feat: upgrade to latest next-auth v4 version (#4345)

* upgrade to latest v4

* Create warm-scissors-juggle.md

* Update .changeset/warm-scissors-juggle.md

* also check for flightcontrol platform

.changeset/warm-scissors-juggle.md

@@ -0,0 +1,6 @@
+---
+"@blitzjs/auth": patch
+"blitz": patch
+---
+
+feat: support next-auth version 4.24.7

apps/toolkit-app/package.json

@@ -33,7 +33,7 @@
     "@prisma/client": "4.6.1",
     "blitz": "2.0.9",
     "next": "canary",
-    "next-auth": "4.18.7",
+    "next-auth": "4.24.7",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",

package.json

@@ -47,7 +47,7 @@
   },
   "pnpm": {
     "patchedDependencies": {
-      "next-auth@4.18.7": "patches/next-auth@4.18.7.patch"
+      "next-auth@4.24.7": "patches/next-auth@4.24.7.patch"
     },
     "overrides": {
       "@types/mime": "3.0.4"

packages/blitz-auth/package.json

@@ -77,7 +77,7 @@
     "@types/react-dom": "17.0.14",
     "blitz": "2.0.9",
     "next": "canary",
-    "next-auth": "4.18.7",
+    "next-auth": "4.24.7",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "secure-password": "4.0.0",

packages/blitz-auth/src/server/adapters/next-auth/adapter.ts

@@ -107,13 +107,8 @@ export function NextAuthAdapter<P extends Provider[]>(
       providerId = providerId.split("?")[0]
     }
     const {options, cookies} = await init({
-      // @ts-ignore
-      url: new URL(
-        internalRequest.url,
-        process.env.APP_ORIGIN || process.env.BLITZ_DEV_SERVER_ORIGIN,
-      ),
       authOptions: config as unknown as AuthOptions,
-      host: internalRequest.url.host,
+      origin: internalRequest.origin,
       action,
       providerId,
       callbackUrl: req.body?.callbackUrl ?? (req.query?.callbackUrl as string),

packages/blitz-auth/src/server/adapters/next-auth/internals/utils/web.ts

@@ -74,16 +74,28 @@ export async function toInternalRequest(req: Request): Promise<
       providerId = providerIdOrAction
     }
 
+    const headers = Object.fromEntries(req.headers)
+    const detectOrigin = (host?: string, proto?: string) => {
+      if (process.env.VERCEL ?? process.env.FLIGHTCONTROL ?? process.env.AUTH_TRUST_HOST)
+        return `${proto === "http" ? "http" : "https"}://${host}`
+
+      return process.env.NEXTAUTH_URL
+    }
+
     return {
       url,
       action,
       providerId,
       method: req.method ?? "GET",
-      headers: Object.fromEntries(req.headers),
+      headers,
       body: req.body ? await readJSONBody(req.body) : undefined,
       cookies: parseCookie(req.headers.get("cookie") ?? "") ?? {},
       error: url.searchParams.get("error") ?? undefined,
       query: Object.fromEntries(url.searchParams),
+      origin: detectOrigin(
+        headers["x-forwarded-host"] ?? headers.host,
+        headers["x-forwarded-proto"],
+      ),
     }
   } catch (error) {
     return error as Error

patches/next-auth@4.24.7.patch

@@ -0,0 +1,23 @@
+diff --git a/package.json b/package.json
+index c89e03c41a03de738cfb0ad090a63c2e99dadc7b..a5f38083c24732651c427c2b2d17cbcb23495473 100644
+--- a/package.json
++++ b/package.json
+@@ -57,6 +57,18 @@
+     "./providers/*": {
+       "types": "./providers/*.d.ts",
+       "default": "./providers/*.js"
++    },
++    "./core/init": {
++      "types": "./core/init.d.ts",
++      "default": "./core/init.js"
++    },
++    "./core/lib/oauth/authorization-url": {
++      "types": "./core/lib/oauth/authorization-url.d.ts",
++      "default": "./core/lib/oauth/authorization-url.js"
++    },
++    "./core/lib/oauth/callback": {
++      "types": "./core/lib/oauth/callback.d.ts",
++      "default": "./core/lib/oauth/callback.js"
+     }
+   },
+   "files": [