Function jwt

apps/web/src/lib/user/server.ts:893–939

({ token, account, user, trigger, profile })

      let linkingSession: AccountLinkingSession | null = null;
      const redirectContext = await getSignInRedirectContext();
      const redirectUrlForCode = (error: AuthErrorType): string => {
        const redirectUrl = new URL(
          authFailureRedirectUrl(error, Boolean(isAccountLinking)),
          'http://localhost'
        );
        if (!isAccountLinking) {
          if (redirectContext.callbackPath) {
            redirectUrl.searchParams.set('callbackPath', redirectContext.callbackPath);
          }
          if (redirectContext.signup) {
            redirectUrl.searchParams.set('signup', 'true');
          }
        }
        return `${redirectUrl.pathname}?${redirectUrl.searchParams.toString()}`;
      };
      try {
        if (!account) return `TRAP: No account found`;

        // early return for fake auth
        const isFakeLogin = account.provider === 'fake-login';
        if (isFakeLogin && !allow_fake_login)
          return 'Fake login is not available in production mode';

        // early return for email auth (magic link)
        const isEmailAuth = account.provider === 'email';

        // normalize the account, user, and profile objects into a single object
        // why does next-auth have 3 separate objects for this? who knows.
        accountInfo = createAccountInfo(account, user, profile);

        linkingSession = await getAccountLinkingSession();

        isAccountLinking = linkingSession && linkingSession.targetProvider === accountInfo.provider;

        // if a user's email domain matches any organization's SSO domain and they are not logging in with SSO, force them to use SSO immediately
        const domain = getLowerDomainFromEmail(accountInfo.google_user_email);

        if (!domain) {
          return redirectUrlForCode('USER-NOT-FOUND');
        }

        if (await isEmailBlacklistedByDomainAsync(accountInfo.google_user_email)) {
          sentryLogger('auth', 'warning')(
            `SECURITY: Blacklisted: ${accountInfo.google_user_email}`,
            accountInfo
          );

          return redirectUrlForCode(`BLOCKED`);
        }