Authentication and Sessions | blade47/dub Wiki | doc0

Public

Authentication and Sessions | blade47/dub Wiki | doc0

Option	Value / Strategy	Purpose
`adapter`	`CustomPrismaAdapter(prisma)`	Connects NextAuth models to the underlying database via Prisma
`session.strategy`	`"jwt"`	Maintains stateless sessions using encrypted JSON Web Tokens
`cookies.sessionToken.name`	`__Secure-next-auth.session-token` (Production) / `next-auth.session-token` (Local)	Determines cookie prefix based on `VERCEL_DEPLOYMENT`
`cookies.sessionToken.options.httpOnly`	`true`	Prevents client-side script access to the session cookie
`cookies.sessionToken.options.sameSite`	`"lax"`	Mitigates CSRF vulnerabilities across cross-site requests
`cookies.sessionToken.options.domain`	`".dub.co"` (Production) / `undefined` (Local)	Scopes cookie domain appropriately for local development vs production
`pages.signIn`	`"/login"`	Custom redirect path for sign-in operations
`pages.error`	`"/login"`	Custom redirect path for authentication errors

Error Code Key	Display Message / Action
`no-credentials`	Please provide an email and password.
`invalid-credentials`	Email or password is incorrect.
`exceeded-login-attempts`	Account has been locked due to too many login attempts. Please contact support to unlock your account.
`too-many-login-attempts`	Too many login attempts. Please try again later.
`email-not-verified`	Please verify your email address.
`require-saml-sso`	Your organization requires authentication through your company's identity provider.
`EmailSignin`	Failed to send login email. Please try again in a minute or contact support.
`Callback`	We encountered an issue processing your request. Please try again or contact support if the problem persists.
`OAuthSignin`	There was an issue signing you in. Please ensure your provider settings are correct.
`OAuthCallback`	We faced a problem while processing the response from the OAuth provider. Please try again.
`OAuthAccountNotLinked`	It looks like you already have an account with this email. Please sign in with your account email instead.

// GET /api/oauth/userinfo - get user info by access token
export async function GET(req: NextRequest) {
  try {
    const accessToken = getAuthTokenOrThrow(req);
 
    const tokenRecord = await prisma.restrictedToken.findFirst({
      where: {
        hashedKey: await hashToken(accessToken),
        expires: {
          gte: new Date(),
        },
        installationId: {
          not: null,
        },
      },
      select: {
        user: {
          select: {
            id: true,
            name: true,
            image: true,
          },
        },
        project: {
          select: {
            id: true,
            name: true,
            slug: true,
            logo: true,
          },
        },
      },
    });
 
    if (!tokenRecord) {
      throw new DubApiError({
        code: "unauthorized",
        message: "Access token not found or expired.",
      });
    }
 
    const { user } = tokenRecord;
 
    const userInfo = {
      id: user.id,
      name: user.name,
      image: user.image,
      workspace: {
        id: prefixWorkspaceId(tokenRecord.project.id),
        slug: tokenRecord.project.slug,
        name: tokenRecord.project.name,
        logo: tokenRecord.project.logo,
      },
    };
 
    return NextResponse.json(userInfo, {
      headers: CORS_HEADERS,
    });
  } catch (e) {
    return handleAndReturnErrorResponse(e, CORS_HEADERS);
  }
}

Route File	Method	Description
`apps/web/app/api/me/route.ts`	`GET`	Fetches the complete unique user record corresponding to `session.user.id`.
`apps/web/app/api/user/tokens/route.ts`	`GET`	Queries all tokens belonging to `session.user.id`, sorted by `lastUsed` then `createdAt` descending.
`apps/web/app/api/user/tokens/route.ts`	`DELETE`	Deletes a specific token filtered by record `id` and `userId: session.user.id`.

Hostname / Path Condition	Target Middleware Handler / Action
`isAppHostname(domain)` (e.g., `app.dub.co`)	`AppMiddleware(req)`
`API_HOSTNAMES.has(domain)`	`ApiMiddleware(req)`
`path.startsWith("/stats/")`	Rewrites to `/${domain}/[key]/stats`
`path.startsWith("/.well-known/")`	Rewrites to `/wellknown/${domain}/${file}`
`domain === "dub.sh"`	Redirects via `DEFAULT_REDIRECTS[key]`
`ADMIN_HOSTNAMES.has(domain)`	`AdminMiddleware(req)`
`PARTNERS_HOSTNAMES.has(domain)`	`PartnersMiddleware(req)`
`isValidUrl(fullKey)`	`CreateLinkMiddleware(req)`
Default fallback	`LinkMiddleware(req, ev)`

export async function getUserViaToken(req: NextRequest) {
  const session = (await getToken({
    req,
    secret: process.env.NEXTAUTH_SECRET,
  })) as {
    email?: string;
    user?: UserProps;
  };
 
  return session?.user;
}

export async function WorkspacesMiddleware(req: NextRequest, user: UserProps) {
  const { path, searchParamsObj, searchParamsString } = parse(req);
 
  if (
    searchParamsObj.next &&
    isValidInternalRedirect({
      redirectPath: searchParamsObj.next,
      currentUrl: req.url,
    })
  ) {
    return NextResponse.redirect(new URL(searchParamsObj.next, req.url));
  }
 
  const defaultWorkspace = await getDefaultWorkspace(user);
 
  if (defaultWorkspace) {
    let redirectPath = path;
    if (["/", "/login", "/register"].includes(path)) {
      redirectPath = "";
    } else if (isTopLevelSettingsRedirect(path)) {
      redirectPath = `/settings/${path}`;
    }
 
    if (!redirectPath) {
      const product = await getWorkspaceProduct(defaultWorkspace);
      redirectPath = `/${product}`;
    }
 
    return NextResponse.redirect(
      new URL(
        `/${defaultWorkspace}${redirectPath}${searchParamsString}`,
        req.url,
      ),
    );
  }
 
  const projectInvite = await prismaEdge.projectInvite.findFirst({
    where: { email: user.email },
    select: { project: { select: { slug: true } } },
  });
 
  if (projectInvite) {
    return NextResponse.redirect(
      new URL(`/${projectInvite.project.slug}/invite`, req.url),
    );
  }
 
  return NextResponse.redirect(new URL("/onboarding/workspace", req.url));
}

export const POST = withSession(async ({ session }) => {
  const user = await prisma.user.findFirst({
    where: {
      id: session.user.id,
      isMachine: false,
      passwordHash: null,
    },
    select: {
      id: true,
    },
  });
 
  if (!user) {
    throw new DubApiError({
      code: "bad_request",
      message:
        "You already have a password set. You can change it in your account settings.",
    });
  }
 
  const { token } = await prisma.passwordResetToken.create({
    data: {
      identifier: session.user.email,
      token: randomBytes(32).toString("hex"),
      expires: new Date(Date.now() + PASSWORD_RESET_TOKEN_EXPIRY * 1000),
    },
  });

  // Send email with password reset link
  await sendEmail({
    subject: "Dub: Password reset instructions",
    to: session.user.email,
    react: ResetPasswordLink({
      email: session.user.email,
      url: `${process.env.NEXTAUTH_URL}/auth/reset-password/${token}`,
    }),
  });
 
  if (process.env.NODE_ENV === "development") {
    console.info(
      "Password reset URL:",
      `${process.env.NEXTAUTH_URL}/auth/reset-password/${token}`,
    );
  }
 
  return NextResponse.json({ ok: true });
});

type ImpersonateIdentifier =
  | { type: "email"; email: string }
  | { type: "slug"; slug: string }
  | { type: "domain"; domain: string }
  | { type: "stripeCustomerId"; stripeCustomerId: string };
 
function parseImpersonateQuery(
  raw: unknown,
): ImpersonateIdentifier | { error: string } {
  if (typeof raw !== "string" || !raw.trim()) {
    return {
      error:
        "Enter a user email, workspace slug, domain, or Stripe customer ID",
    };
  }
 
  let query = raw.trim();
  if (query.toLowerCase().startsWith("mailto:")) {
    query = query.slice(7).trim();
    }
// ...

  const data = {
    email: response.email,
    workspaces: await serializeWorkspaces(
      response.projects.map(({ project }) => project),
    ),
    programs:
      response.partners.length > 0
        ? response.partners[0].partner.programs.map(({ program, ...rest }) => ({
            ...program,
            ...rest,
          }))
        : [],
    impersonateUrl: await getImpersonateUrl(response.email),
  };
 
  return NextResponse.json(data);
});

// Tracks emails signing in via admin impersonation links. Populated in
// CustomPrismaAdapter.useVerificationToken before the token is deleted.
const pendingAdminImpersonations = new Set<string>();
 
export const markAdminImpersonation = (email: string) => {
  pendingAdminImpersonations.add(email.toLowerCase());
};
 
export const consumeAdminImpersonation = (email: string) => {
  const isAdminImpersonation = pendingAdminImpersonations.has(
    email.toLowerCase(),
  );
 
  if (isAdminImpersonation) {
    pendingAdminImpersonations.delete(email.toLowerCase());
  }
 
  return isAdminImpersonation;
};

export async function AdminMiddleware(req: NextRequest) {
  const { path } = parse(req);
 
  const user = await getUserViaToken(req);
 
  if (!user && path !== "/login") {
    return NextResponse.redirect(new URL("/login", req.url));
  } else if (user) {
    const isAdminUser = await prismaEdge.projectUsers.findUnique({
      where: {
        userId_projectId: {
          userId: user.id,
          projectId: DUB_WORKSPACE_ID,
        },
      },
    });
 
    if (!isAdminUser) {
      return NextResponse.next(); // throw 404 page
    } else if (
      path === "/login" ||
      !canAccessAdminPath({ userId: user.id, pathname: path })
    ) {
      return NextResponse.redirect(new URL("/", req.url));
    }
  }
 
  return NextResponse.rewrite(
    new URL(`/admin.dub.co${path === "/" ? "" : path}`, req.url),
  );
}