nextauthjs / next-auth

Authentication for the Web.
https://authjs.dev
ISC License
23.19k stars 3.17k forks source link

With credential provider xata adapter not storing session data in xata database #11088

Open dwalker93 opened 1 month ago

dwalker93 commented 1 month ago

Adapter type

@auth/xata-adapter

Environment

System:
    OS: Windows 11 10.0.22631
    CPU: (12) x64 Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz
    Memory: 13.71 GB / 23.88 GB
  Binaries:
    Node: 20.10.0 - C:\Program Files\nodejs\node.EXE
    Yarn: 3.3.1 - C:\Program Files\nodejs\yarn.CMD
    npm: 9.8.1 - C:\Program Files\nodejs\npm.CMD
    pnpm: 9.1.4 - ~\AppData\Local\pnpm\pnpm.CMD
  Browsers:
    Edge: Chromium (125.0.2535.67)
    Internet Explorer: 11.0.22621.3527
  npmPackages:
    @auth/xata-adapter: ^1.2.0 => 1.2.0
    next: 14.2.3 => 14.2.3
    next-auth: 5.0.0-beta.19 => 5.0.0-beta.19
    react: ^18 => 18.3.1

Reproduction URL

https://github.com/dwalker93/xata-auth-test

Describe the issue

Xata adapater not storing session data in the xata database when using credentials provider. But working fine with the github provider as I tested.

How to reproduce

  1. download the repo
  2. run command pnpm install
  3. Create an account in xata.io
  4. run command pnpm add -g @xata.io/cli
  5. run command xata auth login
  6. run command xata init --schema="schema.json"
  7. run command pnpm dev

Expected behavior

You should be able to login using the credential provider and be redirected to the app and see the users session information.

1034935767 commented 6 days ago

No session was created in the database, can anyone help solve this?

https://github.com/nextauthjs/next-auth/tree/main/packages/core/src/lib/actions/callback/index.ts

else if (provider.type === "credentials" && method === "POST") {
    const credentials = body ?? {}

    // TODO: Forward the original request as is, instead of reconstructing it
    Object.entries(query ?? {}).forEach(([k, v]) =>
      url.searchParams.set(k, v)
    )
    const userFromAuthorize = await provider.authorize(
      credentials,
      // prettier-ignore
      new Request(url, { headers, method, body: JSON.stringify(body) })
    )
    const user = userFromAuthorize

    if (!user) {
      console.error(
        "Read more at https://errors.authjs.dev/#credentialssignin"
      )
      throw new CredentialsSignin()
    } else user.id = user.id?.toString() ?? crypto.randomUUID()

    const account = {
      providerAccountId: user.id,
      type: "credentials",
      provider: provider.id,
    } satisfies Account

    const redirect = await handleAuthorized(
      { user, account, credentials },
      options
    )
    if (redirect) return { redirect, cookies }

    const defaultToken = {
      name: user.name,
      email: user.email,
      picture: user.image,
      sub: user.id,
    }

    const token = await callbacks.jwt({
      token: defaultToken,
      user,
      account,
      isNewUser: false,
      trigger: "signIn",
    })

    // Clear cookies if token is null
    if (token === null) {
      cookies.push(...sessionStore.clean())
    } else {
      const salt = options.cookies.sessionToken.name
      // Encode token
      const newToken = await jwt.encode({ ...jwt, token, salt })

      // Set cookie expiry date
      const cookieExpires = new Date()
      cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000)

      const sessionCookies = sessionStore.chunk(newToken, {
        expires: cookieExpires,
      })

      cookies.push(...sessionCookies)
    }

    await events.signIn?.({ user, account })

    return { redirect: callbackUrl, cookies }
  }

Other providers include the following:

 const { user, session, isNewUser } = await handleLoginOrRegister(
        sessionStore.value,
        userFromProvider,
        account,
        options
      )

https://github.com/nextauthjs/next-auth/tree/main/packages/core/src/lib/actions/session.ts

When accessing “/api/auth/session”, the session could not be read,

let userAndSession = await getSessionAndUser(sessionToken)

and the following operations were performed.

response.cookies?.push(...sessionStore.clean())

@dwalker93