fix: allow login with credentials on production (#4288)

apps/server/src/modules/auth/guard.ts

@@ -77,6 +77,10 @@ class AuthGuard implements CanActivate {
     if (isPublic) {
       return true;
     } else if (!token) {
+      if (!req.cookies) {
+        return isPublicable;
+      }
+
       const session = await AuthHandler({
         req: {
           cookies: req.cookies,

apps/server/src/modules/auth/next-auth-options.ts

@@ -85,7 +85,7 @@ export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
       adapter: prismaAdapter,
       debug: !config.node.prod,
       session: {
-        strategy: config.node.prod ? 'database' : 'jwt',
+        strategy: 'database',
       },
       logger: {
         debug(code, metadata) {

apps/server/src/modules/auth/next-auth.controller.ts

@@ -17,7 +17,7 @@ import { hash, verify } from '@node-rs/argon2';
 import type { User } from '@prisma/client';
 import type { NextFunction, Request, Response } from 'express';
 import { pick } from 'lodash-es';
-import type { AuthAction, NextAuthOptions } from 'next-auth';
+import type { AuthAction, CookieOption, NextAuthOptions } from 'next-auth';
 import { AuthHandler } from 'next-auth/core';
 
 import { Config } from '../../config';
@@ -29,6 +29,8 @@ import { AuthService } from './service';
 
 const BASE_URL = '/api/auth/';
 
+const DEFAULT_SESSION_EXPIRE_DATE = 2592000 * 1000; // 30 days
+
 @Controller(BASE_URL)
 export class NextAuthController {
   private readonly callbackSession;
@@ -69,7 +71,11 @@ export class NextAuthController {
       .slice(BASE_URL.length) // make relative to baseUrl
       .replace(/\?.*/, '') // remove query part, use only path part
       .split('/') as [AuthAction, string]; // as array of strings;
-    if (providerId === 'credentials') {
+
+    const credentialsSignIn =
+      req.method === 'POST' && providerId === 'credentials';
+    let userId: string | undefined;
+    if (credentialsSignIn) {
       const { email } = req.body;
       if (email) {
         const user = await this.prisma.user.findFirst({
@@ -83,6 +89,7 @@ export class NextAuthController {
           req.body = null;
           throw new NotFoundException(`User not found`);
         } else {
+          userId = user.id;
           req.body = {
             ...req.body,
             name: user.name,
@@ -140,6 +147,29 @@ export class NextAuthController {
       }
     }
 
+    let nextAuthTokenCookie: (CookieOption & { value: string }) | undefined;
+    // next-auth credentials login only support JWT strategy
+    // https://next-auth.js.org/configuration/providers/credentials
+    // let's store the session token in the database
+    if (
+      credentialsSignIn &&
+      (nextAuthTokenCookie = cookies?.find(
+        ({ name }) => name === 'next-auth.session-token'
+      ))
+    ) {
+      const cookieExpires = new Date();
+      cookieExpires.setTime(
+        cookieExpires.getTime() + DEFAULT_SESSION_EXPIRE_DATE
+      );
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      await this.nextAuthOptions.adapter!.createSession!({
+        sessionToken: nextAuthTokenCookie.value,
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        userId: userId!,
+        expires: cookieExpires,
+      });
+    }
+
     if (redirect?.endsWith('api/auth/error?error=AccessDenied')) {
       this.logger.log(`Early access redirect headers: ${req.headers}`);
       this.metrics.authFailCounter(1, {