feat(middleware): introduce withAuth Next.js method (#3657)

* feat(middleware): introduce Middleware API to Next.js

* chore(app): upgrade Next.js in dev app

* chore(dev): add Middleware protected page to dev app

* chore(middleware): add `next/middleware` to `exports`

* fix(middleware): bail out redirect on custom pages

* fix(middleware): allow one-line export

* chore(middleware): simplify code

* fix(middleware): redirect back to page after succesful login

* feat(middleware): re-export `withAuth` as `default`

* chore: export middleware from `next-auth/middleware`

* chore: add `middleware` files to npm

* feat(middleware): handle chaining, fix some bugs

* chore(dev): showcase different middlewares

* chore(middleware): remove `@ts-expect-error` comments

* chore: update build clean script

* fix: bail out when NextAuth.js paths

* refactor: be more explicit about `initConfig` result

* refactor: simplify

* refactor: use `callbacks` similarily to `NextAuthOptions`

* refactor: use `nextauth` namespace when setting `token` on `req`

* refactor: don't allow passing `secret`

* addressing review

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -10,7 +10,18 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for taking the time to fill out this bug report! Please provide the following information:
+        Thanks for taking the time to fill out this bug report!
+        ### Important :exclamation:
+        Please help us maintain this project more efficiently!
+        Is this your first time contributing? See this video https://www.youtube.com/watch?v=cuoNzXFLitc
+        
+        **Providing incorrect/insufficient information or skipping steps to reproduce the bug may result in closing the issue or converting to discussion without further explanation.**
+        
+        Before creating the issue make sure you shouldn't be creating it in one the below repos instead:
+        - Docs related: https://github.com/nextauthjs/docs
+        - Adapter related: https://github.com/nextauthjs/adapters
+        
+        If you are in the correct repo, then proceed by providing the following information:
   - type: textarea
     id: description
     attributes: 
@@ -44,8 +55,6 @@ body:
         We encourage you to use one of the templates set up on **CodeSandbox** to reproduce your issue:
         - [`next-auth-example`](https://codesandbox.io/s/next-auth-example-1kktb)
         - [`next-auth-typescript-example`](https://codesandbox.io/s/next-auth-typescript-example-se32w)
-
-        🚧 – _If you don't provide any way to reproduce the bug, the issue is at risk of being closed._
   
   - type: textarea
     id: logs

.github/ISSUE_TEMPLATE/feature_request.yaml

@@ -9,8 +9,14 @@ body:
   - type: markdown
     attributes:
       value: | 
-        Thank you very much for reaching out to us regarding the awesome feature that you believe should be included in the NextAuth.js library. Please provide the following information:
- 
+        Thank you very much for reaching out to us regarding the awesome feature that you believe should be included in the NextAuth.js library.
+        ### Important :exclamation:
+        Please help us maintain this project more efficiently! Before creating the issue make sure you shouldn't be creating it in one the below repos instead:
+        - Docs related: https://github.com/nextauthjs/docs
+        - Adapter related: https://github.com/nextauthjs/adapters
+        
+        If you are in the correct repo, then proceed by providing the following information:
+  
   - type: textarea
     id: description
     attributes:
@@ -65,4 +71,3 @@ body:
     attributes: 
       value: |
         It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
-  

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Build
         run: npm run build
       - name: Run tests
-        run: npm test -- --coverage --verbose && npm run test:types
+        run: npm test -- --coverage --verbose
       - name: Coverage
         uses: codecov/codecov-action@v1
         with:
@@ -66,11 +66,21 @@ jobs:
           node-version: 16
       - name: Dependencies
         uses: bahmutov/npm-install@v1
+      - name: Determine version
+        uses: ./config/version-pr
+        id: determine-version
+        env:
+          PR_NUMBER: ${{ github.event.number }}
       - name: Publish to npm
         run: |
           echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> .npmrc
-          npm run version:pr
           npm publish --access public --tag experimental
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          PR_NUMBER: ${{ github.event.number }}
+      - name: Comment version on PR
+        uses: NejcZdovc/comment-pr@v1
+        with:
+          message: "🎉 Experimental release [published on npm](https://www.npmjs.com/package/next-auth/v/${{ env.VERSION }})!\n\n```sh\nnpm i next-auth@${{ env.VERSION }}\n```\n```sh\nyarn add next-auth@${{ env.VERSION }}\n```"
+        env:
+          VERSION: ${{ steps.determine-version.outputs.version }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -24,33 +24,29 @@ node_modules
 # Generated files
 .docusaurus
 .cache-loader
-/internals
 /providers
-/types/providers/*
-!types/providers/index.d.ts
-!types/providers/email.d.ts
-!types/providers/credentials.d.ts
-!types/providers/oauth.d.ts
+/src/providers/oauth-types.ts
+/client
+/css
+/lib
+/core
+/jwt
+/react
 /adapters.d.ts
-/adapters.js
-/client.d.ts
-/client.js
 /index.d.ts
 /index.js
-/jwt.d.ts
-/jwt.js
-/errors.js
-/errors.d.ts
-/react.js
-/react.d.ts
+/next
+/middleware.d.ts
+/middleware.js
 
 # Development app
-app/next-auth
-app/dist/css
+app/src/css
 app/package-lock.json
 app/yarn.lock
 app/prisma/migrations
 app/prisma/dev.db*
+app/dist
+app/next-auth
 
 # VS
 /.vs/slnx.sqlite-journal
@@ -58,6 +54,9 @@ app/prisma/dev.db*
 /.vs
 .vscode
 
+# Jetbrains
+.idea
+
 # GitHub Actions runner
 /actions-runner
 /_work

CONTRIBUTING.md

@@ -25,7 +25,7 @@ Anyone can be a contributor. Either you found a typo, or you have an awesome fea
 
 A quick guide on how to setup _next-auth_ locally to work on it and test out any changes:
 
-The dev application requires you to use `npm@7`.
+The developer application requires you to use `npm@7`.
 
 1. Clone the repo:
 
@@ -34,7 +34,7 @@ git clone git@github.com:nextauthjs/next-auth.git
 cd next-auth
 ```
 
-2. Install packages, set up the dev application:
+2. Install packages and set up the developer application:
 
 ```sh
 npm run dev:setup
@@ -47,13 +47,13 @@ npm run dev:setup
 > NOTE: You can add any environment variables to .env.local that you would like to use in your dev app.
 > You can find the next-auth config under`app/pages/api/auth/[...nextauth].js`.
 
-1. Start the dev application/server:
+1. Start the developer application/server:
 
 ```sh
 npm run dev
 ```
 
-Your dev application will be available on `http://localhost:3000`
+Your developer application will be available on `http://localhost:3000`
 
 That's it! 🎉
 
@@ -61,9 +61,9 @@ If you need an example project to link to, you can use [next-auth-example](https
 
 #### Hot reloading
 
-When running `npm run dev`, you start a Next.js dev server on `http://localhost:3000`, which includes hot reloading out of the box. Make changes on any of the files in `src` and see the changes immediately.
+When running `npm run dev`, you start a Next.js developer server on `http://localhost:3000`, which includes hot reloading out of the box. Make changes on any of the files in `src` and see the changes immediately.
 
-> NOTE: When working on CSS, you will have to manually refresh the page after changes. The reason for this is our pages using CSS are server-side rendered. (Improving this through a PR is very welcome!)
+> NOTE: When working on CSS, you will have to manually refresh the page after changes. The reason for this is our pages using CSS are server-side rendered (using API routes). (Improving this through a PR is very welcome!)
 
 > NOTE: The setup is as follows: The development application lives inside the `app` folder, and whenever you make a change to the `src` folder in the root (where next-auth is), it gets copied into `app` every time (gitignored), so Next.js can pick them up and apply hot reloading. This is to avoid some annoying issues with how symlinks are working with different React builds, and also to provide a super-fast feedback loop while developing core features.
 

README.md

@@ -32,6 +32,11 @@ NextAuth.js is a complete open source authentication solution for [Next.js](http
 
 It is designed from the ground up to support Next.js and Serverless.
 
+This is the core repo for NextAuth.js. Check the repos below if you are interested in additional information:
+
+- Docs related: https://github.com/nextauthjs/docs
+- Adapter related: https://github.com/nextauthjs/adapters
+
 ## Getting Started
 
 ```
@@ -49,7 +54,7 @@ See [next-auth.js.org](https://next-auth.js.org) for more information and docume
 ### Flexible and easy to use
 
 - Designed to work with any OAuth service, it supports OAuth 1.0, 1.0A and 2.0
-- Built-in support for [many popular sign-in services](https://next-auth.js.org/configuration/providers)
+- Built-in support for [many popular sign-in services](https://next-auth.js.org/providers/overview)
 - Supports email / passwordless authentication
 - Supports stateless authentication with any backend (Active Directory, LDAP, etc)
 - Supports both JSON Web Tokens and database sessions
@@ -81,7 +86,8 @@ Advanced options allow you to define your own routines to handle controlling wha
 
 ### TypeScript
 
-NextAuth.js comes with built-in types. For more information and usage, check out the [TypeScript section](https://next-auth.js.org/getting-started/typescript) in the documentation.
+NextAuth.js comes with built-in types. For more information and usage, check out
+the [TypeScript section](https://next-auth.js.org/getting-started/typescript) in the documentation.
 
 ## Example
 
@@ -90,21 +96,24 @@ NextAuth.js comes with built-in types. For more information and usage, check out
 ```javascript
 // pages/api/auth/[...nextauth].js
 import NextAuth from "next-auth"
-import Providers from "next-auth/providers"
+import AppleProvider from "next-auth/providers/apple"
+import GoogleProvider from "next-auth/providers/google"
+import EmailProvider from "next-auth/providers/email"
 
 export default NextAuth({
+  secret: process.env.SECRET,
   providers: [
     // OAuth authentication providers
-    Providers.Apple({
+    AppleProvider({
       clientId: process.env.APPLE_ID,
       clientSecret: process.env.APPLE_SECRET,
     }),
-    Providers.Google({
+    GoogleProvider({
       clientId: process.env.GOOGLE_ID,
       clientSecret: process.env.GOOGLE_SECRET,
     }),
     // Sign in with passwordless email link
-    Providers.Email({
+    EmailProvider({
       server: process.env.MAIL_SERVER,
       from: "<no-reply@example.com>",
     }),
@@ -140,7 +149,7 @@ export default function Component() {
 
 ### Share/configure session state
 
-Use the `<SessionProvider>` to allows instances of `useSession()` to share the session object across components. It also takes care of keeping the session updated and synced between tabs/windows.
+Use the `<SessionProvider>` to allow instances of `useSession()` to share the session object across components. It also takes care of keeping the session updated and synced between tabs/windows.
 
 ```jsx title="pages/_app.js"
 import { SessionProvider } from "next-auth/react"
@@ -170,7 +179,7 @@ export default function App({
 
 ### Support
 
-We're happy to announce we've recently created an [OpenCollective](https://opencollective.org/nextauth) for individuals and companies looking to contribute financially to the project!
+We're happy to announce we've recently created an [OpenCollective](https://opencollective.com/nextauth) for individuals and companies looking to contribute financially to the project!
 
 <!--sponsors start-->
 <table>
@@ -190,6 +199,13 @@ We're happy to announce we've recently created an [OpenCollective](https://openc
         <div>Prisma</div><br />
         <sub>🥉 Bronze Financial Sponsor</sub>
       </td>
+      <td align="center" valign="top">
+        <a href="https://clerk.dev" target="_blank">
+          <img width="128px" src="https://avatars.githubusercontent.com/u/49538330?s=200&v=4" alt="Prisma Logo" />
+        </a><br />
+        <div>Clerk</div><br />
+        <sub>🥉 Bronze Financial Sponsor</sub>
+      </td>
       <td align="center" valign="top">
         <a href="https://checklyhq.com" target="_blank">
           <img width="128px" src="https://avatars.githubusercontent.com/u/25982255?v=4" alt="Checkly Logo" />
@@ -197,6 +213,13 @@ We're happy to announce we've recently created an [OpenCollective](https://openc
         <div>Checkly</div><br />
         <sub>☁️ Infrastructure Support</sub>
       </td>
+      <td align="center" valign="top">
+        <a href="https://superblog.ai/" target="_blank">
+          <img width="128px" src="https://d33wubrfki0l68.cloudfront.net/cdc4a3833bd878933fcc131655878dbf226ac1c5/10cd6/images/logo_bolt_small.png" alt="superblog Logo" />
+        </a><br />
+        <div>superblog</div><br />
+        <sub>☁️ Infrastructure Support</sub>
+      </td>
     </tr><tr></tr>
   </tbody>
 </table>
@@ -205,7 +228,8 @@ We're happy to announce we've recently created an [OpenCollective](https://openc
 
 ## Contributing
 
-We're open to all community contributions! If you'd like to contribute in any way, please first read our [Contributing Guide](https://github.com/nextauthjs/next-auth/blob/canary/CONTRIBUTING.md).
+We're open to all community contributions! If you'd like to contribute in any way, please first read
+our [Contributing Guide](https://github.com/nextauthjs/next-auth/blob/main/CONTRIBUTING.md).
 
 ## License
 

SECURITY.md

@@ -2,12 +2,6 @@
 
 NextAuth.js practices responsible disclosure.
 
-## Supported Versions
-
-Security updates are only released for the current version.
-
-Old releases are not maintained and do not receive updates.
-
 ## Reporting a Vulnerability
 
 We request that you contact us directly to report serious issues that might impact the security of sites using NextAuth.js.
@@ -19,6 +13,12 @@ If you contact us regarding a serious issue:
 - We will disclose the issue (and credit you, with your consent) once a fix to resolve the issue has been released.
 - If 90 days has elapsed and we still don't have a fix, we will disclose the issue publicly.
 
-Currently, the best way to report an issue is by contacting us via email at me@iaincollins.com or info@balazsorban.com and yo@ndo.dev.
+The best way to report an issue is by contacting us via email at info@balazsorban.com or me@iaincollins.com and yo@ndo.dev, or raise a public issue requesting someone get in touch with you via whatever means you prefer for more details. (Please do not disclose sensitive details publicly at this stage.)
 
-For less serious issues (e.g. RFC compliance for unsupported flows or potential issues that may cause a problem future or default behaviour / options) it is appropriate to submit these these publically as bug reports or feature requests or to raise a question to open a discussion around them.
+> For less serious issues (e.g. RFC compliance for unsupported flows or potential issues that may cause a problem in the future) it is appropriate to submit these these publically as bug reports or feature requests or to raise a question to open a discussion around them.
+
+## Supported Versions
+
+Security updates are only released for the current version.
+
+Old releases are not maintained and do not receive updates.

app/.env.local.example

@@ -7,7 +7,7 @@ NEXTAUTH_URL=http://localhost:3000
 # https://generate-secret.vercel.app/32 to generate a secret.
 # Note: Changing a secret may invalidate existing sessions
 # and/or verification tokens.
-SECRET=secret
+NEXTAUTH_SECRET=secret
 
 AUTH0_ID=
 AUTH0_SECRET=
@@ -28,4 +28,21 @@ TWITCH_ID=
 TWITCH_SECRET=
 
 TWITTER_ID=
-TWITTER_SECRET=
+TWITTER_SECRET=
+
+LINE_ID=
+LINE_SECRET=
+
+TRAKT_ID=
+TRAKT_SECRET=
+
+# Example configuration for a Gmail account (will need SMTP enabled)
+EMAIL_SERVER=smtps://user@gmail.com:password@smtp.gmail.com:465
+EMAIL_FROM=user@gmail.com
+
+# Note: If using with Prisma adapter, you need to use a `.env`
+# file rather than a `.env.local` file to configure env vars.
+# Postgres: DATABASE_URL=postgres://nextauth:password@127.0.0.1:5432/nextauth?synchronize=true
+# MySQL:    DATABASE_URL=mysql://nextauth:password@127.0.0.1:3306/nextauth?synchronize=true
+# MongoDB:  DATABASE_URL=mongodb://nextauth:password@127.0.0.1:27017/nextauth?synchronize=true
+DATABASE_URL=

app/.nvmrc

@@ -0,0 +1 @@
+16

app/components/header.js

@@ -39,15 +39,13 @@ export default function Header() {
           {session && (
             <>
               {session.user.image && (
-                <span
-                  style={{ backgroundImage: `url(${session.user.image})` }}
-                  className={styles.avatar}
-                />
+                <img src={session.user.image} className={styles.avatar} />
               )}
               <span className={styles.signedInText}>
                 <small>Signed in as</small>
                 <br />
-                <strong>{session.user.email || session.user.name}</strong>
+                <strong>{session.user.email} </strong>
+                {session.user.name ? `(${session.user.name})` : null}
               </span>
               <a
                 href="/api/auth/signout"
@@ -105,6 +103,11 @@ export default function Header() {
               <a>Email</a>
             </Link>
           </li>
+          <li className={styles.navItem}>
+            <Link href="/middleware-protected">
+              <a>Middleware protected</a>
+            </Link>
+          </li>
         </ul>
       </nav>
     </header>

app/jsconfig.json

@@ -1,5 +0,0 @@
-{
-  "compilerOptions": {
-    "baseUrl": "."
-  }
-}

app/next-env.d.ts

@@ -1,5 +1,4 @@
 /// <reference types="next" />
-/// <reference types="next/types/global" />
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited

app/next.config.js

@@ -2,18 +2,30 @@ const path = require("path")
 
 module.exports = {
   webpack(config) {
+    config.experiments = {
+      ...config.experiments,
+      topLevelAwait: true,
+    }
     config.resolve = {
       ...config.resolve,
       alias: {
         ...config.resolve.alias,
-        "next-auth$": path.join(process.cwd(), "next-auth/server"),
-        "next-auth/react$": path.join(process.cwd(), "next-auth/client/react"),
-        "next-auth/jwt$": path.join(process.cwd(), "next-auth/lib/jwt"),
-        "next-auth/adapters": path.join(process.cwd(), "next-auth/adapters"),
-        "next-auth/providers": path.join(process.cwd(), "next-auth/providers"),
+        react: path.join(process.cwd(), "node_modules/react"),
+        nodemailer: path.join(process.cwd(), "node_modules/nodemailer"),
+        "react-dom": path.join(process.cwd(), "node_modules/react-dom"),
+        "react/jsx-dev-runtime": path.join(
+          process.cwd(),
+          "node_modules/react/jsx-dev-runtime"
+        ),
       },
     }
 
     return config
   },
+  typescript: {
+    ignoreBuildErrors: true,
+  },
+  experimental: {
+    externalDir: true,
+  },
 }

app/package.json

@@ -4,30 +4,32 @@
   "description": "NextAuth.js Developer app",
   "private": true,
   "scripts": {
-    "dev": "npm-run-all --parallel copy:app dev:css dev:next",
+    "clean": "rm -rf .next",
+    "postinstall": "rm -rf node_modules/next-auth",
+    "dev": "npm-run-all --parallel dev:next watch:css copy:css ",
     "dev:next": "next dev",
-    "copy:app": "cpx \"../src/**/*\" next-auth --watch",
-    "copy:css": "cpx \"../dist/css/**/*\" dist/css --watch",
+    "build": "next build",
+    "copy:css": "cpx \"../css/**/*\" src/css --watch",
     "watch:css": "cd .. && npm run watch:css",
-    "dev:css": "npm-run-all --parallel watch:css copy:css",
     "start": "next start",
-    "start:email": "npx fake-smtp-server"
+    "email": "npx fake-smtp-server",
+    "start:email": "npm run email"
   },
   "license": "ISC",
   "dependencies": {
-    "@next-auth/fauna-adapter": "0.2.2-next.4",
-    "@next-auth/prisma-adapter": "0.5.2-next.5",
-    "@prisma/client": "^2.29.1",
+    "@next-auth/fauna-adapter": "^1.0.1",
+    "@next-auth/prisma-adapter": "^1.0.1",
+    "@prisma/client": "^3.7.0",
     "fake-smtp-server": "^0.8.0",
-    "faunadb": "^4.3.0",
-    "next": "^11.1.0",
-    "nodemailer": "^6.6.3",
+    "faunadb": "^4.4.1",
+    "next": "^12.0.8",
+    "nodemailer": "^6.7.2",
     "react": "^17.0.2",
     "react-dom": "^17.0.2"
   },
   "devDependencies": {
     "cpx": "^1.5.0",
     "npm-run-all": "^4.1.5",
-    "prisma": "^2.29.1"
+    "prisma": "^3.7.0"
   }
 }

app/pages/_app.js

@@ -1,12 +1,9 @@
 import { SessionProvider } from "next-auth/react"
 import "./styles.css"
 
-export default function App({
-  Component,
-  pageProps: { session, ...pageProps },
-}) {
+export default function App({ Component, pageProps }) {
   return (
-    <SessionProvider session={session}>
+    <SessionProvider session={pageProps.session}>
       <Component {...pageProps} />
     </SessionProvider>
   )

app/pages/api/auth/[...nextauth].ts

@@ -1,9 +1,11 @@
-import NextAuth from "next-auth"
-import EmailProvider from "next-auth/providers/email"
+import NextAuth, { NextAuthOptions } from "next-auth"
+// import EmailProvider from "next-auth/providers/email"
 import GitHubProvider from "next-auth/providers/github"
 import Auth0Provider from "next-auth/providers/auth0"
 import KeycloakProvider from "next-auth/providers/keycloak"
-import TwitterProvider from "next-auth/providers/twitter"
+import TwitterProvider, {
+  TwitterLegacy as TwitterLegacyProvider,
+} from "next-auth/providers/twitter"
 import CredentialsProvider from "next-auth/providers/credentials"
 import IDS4Provider from "next-auth/providers/identity-server4"
 import Twitch from "next-auth/providers/twitch"
@@ -17,6 +19,16 @@ import LineProvider from "next-auth/providers/line"
 import LinkedInProvider from "next-auth/providers/linkedin"
 import MailchimpProvider from "next-auth/providers/mailchimp"
 import DiscordProvider from "next-auth/providers/discord"
+import AzureADProvider from "next-auth/providers/azure-ad"
+import SpotifyProvider from "next-auth/providers/spotify"
+import CognitoProvider from "next-auth/providers/cognito"
+import SlackProvider from "next-auth/providers/slack"
+import Okta from "next-auth/providers/okta"
+import AzureB2C from "next-auth/providers/azure-ad-b2c"
+import OsuProvider from "next-auth/providers/osu"
+import AppleProvider from "next-auth/providers/apple"
+import PatreonProvider from "next-auth/providers/patreon"
+import TraktProvider from "next-auth/providers/trakt"
 
 // import { PrismaAdapter } from "@next-auth/prisma-adapter"
 // import { PrismaClient } from "@prisma/client"
@@ -31,29 +43,28 @@ import DiscordProvider from "next-auth/providers/discord"
 //   domain: process.env.FAUNA_DOMAIN,
 // })
 // const adapter = FaunaAdapter(client)
-
-export default NextAuth({
+export const authOptions: NextAuthOptions = {
   // adapter,
   providers: [
     // E-mail
     // Start fake e-mail server with `npm run start:email`
-    EmailProvider({
-      server: {
-        host: "127.0.0.1",
-        auth: null,
-        secure: false,
-        port: 1025,
-        tls: { rejectUnauthorized: false },
-      },
-    }),
+    // EmailProvider({
+    //   server: {
+    //     host: "127.0.0.1",
+    //     auth: null,
+    //     secure: false,
+    //     port: 1025,
+    //     tls: { rejectUnauthorized: false },
+    //   },
+    // }),
     // Credentials
     CredentialsProvider({
       name: "Credentials",
       credentials: {
         password: { label: "Password", type: "password" },
       },
-      async authorize(credentials, req) {
-        if (credentials.password === "password") {
+      async authorize(credentials) {
+        if (credentials.password === "pw") {
           return {
             name: "Fill Murray",
             email: "bill@fillmurray.com",
@@ -64,11 +75,17 @@ export default NextAuth({
       },
     }),
     // OAuth 1
+    // TwitterLegacyProvider({
+    //   clientId: process.env.TWITTER_LEGACY_ID,
+    //   clientSecret: process.env.TWITTER_LEGACY_SECRET,
+    // }),
+    // OAuth 2 / OIDC
     TwitterProvider({
+      // Opt-in to the new Twitter API for now. Should be default in the future.
+      version: "2.0",
       clientId: process.env.TWITTER_ID,
       clientSecret: process.env.TWITTER_SECRET,
     }),
-    // OAuth 2 / OIDC
     GitHubProvider({
       clientId: process.env.GITHUB_ID,
       clientSecret: process.env.GITHUB_SECRET,
@@ -132,11 +149,59 @@ export default NextAuth({
       clientId: process.env.DISCORD_ID,
       clientSecret: process.env.DISCORD_SECRET,
     }),
+    AzureADProvider({
+      clientId: process.env.AZURE_AD_CLIENT_ID,
+      clientSecret: process.env.AZURE_AD_CLIENT_SECRET,
+      tenantId: process.env.AZURE_AD_TENANT_ID,
+      profilePhotoSize: 48,
+    }),
+    SpotifyProvider({
+      clientId: process.env.SPOTIFY_ID,
+      clientSecret: process.env.SPOTIFY_SECRET,
+    }),
+    CognitoProvider({
+      clientId: process.env.COGNITO_ID,
+      clientSecret: process.env.COGNITO_SECRET,
+      issuer: process.env.COGNITO_ISSUER,
+    }),
+    Okta({
+      clientId: process.env.OKTA_ID,
+      clientSecret: process.env.OKTA_SECRET,
+      issuer: process.env.OKTA_ISSUER,
+    }),
+    SlackProvider({
+      clientId: process.env.SLACK_ID,
+      clientSecret: process.env.SLACK_SECRET,
+    }),
+    AzureB2C({
+      clientId: process.env.AZURE_B2C_ID,
+      clientSecret: process.env.AZURE_B2C_SECRET,
+      tenantId: process.env.AZURE_B2C_TENANT_ID,
+      primaryUserFlow: process.env.AZURE_B2C_PRIMARY_USER_FLOW,
+    }),
+    OsuProvider({
+      clientId: process.env.OSU_CLIENT_ID,
+      clientSecret: process.env.OSU_CLIENT_SECRET,
+    }),
+    AppleProvider({
+      clientId: process.env.APPLE_ID,
+      clientSecret: process.env.APPLE_SECRET,
+    }),
+    PatreonProvider({
+      clientId: process.env.PATREON_ID,
+      clientSecret: process.env.PATREON_SECRET,
+    }),
+    TraktProvider({
+      clientId: process.env.TRAKT_ID,
+      clientSecret: process.env.TRAKT_SECRET,
+    }),
   ],
-  jwt: {
-    encryption: true,
-    secret: process.env.SECRET,
-  },
   debug: true,
-  theme: "auto",
-})
+  theme: {
+    colorScheme: "auto",
+    logo: "https://next-auth.js.org/img/logo/logo-sm.png",
+    brandColor: "#1786fb",
+  },
+}
+
+export default NextAuth(authOptions)

app/pages/api/examples/jwt.js

@@ -1,9 +1,7 @@
 // This is an example of how to read a JSON Web Token from an API route
-import jwt from "next-auth/jwt"
-
-const secret = process.env.SECRET
+import { getToken } from "next-auth/jwt"
 
 export default async (req, res) => {
-  const token = await jwt.getToken({ req, secret, encryption: true })
+  const token = await getToken({ req, secret: process.env.SECRET })
   res.send(JSON.stringify(token, null, 2))
 }

app/pages/middleware-protected/_middleware.js

@@ -0,0 +1,44 @@
+export { default } from "next-auth/middleware"
+
+// Other ways to use this middleware
+
+// import withAuth from "next-auth/middleware"
+// import { withAuth } from "next-auth/middleware"
+
+// export function middleware(req, ev) {
+//   return withAuth(req)
+// }
+
+// export function middleware(req, ev) {
+//   return withAuth(req, ev)
+// }
+
+// export function middleware(req, ev) {
+//   return withAuth(req, {
+//     callbacks: {
+//       authorized: ({ token }) => !!token,
+//     },
+//   })
+// }
+
+// export default withAuth(function middleware(req, ev) {
+//   console.log(req.nextauth.token)
+// })
+
+// export default withAuth(
+//   function middleware(req, ev) {
+//     console.log(req, ev)
+//     return undefined // NOTE: `NextMiddleware` should allow returning `void`
+//   },
+//   {
+//     callbacks: {
+//       authorized: ({ token }) => token.name === "Balázs Orbán",
+//     }
+//   }
+// )
+
+// export default withAuth({
+//   callbacks: {
+//     authorized: ({ token }) => !!token,
+//   },
+// })

app/pages/middleware-protected/index.js

@@ -0,0 +1,9 @@
+import Layout from "components/layout"
+
+export default function Page() {
+  return (
+    <Layout>
+      <h1>Page protected by Middleware</h1>
+    </Layout>
+  )
+}

app/pages/protected-ssr.js

@@ -1,5 +1,6 @@
 // This is an example of how to protect content using server rendering
-import { getSession } from "next-auth/react"
+import { getServerSession } from "next-auth/next"
+import { authOptions } from "./api/auth/[...nextauth]"
 import Layout from "../components/layout"
 import AccessDenied from "../components/access-denied"
 
@@ -25,7 +26,7 @@ export default function Page({ content, session }) {
 }
 
 export async function getServerSideProps(context) {
-  const session = await getSession(context)
+  const session = await getServerSession(context, authOptions)
   let content = null
 
   if (session) {

app/pages/styles.css

@@ -4,7 +4,7 @@ body {
   max-width: 680px;
   margin: 0 auto;
   background: #fff;
-  color: #333;
+  color: var(--color-text);
 }
 
 li,

app/tsconfig.json

@@ -1,6 +1,6 @@
 {
   "compilerOptions": {
-    "target": "es5",
+    "target": "esnext",
     "lib": [
       "dom",
       "dom.iterable",
@@ -16,8 +16,13 @@
     "moduleResolution": "node",
     "resolveJsonModule": true,
     "isolatedModules": true,
+    "incremental": true,
     "jsx": "preserve",
-    "baseUrl": "."
+    "baseUrl": ".",
+    "paths": {
+      "next-auth": [ "../src" ],
+      "next-auth/*": [ "../src/*" ]
+    }
   },
   "include": [
     "next-env.d.ts",

config/babel.config.js

@@ -2,28 +2,60 @@
 // https://nextjs.org/docs/getting-started#system-requirements
 // https://nextjs.org/docs/basic-features/supported-browsers-features
 
-module.exports = {
-  presets: [["@babel/preset-env", { targets: { node: "12" } }]],
-  plugins: [
-    "@babel/plugin-proposal-optional-catch-binding",
-    "@babel/plugin-transform-runtime",
-  ],
-  comments: false,
-  overrides: [
-    {
-      test: ["../src/client/**"],
+module.exports = (api) => {
+  const isTest = api.env("test")
+  if (isTest) {
+    return {
       presets: [
-        ["@babel/preset-env", { targets: { ie: "11" } }],
+        "@babel/preset-env",
         ["@babel/preset-react", { runtime: "automatic" }],
+        ["@babel/preset-typescript", { isTSX: true, allExtensions: true }],
       ],
-    },
-    {
-      test: ["../src/server/pages/**"],
-      presets: ["preact"],
-    },
-    {
-      test: ["../src/**/*.test.js"],
-      presets: [["@babel/preset-react", { runtime: "automatic" }]],
-    },
-  ],
+    }
+  }
+  return {
+    presets: [
+      ["@babel/preset-env", { targets: { node: 12 } }],
+      "@babel/preset-typescript",
+    ],
+    plugins: [
+      "@babel/plugin-proposal-optional-catch-binding",
+      "@babel/plugin-transform-runtime",
+    ],
+    ignore: [
+      "../src/**/__tests__/**",
+      "../src/adapters.ts",
+      "../src/lib/types.ts",
+      "../src/providers/oauth-types.ts",
+    ],
+    comments: false,
+    overrides: [
+      {
+        test: [
+          "../src/react/index.tsx",
+          "../src/lib/logger.ts",
+          "../src/core/errors.ts",
+          "../src/client/**",
+        ],
+        presets: [
+          ["@babel/preset-env", { targets: { ie: 11 } }],
+          ["@babel/preset-react", { runtime: "automatic" }],
+        ],
+      },
+      {
+        test: ["../src/core/pages/*.tsx"],
+        presets: ["preact"],
+        plugins: [
+          [
+            "jsx-pragmatic",
+            {
+              module: "preact",
+              export: "h",
+              import: "h",
+            },
+          ],
+        ],
+      },
+    ],
+  }
 }

config/build.js

@@ -1,108 +0,0 @@
-const fs = require("fs-extra")
-const path = require("path")
-
-const MODULE_ENTRIES = {
-  SERVER: "index",
-  REACT: "react",
-  ADAPTERS: "adapters",
-  JWT: "jwt",
-}
-
-// Building submodule entries
-
-const BUILD_TARGETS = {
-  [`${MODULE_ENTRIES.SERVER}.js`]:
-    "module.exports = require('./dist/server').default\n",
-  [`${MODULE_ENTRIES.REACT}.js`]:
-    "module.exports = require('./dist/client/react').default\n",
-  [`${MODULE_ENTRIES.JWT}.js`]:
-    "module.exports = require('./dist/lib/jwt').default\n",
-}
-
-Object.entries(BUILD_TARGETS).forEach(([target, content]) => {
-  fs.writeFile(path.join(process.cwd(), target), content, (err) => {
-    if (err) throw err
-    console.log(`[build] created "${target}" in root folder`)
-  })
-})
-
-// Building types
-fs.mkdirSync("providers", { recursive: true })
-
-const TYPES_TARGETS = [
-  `${MODULE_ENTRIES.SERVER}.d.ts`,
-  `${MODULE_ENTRIES.REACT}-client.d.ts`,
-  `${MODULE_ENTRIES.ADAPTERS}.d.ts`,
-  "providers",
-  `${MODULE_ENTRIES.JWT}.d.ts`,
-  "internals",
-]
-
-TYPES_TARGETS.forEach((target) => {
-  fs.copy(
-    path.resolve("types", target),
-    path.join(
-      process.cwd(),
-      target.startsWith("react-client") ? "react.d.ts" : target
-    ),
-    (err) => {
-      if (err) throw err
-      console.log(`[types] copying "${target}" to root folder`)
-    }
-  )
-})
-
-// Generate provider types
-
-const providersDirPath = path.join(process.cwd(), "/src/providers")
-
-const oauthProviderFiles = fs
-  .readdirSync(providersDirPath, "utf8")
-  .filter((f) => f !== "credentials.js" && f !== "email.js")
-
-let type = `export type OAuthProviderType =\n`
-
-oauthProviderFiles.forEach((file) => {
-  const provider = fs.readFileSync(path.join(providersDirPath, file), "utf8")
-  const fileName = file.split(".")[0]
-  try {
-    // NOTE: If this fails, the default export probably wasn't a named function.
-    // Always use a named function as default export.
-    // Eg.: export default function YourProvider ...
-    const { functionName } = provider.match(
-      /export default function (?<functionName>.+)\s?\(/
-    ).groups
-
-    type += `  | "${functionName}"\n`
-    const providerModule = `import { OAuthConfig } from "."
-
-declare module "next-auth/providers/${fileName}" {
-  export default function ${functionName}Provider(
-    options: Partial<OAuthConfig>
-  ): OAuthConfig
-}
-`
-
-    fs.writeFile(
-      path.join("types/providers", `${fileName}.d.ts`),
-      providerModule
-    )
-
-    console.log(
-      `[types] created module declaration for "${functionName}" provider`
-    )
-  } catch (error) {
-    console.error(
-      [
-        `\nThe provider file '${file}' should have a single named default export`,
-        "Example: 'export default function YourProvider'\n\n",
-      ].join("\n")
-    )
-    process.exit(1)
-  }
-})
-
-fs.writeFile(
-  path.join(process.cwd(), "types/providers/oauth-providers.d.ts"),
-  type
-)

config/generate-providers.js

@@ -0,0 +1,18 @@
+const path = require("path")
+const fs = require("fs")
+
+const providersPath = path.join(process.cwd(), "/src/providers")
+
+const files = fs.readdirSync(providersPath, "utf8")
+
+const providers = files.map((file) => {
+  const strippedProviderName = file.substring(0, file.indexOf("."))
+  return `"${strippedProviderName}"`
+})
+
+const result = `
+// THIS FILE IS AUTOGENERATED. DO NOT EDIT.
+export type OAuthProviderType = 
+  | ${providers.join("\n  | ")}`
+
+fs.writeFileSync(path.join(providersPath, "oauth-types.ts"), result)

config/jest-setup.js

@@ -1,2 +1,3 @@
+import "regenerator-runtime/runtime"
 import "@testing-library/jest-dom"
 import "whatwg-fetch"

config/jest.config.js

@@ -1,7 +1,10 @@
 /** @type {import('@jest/types').Config.InitialOptions} */
 module.exports = {
   transform: {
-    "\\.js$": ["babel-jest", { configFile: "./config/babel.config.js" }],
+    "\\.(js|jsx|ts|tsx)$": [
+      "babel-jest",
+      { configFile: "./config/babel.config.js" },
+    ],
   },
   rootDir: "../src",
   setupFilesAfterEnv: ["../config/jest-setup.js"],
@@ -9,4 +12,8 @@ module.exports = {
   testMatch: ["**/*.test.js"],
   coverageDirectory: "../coverage",
   testEnvironment: "jsdom",
+  watchPlugins: [
+    "jest-watch-typeahead/filename",
+    "jest-watch-typeahead/testname",
+  ],
 }

config/version-pr/action.yml

@@ -0,0 +1,8 @@
+name: "Determine version"
+description: "Determines npm package version based on PR number and commit SHA"
+outputs:
+  version:
+    description: "npm package version"
+runs:
+  using: "node12"
+  main: "index.js"

config/version-pr/index.js

@@ -0,0 +1,18 @@
+const fs = require("fs-extra")
+const path = require("path")
+const core = require("@actions/core")
+
+try {
+  const packageJSONPath = path.join(process.cwd(), "package.json")
+  const packageJSON = JSON.parse(fs.readFileSync(packageJSONPath, "utf8"))
+
+  const sha8 = process.env.GITHUB_SHA.substr(0, 8)
+  const prNumber = process.env.PR_NUMBER
+
+  const packageVersion = `0.0.0-pr.${prNumber}.${sha8}`
+  packageJSON.version = packageVersion
+  core.setOutput("version", packageVersion)
+  fs.writeFileSync(packageJSONPath, JSON.stringify(packageJSON))
+} catch (error) {
+  core.setFailed(error.message)
+}

config/wrap-css.js

@@ -5,14 +5,13 @@
 // To work around this issue, this script is a manual step that wraps CSS in a
 // JavaScript file that has the compiled CSS embedded in it, and exports only
 // a function that returns the CSS as a string.
-const fs = require('fs')
-const path = require('path')
+const fs = require("fs")
+const path = require("path")
 
-const pathToCssJs = path.join(__dirname, '../dist/css/index.js')
-const pathToCss = path.join(__dirname, '../dist/css/index.css')
-
-const css = fs.readFileSync(pathToCss, 'utf8')
+const pathToCss = path.join(__dirname, "../css/index.css")
+const css = fs.readFileSync(pathToCss, "utf8")
 const cssWithEscapedQuotes = css.replace(/"/gm, '\\"')
-const js = `module.exports = function() { return "${cssWithEscapedQuotes}" }`
 
+const js = `module.exports = function() { return "${cssWithEscapedQuotes}" }`
+const pathToCssJs = path.join(__dirname, "../css/index.js")
 fs.writeFileSync(pathToCssJs, js)

package.json

@@ -5,8 +5,14 @@
   "homepage": "https://next-auth.js.org",
   "repository": "https://github.com/nextauthjs/next-auth.git",
   "author": "Iain Collins <me@iaincollins.com>",
+  "contributors": [
+    "Balázs Orbán <info@balazsorban.com>",
+    "Nico Domino <yo@ndo.dev>",
+    "Lluis Agusti <hi@llu.lu>"
+  ],
   "main": "index.js",
-  "types": "./index.d.ts",
+  "module": "index.js",
+  "types": "index.d.ts",
   "keywords": [
     "react",
     "nodejs",
@@ -20,54 +26,62 @@
     "nextauth"
   ],
   "exports": {
-    ".": "./dist/server/index.js",
-    "./jwt": "./dist/lib/jwt.js",
-    "./react": "./dist/client/react.js",
-    "./providers/*": "./dist/providers/*.js"
+    ".": "./index.js",
+    "./jwt": "./jwt/index.js",
+    "./react": "./react/index.js",
+    "./core": "./core/index.js",
+    "./next": "./next/index.js",
+    "./middleware": "./middleware.js",
+    "./client/_utils": "./client/_utils.js",
+    "./providers/*": "./providers/*.js"
   },
   "scripts": {
     "build": "npm run build:js && npm run build:css",
-    "build:js": "node ./config/build.js && babel --config-file ./config/babel.config.js src --out-dir dist",
-    "build:css": "postcss --config config/postcss.config.js src/**/*.css --base src --dir dist && node config/wrap-css.js",
-    "dev:setup": "npm i && npm run build:css && cd app && npm i",
+    "clean": "rm -rf client css lib providers core jwt react next index.d.ts index.js adapters.d.ts middleware.d.ts middleware.js",
+    "build:js": "npm run clean && npm run generate-providers && tsc && babel --config-file ./config/babel.config.js src --out-dir . --extensions \".tsx,.ts,.js,.jsx\"",
+    "build:css": "postcss --config config/postcss.config.js src/**/*.css --base src --dir . && node config/wrap-css.js",
+    "dev:setup": "npm i && npm run generate-providers && npm run build:css && cd app && npm i",
     "dev": "cd app && npm run dev",
-    "watch": "npm run watch:js | npm run watch:css",
-    "watch:js": "babel --config-file ./config/babel.config.js --watch src --out-dir dist",
-    "watch:css": "postcss --config config/postcss.config.js --watch src/**/*.css --base src --dir dist",
+    "watch:css": "postcss --config config/postcss.config.js --watch src/**/*.css --base src --dir .",
     "test": "jest --config ./config/jest.config.js",
-    "test:ci": "npm run lint && npm run test:types && npm run test -- --ci",
-    "test:types": "dtslint types --onlyTestTsNext",
+    "test:ci": "npm run lint && npm run test -- --ci",
     "prepublishOnly": "npm run build",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "version:pr": "node ./config/version-pr"
+    "version:pr": "node ./config/version-pr",
+    "generate-providers": "node ./config/generate-providers.js"
   },
   "files": [
-    "dist",
-    "index.js",
-    "index.d.ts",
+    "lib",
+    "css",
+    "jwt",
+    "react",
+    "next",
+    "client",
     "providers",
+    "core",
+    "index.d.ts",
+    "index.js",
     "adapters.d.ts",
-    "react.js",
-    "react.d.ts",
-    "jwt.js",
-    "jwt.d.ts",
-    "internals"
+    "middleware.d.ts",
+    "middleware.js"
   ],
   "license": "ISC",
   "dependencies": {
-    "@babel/runtime": "^7.14.6",
-    "futoin-hkdf": "^1.3.3",
-    "jose": "^1.27.2",
+    "@babel/runtime": "^7.16.3",
+    "@panva/hkdf": "^1.0.1",
+    "cookie": "^0.4.1",
+    "jose": "^4.3.7",
     "oauth": "^0.9.15",
-    "openid-client": "^4.7.4",
-    "preact": "^10.5.13",
-    "preact-render-to-string": "^5.1.19"
+    "openid-client": "^5.1.0",
+    "preact": "^10.6.3",
+    "preact-render-to-string": "^5.1.19",
+    "uuid": "^8.3.2"
   },
   "peerDependencies": {
-    "nodemailer": "^6.6.2",
-    "react": "^17.0.2",
-    "react-dom": "^17.0.2"
+    "nodemailer": "^6.6.5",
+    "react": "^17.0.2 || ^18.0.0-0",
+    "react-dom": "^17.0.2 || ^18.0.0-0"
   },
   "peerDependenciesMeta": {
     "nodemailer": {
@@ -75,55 +89,60 @@
     }
   },
   "devDependencies": {
-    "@babel/cli": "^7.14.5",
-    "@babel/core": "^7.14.6",
-    "@babel/plugin-proposal-optional-catch-binding": "^7.14.5",
-    "@babel/plugin-transform-runtime": "^7.14.5",
-    "@babel/preset-env": "^7.14.7",
-    "@babel/preset-react": "^7.14.5",
-    "@testing-library/jest-dom": "^5.14.1",
-    "@testing-library/react": "^12.0.0",
-    "@testing-library/react-hooks": "^7.0.1",
-    "@testing-library/user-event": "^13.1.9",
-    "@types/nodemailer": "^6.4.2",
+    "@actions/core": "^1.6.0",
+    "@babel/cli": "^7.16.0",
+    "@babel/core": "^7.16.0",
+    "@babel/plugin-proposal-optional-catch-binding": "^7.16.0",
+    "@babel/plugin-transform-runtime": "^7.16.4",
+    "@babel/preset-env": "^7.16.4",
+    "@babel/preset-react": "^7.16.0",
+    "@babel/preset-typescript": "^7.16.0",
+    "@testing-library/jest-dom": "^5.16.1",
+    "@testing-library/react": "^12.1.2",
+    "@testing-library/react-hooks": "^7.0.2",
+    "@testing-library/user-event": "^13.5.0",
+    "@types/node": "^16.11.12",
+    "@types/nodemailer": "^6.4.4",
     "@types/oauth": "^0.9.1",
-    "@types/react": "^17.0.11",
-    "@typescript-eslint/eslint-plugin": "^4.28.0",
-    "@typescript-eslint/parser": "^4.28.0",
-    "autoprefixer": "^10.2.6",
-    "babel-jest": "^27.0.5",
+    "@types/react": "^17.0.37",
+    "@types/react-dom": "^17.0.11",
+    "@typescript-eslint/parser": "^4.33.0",
+    "autoprefixer": "^10.4.0",
+    "babel-jest": "^27.4.2",
+    "babel-plugin-jsx-pragmatic": "^1.0.2",
     "babel-preset-preact": "^2.0.0",
-    "conventional-changelog-conventionalcommits": "4.6.0",
-    "cssnano": "^5.0.6",
-    "dtslint": "^4.1.0",
-    "eslint": "^7.29.0",
+    "conventional-changelog-conventionalcommits": "4.6.1",
+    "cssnano": "^5.0.12",
+    "eslint": "^7.32.0",
     "eslint-config-prettier": "^8.3.0",
-    "eslint-config-standard-with-typescript": "^20.0.0",
-    "eslint-plugin-import": "^2.23.4",
-    "eslint-plugin-jest": "^24.3.6",
+    "eslint-config-standard-with-typescript": "^21.0.1",
+    "eslint-plugin-jest": "^25.3.0",
     "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-promise": "^5.1.0",
     "fs-extra": "^10.0.0",
-    "husky": "^6.0.0",
-    "jest": "^27.0.5",
-    "msw": "^0.30.0",
-    "next": "^11.0.1",
-    "postcss-cli": "^8.3.1",
-    "postcss-nested": "^5.0.5",
-    "prettier": "^2.3.1",
-    "pretty-quick": "^3.1.1",
+    "husky": "^7.0.4",
+    "jest": "^27.4.3",
+    "jest-watch-typeahead": "^1.0.0",
+    "msw": "^0.36.3",
+    "next": "12.0.9",
+    "postcss-cli": "^9.0.2",
+    "postcss-nested": "^5.0.6",
+    "prettier": "2.4.1",
+    "pretty-quick": "^3.1.2",
     "react": "^17.0.2",
     "react-dom": "^17.0.2",
-    "typescript": "^4.3.4",
+    "typescript": "^4.5.2",
     "whatwg-fetch": "^3.6.2"
   },
+  "engines": {
+    "node": "^12.19.0 || ^14.15.0 || ^16.13.0"
+  },
   "prettier": {
     "semi": false
   },
   "eslintConfig": {
     "parser": "@typescript-eslint/parser",
     "parserOptions": {
-      "project": "./tsconfig.json"
+      "project": "./tsconfig.eslint.json"
     },
     "extends": [
       "standard-with-typescript",
@@ -131,11 +150,12 @@
     ],
     "ignorePatterns": [
       "node_modules",
-      "test",
       "next-env.d.ts",
       "types",
       ".next",
-      "dist"
+      "dist",
+      "/core",
+      "/react.js"
     ],
     "globals": {
       "localStorage": "readonly",
@@ -145,7 +165,9 @@
     "rules": {
       "camelcase": "off",
       "@typescript-eslint/naming-convention": "off",
-      "@typescript-eslint/strict-boolean-expressions": "off"
+      "@typescript-eslint/strict-boolean-expressions": "off",
+      "@typescript-eslint/explicit-function-return-type": "off",
+      "@typescript-eslint/restrict-template-expressions": "off"
     },
     "overrides": [
       {
@@ -164,6 +186,11 @@
       }
     ]
   },
+  "eslintIgnore": [
+    "./*.d.ts",
+    "**/tests",
+    "**/__tests__"
+  ],
   "release": {
     "branches": [
       "+([0-9])?(.{+([0-9]),x}).x",
@@ -194,6 +221,10 @@
     {
       "type": "github",
       "url": "https://github.com/sponsors/balazsorban44"
+    },
+    {
+      "type": "opencollective",
+      "url": "https://opencollective.com/nextauth"
     }
   ]
 }

src/adapters.ts

@@ -1,5 +1,4 @@
-import { Account, User } from "."
-import { Awaitable } from "./internals/utils"
+import { Account, User, Awaitable } from "."
 
 export interface AdapterUser extends User {
   id: string
@@ -57,54 +56,54 @@ export interface VerificationToken {
  * [Create a custom adapter](https://next-auth.js.org/tutorials/creating-a-database-adapter)
  */
 export interface Adapter {
-  createUser(user: Omit<AdapterUser, "id">): Awaitable<AdapterUser>
-  getUser(id: string): Awaitable<AdapterUser | null>
-  getUserByEmail(email: string): Awaitable<AdapterUser | null>
+  createUser: (user: Omit<AdapterUser, "id">) => Awaitable<AdapterUser>
+  getUser: (id: string) => Awaitable<AdapterUser | null>
+  getUserByEmail: (email: string) => Awaitable<AdapterUser | null>
   /** Using the provider id and the id of the user for a specific account, get the user. */
-  getUserByAccount(
+  getUserByAccount: (
     providerAccountId: Pick<Account, "provider" | "providerAccountId">
-  ): Awaitable<AdapterUser | null>
-  updateUser(user: Partial<AdapterUser>): Awaitable<AdapterUser>
+  ) => Awaitable<AdapterUser | null>
+  updateUser: (user: Partial<AdapterUser>) => Awaitable<AdapterUser>
   /** @todo Implement */
-  deleteUser?(
+  deleteUser?: (
     userId: string
-  ): Promise<void> | Awaitable<AdapterUser | null | undefined>
-  linkAccount(
+  ) => Promise<void> | Awaitable<AdapterUser | null | undefined>
+  linkAccount: (
     account: Account
-  ): Promise<void> | Awaitable<Account | null | undefined>
+  ) => Promise<void> | Awaitable<Account | null | undefined>
   /** @todo Implement */
-  unlinkAccount?(
+  unlinkAccount?: (
     providerAccountId: Pick<Account, "provider" | "providerAccountId">
-  ): Promise<void> | Awaitable<Account | undefined>
+  ) => Promise<void> | Awaitable<Account | undefined>
   /** Creates a session for the user and returns it. */
-  createSession(session: {
+  createSession: (session: {
     sessionToken: string
     userId: string
     expires: Date
-  }): Awaitable<AdapterSession>
-  getSessionAndUser(
+  }) => Awaitable<AdapterSession>
+  getSessionAndUser: (
     sessionToken: string
-  ): Awaitable<{ session: AdapterSession; user: AdapterUser } | null>
-  updateSession(
+  ) => Awaitable<{ session: AdapterSession; user: AdapterUser } | null>
+  updateSession: (
     session: Partial<AdapterSession> & Pick<AdapterSession, "sessionToken">
-  ): Awaitable<AdapterSession | null | undefined>
+  ) => Awaitable<AdapterSession | null | undefined>
   /**
    * Deletes a session from the database.
    * It is preferred that this method also returns the session
    * that is being deleted for logging purposes.
    */
-  deleteSession(
+  deleteSession: (
     sessionToken: string
-  ): Promise<void> | Awaitable<AdapterSession | null | undefined>
-  createVerificationToken?(
+  ) => Promise<void> | Awaitable<AdapterSession | null | undefined>
+  createVerificationToken?: (
     verificationToken: VerificationToken
-  ): Awaitable<VerificationToken | null | undefined>
+  ) => Awaitable<VerificationToken | null | undefined>
   /**
    * Return verification token from the database
    * and delete it so it cannot be used again.
    */
-  useVerificationToken?(params: {
+  useVerificationToken?: (params: {
     identifier: string
     token: string
-  }): Awaitable<VerificationToken | null>
+  }) => Awaitable<VerificationToken | null>
 }

src/client/__tests__/client-provider.test.js

@@ -2,7 +2,7 @@ import { rest } from "msw"
 import { render, screen, waitFor } from "@testing-library/react"
 import { server, mockSession } from "./helpers/mocks"
 import { printFetchCalls } from "./helpers/utils"
-import { SessionProvider, useSession, signOut, getSession } from "../react"
+import { SessionProvider, useSession, signOut, getSession } from "../../react"
 
 const origDocumentVisibility = document.visibilityState
 const fetchSpy = jest.spyOn(global, "fetch")

src/client/__tests__/csrf.test.js

@@ -3,7 +3,7 @@ import userEvent from "@testing-library/user-event"
 import { render, screen, waitFor } from "@testing-library/react"
 import { server, mockCSRFToken } from "./helpers/mocks"
 import logger from "../../lib/logger"
-import { getCsrfToken } from "../react"
+import { getCsrfToken } from "../../react"
 import { rest } from "msw"
 
 jest.mock("../../lib/logger", () => ({

src/client/__tests__/helpers/mocks.js

@@ -65,26 +65,28 @@ export const mockSignOutResponse = {
 }
 
 export const server = setupServer(
-  rest.post("/api/auth/signout", (req, res, ctx) =>
+  rest.post("http://localhost/api/auth/signout", (req, res, ctx) =>
     res(ctx.status(200), ctx.json(mockSignOutResponse))
   ),
-  rest.get("/api/auth/session", (req, res, ctx) =>
+  rest.get("http://localhost/api/auth/session", (req, res, ctx) =>
     res(ctx.status(200), ctx.json(mockSession))
   ),
-  rest.get("/api/auth/csrf", (req, res, ctx) =>
+  rest.get("http://localhost/api/auth/csrf", (req, res, ctx) =>
     res(ctx.status(200), ctx.json(mockCSRFToken))
   ),
-  rest.get("/api/auth/providers", (req, res, ctx) =>
+  rest.get("http://localhost/api/auth/providers", (req, res, ctx) =>
     res(ctx.status(200), ctx.json(mockProviders))
   ),
-  rest.post("/api/auth/signin/github", (req, res, ctx) =>
+  rest.post("http://localhost/api/auth/signin/github", (req, res, ctx) =>
     res(ctx.status(200), ctx.json(mockGithubResponse))
   ),
-  rest.post("/api/auth/callback/credentials", (req, res, ctx) =>
+  rest.post("http://localhost/api/auth/callback/credentials", (req, res, ctx) =>
     res(ctx.status(200), ctx.json(mockCredentialsResponse))
   ),
-  rest.post("/api/auth/signin/email", (req, res, ctx) =>
+  rest.post("http://localhost/api/auth/signin/email", (req, res, ctx) =>
     res(ctx.status(200), ctx.json(mockEmailResponse))
   ),
-  rest.post("/api/auth/_log", (req, res, ctx) => res(ctx.status(200)))
+  rest.post("http://localhost/api/auth/_log", (req, res, ctx) =>
+    res(ctx.status(200))
+  )
 )

src/client/__tests__/providers.test.js

@@ -2,7 +2,7 @@ import { useState } from "react"
 import userEvent from "@testing-library/user-event"
 import { render, screen, waitFor } from "@testing-library/react"
 import { server, mockProviders } from "./helpers/mocks"
-import { getProviders } from "../react"
+import { getProviders } from "../../react"
 import logger from "../../lib/logger"
 import { rest } from "msw"
 

src/client/__tests__/session.test.js

@@ -3,7 +3,7 @@ import { rest } from "msw"
 import { server, mockSession } from "./helpers/mocks"
 import logger from "../../lib/logger"
 import { useState, useEffect } from "react"
-import { getSession } from "../react"
+import { getSession } from "../../react"
 import { getBroadcastEvents } from "./helpers/utils"
 
 jest.mock("../../lib/logger", () => ({

src/client/__tests__/sign-in.test.js

@@ -8,7 +8,7 @@ import {
   mockEmailResponse,
   mockGithubResponse,
 } from "./helpers/mocks"
-import { signIn } from "../react"
+import { signIn } from "../../react"
 import { rest } from "msw"
 
 const { location } = window
@@ -27,12 +27,22 @@ jest.mock("../../lib/logger", () => ({
 
 beforeAll(() => {
   server.listen()
+
+  let _href = window.location.href
+  // Allows to mutate `window.location`...
   delete window.location
+
   window.location = {
-    ...location,
-    replace: jest.fn(),
     reload: jest.fn(),
   }
+  Object.defineProperty(window.location, "href", {
+    get: () => _href,
+    // whatwg-fetch or whatwg-url does not seem to work with relative URLs
+    set: (href) => {
+      _href = href.startsWith("/") ? `http://localhost${href}` : href
+      return _href
+    },
+  })
 })
 
 beforeEach(() => {
@@ -59,9 +69,10 @@ test.each`
     userEvent.click(screen.getByRole("button"))
 
     await waitFor(() => {
-      expect(window.location.replace).toHaveBeenCalledTimes(1)
-      expect(window.location.replace).toHaveBeenCalledWith(
-        `/api/auth/signin?callbackUrl=${encodeURIComponent(callbackUrl)}`
+      expect(window.location.href).toBe(
+        `http://localhost/api/auth/signin?${new URLSearchParams({
+          callbackUrl,
+        })}`
       )
     })
   }
@@ -76,14 +87,14 @@ test.each`
   async ({ provider }) => {
     render(<SignInFlow providerId={provider} />)
 
+    const callbackUrl = window.location.href
     userEvent.click(screen.getByRole("button"))
 
     await waitFor(() => {
-      expect(window.location.replace).toHaveBeenCalledTimes(1)
-      expect(window.location.replace).toHaveBeenCalledWith(
-        `/api/auth/signin?callbackUrl=${encodeURIComponent(
-          window.location.href
-        )}`
+      expect(window.location.href).toBe(
+        `http://localhost/api/auth/signin?${new URLSearchParams({
+          callbackUrl,
+        })}`
       )
     })
   }
@@ -101,8 +112,7 @@ test.each`
     userEvent.click(screen.getByRole("button"))
 
     await waitFor(() => {
-      expect(window.location.replace).toHaveBeenCalledTimes(1)
-      expect(window.location.replace).toHaveBeenCalledWith(mockUrl)
+      expect(window.location.href).toBe(mockUrl)
     })
   }
 )
@@ -119,8 +129,7 @@ test("redirection can't be stopped using an oauth provider", async () => {
   userEvent.click(screen.getByRole("button"))
 
   await waitFor(() => {
-    expect(window.location.replace).toHaveBeenCalledTimes(1)
-    expect(window.location.replace).toHaveBeenCalledWith(mockGithubResponse.url)
+    expect(window.location.href).toBe(mockGithubResponse.url)
   })
 })
 
@@ -136,9 +145,7 @@ test("redirection can be stopped using the 'credentials' provider", async () =>
   userEvent.click(screen.getByRole("button"))
 
   await waitFor(() => {
-    expect(window.location.replace).not.toHaveBeenCalledWith(
-      mockCredentialsResponse.url
-    )
+    expect(window.location.href).not.toBe(mockCredentialsResponse.url)
 
     expect(screen.getByTestId("signin-result").textContent).not.toBe(
       "no response"
@@ -165,9 +172,7 @@ test("redirection can be stopped using the 'email' provider", async () => {
   userEvent.click(screen.getByRole("button"))
 
   await waitFor(() => {
-    expect(window.location.replace).not.toHaveBeenCalledWith(
-      mockEmailResponse.url
-    )
+    expect(window.location.href).not.toBe(mockEmailResponse.url)
 
     expect(screen.getByTestId("signin-result").textContent).not.toBe(
       "no response"
@@ -190,7 +195,7 @@ test("if callback URL contains a hash we force a window reload when re-directing
   const mockUrlWithHash = "https://path/to/email/url#foo-bar-baz"
 
   server.use(
-    rest.post("/api/auth/signin/email", (req, res, ctx) => {
+    rest.post("http://localhost/api/auth/signin/email", (req, res, ctx) => {
       return res(
         ctx.status(200),
         ctx.json({
@@ -206,8 +211,7 @@ test("if callback URL contains a hash we force a window reload when re-directing
   userEvent.click(screen.getByRole("button"))
 
   await waitFor(() => {
-    expect(window.location.replace).toHaveBeenCalledTimes(1)
-    expect(window.location.replace).toHaveBeenCalledWith(mockUrlWithHash)
+    expect(window.location.href).toBe(mockUrlWithHash)
     // the browser will not refresh the page if the redirect URL contains a hash, hence we force it on the client, see #1289
     expect(window.location.reload).toHaveBeenCalledTimes(1)
   })
@@ -218,7 +222,7 @@ test("params are propagated to the signin URL when supplied", async () => {
   const authParams = "foo=bar&bar=foo"
 
   server.use(
-    rest.post("/api/auth/signin/github", (req, res, ctx) => {
+    rest.post("http://localhost/api/auth/signin/github", (req, res, ctx) => {
       matchedParams = req.url.search
       return res(ctx.status(200), ctx.json(mockGithubResponse))
     })
@@ -237,7 +241,7 @@ test("when it fails to fetch the providers, it redirected back to signin page",
   const errorMsg = "Error when retrieving providers"
 
   server.use(
-    rest.get("/api/auth/providers", (req, res, ctx) =>
+    rest.get("http://localhost/api/auth/providers", (req, res, ctx) =>
       res(ctx.status(500), ctx.json(errorMsg))
     )
   )
@@ -247,7 +251,7 @@ test("when it fails to fetch the providers, it redirected back to signin page",
   userEvent.click(screen.getByRole("button"))
 
   await waitFor(() => {
-    expect(window.location.replace).toHaveBeenCalledWith(`/api/auth/error`)
+    expect(window.location.href).toBe(`http://localhost/api/auth/error`)
 
     expect(logger.error).toHaveBeenCalledTimes(1)
     expect(logger.error).toBeCalledWith("CLIENT_FETCH_ERROR", {
@@ -268,10 +272,7 @@ function SignInFlow({
   async function handleSignIn() {
     const result = await signIn(
       providerId,
-      {
-        callbackUrl,
-        redirect,
-      },
+      { callbackUrl, redirect },
       authorizationParams
     )
 

src/client/__tests__/sign-out.test.js

@@ -2,7 +2,7 @@ import { useState } from "react"
 import userEvent from "@testing-library/user-event"
 import { render, screen, waitFor } from "@testing-library/react"
 import { server, mockSignOutResponse } from "./helpers/mocks"
-import { signOut } from "../react"
+import { signOut } from "../../react"
 import { rest } from "msw"
 import { getBroadcastEvents } from "./helpers/utils"
 
@@ -10,11 +10,11 @@ const { location } = window
 
 beforeAll(() => {
   server.listen()
+  // Allows to mutate `window.location`...
   delete window.location
   window.location = {
-    ...location,
-    replace: jest.fn(),
     reload: jest.fn(),
+    href: location.href,
   }
 })
 
@@ -37,7 +37,7 @@ const callbackUrl = "https://redirects/to"
 
 test("by default it redirects to the current URL if the server did not provide one", async () => {
   server.use(
-    rest.post("/api/auth/signout", (req, res, ctx) =>
+    rest.post("http://localhost/api/auth/signout", (req, res, ctx) =>
       res(ctx.status(200), ctx.json({ ...mockSignOutResponse, url: undefined }))
     )
   )
@@ -47,8 +47,7 @@ test("by default it redirects to the current URL if the server did not provide o
   userEvent.click(screen.getByRole("button"))
 
   await waitFor(() => {
-    expect(window.location.replace).toHaveBeenCalledTimes(1)
-    expect(window.location.replace).toHaveBeenCalledWith(window.location.href)
+    expect(window.location.href).toBe(window.location.href)
   })
 })
 
@@ -58,10 +57,7 @@ test("it redirects to the URL allowed by the server", async () => {
   userEvent.click(screen.getByRole("button"))
 
   await waitFor(() => {
-    expect(window.location.replace).toHaveBeenCalledTimes(1)
-    expect(window.location.replace).toHaveBeenCalledWith(
-      mockSignOutResponse.url
-    )
+    expect(window.location.href).toBe(mockSignOutResponse.url)
   })
 })
 
@@ -69,7 +65,7 @@ test("if url contains a hash during redirection a page reload happens", async ()
   const mockUrlWithHash = "https://path/to/email/url#foo-bar-baz"
 
   server.use(
-    rest.post("/api/auth/signout", (req, res, ctx) => {
+    rest.post("http://localhost/api/auth/signout", (req, res, ctx) => {
       return res(
         ctx.status(200),
         ctx.json({
@@ -85,8 +81,7 @@ test("if url contains a hash during redirection a page reload happens", async ()
   userEvent.click(screen.getByRole("button"))
 
   await waitFor(() => {
-    expect(window.location.reload).toHaveBeenCalledTimes(1)
-    expect(window.location.replace).toHaveBeenCalledWith(mockUrlWithHash)
+    expect(window.location.href).toBe(mockUrlWithHash)
   })
 })
 

src/client/__tests__/use-session-hook.test.js

@@ -1,28 +1,36 @@
 import { rest } from "msw"
 import { renderHook } from "@testing-library/react-hooks"
 import { render, waitFor } from "@testing-library/react"
-import { SessionProvider, useSession, signOut } from "../react"
+import { SessionProvider, useSession, signOut } from "../../react"
 import { server, mockSession } from "./helpers/mocks"
 
 const origConsoleError = console.error
-const origLocation = window.location
-const locationReplace = jest.fn()
+const { location } = window
 
+let _href = window.location.href
 beforeAll(() => {
   // Prevent noise on the terminal... `next-auth` will log to `console.error`
   // every time a request fails, which makes the tests output very noisy...
   console.error = jest.fn()
 
-  // Allows to spy on `window.location.replace`...
+  // Allows to mutate `window.location`...
   delete window.location
-  window.location = { ...origLocation, replace: locationReplace }
+  window.location = {}
+  Object.defineProperty(window.location, "href", {
+    get: () => _href,
+    // whatwg-fetch or whatwg-url does not seem to work with relative URLs
+    set: (href) => {
+      _href = href.startsWith("/") ? `http://localhost${href}` : href
+      return _href
+    },
+  })
 
   server.listen()
 })
 
 afterEach(() => {
   server.resetHandlers()
-  locationReplace.mockClear()
+  _href = "http://localhost/"
 
   // clear the internal session cache...
   signOut({ redirect: false })
@@ -30,7 +38,7 @@ afterEach(() => {
 
 afterAll(() => {
   console.error = origConsoleError
-  window.location = origLocation
+  window.location = location
   server.close()
 })
 
@@ -67,7 +75,7 @@ test("when session is fetched, `data` will contain the session data and `status`
 
 test("when it fails to fetch the session, `data` will be null and `status` will be 'unauthenticated'", async () => {
   server.use(
-    rest.get(`/api/auth/session`, (req, res, ctx) =>
+    rest.get(`http://localhost/api/auth/session`, (_, res, ctx) =>
       res(ctx.status(401), ctx.json({}))
     )
   )
@@ -84,11 +92,12 @@ test("when it fails to fetch the session, `data` will be null and `status` will
 
 test("it'll redirect to sign-in page if the session is required and the user is not authenticated", async () => {
   server.use(
-    rest.get(`/api/auth/session`, (req, res, ctx) =>
+    rest.get(`http://localhost/api/auth/session`, (req, res, ctx) =>
       res(ctx.status(401), ctx.json({}))
     )
   )
 
+  const callbackUrl = window.location.href
   const { result } = renderHook(() => useSession({ required: true }), {
     wrapper: SessionProvider,
   })
@@ -98,25 +107,17 @@ test("it'll redirect to sign-in page if the session is required and the user is
     expect(result.current.status).toBe("loading")
   })
 
-  expect(locationReplace).toHaveBeenCalledTimes(1)
-
-  expect(locationReplace).toHaveBeenCalledWith(
-    expect.stringContaining("/api/auth/signin")
-  )
-
-  expect(locationReplace).toHaveBeenCalledWith(
-    expect.stringContaining(
-      new URLSearchParams({
-        error: "SessionRequired",
-        callbackUrl: window.location.href,
-      }).toString()
-    )
+  expect(window.location.href).toBe(
+    `http://localhost/api/auth/signin?${new URLSearchParams({
+      error: "SessionRequired",
+      callbackUrl,
+    })}`
   )
 })
 
 test("will call custom redirect logic if supplied when the user could not authenticate", async () => {
   server.use(
-    rest.get(`/api/auth/session`, (req, res, ctx) =>
+    rest.get(`http://localhost/api/auth/session`, (_, res, ctx) =>
       res(ctx.status(401), ctx.json({}))
     )
   )
@@ -135,8 +136,5 @@ test("will call custom redirect logic if supplied when the user could not authen
     expect(result.current.status).toBe("loading")
   })
 
-  // it shouldn't have tried to re-direct to sign-in page (default behavior)
-  expect(locationReplace).not.toHaveBeenCalled()
-
   expect(customRedirect).toHaveBeenCalledTimes(1)
 })

src/client/_utils.ts

@@ -0,0 +1,106 @@
+import type { IncomingMessage } from "http"
+import type { LoggerInstance, Session } from ".."
+
+export interface NextAuthClientConfig {
+  baseUrl: string
+  basePath: string
+  baseUrlServer: string
+  basePathServer: string
+  /** Stores last session response */
+  _session?: Session | null | undefined
+  /** Used for timestamp since last sycned (in seconds) */
+  _lastSync: number
+  /**
+   * Stores the `SessionProvider`'s session update method to be able to
+   * trigger session updates from places like `signIn` or `signOut`
+   */
+  _getSession: (...args: any[]) => any
+}
+
+export interface CtxOrReq {
+  req?: IncomingMessage
+  ctx?: { req: IncomingMessage }
+}
+
+/**
+ * If passed 'appContext' via getInitialProps() in _app.js
+ * then get the req object from ctx and use that for the
+ * req value to allow `fetchData` to
+ * work seemlessly in getInitialProps() on server side
+ * pages *and* in _app.js.
+ */
+export async function fetchData<T = any>(
+  path: string,
+  __NEXTAUTH: NextAuthClientConfig,
+  logger: LoggerInstance,
+  { ctx, req = ctx?.req }: CtxOrReq = {}
+): Promise<T | null> {
+  try {
+    const options = req?.headers.cookie
+      ? { headers: { cookie: req.headers.cookie } }
+      : {}
+    const res = await fetch(`${apiBaseUrl(__NEXTAUTH)}/${path}`, options)
+    const data = await res.json()
+    if (!res.ok) throw data
+    return Object.keys(data).length > 0 ? data : null // Return null if data empty
+  } catch (error) {
+    logger.error("CLIENT_FETCH_ERROR", {
+      error: error as Error,
+      path,
+      ...(req ? { header: req.headers } : {}),
+    })
+    return null
+  }
+}
+
+export function apiBaseUrl(__NEXTAUTH: NextAuthClientConfig) {
+  if (typeof window === "undefined") {
+    // Return absolute path when called server side
+    return `${__NEXTAUTH.baseUrlServer}${__NEXTAUTH.basePathServer}`
+  }
+  // Return relative path when called client side
+  return __NEXTAUTH.basePath
+}
+
+/** Returns the number of seconds elapsed since January 1, 1970 00:00:00 UTC. */
+export function now() {
+  return Math.floor(Date.now() / 1000)
+}
+
+export interface BroadcastMessage {
+  event?: "session"
+  data?: { trigger?: "signout" | "getSession" }
+  clientId: string
+  timestamp: number
+}
+
+/**
+ * Inspired by [Broadcast Channel API](https://developer.mozilla.org/en-US/docs/Web/API/Broadcast_Channel_API)
+ * Only not using it directly, because Safari does not support it.
+ *
+ * https://caniuse.com/?search=broadcastchannel
+ */
+export function BroadcastChannel(name = "nextauth.message") {
+  return {
+    /** Get notified by other tabs/windows. */
+    receive(onReceive: (message: BroadcastMessage) => void) {
+      const handler = (event: StorageEvent) => {
+        if (event.key !== name) return
+        const message: BroadcastMessage = JSON.parse(event.newValue ?? "{}")
+        if (message?.event !== "session" || !message?.data) return
+
+        onReceive(message)
+      }
+      window.addEventListener("storage", handler)
+      return () => window.removeEventListener("storage", handler)
+    },
+    /** Notify other tabs/windows. */
+    post(message: Record<string, unknown>) {
+      if (typeof window === "undefined") return
+      localStorage.setItem(
+        name,
+        JSON.stringify({ ...message, timestamp: now() })
+      )
+    },
+  }
+}

src/core/errors.ts

@@ -0,0 +1,118 @@
+import type { EventCallbacks, LoggerInstance } from ".."
+import type { Adapter } from "../adapters"
+
+/**
+ * Same as the default `Error`, but it is JSON serializable.
+ * @source https://iaincollins.medium.com/error-handling-in-javascript-a6172ccdf9af
+ */
+export class UnknownError extends Error {
+  code: string
+  constructor(error: Error | string) {
+    // Support passing error or string
+    super((error as Error)?.message ?? error)
+    this.name = "UnknownError"
+    this.code = (error as any).code
+    if (error instanceof Error) {
+      this.stack = error.stack
+    }
+  }
+
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      stack: this.stack,
+    }
+  }
+}
+
+export class OAuthCallbackError extends UnknownError {
+  name = "OAuthCallbackError"
+}
+
+/**
+ * Thrown when an Email address is already associated with an account
+ * but the user is trying an OAuth account that is not linked to it.
+ */
+export class AccountNotLinkedError extends UnknownError {
+  name = "AccountNotLinkedError"
+}
+
+export class MissingAPIRoute extends UnknownError {
+  name = "MissingAPIRouteError"
+  code = "MISSING_NEXTAUTH_API_ROUTE_ERROR"
+}
+
+export class MissingSecret extends UnknownError {
+  name = "MissingSecretError"
+  code = "NO_SECRET"
+}
+
+export class MissingAuthorize extends UnknownError {
+  name = "MissingAuthorizeError"
+  code = "CALLBACK_CREDENTIALS_HANDLER_ERROR"
+}
+
+export class MissingAdapter extends UnknownError {
+  name = "MissingAdapterError"
+  code = "EMAIL_REQUIRES_ADAPTER_ERROR"
+}
+
+export class UnsupportedStrategy extends UnknownError {
+  name = "UnsupportedStrategyError"
+  code = "CALLBACK_CREDENTIALS_JWT_ERROR"
+}
+
+type Method = (...args: any[]) => Promise<any>
+
+export function upperSnake(s: string) {
+  return s.replace(/([A-Z])/g, "_$1").toUpperCase()
+}
+
+export function capitalize(s: string) {
+  return `${s[0].toUpperCase()}${s.slice(1)}`
+}
+
+/**
+ * Wraps an object of methods and adds error handling.
+ */
+export function eventsErrorHandler(
+  methods: Partial<EventCallbacks>,
+  logger: LoggerInstance
+): Partial<EventCallbacks> {
+  return Object.keys(methods).reduce<any>((acc, name) => {
+    acc[name] = async (...args: any[]) => {
+      try {
+        const method: Method = methods[name as keyof Method]
+        return await method(...args)
+      } catch (e) {
+        logger.error(`${upperSnake(name)}_EVENT_ERROR`, e as Error)
+      }
+    }
+    return acc
+  }, {})
+}
+
+/** Handles adapter induced errors. */
+export function adapterErrorHandler(
+  adapter: Adapter | undefined,
+  logger: LoggerInstance
+): Adapter | undefined {
+  if (!adapter) return
+
+  return Object.keys(adapter).reduce<any>((acc, name) => {
+    acc[name] = async (...args: any[]) => {
+      try {
+        logger.debug(`adapter_${name}`, { args })
+        const method: Method = adapter[name as keyof Method]
+        return await method(...args)
+      } catch (error) {
+        logger.error(`adapter_error_${name}`, error as Error)
+        const e = new UnknownError(error as Error)
+        e.name = `${capitalize(name)}Error`
+        throw e
+      }
+    }
+    return acc
+  }, {})
+}

src/core/index.ts

@@ -0,0 +1,236 @@
+import logger, { setLogger } from "../lib/logger"
+import * as routes from "./routes"
+import renderPage from "./pages"
+import { init } from "./init"
+import { assertConfig } from "./lib/assert"
+import { SessionStore } from "./lib/cookie"
+
+import type { NextAuthOptions } from "./types"
+import type { NextAuthAction } from "../lib/types"
+import type { Cookie } from "./lib/cookie"
+import type { ErrorType } from "./pages/error"
+
+export interface IncomingRequest {
+  /** @default "http://localhost:3000" */
+  host?: string
+  method?: string
+  cookies?: Record<string, string>
+  headers?: Record<string, any>
+  query?: Record<string, any>
+  body?: Record<string, any>
+  action: NextAuthAction
+  providerId?: string
+  error?: string
+}
+
+export interface NextAuthHeader {
+  key: string
+  value: string
+}
+
+export interface OutgoingResponse<
+  Body extends string | Record<string, any> | any[] = any
+> {
+  status?: number
+  headers?: NextAuthHeader[]
+  body?: Body
+  redirect?: string
+  cookies?: Cookie[]
+}
+
+export interface NextAuthHandlerParams {
+  req: IncomingRequest
+  options: NextAuthOptions
+}
+
+export async function NextAuthHandler<
+  Body extends string | Record<string, any> | any[]
+>(params: NextAuthHandlerParams): Promise<OutgoingResponse<Body>> {
+  const { options: userOptions, req } = params
+
+  setLogger(userOptions.logger, userOptions.debug)
+
+  const assertionResult = assertConfig(params)
+
+  if (typeof assertionResult === "string") {
+    logger.warn(assertionResult)
+  } else if (assertionResult instanceof Error) {
+    // Bail out early if there's an error in the user config
+    const { pages, theme } = userOptions
+    logger.error(assertionResult.code, assertionResult)
+    if (pages?.error) {
+      return {
+        redirect: `${pages.error}?error=Configuration`,
+      }
+    }
+    const render = renderPage({ theme })
+    return render.error({ error: "configuration" })
+  }
+
+  const { action, providerId, error, method = "GET" } = req
+
+  const { options, cookies } = await init({
+    userOptions,
+    action,
+    providerId,
+    host: req.host,
+    callbackUrl: req.body?.callbackUrl ?? req.query?.callbackUrl,
+    csrfToken: req.body?.csrfToken,
+    cookies: req.cookies,
+    isPost: method === "POST",
+  })
+
+  const sessionStore = new SessionStore(
+    options.cookies.sessionToken,
+    req,
+    options.logger
+  )
+
+  if (method === "GET") {
+    const render = renderPage({ ...options, query: req.query, cookies })
+    const { pages } = options
+    switch (action) {
+      case "providers":
+        return (await routes.providers(options.providers)) as any
+      case "session": {
+        const session = await routes.session({ options, sessionStore })
+        if (session.cookies) cookies.push(...session.cookies)
+        return { ...session, cookies } as any
+      }
+      case "csrf":
+        return {
+          headers: [{ key: "Content-Type", value: "application/json" }],
+          body: { csrfToken: options.csrfToken } as any,
+          cookies,
+        }
+      case "signin":
+        if (pages.signIn) {
+          let signinUrl = `${pages.signIn}${
+            pages.signIn.includes("?") ? "&" : "?"
+          }callbackUrl=${options.callbackUrl}`
+          if (error) signinUrl = `${signinUrl}&error=${error}`
+          return { redirect: signinUrl, cookies }
+        }
+
+        return render.signin()
+      case "signout":
+        if (pages.signOut) return { redirect: pages.signOut, cookies }
+
+        return render.signout()
+      case "callback":
+        if (options.provider) {
+          const callback = await routes.callback({
+            body: req.body,
+            query: req.query,
+            headers: req.headers,
+            cookies: req.cookies,
+            method,
+            options,
+            sessionStore,
+          })
+          if (callback.cookies) cookies.push(...callback.cookies)
+          return { ...callback, cookies }
+        }
+        break
+      case "verify-request":
+        if (pages.verifyRequest) {
+          return { redirect: pages.verifyRequest, cookies }
+        }
+        return render.verifyRequest()
+      case "error":
+        // These error messages are displayed in line on the sign in page
+        if (
+          [
+            "Signin",
+            "OAuthSignin",
+            "OAuthCallback",
+            "OAuthCreateAccount",
+            "EmailCreateAccount",
+            "Callback",
+            "OAuthAccountNotLinked",
+            "EmailSignin",
+            "CredentialsSignin",
+            "SessionRequired",
+          ].includes(error as string)
+        ) {
+          return { redirect: `${options.url}/signin?error=${error}`, cookies }
+        }
+
+        if (pages.error) {
+          return {
+            redirect: `${pages.error}${
+              pages.error.includes("?") ? "&" : "?"
+            }error=${error}`,
+            cookies,
+          }
+        }
+
+        return render.error({ error: error as ErrorType })
+      default:
+    }
+  } else if (method === "POST") {
+    switch (action) {
+      case "signin":
+        // Verified CSRF Token required for all sign in routes
+        if (options.csrfTokenVerified && options.provider) {
+          const signin = await routes.signin({
+            query: req.query,
+            body: req.body,
+            options,
+          })
+          if (signin.cookies) cookies.push(...signin.cookies)
+          return { ...signin, cookies }
+        }
+
+        return { redirect: `${options.url}/signin?csrf=true`, cookies }
+      case "signout":
+        // Verified CSRF Token required for signout
+        if (options.csrfTokenVerified) {
+          const signout = await routes.signout({ options, sessionStore })
+          if (signout.cookies) cookies.push(...signout.cookies)
+          return { ...signout, cookies }
+        }
+        return { redirect: `${options.url}/signout?csrf=true`, cookies }
+      case "callback":
+        if (options.provider) {
+          // Verified CSRF Token required for credentials providers only
+          if (
+            options.provider.type === "credentials" &&
+            !options.csrfTokenVerified
+          ) {
+            return { redirect: `${options.url}/signin?csrf=true`, cookies }
+          }
+
+          const callback = await routes.callback({
+            body: req.body,
+            query: req.query,
+            headers: req.headers,
+            cookies: req.cookies,
+            method,
+            options,
+            sessionStore,
+          })
+          if (callback.cookies) cookies.push(...callback.cookies)
+          return { ...callback, cookies }
+        }
+        break
+      case "_log":
+        if (userOptions.logger) {
+          try {
+            const { code, level, ...metadata } = req.body ?? {}
+            logger[level](code, metadata)
+          } catch (error) {
+            // If logging itself failed...
+            logger.error("LOGGER_ERROR", error as Error)
+          }
+        }
+        return {}
+      default:
+    }
+  }
+
+  return {
+    status: 400,
+    body: `Error: Action ${action} with HTTP ${method} is not supported by NextAuth.js` as any,
+  }
+}

src/core/init.ts

@@ -0,0 +1,147 @@
+import { NextAuthOptions } from ".."
+import logger from "../lib/logger"
+import parseUrl from "../lib/parse-url"
+import { InternalOptions } from "../lib/types"
+import { adapterErrorHandler, eventsErrorHandler } from "./errors"
+import parseProviders from "./lib/providers"
+import createSecret from "./lib/utils"
+import * as cookie from "./lib/cookie"
+import * as jwt from "../jwt"
+import { defaultCallbacks } from "./lib/default-callbacks"
+import { createCSRFToken } from "./lib/csrf-token"
+import { createCallbackUrl } from "./lib/callback-url"
+import { IncomingRequest } from "."
+
+interface InitParams {
+  host?: string
+  userOptions: NextAuthOptions
+  providerId?: string
+  action: InternalOptions["action"]
+  /** Callback URL value extracted from the incoming request. */
+  callbackUrl?: string
+  /** CSRF token value extracted from the incoming request. From body if POST, from query if GET */
+  csrfToken?: string
+  /** Is the incoming request a POST request? */
+  isPost: boolean
+  cookies: IncomingRequest["cookies"]
+}
+
+/** Initialize all internal options and cookies. */
+export async function init({
+  userOptions,
+  providerId,
+  action,
+  host,
+  cookies: reqCookies,
+  callbackUrl: reqCallbackUrl,
+  csrfToken: reqCsrfToken,
+  isPost,
+}: InitParams): Promise<{
+  options: InternalOptions
+  cookies: cookie.Cookie[]
+}> {
+  const url = parseUrl(host)
+
+  const secret = createSecret({ userOptions, url })
+
+  const { providers, provider } = parseProviders({
+    providers: userOptions.providers,
+    url,
+    providerId,
+  })
+
+  const maxAge = 30 * 24 * 60 * 60 // Sessions expire after 30 days of being idle by default
+
+  // User provided options are overriden by other options,
+  // except for the options with special handling above
+  const options: InternalOptions = {
+    debug: false,
+    pages: {},
+    theme: {
+      colorScheme: "auto",
+      logo: "",
+      brandColor: "",
+    },
+    // Custom options override defaults
+    ...userOptions,
+    // These computed settings can have values in userOptions but we override them
+    // and are request-specific.
+    url,
+    action,
+    provider,
+    cookies: {
+      ...cookie.defaultCookies(
+        userOptions.useSecureCookies ?? url.base.startsWith("https://")
+      ),
+      // Allow user cookie options to override any cookie settings above
+      ...userOptions.cookies,
+    },
+    secret,
+    providers,
+    // Session options
+    session: {
+      // If no adapter specified, force use of JSON Web Tokens (stateless)
+      strategy: userOptions.adapter ? "database" : "jwt",
+      maxAge,
+      updateAge: 24 * 60 * 60,
+      ...userOptions.session,
+    },
+    // JWT options
+    jwt: {
+      secret, // Use application secret if no keys specified
+      maxAge, // same as session maxAge,
+      encode: jwt.encode,
+      decode: jwt.decode,
+      ...userOptions.jwt,
+    },
+    // Event messages
+    events: eventsErrorHandler(userOptions.events ?? {}, logger),
+    adapter: adapterErrorHandler(userOptions.adapter, logger),
+    // Callback functions
+    callbacks: { ...defaultCallbacks, ...userOptions.callbacks },
+    logger,
+    callbackUrl: url.origin,
+  }
+
+  // Init cookies
+
+  const cookies: cookie.Cookie[] = []
+
+  const {
+    csrfToken,
+    cookie: csrfCookie,
+    csrfTokenVerified,
+  } = createCSRFToken({
+    options,
+    cookieValue: reqCookies?.[options.cookies.csrfToken.name],
+    isPost,
+    bodyValue: reqCsrfToken,
+  })
+
+  options.csrfToken = csrfToken
+  options.csrfTokenVerified = csrfTokenVerified
+
+  if (csrfCookie) {
+    cookies.push({
+      name: options.cookies.csrfToken.name,
+      value: csrfCookie,
+      options: options.cookies.csrfToken.options,
+    })
+  }
+
+  const { callbackUrl, callbackUrlCookie } = await createCallbackUrl({
+    options,
+    cookieValue: reqCookies?.[options.cookies.callbackUrl.name],
+    paramValue: reqCallbackUrl,
+  })
+  options.callbackUrl = callbackUrl
+  if (callbackUrlCookie) {
+    cookies.push({
+      name: options.cookies.callbackUrl.name,
+      value: callbackUrlCookie,
+      options: options.cookies.callbackUrl.options,
+    })
+  }
+
+  return { options, cookies }
+}

src/core/lib/assert.ts

@@ -0,0 +1,87 @@
+import {
+  MissingAdapter,
+  MissingAPIRoute,
+  MissingAuthorize,
+  MissingSecret,
+  UnsupportedStrategy,
+} from "../errors"
+
+import type { NextAuthHandlerParams } from ".."
+import type { WarningCode } from "../../lib/logger"
+
+type ConfigError =
+  | MissingAPIRoute
+  | MissingSecret
+  | UnsupportedStrategy
+  | MissingAuthorize
+  | MissingAdapter
+
+let twitterWarned = false
+
+/**
+ * Verify that the user configured `next-auth` correctly.
+ * Good place to mention deprecations as well.
+ *
+ * REVIEW: Make some of these and corresponding docs less Next.js specific?
+ */
+export function assertConfig(
+  params: NextAuthHandlerParams
+): ConfigError | WarningCode | undefined {
+  const { options, req } = params
+
+  // req.query isn't defined when asserting `getServerSession` for example
+  if (!req.query?.nextauth && !req.action) {
+    return new MissingAPIRoute(
+      "Cannot find [...nextauth].{js,ts} in `/pages/api/auth`. Make sure the filename is written correctly."
+    )
+  }
+
+  if (!options.secret) {
+    if (process.env.NODE_ENV === "production") {
+      return new MissingSecret("Please define a `secret` in production.")
+    } else {
+      return "NO_SECRET"
+    }
+  }
+
+  if (!req.host) return "NEXTAUTH_URL"
+
+  let hasCredentials, hasEmail
+  let hasTwitterProvider
+
+  for (const provider of options.providers) {
+    if (provider.type === "credentials") hasCredentials = true
+    else if (provider.type === "email") hasEmail = true
+    else if (provider.id === "twitter") hasTwitterProvider = true
+  }
+
+  if (hasCredentials) {
+    const dbStrategy = options.session?.strategy === "database"
+    const onlyCredentials = !options.providers.some(
+      (p) => p.type !== "credentials"
+    )
+    if (dbStrategy && onlyCredentials) {
+      return new UnsupportedStrategy(
+        "Signin in with credentials only supported if JWT strategy is enabled"
+      )
+    }
+
+    const credentialsNoAuthorize = options.providers.some(
+      (p) => p.type === "credentials" && !p.authorize
+    )
+    if (credentialsNoAuthorize) {
+      return new MissingAuthorize(
+        "Must define an authorize() handler to use credentials authentication provider"
+      )
+    }
+  }
+
+  if (hasEmail && !options.adapter) {
+    return new MissingAdapter("E-mail login requires an adapter.")
+  }
+
+  if (!twitterWarned && hasTwitterProvider) {
+    twitterWarned = true
+    return "TWITTER_OAUTH_2_BETA"
+  }
+}

src/core/lib/callback-handler.ts

@@ -1,7 +1,11 @@
-// @ts-check
-import { AccountNotLinkedError } from "../../lib/errors"
+import { AccountNotLinkedError } from "../errors"
 import { fromDate } from "./utils"
 import { randomBytes, randomUUID } from "crypto"
+import { InternalOptions } from "../../lib/types"
+import { AdapterSession, AdapterUser } from "../../adapters"
+import { JWT } from "../../jwt"
+import { Account, User } from "../.."
+import { SessionToken } from "./cookie"
 
 /**
  * This function handles the complex flow of signing users in, and either creating,
@@ -14,17 +18,14 @@ import { randomBytes, randomUUID } from "crypto"
  * All verification (e.g. OAuth flows or email address verificaiton flows) are
  * done prior to this handler being called to avoid additonal complexity in this
  * handler.
- * @param {import("types/internals/cookies").SessionToken | null} sessionToken
- * @param {import("types").User} profile
- * @param {import("types").Account} account
- * @param {import("types/internals").InternalOptions} options
  */
-export default async function callbackHandler(
-  sessionToken,
-  profile,
-  account,
-  options
-) {
+export default async function callbackHandler(params: {
+  sessionToken?: SessionToken
+  profile: User
+  account: Account
+  options: InternalOptions
+}) {
+  const { sessionToken, profile, account, options } = params
   // Input validation
   if (!account?.providerAccountId || !account.type)
     throw new Error("Missing or invalid provider account")
@@ -35,7 +36,7 @@ export default async function callbackHandler(
     adapter,
     jwt,
     events,
-    session: { jwt: useJwtSession },
+    session: { strategy: sessionStrategy },
   } = options
 
   // If no adapter is configured then we don't have a database and cannot
@@ -56,17 +57,17 @@ export default async function callbackHandler(
     deleteSession,
   } = adapter
 
-  /** @type {import("types/adapters").AdapterSession | import("types/jwt").JWT | null} */
-  let session = null
-  /** @type {import("types/adapters").AdapterUser | null} */
-  let user = null
+  let session: AdapterSession | JWT | null = null
+  let user: AdapterUser | null = null
   let isNewUser = false
 
+  const useJwtSession = sessionStrategy === "jwt"
+
   if (sessionToken) {
     if (useJwtSession) {
       try {
         session = await jwt.decode({ ...jwt, token: sessionToken })
-        if (session?.sub) {
+        if (session && "sub" in session && session.sub) {
           user = await getUser(session.sub)
         }
       } catch {
@@ -101,8 +102,7 @@ export default async function callbackHandler(
       await events.updateUser?.({ user })
     } else {
       const newUser = { ...profile, emailVerified: new Date() }
-      // @ts-ignore Force the adapter to create its own user id
-      delete newUser.id
+      delete (newUser as Omit<AdapterUser, "id">).id
       // Create user account if there isn't one for the email address already
       user = await createUser(newUser)
       await events.createUser?.({ user })
@@ -132,9 +132,11 @@ export default async function callbackHandler(
           return { session, user, isNewUser }
         }
         // If the user is currently signed in, but the new account they are signing in
-        // with is already associated with another account, then we cannot link them
+        // with is already associated with another user, then we cannot link them
         // and need to return an error.
-        throw new AccountNotLinkedError()
+        throw new AccountNotLinkedError(
+          "The account is already associated with another user"
+        )
       }
       // If there is no active session, but the account being signed in with is already
       // associated with a valid user then create session to sign the user in.
@@ -186,7 +188,9 @@ export default async function callbackHandler(
         // We don't want to have two accounts with the same email address, and we don't
         // want to link them in case it's not safe to do so, so instead we prompt the user
         // to sign in via email to verify their identity and then link the accounts.
-        throw new AccountNotLinkedError()
+        throw new AccountNotLinkedError(
+          "Another account already exists with the same e-mail address"
+        )
       }
       // If the current user is not logged in and the profile isn't linked to any user
       // accounts (by email or provider account id)...
@@ -195,8 +199,7 @@ export default async function callbackHandler(
       // create a new account for the user, link it to the OAuth acccount and
       // create a new session for them so they are signed in with it.
       const newUser = { ...profile, emailVerified: null }
-      // @ts-ignore Force the adapter to create its own user id
-      delete newUser.id
+      delete (newUser as Omit<AdapterUser, "id">).id
       user = await createUser(newUser)
       await events.createUser?.({ user })
 

src/core/lib/callback-url.ts

@@ -0,0 +1,42 @@
+import { InternalOptions } from "../../lib/types"
+
+interface CreateCallbackUrlParams {
+  options: InternalOptions
+  /** Try reading value from request body (POST) then from query param (GET) */
+  paramValue?: string
+  cookieValue?: string
+}
+
+/**
+ * Get callback URL based on query param / cookie + validation,
+ * and add it to `req.options.callbackUrl`.
+ */
+export async function createCallbackUrl({
+  options,
+  paramValue,
+  cookieValue,
+}: CreateCallbackUrlParams) {
+  const { url, callbacks } = options
+
+  let callbackUrl = url.origin
+
+  if (paramValue) {
+    // If callbackUrl form field or query parameter is passed try to use it if allowed
+    callbackUrl = await callbacks.redirect({
+      url: paramValue,
+      baseUrl: url.origin,
+    })
+  } else if (cookieValue) {
+    // If no callbackUrl specified, try using the value from the cookie if allowed
+    callbackUrl = await callbacks.redirect({
+      url: cookieValue,
+      baseUrl: url.origin,
+    })
+  }
+
+  return {
+    callbackUrl,
+    // Save callback URL in a cookie so that it can be used for subsequent requests in signin/signout/callback flow
+    callbackUrlCookie: callbackUrl !== cookieValue ? callbackUrl : undefined,
+  }
+}

src/core/lib/cookie.ts

@@ -0,0 +1,212 @@
+import type { IncomingHttpHeaders } from "http"
+import type { CookiesOptions } from "../.."
+import type { CookieOption, LoggerInstance, SessionStrategy } from "../types"
+
+// Uncomment to recalculate the estimated size
+// of an empty session cookie
+// import { serialize } from "cookie"
+// console.log(
+//   "Cookie estimated to be ",
+//   serialize(`__Secure.next-auth.session-token.0`, "", {
+//     expires: new Date(),
+//     httpOnly: true,
+//     maxAge: Number.MAX_SAFE_INTEGER,
+//     path: "/",
+//     sameSite: "strict",
+//     secure: true,
+//     domain: "example.com",
+//   }).length,
+//   " bytes"
+// )
+
+const ALLOWED_COOKIE_SIZE = 4096
+// Based on commented out section above
+const ESTIMATED_EMPTY_COOKIE_SIZE = 163
+const CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE
+
+// REVIEW: Is there any way to defer two types of strings?
+
+/** Stringified form of `JWT`. Extract the content with `jwt.decode` */
+export type JWTString = string
+
+export type SetCookieOptions = Partial<CookieOption["options"]> & {
+  expires?: Date | string
+  encode?: (val: unknown) => string
+}
+
+/**
+ * If `options.session.strategy` is set to `jwt`, this is a stringified `JWT`.
+ * In case of `strategy: "database"`, this is the `sessionToken` of the session in the database.
+ */
+export type SessionToken<T extends SessionStrategy = "jwt"> = T extends "jwt"
+  ? JWTString
+  : string
+
+/**
+ * Use secure cookies if the site uses HTTPS
+ * This being conditional allows cookies to work non-HTTPS development URLs
+ * Honour secure cookie option, which sets 'secure' and also adds '__Secure-'
+ * prefix, but enable them by default if the site URL is HTTPS; but not for
+ * non-HTTPS URLs like http://localhost which are used in development).
+ * For more on prefixes see https://googlechrome.github.io/samples/cookie-prefixes/
+ *
+ * @TODO Review cookie settings (names, options)
+ */
+export function defaultCookies(useSecureCookies: boolean): CookiesOptions {
+  const cookiePrefix = useSecureCookies ? "__Secure-" : ""
+  return {
+    // default cookie options
+    sessionToken: {
+      name: `${cookiePrefix}next-auth.session-token`,
+      options: {
+        httpOnly: true,
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
+    },
+    callbackUrl: {
+      name: `${cookiePrefix}next-auth.callback-url`,
+      options: {
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
+    },
+    csrfToken: {
+      // Default to __Host- for CSRF token for additional protection if using useSecureCookies
+      // NB: The `__Host-` prefix is stricter than the `__Secure-` prefix.
+      name: `${useSecureCookies ? "__Host-" : ""}next-auth.csrf-token`,
+      options: {
+        httpOnly: true,
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
+    },
+    pkceCodeVerifier: {
+      name: `${cookiePrefix}next-auth.pkce.code_verifier`,
+      options: {
+        httpOnly: true,
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
+    },
+    state: {
+      name: `${cookiePrefix}next-auth.state`,
+      options: {
+        httpOnly: true,
+        sameSite: "lax",
+        path: "/",
+        secure: useSecureCookies,
+      },
+    },
+  }
+}
+
+export interface Cookie extends CookieOption {
+  value: string
+}
+
+type Chunks = Record<string, string>
+
+export class SessionStore {
+  #chunks: Chunks = {}
+  #option: CookieOption
+  #logger: LoggerInstance | Console
+
+  constructor(
+    option: CookieOption,
+    req: {
+      cookies?: Record<string, string>
+      headers?: Record<string, string> | IncomingHttpHeaders
+    },
+    logger: LoggerInstance | Console
+  ) {
+    this.#logger = logger
+    this.#option = option
+
+    if (!req) return
+
+    for (const name in req.cookies) {
+      if (name.startsWith(option.name)) {
+        this.#chunks[name] = req.cookies[name]
+      }
+    }
+  }
+
+  get value() {
+    return Object.values(this.#chunks)?.join("")
+  }
+
+  /** Given a cookie, return a list of cookies, chunked to fit the allowed cookie size. */
+  #chunk(cookie: Cookie): Cookie[] {
+    const chunkCount = Math.ceil(cookie.value.length / CHUNK_SIZE)
+
+    if (chunkCount === 1) {
+      this.#chunks[cookie.name] = cookie.value
+      return [cookie]
+    }
+
+    const cookies: Cookie[] = []
+    for (let i = 0; i < chunkCount; i++) {
+      const name = `${cookie.name}.${i}`
+      const value = cookie.value.substr(i * CHUNK_SIZE, CHUNK_SIZE)
+      cookies.push({ ...cookie, name, value })
+      this.#chunks[name] = value
+    }
+
+    this.#logger.debug("CHUNKING_SESSION_COOKIE", {
+      message: `Session cookie exceeds allowed ${ALLOWED_COOKIE_SIZE} bytes.`,
+      emptyCookieSize: ESTIMATED_EMPTY_COOKIE_SIZE,
+      valueSize: cookie.value.length,
+      chunks: cookies.map((c) => c.value.length + ESTIMATED_EMPTY_COOKIE_SIZE),
+    })
+
+    return cookies
+  }
+
+  /** Returns cleaned cookie chunks. */
+  #clean(): Record<string, Cookie> {
+    const cleanedChunks: Record<string, Cookie> = {}
+    for (const name in this.#chunks) {
+      delete this.#chunks?.[name]
+      cleanedChunks[name] = {
+        name,
+        value: "",
+        options: { ...this.#option.options, maxAge: 0 },
+      }
+    }
+    return cleanedChunks
+  }
+
+  /**
+   * Given a cookie value, return new cookies, chunked, to fit the allowed cookie size.
+   * If the cookie has changed from chunked to unchunked or vice versa,
+   * it deletes the old cookies as well.
+   */
+  chunk(value: string, options: Partial<Cookie["options"]>): Cookie[] {
+    // Assume all cookies should be cleaned by default
+    const cookies: Record<string, Cookie> = this.#clean()
+
+    // Calculate new chunks
+    const chunked = this.#chunk({
+      name: this.#option.name,
+      value,
+      options: { ...this.#option.options, ...options },
+    })
+
+    // Update stored chunks / cookies
+    for (const chunk of chunked) {
+      cookies[chunk.name] = chunk
+    }
+
+    return Object.values(cookies)
+  }
+
+  /** Returns a list of cookies that should be cleaned. */
+  clean(): Cookie[] {
+    return Object.values(this.#clean())
+  }
+}

src/core/lib/csrf-token.ts

@@ -0,0 +1,54 @@
+import { createHash, randomBytes } from "crypto"
+import { InternalOptions } from "../../lib/types"
+
+interface CreateCSRFTokenParams {
+  options: InternalOptions
+  cookieValue?: string
+  isPost: boolean
+  bodyValue?: string
+}
+
+/**
+ * Ensure CSRF Token cookie is set for any subsequent requests.
+ * Used as part of the strategy for mitigation for CSRF tokens.
+ *
+ * Creates a cookie like 'next-auth.csrf-token' with the value 'token|hash',
+ * where 'token' is the CSRF token and 'hash' is a hash made of the token and
+ * the secret, and the two values are joined by a pipe '|'. By storing the
+ * value and the hash of the value (with the secret used as a salt) we can
+ * verify the cookie was set by the server and not by a malicous attacker.
+ *
+ * For more details, see the following OWASP links:
+ * https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie
+ * https://owasp.org/www-chapter-london/assets/slides/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf
+ */
+export function createCSRFToken({
+  options,
+  cookieValue,
+  isPost,
+  bodyValue,
+}: CreateCSRFTokenParams) {
+  if (cookieValue) {
+    const [csrfToken, csrfTokenHash] = cookieValue.split("|")
+    const expectedCsrfTokenHash = createHash("sha256")
+      .update(`${csrfToken}${options.secret}`)
+      .digest("hex")
+    if (csrfTokenHash === expectedCsrfTokenHash) {
+      // If hash matches then we trust the CSRF token value
+      // If this is a POST request and the CSRF Token in the POST request matches
+      // the cookie we have already verified is the one we have set, then the token is verified!
+      const csrfTokenVerified = isPost && csrfToken === bodyValue
+
+      return { csrfTokenVerified, csrfToken }
+    }
+  }
+
+  // New CSRF token
+  const csrfToken = randomBytes(32).toString("hex")
+  const csrfTokenHash = createHash("sha256")
+    .update(`${csrfToken}${options.secret}`)
+    .digest("hex")
+  const cookie = `${csrfToken}|${csrfTokenHash}`
+
+  return { cookie, csrfToken }
+}

src/core/lib/default-callbacks.ts

@@ -0,0 +1,18 @@
+import { CallbacksOptions } from "../.."
+
+export const defaultCallbacks: CallbacksOptions = {
+  signIn() {
+    return true
+  },
+  redirect({ url, baseUrl }) {
+    if (url.startsWith(baseUrl)) return url
+    else if (url.startsWith("/")) return new URL(url, baseUrl).toString()
+    return baseUrl
+  },
+  session({ session }) {
+    return session
+  },
+  jwt({ token }) {
+    return token
+  },
+}

src/core/lib/email/signin.ts

@@ -1,19 +1,16 @@
-// @ts-check
 import { randomBytes } from "crypto"
+import { InternalOptions } from "../../../lib/types"
 import { hashToken } from "../utils"
 
-/**
- * @typedef {import("types/providers").EmailConfig} EmailConfig
- */
-
 /**
  * Starts an e-mail login flow, by generating a token,
  * and sending it to the user's e-mail (with the help of a DB adapter)
- * @param {string} identifier
- * @param {import("types/internals").InternalOptions<EmailConfig>} options
  */
-export default async function email(identifier, options) {
-  const { baseUrl, basePath, adapter, provider, logger, callbackUrl } = options
+export default async function email(
+  identifier: string,
+  options: InternalOptions<"email">
+) {
+  const { url, adapter, provider, logger, callbackUrl } = options
 
   // Generate token
   const token =
@@ -35,7 +32,7 @@ export default async function email(identifier, options) {
 
   // Generate a link with email, unhashed token and callback url
   const params = new URLSearchParams({ callbackUrl, token, email: identifier })
-  const url = `${baseUrl}${basePath}/callback/${provider.id}?${params}`
+  const _url = `${url}/callback/${provider.id}?${params}`
 
   try {
     // Send to user
@@ -43,14 +40,14 @@ export default async function email(identifier, options) {
       identifier,
       token,
       expires,
-      url,
+      url: _url,
       provider,
     })
   } catch (error) {
     logger.error("SEND_VERIFICATION_EMAIL_ERROR", {
       identifier,
       url,
-      error,
+      error: error as Error,
     })
     throw new Error("SEND_VERIFICATION_EMAIL_ERROR")
   }

src/core/lib/oauth/authorization-url.ts

@@ -0,0 +1,79 @@
+import { openidClient } from "./client"
+import { oAuth1Client } from "./client-legacy"
+import { createState } from "./state-handler"
+import { createPKCE } from "./pkce-handler"
+
+import type { AuthorizationParameters } from "openid-client"
+import type { InternalOptions } from "../../../lib/types"
+import type { IncomingRequest } from "../.."
+import type { Cookie } from "../cookie"
+
+/**
+ *
+ * Generates an authorization/request token URL.
+ *
+ * [OAuth 2](https://www.oauth.com/oauth2-servers/authorization/the-authorization-request/) | [OAuth 1](https://oauth.net/core/1.0a/#auth_step2)
+ */
+export default async function getAuthorizationUrl(params: {
+  options: InternalOptions<"oauth">
+  query: IncomingRequest["query"]
+}) {
+  const { options, query } = params
+  const { logger, provider } = options
+  try {
+    let params: any = {}
+
+    if (typeof provider.authorization === "string") {
+      const parsedUrl = new URL(provider.authorization)
+      const parsedParams = Object.fromEntries(parsedUrl.searchParams.entries())
+      params = { ...params, ...parsedParams }
+    } else {
+      params = { ...params, ...provider.authorization?.params }
+    }
+
+    params = { ...params, ...query }
+
+    // Handle OAuth v1.x
+    if (provider.version?.startsWith("1.")) {
+      const client = oAuth1Client(options)
+      const tokens = (await client.getOAuthRequestToken(params)) as any
+      const url = `${
+        // @ts-expect-error
+        provider.authorization?.url ?? provider.authorization
+      }?${new URLSearchParams({
+        oauth_token: tokens.oauth_token,
+        oauth_token_secret: tokens.oauth_token_secret,
+        ...tokens.params,
+      })}`
+
+      logger.debug("GET_AUTHORIZATION_URL", { url })
+      return { redirect: url }
+    }
+
+    const client = await openidClient(options)
+
+    const authorizationParams: AuthorizationParameters = params
+    const cookies: Cookie[] = []
+
+    const state = await createState(options)
+    if (state) {
+      authorizationParams.state = state.value
+      cookies.push(state.cookie)
+    }
+
+    const pkce = await createPKCE(options)
+    if (pkce) {
+      authorizationParams.code_challenge = pkce.code_challenge
+      authorizationParams.code_challenge_method = pkce.code_challenge_method
+      cookies.push(pkce.cookie)
+    }
+
+    const url = client.authorizationUrl(authorizationParams)
+
+    logger.debug("GET_AUTHORIZATION_URL", { url, cookies })
+    return { redirect: url, cookies }
+  } catch (error) {
+    logger.error("GET_AUTHORIZATION_URL_ERROR", error as Error)
+    throw error
+  }
+}

src/core/lib/oauth/callback.ts

@@ -0,0 +1,212 @@
+import { TokenSet } from "openid-client"
+import { openidClient } from "./client"
+import { oAuth1Client } from "./client-legacy"
+import { useState } from "./state-handler"
+import { usePKCECodeVerifier } from "./pkce-handler"
+import { OAuthCallbackError } from "../../errors"
+
+import type { CallbackParamsType } from "openid-client"
+import type { Account, LoggerInstance, Profile } from "../../.."
+import type { OAuthChecks, OAuthConfig } from "../../../providers"
+import type { InternalOptions } from "../../../lib/types"
+import type { IncomingRequest, OutgoingResponse } from "../.."
+import type { Cookie } from "../cookie"
+
+export default async function oAuthCallback(params: {
+  options: InternalOptions<"oauth">
+  query: IncomingRequest["query"]
+  body: IncomingRequest["body"]
+  method: Required<IncomingRequest>["method"]
+  cookies: IncomingRequest["cookies"]
+}): Promise<GetProfileResult & { cookies?: OutgoingResponse["cookies"] }> {
+  const { options, query, body, method, cookies } = params
+  const { logger, provider } = options
+
+  const errorMessage = body?.error ?? query?.error
+  if (errorMessage) {
+    const error = new Error(errorMessage)
+    logger.error("OAUTH_CALLBACK_HANDLER_ERROR", {
+      error,
+      error_description: query?.error_description,
+      body,
+      providerId: provider.id,
+    })
+    throw error
+  }
+
+  if (provider.version?.startsWith("1.")) {
+    try {
+      const client = await oAuth1Client(options)
+      // Handle OAuth v1.x
+      const { oauth_token, oauth_verifier } = query ?? {}
+      // @ts-expect-error
+      const tokens: TokenSet = await client.getOAuthAccessToken(
+        oauth_token as string,
+        // @ts-expect-error
+        null,
+        oauth_verifier
+      )
+      // @ts-expect-error
+      let profile: Profile = await client.get(
+        (provider as any).profileUrl,
+        tokens.oauth_token,
+        tokens.oauth_token_secret
+      )
+
+      if (typeof profile === "string") {
+        profile = JSON.parse(profile)
+      }
+
+      return await getProfile({ profile, tokens, provider, logger })
+    } catch (error) {
+      logger.error("OAUTH_V1_GET_ACCESS_TOKEN_ERROR", error as Error)
+      throw error
+    }
+  }
+
+  try {
+    const client = await openidClient(options)
+
+    let tokens: TokenSet
+
+    const checks: OAuthChecks = {}
+    const resCookies: Cookie[] = []
+
+    const state = await useState(cookies?.[options.cookies.state.name], options)
+
+    if (state) {
+      checks.state = state.value
+      resCookies.push(state.cookie)
+    }
+
+    const codeVerifier = cookies?.[options.cookies.pkceCodeVerifier.name]
+    const pkce = await usePKCECodeVerifier(codeVerifier, options)
+    if (pkce) {
+      checks.code_verifier = pkce.codeVerifier
+      resCookies.push(pkce.cookie)
+    }
+
+    const params: CallbackParamsType = {
+      ...client.callbackParams({
+        url: `http://n?${new URLSearchParams(query)}`,
+        // TODO: Ask to allow object to be passed upstream:
+        // https://github.com/panva/node-openid-client/blob/3ae206dfc78c02134aa87a07f693052c637cab84/types/index.d.ts#L439
+        // @ts-expect-error
+        body,
+        method,
+      }),
+      // @ts-expect-error
+      ...provider.token?.params,
+    }
+
+    // @ts-expect-error
+    if (provider.token?.request) {
+      // @ts-expect-error
+      const response = await provider.token.request({
+        provider,
+        params,
+        checks,
+        client,
+      })
+      tokens = new TokenSet(response.tokens)
+    } else if (provider.idToken) {
+      tokens = await client.callback(provider.callbackUrl, params, checks)
+    } else {
+      tokens = await client.oauthCallback(provider.callbackUrl, params, checks)
+    }
+
+    // REVIEW: How can scope be returned as an array?
+    if (Array.isArray(tokens.scope)) {
+      tokens.scope = tokens.scope.join(" ")
+    }
+
+    let profile: Profile
+    // @ts-expect-error
+    if (provider.userinfo?.request) {
+      // @ts-expect-error
+      profile = await provider.userinfo.request({
+        provider,
+        tokens,
+        client,
+      })
+    } else if (provider.idToken) {
+      profile = tokens.claims()
+    } else {
+      profile = await client.userinfo(tokens, {
+        // @ts-expect-error
+        params: provider.userinfo?.params,
+      })
+    }
+
+    const profileResult = await getProfile({
+      profile,
+      provider,
+      tokens,
+      logger,
+    })
+    return { ...profileResult, cookies: resCookies }
+  } catch (error) {
+    logger.error("OAUTH_CALLBACK_ERROR", {
+      error: error as Error,
+      providerId: provider.id,
+    })
+    throw new OAuthCallbackError(error as Error)
+  }
+}
+
+export interface GetProfileParams {
+  profile: Profile
+  tokens: TokenSet
+  provider: OAuthConfig<any>
+  logger: LoggerInstance
+}
+
+export interface GetProfileResult {
+  // @ts-expect-error
+  profile: ReturnType<OAuthConfig["profile"]> | null
+  account: Omit<Account, "userId"> | null
+  OAuthProfile: Profile
+}
+
+/** Returns profile, raw profile and auth provider details */
+async function getProfile({
+  profile: OAuthProfile,
+  tokens,
+  provider,
+  logger,
+}: GetProfileParams): Promise<GetProfileResult> {
+  try {
+    logger.debug("PROFILE_DATA", { OAuthProfile })
+    // @ts-expect-error
+    const profile = await provider.profile(OAuthProfile, tokens)
+    profile.email = profile.email?.toLowerCase()
+    // Return profile, raw profile and auth provider details
+    return {
+      profile,
+      account: {
+        provider: provider.id,
+        type: provider.type,
+        providerAccountId: profile.id.toString(),
+        ...tokens,
+      },
+      OAuthProfile,
+    }
+  } catch (error) {
+    // If we didn't get a response either there was a problem with the provider
+    // response *or* the user cancelled the action with the provider.
+    //
+    // Unfortuately, we can't tell which - at least not in a way that works for
+    // all providers, so we return an empty object; the user should then be
+    // redirected back to the sign up page. We log the error to help developers
+    // who might be trying to debug this when configuring a new provider.
+    logger.error("OAUTH_PARSE_PROFILE_ERROR", {
+      error: error as Error,
+      OAuthProfile,
+    })
+    return {
+      profile: null,
+      account: null,
+      OAuthProfile,
+    }
+  }
+}

src/core/lib/oauth/client-legacy.ts

@@ -2,29 +2,29 @@
 // We have the intentions to provide only minor fixes for this in the future.
 
 import { OAuth } from "oauth"
+import { InternalOptions } from "src/lib/types"
 
 /**
  * Client supporting OAuth 1.x
- * @param {import("types/internals").InternalOptions} options
  */
-export function oAuth1Client(options) {
-  /** @type {import("types/providers").OAuthConfig} */
+export function oAuth1Client(options: InternalOptions<"oauth">) {
   const provider = options.provider
 
   const oauth1Client = new OAuth(
-    provider.requestTokenUrl,
-    provider.accessTokenUrl,
-    provider.clientId,
-    provider.clientSecret,
-    provider.version || "1.0",
+    provider.requestTokenUrl as string,
+    provider.accessTokenUrl as string,
+    provider.clientId as string,
+    provider.clientSecret as string,
+    provider.version ?? "1.0",
     provider.callbackUrl,
-    provider.encoding || "HMAC-SHA1"
+    provider.encoding ?? "HMAC-SHA1"
   )
 
   // Promisify get()  for OAuth1
   const originalGet = oauth1Client.get.bind(oauth1Client)
-  oauth1Client.get = (...args) => {
-    return new Promise((resolve, reject) => {
+  // @ts-expect-error
+  oauth1Client.get = async (...args) => {
+    return await new Promise((resolve, reject) => {
       originalGet(...args, (error, result) => {
         if (error) {
           return reject(error)
@@ -36,15 +36,15 @@ export function oAuth1Client(options) {
   // Promisify getOAuth1AccessToken()  for OAuth1
   const originalGetOAuth1AccessToken =
     oauth1Client.getOAuthAccessToken.bind(oauth1Client)
-  oauth1Client.getOAuthAccessToken = (...args) => {
-    return new Promise((resolve, reject) => {
+  oauth1Client.getOAuthAccessToken = async (...args: any[]) => {
+    return await new Promise((resolve, reject) => {
       originalGetOAuth1AccessToken(
         ...args,
-        (error, oauth_token, oauth_token_secret) => {
+        (error: any, oauth_token: any, oauth_token_secret: any) => {
           if (error) {
             return reject(error)
           }
-          resolve({ oauth_token, oauth_token_secret })
+          resolve({ oauth_token, oauth_token_secret } as any)
         }
       )
     })
@@ -52,15 +52,15 @@ export function oAuth1Client(options) {
 
   const originalGetOAuthRequestToken =
     oauth1Client.getOAuthRequestToken.bind(oauth1Client)
-  oauth1Client.getOAuthRequestToken = (params = {}) => {
-    return new Promise((resolve, reject) => {
+  oauth1Client.getOAuthRequestToken = async (params = {}) => {
+    return await new Promise((resolve, reject) => {
       originalGetOAuthRequestToken(
         params,
         (error, oauth_token, oauth_token_secret, params) => {
           if (error) {
             return reject(error)
           }
-          resolve({ oauth_token, oauth_token_secret, params })
+          resolve({ oauth_token, oauth_token_secret, params } as any)
         }
       )
     })

src/core/lib/oauth/client.ts

@@ -0,0 +1,50 @@
+import { Issuer, Client, custom } from "openid-client"
+import { InternalOptions } from "src/lib/types"
+
+/**
+ * NOTE: We can add auto discovery of the provider's endpoint
+ * that requires only one endpoint to be specified by the user.
+ * Check out `Issuer.discover`
+ *
+ * Client supporting OAuth 2.x and OIDC
+ */
+export async function openidClient(
+  options: InternalOptions<"oauth">
+): Promise<Client> {
+  const provider = options.provider
+  
+  if (provider.httpOptions) custom.setHttpOptionsDefaults(provider.httpOptions)
+  
+  let issuer: Issuer
+  if (provider.wellKnown) {
+    issuer = await Issuer.discover(provider.wellKnown)
+  } else {
+    issuer = new Issuer({
+      issuer: provider.issuer as string,
+      authorization_endpoint:
+        // @ts-expect-error
+        provider.authorization?.url ?? provider.authorization,
+      // @ts-expect-error
+      token_endpoint: provider.token?.url ?? provider.token,
+      // @ts-expect-error
+      userinfo_endpoint: provider.userinfo?.url ?? provider.userinfo,
+    })
+  }
+
+  const client = new issuer.Client(
+    {
+      client_id: provider.clientId as string,
+      client_secret: provider.clientSecret as string,
+      redirect_uris: [provider.callbackUrl],
+      ...provider.client,
+    },
+    provider.jwks
+  )
+
+  // allow a 10 second skew
+  // See https://github.com/nextauthjs/next-auth/issues/3032
+  // and https://github.com/nextauthjs/next-auth/issues/3067
+  client[custom.clock_tolerance] = 10
+
+  return client
+}

src/core/lib/oauth/pkce-handler.ts

@@ -0,0 +1,84 @@
+import * as jwt from "../../../jwt"
+import { generators } from "openid-client"
+import type { InternalOptions } from "src/lib/types"
+import type { Cookie } from "../cookie"
+
+const PKCE_CODE_CHALLENGE_METHOD = "S256"
+const PKCE_MAX_AGE = 60 * 15 // 15 minutes in seconds
+
+/**
+ * Returns `code_challenge` and `code_challenge_method`
+ * and saves them in a cookie.
+ */
+export async function createPKCE(options: InternalOptions<"oauth">): Promise<
+  | undefined
+  | {
+      code_challenge: string
+      code_challenge_method: "S256"
+      cookie: Cookie
+    }
+> {
+  const { cookies, logger, provider } = options
+  if (!provider.checks?.includes("pkce")) {
+    // Provider does not support PKCE, return nothing.
+    return
+  }
+  const code_verifier = generators.codeVerifier()
+  const code_challenge = generators.codeChallenge(code_verifier)
+
+  const expires = new Date()
+  expires.setTime(expires.getTime() + PKCE_MAX_AGE * 1000)
+
+  // Encrypt code_verifier and save it to an encrypted cookie
+  const encryptedCodeVerifier = await jwt.encode({
+    ...options.jwt,
+    maxAge: PKCE_MAX_AGE,
+    token: { code_verifier },
+  })
+
+  logger.debug("CREATE_PKCE_CHALLENGE_VERIFIER", {
+    code_challenge,
+    code_challenge_method: PKCE_CODE_CHALLENGE_METHOD,
+    code_verifier,
+    PKCE_MAX_AGE,
+  })
+
+  return {
+    code_challenge,
+    code_challenge_method: PKCE_CODE_CHALLENGE_METHOD,
+    cookie: {
+      name: cookies.pkceCodeVerifier.name,
+      value: encryptedCodeVerifier,
+      options: { ...cookies.pkceCodeVerifier.options, expires },
+    },
+  }
+}
+
+/**
+ * Returns code_verifier if provider uses PKCE,
+ * and clears the container cookie afterwards.
+ */
+export async function usePKCECodeVerifier(
+  codeVerifier: string | undefined,
+  options: InternalOptions<"oauth">
+): Promise<{ codeVerifier: string; cookie: Cookie } | undefined> {
+  const { cookies, provider } = options
+
+  if (!provider?.checks?.includes("pkce") || !codeVerifier) {
+    return
+  }
+
+  const pkce = (await jwt.decode({
+    ...options.jwt,
+    token: codeVerifier,
+  })) as any
+
+  return {
+    codeVerifier: pkce?.code_verifier ?? undefined,
+    cookie: {
+      name: cookies.pkceCodeVerifier.name,
+      value: "",
+      options: { ...cookies.pkceCodeVerifier.options, maxAge: 0 },
+    },
+  }
+}

src/core/lib/oauth/state-handler.ts

@@ -0,0 +1,63 @@
+import { generators } from "openid-client"
+
+import type { InternalOptions } from "src/lib/types"
+import type { Cookie } from "../cookie"
+
+const STATE_MAX_AGE = 60 * 15 // 15 minutes in seconds
+
+/** Returns state if the provider supports it */
+export async function createState(
+  options: InternalOptions<"oauth">
+): Promise<{ cookie: Cookie; value: string } | undefined> {
+  const { logger, provider, jwt, cookies } = options
+
+  if (!provider.checks?.includes("state")) {
+    // Provider does not support state, return nothing
+    return
+  }
+
+  const state = generators.state()
+
+  const encodedState = await jwt.encode({
+    ...jwt,
+    maxAge: STATE_MAX_AGE,
+    token: { state },
+  })
+
+  logger.debug("CREATE_STATE", { state, maxAge: STATE_MAX_AGE })
+
+  const expires = new Date()
+  expires.setTime(expires.getTime() + STATE_MAX_AGE * 1000)
+  return {
+    value: state,
+    cookie: {
+      name: cookies.state.name,
+      value: encodedState,
+      options: { ...cookies.state.options, expires },
+    },
+  }
+}
+
+/**
+ * Returns state from if the provider supports states,
+ * and clears the container cookie afterwards.
+ */
+export async function useState(
+  state: string | undefined,
+  options: InternalOptions<"oauth">
+): Promise<{ value: string; cookie: Cookie } | undefined> {
+  const { cookies, provider, jwt } = options
+
+  if (!provider.checks?.includes("state") || !state) return
+
+  const value = (await jwt.decode({ ...options.jwt, token: state })) as any
+
+  return {
+    value: value?.state ?? undefined,
+    cookie: {
+      name: cookies.state.name,
+      value: "",
+      options: { ...cookies.pkceCodeVerifier.options, maxAge: 0 },
+    },
+  }
+}

src/core/lib/providers.ts

@@ -0,0 +1,73 @@
+import { merge } from "../../lib/merge"
+
+import type { InternalProvider } from "../../lib/types"
+import type { Provider } from "../../providers"
+import type { InternalUrl } from "../../lib/parse-url"
+
+/**
+ * Adds `signinUrl` and `callbackUrl` to each provider
+ * and deep merge user-defined options.
+ */
+export default function parseProviders(params: {
+  providers: Provider[]
+  url: InternalUrl
+  providerId?: string
+}): {
+  providers: InternalProvider[]
+  provider?: InternalProvider
+} {
+  const { url, providerId } = params
+
+  const providers = params.providers.map(({ options, ...rest }) => {
+    const defaultOptions = normalizeProvider(rest as Provider)
+    const userOptions = normalizeProvider(options as Provider)
+
+    return merge(defaultOptions, {
+      ...userOptions,
+      signinUrl: `${url}/signin/${userOptions?.id ?? rest.id}`,
+      callbackUrl: `${url}/callback/${userOptions?.id ?? rest.id}`,
+    })
+  })
+
+  const provider = providers.find(({ id }) => id === providerId)
+
+  return { providers, provider }
+}
+
+function normalizeProvider(provider?: Provider) {
+  if (!provider) return
+
+  const normalized: InternalProvider = Object.entries(
+    provider
+  ).reduce<InternalProvider>((acc, [key, value]) => {
+    if (
+      ["authorization", "token", "userinfo"].includes(key) &&
+      typeof value === "string"
+    ) {
+      const url = new URL(value)
+      acc[key] = {
+        url: `${url.origin}${url.pathname}`,
+        params: Object.fromEntries(url.searchParams ?? []),
+      }
+    } else {
+      acc[key] = value
+    }
+
+    return acc
+    // eslint-disable-next-line @typescript-eslint/prefer-reduce-type-parameter, @typescript-eslint/consistent-type-assertions
+  }, {} as any)
+
+  if (normalized.type === "oauth" && !normalized.version?.startsWith("1.")) {
+    // If provider has as an "openid-configuration" well-known endpoint
+    // or an "openid" scope request, it will also likely be able to receive an `id_token`
+    normalized.idToken = Boolean(
+      normalized.idToken ??
+        normalized.wellKnown?.includes("openid-configuration") ??
+        // @ts-expect-error
+        normalized.authorization?.params?.scope?.includes("openid")
+    )
+
+    if (!normalized.checks) normalized.checks = ["state"]
+  }
+  return normalized
+}

src/core/lib/utils.ts

@@ -0,0 +1,42 @@
+import { createHash } from "crypto"
+import { NextAuthOptions } from "../.."
+import { InternalOptions } from "../../lib/types"
+import { InternalUrl } from "../../lib/parse-url"
+
+/**
+ * Takes a number in seconds and returns the date in the future.
+ * Optionally takes a second date parameter. In that case
+ * the date in the future will be calculated from that date instead of now.
+ */
+export function fromDate(time: number, date = Date.now()) {
+  return new Date(date + time * 1000)
+}
+
+export function hashToken(token: string, options: InternalOptions<"email">) {
+  const { provider, secret } = options
+  return (
+    createHash("sha256")
+      // Prefer provider specific secret, but use default secret if none specified
+      .update(`${token}${provider.secret ?? secret}`)
+      .digest("hex")
+  )
+}
+
+/**
+ * Secret used salt cookies and tokens (e.g. for CSRF protection).
+ * If no secret option is specified then it creates one on the fly
+ * based on options passed here. If options contains unique data, such as
+ * OAuth provider secrets and database credentials it should be sufficent. If no secret provided in production, we throw an error. */
+export default function createSecret(params: {
+  userOptions: NextAuthOptions
+  url: InternalUrl
+}) {
+  const { userOptions, url } = params
+
+  return (
+    userOptions.secret ??
+    createHash("sha256")
+      .update(JSON.stringify({ ...url, ...userOptions }))
+      .digest("hex")
+  )
+}

src/core/pages/error.tsx

@@ -0,0 +1,114 @@
+import { Theme } from "../.."
+import { InternalUrl } from "../../lib/parse-url"
+
+/**
+ * The following errors are passed as error query parameters to the default or overridden error page.
+ *
+ * [Documentation](https://next-auth.js.org/configuration/pages#error-page) */
+export type ErrorType =
+  | "default"
+  | "configuration"
+  | "accessdenied"
+  | "verification"
+
+export interface ErrorProps {
+  url?: InternalUrl
+  theme?: Theme
+  error?: ErrorType
+}
+
+interface ErrorView {
+  status: number
+  heading: string
+  message: JSX.Element
+  signin?: JSX.Element
+}
+
+/** Renders an error page. */
+export default function ErrorPage(props: ErrorProps) {
+  const { url, error = "default", theme } = props
+  const signinPageUrl = `${url}/signin`
+
+  const errors: Record<ErrorType, ErrorView> = {
+    default: {
+      status: 200,
+      heading: "Error",
+      message: (
+        <p>
+          <a className="site" href={url?.origin}>
+            {url?.host}
+          </a>
+        </p>
+      ),
+    },
+    configuration: {
+      status: 500,
+      heading: "Server error",
+      message: (
+        <div>
+          <p>There is a problem with the server configuration.</p>
+          <p>Check the server logs for more information.</p>
+        </div>
+      ),
+    },
+    accessdenied: {
+      status: 403,
+      heading: "Access Denied",
+      message: (
+        <div>
+          <p>You do not have permission to sign in.</p>
+          <p>
+            <a className="button" href={signinPageUrl}>
+              Sign in
+            </a>
+          </p>
+        </div>
+      ),
+    },
+    verification: {
+      status: 403,
+      heading: "Unable to sign in",
+      message: (
+        <div>
+          <p>The sign in link is no longer valid.</p>
+          <p>It may have been used already or it may have expired.</p>
+        </div>
+      ),
+      signin: (
+        <p>
+          <a className="button" href={signinPageUrl}>
+            Sign in
+          </a>
+        </p>
+      ),
+    },
+  }
+
+  const { status, heading, message, signin } =
+    errors[error.toLowerCase()] ?? errors.default
+
+  return {
+    status,
+    html: (
+      <div className="error">
+        {theme?.brandColor && (
+          <style
+            dangerouslySetInnerHTML={{
+              __html: `
+        :root {
+          --brand-color: ${theme?.brandColor}
+        }
+      `,
+            }}
+          />
+        )}
+        {theme?.logo && <img src={theme.logo} alt="Logo" className="logo" />}
+        <div className="card">
+          <h1>{heading}</h1>
+          <div className="message">{message}</div>
+          {signin}
+        </div>
+      </div>
+    ),
+  }
+}

src/core/pages/index.ts

@@ -0,0 +1,79 @@
+import renderToString from "preact-render-to-string"
+import SigninPage from "./signin"
+import SignoutPage from "./signout"
+import VerifyRequestPage from "./verify-request"
+import ErrorPage from "./error"
+import css from "../../css"
+
+import type { InternalOptions } from "../../lib/types"
+import type { IncomingRequest, OutgoingResponse } from ".."
+import type { Cookie } from "../lib/cookie"
+import type { ErrorType } from "./error"
+
+type RenderPageParams = {
+  query?: IncomingRequest["query"]
+  cookies?: Cookie[]
+} & Partial<
+  Pick<
+    InternalOptions,
+    "url" | "callbackUrl" | "csrfToken" | "providers" | "theme"
+  >
+>
+
+/**
+ * Unless the user defines their [own pages](https://next-auth.js.org/configuration/pages),
+ * we render a set of default ones, using Preact SSR.
+ */
+export default function renderPage(params: RenderPageParams) {
+  const { url, theme, query, cookies } = params
+
+  function send({ html, title, status }: any): OutgoingResponse {
+    return {
+      cookies,
+      status,
+      headers: [{ key: "Content-Type", value: "text/html" }],
+      body: `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0"><style>${css()}</style><title>${title}</title></head><body class="__next-auth-theme-${
+        theme?.colorScheme ?? "auto"
+      }"><div class="page">${renderToString(html)}</div></body></html>`,
+    }
+  }
+
+  return {
+    signin(props?: any) {
+      return send({
+        html: SigninPage({
+          csrfToken: params.csrfToken,
+          providers: params.providers,
+          callbackUrl: params.callbackUrl,
+          theme,
+          ...query,
+          ...props,
+        }),
+        title: "Sign In",
+      })
+    },
+    signout(props?: any) {
+      return send({
+        html: SignoutPage({
+          csrfToken: params.csrfToken,
+          url,
+          theme,
+          ...props,
+        }),
+        title: "Sign Out",
+      })
+    },
+    verifyRequest(props?: any) {
+      return send({
+        html: VerifyRequestPage({ url, theme, ...props }),
+        title: "Verify Request",
+      })
+    },
+    error(props?: { error?: ErrorType }) {
+      return send({
+        ...ErrorPage({ url, theme, ...props }),
+        title: "Error",
+      })
+    },
+  }
+}

src/core/pages/signin.tsx

@@ -0,0 +1,168 @@
+import { Theme } from "../.."
+import { InternalProvider } from "../../lib/types"
+
+/**
+ * The following errors are passed as error query parameters to the default or overridden sign-in page.
+ *
+ * [Documentation](https://next-auth.js.org/configuration/pages#sign-in-page) */
+export type SignInErrorTypes =
+  | "Signin"
+  | "OAuthSignin"
+  | "OAuthCallback"
+  | "OAuthCreateAccount"
+  | "EmailCreateAccount"
+  | "Callback"
+  | "OAuthAccountNotLinked"
+  | "EmailSignin"
+  | "CredentialsSignin"
+  | "SessionRequired"
+  | "default"
+
+export interface SignInServerPageParams {
+  csrfToken: string
+  providers: InternalProvider[]
+  callbackUrl: string
+  email: string
+  error: SignInErrorTypes
+  theme: Theme
+}
+
+export default function SigninPage(props: SignInServerPageParams) {
+  const {
+    csrfToken,
+    providers,
+    callbackUrl,
+    theme,
+    email,
+    error: errorType,
+  } = props
+  // We only want to render providers
+  const providersToRender = providers.filter((provider) => {
+    if (provider.type === "oauth" || provider.type === "email") {
+      // Always render oauth and email type providers
+      return true
+    } else if (provider.type === "credentials" && provider.credentials) {
+      // Only render credentials type provider if credentials are defined
+      return true
+    }
+    // Don't render other provider types
+    return false
+  })
+
+  if (typeof document !== "undefined" && theme.brandColor) {
+    document.documentElement.style.setProperty(
+      "--brand-color",
+      theme.brandColor
+    )
+  }
+
+  const errors: Record<SignInErrorTypes, string> = {
+    Signin: "Try signing in with a different account.",
+    OAuthSignin: "Try signing in with a different account.",
+    OAuthCallback: "Try signing in with a different account.",
+    OAuthCreateAccount: "Try signing in with a different account.",
+    EmailCreateAccount: "Try signing in with a different account.",
+    Callback: "Try signing in with a different account.",
+    OAuthAccountNotLinked:
+      "To confirm your identity, sign in with the same account you used originally.",
+    EmailSignin: "The e-mail could not be sent.",
+    CredentialsSignin:
+      "Sign in failed. Check the details you provided are correct.",
+    SessionRequired: "Please sign in to access this page.",
+    default: "Unable to sign in.",
+  }
+
+  const error = errorType && (errors[errorType] ?? errors.default)
+
+  return (
+    <div className="signin">
+      {theme.brandColor && (
+        <style
+          dangerouslySetInnerHTML={{
+            __html: `
+        :root {
+          --brand-color: ${theme.brandColor}
+        }
+      `,
+          }}
+        />
+      )}
+      {theme.logo && <img src={theme.logo} alt="Logo" className="logo" />}
+      <div className="card">
+        {error && (
+          <div className="error">
+            <p>{error}</p>
+          </div>
+        )}
+        {providersToRender.map((provider, i: number) => (
+          <div key={provider.id} className="provider">
+            {provider.type === "oauth" && (
+              <form action={provider.signinUrl} method="POST">
+                <input type="hidden" name="csrfToken" value={csrfToken} />
+                {callbackUrl && (
+                  <input type="hidden" name="callbackUrl" value={callbackUrl} />
+                )}
+                <button type="submit" className="button">
+                  Sign in with {provider.name}
+                </button>
+              </form>
+            )}
+            {(provider.type === "email" || provider.type === "credentials") &&
+              i > 0 &&
+              providersToRender[i - 1].type !== "email" &&
+              providersToRender[i - 1].type !== "credentials" && <hr />}
+            {provider.type === "email" && (
+              <form action={provider.signinUrl} method="POST">
+                <input type="hidden" name="csrfToken" value={csrfToken} />
+                <label
+                  className="section-header"
+                  htmlFor={`input-email-for-${provider.id}-provider`}
+                >
+                  Email
+                </label>
+                <input
+                  id={`input-email-for-${provider.id}-provider`}
+                  autoFocus
+                  type="text"
+                  name="email"
+                  value={email}
+                  placeholder="email@example.com"
+                />
+                <button type="submit">Sign in with {provider.name}</button>
+              </form>
+            )}
+            {provider.type === "credentials" && (
+              <form action={provider.callbackUrl} method="POST">
+                <input type="hidden" name="csrfToken" value={csrfToken} />
+                {Object.keys(provider.credentials).map((credential) => {
+                  return (
+                    <div key={`input-group-${provider.id}`}>
+                      <label
+                        className="section-header"
+                        htmlFor={`input-${credential}-for-${provider.id}-provider`}
+                      >
+                        {provider.credentials[credential].label ?? credential}
+                      </label>
+                      <input
+                        name={credential}
+                        id={`input-${credential}-for-${provider.id}-provider`}
+                        type={provider.credentials[credential].type ?? "text"}
+                        placeholder={
+                          provider.credentials[credential].placeholder ?? ""
+                        }
+                        {...provider.credentials[credential]}
+                      />
+                    </div>
+                  )
+                })}
+                <button type="submit">Sign in with {provider.name}</button>
+              </form>
+            )}
+            {(provider.type === "email" || provider.type === "credentials") &&
+              i + 1 < providersToRender.length && <hr />}
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}

src/core/pages/signout.tsx

@@ -0,0 +1,35 @@
+import { Theme } from "../.."
+import { InternalUrl } from "../../lib/parse-url"
+
+export interface SignoutProps {
+  url: InternalUrl
+  csrfToken: string
+  theme: Theme
+}
+
+export default function SignoutPage(props: SignoutProps) {
+  const { url, csrfToken, theme } = props
+
+  return (
+    <div className="signout">
+      { theme.brandColor && <style
+        dangerouslySetInnerHTML={{
+          __html: `
+        :root {
+          --brand-color: ${theme.brandColor}
+        }
+      `,
+        }}
+      /> }
+      {theme.logo && <img src={theme.logo} alt="Logo" className="logo" />}
+      <div className="card">
+        <h1>Signout</h1>
+        <p>Are you sure you want to sign out?</p>
+        <form action={`${url}/signout`} method="POST">
+          <input type="hidden" name="csrfToken" value={csrfToken} />
+          <button type="submit">Sign out</button>
+        </form>
+      </div>
+    </div>
+  )
+}

src/core/pages/verify-request.tsx

@@ -0,0 +1,35 @@
+import { Theme } from "../.."
+import { InternalUrl } from "../../lib/parse-url"
+
+interface VerifyRequestPageProps {
+  url: InternalUrl
+  theme: Theme
+}
+
+export default function VerifyRequestPage(props: VerifyRequestPageProps) {
+  const { url, theme } = props
+
+  return (
+    <div className="verify-request">
+      { theme.brandColor && <style
+        dangerouslySetInnerHTML={{
+          __html: `
+        :root {
+          --brand-color: ${theme.brandColor}
+        }
+      `,
+        }}
+      /> }
+      {theme.logo && <img src={theme.logo} alt="Logo" className="logo" />}
+      <div className="card">
+        <h1>Check your email</h1>
+        <p>A sign in link has been sent to your email address.</p>
+        <p>
+          <a className="site" href={url.origin}>
+            {url.host}
+          </a>
+        </p>
+      </div>
+    </div>
+  )
+}

src/core/routes/callback.ts

@@ -0,0 +1,429 @@
+import oAuthCallback from "../lib/oauth/callback"
+import callbackHandler from "../lib/callback-handler"
+import { hashToken } from "../lib/utils"
+
+import type { InternalOptions } from "../../lib/types"
+import type { IncomingRequest, OutgoingResponse } from ".."
+import type { Cookie, SessionStore } from "../lib/cookie"
+import type { User } from "../.."
+
+/** Handle callbacks from login services */
+export default async function callback(params: {
+  options: InternalOptions<"oauth" | "credentials" | "email">
+  query: IncomingRequest["query"]
+  method: Required<IncomingRequest>["method"]
+  body: IncomingRequest["body"]
+  headers: IncomingRequest["headers"]
+  cookies: IncomingRequest["cookies"]
+  sessionStore: SessionStore
+}): Promise<OutgoingResponse> {
+  const { options, query, body, method, headers, sessionStore } = params
+  const {
+    provider,
+    adapter,
+    url,
+    callbackUrl,
+    pages,
+    jwt,
+    events,
+    callbacks,
+    session: { strategy: sessionStrategy, maxAge: sessionMaxAge },
+    logger,
+  } = options
+
+  const cookies: Cookie[] = []
+
+  const useJwtSession = sessionStrategy === "jwt"
+
+  if (provider.type === "oauth") {
+    try {
+      const {
+        profile,
+        account,
+        OAuthProfile,
+        cookies: oauthCookies,
+      } = await oAuthCallback({
+        query,
+        body,
+        method,
+        options,
+        cookies: params.cookies,
+      })
+
+      if (oauthCookies) cookies.push(...oauthCookies)
+
+      try {
+        // Make it easier to debug when adding a new provider
+        logger.debug("OAUTH_CALLBACK_RESPONSE", {
+          profile,
+          account,
+          OAuthProfile,
+        })
+
+        // If we don't have a profile object then either something went wrong
+        // or the user cancelled signing in. We don't know which, so we just
+        // direct the user to the signin page for now. We could do something
+        // else in future.
+        //
+        // Note: In oAuthCallback an error is logged with debug info, so it
+        // should at least be visible to developers what happened if it is an
+        // error with the provider.
+        if (!profile) {
+          return { redirect: `${url}/signin`, cookies }
+        }
+
+        // Check if user is allowed to sign in
+        // Attempt to get Profile from OAuth provider details before invoking
+        // signIn callback - but if no user object is returned, that is fine
+        // (that just means it's a new user signing in for the first time).
+        let userOrProfile = profile
+        if (adapter) {
+          const { getUserByAccount } = adapter
+          const userByAccount = await getUserByAccount({
+            // @ts-expect-error
+            providerAccountId: account.providerAccountId,
+            provider: provider.id,
+          })
+
+          if (userByAccount) userOrProfile = userByAccount
+        }
+
+        try {
+          const isAllowed = await callbacks.signIn({
+            user: userOrProfile,
+            // @ts-expect-error
+            account,
+            profile: OAuthProfile,
+          })
+          if (!isAllowed) {
+            return { redirect: `${url}/error?error=AccessDenied`, cookies }
+          } else if (typeof isAllowed === "string") {
+            return { redirect: isAllowed, cookies }
+          }
+        } catch (error) {
+          return {
+            redirect: `${url}/error?error=${encodeURIComponent(
+              (error as Error).message
+            )}`,
+            cookies,
+          }
+        }
+
+        // Sign user in
+        // @ts-expect-error
+        const { user, session, isNewUser } = await callbackHandler({
+          sessionToken: sessionStore.value,
+          profile,
+          // @ts-expect-error
+          account,
+          options,
+        })
+
+        if (useJwtSession) {
+          const defaultToken = {
+            name: user.name,
+            email: user.email,
+            picture: user.image,
+            sub: user.id?.toString(),
+          }
+          const token = await callbacks.jwt({
+            token: defaultToken,
+            user,
+            // @ts-expect-error
+            account,
+            profile: OAuthProfile,
+            isNewUser,
+          })
+
+          // Encode token
+          const newToken = await jwt.encode({ ...jwt, token })
+
+          // Set cookie expiry date
+          const cookieExpires = new Date()
+          cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000)
+
+          const sessionCookies = sessionStore.chunk(newToken, {
+            expires: cookieExpires,
+          })
+          cookies.push(...sessionCookies)
+        } else {
+          // Save Session Token in cookie
+          cookies.push({
+            name: options.cookies.sessionToken.name,
+            value: session.sessionToken,
+            options: {
+              ...options.cookies.sessionToken.options,
+              expires: session.expires,
+            },
+          })
+        }
+
+        // @ts-expect-error
+        await events.signIn?.({ user, account, profile, isNewUser })
+
+        // Handle first logins on new accounts
+        // e.g. option to send users to a new account landing page on initial login
+        // Note that the callback URL is preserved, so the journey can still be resumed
+        if (isNewUser && pages.newUser) {
+          return {
+            redirect: `${pages.newUser}${
+              pages.newUser.includes("?") ? "&" : "?"
+            }callbackUrl=${encodeURIComponent(callbackUrl)}`,
+            cookies,
+          }
+        }
+
+        // Callback URL is already verified at this point, so safe to use if specified
+        return { redirect: callbackUrl, cookies }
+      } catch (error) {
+        if ((error as Error).name === "AccountNotLinkedError") {
+          // If the email on the account is already linked, but not with this OAuth account
+          return {
+            redirect: `${url}/error?error=OAuthAccountNotLinked`,
+            cookies,
+          }
+        } else if ((error as Error).name === "CreateUserError") {
+          return { redirect: `${url}/error?error=OAuthCreateAccount`, cookies }
+        }
+        logger.error("OAUTH_CALLBACK_HANDLER_ERROR", error as Error)
+        return { redirect: `${url}/error?error=Callback`, cookies }
+      }
+    } catch (error) {
+      if ((error as Error).name === "OAuthCallbackError") {
+        logger.error("CALLBACK_OAUTH_ERROR", error as Error)
+        return { redirect: `${url}/error?error=OAuthCallback`, cookies }
+      }
+      logger.error("OAUTH_CALLBACK_ERROR", error as Error)
+      return { redirect: `${url}/error?error=Callback`, cookies }
+    }
+  } else if (provider.type === "email") {
+    try {
+      // Verified in `assertConfig`
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      const { useVerificationToken, getUserByEmail } = adapter!
+
+      const token = query?.token
+      const identifier = query?.email
+
+      const invite = await useVerificationToken?.({
+        identifier,
+        token: hashToken(token, options),
+      })
+
+      const invalidInvite = !invite || invite.expires.valueOf() < Date.now()
+      if (invalidInvite) {
+        return { redirect: `${url}/error?error=Verification`, cookies }
+      }
+
+      // If it is an existing user, use that, otherwise use a placeholder
+      const profile = (identifier
+        ? await getUserByEmail(identifier)
+        : null) ?? {
+        email: identifier,
+      }
+
+      /** @type {import("src").Account} */
+      const account = {
+        providerAccountId: profile.email,
+        type: "email",
+        provider: provider.id,
+      }
+
+      // Check if user is allowed to sign in
+      try {
+        const signInCallbackResponse = await callbacks.signIn({
+          // @ts-expect-error
+          user: profile,
+          // @ts-expect-error
+          account,
+          // @ts-expect-error
+          email: { email: identifier },
+        })
+        if (!signInCallbackResponse) {
+          return { redirect: `${url}/error?error=AccessDenied`, cookies }
+        } else if (typeof signInCallbackResponse === "string") {
+          return { redirect: signInCallbackResponse, cookies }
+        }
+      } catch (error) {
+        return {
+          redirect: `${url}/error?error=${encodeURIComponent(
+            (error as Error).message
+          )}`,
+          cookies,
+        }
+      }
+
+      // Sign user in
+      // @ts-expect-error
+      const { user, session, isNewUser } = await callbackHandler({
+        sessionToken: sessionStore.value,
+        // @ts-expect-error
+        profile,
+        // @ts-expect-error
+        account,
+        options,
+      })
+
+      if (useJwtSession) {
+        const defaultToken = {
+          name: user.name,
+          email: user.email,
+          picture: user.image,
+          sub: user.id?.toString(),
+        }
+        const token = await callbacks.jwt({
+          token: defaultToken,
+          user,
+          // @ts-expect-error
+          account,
+          isNewUser,
+        })
+
+        // Encode token
+        const newToken = await jwt.encode({ ...jwt, token })
+
+        // Set cookie expiry date
+        const cookieExpires = new Date()
+        cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000)
+
+        const sessionCookies = sessionStore.chunk(newToken, {
+          expires: cookieExpires,
+        })
+        cookies.push(...sessionCookies)
+      } else {
+        // Save Session Token in cookie
+        cookies.push({
+          name: options.cookies.sessionToken.name,
+          value: session.sessionToken,
+          options: {
+            ...options.cookies.sessionToken.options,
+            expires: session.expires,
+          },
+        })
+      }
+
+      // @ts-expect-error
+      await events.signIn?.({ user, account, isNewUser })
+
+      // Handle first logins on new accounts
+      // e.g. option to send users to a new account landing page on initial login
+      // Note that the callback URL is preserved, so the journey can still be resumed
+      if (isNewUser && pages.newUser) {
+        return {
+          redirect: `${pages.newUser}${
+            pages.newUser.includes("?") ? "&" : "?"
+          }callbackUrl=${encodeURIComponent(callbackUrl)}`,
+          cookies,
+        }
+      }
+
+      // Callback URL is already verified at this point, so safe to use if specified
+      return { redirect: callbackUrl, cookies }
+    } catch (error) {
+      if ((error as Error).name === "CreateUserError") {
+        return { redirect: `${url}/error?error=EmailCreateAccount`, cookies }
+      }
+      logger.error("CALLBACK_EMAIL_ERROR", error as Error)
+      return { redirect: `${url}/error?error=Callback`, cookies }
+    }
+  } else if (provider.type === "credentials" && method === "POST") {
+    const credentials = body
+
+    let user: User
+    try {
+      user = (await provider.authorize(credentials, {
+        query,
+        body,
+        headers,
+        method,
+      })) as User
+      if (!user) {
+        return {
+          status: 401,
+          redirect: `${url}/error?${new URLSearchParams({
+            error: "CredentialsSignin",
+            provider: provider.id,
+          })}`,
+          cookies,
+        }
+      }
+    } catch (error) {
+      return {
+        redirect: `${url}/error?error=${encodeURIComponent(
+          (error as Error).message
+        )}`,
+        cookies,
+      }
+    }
+
+    /** @type {import("src").Account} */
+    const account = {
+      providerAccountId: user.id,
+      type: "credentials",
+      provider: provider.id,
+    }
+
+    try {
+      const isAllowed = await callbacks.signIn({
+        user,
+        // @ts-expect-error
+        account,
+        credentials,
+      })
+      if (!isAllowed) {
+        return {
+          status: 403,
+          redirect: `${url}/error?error=AccessDenied`,
+          cookies,
+        }
+      } else if (typeof isAllowed === "string") {
+        return { redirect: isAllowed, cookies }
+      }
+    } catch (error) {
+      return {
+        redirect: `${url}/error?error=${encodeURIComponent(
+          (error as Error).message
+        )}`,
+        cookies,
+      }
+    }
+
+    const defaultToken = {
+      name: user.name,
+      email: user.email,
+      picture: user.image,
+      sub: user.id?.toString(),
+    }
+
+    const token = await callbacks.jwt({
+      token: defaultToken,
+      user,
+      // @ts-expect-error
+      account,
+      isNewUser: false,
+    })
+
+    // Encode token
+    const newToken = await jwt.encode({ ...jwt, token })
+
+    // Set cookie expiry date
+    const cookieExpires = new Date()
+    cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000)
+
+    const sessionCookies = sessionStore.chunk(newToken, {
+      expires: cookieExpires,
+    })
+
+    cookies.push(...sessionCookies)
+
+    // @ts-expect-error
+    await events.signIn?.({ user, account })
+
+    return { redirect: callbackUrl, cookies }
+  }
+  return {
+    status: 500,
+    body: `Error: Callback for provider type ${provider.type} not supported`,
+    cookies,
+  }
+}

src/core/routes/providers.ts

@@ -0,0 +1,30 @@
+import { OutgoingResponse } from ".."
+import { InternalProvider } from "../../lib/types"
+
+export interface PublicProvider {
+  id: string
+  name: string
+  type: string
+  signinUrl: string
+  callbackUrl: string
+}
+
+/**
+ * Return a JSON object with a list of all OAuth providers currently configured
+ * and their signin and callback URLs. This makes it possible to automatically
+ * generate buttons for all providers when rendering client side.
+ */
+export default function providers(
+  providers: InternalProvider[]
+): OutgoingResponse<Record<string, PublicProvider>> {
+  return {
+    headers: [{ key: "Content-Type", value: "application/json" }],
+    body: providers.reduce<Record<string, PublicProvider>>(
+      (acc, { id, name, type, signinUrl, callbackUrl }) => {
+        acc[id] = { id, name, type, signinUrl, callbackUrl }
+        return acc
+      },
+      {}
+    ),
+  }
+}

src/core/routes/session.ts

@@ -1,34 +1,56 @@
-import * as cookie from "../lib/cookie"
 import { fromDate } from "../lib/utils"
 
+import type { Adapter } from "../../adapters"
+import type { InternalOptions } from "../../lib/types"
+import type { OutgoingResponse } from ".."
+import type { Session } from "../.."
+import type { SessionStore } from "../lib/cookie"
+
+interface SessionParams {
+  options: InternalOptions
+  sessionStore: SessionStore
+}
+
 /**
  * Return a session object (without any private fields)
  * for Single Page App clients
- * @param {import("types/internals").NextAuthRequest} req
- * @param {import("types/internals").NextAuthResponse} res
  */
-export default async function session(req, res) {
-  const { cookies, adapter, jwt, events, callbacks, logger } = req.options
-  const useJwtSession = req.options.session.jwt
-  const sessionMaxAge = req.options.session.maxAge
-  const sessionToken = req.cookies[cookies.sessionToken.name]
 
-  if (!sessionToken) {
-    return res.json({})
+export default async function session(
+  params: SessionParams
+): Promise<OutgoingResponse<Session | {}>> {
+  const { options, sessionStore } = params
+  const {
+    adapter,
+    jwt,
+    events,
+    callbacks,
+    logger,
+    session: { strategy: sessionStrategy, maxAge: sessionMaxAge },
+  } = options
+
+  const response: OutgoingResponse<Session | {}> = {
+    body: {},
+    headers: [{ key: "Content-Type", value: "application/json" }],
+    cookies: [],
   }
 
-  let response = {}
-  if (useJwtSession) {
-    try {
-      // Decrypt and verify token
-      const decodedToken = await jwt.decode({ ...jwt, token: sessionToken })
+  const sessionToken = sessionStore.value
+
+  if (!sessionToken) return response
+
+  if (sessionStrategy === "jwt") {
+    try {
+      const decodedToken = await jwt.decode({
+        ...jwt,
+        token: sessionToken,
+      })
 
-      // Generate new session expiry date
       const newExpires = fromDate(sessionMaxAge)
 
       // By default, only exposes a limited subset of information to the client
       // as needed for presentation purposes (e.g. "you are logged in as...").
-      const defaultSession = {
+      const session = {
         user: {
           name: decodedToken?.name,
           email: decodedToken?.email,
@@ -37,37 +59,39 @@ export default async function session(req, res) {
         expires: newExpires.toISOString(),
       }
 
-      // Pass Session and JSON Web Token through to the session callback
+      // @ts-expect-error
       const token = await callbacks.jwt({ token: decodedToken })
-      const session = await callbacks.session({
-        session: defaultSession,
-        token,
-      })
+      // @ts-expect-error
+      const newSession = await callbacks.session({ session, token })
 
       // Return session payload as response
-      response = session
+      response.body = newSession
 
       // Refresh JWT expiry by re-signing it, with an updated expiry date
-      const newToken = await jwt.encode({ ...jwt, token })
+      const newToken = await jwt.encode({
+        ...jwt,
+        token,
+        maxAge: options.session.maxAge,
+      })
 
       // Set cookie, to also update expiry date on cookie
-      cookie.set(res, cookies.sessionToken.name, newToken, {
+      const sessionCookies = sessionStore.chunk(newToken, {
         expires: newExpires,
-        ...cookies.sessionToken.options,
       })
 
-      await events.session?.({ session, token })
+      response.cookies?.push(...sessionCookies)
+
+      await events.session?.({ session: newSession, token })
     } catch (error) {
       // If JWT not verifiable, make sure the cookie for it is removed and return empty object
-      logger.error("JWT_SESSION_ERROR", error)
-      cookie.set(res, cookies.sessionToken.name, "", {
-        ...cookies.sessionToken.options,
-        maxAge: 0,
-      })
+      logger.error("JWT_SESSION_ERROR", error as Error)
+
+      response.cookies?.push(...sessionStore.clean())
     }
   } else {
     try {
-      const { getSessionAndUser, deleteSession, updateSession } = adapter
+      const { getSessionAndUser, deleteSession, updateSession } =
+        adapter as Adapter
       let userAndSession = await getSessionAndUser(sessionToken)
 
       // If session has expired, clean up the database
@@ -82,7 +106,7 @@ export default async function session(req, res) {
       if (userAndSession) {
         const { user, session } = userAndSession
 
-        const sessionUpdateAge = req.options.session.updateAge
+        const sessionUpdateAge = options.session.updateAge
         // Calculate last updated date to throttle write updates to database
         // Formula: ({expiry date} - sessionMaxAge) + sessionUpdateAge
         //     e.g. ({expiry date} - 30 days) + 1 hour
@@ -99,6 +123,7 @@ export default async function session(req, res) {
         }
 
         // Pass Session through to the session callback
+        // @ts-expect-error
         const sessionPayload = await callbacks.session({
           // By default, only exposes a limited subset of information to the client
           // as needed for presentation purposes (e.g. "you are logged in as...").
@@ -114,27 +139,29 @@ export default async function session(req, res) {
         })
 
         // Return session payload as response
-        response = sessionPayload
+        response.body = sessionPayload
 
         // Set cookie again to update expiry
-        cookie.set(res, cookies.sessionToken.name, sessionToken, {
-          expires: newExpires,
-          ...cookies.sessionToken.options,
+        response.cookies?.push({
+          name: options.cookies.sessionToken.name,
+          value: sessionToken,
+          options: {
+            ...options.cookies.sessionToken.options,
+            expires: newExpires,
+          },
         })
 
+        // @ts-expect-error
         await events.session?.({ session: sessionPayload })
       } else if (sessionToken) {
-        // If sessionToken was found set but it's not valid for a session then
+        // If `sessionToken` was found set but it's not valid for a session then
         // remove the sessionToken cookie from browser.
-        cookie.set(res, cookies.sessionToken.name, "", {
-          ...cookies.sessionToken.options,
-          maxAge: 0,
-        })
+        response.cookies?.push(...sessionStore.clean())
       }
     } catch (error) {
-      logger.error("SESSION_ERROR", error)
+      logger.error("SESSION_ERROR", error as Error)
     }
   }
 
-  res.json(response)
+  return response
 }

src/core/routes/signin.ts

@@ -0,0 +1,92 @@
+import getAuthorizationUrl from "../lib/oauth/authorization-url"
+import emailSignin from "../lib/email/signin"
+import { IncomingRequest, OutgoingResponse } from ".."
+import { InternalOptions } from "../../lib/types"
+import { Account, User } from "../.."
+
+/** Handle requests to /api/auth/signin */
+export default async function signin(params: {
+  options: InternalOptions<"oauth" | "email">
+  query: IncomingRequest["query"]
+  body: IncomingRequest["body"]
+}): Promise<OutgoingResponse> {
+  const { options, query, body } = params
+  const { url, adapter, callbacks, logger, provider } = options
+
+  if (!provider.type) {
+    return {
+      status: 500,
+      // @ts-expect-error
+      text: `Error: Type not specified for ${provider.name}`,
+    }
+  }
+
+  if (provider.type === "oauth") {
+    try {
+      const response = await getAuthorizationUrl({ options, query })
+      return response
+    } catch (error) {
+      logger.error("SIGNIN_OAUTH_ERROR", { error: error as Error, provider })
+      return { redirect: `${url}/error?error=OAuthSignin` }
+    }
+  } else if (provider.type === "email") {
+    // Note: Technically the part of the email address local mailbox element
+    // (everything before the @ symbol) should be treated as 'case sensitive'
+    // according to RFC 2821, but in practice this causes more problems than
+    // it solves. We treat email addresses as all lower case. If anyone
+    // complains about this we can make strict RFC 2821 compliance an option.
+    const email = body?.email?.toLowerCase() ?? null
+
+    // Verified in `assertConfig`
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const { getUserByEmail } = adapter!
+    // If is an existing user return a user object (otherwise use placeholder)
+    const user: User = (email ? await getUserByEmail(email) : null) ?? {
+      email,
+      id: email,
+    }
+
+    const account: Account = {
+      providerAccountId: email,
+      userId: email,
+      type: "email",
+      provider: provider.id,
+    }
+
+    // Check if user is allowed to sign in
+    try {
+      // @ts-expect-error
+      const signInCallbackResponse = await callbacks.signIn({
+        user,
+        account,
+        email: { verificationRequest: true },
+      })
+      if (!signInCallbackResponse) {
+        return { redirect: `${url}/error?error=AccessDenied` }
+      } else if (typeof signInCallbackResponse === "string") {
+        return { redirect: signInCallbackResponse }
+      }
+    } catch (error) {
+      return {
+        redirect: `${url}/error?${new URLSearchParams({
+          error: error as string,
+        })}`,
+      }
+    }
+
+    try {
+      await emailSignin(email, options)
+    } catch (error) {
+      logger.error("SIGNIN_EMAIL_ERROR", error as Error)
+      return { redirect: `${url}/error?error=EmailSignin` }
+    }
+
+    const params = new URLSearchParams({
+      provider: provider.id,
+      type: provider.type,
+    })
+
+    return { redirect: `${url}/verify-request?${params}` }
+  }
+  return { redirect: `${url}/signin` }
+}

src/core/routes/signout.ts

@@ -0,0 +1,45 @@
+import type { Adapter } from "../../adapters"
+import type { InternalOptions } from "../../lib/types"
+import type { OutgoingResponse } from ".."
+import type { SessionStore } from "../lib/cookie"
+
+/** Handle requests to /api/auth/signout */
+export default async function signout(params: {
+  options: InternalOptions
+  sessionStore: SessionStore
+}): Promise<OutgoingResponse> {
+  const { options, sessionStore } = params
+  const { adapter, events, jwt, callbackUrl, logger, session } = options
+
+  const sessionToken = sessionStore?.value
+  if (!sessionToken) {
+    return { redirect: callbackUrl }
+  }
+
+  if (session.strategy === "jwt") {
+    // Dispatch signout event
+    try {
+      const decodedJwt = await jwt.decode({ ...jwt, token: sessionToken })
+      // @ts-expect-error
+      await events.signOut?.({ token: decodedJwt })
+    } catch (error) {
+      // Do nothing if decoding the JWT fails
+      logger.error("SIGNOUT_ERROR", error)
+    }
+  } else {
+    try {
+      const session = await (adapter as Adapter).deleteSession(sessionToken)
+      // Dispatch signout event
+      // @ts-expect-error
+      await events.signOut?.({ session })
+    } catch (error) {
+      // If error, log it but continue
+      logger.error("SIGNOUT_ERROR", error as Error)
+    }
+  }
+
+  // Remove Session Token
+  const sessionCookies = sessionStore.clean()
+
+  return { redirect: callbackUrl, cookies: sessionCookies }
+}

src/core/types.ts

@@ -1,13 +1,13 @@
-import { Adapter } from "./adapters"
-import { JWTOptions, JWT } from "./jwt"
-import { Provider, Credentials, ProviderType } from "./providers"
-import {
-  Awaitable,
-  NextApiRequest,
-  NextApiResponse,
-  NextApiHandler,
-} from "./internals/utils"
-import { TokenSetParameters } from "openid-client"
+import type { Adapter } from "../adapters"
+import type { Provider, CredentialInput, ProviderType } from "../providers"
+import type { TokenSetParameters } from "openid-client"
+import type { JWT, JWTOptions } from "../jwt"
+import type { LoggerInstance } from "../lib/logger"
+import type { CookieSerializeOptions } from "cookie"
+
+export type Awaitable<T> = T | PromiseLike<T>
+
+export type { LoggerInstance }
 
 /**
  * Configure your NextAuth instance
@@ -27,9 +27,10 @@ export interface NextAuthOptions {
   providers: Provider[]
   /**
    * A random string used to hash tokens, sign cookies and generate cryptographic keys.
-   * If not specified is uses a hash of all configuration options, including Client ID / Secrets for entropy.
-   * The default behavior is volatile, and **it is strongly recommended** you explicitly specify a value
-   * to avoid invalidating end user sessions when configuration changes are deployed.
+   * If not specified, it falls back to `jwt.secret` or `NEXTAUTH_SECRET` from environment vairables.
+   * Otherwise it will use a hash of all configuration options, including Client ID / Secrets for entropy.
+   *
+   * NOTE: The last behavior is extrmely volatile, and will throw an error in production.
    * * **Default value**: `string` (SHA hash of the "options" object)
    * * **Required**: No - **but strongly recommended**!
    *
@@ -202,30 +203,10 @@ export interface NextAuthOptions {
  * [Documentation](https://next-auth.js.org/configuration/options#theme) |
  * [Pages](https://next-auth.js.org/configuration/pages)
  */
-export type Theme = "auto" | "dark" | "light"
-
-/**
- * Override any of the methods, and the rest will use the default logger.
- *
- * [Documentation](https://next-auth.js.org/configuration/options#logger)
- */
-export interface LoggerInstance {
-  warn(
-    code:
-      | "JWT_AUTO_GENERATED_SIGNING_KEY"
-      | "JWT_AUTO_GENERATED_ENCRYPTION_KEY"
-      | "NEXTAUTH_URL"
-  ): void
-  error(
-    code: string,
-    /**
-     * Either an instance of (JSON serializable) Error
-     * or an object that contains some debug information.
-     * (Error is still available through `metadata.error`)
-     */
-    metadata: Error | { error: Error; [key: string]: unknown }
-  ): void
-  debug(code: string, metadata: unknown): void
+export interface Theme {
+  colorScheme: "auto" | "dark" | "light"
+  logo?: string
+  brandColor?: string
 }
 
 /**
@@ -279,7 +260,7 @@ export interface CallbacksOptions<
    *
    * [Documentation](https://next-auth.js.org/configuration/callbacks#sign-in-callback)
    */
-  signIn(params: {
+  signIn: (params: {
     user: User
     account: A
     /**
@@ -299,8 +280,8 @@ export interface CallbacksOptions<
       verificationRequest?: boolean
     }
     /** If Credentials provider is used, it contains the user credentials */
-    credentials: Credentials
-  }): Awaitable<string | boolean>
+    credentials?: Record<string, CredentialInput>
+  }) => Awaitable<string | boolean>
   /**
    * This callback is called anytime the user is redirected to a callback URL (e.g. on signin or signout).
    * By default only URLs on the same URL as the site are allowed,
@@ -308,17 +289,17 @@ export interface CallbacksOptions<
    *
    * [Documentation](https://next-auth.js.org/configuration/callbacks#redirect-callback)
    */
-  redirect(params: {
+  redirect: (params: {
     /** URL provided as callback URL by the client */
     url: string
     /** Default base URL of site (can be used as fallback) */
     baseUrl: string
-  }): Awaitable<string>
+  }) => Awaitable<string>
   /**
    * This callback is called whenever a session is checked.
    * (Eg.: invoking the `/api/session` endpoint, using `useSession` or `getSession`)
    *
-   * ⚠ By default, only a subset (email, name, imgage)
+   * ⚠ By default, only a subset (email, name, image)
    * of the token is returned for increased security.
    *
    * If you want to make something available you added to the token through the `jwt` callback,
@@ -330,11 +311,11 @@ export interface CallbacksOptions<
    * [`getSession`](https://next-auth.js.org/getting-started/client#getsession) |
    *
    */
-  session(params: {
+  session: (params: {
     session: Session
     user: User
     token: JWT
-  }): Awaitable<Session>
+  }) => Awaitable<Session>
   /**
    * This callback is called whenever a JSON Web Token is created (i.e. at sign in)
    * or updated (i.e whenever a session is accessed in the client).
@@ -347,26 +328,19 @@ export interface CallbacksOptions<
    * [Documentation](https://next-auth.js.org/configuration/callbacks#jwt-callback) |
    * [`session` callback](https://next-auth.js.org/configuration/callbacks#session-callback)
    */
-  jwt(params: {
+  jwt: (params: {
     token: JWT
     user?: User
     account?: A
     profile?: P
     isNewUser?: boolean
-  }): Awaitable<JWT>
+  }) => Awaitable<JWT>
 }
 
 /** [Documentation](https://next-auth.js.org/configuration/options#cookies) */
 export interface CookieOption {
   name: string
-  options: {
-    httpOnly: boolean
-    sameSite: true | "strict" | "lax" | "none"
-    path?: string
-    secure: boolean
-    maxAge?: number
-    domain?: string
-  }
+  options: CookieSerializeOptions
 }
 
 /** [Documentation](https://next-auth.js.org/configuration/options#cookies) */
@@ -375,6 +349,7 @@ export interface CookiesOptions {
   callbackUrl: CookieOption
   csrfToken: CookieOption
   pkceCodeVerifier: CookieOption
+  state: CookieOption
 }
 
 /**
@@ -389,29 +364,29 @@ export interface EventCallbacks {
    * For other providers, you'll get the User object from your adapter, the account,
    * and an indicator if the user was new to your Adapter.
    */
-  signIn(message: {
+  signIn: (message: {
     user: User
     account: Account
     profile?: Profile
     isNewUser?: boolean
-  }): Awaitable<void>
+  }) => Awaitable<void>
   /**
    * The message object will contain one of these depending on
    * if you use JWT or database persisted sessions:
    * - `token`: The JWT token for this session.
    * - `session`: The session object from your adapter that is being ended.
    */
-  signOut(message: { session: Session; token: JWT }): Awaitable<void>
-  createUser(message: { user: User }): Awaitable<void>
-  updateUser(message: { user: User }): Awaitable<void>
-  linkAccount(message: { user: User; account: Account }): Awaitable<void>
+  signOut: (message: { session: Session; token: JWT }) => Awaitable<void>
+  createUser: (message: { user: User }) => Awaitable<void>
+  updateUser: (message: { user: User }) => Awaitable<void>
+  linkAccount: (message: { user: User; account: Account }) => Awaitable<void>
   /**
    * The message object will contain one of these depending on
    * if you use JWT or database persisted sessions:
    * - `token`: The JWT token for this session.
    * - `session`: The session object from your adapter.
    */
-  session(message: { session: Session; token: JWT }): Awaitable<void>
+  session: (message: { session: Session; token: JWT }) => Awaitable<void>
 }
 
 export type EventType = keyof EventCallbacks
@@ -449,9 +424,23 @@ export interface DefaultSession extends Record<string, unknown> {
  */
 export interface Session extends Record<string, unknown>, DefaultSession {}
 
+export type SessionStrategy = "jwt" | "database"
+
 /** [Documentation](https://next-auth.js.org/configuration/options#session) */
 export interface SessionOptions {
-  jwt: boolean
+  /**
+   * Choose how you want to save the user session.
+   * The default is `"jwt"`, an encrypted JWT (JWE) in the session cookie.
+   *
+   * If you use an `adapter` however, we default it to `"database"` instead.
+   * You can still force a JWT session by explicitly defining `"jwt"`.
+   *
+   * When using `"database"`, the session cookie will only contain a `sessionToken` value,
+   * which is used to look up the session in the database.
+   *
+   * [Documentation](https://next-auth.js.org/configuration/options#session) | [Adapter](https://next-auth.js.org/configuration/options#adapter) | [About JSON Web Tokens](https://next-auth.js.org/faq#json-web-tokens)
+   */
+  strategy: SessionStrategy
   /**
    * Relative time from now in seconds when to expire the session
    * @default 2592000 // 30 days
@@ -483,13 +472,3 @@ export interface DefaultUser {
  * [`profile` OAuth provider callback](https://next-auth.js.org/configuration/providers#using-a-custom-provider)
  */
 export interface User extends Record<string, unknown>, DefaultUser {}
-
-declare function NextAuth(
-  req: NextApiRequest,
-  res: NextApiResponse,
-  options: NextAuthOptions
-): ReturnType<NextApiHandler>
-
-declare function NextAuth(options: NextAuthOptions): ReturnType<NextApiHandler>
-
-export default NextAuth

src/css/index.css

@@ -1,6 +1,6 @@
 :root {
   --border-width: 1px;
-  --border-radius: .3rem;
+  --border-radius: 0.3rem;
   --color-error: #c94b4b;
   --color-info: #157efb;
   --color-info-text: #fff;
@@ -43,7 +43,9 @@ body {
   background-color: var(--color-background);
   margin: 0;
   padding: 0;
-  font-family: -apple-system, Segoe UI, Roboto, Ubuntu, Cantarell, Noto Sans, sans-serif, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol';
+  font-family: -apple-system, Segoe UI, Roboto, Ubuntu, Cantarell, Noto Sans,
+    sans-serif, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif,
+    "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";
 }
 
 h1 {
@@ -54,7 +56,7 @@ h1 {
 }
 
 p {
-  color: var(--color-text)
+  color: var(--color-text);
 }
 
 form {
@@ -67,19 +69,19 @@ label {
   text-align: left;
   margin-bottom: 0.25rem;
   display: block;
-  color: #666;
+  color: var(--color-text);
 }
 
 input[type] {
   box-sizing: border-box;
   display: block;
   width: 100%;
-  padding: .5rem 1rem;
+  padding: 0.5rem 1rem;
   border: var(--border-width) solid var(--color-control-border);
   background: var(--color-background);
   font-size: 1rem;
   border-radius: var(--border-radius);
-  box-shadow: inset 0 .1rem .2rem rgba(0, 0, 0, .2);
+  box-shadow: inset 0 0.1rem 0.2rem rgba(0, 0, 0, 0.2);
   color: var(--color-text);
 
   &:focus {
@@ -107,15 +109,17 @@ a.button {
 
 button,
 a.button {
-  margin: 0 0 .75rem 0;
-  padding: .75rem 1rem;
+  margin: 0 0 0.75rem 0;
+  padding: 0.75rem 1rem;
   border: var(--border-width) solid var(--color-control-border);
   color: var(--color-primary);
   background-color: var(--color-background);
   font-size: 1rem;
   border-radius: var(--border-radius);
-  transition: all .1s ease-in-out;
-  box-shadow: 0 0.15rem 0.3rem rgba(0, 0, 0, .15), inset 0 .1rem .2rem var(--color-background), inset 0 -.1rem .1rem rgba(0, 0, 0, .05);
+  transition: all 0.1s ease-in-out;
+  box-shadow: 0 0.15rem 0.3rem rgba(0, 0, 0, 0.15),
+    inset 0 0.1rem 0.2rem var(--color-background),
+    inset 0 -0.1rem 0.1rem rgba(0, 0, 0, 0.05);
   font-weight: 500;
   position: relative;
 
@@ -124,7 +128,9 @@ a.button {
   }
 
   &:active {
-    box-shadow: 0 0.15rem 0.3rem rgba(0, 0, 0, .15), inset 0 .1rem .2rem var(--color-background), inset 0 -.1rem .1rem rgba(0, 0, 0, .1);
+    box-shadow: 0 0.15rem 0.3rem rgba(0, 0, 0, 0.15),
+      inset 0 0.1rem 0.2rem var(--color-background),
+      inset 0 -0.1rem 0.1rem rgba(0, 0, 0, 0.1);
     background-color: var(--color-button-active-background);
     border-color: var(--color-button-active-border);
     cursor: pointer;
@@ -146,13 +152,12 @@ a.site {
   position: absolute;
   width: 100%;
   height: 100%;
-  display: table;
+  display: grid;
+  place-items: center;
   margin: 0;
   padding: 0;
 
-  >div {
-    display: table-cell;
-    vertical-align: middle;
+  > div {
     text-align: center;
     padding: 0.5rem;
   }
@@ -163,7 +168,7 @@ a.site {
     display: inline-block;
     padding-left: 2rem;
     padding-right: 2rem;
-    margin-top: .5rem;
+    margin-top: 0.5rem;
   }
 
   .message {
@@ -172,7 +177,6 @@ a.site {
 }
 
 .signin {
-
   button,
   a.button,
   input[type="text"] {
@@ -192,9 +196,9 @@ a.site {
       content: "or";
       background: var(--color-background);
       color: #888;
-      padding: 0 .4rem;
+      padding: 0 0.4rem;
       position: relative;
-      top: -.6rem;
+      top: -0.6rem;
     }
   }
 
@@ -213,10 +217,9 @@ a.site {
     }
   }
 
-  >div,
+  > div,
   form {
     display: block;
-    margin: 0 auto 0.5rem auto;
 
     input[type] {
       margin-bottom: 0.5rem;
@@ -228,4 +231,32 @@ a.site {
 
     max-width: 300px;
   }
-}
+}
+.signout {
+  .message {
+    margin-bottom: 1.5rem;
+  }
+}
+
+.logo {
+  display: inline-block;
+  margin-top: 100px;
+  max-width: 300px;
+  max-height: 150px;
+}
+
+.card {
+  max-width: max-content;
+  border: 1px solid var(--color-control-border);
+  border-radius: 5px;
+  padding: 20px 50px;
+  margin: 50px auto;
+
+  .header {
+    color: var(--color-primary);
+  }
+}
+
+.section-header {
+  color: var(--brand-color, var(--color-text));
+}

src/css/index.ts

@@ -1,11 +1,11 @@
 // To support serverless targets (which don't work if you try to read in things
 // like CSS files at run time) this file is replaced in production builds with
 // a function that returns compiled CSS (embedded as a string in the function).
-import fs from 'fs'
-import path from 'path'
+import fs from "fs"
+import path from "path"
 
-const pathToCss = path.join(process.cwd(), '/dist/css/index.css')
+const pathToCss = path.join(process.cwd(), "/src/css/index.css")
 
-export default function css () {
-  return fs.readFileSync(pathToCss, 'utf8')
+export default function css() {
+  return fs.readFileSync(pathToCss, "utf8")
 }

src/index.ts

@@ -0,0 +1,6 @@
+export * from "./core/types"
+
+export type { IncomingRequest, OutgoingResponse } from "./core"
+
+export * from "./next"
+export { default } from "./next"

src/jwt/index.ts

@@ -0,0 +1,121 @@
+import { EncryptJWT, jwtDecrypt } from "jose"
+import hkdf from "@panva/hkdf"
+import { v4 as uuid } from "uuid"
+import { SessionStore } from "../core/lib/cookie"
+import type { NextApiRequest } from "next"
+import type { JWT, JWTDecodeParams, JWTEncodeParams, JWTOptions } from "./types"
+import type { LoggerInstance } from ".."
+
+export * from "./types"
+
+const DEFAULT_MAX_AGE = 30 * 24 * 60 * 60 // 30 days
+
+const now = () => (Date.now() / 1000) | 0
+
+/** Issues a JWT. By default, the JWT is encrypted using "A256GCM". */
+export async function encode(params: JWTEncodeParams) {
+  const { token = {}, secret, maxAge = DEFAULT_MAX_AGE } = params
+  const encryptionSecret = await getDerivedEncryptionKey(secret)
+  return await new EncryptJWT(token)
+    .setProtectedHeader({ alg: "dir", enc: "A256GCM" })
+    .setIssuedAt()
+    .setExpirationTime(now() + maxAge)
+    .setJti(uuid())
+    .encrypt(encryptionSecret)
+}
+
+/** Decodes a NextAuth.js issued JWT. */
+export async function decode(params: JWTDecodeParams): Promise<JWT | null> {
+  const { token, secret } = params
+  if (!token) return null
+  const encryptionSecret = await getDerivedEncryptionKey(secret)
+  const { payload } = await jwtDecrypt(token, encryptionSecret, {
+    clockTolerance: 15,
+  })
+  return payload
+}
+
+export interface GetTokenParams<R extends boolean = false> {
+  /** The request containing the JWT either in the cookies or in the `Authorization` header. */
+  req: NextApiRequest | Pick<NextApiRequest, "cookies" | "headers">
+  /**
+   * Use secure prefix for cookie name, unless URL in `NEXTAUTH_URL` is http://
+   * or not set (e.g. development or test instance) case use unprefixed name
+   */
+  secureCookie?: boolean
+  /** If the JWT is in the cookie, what name `getToken()` should look for. */
+  cookieName?: string
+  /**
+   * `getToken()` will return the raw JWT if this is set to `true`
+   * @default false
+   */
+  raw?: R
+  /**
+   * The same `secret` used in the `NextAuth` configuration.
+   * Defaults to the `NEXTAUTH_SECRET` environment variable.
+   */
+  secret?: string
+  decode?: JWTOptions["decode"]
+  logger?: LoggerInstance | Console
+}
+
+/**
+ * Takes a NextAuth.js request (`req`) and returns either the NextAuth.js issued JWT's payload,
+ * or the raw JWT string. We look for the JWT in the either the cookies, or the `Authorization` header.
+ * [Documentation](https://next-auth.js.org/tutorials/securing-pages-and-api-routes#using-gettoken)
+ */
+export async function getToken<R extends boolean = false>(
+  params?: GetTokenParams<R>
+): Promise<R extends true ? string : JWT | null> {
+  const {
+    req,
+    secureCookie = process.env.NEXTAUTH_URL?.startsWith("https://") ??
+      !!process.env.VERCEL,
+    cookieName = secureCookie
+      ? "__Secure-next-auth.session-token"
+      : "next-auth.session-token",
+    raw,
+    decode: _decode = decode,
+    logger = console,
+    secret = process.env.NEXTAUTH_SECRET,
+  } = params ?? {}
+
+  if (!req) throw new Error("Must pass `req` to JWT getToken()")
+
+  const sessionStore = new SessionStore(
+    { name: cookieName, options: { secure: secureCookie } },
+    { cookies: req.cookies, headers: req.headers },
+    logger
+  )
+
+  let token = sessionStore.value
+
+  if (!token && req.headers.authorization?.split(" ")[0] === "Bearer") {
+    const urlEncodedToken = req.headers.authorization.split(" ")[1]
+    token = decodeURIComponent(urlEncodedToken)
+  }
+
+  // @ts-expect-error
+  if (!token) return null
+
+  // @ts-expect-error
+  if (raw) return token
+
+  try {
+    // @ts-expect-error
+    return await _decode({ token, secret })
+  } catch {
+    // @ts-expect-error
+    return null
+  }
+}
+
+async function getDerivedEncryptionKey(secret: string | Buffer) {
+  return await hkdf(
+    "sha256",
+    secret,
+    "",
+    "NextAuth.js Generated Encryption Key",
+    32
+  )
+}

src/jwt/types.ts

@@ -0,0 +1,54 @@
+import type { Awaitable } from ".."
+
+export interface DefaultJWT extends Record<string, unknown> {
+  name?: string | null
+  email?: string | null
+  picture?: string | null
+  sub?: string
+}
+
+/**
+ * Returned by the `jwt` callback and `getToken`, when using JWT sessions
+ *
+ * [`jwt` callback](https://next-auth.js.org/configuration/callbacks#jwt-callback) | [`getToken`](https://next-auth.js.org/tutorials/securing-pages-and-api-routes#using-gettoken)
+ */
+export interface JWT extends Record<string, unknown>, DefaultJWT {}
+
+export interface JWTEncodeParams {
+  /** The JWT payload. */
+  token?: JWT
+  /** The secret used to encode the NextAuth.js issued JWT. */
+  secret: string | Buffer
+  /**
+   * The maximum age of the NextAuth.js issued JWT in seconds.
+   * @default 30 * 24 * 30 * 60 // 30 days
+   */
+  maxAge?: number
+}
+
+export interface JWTDecodeParams {
+  /** The NextAuth.js issued JWT to be decoded */
+  token?: string
+  /** The secret used to decode the NextAuth.js issued JWT. */
+  secret: string | Buffer
+}
+
+export interface JWTOptions {
+  /**
+   * The secret used to encode/decode the NextAuth.js issued JWT.
+   * @deprecated  Set the `NEXTAUTH_SECRET` environment vairable or
+   * use the top-level `secret` option instead
+   */
+  secret: string
+  /**
+   * The maximum age of the NextAuth.js issued JWT in seconds.
+   * @default 30 * 24 * 30 * 60 // 30 days
+   */
+  maxAge: number
+  /** Override this method to control the NextAuth.js issued JWT encoding. */
+  encode: (params: JWTEncodeParams) => Awaitable<string>
+  /** Override this method to control the NextAuth.js issued JWT decoding. */
+  decode: (params: JWTDecodeParams) => Awaitable<JWT | null>
+}
+
+export type Secret = string | Buffer

src/lib/errors.js

@@ -1,87 +0,0 @@
-/**
- * Same as the default `Error`, but it is JSON serializable.
- * @source https://iaincollins.medium.com/error-handling-in-javascript-a6172ccdf9af
- */
-export class UnknownError extends Error {
-  constructor(error) {
-    // Support passing error or string
-    super(error?.message ?? error)
-    this.name = "UnknownError"
-    if (error instanceof Error) {
-      this.stack = error.stack
-    }
-  }
-
-  toJSON() {
-    return {
-      name: this.name,
-      message: this.message,
-      stack: this.stack,
-    }
-  }
-}
-
-export class OAuthCallbackError extends UnknownError {
-  name = "OAuthCallbackError"
-}
-
-/**
- * Thrown when an Email address is already associated with an account
- * but the user is trying an OAuth account that is not linked to it.
- */
-export class AccountNotLinkedError extends UnknownError {
-  name = "AccountNotLinkedError"
-}
-
-export function upperSnake(s) {
-  return s.replace(/([A-Z])/g, "_$1").toUpperCase()
-}
-
-export function capitalize(s) {
-  return `${s[0].toUpperCase()}${s.slice(1)}`
-}
-
-/**
- * Wraps an object of methods and adds error handling.
- * @param {import("types").EventCallbacks} methods
- * @param {import("types").LoggerInstance} logger
- * @return {import("types").EventCallbacks}
- */
-export function eventsErrorHandler(methods, logger) {
-  return Object.entries(methods).reduce((acc, [name, method]) => {
-    acc[name] = async (...args) => {
-      try {
-        return await method(...args)
-      } catch (e) {
-        logger.error(`${upperSnake(name)}_EVENT_ERROR`, e)
-      }
-    }
-    return acc
-  }, {})
-}
-
-/**
- * Handles adapter induced errors.
- * @param {import("types/adapters").Adapter} [adapter]
- * @param {import("types").LoggerInstance} logger
- * @return {import("types/adapters").Adapter}
- */
-export function adapterErrorHandler(adapter, logger) {
-  if (!adapter) return
-
-  return Object.keys(adapter).reduce((acc, method) => {
-    acc[method] = async (...args) => {
-      try {
-        logger.debug(`adapter_${method}`, ...args)
-        const adapterMethod = adapter[method]
-        return await adapterMethod(...args)
-      } catch (error) {
-        logger.error(`adapter_error_${method}`, error)
-        const e = new UnknownError(error)
-        e.name = `${capitalize(method)}Error`
-        throw e
-      }
-    }
-    return acc
-  }, {})
-}

src/lib/jwt.js

@@ -1,202 +0,0 @@
-import crypto from "crypto"
-import jose from "jose"
-import logger from "./logger"
-
-// Set default algorithm to use for auto-generated signing key
-const DEFAULT_SIGNATURE_ALGORITHM = "HS512"
-
-// Set default algorithm for auto-generated symmetric encryption key
-const DEFAULT_ENCRYPTION_ALGORITHM = "A256GCM"
-
-// Use encryption or not by default
-const DEFAULT_ENCRYPTION_ENABLED = false
-
-const DEFAULT_MAX_AGE = 30 * 24 * 60 * 60 // 30 days
-
-export async function encode({
-  token = {},
-  maxAge = DEFAULT_MAX_AGE,
-  secret,
-  signingKey,
-  signingOptions = {
-    expiresIn: `${maxAge}s`,
-  },
-  encryptionKey,
-  encryptionOptions = {
-    alg: "dir",
-    enc: DEFAULT_ENCRYPTION_ALGORITHM,
-    zip: "DEF",
-  },
-  encryption = DEFAULT_ENCRYPTION_ENABLED,
-} = {}) {
-  // Signing Key
-  const _signingKey = signingKey
-    ? jose.JWK.asKey(JSON.parse(signingKey))
-    : getDerivedSigningKey(secret)
-
-  // Sign token
-  const signedToken = jose.JWT.sign(token, _signingKey, signingOptions)
-
-  if (encryption) {
-    // Encryption Key
-    const _encryptionKey = encryptionKey
-      ? jose.JWK.asKey(JSON.parse(encryptionKey))
-      : getDerivedEncryptionKey(secret)
-
-    // Encrypt token
-    return jose.JWE.encrypt(signedToken, _encryptionKey, encryptionOptions)
-  }
-  return signedToken
-}
-
-export async function decode({
-  secret,
-  token,
-  maxAge = DEFAULT_MAX_AGE,
-  signingKey,
-  verificationKey = signingKey, // Optional (defaults to encryptionKey)
-  verificationOptions = {
-    maxTokenAge: `${maxAge}s`,
-    algorithms: [DEFAULT_SIGNATURE_ALGORITHM],
-  },
-  encryptionKey,
-  decryptionKey = encryptionKey, // Optional (defaults to encryptionKey)
-  decryptionOptions = {
-    algorithms: [DEFAULT_ENCRYPTION_ALGORITHM],
-  },
-  encryption = DEFAULT_ENCRYPTION_ENABLED,
-} = {}) {
-  if (!token) return null
-
-  let tokenToVerify = token
-
-  if (encryption) {
-    // Encryption Key
-    const _encryptionKey = decryptionKey
-      ? jose.JWK.asKey(JSON.parse(decryptionKey))
-      : getDerivedEncryptionKey(secret)
-
-    // Decrypt token
-    const decryptedToken = jose.JWE.decrypt(
-      token,
-      _encryptionKey,
-      decryptionOptions
-    )
-    tokenToVerify = decryptedToken.toString("utf8")
-  }
-
-  // Signing Key
-  const _signingKey = verificationKey
-    ? jose.JWK.asKey(JSON.parse(verificationKey))
-    : getDerivedSigningKey(secret)
-
-  // Verify token
-  return jose.JWT.verify(tokenToVerify, _signingKey, verificationOptions)
-}
-
-/**
- * Server-side method to retrieve the JWT from `req`.
- * @param {{
- * req: NextApiRequest
- * secureCookie?: boolean
- * cookieName?: string
- * raw?: boolean
- * }} params
- */
-export async function getToken(params) {
-  const {
-    req,
-    // Use secure prefix for cookie name, unless URL is NEXTAUTH_URL is http://
-    // or not set (e.g. development or test instance) case use unprefixed name
-    secureCookie = !(
-      !process.env.NEXTAUTH_URL ||
-      process.env.NEXTAUTH_URL.startsWith("http://")
-    ),
-    cookieName = secureCookie
-      ? "__Secure-next-auth.session-token"
-      : "next-auth.session-token",
-    raw = false,
-    decode: _decode = decode,
-  } = params
-  if (!req) throw new Error("Must pass `req` to JWT getToken()")
-
-  // Try to get token from cookie
-  let token = req.cookies[cookieName]
-
-  // If cookie not found in cookie look for bearer token in authorization header.
-  // This allows clients that pass through tokens in headers rather than as
-  // cookies to use this helper function.
-  if (!token && req.headers.authorization?.split(" ")[0] === "Bearer") {
-    const urlEncodedToken = req.headers.authorization.split(" ")[1]
-    token = decodeURIComponent(urlEncodedToken)
-  }
-
-  if (raw) {
-    return token
-  }
-
-  try {
-    return _decode({ token, ...params })
-  } catch {
-    return null
-  }
-}
-
-// Generate warning (but only once at startup) when auto-generated keys are used
-let DERIVED_SIGNING_KEY_WARNING = false
-let DERIVED_ENCRYPTION_KEY_WARNING = false
-
-// Do the better hkdf of Node.js one added in `v15.0.0` and Third Party one
-function hkdf(secret, { byteLength, encryptionInfo, digest = "sha256" }) {
-  if (crypto.hkdfSync) {
-    return Buffer.from(
-      crypto.hkdfSync(
-        digest,
-        secret,
-        Buffer.alloc(0),
-        encryptionInfo,
-        byteLength
-      )
-    )
-  }
-  return require("futoin-hkdf")(secret, byteLength, {
-    info: encryptionInfo,
-    hash: digest,
-  })
-}
-
-function getDerivedSigningKey(secret) {
-  if (!DERIVED_SIGNING_KEY_WARNING) {
-    logger.warn("JWT_AUTO_GENERATED_SIGNING_KEY")
-    DERIVED_SIGNING_KEY_WARNING = true
-  }
-
-  const buffer = hkdf(secret, {
-    byteLength: 64,
-    encryptionInfo: "NextAuth.js Generated Signing Key",
-  })
-  const key = jose.JWK.asKey(buffer, {
-    alg: DEFAULT_SIGNATURE_ALGORITHM,
-    use: "sig",
-    kid: "nextauth-auto-generated-signing-key",
-  })
-  return key
-}
-
-function getDerivedEncryptionKey(secret) {
-  if (!DERIVED_ENCRYPTION_KEY_WARNING) {
-    logger.warn("JWT_AUTO_GENERATED_ENCRYPTION_KEY")
-    DERIVED_ENCRYPTION_KEY_WARNING = true
-  }
-
-  const buffer = hkdf(secret, {
-    byteLength: 32,
-    encryptionInfo: "NextAuth.js Generated Encryption Key",
-  })
-  const key = jose.JWK.asKey(buffer, {
-    alg: DEFAULT_ENCRYPTION_ALGORITHM,
-    use: "enc",
-    kid: "nextauth-auto-generated-encryption-key",
-  })
-  return key
-}

src/lib/logger.js

@@ -1,84 +0,0 @@
-import { UnknownError } from "./errors"
-
-/** Makes sure that error is always serializable */
-function formatError(o) {
-  if (o instanceof Error && !(o instanceof UnknownError)) {
-    return { message: o.message, stack: o.stack, name: o.name }
-  }
-  if (o?.error) {
-    o.error = formatError(o.error)
-    o.message = o.message ?? o.error.message
-  }
-  return o
-}
-
-/** @type {import("types").LoggerInstance} */
-const _logger = {
-  error(code, metadata) {
-    metadata = formatError(metadata)
-    console.error(
-      `[next-auth][error][${code}]`,
-      `\nhttps://next-auth.js.org/errors#${code.toLowerCase()}`,
-      metadata.message,
-      metadata
-    )
-  },
-  warn(code) {
-    console.warn(
-      `[next-auth][warn][${code}]`,
-      `\nhttps://next-auth.js.org/warnings#${code.toLowerCase()}`
-    )
-  },
-  debug(code, metadata) {
-    if (!process?.env?._NEXTAUTH_DEBUG) return
-    console.log(`[next-auth][debug][${code}]`, metadata)
-  },
-}
-
-/**
- * Override the built-in logger.
- * Any `undefined` level will use the default logger.
- * @param {Partial<import("types").LoggerInstance>} newLogger
- */
-export function setLogger(newLogger = {}) {
-  if (newLogger.error) _logger.error = newLogger.error
-  if (newLogger.warn) _logger.warn = newLogger.warn
-  if (newLogger.debug) _logger.debug = newLogger.debug
-}
-
-export default _logger
-
-/**
- * Serializes client-side log messages and sends them to the server
- * @param {import("types").LoggerInstance} logger
- * @param {string} basePath
- * @return {import("types").LoggerInstance}
- */
-export function proxyLogger(logger = _logger, basePath) {
-  try {
-    if (typeof window === "undefined") {
-      return logger
-    }
-
-    const clientLogger = {}
-    for (const level in logger) {
-      clientLogger[level] = (code, metadata) => {
-        _logger[level](code, metadata) // Logs to console
-
-        if (level === "error") {
-          metadata = formatError(metadata)
-        }
-        metadata.client = true
-        const url = `${basePath}/_log`
-        const body = new URLSearchParams({ level, code, ...metadata })
-        if (navigator.sendBeacon) {
-          return navigator.sendBeacon(url, body)
-        }
-        return fetch(url, { method: "POST", body, keepalive: true })
-      }
-    }
-    return clientLogger
-  } catch {
-    return _logger
-  }
-}

src/lib/logger.ts

@@ -0,0 +1,113 @@
+import { UnknownError } from "../core/errors"
+
+// TODO: better typing
+/** Makes sure that error is always serializable */
+function formatError(o: unknown): unknown {
+  if (o instanceof Error && !(o instanceof UnknownError)) {
+    return { message: o.message, stack: o.stack, name: o.name }
+  }
+  if (hasErrorProperty(o)) {
+    o.error = formatError(o.error) as Error
+    o.message = o.message ?? o.error.message
+  }
+  return o
+}
+
+function hasErrorProperty(
+  x: unknown
+): x is { error: Error; [key: string]: unknown } {
+  return !!(x as any)?.error
+}
+
+export type WarningCode = "NEXTAUTH_URL" | "NO_SECRET" | "TWITTER_OAUTH_2_BETA"
+
+/**
+ * Override any of the methods, and the rest will use the default logger.
+ *
+ * [Documentation](https://next-auth.js.org/configuration/options#logger)
+ */
+export interface LoggerInstance extends Record<string, Function> {
+  warn: (code: WarningCode) => void
+  error: (
+    code: string,
+    /**
+     * Either an instance of (JSON serializable) Error
+     * or an object that contains some debug information.
+     * (Error is still available through `metadata.error`)
+     */
+    metadata: Error | { error: Error; [key: string]: unknown }
+  ) => void
+  debug: (code: string, metadata: unknown) => void
+}
+
+const _logger: LoggerInstance = {
+  error(code, metadata) {
+    metadata = formatError(metadata) as Error
+    console.error(
+      `[next-auth][error][${code}]`,
+      `\nhttps://next-auth.js.org/errors#${code.toLowerCase()}`,
+      metadata.message,
+      metadata
+    )
+  },
+  warn(code) {
+    console.warn(
+      `[next-auth][warn][${code}]`,
+      `\nhttps://next-auth.js.org/warnings#${code.toLowerCase()}`
+    )
+  },
+  debug(code, metadata) {
+    console.log(`[next-auth][debug][${code}]`, metadata)
+  },
+}
+
+/**
+ * Override the built-in logger with user's implementation.
+ * Any `undefined` level will use the default logger.
+ */
+export function setLogger(
+  newLogger: Partial<LoggerInstance> = {},
+  debug?: boolean
+) {
+  // Turn off debug logging if `debug` isn't set to `true`
+  if (!debug) _logger.debug = () => {}
+
+  if (newLogger.error) _logger.error = newLogger.error
+  if (newLogger.warn) _logger.warn = newLogger.warn
+  if (newLogger.debug) _logger.debug = newLogger.debug
+}
+
+export default _logger
+
+/** Serializes client-side log messages and sends them to the server */
+export function proxyLogger(
+  logger: LoggerInstance = _logger,
+  basePath?: string
+): LoggerInstance {
+  try {
+    if (typeof window === "undefined") {
+      return logger
+    }
+
+    const clientLogger: Record<string, unknown> = {}
+    for (const level in logger) {
+      clientLogger[level] = (code: string, metadata: Error) => {
+        _logger[level](code, metadata) // Logs to console
+
+        if (level === "error") {
+          metadata = formatError(metadata) as Error
+        }
+        ;(metadata as any).client = true
+        const url = `${basePath}/_log`
+        const body = new URLSearchParams({ level, code, ...metadata })
+        if (navigator.sendBeacon) {
+          return navigator.sendBeacon(url, body)
+        }
+        return fetch(url, { method: "POST", body, keepalive: true })
+      }
+    }
+    return clientLogger as unknown as LoggerInstance
+  } catch {
+    return _logger
+  }
+}

src/lib/merge.ts

@@ -1,20 +1,12 @@
 // Source: https://stackoverflow.com/a/34749873/5364135
 
-/**
- * Simple object check.
- * @param item
- * @returns {boolean}
- */
-function isObject(item) {
+/** Simple object check */
+function isObject(item: any): boolean {
   return item && typeof item === "object" && !Array.isArray(item)
 }
 
-/**
- * Deep merge two objects.
- * @param target
- * @param ...sources
- */
-export function merge(target, ...sources) {
+/** Deep merge two objects */
+export function merge(target: any, ...sources: any[]): any {
   if (!sources.length) return target
   const source = sources.shift()
 

src/lib/parse-url.js

@@ -1,27 +0,0 @@
-/**
- * Simple universal (client/server) function to split host and path
- * We use this rather than a library because we need to use the same logic both
- * client and server side and we only need to parse out the host and path, while
- * supporting a default value, so a simple split is sufficent.
- * @param {string} url
- */
-export default function parseUrl (url) {
-  // Default values
-  const defaultHost = 'http://localhost:3000'
-  const defaultPath = '/api/auth'
-
-  if (!url) { url = `${defaultHost}${defaultPath}` }
-
-  // Default to HTTPS if no protocol explictly specified
-  const protocol = url.startsWith('http:') ? 'http' : 'https'
-
-  // Normalize URLs by stripping protocol and no trailing slash
-  url = url.replace(/^https?:\/\//, '').replace(/\/$/, '')
-
-  // Simple split based on first /
-  const [_host, ..._path] = url.split('/')
-  const baseUrl = _host ? `${protocol}://${_host}` : defaultHost
-  const basePath = _path.length > 0 ? `/${_path.join('/')}` : defaultPath
-
-  return { baseUrl, basePath }
-}

src/lib/parse-url.ts

@@ -0,0 +1,36 @@
+export interface InternalUrl {
+  /** @default "http://localhost:3000" */
+  origin: string
+  /** @default "localhost:3000" */
+  host: string
+  /** @default "/api/auth" */
+  path: string
+  /** @default "http://localhost:3000/api/auth" */
+  base: string
+  /** @default "http://localhost:3000/api/auth" */
+  toString: () => string
+}
+
+/** Returns an `URL` like object to make requests/redirects from server-side */
+export default function parseUrl(url?: string): InternalUrl {
+  const defaultUrl = new URL("http://localhost:3000/api/auth")
+
+  if (url && !url.startsWith("http")) {
+    url = `https://${url}`
+  }
+
+  const _url = new URL(url ?? defaultUrl)
+  const path = (_url.pathname === "/" ? defaultUrl.pathname : _url.pathname)
+    // Remove trailing slash
+    .replace(/\/$/, "")
+
+  const base = `${_url.origin}${path}`
+
+  return {
+    origin: _url.origin,
+    host: _url.host,
+    path,
+    base,
+    toString: () => base,
+  }
+}

src/lib/types.ts

@@ -0,0 +1,90 @@
+import type { NextApiRequest, NextApiResponse } from "next"
+
+import type {
+  CallbacksOptions,
+  CookiesOptions,
+  EventCallbacks,
+  LoggerInstance,
+  PagesOptions,
+  SessionOptions,
+  Theme,
+  Awaitable,
+} from ".."
+
+import type {
+  OAuthConfig,
+  EmailConfig,
+  CredentialsConfig,
+  ProviderType,
+} from "../providers"
+import type { JWTOptions } from "../jwt"
+import type { Adapter } from "../adapters"
+import { InternalUrl } from "./parse-url"
+
+// Below are types that are only supposed be used by next-auth internally
+
+/** @internal */
+export type InternalProvider<T extends ProviderType = any> = (T extends "oauth"
+  ? OAuthConfig<any>
+  : T extends "email"
+  ? EmailConfig
+  : T extends "credentials"
+  ? CredentialsConfig
+  : never) & {
+  signinUrl: string
+  callbackUrl: string
+}
+
+export type NextAuthAction =
+  | "providers"
+  | "session"
+  | "csrf"
+  | "signin"
+  | "signout"
+  | "callback"
+  | "verify-request"
+  | "error"
+  | "_log"
+
+/** @internal */
+export interface InternalOptions<T extends ProviderType = any> {
+  providers: InternalProvider[]
+  /**
+   * Parsed from `NEXTAUTH_URL` or `x-forwarded-host` on Vercel.
+   * @default "http://localhost:3000/api/auth"
+   */
+  url: InternalUrl
+  action: NextAuthAction
+  provider: T extends string
+    ? InternalProvider<T>
+    : InternalProvider<T> | undefined
+  csrfToken?: string
+  csrfTokenVerified?: boolean
+  secret: string
+  theme: Theme
+  debug: boolean
+  logger: LoggerInstance
+  session: Required<SessionOptions>
+  pages: Partial<PagesOptions>
+  jwt: JWTOptions
+  events: Partial<EventCallbacks>
+  adapter?: Adapter
+  callbacks: CallbacksOptions
+  cookies: CookiesOptions
+  callbackUrl: string
+}
+
+/** @internal */
+export interface NextAuthRequest extends NextApiRequest {
+  options: InternalOptions
+}
+
+/** @internal */
+export type NextAuthResponse<T = any> = NextApiResponse<T>
+
+/** @internal */
+// eslint-disable-next-line @typescript-eslint/no-invalid-void-type
+export type NextAuthApiHandler<Result = void, Response = any> = (
+  req: NextAuthRequest,
+  res: NextAuthResponse<Response>
+) => Awaitable<Result>

src/middleware.ts

@@ -0,0 +1,2 @@
+export { default } from "./next/middleware"
+export * from "./next/middleware"

src/next/index.ts

@@ -0,0 +1,118 @@
+import { NextAuthHandler } from "../core"
+import { setCookie, detectHost } from "./utils"
+
+import type {
+  GetServerSidePropsContext,
+  NextApiRequest,
+  NextApiResponse,
+} from "next"
+import type { NextAuthOptions, Session } from ".."
+import type {
+  NextAuthAction,
+  NextAuthRequest,
+  NextAuthResponse,
+} from "../lib/types"
+
+async function NextAuthNextHandler(
+  req: NextApiRequest,
+  res: NextApiResponse,
+  options: NextAuthOptions
+) {
+  const { nextauth, ...query } = req.query
+
+  options.secret =
+    options.secret ?? options.jwt?.secret ?? process.env.NEXTAUTH_SECRET
+
+  const handler = await NextAuthHandler({
+    req: {
+      host: detectHost(req.headers["x-forwarded-host"]),
+      body: req.body,
+      query,
+      cookies: req.cookies,
+      headers: req.headers,
+      method: req.method,
+      action: nextauth?.[0] as NextAuthAction,
+      providerId: nextauth?.[1],
+      error: (req.query.error as string | undefined) ?? nextauth?.[1],
+    },
+    options,
+  })
+
+  res.status(handler.status ?? 200)
+
+  handler.cookies?.forEach((cookie) => setCookie(res, cookie))
+
+  handler.headers?.forEach((h) => res.setHeader(h.key, h.value))
+
+  if (handler.redirect) {
+    // If the request expects a return URL, send it as JSON
+    // instead of doing an actual redirect.
+    if (req.body?.json !== "true") {
+      // Could chain. .end() when lowest target is Node 14
+      // https://github.com/nodejs/node/issues/33148
+      res.status(302).setHeader("Location", handler.redirect)
+      return res.end()
+    }
+    return res.json({ url: handler.redirect })
+  }
+
+  return res.send(handler.body)
+}
+
+function NextAuth(options: NextAuthOptions): any
+function NextAuth(
+  req: NextApiRequest,
+  res: NextApiResponse,
+  options: NextAuthOptions
+): any
+
+/** Tha main entry point to next-auth */
+function NextAuth(
+  ...args:
+    | [NextAuthOptions]
+    | [NextApiRequest, NextApiResponse, NextAuthOptions]
+) {
+  if (args.length === 1) {
+    return async (req: NextAuthRequest, res: NextAuthResponse) =>
+      await NextAuthNextHandler(req, res, args[0])
+  }
+
+  return NextAuthNextHandler(args[0], args[1], args[2])
+}
+
+export default NextAuth
+
+export async function getServerSession(
+  context:
+    | GetServerSidePropsContext
+    | { req: NextApiRequest; res: NextApiResponse },
+  options: NextAuthOptions
+): Promise<Session | null> {
+  const session = await NextAuthHandler<Session | {}>({
+    options,
+    req: {
+      host: detectHost(context.req.headers["x-forwarded-host"]),
+      action: "session",
+      method: "GET",
+      cookies: context.req.cookies,
+      headers: context.req.headers,
+    },
+  })
+
+  const { body, cookies } = session
+
+  cookies?.forEach((cookie) => setCookie(context.res, cookie))
+
+  if (body && Object.keys(body).length) return body as Session
+  return null
+}
+
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace NodeJS {
+    interface ProcessEnv {
+      NEXTAUTH_URL?: string
+      VERCEL?: "1"
+    }
+  }
+}

src/next/middleware.ts

@@ -0,0 +1,141 @@
+import type { NextMiddleware, NextFetchEvent } from "next/server"
+import type { Awaitable, NextAuthOptions } from ".."
+import type { JWT } from "../jwt"
+
+import { NextResponse, NextRequest } from "next/server"
+
+import { getToken } from "../jwt"
+import parseUrl from "../lib/parse-url"
+
+type AuthorizedCallback = (params: {
+  token: JWT | null
+  req: NextRequest
+}) => Awaitable<boolean>
+
+export interface NextAuthMiddlewareOptions {
+  /**
+   * Where to redirect the user in case of an error if they weren't logged in.
+   * Similar to `pages` in `NextAuth`.
+   *
+   * ---
+   * [Documentation](https://next-auth.js.org/configuration/pages)
+   */
+  pages?: NextAuthOptions["pages"]
+  callbacks?: {
+    /**
+     * Callback that receives the user's JWT payload
+     * and returns `true` to allow the user to continue.
+     *
+     * This is similar to the `signIn` callback in `NextAuthOptions`.
+     *
+     * If it returns `false`, the user is redirected to the sign-in page instead
+     *
+     * The default is to let the user continue if they have a valid JWT (basic authentication).
+     *
+     * How to restrict a page and all of it's subpages for admins-only:
+     * @example
+     *
+     * ```js
+     * // `pages/admin/_middleware.js`
+     * import { withAuth } from "next-auth/middleware"
+     *
+     * export default withAuth({
+     *   callbacks: {
+     *     authorized: ({ token }) => token?.user.isAdmin
+     *   }
+     * })
+     * ```
+     *
+     * ---
+     * [Documentation](https://next-auth.js.org/getting-started/nextjs/middleware#api) | [`signIn` callback](configuration/callbacks#sign-in-callback)
+     */
+    authorized?: AuthorizedCallback
+  }
+}
+
+async function handleMiddleware(
+  req: NextRequest,
+  options: NextAuthMiddlewareOptions | undefined,
+  onSuccess?: (token: JWT | null) => Promise<any>
+) {
+  const signInPage = options?.pages?.signIn ?? "/api/auth/signin"
+  const errorPage = options?.pages?.error ?? "/api/auth/error"
+  const basePath = parseUrl(process.env.NEXTAUTH_URL).path
+  // Avoid infinite redirect loop
+  if (
+    req.nextUrl.pathname.startsWith(basePath) ||
+    [signInPage, errorPage].includes(req.nextUrl.pathname)
+  ) {
+    return
+  }
+
+  if (!process.env.NEXTAUTH_SECRET) {
+    console.error(
+      `[next-auth][error][NO_SECRET]`,
+      `\nhttps://next-auth.js.org/errors#no_secret`
+    )
+
+    return {
+      redirect: NextResponse.redirect(`${errorPage}?error=Configuration`),
+    }
+  }
+
+  const token = await getToken({ req: req as any })
+
+  const isAuthorized =
+    (await options?.callbacks?.authorized?.({ req, token })) ?? !!token
+
+  // the user is authorized, let the middleware handle the rest
+  if (isAuthorized) return await onSuccess?.(token)
+
+  // the user is not logged in, re-direct to the sign-in page
+  return NextResponse.redirect(
+    `${signInPage}?${new URLSearchParams({ callbackUrl: req.url })}`
+  )
+}
+
+export type WithAuthArgs =
+  | [NextRequest]
+  | [NextRequest, NextFetchEvent]
+  | [NextRequest, NextAuthMiddlewareOptions]
+  | [NextMiddleware]
+  | [NextMiddleware, NextAuthMiddlewareOptions]
+  | [NextAuthMiddlewareOptions]
+
+/**
+ * Middleware that checks if the user is authenticated/authorized.
+ * If if they aren't, they will be redirected to the login page.
+ * Otherwise, continue.
+ *
+ * @example
+ *
+ * ```js
+ * // `pages/_middleware.js`
+ * export { default } from "next-auth/middleware"
+ * ```
+ *
+ * ---
+ * [Documentation](https://next-auth.js.org/getting-started/middleware)
+ */
+export function withAuth(...args: WithAuthArgs) {
+  if (args[0] instanceof NextRequest) {
+    // @ts-expect-error
+    return handleMiddleware(...args)
+  }
+
+  if (typeof args[0] === "function") {
+    const middleware = args[0]
+    const options = args[1] as NextAuthMiddlewareOptions | undefined
+    return async (...args: Parameters<NextMiddleware>) =>
+      await handleMiddleware(args[0], options, async (token) => {
+        ;(args[0] as any).nextauth = { token }
+        return await middleware(...args)
+      })
+  }
+
+  const options = args[0]
+  return async (...args: Parameters<NextMiddleware>) =>
+    await handleMiddleware(args[0], options)
+}
+
+export default withAuth

src/next/utils.ts

@@ -0,0 +1,23 @@
+import { serialize } from "cookie"
+import { Cookie } from "../core/lib/cookie"
+
+export function setCookie(res, cookie: Cookie) {
+  // Preserve any existing cookies that have already been set in the same session
+  let setCookieHeader = res.getHeader("Set-Cookie") ?? []
+  // If not an array (i.e. a string with a single cookie) convert it into an array
+  if (!Array.isArray(setCookieHeader)) {
+    setCookieHeader = [setCookieHeader]
+  }
+  const { name, value, options } = cookie
+  const cookieHeader = serialize(name, value, options)
+  setCookieHeader.push(cookieHeader)
+  res.setHeader("Set-Cookie", setCookieHeader)
+}
+
+/** Extract the host from the environment */
+export function detectHost(forwardedHost: any) {
+  // If we detect a Vercel environment, we can trust the host
+  if (process.env.VERCEL) return forwardedHost
+  // If `NEXTAUTH_URL` is `undefined` we fall back to "http://localhost:3000"
+  return process.env.NEXTAUTH_URL
+}

src/providers/42-school.ts

@@ -0,0 +1,179 @@
+import type { OAuthConfig, OAuthUserConfig } from "."
+
+export interface UserData {
+  id: number
+  email: string
+  login: string
+  first_name: string
+  last_name: string
+  usual_full_name: null | string
+  usual_first_name: null | string
+  url: string
+  phone: "hidden" | string | null
+  displayname: string
+  image_url: string | null
+  "staff?": boolean
+  correction_point: number
+  pool_month: string | null
+  pool_year: string | null
+  location: string | null
+  wallet: number
+  anonymize_date: string
+  created_at: string
+  updated_at: string | null
+  alumni: boolean
+  "is_launched?": boolean
+}
+
+export interface CursusUser {
+  grade: string | null
+  level: number
+  skills: Array<{ id: number; name: string; level: number }>
+  blackholed_at: string | null
+  id: number
+  begin_at: string | null
+  end_at: string | null
+  cursus_id: number
+  has_coalition: boolean
+  created_at: string
+  updated_at: string | null
+  user: UserData
+  cursus: { id: number; created_at: string; name: string; slug: string }
+}
+
+export interface ProjectUser {
+  id: number
+  occurrence: number
+  final_mark: number | null
+  status: "in_progress" | "finished"
+  "validated?": boolean | null
+  current_team_id: number
+  project: {
+    id: number
+    name: string
+    slug: string
+    parent_id: number | null
+  }
+  cursus_ids: number[]
+  marked_at: string | null
+  marked: boolean
+  retriable_at: string | null
+  created_at: string
+  updated_at: string | null
+}
+
+export interface Achievement {
+  id: number
+  name: string
+  description: string
+  tier: "none" | "easy" | "medium" | "hard" | "challenge"
+  kind: "scolarity" | "project" | "pedagogy" | "scolarity"
+  visible: boolean
+  image: string | null
+  nbr_of_success: number | null
+  users_url: string
+}
+
+export interface LanguagesUser {
+  id: number
+  language_id: number
+  user_id: number
+  position: number
+  created_at: string
+}
+
+export interface TitlesUser {
+  id: number
+  user_id: number
+  title_id: number
+  selected: boolean
+  created_at: string
+  updated_at: string | null
+}
+
+export interface ExpertisesUser {
+  id: number
+  expertise_id: number
+  interested: boolean
+  value: number
+  contact_me: boolean
+  created_at: string
+  user_id: number
+}
+
+export interface Campus {
+  id: number
+  name: string
+  time_zone: string
+  language: {
+    id: number
+    name: string
+    identifier: string
+    created_at: string
+    updated_at: string | null
+  }
+  users_count: number
+  vogsphere_id: number
+  country: string
+  address: string
+  zip: string
+  city: string
+  website: string
+  facebook: string
+  twitter: string
+  active: boolean
+  email_extension: string
+  default_hidden_phone: boolean
+}
+
+export interface CampusUser {
+  id: number
+  user_id: number
+  campus_id: number
+  is_primary: boolean
+  created_at: string
+  updated_at: string | null
+}
+
+export interface FortyTwoProfile extends UserData {
+  groups: Array<{ id: string; name: string }>
+  cursus_users: CursusUser[]
+  projects_users: ProjectUser[]
+  languages_users: LanguagesUser[]
+  achievements: Achievement[]
+  titles: Array<{ id: string; name: string }>
+  titles_users: TitlesUser[]
+  partnerships: any[]
+  patroned: any[]
+  patroning: any[]
+  expertises_users: ExpertisesUser[]
+  roles: Array<{ id: string; name: string }>
+  campus: Campus[]
+  campus_users: CampusUser[]
+  user: any | null
+}
+
+export default function FortyTwo<
+  P extends Record<string, any> = FortyTwoProfile
+>(options: OAuthUserConfig<P>): OAuthConfig<P> {
+  return {
+    id: "42-school",
+    name: "42 School",
+    type: "oauth",
+    authorization: {
+      url: "https://api.intra.42.fr/oauth/authorize",
+      params: { scope: "public" },
+    },
+    token: "https://api.intra.42.fr/oauth/token",
+    userinfo: "https://api.intra.42.fr/v2/me",
+    profile(profile) {
+      return {
+        id: profile.id.toString(),
+        name: profile.usual_full_name,
+        email: profile.email,
+        image: profile.image_url,
+      }
+    },
+    options,
+  }
+}

src/providers/42.js

@@ -1,19 +0,0 @@
-export default function FortyTwo(options) {
-  return {
-    id: "42-school",
-    name: "42 School",
-    type: "oauth",
-    authorization: "https://api.intra.42.fr/oauth/authorize",
-    token: "https://api.intra.42.fr/oauth/token",
-    userinfo: "https://api.intra.42.fr/v2/me",
-    profile(profile) {
-      return {
-        id: profile.id,
-        name: profile.usual_full_name,
-        email: profile.email,
-        image: profile.image_url,
-      }
-    },
-    options,
-  }
-}

src/providers/apple.js

@@ -1,36 +0,0 @@
-export default function Apple(options) {
-  return {
-    id: "apple",
-    name: "Apple",
-    type: "oauth",
-    authorization: {
-      url: "https://appleid.apple.com/auth/authorize",
-      params: {
-        scope: "name email",
-        response_type: "code",
-        id_token: "",
-        response_mode: "form_post",
-      },
-    },
-    token: {
-      url: "https://appleid.apple.com/auth/token",
-      idToken: true,
-    },
-    jwks_endpoint: "https://appleid.apple.com/auth/keys",
-    profile(profile) {
-      // The name of the user will only be returned on first login
-      const name = profile.user
-        ? profile.user.name.firstName + " " + profile.user.name.lastName
-        : null
-
-      return {
-        id: profile.sub,
-        name,
-        email: profile.email,
-        image: null,
-      }
-    },
-    checks: ["none"], // REVIEW: Apple does not support state, as far as I know. Can we use "pkce" then?
-    options,
-  }
-}

src/providers/apple.ts

@@ -0,0 +1,122 @@
+import { OAuthConfig, OAuthUserConfig } from "."
+
+/**
+ * See more at:
+ * [Retrieve the User's Information from Apple ID Servers
+](https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple#3383773)
+ */
+export interface AppleProfile {
+  /**
+   * The issuer registered claim identifies the principal that issued the identity token.
+   * Since Apple generates the token, the value is `https://appleid.apple.com`.
+   */
+  iss: "https://appleid.apple.com"
+  /**
+   * The audience registered claim identifies the recipient for which the identity token is intended.
+   * Since the token is meant for your application, the value is the `client_id` from your developer account.
+   */
+  aud: string
+  /**
+   * The issued at registered claim indicates the time at which Apple issued the identity token,
+   * in terms of the number of seconds since Epoch, in UTC.
+   */
+  iat: number
+
+  /**
+   * The expiration time registered identifies the time on or after which the identity token expires,
+   * in terms of number of seconds since Epoch, in UTC.
+   * The value must be greater than the current date/time when verifying the token.
+   */
+  exp: number
+  /**
+   * The subject registered claim identifies the principal that's the subject of the identity token.
+   * Since this token is meant for your application, the value is the unique identifier for the user.
+   */
+  sub: string
+  /**
+   * A String value used to associate a client session and the identity token.
+   * This value mitigates replay attacks and is present only if passed during the authorization request.
+   */
+  nonce: string
+
+  /**
+   * A Boolean value that indicates whether the transaction is on a nonce-supported platform.
+   * If you sent a nonce in the authorization request but don't see the nonce claim in the identity token,
+   * check this claim to determine how to proceed.
+   * If this claim returns true, you should treat nonce as mandatory and fail the transaction;
+   * otherwise, you can proceed treating the nonce as options.
+   */
+  nonce_supported: boolean
+
+  /**
+   * A String value representing the user's email address.
+   * The email address is either the user's real email address or the proxy address,
+   * depending on their status private email relay service.
+   */
+  email: string
+
+  /**
+   * A String or Boolean value that indicates whether the service has verified the email.
+   * The value of this claim is always true, because the servers only return verified email addresses.
+   * The value can either be a String (`"true"`) or a Boolean (`true`).
+   */
+  email_verified: "true" | true
+
+  /**
+   * A String or Boolean value that indicates whether the email shared by the user is the proxy address.
+   * The value can either be a String (`"true"` or `"false"`) or a Boolean (`true` or `false`).
+   */
+  is_private_email: boolean | "true" | "false"
+
+  /**
+   * An Integer value that indicates whether the user appears to be a real person.
+   * Use the value of this claim to mitigate fraud. The possible values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal).
+   * For more information, see [`ASUserDetectionStatus`](https://developer.apple.com/documentation/authenticationservices/asuserdetectionstatus).
+   * This claim is present only on iOS 14 and later, macOS 11 and later, watchOS 7 and later, tvOS 14 and later;
+   * the claim isn't present or supported for web-based apps.
+   */
+  real_user_status: 0 | 1 | 2
+
+  /**
+   * A String value representing the transfer identifier used to migrate users to your team.
+   * This claim is present only during the 60-day transfer period after an you transfer an app.
+   * For more information, see [Bringing New Apps and Users into Your Team](https://developer.apple.com/documentation/sign_in_with_apple/bringing_new_apps_and_users_into_your_team).
+   */
+  transfer_sub: string
+  at_hash: string
+  auth_time: number
+}
+
+export default function Apple<P extends Record<string, any> = AppleProfile>(
+  options: Omit<OAuthUserConfig<P>, "clientSecret"> & {
+    /**
+     * Apple requires the client secret to be a JWT. You can generate one using the following script:
+     * https://bal.so/apple-gen-secret
+     * 
+     * Read more: [Creating the Client Secret
+](https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens#3262048)
+     */
+    clientSecret: string
+  }
+): OAuthConfig<P> {
+  return {
+    id: "apple",
+    name: "Apple",
+    type: "oauth",
+    wellKnown: "https://appleid.apple.com/.well-known/openid-configuration",
+    authorization: {
+      params: { scope: "name email", response_mode: "form_post" },
+    },
+    idToken: true,
+    profile(profile) {
+      return {
+        id: profile.sub,
+        name: profile.name,
+        email: profile.email,
+        image: null,
+      }
+    },
+    checks: ["pkce"],
+    options,
+  }
+}

src/providers/atlassian.ts

@@ -1,10 +1,21 @@
-export default function Atlassian(options) {
+import type { OAuthConfig, OAuthUserConfig } from "."
+
+interface AtlassianProfile {
+  account_id: string
+  name: string
+  email: string
+  picture: string
+}
+
+export default function Atlassian<P extends AtlassianProfile>(
+  options: OAuthUserConfig<P>
+): OAuthConfig<P> {
   return {
     id: "atlassian",
     name: "Atlassian",
     type: "oauth",
     authorization: {
-      url: "https://auth.atlassian.com/oauth/authorize",
+      url: "https://auth.atlassian.com/authorize",
       params: {
         audience: "api.atlassian.com",
         prompt: "consent",

src/providers/auth0.ts

@@ -1,5 +1,15 @@
-/** @type {import("types/providers").OAuthProvider} */
-export default function Auth0(options) {
+import type { OAuthConfig, OAuthUserConfig } from "."
+
+export interface Auth0Profile {
+  sub: string
+  nickname: string
+  email: string
+  picture: string
+}
+
+export default function Auth0<P extends Record<string, any> = Auth0Profile>(
+  options: OAuthUserConfig<P>
+): OAuthConfig<P> {
   return {
     id: "auth0",
     name: "Auth0",

src/providers/authentik.ts

@@ -0,0 +1,44 @@
+import type { OAuthConfig, OAuthUserConfig } from "."
+
+export interface AuthentikProfile {
+  iss: string,
+  sub: string,
+  aud: string,
+  exp: number,
+  iat: number,
+  auth_time: number,
+  acr: string,
+  c_hash: string,
+  nonce: string,
+  at_hash: string,
+  email: string,
+  email_verified: boolean,
+  name: string,
+  given_name: string,
+  family_name: string,
+  preferred_username: string,
+  nickname: string,
+  groups: string[]
+}
+
+export default function Authentik<
+  P extends Record<string, any> = AuthentikProfile
+>(options: OAuthUserConfig<P>): OAuthConfig<P> {
+  return {
+    id: "authentik",
+    name: "Authentik",
+    wellKnown: `${options.issuer}/.well-known/openid-configuration`,
+    type: "oauth",
+    authorization: { params: { scope: "openid email profile" } },
+    checks: ["pkce", "state"],
+    profile(profile) {
+      return {
+        id: profile.sub,
+        name: profile.name ?? profile.preferred_username,
+        email: profile.email,
+        image: profile.picture,
+      }
+    },
+    options,
+  }
+}

src/providers/azure-ad-b2c.js

@@ -1,43 +0,0 @@
-export default function AzureADB2C(options) {
-  const { tenantName, primaryUserFlow } = options
-
-  return {
-    id: "azure-ad-b2c",
-    name: "Azure Active Directory B2C",
-    type: "oauth",
-    authorization: {
-      url: `https://${tenantName}.b2clogin.com/${tenantName}.onmicrosoft.com/${primaryUserFlow}/oauth2/v2.0/authorize`,
-      params: {
-        response_type: "code id_token",
-        response_mode: "query",
-      },
-    },
-    token: {
-      url: `https://${tenantName}.b2clogin.com/${tenantName}.onmicrosoft.com/${primaryUserFlow}/oauth2/v2.0/token`,
-      idToken: true,
-    },
-    jwks_uri: `https://${tenantName}.b2clogin.com/${tenantName}.onmicrosoft.com/${primaryUserFlow}}/discovery/v2.0/keys`,
-    profile(profile) {
-      let name = ""
-
-      if (profile.name) {
-        // B2C "Display Name"
-        name = profile.name
-      } else if (profile.given_name && profile.family_name) {
-        // B2C "Given Name" & "Surname"
-        name = `${profile.given_name} ${profile.family_name}`
-      } else if (profile.given_name) {
-        // B2C "Given Name"
-        name = `${profile.given_name}`
-      }
-
-      return {
-        id: profile.oid,
-        name,
-        email: profile.emails[0],
-        image: null,
-      }
-    },
-    options,
-  }
-}

src/providers/azure-ad-b2c.ts

@@ -0,0 +1,46 @@
+import type { OAuthConfig, OAuthUserConfig } from "."
+
+export interface AzureB2CProfile {
+  exp: number
+  nbf: number
+  ver: string
+  iss: string
+  sub: string
+  aud: string
+  iat: number
+  auth_time: number
+  oid: string
+  country: string
+  name: string
+  postalCode: string
+  emails: string[]
+  tfp: string
+}
+
+export default function AzureADB2C<
+  P extends Record<string, any> = AzureB2CProfile
+>(
+  options: OAuthUserConfig<P> & {
+    primaryUserFlow: string
+    tenantId: string
+  }
+): OAuthConfig<P> {
+  const { tenantId, primaryUserFlow } = options
+  return {
+    id: "azure-ad-b2c",
+    name: "Azure Active Directory B2C",
+    type: "oauth",
+    wellKnown: `https://${tenantId}.b2clogin.com/${tenantId}.onmicrosoft.com/${primaryUserFlow}/v2.0/.well-known/openid-configuration`,
+    idToken: true,
+    profile(profile) {
+      return {
+        id: profile.sub,
+        name: profile.name,
+        email: profile.emails[0],
+        // TODO: Find out how to retrieve the profile picture
+        image: null,
+      }
+    },
+    options,
+  }
+}

src/providers/azure-ad.js

@@ -1,21 +0,0 @@
-export default function AzureAD(options) {
-  const tenant = options.tenantId ?? "common"
-
-  return {
-    id: "azure-ad",
-    name: "Azure Active Directory",
-    type: "oauth",
-    authorization: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize?response_mode=query`,
-    token: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
-    userinfo: "https://graph.microsoft.com/v1.0/me/",
-    profile(profile) {
-      return {
-        id: profile.id,
-        name: profile.displayName,
-        email: profile.userPrincipalName,
-        image: null,
-      }
-    },
-    options,
-  }
-}

src/providers/azure-ad.ts

@@ -0,0 +1,65 @@
+import type { OAuthConfig, OAuthUserConfig } from "."
+
+export interface AzureADProfile {
+  sub: string
+  nicname: string
+  email: string
+  picture: string
+}
+
+export default function AzureAD<P extends Record<string, any> = AzureADProfile>(
+  options: OAuthUserConfig<P> & {
+    /**
+     * https://docs.microsoft.com/en-us/graph/api/profilephoto-get?view=graph-rest-1.0#examples
+     * @default 48
+     */
+    profilePhotoSize?: 48 | 64 | 96 | 120 | 240 | 360 | 432 | 504 | 648
+    /** @default "common" */
+    tenantId?: string
+  }
+): OAuthConfig<P> {
+  const tenant = options.tenantId ?? "common"
+  const profilePhotoSize = options.profilePhotoSize ?? 48
+
+  return {
+    id: "azure-ad",
+    name: "Azure Active Directory",
+    type: "oauth",
+    wellKnown: `https://login.microsoftonline.com/${tenant}/v2.0/.well-known/openid-configuration`,
+    authorization: {
+      params: {
+        scope: "openid profile email",
+      },
+    },
+    async profile(profile, tokens) {
+      // https://docs.microsoft.com/en-us/graph/api/profilephoto-get?view=graph-rest-1.0#examples
+      const profilePicture = await fetch(
+        `https://graph.microsoft.com/v1.0/me/photos/${profilePhotoSize}x${profilePhotoSize}/$value`,
+        {
+          headers: {
+            Authorization: `Bearer ${tokens.access_token}`,
+          },
+        }
+      )
+
+      // Confirm that profile photo was returned
+      if (profilePicture.ok) {
+        const pictureBuffer = await profilePicture.arrayBuffer()
+        const pictureBase64 = Buffer.from(pictureBuffer).toString("base64")
+        return {
+          id: profile.sub,
+          name: profile.name,
+          email: profile.email,
+          image: `data:image/jpeg;base64, ${pictureBase64}`,
+        }
+      } else {
+        return {
+          id: profile.sub,
+          name: profile.name,
+          email: profile.email,
+        }
+      }
+    },
+    options,
+  }
+}