From 9886bd4622dd01ce21710e09c98ae68309c4578e Mon Sep 17 00:00:00 2001 From: Thang Vu Date: Sun, 22 Jun 2025 19:13:01 +0700 Subject: [PATCH 01/30] chore(release): bump version [skip ci] --- packages/next-auth/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/next-auth/package.json b/packages/next-auth/package.json index 072e04ce3b..b1b492d960 100644 --- a/packages/next-auth/package.json +++ b/packages/next-auth/package.json @@ -1,6 +1,6 @@ { "name": "next-auth", - "version": "5.0.0-beta.28", + "version": "5.0.0-beta.29", "description": "Authentication for Next.js", "homepage": "https://nextjs.authjs.dev", "repository": "https://github.com/nextauthjs/next-auth.git", From 328185463ae463879a31db2d8234c4707be5b362 Mon Sep 17 00:00:00 2001 From: Alex Patterson <139158618+alex-fusionauth@users.noreply.github.com> Date: Mon, 30 Jun 2025 07:05:50 -0400 Subject: [PATCH 02/30] adjust default fusionauth provider details (#10868) --------- Co-authored-by: Alex Patterson Co-authored-by: Falco Winkler <8613031+falcowinkler@users.noreply.github.com> --- packages/core/src/providers/fusionauth.ts | 210 +++++++++++++++++++++- 1 file changed, 205 insertions(+), 5 deletions(-) diff --git a/packages/core/src/providers/fusionauth.ts b/packages/core/src/providers/fusionauth.ts index 5bb3d31bd6..52f2eb4404 100644 --- a/packages/core/src/providers/fusionauth.ts +++ b/packages/core/src/providers/fusionauth.ts @@ -24,11 +24,16 @@ export interface FusionAuthProfile extends Record { authenticationType: string email: string email_verified: boolean - preferred_username: string + preferred_username?: string + name?: string + given_name?: string + middle_name?: string + family_name?: string at_hash: string c_hash: string scope: string sid: string + picture?: string } /** @@ -64,7 +69,7 @@ export interface FusionAuthProfile extends Record { * * ### Resources * - * - [FusionAuth OAuth documentation](https://fusionauth.io/docs/v1/tech/oauth/) + * - [FusionAuth OAuth documentation](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/) * * ### Notes * @@ -104,6 +109,170 @@ export interface FusionAuthProfile extends Record { * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions). * * ::: + * + * + * It is highly recommended to follow this example call when using the provider in Next.js + * so that you can access both the access_token and id_token on the server. + * + * /// +import NextAuth from 'next-auth'; +export const { handlers, auth, signIn, signOut } = NextAuth({ + providers: [ + { + id: 'fusionauth', + name: 'FusionAuth', + type: 'oidc', + issuer: process.env.AUTH_FUSIONAUTH_ISSUER!, + clientId: process.env.AUTH_FUSIONAUTH_CLIENT_ID!, + clientSecret: process.env.AUTH_FUSIONAUTH_CLIENT_SECRET!, + authorization: { + params: { + scope: 'offline_access email openid profile', + tenantId: process.env.AUTH_FUSIONAUTH_TENANT_ID!, + }, + }, + userinfo: `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/userinfo`, + // This is due to a known processing issue + // TODO: https://github.com/nextauthjs/next-auth/issues/8745#issuecomment-1907799026 + token: { + url: `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/token`, + conform: async (response: Response) => { + if (response.status === 401) return response; + + const newHeaders = Array.from(response.headers.entries()) + .filter(([key]) => key.toLowerCase() !== 'www-authenticate') + .reduce( + (headers, [key, value]) => (headers.append(key, value), headers), + new Headers() + ); + + return new Response(response.body, { + status: response.status, + statusText: response.statusText, + headers: newHeaders, + }); + }, + }, + }, + ], + session: { + strategy: 'jwt', + }, + // Required to get the account object in the session and enable + // the ability to call API's externally that rely on JWT tokens. + callbacks: { + async jwt(params) { + const { token, user, account } = params; + if (account) { + // First-time login, save the `access_token`, its expiry and the `refresh_token` + return { + ...token, + ...account, + }; + } else if ( + token.expires_at && + Date.now() < (token.expires_at as number) * 1000 + ) { + // Subsequent logins, but the `access_token` is still valid + return token; + } else { + // Subsequent logins, but the `access_token` has expired, try to refresh it + if (!token.refresh_token) throw new TypeError('Missing refresh_token'); + + try { + const refreshResponse = await fetch( + `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/token`, + { + method: 'POST', + headers: { + 'Content-Type': 'application/x-www-form-urlencoded', + }, + body: new URLSearchParams({ + client_id: process.env.AUTH_FUSIONAUTH_CLIENT_ID!, + client_secret: process.env.AUTH_FUSIONAUTH_CLIENT_SECRET!, + grant_type: 'refresh_token', + refresh_token: token.refresh_token as string, + }), + } + ); + + if (!refreshResponse.ok) { + throw new Error('Failed to refresh token'); + } + + const tokensOrError = await refreshResponse.json(); + + if (!refreshResponse.ok) throw tokensOrError; + + const newTokens = tokensOrError as { + access_token: string; + expires_in: number; + refresh_token?: string; + }; + + return { + ...token, + access_token: newTokens.access_token, + expires_at: Math.floor(Date.now() / 1000 + newTokens.expires_in), + // Some providers only issue refresh tokens once, so preserve if we did not get a new one + refresh_token: newTokens.refresh_token + ? newTokens.refresh_token + : token.refresh_token, + }; + } catch (error) { + console.error('Error refreshing access_token', error); + // If we fail to refresh the token, return an error so we can handle it on the page + token.error = 'RefreshTokenError'; + return token; + } + } + }, + async session(params) { + const { session, token } = params; + return { ...session, ...token }; + }, + }, +}); + +declare module 'next-auth' { + interface Session { + access_token: string; + expires_in: number; + id_token?: string; + expires_at: number; + refresh_token?: string; + refresh_token_id?: string; + error?: 'RefreshTokenError'; + scope: string; + token_type: string; + userId: string; + provider: string; + type: string; + providerAccountId: string; + } +} + +declare module 'next-auth' { + interface JWT { + access_token: string; + expires_in: number; + id_token?: string; + expires_at: number; + refresh_token?: string; + refresh_token_id?: string; + error?: 'RefreshTokenError'; + scope: string; + token_type: string; + userId: string; + provider: string; + type: string; + providerAccountId: string; + } +} + + * + * + * */ export default function FusionAuth

( // tenantId only needed if there is more than one tenant configured on the server @@ -112,22 +281,53 @@ export default function FusionAuth

( return { id: "fusionauth", name: "FusionAuth", - type: "oauth", + type: "oidc", + issuer: options.issuer, + clientId: options.clientId, + clientSecret: options.clientSecret, wellKnown: options?.tenantId ? `${options.issuer}/.well-known/openid-configuration?tenantId=${options.tenantId}` : `${options.issuer}/.well-known/openid-configuration`, authorization: { params: { - scope: "openid offline_access", + scope: "openid offline_access email profile", ...(options?.tenantId && { tenantId: options.tenantId }), }, }, + userinfo: `${options.issuer}/oauth2/userinfo`, + // This is due to a known processing issue + // TODO: https://github.com/nextauthjs/next-auth/issues/8745#issuecomment-1907799026 + token: { + url: `${options.issuer}/oauth2/token`, + conform: async (response: Response) => { + if (response.status === 401) return response + + const newHeaders = Array.from(response.headers.entries()) + .filter(([key]) => key.toLowerCase() !== "www-authenticate") + .reduce( + (headers, [key, value]) => (headers.append(key, value), headers), + new Headers() + ) + + return new Response(response.body, { + status: response.status, + statusText: response.statusText, + headers: newHeaders, + }) + }, + }, checks: ["pkce", "state"], profile(profile) { return { id: profile.sub, email: profile.email, - name: profile?.preferred_username, + name: + profile.name ?? + profile.preferred_username ?? + [profile.given_name, profile.middle_name, profile.family_name] + .filter((x) => x) + .join(" "), + image: profile.picture, } }, options, From 3b1b1b9af06dac9a8414c5d8f42daccf97ec16c4 Mon Sep 17 00:00:00 2001 From: "Nicole W." <76132106+nicolecomputer@users.noreply.github.com> Date: Wed, 2 Jul 2025 08:06:10 -0600 Subject: [PATCH 03/30] chore(docs): svelte 5 compatibility updates (#12634) * Update drizzle.mdx Fixup previous reference to next-auth * Update get-session.mdx Update code for svelte 5 --- docs/pages/getting-started/adapters/drizzle.mdx | 2 +- .../getting-started/session-management/get-session.mdx | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/pages/getting-started/adapters/drizzle.mdx b/docs/pages/getting-started/adapters/drizzle.mdx index 7707eb06a8..4b266a7480 100644 --- a/docs/pages/getting-started/adapters/drizzle.mdx +++ b/docs/pages/getting-started/adapters/drizzle.mdx @@ -55,7 +55,7 @@ import { } from "drizzle-orm/pg-core" import postgres from "postgres" import { drizzle } from "drizzle-orm/postgres-js" -import type { AdapterAccountType } from "next-auth/adapters" +import type { AdapterAccountType } from "@auth/core/adapters"; const connectionString = "postgres://postgres:postgres@localhost:5432/drizzle" const pool = postgres(connectionString, { max: 1 }) diff --git a/docs/pages/getting-started/session-management/get-session.mdx b/docs/pages/getting-started/session-management/get-session.mdx index 62441074c5..13bc71b2b9 100644 --- a/docs/pages/getting-started/session-management/get-session.mdx +++ b/docs/pages/getting-started/session-management/get-session.mdx @@ -153,8 +153,8 @@ With SvelteKit, you have to return the `session` object from the load function i ```ts filename="src/routes/+page.server.ts" {11} import type { PageServerLoad } from "./$types" -export const load: PageServerLoad = async (events) => { - const session = await events.locals.auth() +export const load: PageServerLoad = async ({ params, locals }) => { + const session = await locals.auth() if (!session?.user?.userId) { redirect(303, `/login`) @@ -170,12 +170,12 @@ Then you can access the `session` on the `$page.data` object in your page. ```svelte filename="src/routes/+page.svelte" {7}

From be4f0216a2d1c129c2b4fcf31d1b7a22b73f0d47 Mon Sep 17 00:00:00 2001 From: Thang Vu Date: Wed, 2 Jul 2025 22:33:05 +0700 Subject: [PATCH 04/30] docs: formatting --- docs/pages/getting-started/adapters/drizzle.mdx | 2 +- docs/pages/getting-started/session-management/get-session.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/pages/getting-started/adapters/drizzle.mdx b/docs/pages/getting-started/adapters/drizzle.mdx index 4b266a7480..8a84b1fc02 100644 --- a/docs/pages/getting-started/adapters/drizzle.mdx +++ b/docs/pages/getting-started/adapters/drizzle.mdx @@ -55,7 +55,7 @@ import { } from "drizzle-orm/pg-core" import postgres from "postgres" import { drizzle } from "drizzle-orm/postgres-js" -import type { AdapterAccountType } from "@auth/core/adapters"; +import type { AdapterAccountType } from "@auth/core/adapters" const connectionString = "postgres://postgres:postgres@localhost:5432/drizzle" const pool = postgres(connectionString, { max: 1 }) diff --git a/docs/pages/getting-started/session-management/get-session.mdx b/docs/pages/getting-started/session-management/get-session.mdx index 13bc71b2b9..0d7e469ae7 100644 --- a/docs/pages/getting-started/session-management/get-session.mdx +++ b/docs/pages/getting-started/session-management/get-session.mdx @@ -170,7 +170,7 @@ Then you can access the `session` on the `$page.data` object in your page. ```svelte filename="src/routes/+page.svelte" {7}