Multiple providers used for getting refresh tokens - question about updating session

[mateioprea]

Question 💬

Hi!

I have a quick question about how to handle a certain situation. I've implemented my own credentials login, but right now I'm trying to connect multiple services to my user (google, bing, etc) to manage services in these account (let's say calendars).

Currently, I'm only interested in the refresh and access token. I'm only interested in using nextauth as a "middleman" to get these tokens. Is there any way to ignore the return of

profile(profile, tokens) {}

method on custom oauth providers?

Just curious if I'll have to implement the oauth flow by myself in order to not mess with next auth's already created credentials session.

How to reproduce ☕️

{
            id: "google",
            name: "Google",
            type: "oauth",
            version: "2.0",
            params: { grant_type: "authorization_code" },
            token: {
                url: 'https://accounts.google.com/o/oauth2/token'
            },
            userinfo: {
                url: 'https://www.googleapis.com/oauth2/v3/userinfo'
            },
            accessTokenUrl: "https://accounts.google.com/o/oauth2/token",
            requestTokenUrl: "https://accounts.google.com/o/oauth2/auth",
            authorization: {
                url: 'https://accounts.google.com/o/oauth2/v2/auth?prompt=consent&access_type=offline&response_type=code',
                params: {
                    scope: "openid email"
                }
            },
            async profile(profile, tokens) {
-----------> i don't want this to update my user id & session. 

            },
            clientId: process.env.GOOGLE_APP_ID,
            clientSecret: process.env.GOOGLE_APP_SECRET
        }

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[balazsorban44]

Have some code? Are you using an Adapter? What version are you on, etc.

Your above config doesn't make it easy, you mix v3 and v4 options.

[mateioprea]

Hi @balazsorban44 i was just testing stuff, that's why I have mixed v3 and v4 options.
I actually went ahead with next-connect and passport and implemented my own flows. :)

Couldn't close the issues so if you could do it for me, that will be great! Thanks for the fast response tho!

[balazsorban44]

sorry to hear that next-auth didn't work for you, unfortunately I did not get a reproduction/code to be able to more helpful. Glad you solved your problem though! 💚

[mateioprea]

next-auth actually handles the credentials flow which is really great!

Just for the sake of it, I'm using next-auth v4 and prisma as an Adapter.
I'm signing in users using my own Credentials provider, jwt enabled. Super basic:

CredentialsProvider({
            name: 'Credentials',
            credentials: {
                username: { label: "Username", type: "text"},
                password: {  label: "Password", type: "password" }
            },
            async authorize(credentials, req) {
                const user = await prisma.users.findUnique({
                    where: {
                        email: credentials.username
                    }
                });
                if (user) {
                    const result = await bcrypt.compareSync(credentials.password, user.password);
                    if (result) {
                        return user;
                    }
                    return null;
                }
                return null;
            }
        })

After this step, I want to use Google just for getting a refresh token/access token. I've implemented my own Credentials Provider with the following code:

{
            id: "google",
            name: "Google",
            type: "oauth",
            version: "2.0",
            params: { grant_type: "authorization_code" },
            token: {
                url: 'https://accounts.google.com/o/oauth2/token'
            },
            userinfo: {
                url: 'https://www.googleapis.com/oauth2/v3/userinfo'
            },
            accessTokenUrl: "https://accounts.google.com/o/oauth2/token",
            authorization: {
                url: 'https://accounts.google.com/o/oauth2/v2/auth?prompt=consent&access_type=offline&response_type=code',
                params: {
                    scope: "openid email https://www.googleapis.com/auth/adwords"
                }
            },
            async profile(profile, tokens) {
                // You can use the tokens, in case you want to fetch more profile information
                // For example several OAuth providers do not return email by default.
                // Depending on your provider, will have tokens like `access_token`, `id_token` and or `refresh_token`

            },
            clientId: process.env.GOOGLE_APP_ID,
            clientSecret: process.env.GOOGLE_APP_SECRET
        }

What I can see is that the custom provider will update the session with the profile returned by google oauth. Personally, I am not interested in updating the session with the user profile Google returns, I'm just interested in the tokens.
This is mostly what I want to do.

[balazsorban44]

I see. if I understand correctly, then you would be interested in this, right?: #2988

[mateioprea]

Yes, that seems exactly what I'm interested in.