Repository navigation
refactor(web): move NextAuth sign-in config and landing redirect out of lib/user/server - #6894
Merged
Merged
Conversation
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryThe PR branch was rebased onto the current Files Reviewed (0 changed since last review)
Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0 Review guidance: REVIEW.md from base branch Previous Review Summaries (2 snapshots, latest commit 40b9c7d)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 40b9c7d)Status: No Issues Found | Recommendation: Merge Executive SummaryIncremental review of the single new commit (test-only change to the native token route test) found no issues; the Files Reviewed (1 file, incremental)
Previous review (commit 5336c50)Status: No Issues Found | Recommendation: Merge Files Reviewed (127 files)
Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0 Review guidance: REVIEW.md from base branch |
This was referenced Sep 29, 2026
The post-sign-in landing path pulls in sales demos, verified domains, seat purchases and trial classification, none of which request authentication uses. It moves unchanged, with its personal-account fallback, to lib/user/profile-redirect-path.
…er/server getUserFromAuth reads sessions with getServerSession(authOptions), so every request that authenticates loaded all sign-in providers and callbacks: account creation and linking, passkeys, magic links, SSO, verified-domain joins, Impact attribution, PostHog and the ChatGPT connection store. lib/user/server now reads sessions with sessionAuthOptions, the options a session read uses: secret, logger, pages, debug and the jwt and session callbacks. getServerSession drops providers, and a session read calls the jwt callback without a trigger, for which the full callback already returns the token unchanged, so session reads behave as before. The sign-in configuration moves unchanged to lib/user/next-auth-options, where authOptions extends sessionAuthOptions with the cookies, providers and the signIn and full jwt callbacks.
Jest also runs the @/lib/posthog mock factory while it generates the automatic @/lib/user mock. Now that lib/user/server no longer imports lib/user, that happens after the route created its PostHog client, so the factory replaced the capture mock the test asserts on. The factory now reuses one capture mock.
chrarnoldus
force-pushed
the
refactor/web-shared-prep
branch
from
September 29, 2026 15:11
40b9c7d to
fb70b48
Compare
chrarnoldus
changed the title
chrarnoldus
changed the title
eshurakov
approved these changes
Sep 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR moves the NextAuth sign-in configuration and the post-sign-in landing logic out of
lib/user/server. After this,getUserFromAuthand the other request-authentication functions no longer import the sign-in flows.getProfileRedirectPathunchanged tolib/user/profile-redirect-path, together with its personal-account fallback.lib/user/next-auth-options. That coversauthOptions,nextAuthHttpHandler, the providers, thesignInandjwtcallbacks, the profile parsers andTurnstileJwtPayload.sessionAuthOptionstolib/user/serverand uses it for session reads (getUserFromSessionand the session path ofgetUserFromAuth). It holds the secret, logger, pages, debug flag, thesessioncallback, and ajwtcallback that returns the token.authOptionsextends it with the cookies, providers and sign-in callbacks.sessionAuthOptionsandauthOptionsread sessions with the same configuration.@/lib/usermock, which now happens after the route has created its PostHog client.Verification
Tests are left to CI. No manual checks are listed.
Visual Changes
N/A
Reviewer Notes
sessionAuthOptionsbehaves like reading it withauthOptions.getServerSessionreplaces the providers with[], and a session read calls thejwtcallback without atrigger. The full callback already returns the token unchanged in that case (if (!trigger) return token;).git show --color-moved=dimmed-zebra <commit>to check them; GitHub does not highlight moved blocks.