Has anyone been able to get auth roles working with Prisma and v4

[MatD1]

I have been stuck on this for the last couple days, all the research I have done is just info about v3 which is not very useful at the moment.

I am interested if anyone has been able to get this working and could provide a repo or some info about it?

All of the code below is a mix of what I have put together so far, (not working) I thought atleast If I leave it here it may help.

[...nextauth].js

import NextAuth from "next-auth";
// import Twitch from "../../../providers/twitch";
import Auth0Provider from "next-auth/providers/auth0";
import AzureADProvider from "next-auth/providers/azure-ad";
import { PrismaAdapter } from "@next-auth/prisma-adapter"
import { PrismaClient } from "@prisma/client"
import models from "../../../models";

const prisma = new PrismaClient()

export default NextAuth({
    adapter: PrismaAdapter(prisma, {
        models: {
            User: models.User,
        }
    }),
    providers: [
      /*Twitch({
        clientId: process.env.TWITCH_CLIENT_ID,
        clientSecret: process.env.TWITCH_SECRET,
        scope: 'user:read:follows',
      })*/
      Auth0Provider({
        clientId: process.env.AUTH0_CLIENT_ID,
        clientSecret: process.env.AUTH0_CLIENT_SECRET,
        issuer: process.env.AUTH0_DOMAIN,
      }),
      AzureADProvider({
        clientId: process.env.AZURE_AD_CLIENT_ID,
        clientSecret: process.env.AZURE_AD_CLIENT_SECRET,
        tenantId: process.env.AZURE_AD_TENANT_ID,
      }),
    ],
    debug: true,
    secret: process.env.SECRET,
    session: {
        jwt: true,
        maxAge: 1000,
    },
    jwt: {
        secret: process.env.SECRET,

      },
      callbacks: {
          async redirect({url="/Factions", baseUrl="/"}){
              return url.startsWith('/Factions') ? url : baseUrl
          },
          async jwt({token, user, account, profile}) {
              if (account) {
                  token.accessToken = account.access_token
                  token.provider = account.provider
              }
              if (user?.roles) {
                  token.roles = user.roles

              }
              return token
          },
          async session({ session, token, user}) {
              if (token) {
                  session.accessToken = token.accessToken
              }
              if (token?.roles) {
                  session.user.roles = token.roles
              }
              return session
          }
      },
      events: {
         signIn: ({user}) => {
             console.log(user.name)
         },
        async signOut(message) { /* on signout */ },
      }
  });

schema.prisma

datasource db {
  provider = "postgresql"
  url      = "xxx"
  shadowDatabaseUrl = "xxx"
}

generator client {
  provider        = "prisma-client-js"
}

enum Role {
    User
    ADMIN
    SUPERADMIN
}

model Account {
  id                 String  @id @default(cuid())
  userId             String
  type               String
  provider           String
  providerAccountId  String
  refresh_token      String?  @db.Text
  access_token       String?  @db.Text
  expires_at         Int?
  token_type         String?
  scope              String?
  id_token           String?  @db.Text
  session_state      String?

  user User @relation(fields: [userId], references: [id], onDelete: Cascade)

  @@unique([provider, providerAccountId])
}

model Session {
  id           String   @id @default(cuid())
  sessionToken String   @unique
  userId       String
  expires      DateTime
  user         User     @relation(fields: [userId], references: [id], onDelete: Cascade)
}

model User {
  id            String    @id @default(cuid())
  name          String?
  email         String?   @unique
  emailVerified DateTime?
  image         String?
  accounts      Account[]
  sessions      Session[]
  roles         Role     @default(User)
}

model VerificationToken {
  identifier String
  token      String   @unique
  expires    DateTime

  @@unique([identifier, token])
}

/models/User.js

import { Adapter } from "next-auth/adapters"

// Extend the built-in models using class inheritance
export default class User extends Adapter.Prisma.Models.User.model {
  constructor(name, email, image, emailVerified, roles) {
    super(name, email, image, emailVerified)
    if (roles) { this.roles = roles}
  }
}

export const UserSchema = {
  name: "User",
  target: User,
  columns: {
    ...Adapter.Prisma.Models.User.schema.columns,
    roles: {
      type: "varchar",
      nullable: true
    },
  },
}

/models/index.js

import User, { UserSchema } from "./User"

export default {
  User: {
    model: User,
    schema: UserSchema
  }
}

[zanzlender]

If I understand correctly, you want to save the user's role into the session? If so, then yes I have but with a little different approach. I didn't even know you could use it like this, although I am using prisma 😅

Here is the simplified code:

Provider

CredentialsProvider({
        name: "Credentials",
        credentials: {
          username: { label: "Email", type: "text", placeholder: "Email" },
          password: { label: "Password", type: "password" },
        },
        async authorize(credentials, req) {
          let tempUser = await FindUser({          <-- function that uses prisma to query db, which also gives the role
            email: credentials?.["email"],               <-- I get it with ["email"] because I didn't change the default credentials object so typescript throws error if I do .email. As a note all params passed in signIn can be accessed like this although they arent visible with typescript - see below 
          });

          // If user found remove unnecessary attributes (skip if you don't need it but my function returns all data so I remove some of it)
          if (tempUser) {
            let user = {
              id: tempUser.id,
              email: tempUser.email,
              first_name: tempUser.first_name,
              last_name: tempUser.last_name,
              full_name: tempUser.full_name,
              profile_image: tempUser.profile_image,
              active: tempUser.active,
              provider: tempUser.provider,
              role: tempUser.role,
            };

            return user;
          } else {
            // If you return null then an error will be displayed advising the user to check their details.
            return null;
          }
        },
      }),

You don't need to modify signIn callback, but jwt and session yes.

JWT

jwt({ token, user, account, profile, isNewUser }) {
 // If - if you have multiple providers, because they return different user objects
 // and you need to check for undefined because sometimes jwt runs multiple times in a row, and in the second one the user data gets lost, or will overwrite what you have with undefined
 if (account?.provider === "credentials" && user !== undefined) {
      token.user = user;
 }

    return token;
},

Session

session({ session, token, user }) {
  // for credentials
  if (token.user !== undefined) {
    session.user = token.user;
  }

  return session;
},

This is how to add different params to Credentials signIn, as mentioned above

signIn("credentials", {
  redirect: false,
  password: "12345678",
  email: "[email protected]",
  someParam: "test123",
});

Hope it helps ✌

[MatD1]

Ahh okay I appreciate you outlining that, it is greatly helpful, So I would assume that you have Google and Facebook work with everything roles included? Just curious because it would save me time in having to create signup forms and all that. Thanks for the all help though I will mark everything as an answer!

[zanzlender]

No problem :)
And yes, it all works. I managed to do it all in the [nextauth].js file, although you could probably split it up so it's easier to understand. Here is a quick view of what I do where. I didn't put much code here because it is firstly important to understand what to do where, since I struggled with that when I first started. That is mostly because some providers have to be handled in specific callbacks and in specific order for them to do what you would want them to, and sometimes they can overwrite each other which is bad ofc. That's why I wrote my logic here plus some things I encountered during development.

Also this is a quick view of how callbacks are executed in order

CREDENTIALS
-> authorize --> signIn --> JWT (can be 1 or 2 times) --> session

G, FB
--> signIn --> JWT (can be 1 or 2 times) --> session

If you want you can also be like me and console.log everything so you see what it does. I did this for each callback to see how they execute in order:

--> for singIn callback

console.log("-------------------------------");
console.log("SIGNIN CALLBACK");
console.log("-------------------------------");
console.log("account");
console.log(account);
console.log("profile");
console.log(profile);
console.log("user");
console.log(user);
console.log("email");
console.log(email);
console.log("credentials");
console.log(credentials);

Anyways, this is the simplified code:

// Global variable to save user data which I want in session
let userData = {};

export default async function auth(req: NextApiRequest, res: NextApiResponse) {
  // Do whatever you want here, before the request is passed down to `NextAuth`
    return await NextAuth(req, res, {
    // Configure one or more authentication providers
    providers: [
      GoogleProvider({ ... }),
      FacebookProvider({ ... }),
      CredentialsProvider({
        async authorize(credentials, req) {ž
            // this code will activate first if user signs in with credentials
           
            // get all user data from database and if user is found return his data
            let user = findUser();  
            
           // what you return here will be passed to SignIn callback as the user prop, alternatively save to *userData* like with google and fb
            return user or null
        }
      }),
      // ...add more providers here
     ],
    callbacks: {
 
      // IMPORTANT NOTE! What I am doing, is basically using the email i get from Google/Fb to check with my database if I have them

      async signIn({ user, account, profile, email, credentials }) {
        // Here I split the logic for google and facebook because they are slightly different

        // logic for when user signs in with google
        if (account.provider === "google") {
             // Account is verified
             if (profile.email_verified && profile.email.endsWith("@gmail.com")) {
                 // Find the user in db from email
                 let tempUser = FindUser(profile.email)

                 if ( USER IS FOUND ) {
                      // save found user's data to global variable and return true to go directly to JWT callback
                      userData = tempUser
                      return true
                 }

                 if ( USER NOT FOUND ) {
                      //  register user 

                      // save found user's data to global variable and return true to go directly to JWT callback
                      userData = NewUserData
                      return true
                 }
             }
        }

        if (account.provider === "facebook") {
          // same logic as with google provider, however they return slightly different **profiles** so you need this do it separately, maybe you even don't depending what data you need.
          // for example when registering user i use the **profile** prop, but they are different
        }

        // if user logged in with credentials it will still pass through
        if (account.provider === "credentials") {
          // if user logged in with credentials and he came to this point, he is already authorized so let him through
          return true
        }
      
       // if it comes to this point it will just return false so it stops the auth process
       return false
      },
      jwt({ token, user, account, profile, isNewUser }) {
        // this callback executes in the order I mentioned but also on every reading or setting the session, like when using useSession()
       
        // save whatever data you want into token, token.user is created for user data already so you can just put it in there
        // notice that it's set to the global variable so we can use it here
       // doing it like this saves us some checks, because sometimes JWT runs multiple times, but doesn't keep the data in user, so the second time it comes it's undefined and it overwrites the token.user
        if (account?.provider === "google" || account?.provider === "facebook") {
          token.user = userData;
        }

        // here I'm not using the global variable, so I have to check for undefined like i mention above
        if (account?.provider === "credentials" && user !== undefined) {
          token.user = user;
        }
 
        // the token will be passed to session, including anything you saved in it
        return token;
      },
      session({ session, token, user }) {
        // runs lastly, here is where you actually save the data into the session object
        
        // if you need the access token from google or fb
        if (token.access_token) {
          session.access_token = token.access_token;
        }

        // save user data, and the check is because sometimes it was undefined idk why...
        if (token.user !== undefined) {
          session.user = token.user;
        }

        return session;
      },
}

Hope it helps you understand, if you want I can also post the whole code :)

[MatD1]

Ah okay this looks great, and yeah please if you can leave the full code not just for my sanity but for anyone else who comes across here in the same situation.

Again thanks for all the help!

[zanzlender]

This is the full code with all the console logs you need to see what's going on :) but without all the included types (which you can omit) and functions which I think are self explanatory by name, and are just functions with prisma that I posted in the earlier comment. I will also post the cleaner version below.

Also a quick reminder, on my project, because of a specific use case I had to pass the the user's role (admin, user) to nextauth and handle it there. That's why I declare a global variable that saves it temporarily. This might not be the best solution, and could lead to some errors, although I myself didn't encounter any yet.

FULL VERSION

import NextAuth, { User } from "next-auth";
import type { NextApiRequest, NextApiResponse } from "next";
import GoogleProvider from "next-auth/providers/google";
import FacebookProvider from "next-auth/providers/facebook";
import CredentialsProvider from "next-auth/providers/credentials";

let userT = "";  // user type - string
let userData = {};  // object to save user data

export default async function auth(req: NextApiRequest, res: NextApiResponse) {
  // Do whatever you want here, before the request is passed down to `NextAuth`

  // save user data only if not undefined, so it doesn't overwrite
  if (req.body.userType !== undefined) {
    userT = req.body.userType;
  }

  return await NextAuth(req, res, {
    // Configure one or more authentication providers
    providers: [
      GoogleProvider({
        clientId: process.env.GOOGLE_CLIENT_ID,
        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
        authorization: {
          params: {
            prompt: "consent",
            access_type: "offline",
            response_type: "code",
            userType: "user" || "admin",
          },
        },
      }),
      FacebookProvider({
        clientId: process.env.FACEBOOK_CLIENT_ID,
        clientSecret: process.env.FACEBOOK_CLIENT_SECRET,
      }),
      CredentialsProvider({
        name: "Credentials",
        credentials: {
          username: { label: "Email", type: "text", placeholder: "Email" },
          password: { label: "Password", type: "password" },
        },
        async authorize(credentials, req) {
          /**
           * This callback handle login with credentials,
           * if the user does not exist then null is returned
           * else the user's data will be set in session.user
           */
          console.log("-------------------------------");
          console.log("CREDENTIALS AUTHORIZATION CALLBACK");
          console.log("-------------------------------");
          console.log("credentials");
          console.log(credentials);

          let userType = credentials?.["userType"].toString();

          let tempUser = await FindUserByRoleAndEmail({
            email: credentials?.["email"],
            role: userType,
          });

          if (tempUser) {
            // Any object returned will be saved in `user` property of the JWT

            // Keep only necessary attributes
            let user = {
              id: tempUser.id,
              email: tempUser.email,
              first_name: tempUser.first_name,
              last_name: tempUser.last_name,
              full_name: tempUser.full_name,
              profile_image: tempUser.profile_image,
              active: tempUser.active,
              provider: tempUser.provider,
              role: userType,
            };

            return user;
          } else {
            // If you return null then an error will be displayed advising the user to check their details.
            return null;

            // You can also Reject this callback with an Error thus the user will be sent to the error page with the error message as a query parameter
          }
        },
      }),
      // ...add more providers here
    ],
    secret: process.env.JWT_SECRET,
    session: {
      strategy: "jwt",
      maxAge: 7 * 24 * 60 * 60, // session valid for 7 days
    },
    pages: {
      signIn: "/authentication/login",
      signOut: "/auth/signout",
      error: "/authentication/login", // Error code passed in query string as ?error=
      verifyRequest: "/auth/verify-request", // (used for check email message)
    },
    callbacks: {
      async signIn({ user, account, profile, email, credentials }) {
        console.log("-------------------------------");
        console.log("SIGNIN CALLBACK");
        console.log("-------------------------------");
        console.log("account");
        console.log(account);
        console.log("profile");
        console.log(profile);
        console.log("user");
        console.log(user);
        console.log("email");
        console.log(email);
        console.log("credentials");
        console.log(credentials);

        if (account.provider === "google") {
          console.log("GOOGLE PROVIDER LOGIN");

          // Account is verified
          if (profile.email_verified && profile.email.endsWith("@gmail.com")) {
            // Check if user or admin then check if in db
            if (userT === "user") {
              // Check if user exists, if not create a new one --> register him
              let tempUser = await FindUserByRoleAndEmail({
                email: profile.email,
                role: "user",
              });

              // If user is returned, he is already in databse, registered
              if (tempUser) {
                // Keep only necessary attributes
                userData = {
                  id: tempUser.id,
                  email: tempUser.email,
                  first_name: tempUser.first_name,
                  last_name: tempUser.last_name,
                  full_name: tempUser.full_name,
                  profile_image: tempUser.profile_image,
                  active: tempUser.active,
                  provider: tempUser.provider,
                  role: userT,
                };
                return true;
              }
              // If null we have to register him
              else {
                let newUser: UsersP = {
                  full_name: profile.name,
                  email: profile.email,
                  active: true,
                  profile_image: profile.image,
                  provider: account.provider,
                  id: "",
                };

                // try to create new user
                try {
                  let newUserRes = await CreateNewUser(newUser);

                  // If user is created we get the user object
                  if (newUserRes) {
                    // Keep only necessary attributes
                    userData = {
                      id: newUserRes.id,
                      email: newUserRes.email,
                      first_name: newUserRes.first_name,
                      last_name: newUserRes.last_name,
                      full_name: newUserRes.full_name,
                      profile_image: newUserRes.profile_image,
                      active: newUserRes.active,
                      provider: newUserRes.provider,
                      role: userT,
                    };
                    return true;
                  }
                  return false;
                } catch (error) {
                  console.log(
                    "ERROR While adding new User from Google SignIn callback"
                  );
                  return false;
                }
              }
            } else {
              // check if admin exists, if not create a new one --> register him
              let tempAdmin = await FindUserByRoleAndEmail({
                email: profile.email,
                role: "admin",
              });

              // If admin/admin is returned, he is already in databse, registered
              if (tempAdmin) {
                // Keep only necessary attributes
                userData = {
                  id: tempAdmin.id,
                  email: tempAdmin.email,
                  first_name: tempAdmin.first_name,
                  last_name: tempAdmin.last_name,
                  full_name: tempAdmin.full_name,
                  profile_image: tempAdmin.profile_image,
                  active: tempAdmin.active,
                  provider: tempAdmin.provider,
                  role: tempAdmin?.["role"],
                };
                return true;
              }
              // If null we have to register him
              else {
                let newAdmin: AdminsP = {
                  full_name: profile.name,
                  email: profile.email,
                  active: true,
                  profile_image: profile.image,
                  provider: account.provider,
                  role: "admin",
                  id: "",
                };

                console.log("\n\n\n\n\n\n\nNEW COACH");
                console.log(newAdmin);
                // try to create new admin in db
                try {
                  let newAdminRes = await CreateNewAdmin(newAdmin);

                  // If insert was successful we got the new admin object
                  if (newAdminRes) {
                    // Keep only necessary attributes
                    userData = {
                      id: newAdminRes.id,
                      email: newAdminRes.email,
                      first_name: newAdminRes.first_name,
                      last_name: newAdminRes.last_name,
                      full_name: newAdminRes.full_name,
                      profile_image: newAdminRes.profile_image,
                      active: newAdminRes.active,
                      provider: newAdminRes.provider,
                      role: newAdminRes.role,
                    };
                    return true;
                  }

                  return false;
                } catch (error) {
                  console.log(error);
                  console.log(
                    "ERROR While adding new Admin from Google SignIn callback"
                  );
                  return false;
                }
              }
            }
          }
        }

        if (account.provider === "facebook") {
          // Check if user or admin then check if in db
          if (userT === "user") {
            // Check if user exists, if not create a new one --> register him
            let tempUser = await FindUserByRoleAndEmail({
              email: profile.email,
              role: "user",
            });

            // If user is returned, he is already in databse, registered
            if (tempUser) {
              // Keep only necessary attributes
              userData = {
                id: tempUser.id,
                email: tempUser.email,
                first_name: tempUser.first_name,
                last_name: tempUser.last_name,
                full_name: tempUser.full_name,
                profile_image: tempUser.profile_image,
                active: tempUser.active,
                provider: tempUser.provider,
                role: userT,
              };
              return true;
            }
            // If null we have to register him
            else {
              let newUser: UsersP = {
                full_name: profile.name,
                email: profile.email,
                active: true,
                profile_image: profile.image,
                provider: account.provider,
                id: "",
              };

              // try to create new user
              try {
                let newUserRes = await CreateNewUser(newUser);

                // If user is created we get the user object
                if (newUserRes) {
                  // Keep only necessary attributes
                  userData = {
                    id: newUserRes.id,
                    email: newUserRes.email,
                    first_name: newUserRes.first_name,
                    last_name: newUserRes.last_name,
                    full_name: newUserRes.full_name,
                    profile_image: newUserRes.profile_image,
                    active: newUserRes.active,
                    provider: newUserRes.provider,
                    role: userT,
                  };
                  return true;
                }
                return false;
              } catch (error) {
                console.log(
                  "ERROR While adding new User from Google SignIn callback"
                );
                return false;
              }
            }
          } else {
            // check if admin exists, if not create a new one --> register him
            let tempAdmin = await FindUserByRoleAndEmail({
              email: profile.email,
              role: "admin",
            });

            // If admin/admin is returned, he is already in databse, registered
            if (tempAdmin) {
              // Keep only necessary attributes
              userData = {
                id: tempAdmin.id,
                email: tempAdmin.email,
                first_name: tempAdmin.first_name,
                last_name: tempAdmin.last_name,
                full_name: tempAdmin.full_name,
                profile_image: tempAdmin.profile_image,
                active: tempAdmin.active,
                provider: tempAdmin.provider,
                role: tempAdmin?.["role"],
              };
              return true;
            }
            // If null we have to register him
            else {
              let newAdmin: AdminsP = {
                full_name: profile.name,
                email: profile.email,
                active: true,
                profile_image: profile.image,
                provider: account.provider,
                role: "admin",
                id: "",
              };

              console.log("\n\n\n\n\n\n\nNEW COACH");
              console.log(newAdmin);
              // try to create new admin in db
              try {
                let newAdminRes = await CreateNewAdmin(newAdmin);

                // If insert was successful we got the new admin object
                if (newAdminRes) {
                  // Keep only necessary attributes
                  userData = {
                    id: newAdminRes.id,
                    email: newAdminRes.email,
                    first_name: newAdminRes.first_name,
                    last_name: newAdminRes.last_name,
                    full_name: newAdminRes.full_name,
                    profile_image: newAdminRes.profile_image,
                    active: newAdminRes.active,
                    provider: newAdminRes.provider,
                    role: newAdminRes.role,
                  };
                  return true;
                }

                return false;
              } catch (error) {
                console.log(error);
                console.log(
                  "ERROR While adding new Admin from Google SignIn callback"
                );
                return false;
              }
            }
          }
        }

        return true;
      },
      jwt({ token, user, account, profile, isNewUser }) {
        console.log("-------------------------------");
        console.log("JWT CALLBACK");
        console.log("-------------------------------");
        console.log("token");
        console.log(token);
        console.log("user");
        console.log(user);
        console.log("account");
        console.log(account);
        console.log("profile");
        console.log(profile);

        if (account?.provider === "google" || account.provider === "facebook") {
          token.user = userData;
        }

        if (account?.provider === "credentials" && user !== undefined) {
          token.user = user;
        }

        return token;
      },
      session({ session, token, user }) {
        // Return a cookie value as part of the session
        // This is read when `req.query.nextauth.includes("session") && req.method === "GET"`
        console.log("-------------------------------");
        console.log("SESSION CALLBACK");
        console.log("-------------------------------");
        console.log("session");
        console.log(session);
        console.log("token");
        console.log(token);
        console.log("user");
        console.log(user);

        // For google
        if (token?.profile != undefined) {
          session.user = token.profile;
        }

        if (token.access_token) {
          session.access_token = token.access_token;
        }

        // for credentials
        if (token.user !== undefined) {
          session.user = token.user;
        }

        return session;
      },
      redirect: async ({ url, baseUrl }) => {
        console.log("---------------------------");
        console.log("REDIRECT CALLBACK");
        console.log("---------------------------");
        console.log("URL");
        console.log(url);
        console.log("baseUrl");
        console.log(baseUrl);
        return baseUrl;
      },
    },
  });
}

// Function returns user/admin object from database if exists
// Otherwise returns null
async function FindUserByRoleAndEmail({
  email,
  role,
}: {
  email: string;
  role: "admin" | "user";
}): Promise<Users | Admines> {
  let userData: Users | Admines;

  try {
    if (role === "user") {
      userData = await GetUserByEmail(email);
    } else {
      userData = await GetAdminDataByEmail(email);
    }
  } catch (error) {
    console.log(error);
    return null;
  }

  return userData;
}

SHORT VERSION - without most comments

import NextAuth, { User } from "next-auth";
import type { NextApiRequest, NextApiResponse } from "next";
import GoogleProvider from "next-auth/providers/google";
import FacebookProvider from "next-auth/providers/facebook";
import CredentialsProvider from "next-auth/providers/credentials";

let userT = "";
let userData = {};

export default async function auth(req: NextApiRequest, res: NextApiResponse) {
  // Do whatever you want here, before the request is passed down to `NextAuth`

  // save user data only if not undefined, so it doesn't overwrite
  if (req.body.userType !== undefined) {
    userT = req.body.userType;
  }

  return await NextAuth(req, res, {
    // Configure one or more authentication providers
    providers: [
      GoogleProvider({
        clientId: process.env.GOOGLE_CLIENT_ID,
        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
        authorization: {
          params: {
            prompt: "consent",
            access_type: "offline",
            response_type: "code",
            userType: "user" || "admin",
          },
        },
      }),
      FacebookProvider({
        clientId: process.env.FACEBOOK_CLIENT_ID,
        clientSecret: process.env.FACEBOOK_CLIENT_SECRET,
      }),
      CredentialsProvider({
        name: "Credentials",
        credentials: {
          username: { label: "Email", type: "text", placeholder: "Email" },
          password: { label: "Password", type: "password" },
        },
        async authorize(credentials, req) {
          let userType = credentials?.["userType"].toString();

          let tempUser = await FindUserByRoleAndEmail({
            email: credentials?.["email"],
            role: userType,
          });

          if (tempUser) {
            // Any object returned will be saved in `user` property of the JWT

            // Keep only necessary attributes
            let user = {
              id: tempUser.id,
              email: tempUser.email,
              first_name: tempUser.first_name,
              last_name: tempUser.last_name,
              full_name: tempUser.full_name,
              profile_image: tempUser.profile_image,
              active: tempUser.active,
              provider: tempUser.provider,
              role: userType,
            };

            return user;
          } else {
            // If you return null then an error will be displayed advising the user to check their details.
            return null;

            // You can also Reject this callback with an Error thus the user will be sent to the error page with the error message as a query parameter
          }
        },
      }),
      // ...add more providers here
    ],
    secret: process.env.JWT_SECRET,
    session: {
      strategy: "jwt",
      maxAge: 7 * 24 * 60 * 60, // session valid for 7 days
    },
    pages: {
      signIn: "/authentication/login",
      signOut: "/auth/signout",
      error: "/authentication/login", // Error code passed in query string as ?error=
      verifyRequest: "/auth/verify-request", // (used for check email message)
    },
    callbacks: {
      async signIn({ user, account, profile, email, credentials }) {
        if (account.provider === "google") {
          // Account is verified
          if (profile.email_verified && profile.email.endsWith("@gmail.com")) {
            // Check if user or admin then check if in db
            if (userT === "user") {
              // Check if user exists, if not create a new one --> register him
              let tempUser = await FindUserByRoleAndEmail({
                email: profile.email,
                role: "user",
              });

              // If user is returned, he is already in databse, registered
              if (tempUser) {
                // Keep only necessary attributes
                userData = {
                  id: tempUser.id,
                  email: tempUser.email,
                  first_name: tempUser.first_name,
                  last_name: tempUser.last_name,
                  full_name: tempUser.full_name,
                  profile_image: tempUser.profile_image,
                  active: tempUser.active,
                  provider: tempUser.provider,
                  role: userT,
                };
                return true;
              }
              // If null we have to register him
              else {
                let newUser: UsersP = {
                  full_name: profile.name,
                  email: profile.email,
                  active: true,
                  profile_image: profile.image,
                  provider: account.provider,
                  id: "",
                };

                // try to create new user
                try {
                  let newUserRes = await CreateNewUser(newUser);

                  // If user is created we get the user object
                  if (newUserRes) {
                    // Keep only necessary attributes
                    userData = {
                      id: newUserRes.id,
                      email: newUserRes.email,
                      first_name: newUserRes.first_name,
                      last_name: newUserRes.last_name,
                      full_name: newUserRes.full_name,
                      profile_image: newUserRes.profile_image,
                      active: newUserRes.active,
                      provider: newUserRes.provider,
                      role: userT,
                    };
                    return true;
                  }
                  return false;
                } catch (error) {
                  console.log(
                    "ERROR While adding new User from Google SignIn callback"
                  );
                  return false;
                }
              }
            } else {
              // check if admin exists, if not create a new one --> register him
              let tempAdmin = await FindUserByRoleAndEmail({
                email: profile.email,
                role: "admin",
              });

              // If admin/admin is returned, he is already in databse, registered
              if (tempAdmin) {
                // Keep only necessary attributes
                userData = {
                  id: tempAdmin.id,
                  email: tempAdmin.email,
                  first_name: tempAdmin.first_name,
                  last_name: tempAdmin.last_name,
                  full_name: tempAdmin.full_name,
                  profile_image: tempAdmin.profile_image,
                  active: tempAdmin.active,
                  provider: tempAdmin.provider,
                  role: tempAdmin?.["role"],
                };
                return true;
              }
              // If null we have to register him
              else {
                let newAdmin: AdminsP = {
                  full_name: profile.name,
                  email: profile.email,
                  active: true,
                  profile_image: profile.image,
                  provider: account.provider,
                  role: "admin",
                  id: "",
                };

                // try to create new admin in db
                try {
                  let newAdminRes = await CreateNewAdmin(newAdmin);

                  // If insert was successful we got the new admin object
                  if (newAdminRes) {
                    // Keep only necessary attributes
                    userData = {
                      id: newAdminRes.id,
                      email: newAdminRes.email,
                      first_name: newAdminRes.first_name,
                      last_name: newAdminRes.last_name,
                      full_name: newAdminRes.full_name,
                      profile_image: newAdminRes.profile_image,
                      active: newAdminRes.active,
                      provider: newAdminRes.provider,
                      role: newAdminRes.role,
                    };
                    return true;
                  }

                  return false;
                } catch (error) {
                  console.log(error);
                  console.log(
                    "ERROR While adding new Admin from Google SignIn callback"
                  );
                  return false;
                }
              }
            }
          }
        }

        if (account.provider === "facebook") {
          // Check if user or admin then check if in db
          if (userT === "user") {
            // Check if user exists, if not create a new one --> register him
            let tempUser = await FindUserByRoleAndEmail({
              email: profile.email,
              role: "user",
            });

            // If user is returned, he is already in databse, registered
            if (tempUser) {
              // Keep only necessary attributes
              userData = {
                id: tempUser.id,
                email: tempUser.email,
                first_name: tempUser.first_name,
                last_name: tempUser.last_name,
                full_name: tempUser.full_name,
                profile_image: tempUser.profile_image,
                active: tempUser.active,
                provider: tempUser.provider,
                role: userT,
              };
              return true;
            }
            // If null we have to register him
            else {
              let newUser: UsersP = {
                full_name: profile.name,
                email: profile.email,
                active: true,
                profile_image: profile.image,
                provider: account.provider,
                id: "",
              };

              // try to create new user
              try {
                let newUserRes = await CreateNewUser(newUser);

                // If user is created we get the user object
                if (newUserRes) {
                  // Keep only necessary attributes
                  userData = {
                    id: newUserRes.id,
                    email: newUserRes.email,
                    first_name: newUserRes.first_name,
                    last_name: newUserRes.last_name,
                    full_name: newUserRes.full_name,
                    profile_image: newUserRes.profile_image,
                    active: newUserRes.active,
                    provider: newUserRes.provider,
                    role: userT,
                  };
                  return true;
                }
                return false;
              } catch (error) {
                console.log(
                  "ERROR While adding new User from Google SignIn callback"
                );
                return false;
              }
            }
          } else {
            // check if admin exists, if not create a new one --> register him
            let tempAdmin = await FindUserByRoleAndEmail({
              email: profile.email,
              role: "admin",
            });

            // If admin/admin is returned, he is already in databse, registered
            if (tempAdmin) {
              // Keep only necessary attributes
              userData = {
                id: tempAdmin.id,
                email: tempAdmin.email,
                first_name: tempAdmin.first_name,
                last_name: tempAdmin.last_name,
                full_name: tempAdmin.full_name,
                profile_image: tempAdmin.profile_image,
                active: tempAdmin.active,
                provider: tempAdmin.provider,
                role: tempAdmin?.["role"],
              };
              return true;
            }
            // If null we have to register him
            else {
              let newAdmin: AdminsP = {
                full_name: profile.name,
                email: profile.email,
                active: true,
                profile_image: profile.image,
                provider: account.provider,
                role: "admin",
                id: "",
              };

              // try to create new admin in db
              try {
                let newAdminRes = await CreateNewAdmin(newAdmin);

                // If insert was successful we got the new admin object
                if (newAdminRes) {
                  // Keep only necessary attributes
                  userData = {
                    id: newAdminRes.id,
                    email: newAdminRes.email,
                    first_name: newAdminRes.first_name,
                    last_name: newAdminRes.last_name,
                    full_name: newAdminRes.full_name,
                    profile_image: newAdminRes.profile_image,
                    active: newAdminRes.active,
                    provider: newAdminRes.provider,
                    role: newAdminRes.role,
                  };
                  return true;
                }

                return false;
              } catch (error) {
                console.log(error);
                console.log(
                  "ERROR While adding new Admin from Google SignIn callback"
                );
                return false;
              }
            }
          }
        }

        return true;
      },
      jwt({ token, user, account, profile, isNewUser }) {
        if (account?.provider === "google" || account.provider === "facebook") {
          token.user = userData;
        }

        if (account?.provider === "credentials" && user !== undefined) {
          token.user = user;
        }

        return token;
      },
      session({ session, token, user }) {
        // Return a cookie value as part of the session

        // For google
        if (token?.profile != undefined) {
          session.user = token.profile;
        }

        if (token.access_token) {
          session.access_token = token.access_token;
        }

        // for credentials
        if (token.user !== undefined) {
          session.user = token.user;
        }

        return session;
      },
    },
  });
}

// Function returns user/admin object from database if exists
// Otherwise returns null
async function FindUserByRoleAndEmail({
  email,
  role,
}: {
  email: string;
  role: "admin" | "user";
}): Promise<Users | Admines> {
  let userData: Users | Admines;

  try {
    if (role === "user") {
      userData = await GetUserByEmail(email);
    } else {
      userData = await GetAdminDataByEmail(email);
    }
  } catch (error) {
    console.log(error);
    return null;
  }

  return userData;
}

[MatD1]

Again huge thanks I am sure a lot of others will find this info just as useful as I have!