auth.ts

import NextAuth from "next-auth";
import EntraIDProvider from "next-auth/providers/microsoft-entra-id";

import { getUserProfile } from "@/lib/profile";
import { PostPermissionsResponse } from "./app/api/permissions/route";
import { getEnv } from "./lib/utils";
import { UserRole } from "./types";

const baseURL = process.env.APP_URL ?? "http://127.0.0.1:3000";

export const { handlers, signIn, signOut, auth } = NextAuth({
  providers: [
    EntraIDProvider({
      clientId: getEnv("AUTH_MICROSOFT_ENTRA_ID_ID"),
      clientSecret: getEnv("AUTH_MICROSOFT_ENTRA_ID_SECRET"),
      issuer: `https://login.microsoftonline.com/${getEnv("AUTH_MICROSOFT_ENTRA_ID_TENANT_ID")}/v2.0`,
      authorization: {
        params: {
          scope: "openid email profile User.Read",
        },
      },
    }),
  ],
  callbacks: {
    // Check if user is on official roster and authorized to access
    async signIn({ profile }) {
      if (!profile?.email) {
        console.error("Email does not exist in profile");
        return false;
      }
      const isAuthorized = await fetch(
        `${baseURL}/api/permissions`,
        {
          method: "POST",
          body: JSON.stringify({
            email: profile.email,
          }),
        },
      )
        .then((response) => response.json())
        .then((response) => response.isAuthorized);

      console.debug(isAuthorized ? "User authorized" : "User not authorized");

      return isAuthorized;
    },
    // Add extra properties to the JWT token
    async jwt({ token, user, account, profile }) {
      if (user) {
        // Fetch additional user data from Microsoft Graph
        const graphProfile = await getUserProfile(
          account?.access_token as string,
        );

        // Get user role
        const rosterData = await fetch(
          `${baseURL}/api/permissions`,
          {
            method: "POST",
            body: JSON.stringify({
              email: user.email,
            }),
          },
        )
          .then((response) => response.json())
          .then((response: PostPermissionsResponse) => {
            return {
              role: response?.data?.role,
              branch: response?.data?.branch,
              team: response?.data?.team,
              position: response?.data?.position,
            };
          });

        // Enrich token with user details
        token.user = {
          name: user.name,
          email: user.email,
          image: user.image,
          nuid: graphProfile.nuid,
          role: rosterData?.role || UserRole.MEMBER,
          branch: rosterData?.branch,
          team: rosterData?.team,
          position: rosterData?.position
        };
      }
      return token;
    },
    session({ session, token }) {
      if (!token.user) throw new Error("No user data");

      // Add properties to session
      session.user = token.user as any;

      return session;
    },
  },
  pages: {
    signIn: "/auth/login",
    error: "/auth/error",
  },
});