fix(page): fall back to default error page (#1700)

* chore: alias dev script to next

* feat(core): fallback to body when reading state

* refactor: set csrfToken on req.options implicitly

Ensures we do this similarly than
in other handlers like pkce, state, extendRes, callbackUrlHandler etc.

* chore: add code comment for debugging

config/babel.config.json

@@ -1,19 +1,12 @@
 {
   "presets": [
-    ["@babel/preset-env", { "targets": { "node": "10" } }]
+    ["@babel/preset-env", { "targets": { "esmodules": true } }]
   ],
   "comments": false,
   "overrides": [
-    {
-      "test": ["../src/client/**"],
-      "comments": true,
-      "presets": [
-        ["@babel/preset-env", { "targets": { "ie": "11" } }]
-      ]
-    },
     {
       "test": ["../src/server/pages/**"],
       "presets": ["preact"]
     }
   ]
-}
+}

package.json

@@ -5,6 +5,7 @@
   "homepage": "https://next-auth.js.org",
   "repository": "https://github.com/nextauthjs/next-auth.git",
   "author": "Iain Collins <me@iaincollins.com>",
+  "main": "index.js",
   "scripts": {
     "build": "npm run build:js && npm run build:css",
     "build:js": "babel --config-file ./config/babel.config.json src --out-dir dist",
@@ -32,15 +33,6 @@
     "lint": "ts-standard",
     "lint:fix": "ts-standard --fix"
   },
-  "main": "index.js",
-  "exports": {
-    ".": "./dist/server/index.js",
-    "./jwt": "./dist/lib/jwt.js",
-    "./adapters": "./dist/adapters/index.js",
-    "./client": "./dist/client/index.js",
-    "./providers": "./dist/providers/index.js",
-    "./providers/*": "./dist/providers/*.js"
-  },
   "files": [
     "dist",
     "index.js",
@@ -51,47 +43,29 @@
   ],
   "license": "ISC",
   "dependencies": {
+    "crypto-js": "^4.0.0",
     "futoin-hkdf": "^1.3.2",
     "jose": "^1.27.2",
     "jsonwebtoken": "^8.5.1",
+    "nodemailer": "^6.4.16",
     "oauth": "^0.9.15",
     "pkce-challenge": "^2.1.0",
     "preact": "^10.4.1",
-    "preact-render-to-string": "^5.1.14"
+    "preact-render-to-string": "^5.1.14",
+    "querystring": "^0.2.0",
+    "require_optional": "^1.0.1",
+    "typeorm": "^0.2.30"
   },
   "peerDependencies": {
     "react": "^16.13.1 || ^17",
-    "react-dom": "^16.13.1 || ^17",
-    "mongodb": "^3.6.6",
+    "react-dom": "^16.13.1 || ^17"
+  },
+  "peerOptionalDependencies": {
+    "mongodb": "^3.5.9",
     "mysql": "^2.18.1",
     "mssql": "^6.2.1",
     "pg": "^8.2.1",
-    "@prisma/client": "^2.16.1",
-    "nodemailer": "^6.4.16",
-    "typeorm": "^0.2.30"
-  },
-  "peerDependenciesMeta": {
-    "mongodb": {
-      "optional": true
-    },
-    "mysql": {
-      "optional": true
-    },
-    "mssql": {
-      "optional": true
-    },
-    "pg": {
-      "optional": true
-    },
-    "@prisma/client": {
-      "optional": true
-    },
-    "nodemailer": {
-      "optional": true
-    },
-    "typeorm": {
-      "optional": true
-    }
+    "@prisma/client": "^2.16.1"
   },
   "devDependencies": {
     "@babel/cli": "^7.8.4",
@@ -110,7 +84,7 @@
     "dotenv": "^8.2.0",
     "eslint": "^7.19.0",
     "mocha": "^8.1.3",
-    "mongodb": "^3.6.6",
+    "mongodb": "^3.5.9",
     "mssql": "^6.2.1",
     "mysql": "^2.18.1",
     "next": "^10.0.5",

src/adapters/typeorm/index.js

@@ -1,5 +1,6 @@
 import { createConnection, getConnection } from 'typeorm'
 import { createHash } from 'crypto'
+import require_optional from 'require_optional' // eslint-disable-line camelcase
 
 import { CreateUserError } from '../../lib/errors'
 import adapterConfig from './lib/config'
@@ -93,8 +94,12 @@ const Adapter = (typeOrmConfig, options = {}) => {
     let ObjectId
     if (config.type === 'mongodb') {
       idKey = '_id'
-      const mongodb = (await import('mongodb')).default
-      ObjectId = mongodb.ObjectID
+      // Using a dynamic import causes problems for some compilers/bundlers
+      // that don't handle dynamic imports. To try and work around this we are
+      // using the same method mongodb uses to load Object ID type, which is to
+      // use the require_optional loader.
+      const mongodb = require_optional('mongodb')
+      ObjectId = mongodb.ObjectId
     }
 
     // These values are stored as seconds, but to use them with dates in

src/providers/email.js

@@ -1,3 +1,4 @@
+import nodemailer from 'nodemailer'
 import logger from '../lib/logger'
 
 export default (options) => {
@@ -21,13 +22,13 @@ export default (options) => {
   }
 }
 
-async function sendVerificationRequest ({ identifier: email, url, baseUrl, provider }) {
-  const { server, from } = provider
-  // Strip protocol from URL and use domain as site name
-  const site = baseUrl.replace(/^https?:\/\//, '')
-  try {
-    const nodemailer = (await import('nodemailer')).default
-    await nodemailer
+const sendVerificationRequest = ({ identifier: email, url, baseUrl, provider }) => {
+  return new Promise((resolve, reject) => {
+    const { server, from } = provider
+    // Strip protocol from URL and use domain as site name
+    const site = baseUrl.replace(/^https?:\/\//, '')
+
+    nodemailer
       .createTransport(server)
       .sendMail({
         to: email,
@@ -35,11 +36,14 @@ async function sendVerificationRequest ({ identifier: email, url, baseUrl, provi
         subject: `Sign in to ${site}`,
         text: text({ url, site, email }),
         html: html({ url, site, email })
+      }, (error) => {
+        if (error) {
+          logger.error('SEND_VERIFICATION_EMAIL_ERROR', email, error)
+          return reject(new Error('SEND_VERIFICATION_EMAIL_ERROR', error))
+        }
+        return resolve()
       })
-  } catch (error) {
-    logger.error('SEND_VERIFICATION_EMAIL_ERROR', email, error)
-    throw new Error('SEND_VERIFICATION_EMAIL_ERROR')
-  }
+  })
 }
 
 // Email HTML body

src/server/index.js

@@ -1,3 +1,4 @@
+import adapters from '../adapters'
 import jwt from '../lib/jwt'
 import parseUrl from '../lib/parse-url'
 import logger, { setLogger } from '../lib/logger'
@@ -72,7 +73,7 @@ async function NextAuthHandler (req, res, userOptions) {
     // Protection only works on OAuth 2.x providers
     if (provider?.type === 'oauth' && provider.version?.startsWith('2')) {
       // When provider.state is undefined, we still want this to pass
-      if (!provider.protection) {
+      if (!provider.protection && provider.state !== false) {
         // Default to state, as we did in 3.1 REVIEW: should we use "pkce" or "none" as default?
         provider.protection = ['state']
       } else if (typeof provider.protection === 'string') {
@@ -85,11 +86,7 @@ async function NextAuthHandler (req, res, userOptions) {
     // Parse database / adapter
     // If adapter is provided, use it (advanced usage, overrides database)
     // If database URI or config object is provided, use it (simple usage)
-    let adapter = userOptions.adapter
-    if ((!adapter && !!userOptions.database)) {
-      const TypeOrm = (await import('../adapters/typeorm')).default
-      adapter = TypeOrm.Adapter(userOptions.database)
-    }
+    const adapter = userOptions.adapter ?? (userOptions.database && adapters.Default(userOptions.database))
 
     // User provided options are overriden by other options,
     // except for the options with special handling above

src/server/pages/error.js

@@ -52,7 +52,7 @@ export default function error ({ baseUrl, basePath, error = 'default', res }) {
     }
   }
 
-  const { statusCode, heading, message, signin } = errors[error.toLowerCase()]
+  const { statusCode, heading, message, signin } = errors[error.toLowerCase()] ?? errors.default
 
   res.status(statusCode)
 

src/server/routes/callback.js

@@ -65,13 +65,18 @@ export default async function callback (req, res) {
 
         try {
           const signInCallbackResponse = await callbacks.signIn(userOrProfile, account, OAuthProfile)
-          if (!signInCallbackResponse) {
+          if (signInCallbackResponse === false) {
             return res.redirect(`${baseUrl}${basePath}/error?error=AccessDenied`)
           } else if (typeof signInCallbackResponse === 'string') {
             return res.redirect(signInCallbackResponse)
           }
         } catch (error) {
-          return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error.message)}`)
+          if (error instanceof Error) {
+            return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error.message)}`)
+          }
+          // TODO: Remove in a future major release
+          logger.warn('SIGNIN_CALLBACK_REJECT_REDIRECT')
+          return res.redirect(error)
         }
 
         // Sign user in
@@ -156,13 +161,18 @@ export default async function callback (req, res) {
       // Check if user is allowed to sign in
       try {
         const signInCallbackResponse = await callbacks.signIn(profile, account, { email })
-        if (!signInCallbackResponse) {
+        if (signInCallbackResponse === false) {
           return res.redirect(`${baseUrl}${basePath}/error?error=AccessDenied`)
         } else if (typeof signInCallbackResponse === 'string') {
           return res.redirect(signInCallbackResponse)
         }
       } catch (error) {
-        return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error.message)}`)
+        if (error instanceof Error) {
+          return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error.message)}`)
+        }
+        // TODO: Remove in a future major release
+        logger.warn('SIGNIN_CALLBACK_REJECT_REDIRECT')
+        return res.redirect(error)
       }
 
       // Sign user in
@@ -226,11 +236,12 @@ export default async function callback (req, res) {
       userObjectReturnedFromAuthorizeHandler = await provider.authorize(credentials)
       if (!userObjectReturnedFromAuthorizeHandler) {
         return res.status(401).redirect(`${baseUrl}${basePath}/error?error=CredentialsSignin&provider=${encodeURIComponent(provider.id)}`)
-      } else if (typeof userObjectReturnedFromAuthorizeHandler === 'string') {
-        return res.redirect(userObjectReturnedFromAuthorizeHandler)
       }
     } catch (error) {
-      return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error.message)}`)
+      if (error instanceof Error) {
+        return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error.message)}`)
+      }
+      return res.redirect(error)
     }
 
     const user = userObjectReturnedFromAuthorizeHandler
@@ -238,13 +249,14 @@ export default async function callback (req, res) {
 
     try {
       const signInCallbackResponse = await callbacks.signIn(user, account, credentials)
-      if (!signInCallbackResponse) {
+      if (signInCallbackResponse === false) {
         return res.status(403).redirect(`${baseUrl}${basePath}/error?error=AccessDenied`)
-      } else if (typeof signInCallbackResponse === 'string') {
-        return res.redirect(signInCallbackResponse)
       }
     } catch (error) {
-      return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error.message)}`)
+      if (error instanceof Error) {
+        return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error.message)}`)
+      }
+      return res.redirect(error)
     }
 
     const defaultJwtPayload = {

src/server/routes/signin.js

@@ -45,13 +45,18 @@ export default async function signin (req, res) {
     // Check if user is allowed to sign in
     try {
       const signInCallbackResponse = await callbacks.signIn(profile, account, { email, verificationRequest: true })
-      if (!signInCallbackResponse) {
+      if (signInCallbackResponse === false) {
         return res.redirect(`${baseUrl}${basePath}/error?error=AccessDenied`)
       } else if (typeof signInCallbackResponse === 'string') {
         return res.redirect(signInCallbackResponse)
       }
     } catch (error) {
-      return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error)}`)
+      if (error instanceof Error) {
+        return res.redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error)}`)
+      }
+      // TODO: Remove in a future major release
+      logger.warn('SIGNIN_CALLBACK_REJECT_REDIRECT')
+      return res.redirect(error)
     }
 
     try {

www/docs/warnings.md

@@ -46,4 +46,32 @@ You can use [node-jose-tools](https://www.npmjs.com/package/node-jose-tools) to
 
 **Option 2**: Specify custom encode/decode functions on the jwt object. This gives you complete control over signing / verification / etc.
 
-#### JWT_AUTO_GENERATED_ENCRYPTION_KEY
+#### JWT_AUTO_GENERATED_ENCRYPTION_KEY
+
+#### SIGNIN_CALLBACK_REJECT_REDIRECT
+
+You returned something in the `signIn` callback, that is being deprecated.
+
+You probably had something similar in the callback:
+```js
+  return Promise.reject("/some/url")
+```
+
+or
+
+```js
+  throw "/some/url"
+```
+
+To remedy this, simply return the url instead:
+
+```js
+  return "/some/url"
+```
+
+
+#### STATE_OPTION_DEPRECATION
+You provided `state: true` or `state: false` as a provider option. This is being deprecated in a later release in favour of `protection: "state"` and `protection: "none"` respectively. To remedy this warning:
+
+- If you use `state: true`, just simply remove it. The default is `protection: "state"` already..
+- If you use `state: false`, set `protection: "none"`.