Adding custom properties from Discord

[ariscript]

I am trying to authenticate users with Discord using the "identify" and "guilds" scopes. It seems to be possible to add the user info provided by Discord into the token into token.profile (note I am also including the guilds array there as well) using this code:

async jwt(token, user, account, profile, isNewUser) {
    if (profile) token.profile = profile;
    if (account?.accessToken) token.accessToken = account.accessToken;

    const data = await (
        await fetch("https://discord.com/api/v8/users/@me/guilds", {
            method: "GET",
            headers: {
                Authorization: `Bearer ${account?.accessToken}`,
            },
        })
    ).json();

    // @ts-ignore
    token.profile.guilds = data;

    return token;
},

But, as soon as I add a session function that adds the profile object into the session, the session becomes null all the time even when signed in, and the login screen from Discord prompts me to enter username and password instead of just automatically letting me in.

// @ts-ignore
async session(session, token) {
    console.log("token", token);
    console.log("session", session);

    // @ts-ignore
    session.profile = token.profile;

    return session;
},

As a side-note, the reason I have to add so many @ts-ignores in the session function is that it expects a Promise<WithAdditionalParams<Session>> while I only return a Promise<Session>, not sure how to fix that.

Can anyone help me add the information I receive from Discord into the session so that I can use it in my application?

[balazsorban44]

You should do all the logic in the same if block, otherwise things will be overridden. Check the docs: https://next-auth.js.org/configuration/callbacks#jwt-callback

user, account, profile, isNewUser are only available at signIn. You can check any of them, all the others will also exist actually. Try:

export default NextAuth({
  callbacks: {
    async jwt(token, user, account, profile, isNewUser) {
      // Sign-in
      if (user) {
        token.profile = user;
        token.accessToken = account.accessToken;
        const res = await fetch("https://discord.com/api/v8/users/@me/guilds", {
          headers: { Authorization: `Bearer ${account.accessToken}` },
        })
        const data = await res.json()
        token.profile.guilds = data
      }
      return token
    },
    session(session, token) {
      session.profile = token.profile
      return session;
    },
  }
  providers: [
    Providers.Discord({
      clientId: process.env.CLIENT_ID,
      clientSecret: process.env.CLIENT_SECRET,
      profile(profile) {
        // What you return here will be the same as the second argument in the jwt() callback at signin.
        return
      }
    })
  ]
})

The fourth parameter is actually ALL the information the provider will return, you probably don't need everything. You can filter it down with the provider's profile callback.

Regarding TS, better typings are coming built-in. Follow #1649

[ariscript]

I made this work by fetching and setting guilds in the session callback as opposed to jwt. I feel like the documentation for this could get a good rework after 2 days of headscratching.

[balazsorban44]

you can fetch extra information in the profile callback. The second param will contain access token. The profile callback is only invoked on signin

You definitely don't want to fetch data in the session callback. it will contact discord on each request for the session endpoint

https://next-auth.js.org/configuration/providers#using-a-custom-provider

You could try wrapping your async call in a try..catch when fetching guild, and see if the problem happens there

[ariscript]

I tried to put the request in the profile function, and the session immediately became null. In the token, the profile object seems to be correct, but once again, it session seems to never get called.

[balazsorban44]

and you don't get an error in your console either?

When the fetch call is either in jwt or profile, do you get to log it right after the res.json call? if not it would indicate a failed request and would explain the problem try to wrap it in a try..catch

[ariscript]

Yes, the request doesn't fail and logs properly, but nothing in session ever runs. Here is my code for reference: https://sourceb.in/HHhY2G8n0h