Unknow error on api route for oauth on next.js app router and type error with cookies

[perrylets]

My code:

import { githubAuth } from "@/scripts/auth";
import { cookies } from "next/headers";
import { type NextRequest, NextResponse } from "next/server";

export const GET = async (req: NextRequest) => {
  if (!req.url) return new NextResponse(null, { status: 400 });

  // get url to redirect the user to, with the state
  const [url, state] = await githubAuth.getAuthorizationUrl();

  // the state can be stored in cookies or localstorage for request validation on callback
  cookies().set("oauth_state", state, {
    path: "/",
    maxAge: 60 * 60,
    httpOnly: true,
    secure: process.env.NODE_ENV === "production"
  });

  // redirect to authorization url
  return NextResponse.redirect(url.toString(), {});
};

I'm just following the guide and error code 500 appears, there's not even an error message.

Also, every call to handleRequest that has cookies inside the parameter object has the following type error:

Type '() => ReadonlyRequestCookies' is not assignable to type '() => { set?: ((name: string, value: string, options?: CookieAttributes | undefined) => void) | undefined; get: (name: string) => { name: string; value: string; } | undefined; }'.

[pilcrowonpaper]

Hm, this works for me:

const [url, state] = await githubAuth.getAuthorizationUrl();
cookies().set("oauth_state", state, {
	path: "/",
	maxAge: 60 * 60,
	httpOnly: true
});
return NextResponse.redirect(url.toString());

Also, the handleRequest() issue should be resolved with the next version of Next.js (13.4.4).

[pilcrowonpaper]

Does getPrivateEmail() work?

[perrylets]

It didn't but now it does and the error message is this one again:

{
  "clientVersion": "4.14.1"
}

I get the email and I know it crashes during createUser because the user object isn't printed, but debug is harder than it should be because of the multiple layers of library code and next.js shenanigans.

[pilcrowonpaper]

Do you know any packages that's version 4.14.1? Maybe it's related to the adapter and/or the database you're using, since it re-throws whatever the adapter/db driver throws.

[perrylets]

It's prisma

[pilcrowonpaper]

Found it: prisma/prisma#11533

[perrylets]

This is my UserAttributes type, maybe it has something to do with error.

type UserAttributes = Omit<
    Omit<import("@prisma/client").AuthUser, "id">,
    "role"
  > & {
    role?: import("@prisma/client").Role;
  };

The docs for lucia say that if a column has a default value, you can make the column optional.

[pilcrowonpaper]

I doubt it, types can’t affect runtime behaviors

[perrylets]

I meant that maybe I can't find the error because the types are wrong so it won't appear on vscode.

[perrylets]

I just remembered I changed the names of some columns. But I used @map so I think it should work. I need to check it.

[perrylets]

That was the problem with prisma

[perrylets]

Now the error is empty again, but it still gives code 500

[pilcrowonpaper]

Can you confirm that you can use Prisma at all? Not sure if it's a Lucia issue or a Prisma one.

[perrylets]

I can print the auth request:

{
  "validatePromise": null,
  "validateUserPromise": null,
  "auth": {
    "adapter": {},
    "env": "DEV",
    "csrfProtection": true,
    "sessionExpiresIn": {
      "activePeriod": 2678400,
      "idlePeriod": 0
    },
    "autoDatabaseCleanup": true,
    "sessionCookieOption": {
      "sameSite": "lax",
      "path": "/"
    },
    "hash": {},
    "origin": []
  },
  "context": {
    "request": {
      "url": "http://localhost:3000/api/oauth/github?code=CODE&state=STATE",
      "method": "GET",
      "headers": {
        "origin": null,
        "cookie": "auth_session=COOKIE_VALUE"
      }
    }
  }
}

So the error happens in one of these two lines:

authRequest.setSession(session);
return NextResponse.redirect("/", {
  status: 302
});

[perrylets]

The problem was with the redirect url, because behaviours where the documentation is only easy to find after the error ocurrs are my favorite.

I fixed it by doing this instead of the previous redirect

return NextResponse.redirect(new URL("/", req.nextUrl.hostname), {
  status: 302
});

[pilcrowonpaper]

Wtf, thanks!