♻️ Upgrade to next-auth v5 (#1558)

apps/web/src/middleware.ts

@@ -1,32 +1,19 @@
 import languages from "@rallly/languages";
 import { withPostHog } from "@rallly/posthog/next/middleware";
 import { NextResponse } from "next/server";
-import withAuth from "next-auth/middleware";
 
 import { getLocaleFromHeader } from "@/app/guest";
-import { isSelfHosted } from "@/utils/constants";
+import { withAuthMigration } from "@/auth/legacy/next-auth-cookie-migration";
+import { withAuth } from "@/auth/middleware";
 
 const supportedLocales = Object.keys(languages);
 
-const publicRoutes = [
-  "/login",
-  "/register",
-  "/invite/",
-  "/poll/",
-  "/auth/login",
-];
-
-if (process.env.QUICK_CREATE_ENABLED === "true") {
-  publicRoutes.push("/quick-create", "/new");
-}
-
-export const middleware = withAuth(
-  async function middleware(req) {
+export const middleware = withAuthMigration(
+  withAuth(async (req) => {
     const { nextUrl } = req;
     const newUrl = nextUrl.clone();
 
-    const isLoggedIn = req.nextauth.token?.email;
-    // set x-pathname header to the pathname
+    const isLoggedIn = req.auth?.user?.email;
 
     // if the user is already logged in, don't let them access the login page
     if (/^\/(login)/.test(newUrl.pathname) && isLoggedIn) {
@@ -34,63 +21,25 @@ export const middleware = withAuth(
       return NextResponse.redirect(newUrl);
     }
 
-    // if the user is not logged in and the page is not public, redirect to login
-    if (
-      !isLoggedIn &&
-      !publicRoutes.some((route) => newUrl.pathname.startsWith(route))
-    ) {
-      if (newUrl.pathname !== "/") {
-        newUrl.searchParams.set("callbackUrl", newUrl.pathname);
-      }
-      newUrl.pathname = "/login";
-      return NextResponse.redirect(newUrl);
-    }
-
     // Check if locale is specified in cookie
-    let locale = req.nextauth.token?.locale;
+    let locale = req.auth?.user?.locale;
     if (locale && supportedLocales.includes(locale)) {
       newUrl.pathname = `/${locale}${newUrl.pathname}`;
     } else {
       // Check if locale is specified in header
       locale = await getLocaleFromHeader(req);
-
       newUrl.pathname = `/${locale}${newUrl.pathname}`;
     }
 
     const res = NextResponse.rewrite(newUrl);
     res.headers.set("x-pathname", newUrl.pathname);
 
-    if (req.nextauth.token) {
-      await withPostHog(res, { distinctID: req.nextauth.token.sub });
+    if (req.auth?.user?.id) {
+      await withPostHog(res, { distinctID: req.auth.user.id });
     }
 
     return res;
-  },
-  {
-    secret: process.env.SECRET_PASSWORD,
-    callbacks: {
-      authorized: ({ token, req }) => {
-        const nextUrl = req.nextUrl;
-        const isGuest = !token?.email;
-        if (
-          isSelfHosted &&
-          isGuest &&
-          !(
-            nextUrl.pathname.startsWith("/invite") ||
-            nextUrl.pathname.startsWith("/login") ||
-            nextUrl.pathname.startsWith("/register") ||
-            nextUrl.pathname.startsWith("/auth") ||
-            nextUrl.pathname.startsWith("/p/")
-          )
-        ) {
-          // limit which pages guests can access for self-hosted instances
-          return false;
-        }
-
-        return true;
-      },
-    },
-  },
+  }),
 );
 
 export const config = {