Function redirect

freebuff/web/src/app/api/auth/[...nextauth]/auth-options.ts:107–151

({ url, baseUrl })

      return session
    },
    async redirect({ url, baseUrl }) {
      const potentialRedirectUrl = new URL(url, baseUrl)
      const authCode = potentialRedirectUrl.searchParams.get('auth_code')

      if (authCode) {
        if (!isCliAuthCodeCandidate(authCode)) {
          const searchParamKeys = Array.from(
            potentialRedirectUrl.searchParams.keys(),
          ).sort()
          logger.warn(
            {
              authCodeLength: authCode.length,
              authCodeTrimmedLength: authCode.trim().length,
              authCodeHashPrefix: getCliAuthCodeHashPrefix(authCode),
              authCodeParamCount:
                potentialRedirectUrl.searchParams.getAll('auth_code').length,
              searchParamKeys,
              searchParamCount: searchParamKeys.length,
              hasCallbackUrlParam: searchParamKeys.includes('callbackUrl'),
              hasCodeParam: searchParamKeys.includes('code'),
              hasRedirectParam: searchParamKeys.includes('redirect'),
              dotCount: authCode.match(/\./g)?.length ?? 0,
              hyphenCount: authCode.match(/-/g)?.length ?? 0,
              redirectUrlOrigin: potentialRedirectUrl.origin,
              baseUrl,
            },
            'Freebuff auth redirect received non-CLI-shaped auth_code',
          )
          return baseUrl
        }

        const onboardUrl = new URL(`${baseUrl}/onboard`)
        onboardUrl.search = getCliAuthOnboardSearchParams(
          potentialRedirectUrl.searchParams,
          authCode,
        ).toString()
        return onboardUrl.toString()
      }

      if (url.startsWith('/') || potentialRedirectUrl.origin === baseUrl) {
        return potentialRedirectUrl.toString()
      }

      return baseUrl
    },
  },
  events: {
    createUser: async ({ user }) => {