⏪ Revert unwanted auth changes (#1551)

apps/web/declarations/next-auth.d.ts

@@ -20,7 +20,6 @@ declare module "next-auth" {
   }
 
   interface User extends DefaultUser {
-    id: string;
     locale?: string | null;
     timeZone?: string | null;
     timeFormat?: TimeFormat | null;

apps/web/i18next-scanner.config.js

@@ -1,7 +1,7 @@
 const typescriptTransform = require("i18next-scanner-typescript");
 
 module.exports = {
-  input: ["src/**/*.{ts,tsx}", "!src/next-auth*.ts"],
+  input: ["src/**/*.{ts,tsx}", "!src/auth.ts"],
   options: {
     nsSeparator: false,
     defaultNs: "app",

apps/web/package.json

@@ -18,7 +18,7 @@
     "docker:start": "./scripts/docker-start.sh"
   },
   "dependencies": {
-    "@auth/prisma-adapter": "^2.7.4",
+    "@auth/prisma-adapter": "^1.0.3",
     "@aws-sdk/client-s3": "^3.645.0",
     "@aws-sdk/s3-request-presigner": "^3.645.0",
     "@hookform/resolvers": "^3.3.1",
@@ -67,7 +67,7 @@
     "lucide-react": "^0.387.0",
     "micro": "^10.0.1",
     "nanoid": "^5.0.9",
-    "next-auth": "^5.0.0-beta.25",
+    "next-auth": "^4.24.5",
     "next-i18next": "^13.0.3",
     "php-serialize": "^4.1.1",
     "postcss": "^8.4.31",

apps/web/public/locales/en/app.json

@@ -32,6 +32,7 @@
   "emailNotAllowed": "This email is not allowed.",
   "emailPlaceholder": "jessie.smith@example.com",
   "exportToCsv": "Export to CSV",
+  "forgetMe": "Forget me",
   "guest": "Guest",
   "ifNeedBe": "If need be",
   "location": "Location",
@@ -198,6 +199,9 @@
   "pollStatusFinalized": "Finalized",
   "share": "Share",
   "noParticipants": "No participants",
+  "userId": "User ID",
+  "aboutGuest": "Guest User",
+  "aboutGuestDescription": "Profile settings are not available for guest users. <0>Sign in</0> to your existing account or <1>create a new account</1> to customize your profile.",
   "logoutDescription": "Sign out of your existing session",
   "events": "Events",
   "inviteParticipantsDescription": "Copy and share the invite link to start gathering responses from your participants.",
@@ -301,6 +305,5 @@
   "registerVerifyDescription": "Check your email for the verification code",
   "loginVerifyTitle": "Finish Logging In",
   "loginVerifyDescription": "Check your email for the verification code",
-  "createAccount": "Create Account",
+  "createAccount": "Create Account"
-  "loginMagicLinkError": "This link is invalid or expired. Please request a new link."
 }

apps/web/src/app/[locale]/(admin)/settings/profile/delete-account-dialog.tsx

@@ -38,7 +38,7 @@ export function DeleteAccountDialog({
     onSuccess() {
       posthog?.capture("delete account");
       signOut({
-        redirectTo: "/login",
+        callbackUrl: "/login",
       });
     },
   });

apps/web/src/app/[locale]/(auth)/auth/login/components/login-page.tsx

@@ -4,12 +4,10 @@ import { Button } from "@rallly/ui/button";
 import { useMutation } from "@tanstack/react-query";
 import { useRouter } from "next/navigation";
 import { useSession } from "next-auth/react";
-import React from "react";
 
 import { OptimizedAvatarImage } from "@/components/optimized-avatar-image";
 import { Skeleton } from "@/components/skeleton";
 import { Trans } from "@/components/trans";
-import { useTranslation } from "@/i18n/client";
 import { trpc } from "@/trpc/client";
 
 type PageProps = { magicLink: string; email: string };
@@ -17,9 +15,6 @@ type PageProps = { magicLink: string; email: string };
 export const LoginPage = ({ magicLink, email }: PageProps) => {
   const session = useSession();
   const posthog = usePostHog();
-  const { t } = useTranslation();
-  const [error, setError] = React.useState<string | null>(null);
-
   const magicLinkFetch = useMutation({
     mutationFn: async () => {
       const res = await fetch(magicLink);
@@ -36,15 +31,9 @@ export const LoginPage = ({ magicLink, email }: PageProps) => {
             name: updatedSession.user.name,
           });
         }
-        router.push(data.url);
-      } else {
-        setError(
-          t("loginMagicLinkError", {
-            defaultValue:
-              "This link is invalid or expired. Please request a new link.",
-          }),
-        );
       }
+
+      router.push(data.url);
     },
   });
   const { data } = trpc.user.getByEmail.useQuery({ email });
@@ -83,7 +72,6 @@ export const LoginPage = ({ magicLink, email }: PageProps) => {
             <Trans i18nKey="login" defaults="Login" />
           </Button>
         </div>
-        {error && <p className="text-destructive text-sm">{error}</p>}
       </div>
     </div>
   );

apps/web/src/app/[locale]/(auth)/login/actions.ts

@@ -4,24 +4,18 @@ import { prisma } from "@rallly/database";
 import { cookies } from "next/headers";
 
 export async function setVerificationEmail(email: string) {
-  const user = await prisma.user.findUnique({
+  const count = await prisma.user.count({
     where: {
       email,
     },
-    select: {
-      email: true,
-    },
   });
 
-  if (user) {
+  cookies().set("verification-email", email, {
-    cookies().set("verification-email", user.email, {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",
     sameSite: "lax",
     maxAge: 15 * 60,
   });
-    return true;
-  }
 
-  return false;
+  return count > 0;
 }

apps/web/src/app/[locale]/(auth)/login/components/login-email-form.tsx

@@ -53,13 +53,13 @@ export function LoginWithEmailForm() {
           if (doesExist) {
             await signIn("email", {
               email: identifier,
-              redirectTo: searchParams?.get("redirectTo") ?? undefined,
+              callbackUrl: searchParams?.get("callbackUrl") ?? undefined,
               redirect: false,
             });
-            // redirect to verify page with redirectTo
+            // redirect to verify page with callbackUrl
             router.push(
-              `/login/verify?redirectTo=${encodeURIComponent(
+              `/login/verify?callbackUrl=${encodeURIComponent(
-                searchParams?.get("redirectTo") ?? "",
+                searchParams?.get("callbackUrl") ?? "",
               )}`,
             );
           } else {

apps/web/src/app/[locale]/(auth)/login/components/login-with-oidc.tsx

@@ -6,16 +6,16 @@ import { Trans } from "@/components/trans";
 
 export async function LoginWithOIDC({
   name,
-  redirectTo,
+  callbackUrl,
 }: {
   name: string;
-  redirectTo?: string;
+  callbackUrl?: string;
 }) {
   return (
     <Button
       onClick={() => {
         signIn("oidc", {
-          redirectTo: redirectTo,
+          callbackUrl,
         });
       }}
       variant="link"

apps/web/src/app/[locale]/(auth)/login/components/sso-provider.tsx

@@ -15,7 +15,7 @@ function SSOImage({ provider }: { provider: string }) {
     );
   }
 
-  if (provider === "microsoft-entra-id") {
+  if (provider === "azure-ad") {
     return (
       <Image
         src="/static/microsoft.svg"
@@ -40,11 +40,11 @@ function SSOImage({ provider }: { provider: string }) {
 export function SSOProvider({
   providerId,
   name,
-  redirectTo,
+  callbackUrl,
 }: {
   providerId: string;
   name: string;
-  redirectTo?: string;
+  callbackUrl?: string;
 }) {
   const { t } = useTranslation();
   return (
@@ -58,7 +58,7 @@ export function SSOProvider({
       key={providerId}
       onClick={() => {
         signIn(providerId, {
-          redirectTo: redirectTo,
+          callbackUrl,
         });
       }}
     >

apps/web/src/app/[locale]/(auth)/login/page.tsx

@@ -1,9 +1,7 @@
 import Link from "next/link";
 import { Trans } from "react-i18next/TransWithoutContext";
 
-import { GoogleProvider } from "@/auth/providers/google";
+import { getOAuthProviders } from "@/auth";
-import { MicrosoftProvider } from "@/auth/providers/microsoft";
-import { OIDCProvider } from "@/auth/providers/oidc";
 import { getTranslation } from "@/i18n/server";
 
 import {
@@ -24,14 +22,20 @@ export default async function LoginPage({
   searchParams,
 }: {
   searchParams?: {
-    redirectTo?: string;
+    callbackUrl?: string;
   };
 }) {
   const { t } = await getTranslation();
+  const oAuthProviders = getOAuthProviders();
 
-  const oidcProvider = OIDCProvider();
+  const hasAlternateLoginMethods = oAuthProviders.length > 0;
-  const socialProviders = [GoogleProvider(), MicrosoftProvider()];
+
-  const hasAlternateLoginMethods = socialProviders.length > 0 || !!oidcProvider;
+  const oidcProvider = oAuthProviders.find(
+    (provider) => provider.id === "oidc",
+  );
+  const socialProviders = oAuthProviders.filter(
+    (provider) => provider.id !== "oidc",
+  );
 
   return (
     <AuthPageContainer>
@@ -54,21 +58,19 @@ export default async function LoginPage({
         {oidcProvider ? (
           <LoginWithOIDC
             name={oidcProvider.name}
-            redirectTo={searchParams?.redirectTo}
+            callbackUrl={searchParams?.callbackUrl}
           />
         ) : null}
         {socialProviders ? (
           <div className="grid gap-4">
-            {socialProviders.map((provider) =>
+            {socialProviders.map((provider) => (
-              provider ? (
               <SSOProvider
                 key={provider.id}
                 providerId={provider.id}
-                  name={provider.options?.name || provider.name}
+                name={provider.name}
-                  redirectTo={searchParams?.redirectTo}
+                callbackUrl={searchParams?.callbackUrl}
               />
-              ) : null,
+            ))}
-            )}
           </div>
         ) : null}
       </AuthPageContent>

apps/web/src/app/[locale]/(auth)/login/verify/components/otp-form.tsx

@@ -50,7 +50,7 @@ export function OTPForm({ email }: { email: string }) {
         message: t("wrongVerificationCode"),
       });
     } else {
-      window.location.href = searchParams?.get("redirectTo") ?? "/";
+      window.location.href = searchParams?.get("callbackUrl") ?? "/";
     }
   });
 

apps/web/src/app/[locale]/(auth)/register/verify/components/otp-form.tsx

@@ -68,7 +68,7 @@ export function OTPForm({ token }: { token: string }) {
 
     signIn("registration-token", {
       token,
-      redirectTo: searchParams?.get("redirectTo") ?? "/",
+      callbackUrl: searchParams?.get("callbackUrl") ?? "/",
     });
   });
 

apps/web/src/app/[locale]/layout.tsx

@@ -8,8 +8,8 @@ import React from "react";
 
 import { TimeZoneChangeDetector } from "@/app/[locale]/timezone-change-detector";
 import { Providers } from "@/app/providers";
+import { getServerSession } from "@/auth";
 import { SessionProvider } from "@/auth/session-provider";
-import { auth } from "@/next-auth";
 
 const inter = Inter({
   subsets: ["latin"],
@@ -30,7 +30,7 @@ export default async function Root({
   children: React.ReactNode;
   params: { locale: string };
 }) {
-  const session = await auth();
+  const session = await getServerSession();
 
   return (
     <html lang={locale} className={inter.className}>

apps/web/src/app/api/auth/[...nextauth]/route.ts

@@ -1,6 +0,0 @@
-import { withPosthog } from "@rallly/posthog/server";
-
-import { handlers } from "@/next-auth";
-
-export const GET = withPosthog(handlers.GET);
-export const POST = withPosthog(handlers.POST);

apps/web/src/app/api/notifications/unsubscribe/route.ts

@@ -3,7 +3,7 @@ import { cookies } from "next/headers";
 import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
 
-import { auth } from "@/next-auth";
+import { getServerSession } from "@/auth";
 import type { DisableNotificationsPayload } from "@/trpc/types";
 import { decryptToken } from "@/utils/session";
 
@@ -14,7 +14,7 @@ export const GET = async (req: NextRequest) => {
     return NextResponse.redirect(new URL("/login", req.url));
   }
 
-  const session = await auth();
+  const session = await getServerSession();
 
   if (!session || !session.user?.email) {
     return NextResponse.redirect(new URL("/login", req.url));

apps/web/src/app/api/stripe/checkout/route.ts

@@ -5,7 +5,7 @@ import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 
-import { auth } from "@/next-auth";
+import { getServerSession } from "@/auth";
 
 const inputSchema = z.object({
   period: z.enum(["monthly", "yearly"]).optional(),
@@ -14,7 +14,7 @@ const inputSchema = z.object({
 });
 
 export async function POST(request: NextRequest) {
-  const userSession = await auth();
+  const userSession = await getServerSession();
   const formData = await request.formData();
   const { period = "monthly", return_path } = inputSchema.parse(
     Object.fromEntries(formData.entries()),

apps/web/src/app/api/stripe/portal/route.ts

@@ -5,7 +5,7 @@ import * as Sentry from "@sentry/nextjs";
 import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
 
-import { auth } from "@/next-auth";
+import { getServerSession } from "@/auth";
 
 export async function GET(request: NextRequest) {
   const sessionId = request.nextUrl.searchParams.get("session_id");
@@ -32,7 +32,7 @@ export async function GET(request: NextRequest) {
       );
     }
   } else {
-    const userSession = await auth();
+    const userSession = await getServerSession();
     if (!userSession?.user || userSession.user.email === null) {
       Sentry.captureException(new Error("User not logged in"));
       return NextResponse.json(

apps/web/src/app/api/trpc/[trpc]/route.ts

@@ -4,7 +4,7 @@ import { ipAddress } from "@vercel/functions";
 import type { NextRequest } from "next/server";
 
 import { getLocaleFromHeader } from "@/app/guest";
-import { auth } from "@/next-auth";
+import { getServerSession } from "@/auth";
 import type { TRPCContext } from "@/trpc/context";
 import { appRouter } from "@/trpc/routers";
 import { getEmailClient } from "@/utils/emails";
@@ -15,7 +15,7 @@ const handler = (req: NextRequest) => {
     req,
     router: appRouter,
     createContext: async () => {
-      const session = await auth();
+      const session = await getServerSession();
       const locale = await getLocaleFromHeader(req);
       const user = session?.user
         ? {

apps/web/src/app/api/user/verify-email-change/route.ts

@@ -3,7 +3,7 @@ import { cookies } from "next/headers";
 import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
 
-import { auth } from "@/next-auth";
+import { getServerSession } from "@/auth";
 import { decryptToken } from "@/utils/session";
 
 type EmailChangePayload = {
@@ -50,11 +50,11 @@ export const GET = async (request: NextRequest) => {
     return NextResponse.json({ error: "No token provided" }, { status: 400 });
   }
 
-  const session = await auth();
+  const session = await getServerSession();
 
   if (!session?.user || !session.user.email) {
     return NextResponse.redirect(
-      new URL(`/login?redirectTo=${request.url}`, request.url),
+      new URL(`/login?callbackUrl=${request.url}`, request.url),
     );
   }
 

apps/web/src/auth.ts

@@ -0,0 +1,371 @@
+import { prisma } from "@rallly/database";
+import { posthog } from "@rallly/posthog/server";
+import { absoluteUrl } from "@rallly/utils/absolute-url";
+import { generateOtp, randomid } from "@rallly/utils/nanoid";
+import type {
+  GetServerSidePropsContext,
+  NextApiRequest,
+  NextApiResponse,
+} from "next";
+import type { NextAuthOptions, User } from "next-auth";
+import NextAuth, {
+  getServerSession as getServerSessionWithOptions,
+} from "next-auth/next";
+import AzureADProvider from "next-auth/providers/azure-ad";
+import CredentialsProvider from "next-auth/providers/credentials";
+import EmailProvider from "next-auth/providers/email";
+import GoogleProvider from "next-auth/providers/google";
+import type { Provider } from "next-auth/providers/index";
+
+import { env } from "@/env";
+import type { RegistrationTokenPayload } from "@/trpc/types";
+import { getEmailClient } from "@/utils/emails";
+import { getValueByPath } from "@/utils/get-value-by-path";
+import { decryptToken } from "@/utils/session";
+
+import { CustomPrismaAdapter } from "./auth/custom-prisma-adapter";
+import { mergeGuestsIntoUser } from "./auth/merge-user";
+
+const providers: Provider[] = [
+  // When a user registers, we don't want to go through the email verification process
+  // so this provider allows us exchange the registration token for a session token
+  CredentialsProvider({
+    id: "registration-token",
+    name: "Registration Token",
+    credentials: {
+      token: {
+        label: "Token",
+        type: "text",
+      },
+    },
+    async authorize(credentials) {
+      if (credentials?.token) {
+        const payload = await decryptToken<RegistrationTokenPayload>(
+          credentials.token,
+        );
+        if (payload) {
+          const user = await prisma.user.findUnique({
+            where: {
+              email: payload.email,
+            },
+            select: {
+              id: true,
+              email: true,
+              name: true,
+              locale: true,
+              timeFormat: true,
+              timeZone: true,
+              image: true,
+            },
+          });
+
+          if (user) {
+            return user;
+          }
+        }
+      }
+
+      return null;
+    },
+  }),
+  CredentialsProvider({
+    id: "guest",
+    name: "Guest",
+    credentials: {},
+    async authorize() {
+      return {
+        id: `user-${randomid()}`,
+        email: null,
+      };
+    },
+  }),
+  EmailProvider({
+    server: "",
+    from: process.env.NOREPLY_EMAIL,
+    generateVerificationToken() {
+      return generateOtp();
+    },
+    async sendVerificationRequest({ identifier: email, token, url }) {
+      const user = await prisma.user.findUnique({
+        where: {
+          email,
+        },
+        select: {
+          name: true,
+          locale: true,
+        },
+      });
+
+      if (user) {
+        await getEmailClient(user.locale ?? undefined).sendTemplate(
+          "LoginEmail",
+          {
+            to: email,
+            props: {
+              magicLink: absoluteUrl("/auth/login", {
+                magicLink: url,
+              }),
+              code: token,
+            },
+          },
+        );
+      }
+    },
+  }),
+];
+
+// If we have an OAuth provider configured, we add it to the list of providers
+if (
+  process.env.OIDC_DISCOVERY_URL &&
+  process.env.OIDC_CLIENT_ID &&
+  process.env.OIDC_CLIENT_SECRET
+) {
+  providers.push({
+    id: "oidc",
+    name: process.env.OIDC_NAME ?? "OpenID Connect",
+    type: "oauth",
+    wellKnown: process.env.OIDC_DISCOVERY_URL,
+    authorization: { params: { scope: "openid email profile" } },
+    clientId: process.env.OIDC_CLIENT_ID,
+    clientSecret: process.env.OIDC_CLIENT_SECRET,
+    idToken: true,
+    checks: ["state"],
+    allowDangerousEmailAccountLinking: true,
+    profile(profile) {
+      return {
+        id: profile.sub,
+        name: getValueByPath(profile, env.OIDC_NAME_CLAIM_PATH),
+        email: getValueByPath(profile, env.OIDC_EMAIL_CLAIM_PATH),
+        image: getValueByPath(profile, env.OIDC_PICTURE_CLAIM_PATH),
+      } as User;
+    },
+  });
+}
+
+if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
+  providers.push(
+    GoogleProvider({
+      clientId: process.env.GOOGLE_CLIENT_ID,
+      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+      allowDangerousEmailAccountLinking: true,
+    }),
+  );
+}
+
+if (
+  process.env.MICROSOFT_TENANT_ID &&
+  process.env.MICROSOFT_CLIENT_ID &&
+  process.env.MICROSOFT_CLIENT_SECRET
+) {
+  providers.push(
+    AzureADProvider({
+      name: "Microsoft",
+      tenantId: process.env.MICROSOFT_TENANT_ID,
+      clientId: process.env.MICROSOFT_CLIENT_ID,
+      clientSecret: process.env.MICROSOFT_CLIENT_SECRET,
+      wellKnown:
+        "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration",
+    }),
+  );
+}
+
+const getAuthOptions = (...args: GetServerSessionParams) =>
+  ({
+    adapter: CustomPrismaAdapter(prisma, {
+      migrateData: async (userId) => {
+        const session = await getServerSession(...args);
+        if (session?.user && session.user.email === null) {
+          await mergeGuestsIntoUser(userId, [session.user.id]);
+        }
+      },
+    }),
+    secret: process.env.SECRET_PASSWORD,
+    session: {
+      strategy: "jwt",
+    },
+    providers: providers,
+    pages: {
+      signIn: "/login",
+      verifyRequest: "/login/verify",
+      error: "/auth/error",
+    },
+    events: {
+      signIn({ user, account }) {
+        posthog?.capture({
+          distinctId: user.id,
+          event: "login",
+          properties: {
+            method: account?.provider,
+            $set: {
+              name: user.name,
+              email: user.email,
+              timeZone: user.timeZone,
+              locale: user.locale,
+            },
+          },
+        });
+      },
+    },
+    callbacks: {
+      async signIn({ user, email, profile }) {
+        const distinctId = user.id;
+        // prevent sign in if email is not verified
+        if (
+          profile &&
+          "email_verified" in profile &&
+          profile.email_verified === false
+        ) {
+          posthog?.capture({
+            distinctId,
+            event: "login failed",
+            properties: {
+              reason: "email not verified",
+            },
+          });
+          return false;
+        }
+        // Make sure email is allowed
+        if (user.email) {
+          const isBlocked = isEmailBlocked(user.email);
+          if (isBlocked) {
+            return false;
+          }
+        }
+
+        // For now, we don't allow users to login unless they have
+        // registered an account. This is just because we need a name
+        // to display on the dashboard. The flow can be modified so that
+        // the name is requested after the user has logged in.
+        if (email?.verificationRequest) {
+          const isRegisteredUser =
+            (await prisma.user.count({
+              where: {
+                email: user.email as string,
+              },
+            })) > 0;
+
+          return isRegisteredUser;
+        }
+
+        // when we login with a social account for the first time, the user is not created yet
+        // and the user id will be the same as the provider account id
+        // we handle this case the the prisma adapter when we link accounts
+        const isInitialSocialLogin = user.id === profile?.sub;
+
+        if (!isInitialSocialLogin) {
+          // merge guest user into newly logged in user
+          const session = await getServerSession(...args);
+          if (session?.user && !session.user.email) {
+            await mergeGuestsIntoUser(user.id, [session.user.id]);
+          }
+        }
+
+        return true;
+      },
+      async jwt({ token, session }) {
+        if (session) {
+          token.locale = session.locale;
+          token.timeFormat = session.timeFormat;
+          token.timeZone = session.timeZone;
+          token.weekStart = session.weekStart;
+        }
+
+        return token;
+      },
+      async session({ session, token }) {
+        if (!token.sub) {
+          return session;
+        }
+
+        if (token.sub?.startsWith("user-")) {
+          session.user = {
+            id: token.sub as string,
+            locale: token.locale,
+            timeFormat: token.timeFormat,
+            timeZone: token.timeZone,
+            weekStart: token.weekStart,
+          };
+          return session;
+        }
+
+        const user = await prisma.user.findUnique({
+          where: {
+            id: token.sub as string,
+          },
+          select: {
+            id: true,
+            name: true,
+            timeFormat: true,
+            timeZone: true,
+            locale: true,
+            weekStart: true,
+            email: true,
+            image: true,
+          },
+        });
+
+        if (user) {
+          session.user = {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+            image: user.image,
+            locale: user.locale,
+            timeFormat: user.timeFormat,
+            timeZone: user.timeZone,
+            weekStart: user.weekStart,
+          };
+        }
+
+        return session;
+      },
+    },
+  }) satisfies NextAuthOptions;
+
+type GetServerSessionParams =
+  | [GetServerSidePropsContext["req"], GetServerSidePropsContext["res"]]
+  | [NextApiRequest, NextApiResponse]
+  | [];
+
+export async function getServerSession(...args: GetServerSessionParams) {
+  return await getServerSessionWithOptions(...args, getAuthOptions(...args));
+}
+
+export async function AuthApiRoute(req: NextApiRequest, res: NextApiResponse) {
+  const authOptions = getAuthOptions(req, res);
+  return NextAuth(req, res, authOptions);
+}
+
+export const isEmailBlocked = (email: string) => {
+  if (process.env.ALLOWED_EMAILS) {
+    const allowedEmails = process.env.ALLOWED_EMAILS.split(",");
+    // Check whether the email matches enough of the patterns specified in ALLOWED_EMAILS
+    const isAllowed = allowedEmails.some((allowedEmail) => {
+      const regex = new RegExp(
+        `^${allowedEmail
+          .replace(/[.+?^${}()|[\]\\]/g, "\\$&")
+          .replaceAll(/[*]/g, ".*")}$`,
+      );
+      return regex.test(email);
+    });
+
+    if (!isAllowed) {
+      return true;
+    }
+  }
+  return false;
+};
+
+export function getOAuthProviders(): {
+  id: string;
+  name: string;
+}[] {
+  return providers
+    .filter((provider) => provider.type === "oauth")
+    .map((provider) => {
+      return {
+        id: provider.id,
+        name: provider.options?.name || provider.name,
+      };
+    });
+}

apps/web/src/auth/custom-prisma-adapter.ts

@@ -10,18 +10,19 @@
  * See: https://github.com/lukevella/rallly/issues/949
  */
 import { PrismaAdapter } from "@auth/prisma-adapter";
-import { prisma } from "@rallly/database";
+import type { ExtendedPrismaClient, PrismaClient } from "@rallly/database";
-import type { Adapter } from "next-auth/adapters";
+import type { Adapter, AdapterAccount } from "next-auth/adapters";
 
-export function CustomPrismaAdapter(options: {
+export function CustomPrismaAdapter(
-  migrateData: (userId: string) => Promise<void>;
+  client: ExtendedPrismaClient,
-}) {
+  options: { migrateData: (userId: string) => Promise<void> },
-  const adapter = PrismaAdapter(prisma);
+) {
+  const adapter = PrismaAdapter(client as PrismaClient);
   return {
     ...adapter,
-    linkAccount: async (account) => {
+    linkAccount: async (account: AdapterAccount) => {
       await options.migrateData(account.userId);
-      return prisma.account.create({
+      return (await client.account.create({
         data: {
           userId: account.userId,
           type: account.type,
@@ -35,7 +36,7 @@ export function CustomPrismaAdapter(options: {
           scope: account.scope as string,
           session_state: account.session_state as string,
         },
-      });
+      })) as AdapterAccount;
     },
-  } as Adapter;
+  } satisfies Adapter;
 }

apps/web/src/auth/get-optional-providers.ts

@@ -1,11 +0,0 @@
-import type { Provider } from "next-auth/providers/index";
-
-import { GoogleProvider } from "./providers/google";
-import { MicrosoftProvider } from "./providers/microsoft";
-import { OIDCProvider } from "./providers/oidc";
-
-export function getOptionalProviders() {
-  return [OIDCProvider(), GoogleProvider(), MicrosoftProvider()].filter(
-    Boolean,
-  ) as Provider[];
-}

apps/web/src/auth/is-email-blocked.ts

@@ -1,19 +0,0 @@
-export const isEmailBlocked = (email: string) => {
-  if (process.env.ALLOWED_EMAILS) {
-    const allowedEmails = process.env.ALLOWED_EMAILS.split(",");
-    // Check whether the email matches enough of the patterns specified in ALLOWED_EMAILS
-    const isAllowed = allowedEmails.some((allowedEmail) => {
-      const regex = new RegExp(
-        `^${allowedEmail
-          .replace(/[.+?^${}()|[\]\\]/g, "\\$&")
-          .replaceAll(/[*]/g, ".*")}$`,
-      );
-      return regex.test(email);
-    });
-
-    if (!isAllowed) {
-      return true;
-    }
-  }
-  return false;
-};

apps/web/src/auth/providers/email.ts

@@ -1,41 +0,0 @@
-import { prisma } from "@rallly/database";
-import { absoluteUrl } from "@rallly/utils/absolute-url";
-import { generateOtp } from "@rallly/utils/nanoid";
-import NodemailerProvider from "next-auth/providers/nodemailer";
-
-import { getEmailClient } from "@/utils/emails";
-
-export const EmailProvider = NodemailerProvider({
-  server: "none", // This value is required even though we don't need it
-  from: process.env.NOREPLY_EMAIL,
-  id: "email",
-  generateVerificationToken() {
-    return generateOtp();
-  },
-  async sendVerificationRequest({ identifier: email, token, url }) {
-    const user = await prisma.user.findUnique({
-      where: {
-        email,
-      },
-      select: {
-        name: true,
-        locale: true,
-      },
-    });
-
-    if (user) {
-      await getEmailClient(user.locale ?? undefined).sendTemplate(
-        "LoginEmail",
-        {
-          to: email,
-          props: {
-            magicLink: absoluteUrl("/auth/login", {
-              magicLink: url,
-            }),
-            code: token,
-          },
-        },
-      );
-    }
-  },
-});

apps/web/src/auth/providers/google.ts

@@ -1,11 +0,0 @@
-import BaseGoogleProvider from "next-auth/providers/google";
-
-export function GoogleProvider() {
-  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
-    return BaseGoogleProvider({
-      clientId: process.env.GOOGLE_CLIENT_ID,
-      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
-      allowDangerousEmailAccountLinking: true,
-    });
-  }
-}

apps/web/src/auth/providers/guest.ts

@@ -1,14 +0,0 @@
-import { randomid } from "@rallly/utils/nanoid";
-import CredentialsProvider from "next-auth/providers/credentials";
-
-export const GuestProvider = CredentialsProvider({
-  id: "guest",
-  name: "Guest",
-  credentials: {},
-  async authorize() {
-    return {
-      id: `user-${randomid()}`,
-      email: null,
-    };
-  },
-});

apps/web/src/auth/providers/microsoft.ts

@@ -1,17 +0,0 @@
-import MicrosoftEntraID from "next-auth/providers/microsoft-entra-id";
-
-export function MicrosoftProvider() {
-  if (
-    process.env.MICROSOFT_TENANT_ID &&
-    process.env.MICROSOFT_CLIENT_ID &&
-    process.env.MICROSOFT_CLIENT_SECRET
-  ) {
-    return MicrosoftEntraID({
-      name: "Microsoft",
-      clientId: process.env.MICROSOFT_CLIENT_ID,
-      clientSecret: process.env.MICROSOFT_CLIENT_SECRET,
-      wellKnown:
-        "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration",
-    });
-  }
-}

apps/web/src/auth/providers/oidc.ts

@@ -1,34 +0,0 @@
-import type { User } from "next-auth";
-import type { OIDCConfig } from "next-auth/providers/index";
-
-import { env } from "@/env";
-import { getValueByPath } from "@/utils/get-value-by-path";
-
-export const OIDCProvider = () => {
-  if (
-    process.env.OIDC_DISCOVERY_URL &&
-    process.env.OIDC_CLIENT_ID &&
-    process.env.OIDC_CLIENT_SECRET
-  ) {
-    return {
-      id: "oidc",
-      name: process.env.OIDC_NAME ?? "OpenID Connect",
-      type: "oidc",
-      wellKnown: process.env.OIDC_DISCOVERY_URL,
-      authorization: { params: { scope: "openid email profile" } },
-      clientId: process.env.OIDC_CLIENT_ID,
-      clientSecret: process.env.OIDC_CLIENT_SECRET,
-      idToken: true,
-      checks: ["state"],
-      allowDangerousEmailAccountLinking: true,
-      profile(profile) {
-        return {
-          id: profile.sub,
-          name: getValueByPath(profile, env.OIDC_NAME_CLAIM_PATH),
-          email: getValueByPath(profile, env.OIDC_EMAIL_CLAIM_PATH),
-          image: getValueByPath(profile, env.OIDC_PICTURE_CLAIM_PATH),
-        } as User;
-      },
-    } satisfies OIDCConfig<Record<string, unknown>>;
-  }
-};

apps/web/src/auth/providers/registration-token.ts

@@ -1,47 +0,0 @@
-import { prisma } from "@rallly/database";
-import CredentialsProvider from "next-auth/providers/credentials";
-
-import type { RegistrationTokenPayload } from "@/trpc/types";
-import { decryptToken } from "@/utils/session";
-
-// When a user registers, we don't want to go through the email verification process
-// so this provider allows us exchange the registration token for a session token
-export const RegistrationTokenProvider = CredentialsProvider({
-  id: "registration-token",
-  name: "Registration Token",
-  credentials: {
-    token: {
-      label: "Token",
-      type: "text",
-    },
-  },
-  async authorize(credentials) {
-    if (credentials?.token) {
-      const payload = await decryptToken<RegistrationTokenPayload>(
-        credentials.token as string,
-      );
-      if (payload) {
-        const user = await prisma.user.findUnique({
-          where: {
-            email: payload.email,
-          },
-          select: {
-            id: true,
-            email: true,
-            name: true,
-            locale: true,
-            timeFormat: true,
-            timeZone: true,
-            image: true,
-          },
-        });
-
-        if (user) {
-          return user;
-        }
-      }
-    }
-
-    return null;
-  },
-});

apps/web/src/components/login-link.tsx

@@ -12,7 +12,7 @@ export const LoginLink = React.forwardRef<
     <Link
       ref={ref}
       {...props}
-      href={`/login?redirectTo=${encodeURIComponent(pathname)}`}
+      href={`/login?callbackUrl=${encodeURIComponent(pathname)}`}
     >
       {children}
     </Link>

apps/web/src/components/poll/language-selector.tsx

@@ -18,7 +18,7 @@ export const LanguageSelect: React.FunctionComponent<{
   return (
     <Select value={value} onValueChange={onChange}>
       <SelectTrigger asChild className={className}>
-        <Button>
+        <Button variant="ghost">
           <Icon>
             <GlobeIcon />
           </Icon>

apps/web/src/components/register-link.tsx

@@ -17,7 +17,7 @@ export const RegisterLink = React.forwardRef<
       onClick={async (e) => {
         e.preventDefault();
         props.onClick?.(e);
-        router.push("/register?redirectTo=" + encodeURIComponent(pathname));
+        router.push("/register?callbackUrl=" + encodeURIComponent(pathname));
       }}
     >
       {children}

apps/web/src/features/quick-create/lib/get-guest-polls.ts

@@ -1,9 +1,9 @@
 import { prisma } from "@rallly/database";
 
-import { auth } from "@/next-auth";
+import { getServerSession } from "@/auth";
 
 export async function getGuestPolls() {
-  const session = await auth();
+  const session = await getServerSession();
   const user = session?.user;
   const guestId = !user?.email ? user?.id : null;
 

apps/web/src/middleware.ts

@@ -1,20 +1,32 @@
 import languages from "@rallly/languages";
 import { withPostHog } from "@rallly/posthog/next/middleware";
 import { NextResponse } from "next/server";
-import NextAuth from "next-auth";
+import withAuth from "next-auth/middleware";
 
 import { getLocaleFromHeader } from "@/app/guest";
-import { nextAuthConfig } from "@/next-auth.config";
+import { isSelfHosted } from "@/utils/constants";
-
-const { auth } = NextAuth(nextAuthConfig);
 
 const supportedLocales = Object.keys(languages);
 
-export default auth(async (req) => {
+const publicRoutes = [
+  "/login",
+  "/register",
+  "/invite/",
+  "/poll/",
+  "/auth/login",
+];
+
+if (process.env.QUICK_CREATE_ENABLED === "true") {
+  publicRoutes.push("/quick-create", "/new");
+}
+
+export const middleware = withAuth(
+  async function middleware(req) {
     const { nextUrl } = req;
     const newUrl = nextUrl.clone();
 
-  const isLoggedIn = req.auth?.user?.email;
+    const isLoggedIn = req.nextauth.token?.email;
+    // set x-pathname header to the pathname
 
     // if the user is already logged in, don't let them access the login page
     if (/^\/(login)/.test(newUrl.pathname) && isLoggedIn) {
@@ -22,8 +34,20 @@ export default auth(async (req) => {
       return NextResponse.redirect(newUrl);
     }
 
+    // if the user is not logged in and the page is not public, redirect to login
+    if (
+      !isLoggedIn &&
+      !publicRoutes.some((route) => newUrl.pathname.startsWith(route))
+    ) {
+      if (newUrl.pathname !== "/") {
+        newUrl.searchParams.set("callbackUrl", newUrl.pathname);
+      }
+      newUrl.pathname = "/login";
+      return NextResponse.redirect(newUrl);
+    }
+
     // Check if locale is specified in cookie
-  let locale = req.auth?.user?.locale;
+    let locale = req.nextauth.token?.locale;
     if (locale && supportedLocales.includes(locale)) {
       newUrl.pathname = `/${locale}${newUrl.pathname}`;
     } else {
@@ -36,12 +60,38 @@ export default auth(async (req) => {
     const res = NextResponse.rewrite(newUrl);
     res.headers.set("x-pathname", newUrl.pathname);
 
-  if (req.auth?.user?.id) {
+    if (req.nextauth.token) {
-    await withPostHog(res, { distinctID: req.auth.user.id });
+      await withPostHog(res, { distinctID: req.nextauth.token.sub });
     }
 
     return res;
-});
+  },
+  {
+    secret: process.env.SECRET_PASSWORD,
+    callbacks: {
+      authorized: ({ token, req }) => {
+        const nextUrl = req.nextUrl;
+        const isGuest = !token?.email;
+        if (
+          isSelfHosted &&
+          isGuest &&
+          !(
+            nextUrl.pathname.startsWith("/invite") ||
+            nextUrl.pathname.startsWith("/login") ||
+            nextUrl.pathname.startsWith("/register") ||
+            nextUrl.pathname.startsWith("/auth") ||
+            nextUrl.pathname.startsWith("/p/")
+          )
+        ) {
+          // limit which pages guests can access for self-hosted instances
+          return false;
+        }
+
+        return true;
+      },
+    },
+  },
+);
 
 export const config = {
   matcher: ["/((?!api|_next/static|_next/image|static|.*\\.).*)"],

apps/web/src/next-auth.config.ts

@@ -1,50 +0,0 @@
-import { NextResponse } from "next/server";
-import type { NextAuthConfig } from "next-auth";
-
-import { env } from "@/env";
-import { isQuickCreateEnabled } from "@/features/quick-create/constants";
-
-const publicRoutes = ["/login", "/register", "/invite/", "/poll/", "/auth"];
-
-if (isQuickCreateEnabled) {
-  publicRoutes.push("/quick-create", "/new");
-}
-
-/**
- * We split the next-auth config so that we can create an edge compatible instance that is
- * used in middleware.
- */
-export const nextAuthConfig = {
-  session: {
-    strategy: "jwt",
-  },
-  secret: env.SECRET_PASSWORD,
-  providers: [],
-  callbacks: {
-    async session({ session, token }) {
-      session.user.id = token.sub as string;
-      session.user.email = token.email as string;
-      session.user.locale = token.locale;
-      session.user.timeFormat = token.timeFormat;
-      session.user.timeZone = token.timeZone;
-      session.user.weekStart = token.weekStart;
-      return session;
-    },
-    async authorized({ request, auth }) {
-      const { nextUrl } = request;
-      const isLoggedIn = !!auth?.user?.email;
-      const isPublicRoute = publicRoutes.some((route) =>
-        nextUrl.pathname.startsWith(route),
-      );
-      if (isLoggedIn || isPublicRoute) {
-        return true;
-      }
-      const redirectUrl = new URL("/login", request.url);
-      if (nextUrl.pathname !== "/") {
-        const redirectPath = nextUrl.pathname + nextUrl.search;
-        redirectUrl.searchParams.set("redirectTo", redirectPath);
-      }
-      return NextResponse.redirect(redirectUrl);
-    },
-  },
-} satisfies NextAuthConfig;

apps/web/src/next-auth.ts

@@ -1,169 +0,0 @@
-import { prisma } from "@rallly/database";
-import { posthog } from "@rallly/posthog/server";
-import NextAuth from "next-auth";
-import type { Provider } from "next-auth/providers";
-import z from "zod";
-
-import { CustomPrismaAdapter } from "./auth/adapters/prisma";
-import { isEmailBlocked } from "./auth/is-email-blocked";
-import { mergeGuestsIntoUser } from "./auth/merge-user";
-import { EmailProvider } from "./auth/providers/email";
-import { GoogleProvider } from "./auth/providers/google";
-import { GuestProvider } from "./auth/providers/guest";
-import { MicrosoftProvider } from "./auth/providers/microsoft";
-import { OIDCProvider } from "./auth/providers/oidc";
-import { RegistrationTokenProvider } from "./auth/providers/registration-token";
-import { nextAuthConfig } from "./next-auth.config";
-
-const sessionUpdateSchema = z.object({
-  locale: z.string().nullish(),
-  timeFormat: z.enum(["12h", "24h"]).nullish(),
-  timeZone: z.string().nullish(),
-  weekStart: z.number().nullish(),
-});
-
-export const { auth, handlers, signIn, signOut } = NextAuth({
-  ...nextAuthConfig,
-  adapter: CustomPrismaAdapter({
-    migrateData: async (userId) => {
-      const session = await auth();
-      if (session?.user && session.user.email === null) {
-        await mergeGuestsIntoUser(userId, [session.user.id]);
-      }
-    },
-  }),
-  providers: [
-    RegistrationTokenProvider,
-    EmailProvider,
-    GuestProvider,
-    ...([GoogleProvider(), OIDCProvider(), MicrosoftProvider()].filter(
-      Boolean,
-    ) as Provider[]),
-  ],
-  pages: {
-    signIn: "/login",
-    verifyRequest: "/login/verify",
-    error: "/auth/error",
-  },
-  session: {
-    strategy: "jwt",
-  },
-  events: {
-    signIn({ user, account }) {
-      if (user.id) {
-        posthog?.capture({
-          distinctId: user.id,
-          event: "login",
-          properties: {
-            method: account?.provider,
-            $set: {
-              name: user.name,
-              email: user.email,
-              timeZone: user.timeZone,
-              locale: user.locale,
-            },
-          },
-        });
-      }
-    },
-  },
-  callbacks: {
-    ...nextAuthConfig.callbacks,
-    async signIn({ user, email, profile }) {
-      const distinctId = user.id;
-      // prevent sign in if email is not verified
-      if (
-        profile &&
-        "email_verified" in profile &&
-        profile.email_verified === false &&
-        distinctId
-      ) {
-        posthog?.capture({
-          distinctId,
-          event: "login failed",
-          properties: {
-            reason: "email not verified",
-          },
-        });
-        return false;
-      }
-      // Make sure email is allowed
-      if (user.email) {
-        const isBlocked = isEmailBlocked(user.email);
-        if (isBlocked) {
-          return false;
-        }
-      }
-
-      // For now, we don't allow users to login unless they have
-      // registered an account. This is just because we need a name
-      // to display on the dashboard. The flow can be modified so that
-      // the name is requested after the user has logged in.
-      if (email?.verificationRequest) {
-        const isRegisteredUser =
-          (await prisma.user.count({
-            where: {
-              email: user.email as string,
-            },
-          })) > 0;
-
-        return isRegisteredUser;
-      }
-
-      // when we login with a social account for the first time, the user is not created yet
-      // and the user id will be the same as the provider account id
-      // we handle this case the the prisma adapter when we link accounts
-      const isInitialSocialLogin = user.id === profile?.sub;
-
-      if (!isInitialSocialLogin) {
-        // merge guest user into newly logged in user
-        const session = await auth();
-        if (user.id && session?.user && !session.user.email) {
-          await mergeGuestsIntoUser(user.id, [session.user.id]);
-        }
-      }
-
-      return true;
-    },
-    async jwt({ token, session, trigger }) {
-      if (trigger === "update") {
-        const parsed = sessionUpdateSchema.safeParse(session);
-        if (parsed.success) {
-          Object.entries(parsed.data).forEach(([key, value]) => {
-            token[key] = value;
-          });
-        } else {
-          console.error(parsed.error);
-        }
-      } else {
-        const userId = token.sub;
-        const isGuest = userId?.startsWith("guest-");
-
-        if (userId && !isGuest) {
-          const user = await prisma.user.findUnique({
-            where: {
-              id: userId,
-            },
-            select: {
-              email: true,
-              locale: true,
-              timeFormat: true,
-              timeZone: true,
-              weekStart: true,
-            },
-          });
-
-          if (user) {
-            token.email = user.email;
-            token.locale = user.locale;
-            token.timeFormat = user.timeFormat;
-            token.timeZone = user.timeZone;
-            token.weekStart = user.weekStart;
-          }
-        }
-      }
-
-      return token;
-    },
-  },
-});

apps/web/src/pages/api/auth/[...nextauth].ts

@@ -0,0 +1,14 @@
+import { posthogApiHandler } from "@rallly/posthog/server";
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { AuthApiRoute } from "@/auth";
+import { composeApiHandlers } from "@/utils/next";
+
+export default async function auth(req: NextApiRequest, res: NextApiResponse) {
+  if (req.method === "HEAD") {
+    res.status(200).end();
+    res.setHeader("Content-Length", "0");
+  } else {
+    return composeApiHandlers(AuthApiRoute, posthogApiHandler)(req, res);
+  }
+}

apps/web/src/trpc/routers/auth.ts

@@ -4,7 +4,7 @@ import { generateOtp } from "@rallly/utils/nanoid";
 import * as Sentry from "@sentry/nextjs";
 import { z } from "zod";
 
-import { isEmailBlocked } from "@/auth/is-email-blocked";
+import { isEmailBlocked } from "@/auth";
 import { mergeGuestsIntoUser } from "@/auth/merge-user";
 import { getEmailClient } from "@/utils/emails";
 import { createToken, decryptToken } from "@/utils/session";

apps/web/src/trpc/server/create-ssr-helper.ts

@@ -2,14 +2,14 @@ import { createServerSideHelpers } from "@trpc/react-query/server";
 import { redirect } from "next/navigation";
 import superjson from "superjson";
 
-import { auth } from "@/next-auth";
+import { getServerSession } from "@/auth";
 import { getEmailClient } from "@/utils/emails";
 
 import type { TRPCContext } from "../context";
 import { appRouter } from "../routers";
 
 async function createContext(): Promise<TRPCContext> {
-  const session = await auth();
+  const session = await getServerSession();
   return {
     user: session?.user
       ? {

apps/web/tests/create-delete-poll.spec.ts

@@ -31,6 +31,6 @@ test.describe.serial(() => {
 
     deletePollDialog.getByRole("button", { name: "delete" }).click();
 
-    await expect(page).toHaveURL("/login?redirectTo=%2Fpolls");
+    await expect(page).toHaveURL("/login?callbackUrl=%2Fpolls");
   });
 });

package.json

@@ -58,6 +58,5 @@
   "engines": {
     "node": "20.x"
   },
-  "packageManager": "yarn@1.22.22",
+  "packageManager": "yarn@1.22.22"
-  "dependencies": {}
 }

packages/posthog/src/server/index.ts

@@ -1,5 +1,4 @@
 import { waitUntil } from "@vercel/functions";
-import type { NextRequest } from "next/server";
 import { PostHog } from "posthog-node";
 
 function PostHogClient() {
@@ -22,10 +21,3 @@ export function posthogApiHandler() {
     console.error("Failed to flush PostHog events:", error);
   }
 }
-export function withPosthog(handler: (req: NextRequest) => Promise<Response>) {
-  return async (req: NextRequest) => {
-    const res = await handler(req);
-    posthogApiHandler();
-    return res;
-  };
-}

yarn.lock

@@ -20,36 +20,24 @@
     "@jridgewell/gen-mapping" "^0.1.0"
     "@jridgewell/trace-mapping" "^0.3.9"
 
-"@auth/core@0.37.2":
+"@auth/core@0.16.1":
-  version "0.37.2"
+  version "0.16.1"
-  resolved "https://registry.yarnpkg.com/@auth/core/-/core-0.37.2.tgz#0db8a94a076846bd88eb7f9273618513e2285cb2"
+  resolved "https://registry.npmjs.org/@auth/core/-/core-0.16.1.tgz"
-  integrity sha512-kUvzyvkcd6h1vpeMAojK2y7+PAV5H+0Cc9+ZlKYDFhDY31AlvsB+GW5vNO4qE3Y07KeQgvNO9U0QUx/fN62kBw==
+  integrity sha512-V+YifnjpyOadiiTbxfYDV2xYWo8xpKNtwYVskAEKUSwMvE0FlSlP+10QGBpf0axS/AJFOO61IR6GncFF/IOrHQ==
   dependencies:
-    "@panva/hkdf" "^1.2.1"
+    "@panva/hkdf" "^1.0.4"
-    "@types/cookie" "0.6.0"
+    cookie "0.5.0"
-    cookie "0.7.1"
+    jose "^4.11.1"
-    jose "^5.9.3"
+    oauth4webapi "^2.0.6"
-    oauth4webapi "^3.0.0"
     preact "10.11.3"
     preact-render-to-string "5.2.3"
 
-"@auth/core@0.37.4":
+"@auth/prisma-adapter@^1.0.3":
-  version "0.37.4"
+  version "1.0.3"
-  resolved "https://registry.yarnpkg.com/@auth/core/-/core-0.37.4.tgz#c51410aa7d0997fa22a07a196d2c21c8b1bca71b"
+  resolved "https://registry.npmjs.org/@auth/prisma-adapter/-/prisma-adapter-1.0.3.tgz"
-  integrity sha512-HOXJwXWXQRhbBDHlMU0K/6FT1v+wjtzdKhsNg0ZN7/gne6XPsIrjZ4daMcFnbq0Z/vsAbYBinQhhua0d77v7qw==
+  integrity sha512-AMwQbO7OiBYRCA6VNfv9CpcpiRh0BP4EKhPdtO+pom9Uhuor2ioE4IqvhUfJyBkSjAP2Gt9WbKqr9kzL9LrtIg==
   dependencies:
-    "@panva/hkdf" "^1.2.1"
+    "@auth/core" "0.16.1"
-    jose "^5.9.6"
-    oauth4webapi "^3.1.1"
-    preact "10.24.3"
-    preact-render-to-string "6.5.11"
-
-"@auth/prisma-adapter@^2.7.4":
-  version "2.7.4"
-  resolved "https://registry.yarnpkg.com/@auth/prisma-adapter/-/prisma-adapter-2.7.4.tgz#4890be47a9f227f449832302d955c565c02879ee"
-  integrity sha512-3T/X94R9J1sxOLQtsD3ijIZ0JGHPXlZQxRr/8NpnZBJ3KGxun/mNsZ1MwMRhTxy0mmn9JWXk7u9+xCcVn0pu3A==
-  dependencies:
-    "@auth/core" "0.37.4"
 
 "@aws-crypto/crc32@3.0.0":
   version "3.0.0"
@@ -3390,10 +3378,10 @@
   dependencies:
     "@opentelemetry/core" "^1.1.0"
 
-"@panva/hkdf@^1.2.1":
+"@panva/hkdf@^1.0.2", "@panva/hkdf@^1.0.4":
-  version "1.2.1"
+  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/@panva/hkdf/-/hkdf-1.2.1.tgz#cb0d111ef700136f4580349ff0226bf25c853f23"
+  resolved "https://registry.npmjs.org/@panva/hkdf/-/hkdf-1.1.1.tgz"
-  integrity sha512-6oclG6Y3PiDFcoyk8srjLfVKyMfVCKJ27JwNPViuXziFpmdz+MZnZN/aKY0JGXgYuO/VghU0jcOAZgWXZ1Dmrw==
+  integrity sha512-dhPeilub1NuIG0X5Kvhh9lH4iW3ZsHlnzwgwbOlgwQ2wG1IqFzsgHqmKPk3WzsdWAeaxKJxgM0+W433RmN45GA==
 
 "@peculiar/asn1-schema@^2.1.6", "@peculiar/asn1-schema@^2.3.0":
   version "2.3.3"
@@ -6147,11 +6135,6 @@
   resolved "https://registry.npmjs.org/@types/content-disposition/-/content-disposition-0.5.5.tgz"
   integrity sha512-v6LCdKfK6BwcqMo+wYW05rLS12S0ZO0Fl4w1h4aaZMD7bqT3gVUns6FvLJKGZHQmYn3SX55JWGpziwJRwVgutA==
 
-"@types/cookie@0.6.0":
-  version "0.6.0"
-  resolved "https://registry.yarnpkg.com/@types/cookie/-/cookie-0.6.0.tgz#eac397f28bf1d6ae0ae081363eca2f425bedf0d5"
-  integrity sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==
-
 "@types/cookie@^0.4.1":
   version "0.4.1"
   resolved "https://registry.yarnpkg.com/@types/cookie/-/cookie-0.4.1.tgz#bfd02c1f2224567676c1545199f87c3a861d878d"
@@ -7545,9 +7528,9 @@ camelcase@^6.2.0:
   integrity sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==
 
 caniuse-lite@^1.0.30001406, caniuse-lite@^1.0.30001426, caniuse-lite@^1.0.30001449, caniuse-lite@^1.0.30001464, caniuse-lite@^1.0.30001579, caniuse-lite@^1.0.30001580, caniuse-lite@^1.0.30001629:
-  version "1.0.30001697"
+  version "1.0.30001636"
-  resolved "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001697.tgz"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001636.tgz#b15f52d2bdb95fad32c2f53c0b68032b85188a78"
-  integrity sha512-GwNPlWJin8E+d7Gxq96jxM6w0w+VFeyyXRsjU58emtkYqnbwHqXm5uT2uCmO0RQE9htWknOP4xtBlLmM/gWxvQ==
+  integrity sha512-bMg2vmr8XBsbL6Lr0UHXy/21m84FTxDLWn2FSqMd5PrlbMxwJlQnC2YWYxVgp66PZE+BBNF2jYQUBKCo1FDeZg==
 
 ccount@^2.0.0:
   version "2.0.1"
@@ -7879,12 +7862,7 @@ convert-source-map@^2.0.0:
   resolved "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-2.0.0.tgz#4b560f649fc4e918dd0ab75cf4961e8bc882d82a"
   integrity sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==
 
-cookie@0.7.1:
+cookie@0.5.0, cookie@^0.5.0:
-  version "0.7.1"
-  resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.7.1.tgz#2f73c42142d5d5cf71310a74fc4ae61670e5dbc9"
-  integrity sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==
-
-cookie@^0.5.0:
   version "0.5.0"
   resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.5.0.tgz#d1f5d71adec6558c58f389987c366aa47e994f8b"
   integrity sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==
@@ -8080,12 +8058,12 @@ debounce@2.0.0:
   resolved "https://registry.yarnpkg.com/debounce/-/debounce-2.0.0.tgz#b2f914518a1481466f4edaee0b063e4d473ad549"
   integrity sha512-xRetU6gL1VJbs85Mc4FoEGSjQxzpdxRyFhe3lmWFyy2EzydIcD4xzUvRJMD+NPDfMwKNhxa3PvsIOU32luIWeA==
 
-debug@4, debug@^4.0.0, debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.2, debug@^4.3.4, debug@^4.3.7:
+debug@4, debug@^4.0.0, debug@^4.1.0, debug@^4.1.1, debug@^4.3.2, debug@^4.3.4, debug@~4.3.1, debug@~4.3.2:
-  version "4.4.0"
+  version "4.3.4"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.0.tgz#2b3f2aea2ffeb776477460267377dc8710faba8a"
+  resolved "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"
-  integrity sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==
+  integrity sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==
   dependencies:
-    ms "^2.1.3"
+    ms "2.1.2"
 
 debug@^3.2.7:
   version "3.2.7"
@@ -8094,13 +8072,20 @@ debug@^3.2.7:
   dependencies:
     ms "^2.1.1"
 
-debug@~4.3.1, debug@~4.3.2:
+debug@^4.3.1:
   version "4.3.5"
   resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.5.tgz#e83444eceb9fedd4a1da56d671ae2446a01a6e1e"
   integrity sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg==
   dependencies:
     ms "2.1.2"
 
+debug@^4.3.7:
+  version "4.4.0"
+  resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.0.tgz#2b3f2aea2ffeb776477460267377dc8710faba8a"
+  integrity sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==
+  dependencies:
+    ms "^2.1.3"
+
 decamelize-keys@^1.1.0:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/decamelize-keys/-/decamelize-keys-1.1.1.tgz#04a2d523b2f18d80d0158a43b895d56dff8d19d8"
@@ -10418,7 +10403,12 @@ joi@^17.6.0:
     "@sideway/formula" "^3.0.1"
     "@sideway/pinpoint" "^2.0.0"
 
-jose@^5.2.3, jose@^5.9.3, jose@^5.9.6:
+jose@^4.11.1, jose@^4.11.4, jose@^4.15.1:
+  version "4.15.5"
+  resolved "https://registry.yarnpkg.com/jose/-/jose-4.15.5.tgz#6475d0f467ecd3c630a1b5dadd2735a7288df706"
+  integrity sha512-jc7BFxgKPKi94uOvEmzlSWFFe2+vASyXaKUpdQKatWAESU2MWjDfFf0fdfc83CDKcA5QecabZeNLyfhe3yKNkg==
+
+jose@^5.2.3:
   version "5.9.6"
   resolved "https://registry.yarnpkg.com/jose/-/jose-5.9.6.tgz#77f1f901d88ebdc405e57cce08d2a91f47521883"
   integrity sha512-AMlnetc9+CV9asI19zHmrgS/WYsWUwCn2R7RzlbJWD7F9eWYUTGyBmU9o6PxngtLGOiDGPRu+Uc4fhKzbpteZQ==
@@ -10724,13 +10714,20 @@ magic-string@0.30.8:
   dependencies:
     "@jridgewell/sourcemap-codec" "^1.4.15"
 
-magic-string@^0.30.12, magic-string@^0.30.3:
+magic-string@^0.30.12:
   version "0.30.17"
   resolved "https://registry.yarnpkg.com/magic-string/-/magic-string-0.30.17.tgz#450a449673d2460e5bbcfba9a61916a1714c7453"
   integrity sha512-sNPKHvyjVf7gyjwS4xGTaW/mCnF8wnjtifKBEhxfZ7E/S8tQ0rssrwGNn6q8JH/ohItJfSQp9mBtQYuTlH5QnA==
   dependencies:
     "@jridgewell/sourcemap-codec" "^1.5.0"
 
+magic-string@^0.30.3:
+  version "0.30.10"
+  resolved "https://registry.yarnpkg.com/magic-string/-/magic-string-0.30.10.tgz#123d9c41a0cb5640c892b041d4cfb3bd0aa4b39e"
+  integrity sha512-iIRwTIf0QKV3UAnYK4PU8uiEc4SRh5jX0mwpIwETPpHdhVM4f53RSwS/vXvN1JhGX+Cs7B8qIq3d6AH49O5fAQ==
+  dependencies:
+    "@jridgewell/sourcemap-codec" "^1.4.15"
+
 map-obj@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/map-obj/-/map-obj-1.0.1.tgz#d933ceb9205d82bdcf4886f6742bdc2b4dea146d"
@@ -11374,12 +11371,20 @@ neverthrow@^7.0.1:
   resolved "https://registry.yarnpkg.com/neverthrow/-/neverthrow-7.2.0.tgz#76fa0a6cf1f6d59f0770df461c92b8b270910694"
   integrity sha512-iGBUfFB7yPczHHtA8dksKTJ9E8TESNTAx1UQWW6TzMF280vo9jdPYpLUXrMN1BCkPdHFdNG3fxOt2CUad8KhAw==
 
-next-auth@^5.0.0-beta.25:
+next-auth@^4.24.5:
-  version "5.0.0-beta.25"
+  version "4.24.5"
-  resolved "https://registry.yarnpkg.com/next-auth/-/next-auth-5.0.0-beta.25.tgz#3a9f9734e1d8fa5ced545360f1afc24862cb92d5"
+  resolved "https://registry.yarnpkg.com/next-auth/-/next-auth-4.24.5.tgz#1fd1bfc0603c61fd2ba6fd81b976af690edbf07e"
-  integrity sha512-2dJJw1sHQl2qxCrRk+KTQbeH+izFbGFPuJj5eGgBZFYyiYYtvlrBeUw1E/OJJxTRjuxbSYGnCTkUIRsIIW0bog==
+  integrity sha512-3RafV3XbfIKk6rF6GlLE4/KxjTcuMCifqrmD+98ejFq73SRoj2rmzoca8u764977lH/Q7jo6Xu6yM+Re1Mz/Og==
   dependencies:
-    "@auth/core" "0.37.2"
+    "@babel/runtime" "^7.20.13"
+    "@panva/hkdf" "^1.0.2"
+    cookie "^0.5.0"
+    jose "^4.11.4"
+    oauth "^0.9.15"
+    openid-client "^5.4.0"
+    preact "^10.6.3"
+    preact-render-to-string "^5.1.19"
+    uuid "^8.3.2"
 
 next-i18next@^13.0.3:
   version "13.1.6"
@@ -11545,16 +11550,26 @@ nth-check@^2.0.1:
   dependencies:
     boolbase "^1.0.0"
 
-oauth4webapi@^3.0.0, oauth4webapi@^3.1.1:
+oauth4webapi@^2.0.6:
-  version "3.1.4"
+  version "2.3.0"
-  resolved "https://registry.yarnpkg.com/oauth4webapi/-/oauth4webapi-3.1.4.tgz#50695385cea8e7a43f3e2e23bc33ea27faece4a7"
+  resolved "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-2.3.0.tgz"
-  integrity sha512-eVfN3nZNbok2s/ROifO0UAc5G8nRoLSbrcKJ09OqmucgnhXEfdIQOR4gq1eJH1rN3gV7rNw62bDEgftsgFtBEg==
+  integrity sha512-JGkb5doGrwzVDuHwgrR4nHJayzN4h59VCed6EW8Tql6iHDfZIabCJvg6wtbn5q6pyB2hZruI3b77Nudvq7NmvA==
+
+oauth@^0.9.15:
+  version "0.9.15"
+  resolved "https://registry.npmjs.org/oauth/-/oauth-0.9.15.tgz"
+  integrity sha512-a5ERWK1kh38ExDEfoO6qUHJb32rd7aYmPHuyCu3Fta/cnICvYmgd2uhuKXvPD+PXB+gCEYYEaQdIRAjCOwAKNA==
 
 object-assign@^4, object-assign@^4.0.1, object-assign@^4.1.0, object-assign@^4.1.1:
   version "4.1.1"
   resolved "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz"
   integrity sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==
 
+object-hash@^2.2.0:
+  version "2.2.0"
+  resolved "https://registry.npmjs.org/object-hash/-/object-hash-2.2.0.tgz"
+  integrity sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw==
+
 object-hash@^3.0.0:
   version "3.0.0"
   resolved "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz"
@@ -11648,6 +11663,11 @@ obuf@~1.1.2:
   resolved "https://registry.yarnpkg.com/obuf/-/obuf-1.1.2.tgz#09bea3343d41859ebd446292d11c9d4db619084e"
   integrity sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg==
 
+oidc-token-hash@^5.0.3:
+  version "5.0.3"
+  resolved "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.0.3.tgz"
+  integrity sha512-IF4PcGgzAr6XXSff26Sk/+P4KZFJVuHAJZj3wgO3vX2bMdNVp/QXTP3P7CEm9V1IdG8lDLY3HhiqpsE/nOwpPw==
+
 once@^1.3.0, once@^1.3.1, once@^1.3.2, once@^1.4.0:
   version "1.4.0"
   resolved "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
@@ -11667,6 +11687,16 @@ opener@^1.5.2:
   resolved "https://registry.npmjs.org/opener/-/opener-1.5.2.tgz"
   integrity sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A==
 
+openid-client@^5.4.0:
+  version "5.6.0"
+  resolved "https://registry.npmjs.org/openid-client/-/openid-client-5.6.0.tgz"
+  integrity sha512-uFTkN/iqgKvSnmpVAS/T6SNThukRMBcmymTQ71Ngus1F60tdtKVap7zCrleocY+fogPtpmoxi5Q1YdrgYuTlkA==
+  dependencies:
+    jose "^4.15.1"
+    lru-cache "^6.0.0"
+    object-hash "^2.2.0"
+    oidc-token-hash "^5.0.3"
+
 optionator@^0.9.3:
   version "0.9.3"
   resolved "https://registry.npmjs.org/optionator/-/optionator-0.9.3.tgz"
@@ -12139,26 +12169,28 @@ preact-render-to-string@5.2.3:
   dependencies:
     pretty-format "^3.8.0"
 
-preact-render-to-string@6.5.11:
+preact-render-to-string@^5.1.19:
-  version "6.5.11"
+  version "5.2.6"
-  resolved "https://registry.yarnpkg.com/preact-render-to-string/-/preact-render-to-string-6.5.11.tgz#467e69908a453497bb93d4d1fc35fb749a78e027"
+  resolved "https://registry.npmjs.org/preact-render-to-string/-/preact-render-to-string-5.2.6.tgz"
-  integrity sha512-ubnauqoGczeGISiOh6RjX0/cdaF8v/oDXIjO85XALCQjwQP+SB4RDXXtvZ6yTYSjG+PC1QRP2AhPgCEsM2EvUw==
+  integrity sha512-JyhErpYOvBV1hEPwIxc/fHWXPfnEGdRKxc8gFdAZ7XV4tlzyzG847XAyEZqoDnynP88akM4eaHcSOzNcLWFguw==
+  dependencies:
+    pretty-format "^3.8.0"
 
 preact@10.11.3:
   version "10.11.3"
   resolved "https://registry.npmjs.org/preact/-/preact-10.11.3.tgz"
   integrity sha512-eY93IVpod/zG3uMF22Unl8h9KkrcKIRs2EGar8hwLZZDU1lkjph303V9HZBwufh2s736U6VXuhD109LYqPoffg==
 
-preact@10.24.3:
-  version "10.24.3"
-  resolved "https://registry.yarnpkg.com/preact/-/preact-10.24.3.tgz#086386bd47071e3b45410ef20844c21e23828f64"
-  integrity sha512-Z2dPnBnMUfyQfSQ+GBdsGa16hz35YmLmtTLhM169uW944hYL6xzTYkJjC07j+Wosz733pMWx0fgON3JNw1jJQA==
-
 preact@^10.19.3:
   version "10.19.3"
   resolved "https://registry.yarnpkg.com/preact/-/preact-10.19.3.tgz#7a7107ed2598a60676c943709ea3efb8aaafa899"
   integrity sha512-nHHTeFVBTHRGxJXKkKu5hT8C/YWBkPso4/Gad6xuj5dbptt9iF9NZr9pHbPhBrnT2klheu7mHTxTZ/LjwJiEiQ==
 
+preact@^10.6.3:
+  version "10.18.1"
+  resolved "https://registry.npmjs.org/preact/-/preact-10.18.1.tgz"
+  integrity sha512-mKUD7RRkQQM6s7Rkmi7IFkoEHjuFqRQUaXamO61E6Nn7vqF/bo7EZCmSyrUnp2UWHw0O7XjZ2eeXis+m7tf4lg==
+
 prelude-ls@^1.2.1:
   version "1.2.1"
   resolved "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz"