Credentials Provider does not allow non-standard JSON in session user object

[un-focused]

Description 🐜

I implemented the Credentials Provider for the FLOW Wallet since OAuth does not work there, & then it wasn't adding the user in the session. I then tried the sample which worked! However any nested object I added did not show up which means the JSON User would only be one dimensional!

Here is the provider BEFORE:

CredentialsProvider(
                {
                    name: 'SAMPLE',
                    type: 'credentials',
                    credentials: {},
                    authorize: async (credentials: any, req) => {
                        const user = { id: 1, name: 'SAMPLE NAME', email: '[email protected]' };

                        if (user) {
                            // Any object returned will be saved in `user` property of the JWT
                            return user;
                        } else {
                            // If you return null or false then the credentials will be rejected
                            return null
                            // You can also Reject this callback with an Error or with a URL:
                            // throw new Error('error message') // Redirect to error page
                            // throw '/path/to/redirect'        // Redirect to a URL
                        }
                    }
                }
            )

Here is the provider AFTER:

CredentialsProvider(
                {
                    name: 'SAMPLE',
                    type: 'credentials',
                    credentials: {},
                    authorize: async (credentials: any, req) => {
                        const user = { id: 1, name: 'SAMPLE NAME', email: '[email protected]', userProfile: { id: 2, username: 'abc' } };

                        if (user) {
                            // Any object returned will be saved in `user` property of the JWT
                            return user;
                        } else {
                            // If you return null or false then the credentials will be rejected
                            return null
                            // You can also Reject this callback with an Error or with a URL:
                            // throw new Error('error message') // Redirect to error page
                            // throw '/path/to/redirect'        // Redirect to a URL
                        }
                    }
                }
            )

Here is what useSession returns in the session variable

Is this a bug in your own project?

No

How to reproduce ☕️

I implemented the Credentials Provider for the FLOW Wallet since OAuth does not work there, & then it wasn't adding the user in the session. I then tried the sample which worked! However any nested object I added did not show up which means the JSON User would only be one dimensional!

Here is the provider BEFORE:

CredentialsProvider(
                {
                    name: 'SAMPLE',
                    type: 'credentials',
                    credentials: {},
                    authorize: async (credentials: any, req) => {
                        const user = { id: 1, name: 'SAMPLE NAME', email: '[email protected]' };

                        if (user) {
                            // Any object returned will be saved in `user` property of the JWT
                            return user;
                        } else {
                            // If you return null or false then the credentials will be rejected
                            return null
                            // You can also Reject this callback with an Error or with a URL:
                            // throw new Error('error message') // Redirect to error page
                            // throw '/path/to/redirect'        // Redirect to a URL
                        }
                    }
                }
            )

Here is the provider AFTER:

CredentialsProvider(
                {
                    name: 'SAMPLE',
                    type: 'credentials',
                    credentials: {},
                    authorize: async (credentials: any, req) => {
                        const user = { id: 1, name: 'SAMPLE NAME', email: '[email protected]', userProfile: { id: 2, username: 'abc' } };

                        if (user) {
                            // Any object returned will be saved in `user` property of the JWT
                            return user;
                        } else {
                            // If you return null or false then the credentials will be rejected
                            return null
                            // You can also Reject this callback with an Error or with a URL:
                            // throw new Error('error message') // Redirect to error page
                            // throw '/path/to/redirect'        // Redirect to a URL
                        }
                    }
                }
            )

Here is what useSession returns in the session variable

Screenshots / Logs 📽

Environment 🖥

System:
OS: macOS 12.0.1
CPU: (10) arm64 Apple M1 Pro
Memory: 92.11 MB / 16.00 GB
Shell: 5.8 - /bin/zsh
Binaries:
Node: 17.2.0 - /opt/homebrew/bin/node
npm: 8.1.4 - /opt/homebrew/bin/npm
Browsers:
Chrome: 96.0.4664.93
Firefox: 95.0
Safari: 15.1
npmPackages:
next: 12.0.2 => 12.0.2
next-auth: ^4.0.5 => 4.0.5
react: 17.0.2 => 17.0.2

Contributing 🙌🏽

Yes, I am willing to help solve this bug in a PR

[un-focused]

[un-focused]

async jwt({ token, account, user }) {
                console.log('account', account);
                console.log('user', user);
}

[un-focused]

async session(params: {session: Session, user: User, token: JWT}) {
                const { session, user, token } = params;

                console.log('session user', user);
    
                return session;
            }

[un-focused]

Here is my logging code, the user is defined in the JWT callback but not the session callback. In the credentials provider doc, it states that you need JWT enabled, so I'm assuming I can manually do it using the token.user object. In the docs, it states that what you return will be used (it says JWT token). So is it safe to assume that this the credentials user is not valid in the session?

[un-focused]

(property) DefaultSession.user?: {
    name?: string | null | undefined;
    email?: string | null | undefined;
    image?: string | null | undefined;
} | undefined

This is an error I receive when I try to assign the token user to the session user. The session user seems to have a particular type to follow. This is not clear in the documentation. Is the session user standardized?

[un-focused]

Any updates?

[choutkamartin]

Yes, by default, a user in session contains only name, email and image properties. The session also has expires property. It's not a bug, and its documented here: https://next-auth.js.org/configuration/callbacks#session-callback
How to accomplish what you are trying to do is explained in this discussion: #2762 (reply in thread)