Fix GitHub OAuth callback issuer validation

.env.example

@@ -15,8 +15,8 @@ NEXTAUTH_SECRET="your-super-secret-key-change-in-production"
 # AZURE_AD_CLIENT_ID=""
 # AZURE_AD_CLIENT_SECRET=""
 # AZURE_AD_TENANT_ID=""
-# AUTH_GITHUB_ID=your_client_id
-# AUTH_GITHUB_SECRET=your_client_secret
+# GITHUB_CLIENT_ID=your_client_id
+# GITHUB_CLIENT_SECRET=your_client_secret
 
 # Run `npx auth add apple` to generate the secret, follow the instructions in the prompt
 # AUTH_APPLE_ID=""
@@ -113,3 +113,4 @@ CRON_SECRET="your-secret-key-here"
 # AUTH_OAUTH_JWKS_URL="https://sso.example.com/jwks"
 # AUTH_OAUTH_TOKEN_AUTH_METHOD="client_secret_basic" # Allowed values: "client_secret_basic", "client_secret_post", "none"
 # AUTH_OAUTH_ENABLE_PKCE="true" # PKCE is enabled by default. Set to "false" to disable.
+

src/__tests__/lib/plugins/auth/github.test.ts

@@ -1,138 +1,110 @@
+// @vitest-environment node
+
+import { Auth, type AuthConfig } from "@auth/core";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { GitHubProfile } from "next-auth/providers/github";
-import type { OAuthConfig, OAuthUserConfig } from "next-auth/providers";
 import { githubPlugin } from "@/lib/plugins/auth/github";
 
-interface GitHubProviderOptions extends OAuthUserConfig<GitHubProfile> {
-  userinfo: {
-    request: (params: {
-      tokens: { access_token?: string };
-    }) => Promise<GitHubProfile>;
-  };
+const ORIGIN = "https://prompts.test";
+const GITHUB_ISSUER = "https://github.com/login/oauth";
+
+function responseCookies(response: Response): string {
+  return response.headers.getSetCookie().map((cookie) => cookie.split(";")[0]).join("; ");
 }
 
-function getProviderOptions(): GitHubProviderOptions {
-  const provider = githubPlugin.getProvider() as OAuthConfig<GitHubProfile>;
-  return provider.options as GitHubProviderOptions;
-}
-
-function mockGitHubResponses(
-  emails: Array<{
-    email: string;
-    primary: boolean;
-    verified: boolean;
-    visibility: "public" | "private";
-  }>
-) {
-  const fetchMock = vi
-    .fn<typeof fetch>()
-    .mockResolvedValueOnce(
-      new Response(
-        JSON.stringify({
-          id: 123,
-          login: "octocat",
-          name: "The Octocat",
-          email: null,
-          avatar_url: "https://avatars.githubusercontent.com/u/123",
-        }),
-        { status: 200 }
-      )
-    )
-    .mockResolvedValueOnce(
-      new Response(JSON.stringify(emails), { status: 200 })
-    );
-  vi.stubGlobal("fetch", fetchMock);
-
-  return fetchMock;
-}
-
-describe("GitHub auth plugin", () => {
-  const originalEnv = process.env;
+describe("GitHub OAuth callback", () => {
+  const fetchMock = vi.fn<typeof fetch>();
+  const signIn = vi.fn(() => true);
+  const logError = vi.fn();
+  let config: AuthConfig;
 
   beforeEach(() => {
-    process.env = { ...originalEnv };
-    delete process.env.AUTH_GITHUB_ID;
-    delete process.env.AUTH_GITHUB_SECRET;
-    delete process.env.GITHUB_CLIENT_ID;
-    delete process.env.GITHUB_CLIENT_SECRET;
+    vi.stubEnv("GITHUB_CLIENT_ID", "test-github-client");
+    vi.stubEnv("GITHUB_CLIENT_SECRET", "test-github-secret");
+    vi.stubGlobal("fetch", fetchMock);
+    fetchMock.mockImplementation(async (input) => {
+      const url = String(input);
+      if (url === "https://github.com/login/oauth/access_token") {
+        return Response.json({ access_token: "test-access-token", token_type: "bearer" });
+      }
+      if (url === "https://api.github.com/user") {
+        return Response.json({
+          id: 123,
+          login: "testuser",
+          name: "Test User",
+          email: "test@example.com",
+          avatar_url: "https://avatars.githubusercontent.com/u/123",
+        });
+      }
+      throw new Error(`Unexpected fetch: ${url}`);
+    });
+    config = {
+      providers: [githubPlugin.getProvider()],
+      secret: "github-callback-test-secret",
+      trustHost: true,
+      basePath: "/api/auth",
+      callbacks: { signIn },
+      logger: { error: logError, warn: vi.fn(), debug: vi.fn() },
+    };
   });
 
   afterEach(() => {
-    process.env = originalEnv;
+    vi.unstubAllEnvs();
     vi.unstubAllGlobals();
+    vi.clearAllMocks();
   });
 
-  it("uses Auth.js GitHub credential names", () => {
-    process.env.AUTH_GITHUB_ID = "auth-client-id";
-    process.env.AUTH_GITHUB_SECRET = "auth-client-secret";
-
-    const options = getProviderOptions();
-
-    expect(options.clientId).toBe("auth-client-id");
-    expect(options.clientSecret).toBe("auth-client-secret");
-  });
-
-  it("supports legacy GitHub credential names", () => {
-    process.env.GITHUB_CLIENT_ID = "legacy-client-id";
-    process.env.GITHUB_CLIENT_SECRET = "legacy-client-secret";
-
-    const options = getProviderOptions();
-
-    expect(options.clientId).toBe("legacy-client-id");
-    expect(options.clientSecret).toBe("legacy-client-secret");
-  });
-
-  it("enables account linking only with a verified GitHub email", async () => {
-    const fetchMock = mockGitHubResponses([
-      {
-        email: "unverified@example.com",
-        primary: true,
-        verified: false,
-        visibility: "private",
+  async function startSignIn(): Promise<string> {
+    const csrfResponse = await Auth(new Request(`${ORIGIN}/api/auth/csrf`), config);
+    const { csrfToken } = await csrfResponse.json() as { csrfToken: string };
+    const response = await Auth(new Request(`${ORIGIN}/api/auth/signin/github`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Cookie: responseCookies(csrfResponse),
       },
-      {
-        email: "verified@example.com",
-        primary: false,
-        verified: true,
-        visibility: "private",
-      },
-    ]);
-    const options = getProviderOptions();
+      body: new URLSearchParams({ csrfToken, callbackUrl: ORIGIN }),
+    }), config);
 
-    const profile = await options.userinfo.request({
-      tokens: { access_token: "github-token" },
-    });
+    const authorizationUrl = new URL(response.headers.get("location")!);
+    expect(authorizationUrl.origin).toBe("https://github.com");
+    expect(authorizationUrl.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(authorizationUrl.searchParams.get("code_challenge")).toBeTruthy();
+    return responseCookies(response);
+  }
 
-    expect(options.allowDangerousEmailAccountLinking).toBe(true);
-    expect(profile.email).toBe("verified@example.com");
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(fetchMock).toHaveBeenCalledWith(
-      "https://api.github.com/user/emails",
-      expect.objectContaining({
-        headers: expect.objectContaining({
-          Authorization: "Bearer github-token",
-        }),
-      })
-    );
+  it.each([GITHUB_ISSUER, undefined])("accepts GitHub callbacks with issuer %s", async (issuer) => {
+    const cookies = await startSignIn();
+    const callbackUrl = new URL(`${ORIGIN}/api/auth/callback/github?code=test-code`);
+    if (issuer) callbackUrl.searchParams.set("iss", issuer);
+
+    const response = await Auth(new Request(callbackUrl, { headers: { Cookie: cookies } }), config);
+
+    expect(logError).not.toHaveBeenCalled();
+    expect(response.headers.get("location")).toBe(ORIGIN);
+    expect(signIn).toHaveBeenCalledWith(expect.objectContaining({
+      user: expect.objectContaining({ email: "test@example.com", username: "testuser" }),
+      account: expect.objectContaining({ provider: "github", providerAccountId: "123" }),
+    }));
+    expect(responseCookies(response)).toContain("__Secure-authjs.session-token=");
+    const tokenRequest = fetchMock.mock.calls.find(([url]) => String(url).endsWith("/access_token"));
+    expect((tokenRequest?.[1]?.body as URLSearchParams).get("code_verifier")).toBeTruthy();
   });
 
-  it("rejects GitHub profiles without a verified email", async () => {
-    mockGitHubResponses([
-      {
-        email: "unverified@example.com",
-        primary: true,
-        verified: false,
-        visibility: "private",
-      },
-    ]);
-    const options = getProviderOptions();
+  it("rejects a callback from an unexpected issuer before exchanging the code", async () => {
+    const cookies = await startSignIn();
+    const callbackUrl = new URL(`${ORIGIN}/api/auth/callback/github?code=test-code`);
+    callbackUrl.searchParams.set("iss", "https://unexpected.example.com");
 
-    await expect(
-      options.userinfo.request({
-        tokens: { access_token: "github-token" },
-      })
-    ).rejects.toThrow(
-      "GitHub account does not have a verified email address"
-    );
+    const response = await Auth(new Request(callbackUrl, { headers: { Cookie: cookies } }), config);
+
+    expect(new URL(response.headers.get("location")!).searchParams.get("error")).toBe("Configuration");
+    expect(logError).toHaveBeenCalledWith(expect.objectContaining({
+      cause: expect.objectContaining({
+        err: expect.objectContaining({ message: 'unexpected "iss" (issuer) response parameter value' }),
+      }),
+    }));
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(signIn).not.toHaveBeenCalled();
+    expect(responseCookies(response)).not.toContain("authjs.session-token");
   });
 });

src/app/docs/self-hosting/page.tsx

@@ -236,11 +236,11 @@ export default async function SelfHostingPage() {
                 </TableHeader>
                 <TableBody>
                   <TableRow>
-                    <TableCell className="font-mono text-xs">AUTH_GITHUB_ID</TableCell>
+                    <TableCell className="font-mono text-xs">GITHUB_CLIENT_ID</TableCell>
                     <TableCell className="text-muted-foreground text-sm">GitHub OAuth App client ID</TableCell>
                   </TableRow>
                   <TableRow>
-                    <TableCell className="font-mono text-xs">AUTH_GITHUB_SECRET</TableCell>
+                    <TableCell className="font-mono text-xs">GITHUB_CLIENT_SECRET</TableCell>
                     <TableCell className="text-muted-foreground text-sm">GitHub OAuth App client secret</TableCell>
                   </TableRow>
                   <TableRow>

src/lib/plugins/auth/github.ts

@@ -1,109 +1,15 @@
-import GitHub, {
-  type GitHubEmail,
-  type GitHubProfile,
-} from "next-auth/providers/github";
-import type { TokenSet } from "@auth/core/types";
+import GitHub from "next-auth/providers/github";
 import type { AuthPlugin } from "../types";
 
-const GITHUB_API_URL = "https://api.github.com";
-
-function isGitHubProfile(value: unknown): value is GitHubProfile {
-  if (!value || typeof value !== "object") return false;
-
-  const profile = value as Partial<GitHubProfile>;
-  return (
-    typeof profile.id === "number" &&
-    typeof profile.login === "string" &&
-    typeof profile.avatar_url === "string"
-  );
-}
-
-function isGitHubEmail(value: unknown): value is GitHubEmail {
-  if (!value || typeof value !== "object") return false;
-
-  const email = value as Partial<GitHubEmail>;
-  return (
-    typeof email.email === "string" &&
-    typeof email.primary === "boolean" &&
-    typeof email.verified === "boolean"
-  );
-}
-
-async function getVerifiedGitHubProfile(
-  accessToken: string
-): Promise<GitHubProfile> {
-  const headers = {
-    Authorization: `Bearer ${accessToken}`,
-    Accept: "application/vnd.github+json",
-    "X-GitHub-Api-Version": "2022-11-28",
-    "User-Agent": "prompts.chat",
-  };
-  const [profileResponse, emailsResponse] = await Promise.all([
-    fetch(`${GITHUB_API_URL}/user`, { headers }),
-    fetch(`${GITHUB_API_URL}/user/emails`, { headers }),
-  ]);
-
-  if (!profileResponse.ok) {
-    throw new Error(
-      `GitHub profile request failed with status ${profileResponse.status}`
-    );
-  }
-  if (!emailsResponse.ok) {
-    throw new Error(
-      `GitHub email request failed with status ${emailsResponse.status}`
-    );
-  }
-
-  const profile: unknown = await profileResponse.json();
-  const emails: unknown = await emailsResponse.json();
-
-  if (!isGitHubProfile(profile)) {
-    throw new Error("GitHub returned an invalid user profile");
-  }
-  if (!Array.isArray(emails)) {
-    throw new Error("GitHub returned an invalid email list");
-  }
-
-  const githubEmails = emails.filter(isGitHubEmail);
-  const verifiedEmail =
-    githubEmails.find((email) => email.primary && email.verified) ??
-    githubEmails.find((email) => email.verified);
-
-  if (!verifiedEmail) {
-    throw new Error("GitHub account does not have a verified email address");
-  }
-
-  return {
-    ...profile,
-    email: verifiedEmail.email,
-  };
-}
-
-const githubUserinfo = {
-  url: `${GITHUB_API_URL}/user`,
-  async request({ tokens }: { tokens: TokenSet }) {
-    if (!tokens.access_token) {
-      throw new Error("GitHub did not return an access token");
-    }
-
-    return getVerifiedGitHubProfile(tokens.access_token);
-  },
-};
-
 export const githubPlugin: AuthPlugin = {
   id: "github",
   name: "GitHub",
-  getProvider: () => {
-    const clientId =
-      process.env.AUTH_GITHUB_ID || process.env.GITHUB_CLIENT_ID;
-    const clientSecret =
-      process.env.AUTH_GITHUB_SECRET || process.env.GITHUB_CLIENT_SECRET;
-
-    return GitHub({
-      clientId,
-      clientSecret,
-      allowDangerousEmailAccountLinking: true,
-      userinfo: githubUserinfo,
+  getProvider: () =>
+    GitHub({
+      // GitHub includes this issuer in OAuth authorization responses.
+      issuer: "https://github.com/login/oauth",
+      clientId: process.env.GITHUB_CLIENT_ID!,
+      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
       profile(profile) {
         return {
           id: profile.id.toString(),
@@ -114,6 +20,5 @@ export const githubPlugin: AuthPlugin = {
           githubUsername: profile.login, // Immutable GitHub username for contributor attribution
         };
       },
-    });
-  },
+    }),
 };