `/api/auth/signin?callbackUrl=${encodeURIComponent(
+          window.location.href
+        )}`
+      )
+    })
+  }
+)
+
+test.each`
+  provider         | mockUrl
+  ${`email`}       | ${mockEmailResponse.url}
+  ${`credentials`} | ${mockCredentialsResponse.url}
+`(
+  "$provider provider redirects if `redirect` is `true`",
+  async ({ provider, mockUrl }) => {
+    render(<SignInFlow providerId={provider} redirect={true} />)
+
+    userEvent.click(screen.getByRole("button"))
+
+    await waitFor(() => {
+      expect(window.location.replace).toHaveBeenCalledTimes(1)
+      expect(window.location.replace).toHaveBeenCalledWith(mockUrl)
+    })
+  }
+)
+
+test("redirection can't be stopped using an oauth provider", async () => {
+  render(
+    <SignInFlow
+      providerId="github"
+      callbackUrl={callbackUrl}
+      redirect={false}
+    />
+  )
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(window.location.replace).toHaveBeenCalledTimes(1)
+    expect(window.location.replace).toHaveBeenCalledWith(mockGithubResponse.url)
+  })
+})
+
+test("redirection can be stopped using the 'credentials' provider", async () => {
+  render(
+    <SignInFlow
+      providerId="credentials"
+      callbackUrl={callbackUrl}
+      redirect={false}
+    />
+  )
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(window.location.replace).not.toHaveBeenCalledWith(
+      mockCredentialsResponse.url
+    )
+
+    expect(screen.getByTestId("signin-result").textContent).not.toBe(
+      "no response"
+    )
+  })
+
+  // snapshot the expected return shape from `signIn`
+  expect(JSON.parse(screen.getByTestId("signin-result").textContent))
+    .toMatchInlineSnapshot(`
+    Object {
+      "error": null,
+      "ok": true,
+      "status": 200,
+      "url": "https://path/to/credentials/url",
+    }
+  `)
+})
+
+test("redirection can be stopped using the 'email' provider", async () => {
+  render(
+    <SignInFlow providerId="email" callbackUrl={callbackUrl} redirect={false} />
+  )
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(window.location.replace).not.toHaveBeenCalledWith(
+      mockEmailResponse.url
+    )
+
+    expect(screen.getByTestId("signin-result").textContent).not.toBe(
+      "no response"
+    )
+  })
+
+  // snapshot the expected return shape from `signIn` oauth
+  expect(JSON.parse(screen.getByTestId("signin-result").textContent))
+    .toMatchInlineSnapshot(`
+    Object {
+      "error": null,
+      "ok": true,
+      "status": 200,
+      "url": "https://path/to/email/url",
+    }
+  `)
+})
+
+test("if callback URL contains a hash we force a window reload when re-directing", async () => {
+  const mockUrlWithHash = "https://path/to/email/url#foo-bar-baz"
+
+  server.use(
+    rest.post("/api/auth/signin/email", (req, res, ctx) => {
+      return res(
+        ctx.status(200),
+        ctx.json({
+          ...mockEmailResponse,
+          url: mockUrlWithHash,
+        })
+      )
+    })
+  )
+
+  render(<SignInFlow providerId="email" callbackUrl={mockUrlWithHash} />)
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(window.location.replace).toHaveBeenCalledTimes(1)
+    expect(window.location.replace).toHaveBeenCalledWith(mockUrlWithHash)
+    // the browser will not refresh the page if the redirect URL contains a hash, hence we force it on the client, see #1289
+    expect(window.location.reload).toHaveBeenCalledTimes(1)
+  })
+})
+
+test("params are propagated to the signin URL when supplied", async () => {
+  let matchedParams = ""
+  const authParams = "foo=bar&bar=foo"
+
+  server.use(
+    rest.post("/api/auth/signin/github", (req, res, ctx) => {
+      matchedParams = req.url.search
+      return res(ctx.status(200), ctx.json(mockGithubResponse))
+    })
+  )
+
+  render(<SignInFlow providerId="github" authorizationParams={authParams} />)
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(matchedParams).toEqual(`?${authParams}`)
+  })
+})
+
+test("when it fails to fetch the providers, it redirected back to signin page", async () => {
+  const errorMsg = "Error when retrieving providers"
+
+  server.use(
+    rest.get("/api/auth/providers", (req, res, ctx) =>
+      res(ctx.status(500), ctx.json(errorMsg))
+    )
+  )
+
+  render(<SignInFlow providerId="github" />)
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(window.location.replace).toHaveBeenCalledWith(`/api/auth/error`)
+
+    expect(logger.error).toHaveBeenCalledTimes(1)
+    expect(logger.error).toBeCalledWith(
+      "CLIENT_FETCH_ERROR",
+      "providers",
+      errorMsg
+    )
+  })
+})
+
+function SignInFlow({
+  providerId,
+  callbackUrl,
+  redirect = true,
+  authorizationParams = {},
+}) {
+  const [response, setResponse] = useState(null)
+
+  async function handleSignIn() {
+    const result = await signIn(
+      providerId,
+      {
+        callbackUrl,
+        redirect,
+      },
+      authorizationParams
+    )
+
+    setResponse(result)
+  }
+
+  return (
+    <>
+      <p data-testid="signin-result">
+        {response ? JSON.stringify(response) : "no response"}
+      </p>
+      <button onClick={() => handleSignIn()}>Sign in</button>
+    </>
+  )
+}

src/client/__tests__/sign-out.test.js

@@ -0,0 +1,129 @@
+import { useState } from "react"
+import userEvent from "@testing-library/user-event"
+import { render, screen, waitFor } from "@testing-library/react"
+import { server, mockSignOutResponse } from "./mocks"
+import { signOut } from ".."
+import { rest } from "msw"
+import { getBroadcastEvents } from "./utils"
+
+const { location } = window
+
+beforeAll(() => {
+  server.listen()
+  delete window.location
+  window.location = {
+    ...location,
+    replace: jest.fn(),
+    reload: jest.fn(),
+  }
+})
+
+beforeEach(() => {
+  // eslint-disable-next-line no-proto
+  jest.spyOn(window.localStorage.__proto__, "setItem")
+})
+
+afterEach(() => {
+  jest.resetAllMocks()
+  server.resetHandlers()
+})
+
+afterAll(() => {
+  window.location = location
+  server.close()
+})
+
+const callbackUrl = "https://redirects/to"
+
+test("by default it redirects to the current URL if the server did not provide one", async () => {
+  server.use(
+    rest.post("/api/auth/signout", (req, res, ctx) =>
+      res(ctx.status(200), ctx.json({ ...mockSignOutResponse, url: undefined }))
+    )
+  )
+
+  render(<SignOutFlow />)
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(window.location.replace).toHaveBeenCalledTimes(1)
+    expect(window.location.replace).toHaveBeenCalledWith(window.location.href)
+  })
+})
+
+test("it redirects to the URL allowed by the server", async () => {
+  render(<SignOutFlow callbackUrl={callbackUrl} />)
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(window.location.replace).toHaveBeenCalledTimes(1)
+    expect(window.location.replace).toHaveBeenCalledWith(
+      mockSignOutResponse.url
+    )
+  })
+})
+
+test("if url contains a hash during redirection a page reload happens", async () => {
+  const mockUrlWithHash = "https://path/to/email/url#foo-bar-baz"
+
+  server.use(
+    rest.post("/api/auth/signout", (req, res, ctx) => {
+      return res(
+        ctx.status(200),
+        ctx.json({
+          ...mockSignOutResponse,
+          url: mockUrlWithHash,
+        })
+      )
+    })
+  )
+
+  render(<SignOutFlow />)
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    expect(window.location.reload).toHaveBeenCalledTimes(1)
+    expect(window.location.replace).toHaveBeenCalledWith(mockUrlWithHash)
+  })
+})
+
+test("will broadcast the signout event to other tabs", async () => {
+  render(<SignOutFlow />)
+
+  userEvent.click(screen.getByRole("button"))
+
+  await waitFor(() => {
+    const broadcastCalls = getBroadcastEvents()
+    const [broadcastedEvent] = broadcastCalls
+
+    expect(broadcastCalls).toHaveLength(1)
+    expect(broadcastedEvent.eventName).toBe("nextauth.message")
+    expect(broadcastedEvent.value).toStrictEqual({
+      data: {
+        trigger: "signout",
+      },
+      event: "session",
+    })
+  })
+})
+
+function SignOutFlow({ callbackUrl, redirect = true }) {
+  const [response, setResponse] = useState(null)
+
+  async function setSignOutRes() {
+    const result = await signOut({ callbackUrl, redirect })
+    setResponse(result)
+  }
+
+  return (
+    <>
+      <p data-testid="signout-result">
+        {response ? JSON.stringify(response) : "no response"}
+      </p>
+      <button onClick={() => setSignOutRes()}>Sign out</button>
+    </>
+  )
+}

src/client/__tests__/utils.js

@@ -0,0 +1,8 @@
+export function getBroadcastEvents() {
+  return window.localStorage.setItem.mock.calls
+    .filter((call) => call[0] === "nextauth.message")
+    .map(([eventName, value]) => {
+      const { timestamp, ...rest } = JSON.parse(value)
+      return { eventName, value: rest }
+    })
+}

src/client/index.js

@@ -8,9 +8,15 @@
 //
 // We use HTTP POST requests with CSRF Tokens to protect against CSRF attacks.
 
-import { useState, useEffect, useContext, createContext, createElement } from 'react'
-import _logger, { proxyLogger } from '../lib/logger'
-import parseUrl from '../lib/parse-url'
+import {
+  useState,
+  useEffect,
+  useContext,
+  createContext,
+  createElement,
+} from "react"
+import _logger, { proxyLogger } from "../lib/logger"
+import parseUrl from "../lib/parse-url"
 
 // This behaviour mirrors the default behaviour for getting the site name that
 // happens server side in server/index.js
@@ -22,8 +28,14 @@ import parseUrl from '../lib/parse-url'
 const __NEXTAUTH = {
   baseUrl: parseUrl(process.env.NEXTAUTH_URL || process.env.VERCEL_URL).baseUrl,
   basePath: parseUrl(process.env.NEXTAUTH_URL).basePath,
-  baseUrlServer: parseUrl(process.env.NEXTAUTH_URL_INTERNAL || process.env.NEXTAUTH_URL || process.env.VERCEL_URL).baseUrl,
-  basePathServer: parseUrl(process.env.NEXTAUTH_URL_INTERNAL || process.env.NEXTAUTH_URL).basePath,
+  baseUrlServer: parseUrl(
+    process.env.NEXTAUTH_URL_INTERNAL ||
+      process.env.NEXTAUTH_URL ||
+      process.env.VERCEL_URL
+  ).baseUrl,
+  basePathServer: parseUrl(
+    process.env.NEXTAUTH_URL_INTERNAL || process.env.NEXTAUTH_URL
+  ).basePath,
   keepAlive: 0,
   clientMaxAge: 0,
   // Properties starting with _ are used for tracking internal app state
@@ -31,7 +43,7 @@ const __NEXTAUTH = {
   _clientSyncTimer: null,
   _eventListenersAdded: false,
   _clientSession: undefined,
-  _getSession: () => {}
+  _getSession: () => {},
 }
 
 const logger = proxyLogger(_logger, __NEXTAUTH.basePath)
@@ -39,7 +51,7 @@ const logger = proxyLogger(_logger, __NEXTAUTH.basePath)
 const broadcast = BroadcastChannel()
 
 // Add event listners on load
-if (typeof window !== 'undefined' && !__NEXTAUTH._eventListenersAdded) {
+if (typeof window !== "undefined" && !__NEXTAUTH._eventListenersAdded) {
   __NEXTAUTH._eventListenersAdded = true
   // Listen for storage events and update session if event fired from
   // another window (but suppress firing another event to avoid a loop)
@@ -50,26 +62,30 @@ if (typeof window !== 'undefined' && !__NEXTAUTH._eventListenersAdded) {
   // on how the session object is being used in the client; it is
   // more robust to have each window/tab fetch it's own copy of the
   // session object rather than share it across instances.
-  broadcast.receive(() => __NEXTAUTH._getSession({ event: 'storage' }))
+  broadcast.receive(() => __NEXTAUTH._getSession({ event: "storage" }))
 
   // Listen for document visibility change events and
   // if visibility of the document changes, re-fetch the session.
-  document.addEventListener('visibilitychange', () => {
-    !document.hidden && __NEXTAUTH._getSession({ event: 'visibilitychange' })
-  }, false)
+  document.addEventListener(
+    "visibilitychange",
+    () => {
+      !document.hidden && __NEXTAUTH._getSession({ event: "visibilitychange" })
+    },
+    false
+  )
 }
 
 // Context to store session data globally
 /** @type {import("types/internals/client").SessionContext} */
 const SessionContext = createContext()
 
-export function useSession (session) {
+export function useSession(session) {
   const context = useContext(SessionContext)
   if (context) return context
   return _useSessionHook(session)
 }
 
-function _useSessionHook (session) {
+function _useSessionHook(session) {
   const [data, setData] = useState(session)
   const [loading, setLoading] = useState(!data)
 
@@ -77,7 +93,7 @@ function _useSessionHook (session) {
     __NEXTAUTH._getSession = async ({ event = null } = {}) => {
       try {
         const triggredByEvent = event !== null
-        const triggeredByStorageEvent = event === 'storage'
+        const triggeredByStorageEvent = event === "storage"
 
         const clientMaxAge = __NEXTAUTH.clientMaxAge
         const clientLastSync = parseInt(__NEXTAUTH._clientLastSync)
@@ -98,14 +114,19 @@ function _useSessionHook (session) {
             // tab or window that will come through as a triggeredByStorageEvent
             // event and will skip this logic)
             return
-          } else if (clientMaxAge > 0 && currentTime < (clientLastSync + clientMaxAge)) {
+          } else if (
+            clientMaxAge > 0 &&
+            currentTime < clientLastSync + clientMaxAge
+          ) {
             // If the session freshness is within clientMaxAge then don't request
             // it again on this call (avoids too many invokations).
             return
           }
         }
 
-        if (clientSession === undefined) { __NEXTAUTH._clientSession = null }
+        if (clientSession === undefined) {
+          __NEXTAUTH._clientSession = null
+        }
 
         // Update clientLastSync before making response to avoid repeated
         // invokations that would otherwise be triggered while we are still
@@ -116,7 +137,7 @@ function _useSessionHook (session) {
         // tell getSession not to trigger an event when it calls to avoid an
         // infinate loop.
         const newClientSessionData = await getSession({
-          triggerEvent: !triggeredByStorageEvent
+          triggerEvent: !triggeredByStorageEvent,
         })
 
         // Save session state internally, just so we can track that we've checked
@@ -126,7 +147,7 @@ function _useSessionHook (session) {
         setData(newClientSessionData)
         setLoading(false)
       } catch (error) {
-        logger.error('CLIENT_USE_SESSION_ERROR', error)
+        logger.error("CLIENT_USE_SESSION_ERROR", error)
         setLoading(false)
       }
     }
@@ -137,114 +158,112 @@ function _useSessionHook (session) {
   return [data, loading]
 }
 
-export async function getSession (ctx) {
-  const session = await _fetchData('session', ctx)
+export async function getSession(ctx) {
+  const session = await _fetchData("session", ctx)
   if (ctx?.triggerEvent ?? true) {
-    broadcast.post({ event: 'session', data: { trigger: 'getSession' } })
+    broadcast.post({ event: "session", data: { trigger: "getSession" } })
   }
   return session
 }
 
-export async function getCsrfToken (ctx) {
-  return (await _fetchData('csrf', ctx))?.csrfToken
+export async function getCsrfToken(ctx) {
+  return (await _fetchData("csrf", ctx))?.csrfToken
 }
 
-export async function getProviders () {
-  return _fetchData('providers')
+export async function getProviders() {
+  return await _fetchData("providers")
 }
 
-export async function signIn (provider, options = {}, authorizationParams = {}) {
-  const {
-    callbackUrl = window.location,
-    redirect = true
-  } = options
+export async function signIn(provider, options = {}, authorizationParams = {}) {
+  const { callbackUrl = window.location.href, redirect = true } = options
 
   const baseUrl = _apiBaseUrl()
   const providers = await getProviders()
 
-  // Redirect to sign in page if no valid provider specified
-  if (!(provider in providers)) {
-    // If Provider not recognized, redirect to sign in page
-    window.location = `${baseUrl}/signin?callbackUrl=${encodeURIComponent(callbackUrl)}`
-    return
+  if (!providers) {
+    return window.location.replace(`${baseUrl}/error`)
   }
-  const isCredentials = providers[provider].type === 'credentials'
-  const isEmail = providers[provider].type === 'email'
-  const canRedirectBeDisabled = isCredentials || isEmail
+
+  if (!(provider in providers)) {
+    return window.location.replace(
+      `${baseUrl}/signin?callbackUrl=${encodeURIComponent(callbackUrl)}`
+    )
+  }
+
+  const isCredentials = providers[provider].type === "credentials"
+  const isEmail = providers[provider].type === "email"
+  const isSupportingReturn = isCredentials || isEmail
 
   const signInUrl = isCredentials
     ? `${baseUrl}/callback/${provider}`
     : `${baseUrl}/signin/${provider}`
 
-  // If is any other provider type, POST to provider URL with CSRF Token,
-  // callback URL and any other parameters supplied.
-  const fetchOptions = {
-    method: 'post',
+  const _signInUrl = `${signInUrl}?${new URLSearchParams(authorizationParams)}`
+
+  const res = await fetch(_signInUrl, {
+    method: "post",
     headers: {
-      'Content-Type': 'application/x-www-form-urlencoded'
+      "Content-Type": "application/x-www-form-urlencoded",
     },
     body: new URLSearchParams({
       ...options,
       csrfToken: await getCsrfToken(),
       callbackUrl,
-      json: true
-    })
-  }
-  const _signInUrl = `${signInUrl}?${new URLSearchParams(authorizationParams)}`
-  const res = await fetch(_signInUrl, fetchOptions)
-  const data = await res.json()
-  if (redirect || !canRedirectBeDisabled) {
-    const url = data.url ?? callbackUrl
-    window.location = url
-    // If url contains a hash, the browser does not reload the page. We reload manually
-    if (url.includes('#')) window.location.reload()
+      json: true,
+    }),
+  })
 
+  const data = await res.json()
+
+  if (redirect || !isSupportingReturn) {
+    const url = data.url ?? callbackUrl
+    window.location.replace(url)
+    // If url contains a hash, the browser does not reload the page. We reload manually
+    if (url.includes("#")) window.location.reload()
     return
   }
 
-  const error = new URL(data.url).searchParams.get('error')
+  const error = new URL(data.url).searchParams.get("error")
 
   if (res.ok) {
-    await __NEXTAUTH._getSession({ event: 'storage' })
+    await __NEXTAUTH._getSession({ event: "storage" })
   }
 
   return {
     error,
     status: res.status,
     ok: res.ok,
-    url: error ? null : data.url
+    url: error ? null : data.url,
   }
 }
 
-export async function signOut (options = {}) {
-  const {
-    callbackUrl = window.location,
-    redirect = true
-  } = options
+export async function signOut(options = {}) {
+  const { callbackUrl = window.location.href, redirect = true } = options
   const baseUrl = _apiBaseUrl()
   const fetchOptions = {
-    method: 'post',
+    method: "post",
     headers: {
-      'Content-Type': 'application/x-www-form-urlencoded'
+      "Content-Type": "application/x-www-form-urlencoded",
     },
     body: new URLSearchParams({
       csrfToken: await getCsrfToken(),
       callbackUrl,
-      json: true
-    })
+      json: true,
+    }),
   }
   const res = await fetch(`${baseUrl}/signout`, fetchOptions)
   const data = await res.json()
-  broadcast.post({ event: 'session', data: { trigger: 'signout' } })
+  broadcast.post({ event: "session", data: { trigger: "signout" } })
+
   if (redirect) {
     const url = data.url ?? callbackUrl
-    window.location = url
+    window.location.replace(url)
     // If url contains a hash, the browser does not reload the page. We reload manually
-    if (url.includes('#')) window.location.reload()
+    if (url.includes("#")) window.location.reload()
     return
   }
 
-  await __NEXTAUTH._getSession({ event: 'storage' })
+  await __NEXTAUTH._getSession({ event: "storage" })
 
   return data
 }
@@ -252,13 +271,18 @@ export async function signOut (options = {}) {
 // Method to set options. The documented way is to use the provider, but this
 // method is being left in as an alternative, that will be helpful if/when we
 // expose a vanilla JavaScript version that doesn't depend on React.
-export function setOptions ({ baseUrl, basePath, clientMaxAge, keepAlive } = {}) {
+export function setOptions({
+  baseUrl,
+  basePath,
+  clientMaxAge,
+  keepAlive,
+} = {}) {
   if (baseUrl) __NEXTAUTH.baseUrl = baseUrl
   if (basePath) __NEXTAUTH.basePath = basePath
   if (clientMaxAge) __NEXTAUTH.clientMaxAge = clientMaxAge
   if (keepAlive) {
     __NEXTAUTH.keepAlive = keepAlive
-    if (typeof window === 'undefined') return
+    if (typeof window === "undefined") return
 
     // Clear existing timer (if there is one)
     if (__NEXTAUTH._clientSyncTimer !== null) {
@@ -269,12 +293,12 @@ export function setOptions ({ baseUrl, basePath, clientMaxAge, keepAlive } = {})
     __NEXTAUTH._clientSyncTimer = setTimeout(async () => {
       // Only invoke keepalive when a session exists
       if (!__NEXTAUTH._clientSession) return
-      await __NEXTAUTH._getSession({ event: 'timer' })
+      await __NEXTAUTH._getSession({ event: "timer" })
     }, keepAlive * 1000)
   }
 }
 
-export function Provider ({ children, session, options }) {
+export function Provider({ children, session, options }) {
   setOptions(options)
   return createElement(
     SessionContext.Provider,
@@ -290,24 +314,25 @@ export function Provider ({ children, session, options }) {
  * work seemlessly in getInitialProps() on server side
  * pages *and* in _app.js.
  */
-async function _fetchData (path, { ctx, req = ctx?.req } = {}) {
+async function _fetchData(path, { ctx, req = ctx?.req } = {}) {
   try {
     const baseUrl = await _apiBaseUrl()
     const options = req ? { headers: { cookie: req.headers.cookie } } : {}
     const res = await fetch(`${baseUrl}/${path}`, options)
     const data = await res.json()
+    if (!res.ok) throw data
     return Object.keys(data).length > 0 ? data : null // Return null if data empty
   } catch (error) {
-    logger.error('CLIENT_FETCH_ERROR', path, error)
+    logger.error("CLIENT_FETCH_ERROR", path, error)
     return null
   }
 }
 
-function _apiBaseUrl () {
-  if (typeof window === 'undefined') {
+function _apiBaseUrl() {
+  if (typeof window === "undefined") {
     // NEXTAUTH_URL should always be set explicitly to support server side calls - log warning if not set
     if (!process.env.NEXTAUTH_URL) {
-      logger.warn('NEXTAUTH_URL', 'NEXTAUTH_URL environment variable not set')
+      logger.warn("NEXTAUTH_URL", "NEXTAUTH_URL environment variable not set")
     }
 
     // Return absolute path when called server side
@@ -318,7 +343,7 @@ function _apiBaseUrl () {
 }
 
 /** Returns the number of seconds elapsed since January 1, 1970 00:00:00 UTC. */
-function _now () {
+function _now() {
   return Math.floor(Date.now() / 1000)
 }
 
@@ -328,35 +353,34 @@ function _now () {
  *
  * https://caniuse.com/?search=broadcastchannel
  */
-function BroadcastChannel (name = 'nextauth.message') {
+function BroadcastChannel(name = "nextauth.message") {
   return {
     /**
      * Get notified by other tabs/windows.
      * @param {(message: import("types/internals/client").BroadcastMessage) => void} onReceive
      */
-    receive (onReceive) {
-      if (typeof window === 'undefined') return
-      window.addEventListener('storage', async (event) => {
+    receive(onReceive) {
+      if (typeof window === "undefined") return
+      window.addEventListener("storage", async (event) => {
         if (event.key !== name) return
         /** @type {import("types/internals/client").BroadcastMessage} */
         const message = JSON.parse(event.newValue)
-        if (message?.event !== 'session' || !message?.data) return
+        if (message?.event !== "session" || !message?.data) return
 
         onReceive(message)
       })
     },
     /** Notify other tabs/windows. */
-    post (message) {
-      if (typeof localStorage === 'undefined') return
-      localStorage.setItem(name,
+    post(message) {
+      if (typeof localStorage === "undefined") return
+      localStorage.setItem(
+        name,
         JSON.stringify({ ...message, timestamp: _now() })
       )
-    }
+    },
   }
 }
 
-
-
 // Some methods are exported with more than one name. This provides some
 // flexibility over how they can be invoked and backwards compatibility
 // with earlier releases. These should be removed in a newer release, as it only
@@ -368,7 +392,7 @@ export {
   getProviders as providers,
   getCsrfToken as csrfToken,
   signIn as signin,
-  signOut as signout
+  signOut as signout,
 }
 
 export default {
@@ -390,5 +414,5 @@ export default {
   providers: getProviders,
   csrfToken: getCsrfToken,
   signin: signIn,
-  signout: signOut
+  signout: signOut,
 }

src/providers/zoom.js

@@ -0,0 +1,20 @@
+export default function Zoom(options) {
+  return {
+    id: "zoom",
+    name: "Zoom",
+    type: "oauth",
+    version: "2.0",
+    params: { grant_type: "authorization_code" },
+    accessTokenUrl: "https://zoom.us/oauth/token",
+    authorizationUrl: "https://zoom.us/oauth/authorize?response_type=code",
+    profileUrl: "https://api.zoom.us/v2/users/me",
+    profile(profile) {
+      return {
+        id: profile.id,
+        name: `${profile.first_name} ${profile.last_name}`,
+        email: profile.email,
+      }
+    },
+    ...options,
+  }
+}

src/server/lib/signin/oauth.js

@@ -15,9 +15,9 @@ export default async function getAuthorizationUrl (req) {
   if (provider.version?.startsWith('2.')) {
     // Handle OAuth v2.x
     let url = client.getAuthorizeUrl({
+      scope: provider.scope,
       ...params,
-      redirect_uri: provider.callbackUrl,
-      scope: provider.scope
+      redirect_uri: provider.callbackUrl
     })
 
     // If the authorizationUrl specified in the config has query parameters on it

src/server/routes/providers.js

@@ -5,13 +5,16 @@
  * @param {import("types/internals").NextAuthRequest} req
  * @param {import("types/internals").NextAuthResponse} res
  */
-export default function providers (req, res) {
+export default function providers(req, res) {
   const { providers } = req.options
 
-  const result = providers.reduce((acc, { id, name, type, signinUrl, callbackUrl }) => {
-    acc[id] = { id, name, type, signinUrl, callbackUrl }
-    return acc
-  }, {})
+  const result = providers.reduce(
+    (acc, { id, name, type, signinUrl, callbackUrl }) => {
+      acc[id] = { id, name, type, signinUrl, callbackUrl }
+      return acc
+    },
+    {}
+  )
 
   res.json(result)
 }

tsconfig.json

@@ -3,31 +3,15 @@
     "strictNullChecks": true,
     "baseUrl": ".",
     "paths": {
-      "types": [
-        "./types"
-      ],
-      "next-auth": [
-        "./src/server"
-      ],
-      "next-auth/adapters": [
-        "./src/adapters"
-      ],
-      "next-auth/client": [
-        "./src/client"
-      ],
-      "next-auth/jwt": [
-        "./src/lib/jwt"
-      ],
-      "next-auth/providers": [
-        "./src/providers"
-      ]
+      "types": ["./types"],
+      "next-auth": ["./src/server"],
+      "next-auth/adapters": ["./src/adapters"],
+      "next-auth/client": ["./src/client"],
+      "next-auth/jwt": ["./src/lib/jwt"],
+      "next-auth/providers": ["./src/providers"]
     },
     "target": "es5",
-    "lib": [
-      "dom",
-      "dom.iterable",
-      "esnext"
-    ],
+    "lib": ["dom", "dom.iterable", "esnext"],
     "allowJs": true,
     "skipLibCheck": true,
     "strict": false,
@@ -44,9 +28,8 @@
     "next-env.d.ts",
     "**/*.ts",
     "**/*.tsx",
-    "**/*.js"
+    "**/*.js",
+    ".eslintrc.js"
   ],
-  "exclude": [
-    "node_modules"
-  ]
+  "exclude": ["node_modules"]
 }

types/providers.d.ts

@@ -97,6 +97,7 @@ export type OAuthProviderType =
   | "WorkOS"
   | "Yandex"
   | "Zoho"
+  | "Zoom"
 
 export type OAuthProvider = (options: Partial<OAuthConfig>) => OAuthConfig
 

www/docs/adapters/dynamodb.md

@@ -0,0 +1,71 @@
+---
+id: dynamodb
+title: DynamoDB Adapter
+---
+
+# DynamoDB
+
+This is the AWS DynamoDB Adapter for next-auth. This package can only be used in conjunction with the primary next-auth package. It is not a standalone package.
+
+You need a table with a partition key `pk` and a sort key `sk`. Your table also needs a global secondary index named `GSI1` with `GSI1PK` as partition key and `GSI1SK` as sorting key. You can set whatever you want as the table name and the billing method.
+
+You can find the full schema in the table structure section below.
+
+## Getting Started
+
+1. Install `next-auth` and `@next-auth/dynamodb-adapter@canary`
+
+```js
+npm install next-auth @next-auth/dynamodb-adapter@canary
+```
+
+2. Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object.
+
+You need to pass `aws-sdk` to the adapter in addition to the table name.
+
+```javascript title="pages/api/auth/[...nextauth].js"
+import AWS from "aws-sdk";
+import NextAuth from "next-auth";
+import Providers from "next-auth/providers";
+import { DynamoDBAdapter } from "@next-auth/dynamodb-adapter"
+
+AWS.config.update({
+  accessKeyId: process.env.NEXT_AUTH_AWS_ACCESS_KEY,
+  secretAccessKey: process.env.NEXT_AUTH_AWS_SECRET_KEY,
+  region: process.env.NEXT_AUTH_AWS_REGION,
+});
+
+export default NextAuth({
+  // Configure one or more authentication providers
+  providers: [
+    Providers.GitHub({
+      clientId: process.env.GITHUB_ID,
+      clientSecret: process.env.GITHUB_SECRET,
+    }),
+    Providers.Email({
+      server: process.env.EMAIL_SERVER,
+      from: process.env.EMAIL_FROM,
+    }),
+    // ...add more providers here
+  ],
+  adapter: DynamoDBAdapter({
+    AWS,
+    tableName: "next-auth-test",
+  }),
+  ...
+});
+```
+
+(AWS secrets start with `NEXT_AUTH_` in order to not conflict with [Vercel's reserved environment variables](https://vercel.com/docs/environment-variables#reserved-environment-variables).)
+
+## Schema
+
+The table respects the single table design pattern. This has many advantages:
+
+- Only one table to manage, monitor and provision.
+- Querying relations is faster than with multi-table schemas (for eg. retreiving all sessions for a user).
+- Only one table needs to be replicated, if you want to go multi-region.
+
+Here is a schema of the table :
+
+![DynamoDB Table](https://i.imgur.com/hGZtWDq.png)

www/docs/adapters/fauna.md

@@ -0,0 +1,84 @@
+---
+id: fauna
+title: FaunaDB Adapter
+---
+
+# FaunaDB
+
+This is the Fauna Adapter for [`next-auth`](https://next-auth.js.org). This package can only be used in conjunction with the primary `next-auth` package. It is not a standalone package.
+
+You can find the Fauna schema and seed information in the docs at [next-auth.js.org/adapters/fauna](https://next-auth.js.org/adapters/fauna).
+
+## Getting Started
+
+1. Install `next-auth` and `@next-auth/fauna-adapter@canary`
+
+```js
+npm install next-auth @next-auth/fauna-adapter@canary
+```
+
+2. Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object.
+
+```javascript title="pages/api/auth/[...nextauth].js"
+import NextAuth from "next-auth"
+import Providers from "next-auth/providers"
+import * as Fauna from "faunadb"
+import { FaunaAdapter } from "@next-auth/fauna-adapter"
+
+const client = new Fauna.Client({
+  secret: "secret",
+  scheme: "http",
+  domain: "localhost",
+  port: 8443,
+})
+
+// For more information on each option (and a full list of options) go to
+// https://next-auth.js.org/configuration/options
+export default NextAuth({
+  // https://next-auth.js.org/configuration/providers
+  providers: [
+    Providers.Google({
+      clientId: process.env.GOOGLE_ID,
+      clientSecret: process.env.GOOGLE_SECRET,
+    }),
+  ],
+  adapter: FaunaAdapter({ faunaClient: client})
+  ...
+})
+```
+
+## Schema
+
+```javascript
+CreateCollection({ name: "accounts" })
+CreateCollection({ name: "sessions" })
+CreateCollection({ name: "users" })
+CreateCollection({ name: "verification_requests" })
+CreateIndex({
+  name: "account_by_provider_account_id",
+  source: Collection("accounts"),
+  unique: true,
+  terms: [
+    { field: ["data", "providerId"] },
+    { field: ["data", "providerAccountId"] },
+  ],
+})
+CreateIndex({
+  name: "session_by_token",
+  source: Collection("sessions"),
+  unique: true,
+  terms: [{ field: ["data", "sessionToken"] }],
+})
+CreateIndex({
+  name: "user_by_email",
+  source: Collection("users"),
+  unique: true,
+  terms: [{ field: ["data", "email"] }],
+})
+CreateIndex({
+  name: "verification_request_by_token",
+  source: Collection("verification_requests"),
+  unique: true,
+  terms: [{ field: ["data", "token"] }, { field: ["data", "identifier"] }],
+})
+```

www/docs/adapters/firebase.md

@@ -0,0 +1,73 @@
+---
+id: firebase
+title: Firebase Adapter
+---
+
+# Firebase
+
+This is the Firebase Adapter for [`next-auth`](https://next-auth.js.org). This package can only be used in conjunction with the primary `next-auth` package. It is not a standalone package.
+
+## Getting Started
+
+1. Install `next-auth` and `@next-auth/firebase-adapter@canary`
+
+```js
+npm install next-auth @next-auth/firebase-adapter@canary
+```
+
+2. Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object.
+
+```javascript title="pages/api/auth/[...nextauth].js"
+import NextAuth from "next-auth"
+import Providers from "next-auth/providers"
+import { FirebaseAdapter } from "@next-auth/firebase-adapter"
+
+import firebase from "firebase/app"
+import "firebase/firestore"
+
+const firestore = (
+  firebase.apps[0] ?? firebase.initializeApp(/* your config */)
+).firestore()
+
+// For more information on each option (and a full list of options) go to
+// https://next-auth.js.org/configuration/options
+export default NextAuth({
+  // https://next-auth.js.org/configuration/providers
+  providers: [
+    Providers.Google({
+      clientId: process.env.GOOGLE_ID,
+      clientSecret: process.env.GOOGLE_SECRET,
+    }),
+  ],
+  adapter: FirebaseAdapter(firestore),
+  ...
+})
+```
+
+## Options
+
+When initializing the firestore adapter, you must pass in the firebase config object with the details from your project. More details on how to obtain that config object can be found [here](https://support.google.com/firebase/answer/7015592).
+
+An example firebase config looks like this:
+
+```js
+const firebaseConfig = {
+  apiKey: "AIzaSyDOCAbC123dEf456GhI789jKl01-MnO",
+  authDomain: "myapp-project-123.firebaseapp.com",
+  databaseURL: "https://myapp-project-123.firebaseio.com",
+  projectId: "myapp-project-123",
+  storageBucket: "myapp-project-123.appspot.com",
+  messagingSenderId: "65211879809",
+  appId: "1:65211879909:web:3ae38ef1cdcb2e01fe5f0c",
+  measurementId: "G-8GSGZQ44ST",
+}
+```
+
+See [firebase.google.com/docs/web/setup](https://firebase.google.com/docs/web/setup) for more details.
+
+:::tip **From Firebase**
+
+**Caution**: We do not recommend manually modifying an app's Firebase config file or object. If you initialize an app with invalid or missing values for any of these required "Firebase options", then your end users may experience serious issues.
+
+For open source projects, we generally do not recommend including the app's Firebase config file or object in source control because, in most cases, your users should create their own Firebase projects and point their apps to their own Firebase resources (via their own Firebase config file or object).
+:::

www/docs/adapters/overview.md

@@ -0,0 +1,42 @@
+---
+id: overview
+title: Overview
+---
+
+An **Adapter** in NextAuth.js connects your application to whatever database or backend system you want to use to store data for user accounts, sessions, etc.
+
+The adapters can be found in their own repository under [`nextauthjs/adapters`](https://github.com/nextauthjs/adapters).
+
+There you can find the following adapters:
+
+- [`typeorm-legacy`](./typeorm/typeorm-overview)
+- [`prisma`](./prisma)
+- [`prisma-legacy`](./prisma-legacy)
+- [`fauna`](./fauna)
+- [`dynamodb`](./dynamodb)
+- [`firebase`](./firebase)
+
+## Custom Adapter
+
+See the tutorial for [creating a database Adapter](/tutorials/creating-a-database-adapter) for more information on how to create a custom Adapter. Have a look at the [Adapter repository](https://github.com/nextauthjs/adapters) to see community maintained custom Adapter or add your own.
+
+### Editor integration
+
+When writing your own custom Adapter in plain JavaScript, note that you can use **JSDoc** to get helpful editor hints and auto-completion like so:
+
+```js
+/** @type { import("next-auth/adapters").Adapter } */
+const MyAdapter = () => {
+  return {
+    async getAdapter() {
+      return {
+        // your adapter methods here
+      }
+    },
+  }
+}
+```
+
+:::note
+This will work in code editors with a strong TypeScript integration like VSCode or WebStorm. It might not work if you're using more lightweight editors like VIM or Atom.
+:::

www/docs/adapters/prisma-legacy.md

@@ -1,68 +1,16 @@
 ---
-id: adapters
-title: Database Adapters
+id: prisma-legacy
+title: Prisma Adapter (Legacy)
 ---
 
-An **Adapter** in NextAuth.js connects your application to whatever database or backend system you want to use to store data for user accounts, sessions, etc.
+# Prisma (Legacy)
 
-The adapters can be found in their own repository under [`nextauthjs/adapters`](https://github.com/nextauthjs/adapters).
+You can also use NextAuth.js with the built-in Adapter for [Prisma](https://www.prisma.io/docs/). This is included in the core `next-auth` package at the moment. The other adapter needs to be installed from its own additional package.
 
-There you can find the following adapters:
-
-- typeorm-legacy
-- prisma
-- prisma-legacy
-- fauna
-- dynamodb
-
-## TypeORM Adapter
-
-NextAuth.js comes with a default Adapter that uses [TypeORM](https://typeorm.io/) so that it can be used with many different databases without any further configuration, you simply add the node module for the database driver you want to use in your project and pass a database connection string to NextAuth.js.
-
-### Database Schemas
-
-Configure your database by creating the tables and columns to match the schema expected by NextAuth.js.
-
-- [MySQL Schema](/schemas/mysql)
-- [Postgres Schema](/schemas/postgres)
-- [Microsoft SQL Server Schema](/schemas/mssql)
-
-The default Adapter is the TypeORM Adapter and the default database type for TypeORM is SQLite, the following configuration options are exactly equivalent.
-
-```javascript
-database: {
-  type: 'sqlite',
-  database: ':memory:',
-  synchronize: true
-}
-```
-
-```javascript
-adapter: Adapters.Default({
-  type: "sqlite",
-  database: ":memory:",
-  synchronize: true,
-})
-```
-
-```javascript
-adapter: Adapters.TypeORM.Adapter({
-  type: "sqlite",
-  database: ":memory:",
-  synchronize: true,
-})
-```
-
-The tutorial [Custom models with TypeORM](/tutorials/typeorm-custom-models) explains how to extend the built in models and schemas used by the TypeORM Adapter. You can use these models in your own code.
-
-:::tip
-The `synchronize` option in TypeORM will generate SQL that exactly matches the documented schemas for MySQL and Postgres. This will automatically apply any changes it finds in the entity model, therefore it **should not be enabled against production databases** as it may cause data loss if the configured schema does not match the expected schema!
+:::info
+You may have noticed there is a `prisma` and `prisma-legacy` adapter. This is due to historical reasons, but the code has mostly converged so that there is no longer much difference between the two. The legacy adapter, however, does have the ability to rename tables which the newer version does not.
 :::
 
-## Prisma Adapter
-
-You can also use NextAuth.js with the experimental Adapter for [Prisma 2](https://www.prisma.io/docs/).
-
 To use this Adapter, you need to install Prisma Client and Prisma CLI:
 
 ```
@@ -94,8 +42,9 @@ export default NextAuth({
 :::tip
 While Prisma includes an experimental feature in the migration command that is able to generate SQL from a schema, creating tables and columns using the provided SQL is currently recommended instead as SQL schemas automatically generated by Prisma may differ from the recommended schemas.
 :::
+Schema for the Prisma Adapter
 
-### Prisma Schema
+## Setup
 
 Create a schema file in `prisma/schema.prisma` similar to this one:
 
@@ -110,7 +59,7 @@ datasource db {
 }
 
 model Account {
-  id                 Int       @default(autoincrement()) @id
+  id                 Int       @id @default(autoincrement())
   compoundId         String    @unique @map(name: "compound_id")
   userId             Int       @map(name: "user_id")
   providerType       String    @map(name: "provider_type")
@@ -125,12 +74,11 @@ model Account {
   @@index([providerAccountId], name: "providerAccountId")
   @@index([providerId], name: "providerId")
   @@index([userId], name: "userId")
-
   @@map(name: "accounts")
 }
 
 model Session {
-  id           Int      @default(autoincrement()) @id
+  id           Int      @id @default(autoincrement())
   userId       Int      @map(name: "user_id")
   expires      DateTime
   sessionToken String   @unique @map(name: "session_token")
@@ -142,7 +90,7 @@ model Session {
 }
 
 model User {
-  id            Int       @default(autoincrement()) @id
+  id            Int       @id @default(autoincrement())
   name          String?
   email         String?   @unique
   emailVerified DateTime? @map(name: "email_verified")
@@ -154,36 +102,19 @@ model User {
 }
 
 model VerificationRequest {
-  id         Int      @default(autoincrement()) @id
+  id         Int      @id @default(autoincrement())
   identifier String
   token      String   @unique
   expires    DateTime
-  createdAt  DateTime  @default(now()) @map(name: "created_at")
-  updatedAt  DateTime  @default(now()) @map(name: "updated_at")
+  createdAt  DateTime @default(now()) @map(name: "created_at")
+  updatedAt  DateTime @default(now()) @map(name: "updated_at")
 
   @@map(name: "verification_requests")
 }
+
+
 ```
 
-:::note
-Set the `datasource` option appropriately for your database:
-
-```json title="schema.prisma"
-datasource db {
-  provider = "mysql"
-  url      = env("DATABASE_URL")
-}
-```
-
-```json title="schema.prisma"
-datasource db {
-  provider = "postgresql"
-  url      = env("DATABASE_URL")
-}
-```
-
-:::
-
 ### Generate Client
 
 Once you have saved your schema, use the Prisma CLI to generate the Prisma Client:
@@ -241,28 +172,3 @@ if (process.env.NODE_ENV === "production") {
 ```
 
 :::
-
-## Custom Adapter
-
-See the tutorial for [creating a database Adapter](/tutorials/creating-a-database-adapter) for more information on how to create a custom Adapter. Have a look at the [Adapter repository](https://github.com/nextauthjs/adapters) to see community maintained custom Adapter or add your own.
-
-### Editor integration
-
-When writing your own custom Adapter in plain JavaScript, note that you can use **JSDoc** to get helpful editor hints and auto-completion like so:
-
-```js
-/** @type { import("next-auth/adapters").Adapter } */
-const MyAdapter = () => {
-  return {
-    async getAdapter() {
-      return {
-        // your adapter methods here
-      }
-    },
-  }
-}
-```
-
-:::note
-This will work in code editors with a strong TypeScript integration like VSCode or WebStorm. It might not work if you're using more lightweight editors like VIM or Atom.
-:::

www/docs/adapters/prisma.md

@@ -1,10 +1,63 @@
+---
+id: prisma
+title: Prisma Adapter
+---
+
 # Prisma
 
-Schema for the Prisma2 Adapter (`@next-auth/prisma-adapter`)
+You can also use NextAuth.js with the new experimental Adapter for [Prisma](https://www.prisma.io/docs/). This version of the Prisma Adapter is not included in the core `next-auth` package, and must be installed separately.
 
-## Schema
+:::info
+You may have noticed there is a `prisma` and `prisma-legacy` adapter. This is due to historical reasons, but the code has mostly converged so that there is no longer much difference between the two. The legacy adapter, however, does have the ability to rename tables which the newer version does not.
+:::
+
+To use this Adapter, you need to install Prisma Client, Prisma CLI, and the separate `@next-auth/prisma-adapter@canary` package:
+
+```
+npm install @prisma/client @next-auth/prisma-adapter@canary
+npm install prisma --save-dev
+```
+
+Configure your NextAuth.js to use the Prisma Adapter:
+
+```javascript title="pages/api/auth/[...nextauth].js"
+import NextAuth from "next-auth"
+import Providers from "next-auth/providers"
+import { PrismaAdapter } from "@next-auth/prisma-adapter"
+import { PrismaClient } from "@prisma/client"
+
+const prisma = new PrismaClient()
+
+export default NextAuth({
+  providers: [
+    Providers.Google({
+      clientId: process.env.GOOGLE_CLIENT_ID,
+      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+    }),
+  ],
+  adapter: PrismaAdapter(prisma),
+})
+```
+
+:::tip
+While Prisma includes an experimental feature in the migration command that is able to generate SQL from a schema, creating tables and columns using the provided SQL is currently recommended instead as SQL schemas automatically generated by Prisma may differ from the recommended schemas.
+:::
+Schema for the Prisma Adapter (`@next-auth/prisma-adapter`)
+
+## Setup
+
+Create a schema file in `prisma/schema.prisma` similar to this one:
+
+```json title="schema.prisma"
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "sqlite"
+  url      = "file:./dev.db"
+}
 
-```prisma filename="schema.prisma"
 model Account {
   id                 String    @id @default(cuid())
   userId             String
@@ -57,6 +110,26 @@ model VerificationRequest {
 
 ```
 
+### Generate Client
+
+Once you have saved your schema, use the Prisma CLI to generate the Prisma Client:
+
+```
+npx prisma generate
+```
+
+To configure you database to use the new schema (i.e. create tables and columns) use the `prisma migrate` command:
+
+```
+npx prisma migrate dev
+```
+
+To generate a schema in this way with the above example code, you will need to specify your datbase connection string in the environment variable `DATABASE_URL`. You can do this by setting it in a `.env` file at the root of your project.
+
+As this feature is experimental in Prisma, it is behind a feature flag. You should check your database schema manually after using this option. See the [Prisma documentation](https://www.prisma.io/docs/) for information on how to use `prisma migrate`.
+
+## Schema History
+
 Changes from the original Prisma Adapter
 
 ```diff
@@ -142,3 +215,4 @@ Changes from the original Prisma Adapter
 -  @@map(name: "verification_requests")
 +  @@unique([identifier, token])
  }
+```

www/docs/adapters/typeorm/overview.md

@@ -0,0 +1,49 @@
+---
+id: typeorm-overview
+title: Overview
+---
+
+## TypeORM Adapter
+
+NextAuth.js comes with a default Adapter that uses [TypeORM](https://typeorm.io/) so that it can be used with many different databases without any further configuration, you simply add the node module for the database driver you want to use in your project and pass a database connection string to NextAuth.js.
+
+### Database Schemas
+
+Configure your database by creating the tables and columns to match the schema expected by NextAuth.js.
+
+- [MySQL Schema](./mysql)
+- [Postgres Schema](./postgres)
+- [Microsoft SQL Server Schema](./mssql)
+- [MongoDB](./mongodb)
+
+The default Adapter is the TypeORM Adapter and the default database type for TypeORM is SQLite, the following configuration options are exactly equivalent.
+
+```javascript
+database: {
+  type: 'sqlite',
+  database: ':memory:',
+  synchronize: true
+}
+```
+
+```javascript
+adapter: Adapters.Default({
+  type: "sqlite",
+  database: ":memory:",
+  synchronize: true,
+})
+```
+
+```javascript
+adapter: Adapters.TypeORM.Adapter({
+  type: "sqlite",
+  database: ":memory:",
+  synchronize: true,
+})
+```
+
+The tutorial [Custom models with TypeORM](/tutorials/typeorm-custom-models) explains how to extend the built in models and schemas used by the TypeORM Adapter. You can use these models in your own code.
+
+:::tip
+The `synchronize` option in TypeORM will generate SQL that exactly matches the documented schemas for MySQL and Postgres. This will automatically apply any changes it finds in the entity model, therefore it **should not be enabled against production databases** as it may cause data loss if the configured schema does not match the expected schema!
+:::

www/docs/configuration/callbacks.md

@@ -78,11 +78,6 @@ When using NextAuth.js with a database, the User object will be either a user ob
 When using NextAuth.js without a database, the user object it will always be a prototype user object, with information extracted from the profile.
 :::
 
-:::tip
-If you only want to allow users who already have accounts in the database to sign in, you can check for the existence of a `user.id` property and reject any sign in attempts from accounts that do not have one.
-
-If you are using NextAuth.js without database and want to control who can sign in, you can check their email address or profile against a hard coded list in the `signIn()` callback.
-:::
 
 ## Redirect callback
 

www/docs/configuration/databases.md

@@ -18,7 +18,7 @@ NextAuth.js comes with multiple ways of connecting to a database:
 
 **This document covers the default adapter (TypeORM).**
 
-See the [documentation for adapters](/schemas/adapters) to learn more about using Prisma adapter or using a custom adapter.
+See the [documentation for adapters](/adapters/overview) to learn more about using Prisma adapter or using a custom adapter.
 
 To learn more about databases in NextAuth.js and how they are used, check out [databases in the FAQ](/faq#databases).
 
@@ -79,8 +79,8 @@ Using SQL to create tables and columns is the recommended way to set up an SQL d
 
 Check out the links below for SQL you can run to set up a database for NextAuth.js.
 
-- [MySQL Schema](/schemas/mysql)
-- [Postgres Schema](/schemas/postgres)
+- [MySQL Schema](/adapters/typeorm/mysql)
+- [Postgres Schema](/adapters/typeorm/postgres)
 
 _If you are running SQLite, MongoDB or a Document database you can skip this step._
 
@@ -219,4 +219,4 @@ database: "sqlite://localhost/:memory:"
 
 ## Other databases
 
-See the [documentation for adapters](/schemas/adapters) for more information on advanced configuration, including how to use NextAuth.js with other databases using a [custom adapter](/tutorials/creating-a-database-adapter).
+See the [documentation for adapters](/adapters/overview) for more information on advanced configuration, including how to use NextAuth.js with other databases using a [custom adapter](/tutorials/creating-a-database-adapter).

www/docs/configuration/options.md

@@ -309,7 +309,7 @@ By default NextAuth.js uses a database adapter that uses TypeORM and supports My
 
 You can use the `adapter` option to use the Prisma adapter - or pass in your own adapter if you want to use a database that is not supported by one of the built-in adapters.
 
-See the [adapter documentation](/schemas/adapters) for more information.
+See the [adapter documentation](/adapters/overview) for more information.
 
 :::note
 If the `adapter` option is specified it overrides the `database` option, only specify one or the other.

www/docs/configuration/pages.md

@@ -28,7 +28,7 @@ We purposefully restrict the returned error codes for increased security.
 The following errors are passed as error query parameters to the default or overriden error page:
 
 - **Configuration**: There is a problem with the server configuration. Check if your [options](/configuration/options#options) is correct.
-- **AccessDenied**: Usually occurs, when you restriected access through the [`signIn` callback](/configuration/callbacks#sign-in-callback), or [`redirect` callback](/configuration/callbacks#redirect-callback)
+- **AccessDenied**: Usually occurs, when you restricted access through the [`signIn` callback](/configuration/callbacks#sign-in-callback), or [`redirect` callback](/configuration/callbacks#redirect-callback)
 - **Verification**: Related to the Email provider. The token has expired or has already been used
 - **Default**: Catch all, will apply, if none of the above matched
 

www/docs/configuration/providers.md

@@ -254,22 +254,26 @@ providers: [
       username: { label: "Username", type: "text", placeholder: "jsmith" },
       password: {  label: "Password", type: "password" }
     },
-   async authorize(credentials, req) {
-      const user = (credentials, req) => {
-        // You need to provide your own logic here that takes the credentials
-        // submitted and returns either a object representing a user or value
-        // that is false/null if the credentials are invalid.
-        // e.g. return { id: 1, name: 'J Smith', email: 'jsmith@example.com' }
-        // You can also use the request object to obtain additional parameters 
-        // (i.e., the request IP address)   
-        return null
-      }
-      if (user) {
-        // Any user object returned here will be saved in the JSON Web Token
+    async authorize(credentials, req) {
+      // You need to provide your own logic here that takes the credentials
+      // submitted and returns either a object representing a user or value
+      // that is false/null if the credentials are invalid.
+      // e.g. return { id: 1, name: 'J Smith', email: 'jsmith@example.com' }
+      // You can also use the `req` object to obtain additional parameters
+      // (i.e., the request IP address) 
+      const res = await fetch("/your/endpoint", {
+        method: 'POST',
+        body: JSON.stringify(credentials),
+        headers: { "Content-Type": "application/json" }
+      })
+      const user = await res.json()
+      
+      // If no error and we have user data, return it
+      if (res.ok && user) {
         return user
-      } else {
-        return null
       }
+      // Return null if user data could not be retrieved
+      return null
     }
   })
 ]

www/docs/faq.md

@@ -216,7 +216,7 @@ By default tokens are signed (JWS) but not encrypted (JWE), as encryption adds a
 
 * JSON Web Tokens in NextAuth.js use JWS and are signed using HS512 with an auto-generated key.
 
-* If encryption is enabled by setting `jwt: { encrypt: true }` option then the JWT will _also_ use JWE to encrypt the token, using A256GCM with an auto-generated key.
+* If encryption is enabled by setting `jwt: { encryption: true }` option then the JWT will _also_ use JWE to encrypt the token, using A256GCM with an auto-generated key.
 
 You can specify other valid algorithms - [as specified in RFC 7518](https://tools.ietf.org/html/rfc7517) - with either a  secret (for symmetric encryption) or a public/private key pair (for a symmetric encryption).
 

www/docs/getting-started/client.md

@@ -266,7 +266,7 @@ You can also set these parameters through [`provider.authorizationParams`](/conf
 :::
 
 :::note
-The following parameters are always overridden server-side: `redirect_uri`, `scope`, `state`
+The following parameters are always overridden server-side: `redirect_uri`, `state`
 :::
 
 ---

www/docs/getting-started/example.md

@@ -5,10 +5,10 @@ title: Example Code
 
 ## Get started with NextAuth.js
 
-The example code below describes to add authentication to a Next.js app.
+The example code below describes how to add authentication to a Next.js app.
 
 :::tip
-The easiest way to get started is to clone the [example app](https://github.com/nextauthjs/next-auth-example) and follow the instructions in README.md. You can try out a live demo at [next-auth-example.now.sh](https://next-auth-example.now.sh)
+The easiest way to get started is to clone the [example app](https://github.com/nextauthjs/next-auth-example) and follow the instructions in README.md. You can try out a live demo at [next-auth-example.vercel.app](https://next-auth-example.vercel.app)
 :::
 
 ### Add API route

www/docs/providers/zoom.md

@@ -0,0 +1,34 @@
+---
+id: zoom
+title: Zoom
+---
+
+## Documentation
+
+https://marketplace.zoom.us/docs/guides/auth/oauth
+
+## Configuration
+
+https://marketplace.zoom.us
+
+## Options
+
+The **Zoom Provider** comes with a set of default options:
+
+- [Zoom Provider options](https://github.com/nextauthjs/next-auth/blob/main/src/providers/zoom.js)
+
+You can override any of the options to suit your own use case.
+
+## Example
+
+```js
+import Providers from `next-auth/providers`
+...
+providers: [
+  Providers.Zoom({
+    clientId: process.env.ZOOM_CLIENT_ID,
+    clientSecret: process.env.ZOOM_CLIENT_SECRET
+  })
+}
+...
+```

www/docs/schemas/fauna.md

@@ -1,43 +0,0 @@
-# FaunaDB
-
-FaunaDB Schema (`@next-auth/fauna-adapter`)
-
-## Setup
-
-```javascript
-CreateCollection({ name: 'accounts' })
-CreateCollection({ name: 'sessions' })
-CreateCollection({ name: 'users' })
-CreateCollection({ name: 'verification_requests' })
-CreateIndex({
-  name: 'account_by_provider_account_id',
-  source: Collection('accounts'),
-  unique: true,
-  terms: [
-    { field: ['data', 'providerId'] },
-    { field: ['data', 'providerAccountId'] },
-  ],
-})
-CreateIndex({
-  name: 'session_by_token',
-  source: Collection('sessions'),
-  unique: true,
-  terms: [{ field: ['data', 'sessionToken'] }],
-})
-CreateIndex({
-  name: 'user_by_email',
-  source: Collection('users'),
-  unique: true,
-  terms: [{ field: ['data', 'email'] }],
-})
-CreateIndex({
-  name: 'verification_request_by_token',
-  source: Collection('verification_requests'),
-  unique: true,
-  terms: [
-    { field: ['data', 'token'] }, 
-    { field: ['data', 'identifier'] }
-  ],
-})
-```
-

www/docs/tutorials.md

@@ -86,3 +86,7 @@ This `dev.to` tutorial walks one through adding NextAuth.js to an existing proje
 ### [Adding Sign in With Apple Next JS](https://thesiddd.com/blog/apple-auth)
 
 This tutorial walks step by step on how to get Sign In with Apple working (both locally and on a deployed website) using NextAuth.js.
+
+### [How to Authenticate Next.js Apps with Twitter & NextAuth.js](https://spacejelly.dev/posts/how-to-authenticate-next-js-apps-with-twitter-nextauth-js/)
+
+Learn how to add Twitter authentication and login to a Next.js app both clientside and serverside with NextAuth.js.

www/docs/tutorials/typeorm-custom-models.md

@@ -3,7 +3,7 @@ id: typeorm-custom-models
 title: Custom models with TypeORM
 ---
 
-NextAuth.js provides a set of [models and schemas](/schemas/models) for the built-in TypeORM adapter that you can easily extend.
+NextAuth.js provides a set of [models and schemas](/adapters/models) for the built-in TypeORM adapter that you can easily extend.
 
 You can use these models with MySQL, MariaDB, Postgres, MongoDB and SQLite.
 
@@ -79,5 +79,3 @@ export default NextAuth({
   ),
 })
 ```
-
-

www/sidebars.js

@@ -27,15 +27,28 @@ module.exports = {
     },
     {
       type: "category",
-      label: "Models & Schemas",
+      label: "Database Adapters",
       collapsed: true,
       items: [
-        "schemas/models",
-        "schemas/mysql",
-        "schemas/postgres",
-        "schemas/mssql",
-        "schemas/mongodb",
-        "schemas/adapters",
+        "adapters/overview",
+        "adapters/models",
+        {
+          type: "category",
+          label: "TypeORM",
+          collapsed: true,
+          items: [
+            "adapters/typeorm/typeorm-overview",
+            "adapters/typeorm/mysql",
+            "adapters/typeorm/postgres",
+            "adapters/typeorm/mssql",
+            "adapters/typeorm/mongodb",
+          ],
+        },
+        "adapters/fauna",
+        "adapters/prisma",
+        "adapters/prisma-legacy",
+        "adapters/dynamodb",
+        "adapters/firebase",
       ],
     },
     {
@@ -49,5 +62,7 @@ module.exports = {
         },
       ],
     },
+    "warnings",
+    "errors",
   ],
 }

www/src/pages/index.js

@@ -117,7 +117,7 @@ function Home() {
                     "button button--outline button--secondary button--lg rounded-pill",
                     styles.button
                   )}
-                  href="https://next-auth-example.now.sh"
+                  href="https://next-auth-example.vercel.app"
                 >
                   Live Demo
                 </a>

www/vercel.json

@@ -0,0 +1,10 @@
+{
+  "redirects": [
+    { "source": "/schemas/models", "destination": "/adapters/models", "permanent": true },
+    { "source": "/schemas/mysql", "destination": "/adapters/typeorm/mysql", "permanent": true },
+		{ "source": "/schemas/postgres", "destination": "/adapters/typeorm/postgres", "permanent": true },
+    { "source": "/schemas/mssql", "destination": "/adapters/typeorm/mssql", "permanent": true },
+    { "source": "/schemas/mongodb", "destination": "/adapters/typeorm/mongodb", "permanent": true },
+    { "source": "/schemas/adapters", "destination": "/adapters/overview", "permanent": true }
+  ]
+}