`lib/auth.ts`

68 lines
import { NextAuthOptions } from 'next-auth'
import GoogleProvider from 'next-auth/providers/google'

export const authOptions: NextAuthOptions = {
  providers: [
    GoogleProvider({
      clientId: process.env.GOOGLE_CLIENT_ID!,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
      authorization: {
        params: {
          prompt: "select_account consent",
          access_type: "offline",
          response_type: "code",
          include_granted_scopes: true,
          // Force account chooser even if single account
          login_hint: undefined,
          // Removed hd parameter to allow any domain
        }
      }
    })
  ],
  callbacks: {
    async session({ session, token }) {
      // Add user ID to session
      if (session?.user) {
        (session.user as any).id = token.sub!
      }
      return session
    },
    async jwt({ token, user, account }) {
      // Persist the OAuth access_token to the token right after signin
      if (account) {
        token.accessToken = account.access_token
      }
      return token
    },
    async signIn({ user, account, profile }) {
      // You can add custom logic here to save user to database
      console.log('[AUTH] User signed in:', user.email)
      return true // Allow sign in
    }
  },
  pages: {
    // Both must point at /auth/signin — it's the page that renders the
    // ?error= banner; '/' silently swallowed every auth error code.
    signIn: '/auth/signin',
    error: '/auth/signin',
  },
  session: {
    strategy: 'jwt',
    maxAge: 30 * 24 * 60 * 60, // 30 days
    updateAge: 24 * 60 * 60, // Refresh session every 24 hours
  },
  cookies: {
    sessionToken: {
      name: `next-auth.session-token`,
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        // Secure on prod (bubbe.ai is HTTPS-only); plain http://localhost dev
        // would reject a Secure cookie, so key off NODE_ENV.
        secure: process.env.NODE_ENV === 'production'
      }
    }
  },
  secret: process.env.NEXTAUTH_SECRET,
}