6f7327b774
* wip: add provider field to sqlite user table * feat: disable invites when credentials provider is not used * wip: add migration for provider field in user table with sqlite * wip: remove fields that can not be modified by non credential users * wip: make username, mail and avatar disabled instead of hidden * wip: external users membership of group cannot be managed manually * feat: add alerts to inform about disabled fields and managing group members * wip: add mysql migration for provider on user table * chore: fix format issues * chore: address pull request feedback * fix: build issue * fix: deepsource issues * fix: tests not working * feat: restrict login to specific auth providers * chore: address pull request feedback * fix: deepsource issue
39 lines
1.1 KiB
TypeScript
39 lines
1.1 KiB
TypeScript
import type { ReadonlyHeaders } from "next/dist/server/web/spec-extension/adapters/headers";
|
|
import type { OIDCConfig } from "next-auth/providers";
|
|
|
|
import { env } from "../../env.mjs";
|
|
import { createRedirectUri } from "../../redirect";
|
|
|
|
interface Profile {
|
|
sub: string;
|
|
name: string;
|
|
email: string;
|
|
groups: string[];
|
|
preferred_username: string;
|
|
email_verified: boolean;
|
|
}
|
|
|
|
export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profile> => ({
|
|
id: "oidc",
|
|
name: env.AUTH_OIDC_CLIENT_NAME,
|
|
type: "oidc",
|
|
clientId: env.AUTH_OIDC_CLIENT_ID,
|
|
clientSecret: env.AUTH_OIDC_CLIENT_SECRET,
|
|
issuer: env.AUTH_OIDC_ISSUER,
|
|
authorization: {
|
|
params: {
|
|
scope: env.AUTH_OIDC_SCOPE_OVERWRITE,
|
|
redirect_uri: createRedirectUri(headers, "/api/auth/callback/oidc"),
|
|
},
|
|
},
|
|
profile(profile) {
|
|
return {
|
|
id: profile.sub,
|
|
// Use the name as the username if the preferred_username is an email address
|
|
name: profile.preferred_username.includes("@") ? profile.name : profile.preferred_username,
|
|
email: profile.email,
|
|
provider: "oidc",
|
|
};
|
|
},
|
|
});
|