feat(provider): add Coinbase provider (#2153)

Co-authored-by: Balázs Orbán <info@balazsorban.com>

CONTRIBUTING.md

@@ -95,7 +95,7 @@ The databases can take a few seconds to start up, so you might need to give it a
 
 ## For maintainers
 
-We use [semantic-release](https://github.com/semantic-release/semantic-release) together with [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0) to automate releases. This makes the maintainenance process easier and less error-prone to human error. Please study the "Conventional Commits" site to understand how to write a good commit message.
+We use [semantic-release](https://github.com/semantic-release/semantic-release) together with [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0) to automate releases. This makes the maintenance process easier and less error-prone to human error. Please study the "Conventional Commits" site to understand how to write a good commit message.
 
 When accepting Pull Requests, make sure the following:
 
@@ -113,9 +113,9 @@ type(scope): title
 body
 ```
 
-Scope is the part that will help groupping the different commit types in the release notes.
+Scope is the part that will help grouping the different commit types in the release notes.
 
-Some recommened scopes are:
+Some recommended scopes are:
 
 - **provider** - Provider related changes. (eg.: "feat(provider): add X provider", "docs(provider): fix typo in X documentation"
 - **adapter** - Adapter related changes. (eg.: "feat(adapter): add X provider", "docs(provider): fix typo in X documentation"

README.md

@@ -81,7 +81,7 @@ Advanced options allow you to define your own routines to handle controlling wha
 
 ### TypeScript
 
-NextAuth.js comes with built-in types. For more information and usage, check out the [TypeScript section](https://next-auth.js.org/getting-started/typescript) in the documentaion.
+NextAuth.js comes with built-in types. For more information and usage, check out the [TypeScript section](https://next-auth.js.org/getting-started/typescript) in the documentation.
 
 The package at `@types/next-auth` is now deprecated.
 

SECURITY.md

@@ -17,7 +17,7 @@ If you contact us regarding a serious issue:
 * We will endeavor to get back to you within 72 hours.
 * We will aim to publish a fix within 30 days.
 * We will disclose the issue (and credit you, with your consent) once a fix to resolve the issue has been released.
-* If 90 days has elapsed and we still don't have a fix, we will disclose the issue publically.
+* If 90 days has elapsed and we still don't have a fix, we will disclose the issue publicly.
 
 Currently, the best way to report an issue is by emailing me@iaincollins.com
 

package.json

@@ -29,6 +29,7 @@
     "./errors": "./dist/lib/errors.js"
   },
   "scripts": {
+    "postinstall": "npx husky install",
     "build": "npm run build:js && npm run build:css",
     "build:js": "node ./config/build.js && babel --config-file ./config/babel.config.js src --out-dir dist",
     "build:css": "postcss --config config/postcss.config.js src/**/*.css --base src --dir dist && node config/wrap-css.js",

src/providers/coinbase.js

@@ -0,0 +1,24 @@
+export default function Coinbase(options) {
+  return {
+    id: "coinbase",
+    name: "Coinbase",
+    type: "oauth",
+    version: "2.0",
+    scope: "wallet:user:email wallet:user:read",
+    params: { grant_type: "authorization_code" },
+    accessTokenUrl: "https://api.coinbase.com/oauth/token",
+    requestTokenUrl: "https://api.coinbase.com/oauth/token",
+    authorizationUrl:
+      "https://www.coinbase.com/oauth/authorize?response_type=code",
+    profileUrl: "https://api.coinbase.com/v2/user",
+    profile(profile) {
+      return {
+        id: profile.data.id,
+        name: profile.data.name,
+        email: profile.data.email,  
+        image: profile.data.avatar_url,
+      }
+    },
+    ...options,
+  }
+}

types/providers.d.ts

@@ -63,6 +63,7 @@ export type OAuthProviderType =
   | "Box"
   | "Bungie"
   | "Cognito"
+  | "Coinbase"
   | "Discord"
   | "Dropbox"
   | "EVEOnline"

www/docs/adapters/dynamodb.md

@@ -19,9 +19,10 @@ You can find the full schema in the table structure section below.
 npm install next-auth @next-auth/dynamodb-adapter@canary
 ```
 
-2. Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object.
+2. Add this adapter to your `pages/api/auth/[...nextauth].js` next-auth configuration object.
 
-You need to pass `aws-sdk` to the adapter in addition to the table name.
+You need to pass `DocumentClient` instance from `aws-sdk` to the adapter.
+The default table name is `next-auth`, but you can customise that by passing `{ tableName: 'your-table-name' }` as the second parameter in the adapter.
 
 ```javascript title="pages/api/auth/[...nextauth].js"
 import AWS from "aws-sdk";
@@ -48,10 +49,9 @@ export default NextAuth({
     }),
     // ...add more providers here
   ],
-  adapter: DynamoDBAdapter({
-    AWS,
-    tableName: "next-auth-test",
-  }),
+  adapter: DynamoDBAdapter(
+    new AWS.DynamoDB.DocumentClient()
+  ),
   ...
 });
 ```
@@ -63,7 +63,7 @@ export default NextAuth({
 The table respects the single table design pattern. This has many advantages:
 
 - Only one table to manage, monitor and provision.
-- Querying relations is faster than with multi-table schemas (for eg. retreiving all sessions for a user).
+- Querying relations is faster than with multi-table schemas (for eg. retrieving all sessions for a user).
 - Only one table needs to be replicated, if you want to go multi-region.
 
 Here is a schema of the table :

www/docs/adapters/pouchdb.md

@@ -0,0 +1,63 @@
+---
+id: pouchdb
+title: PouchDB Adapter
+---
+
+# PouchDB
+
+This is the PouchDB Adapter for [`next-auth`](https://next-auth.js.org). This package can only be used in conjunction with the primary `next-auth` package. It is not a standalone package.
+
+Depending on your architecture you can use PouchDB's http adapter to reach any database compliant with the CouchDB protocol (CouchDB, Cloudant, ...) or use any other PouchDB compatible adapter (leveldb, in-memory, ...)
+
+## Getting Started
+
+> **Prerequesite**: Your PouchDB instance MUST provide the `pouchdb-find` plugin since it is used internally by the adapter to build and manage indexes
+
+1. Install `next-auth` and `@next-auth/pouchdb-adapter@canary`
+
+```js
+npm install next-auth @next-auth/pouchdb-adapter@canary
+```
+
+2. Add this adapter to your `pages/api/auth/[...nextauth].js` next-auth configuration object
+
+```javascript title="pages/api/auth/[...nextauth].js"
+import NextAuth from "next-auth"
+import Providers from "next-auth/providers"
+import { PouchDBAdapter } from "@next-auth/pouchdb-adapter"
+import PouchDB from "pouchdb"
+
+// Setup your PouchDB instance and database
+PouchDB
+  .plugin(require("pouchdb-adapter-leveldb"))   // Any other adapter
+  .plugin(require("pouchdb-find"))              // Don't forget the `pouchdb-find` plugin
+  
+const pouchdb = new PouchDB("auth_db", { adapter: "leveldb" })
+
+// For more information on each option (and a full list of options) go to
+// https://next-auth.js.org/configuration/options
+export default NextAuth({
+  // https://next-auth.js.org/configuration/providers
+  providers: [
+    Providers.Google({
+      clientId: process.env.GOOGLE_ID,
+      clientSecret: process.env.GOOGLE_SECRET,
+    }),
+  ],
+  adapter: PouchDBAdapter(pouchdb),
+  // ...
+})
+```
+
+## Advanced 
+
+### Memory-First Caching Strategy
+
+If you need to boost your authentication layer performance, you may use PouchDB's powerful sync features and various adapters, to build a memory-first caching strategy.
+
+Use an in-memory PouchDB as your main authentication database, and synchronize it with any other persisted PouchDB. You may do a one way, one-off replication at startup from the persisted PouchDB into the in-memory PouchDB, then two-way, continuous, retriable sync.
+
+This will most likely not increase performance much in a serverless environment due to various reasons such as concurrency, function startup time increases, etc.
+
+For more details, please see https://pouchdb.com/api.html#sync
+

www/docs/adapters/prisma-legacy.md

@@ -129,10 +129,28 @@ To configure you database to use the new schema (i.e. create tables and columns)
 npx prisma migrate dev
 ```
 
-To generate a schema in this way with the above example code, you will need to specify your datbase connection string in the environment variable `DATABASE_URL`. You can do this by setting it in a `.env` file at the root of your project.
+To generate a schema in this way with the above example code, you will need to specify your database connection string in the environment variable `DATABASE_URL`. You can do this by setting it in a `.env` file at the root of your project.
 
 As this feature is experimental in Prisma, it is behind a feature flag. You should check your database schema manually after using this option. See the [Prisma documentation](https://www.prisma.io/docs/) for information on how to use `prisma migrate`.
 
+:::tip
+If you experience issues with Prisma opening too many database connections in local development mode (e.g. due to Hot Module Reloading) you can use an approach like this when initalising the Prisma Client:
+
+```javascript title="pages/api/auth/[...nextauth].js"
+let prisma
+
+if (process.env.NODE_ENV === "production") {
+  prisma = new PrismaClient()
+} else {
+  if (!global.prisma) {
+    global.prisma = new PrismaClient()
+  }
+  prisma = global.prisma
+}
+```
+
+:::
+
 ### Custom Models
 
 You can add properties to the schema and map them to any database column names you wish, but you should not change the base properties or types defined in the example schema.
@@ -154,21 +172,3 @@ adapter: Adapters.Prisma.Adapter({
 })
 ...
 ```
-
-:::tip
-If you experience issues with Prisma opening too many database connections in local development mode (e.g. due to Hot Module Reloading) you can use an approach like this when initalising the Prisma Client:
-
-```javascript title="pages/api/auth/[...nextauth].js"
-let prisma
-
-if (process.env.NODE_ENV === "production") {
-  prisma = new PrismaClient()
-} else {
-  if (!global.prisma) {
-    global.prisma = new PrismaClient()
-  }
-  prisma = global.prisma
-}
-```
-
-:::

www/docs/adapters/prisma.md

@@ -124,7 +124,7 @@ To configure you database to use the new schema (i.e. create tables and columns)
 npx prisma migrate dev
 ```
 
-To generate a schema in this way with the above example code, you will need to specify your datbase connection string in the environment variable `DATABASE_URL`. You can do this by setting it in a `.env` file at the root of your project.
+To generate a schema in this way with the above example code, you will need to specify your database connection string in the environment variable `DATABASE_URL`. You can do this by setting it in a `.env` file at the root of your project.
 
 As this feature is experimental in Prisma, it is behind a feature flag. You should check your database schema manually after using this option. See the [Prisma documentation](https://www.prisma.io/docs/) for information on how to use `prisma migrate`.
 

www/docs/configuration/callbacks.md

@@ -66,7 +66,7 @@ callbacks: {
 
 * When using the **Email Provider** the `signIn()` callback is triggered both when the user makes a **Verification Request** (before they are sent email with a link that will allow them to sign in) and again *after* they activate the link in the sign in email.
 
-  Email accounts do not have profiles in the same way OAuth accounts do. On the first call during email sign in the `profile` object will include an property `verificationRequest: true` to indicate it is being triggered in the verification request flow. When the callback is invoked *after* a user has clicked on a sign in link, this property will not be present.
+  Email accounts do not have profiles in the same way OAuth accounts do. On the first call during email sign in the `profile` object will include a property `verificationRequest: true` to indicate it is being triggered in the verification request flow. When the callback is invoked *after* a user has clicked on a sign in link, this property will not be present.
   
   You can check for the `verificationRequest` property to avoid sending emails to addresses or domains on a blocklist (or to only explicitly generate them for email address in an allow list).
 
@@ -78,6 +78,11 @@ When using NextAuth.js with a database, the User object will be either a user ob
 When using NextAuth.js without a database, the user object it will always be a prototype user object, with information extracted from the profile.
 :::
 
+:::note
+Redirects returned by this callback cancel the authentication flow. Only redirect to error pages that, for example, tell the user why they're not allowed to sign in.
+
+To redirect to a page after a successful sign in, please use [the `callbackUrl` option](/getting-started/client#specifying-a-callbackurl) or [the redirect callback](/configuration/callbacks#redirect-callback).
+:::
 
 ## Redirect callback
 
@@ -158,7 +163,7 @@ If you need to persist a large amount of data, you will need to persist it elsew
 
 ## Session callback
 
-The session callback is called whenever a session is checked. By default, only a subset of the token is returned for increased security. If you want to make something available you added to the token through the `jwt()` callback, you have to explicitely forward it here to make it available to the client.
+The session callback is called whenever a session is checked. By default, only a subset of the token is returned for increased security. If you want to make something available you added to the token through the `jwt()` callback, you have to explicitly forward it here to make it available to the client.
 
 e.g. `getSession()`, `useSession()`, `/api/auth/session`
 

www/docs/configuration/options.md

@@ -66,7 +66,7 @@ See the [providers documentation](/configuration/providers) for a list of suppor
 
 #### Description
 
-A random string used to hash tokens, sign cookies and generate crytographic keys.
+A random string used to hash tokens, sign cookies and generate cryptographic keys.
 
 If not specified, it uses a hash for all configuration options, including Client ID / Secrets for entropy.
 

www/docs/errors.md

@@ -21,7 +21,7 @@ This error occurs when the `useSession()` React Hook has a problem fetching sess
 
 #### CLIENT_FETCH_ERROR
 
-If you see `CLIENT_FETCH_ERROR` make sure you have configured the `NEXTAUTH_URL` envionment variable.
+If you see `CLIENT_FETCH_ERROR` make sure you have configured the `NEXTAUTH_URL` environment variable.
 
 ---
 
@@ -63,9 +63,9 @@ The Email authentication provider can only be used if a database is configured.
 
 The Credentials Provider can only be used if JSON Web Tokens are used for sessions.
 
-JSON Web Tokens are used for Sessions by default if you have not specified a database. However if you are using a database, then Database Sessions are enabled by default and you need to [explictly enable JWT Sessions](https://next-auth.js.org/configuration/options#session) to use the Credentials Provider.
+JSON Web Tokens are used for Sessions by default if you have not specified a database. However if you are using a database, then Database Sessions are enabled by default and you need to [explicitly enable JWT Sessions](https://next-auth.js.org/configuration/options#session) to use the Credentials Provider.
 
-If you are using a Credentials Provider, NextAuth.js will not persist users or sessions in a database - user accounts used with the Credentials Provider must be created and manged outside of NextAuth.js.
+If you are using a Credentials Provider, NextAuth.js will not persist users or sessions in a database - user accounts used with the Credentials Provider must be created and managed outside of NextAuth.js.
 
 In _most cases_ it does not make sense to specify a database in NextAuth.js options and support a Credentials Provider.
 

www/docs/faq.md

@@ -186,7 +186,7 @@ JSON Web Tokens can be used for session tokens, but are also used for lots of ot
 
 * You can enable encryption (JWE) to store include information directly in a JWT session token that you wish to keep secret and use the token to pass information between services / APIs on the same domain.
 
-* You can use JWT to securely store information you do not mind the client knowing even without encryption, as the JWT is stored in an server-readable-only-token so data in the JWT is not accessible to third party JavaScript running on your site.
+* You can use JWT to securely store information you do not mind the client knowing even without encryption, as the JWT is stored in a server-readable-only-token so data in the JWT is not accessible to third party JavaScript running on your site.
 
 ### What are the disadvantages of JSON Web Tokens?
 

www/docs/getting-started/client.md

@@ -22,7 +22,7 @@ The NextAuth.js client library makes it easy to interact with sessions from Reac
 :::tip
 The session data returned to the client does not contain sensitive information such as the Session Token or OAuth tokens. It contains a minimal payload that includes enough data needed to display information on a page about the user who is signed in for presentation purposes (e.g name, email, image).
 
-You can use the [session callback](/configuration/callbacks#session) to customize the session object returned to the client if you need to return additional data in the session object.
+You can use the [session callback](/configuration/callbacks#session-callback) to customize the session object returned to the client if you need to return additional data in the session object.
 :::
 
 ---
@@ -208,7 +208,7 @@ e.g.
 * `signIn('google', { callbackUrl: 'http://localhost:3000/foo' })`
 * `signIn('email', { email, callbackUrl: 'http://localhost:3000/foo' })`
 
-The URL must be considered valid by the [redirect callback handler](/configuration/callbacks#redirect). By default it requires the URL to be an absolute URL at the same hostname, or else it will redirect to the homepage. You can define your own redirect callback to allow other URLs, including supporting relative URLs.
+The URL must be considered valid by the [redirect callback handler](/configuration/callbacks#redirect-callback). By default it requires the URL to be an absolute URL at the same hostname, or else it will redirect to the homepage. You can define your own [redirect callback](/configuration/callbacks#redirect-callback) to allow other URLs, including supporting relative URLs.
 
 #### Using the redirect: false option
 
@@ -294,7 +294,7 @@ As with the `signIn()` function, you can specify a `callbackUrl` parameter by pa
 
 e.g. `signOut({ callbackUrl: 'http://localhost:3000/foo' })`
 
-The URL must be considered valid by the [redirect callback handler](/configuration/callbacks#redirect). By default this means it must be an absolute URL at the same hostname (or else it will default to the homepage); you can define your own custom redirect callback to allow other URLs, including supporting relative URLs.
+The URL must be considered valid by the [redirect callback handler](/configuration/callbacks#redirect-callback). By default this means it must be an absolute URL at the same hostname (or else it will default to the homepage); you can define your own custom [redirect callback](/configuration/callbacks#redirect-callback) to allow other URLs, including supporting relative URLs.
 
 #### Using the redirect: false option
 
@@ -344,7 +344,7 @@ export async function getServerSideProps(ctx) {
 }
 ```
 
-If every one of your pages needs to be protected, you can do this in `_app`, otherwise you can do it on a page-by-page basis. Alternatively, there is you can do per page authentication checks client side, instead of having each auth check be blocking (SSR) by using the method described below in [alternative client session handling](#custom-client-session-handling).
+If every one of your pages needs to be protected, you can do this in `_app`, otherwise you can do it on a page-by-page basis. Alternatively, you can do per page authentication checks client side, instead of having each auth check be blocking (SSR) by using the method described below in [alternative client session handling](#custom-client-session-handling).
 
 ### Options
 
@@ -385,7 +385,7 @@ The `clientMaxAge` option is the maximum age a session data can be on the client
 
 When `clientMaxAge` is set to `0` (the default) the cache will always be used when useSession is called and only explicit calls made to get the session status (i.e. `getSession()`) or event triggers, such as signing in or out in another tab/window, or a tab/window gaining or losing focus, will trigger an update of the session state.
 
-If set to any value other than zero, it specifies in seconds the maxium age of session data on the client before the `useSession()` hook will call the server again to sync the session state.
+If set to any value other than zero, it specifies in seconds the maximum age of session data on the client before the `useSession()` hook will call the server again to sync the session state.
 
 Unless you have a short session expiry time (e.g. < 24 hours) you probably don't need to change this option. Setting this option to too short a value will increase load (and potentially hosting costs).
 
@@ -461,7 +461,7 @@ AdminDashboard.auth = {
 }
 ```
 
-Because of how _app is done, it won't unnecessarily contant the /api/auth/session endpoint for pages that do not require auth.
+Because of how _app is done, it won't unnecessarily contact the /api/auth/session endpoint for pages that do not require auth.
 
 More information can be found in the following [Github Issue](https://github.com/nextauthjs/next-auth/issues/1210).
 

www/docs/providers/apple.md

@@ -45,7 +45,7 @@ providers: [
 
 :::tip
 
-You can convert your Apple key to a single line to use it in a environment variable.
+You can convert your Apple key to a single line to use it in an environment variable.
 
 **Mac**
 

www/docs/providers/azure-ad-b2c.md

@@ -28,7 +28,7 @@ You can override any of the options to suit your own use case.
 - When asked for a redirection URL, use http://localhost:3000/api/auth/callback/azure-ad-b2c
 - Create a new secret and remember / copy its value immediately, it will disappear.
 
-In `.env.local` create the follwing entries:
+In `.env.local` create the following entries:
 
 ```
 AZURE_CLIENT_ID=<copy Application (client) ID here>

www/docs/providers/coinbase.md

@@ -0,0 +1,38 @@
+---
+id: coinbase
+title: Coinbase 
+---
+
+## Documentation
+
+https://developers.coinbase.com/api/v2      
+
+## Configuration
+
+https://www.coinbase.com/settings/api
+
+## Options
+
+The **Coinbase Provider** comes with a set of default options:
+
+- [Coinbase Provider options](https://github.com/nextauthjs/next-auth/blob/main/src/providers/coinbase.js)
+
+You can override any of the options to suit your own use case.
+
+## Example
+
+```js
+import Providers from `next-auth/providers`
+...
+providers: [
+  Providers.Coinbase({
+    clientId: process.env.COINBASE_CLIENT_ID,
+    clientSecret: process.env.COINBASE_CLIENT_SECRET
+  })
+]
+...
+```
+
+:::tip
+This Provider template has a 2 hour access token to it. A refresh token is also returned.
+:::

www/docs/providers/credentials.md

@@ -83,7 +83,7 @@ See the [callbacks documentation](/configuration/callbacks) for more information
 
 You can specify more than one credentials provider by specifying a unique `id` for each one.
 
-You can also use them in conjuction with other provider options.
+You can also use them in conjunction with other provider options.
 
 As with all providers, the order you specify them is the order they are displayed on the sign in page.
 

www/docs/providers/instagram.md

@@ -46,5 +46,5 @@ Email address is not returned by the Instagram API.
 :::
 
 :::tip
-Instagram display app required callback URL to be configured in your Facebook app and Facebook required you to use **https** even for localhost! In order to do that, you either need to [add an SSL to your localhost](https://www.freecodecamp.org/news/how-to-get-https-working-on-your-local-development-environment-in-5-minutes-7af615770eec/) or use a proxy such as [ngrock](https://ngrok.com/docs).
+Instagram display app required callback URL to be configured in your Facebook app and Facebook required you to use **https** even for localhost! In order to do that, you either need to [add an SSL to your localhost](https://www.freecodecamp.org/news/how-to-get-https-working-on-your-local-development-environment-in-5-minutes-7af615770eec/) or use a proxy such as [ngrok](https://ngrok.com/docs).
 :::

www/docs/tutorials.md

@@ -83,6 +83,10 @@ This example shows how to implement a fullstack app in TypeScript with Next.js u
 
 This `dev.to` tutorial walks one through adding NextAuth.js to an existing project. Including setting up the OAuth client id and secret, adding the API routes for authentication, protecting pages and API routes behind that authentication, etc.
 
+### [Introduction to NextAuth.js](https://www.youtube.com/watch?v=npZsJxWntJM)
+
+This is an introductory video to NextAuth.js for beginners. In this video, it is explained how to set up authentication in a few easy steps and add different configurations to make it more robust and secure.
+
 ### [Adding Sign in With Apple Next JS](https://thesiddd.com/blog/apple-auth)
 
 This tutorial walks step by step on how to get Sign In with Apple working (both locally and on a deployed website) using NextAuth.js.

www/sidebars.js

@@ -49,6 +49,7 @@ module.exports = {
         "adapters/prisma-legacy",
         "adapters/dynamodb",
         "adapters/firebase",
+        "adapters/pouchdb",
       ],
     },
     {