enabling multi-tenant functionality

src/client/index.js

@@ -21,9 +21,11 @@ import parseUrl from '../lib/parse-url'
 //    relative URLs are valid in that context and so defaults to empty.
 // 2. When invoked server side the value is picked up from an environment
 //    variable and defaults to 'http://localhost:3000'.
+const multiTenant = process.env.MULTITENANT === "true"
 const __NEXTAUTH = {
   baseUrl: parseUrl(process.env.NEXTAUTH_URL || process.env.VERCEL_URL).baseUrl,
   basePath: parseUrl(process.env.NEXTAUTH_URL).basePath,
+  multiTenant: multiTenant,
   keepAlive: 0, // 0 == disabled (don't send); 60 == send every 60 seconds
   clientMaxAge: 0, // 0 == disabled (only use cache); 60 == sync if last checked > 60 seconds ago
   // Properties starting with _ are used for tracking internal app state
@@ -80,11 +82,13 @@ const setOptions = ({
   baseUrl,
   basePath,
   clientMaxAge,
-  keepAlive
+  keepAlive,
+  multiTenant
 } = {}) => {
   if (baseUrl) { __NEXTAUTH.baseUrl = baseUrl }
   if (basePath) { __NEXTAUTH.basePath = basePath }
   if (clientMaxAge) { __NEXTAUTH.clientMaxAge = clientMaxAge }
+  if (multiTenant) { __NEXTAUTH.multiTenant = multiTenant}
   if (keepAlive) {
     __NEXTAUTH.keepAlive = keepAlive
 
@@ -110,7 +114,7 @@ const getSession = async ({ req, ctx, triggerEvent = true } = {}) => {
   // work seemlessly in getInitialProps() on server side pages *and* in _app.js.
   if (!req && ctx && ctx.req) { req = ctx.req }
 
-  const baseUrl = _apiBaseUrl()
+  const baseUrl = _apiBaseUrl(req)
   const fetchOptions = req ? { headers: { cookie: req.headers.cookie } } : {}
   const session = await _fetchData(`${baseUrl}/session`, fetchOptions)
   if (triggerEvent) {
@@ -126,15 +130,15 @@ const getCsrfToken = async ({ req, ctx } = {}) => {
   // work seemlessly in getInitialProps() on server side pages *and* in _app.js.
   if (!req && ctx && ctx.req) { req = ctx.req }
 
-  const baseUrl = _apiBaseUrl()
+  const baseUrl = _apiBaseUrl(req)
   const fetchOptions = req ? { headers: { cookie: req.headers.cookie } } : {}
   const data = await _fetchData(`${baseUrl}/csrf`, fetchOptions)
   return data && data.csrfToken ? data.csrfToken : null
 }
 
-// Universal method (client + server); does not require request headers
-const getProviders = async () => {
-  const baseUrl = _apiBaseUrl()
+// Universal method (client + server); does not require request headers but seems to only be called by client
+const getProviders = async (req) => {
+  const baseUrl = _apiBaseUrl(req)
   return _fetchData(`${baseUrl}/providers`)
 }
 
@@ -294,13 +298,23 @@ const _fetchData = async (url, options = {}) => {
   }
 }
 
-const _apiBaseUrl = () => {
+const _apiBaseUrl = (req) => {
   if (typeof window === 'undefined') {
     // NEXTAUTH_URL should always be set explicitly to support server side calls - log warning if not set
-    if (!process.env.NEXTAUTH_URL) { logger.warn('NEXTAUTH_URL', 'NEXTAUTH_URL environment variable not set') }
+    if (!__NEXTAUTH.multiTenant && !process.env.NEXTAUTH_URL) { logger.warn('NEXTAUTH_URL', 'NEXTAUTH_URL environment variable not set') }
 
     // Return absolute path when called server side
-    return `${__NEXTAUTH.baseUrl}${__NEXTAUTH.basePath}`
+    if(req && __NEXTAUTH.multiTenant){
+      let protocol = 'http'
+      if( (req.headers.referer && req.headers.referer.split("://")[0] == 'https') || (req.headers['X-Forwarded-Proto'] && req.headers['X-Forwarded-Proto'] === 'https')){
+        protocol = 'https'
+      }
+      return protocol + "://" +`${req.headers.host}${__NEXTAUTH.basePath}`
+    } else if(__NEXTAUTH.multiTenant){
+      logger.warn('found an instance of multitenant without a req')
+    } else {
+      return `${__NEXTAUTH.baseUrl}${__NEXTAUTH.basePath}`
+    }
   } else {
     // Return relative path when called client side
     return __NEXTAUTH.basePath

src/server/index.js

@@ -45,7 +45,16 @@ export default async (req, res, userSuppliedOptions) => {
     } = body
 
     // @todo refactor all existing references to site, baseUrl and basePath
-    const parsedUrl = parseUrl(process.env.NEXTAUTH_URL || process.env.VERCEL_URL)
+    let multiTenantURL = null
+    if(process.env.MULTITENANT == "true"){
+      let protocol = 'http'
+      if( (req.headers.referer && req.headers.referer.split("://")[0] == 'https') || (req.headers['X-Forwarded-Proto'] && req.headers['X-Forwarded-Proto'] === 'https')){
+        protocol = 'https'
+      }
+
+      multiTenantURL = protocol + "://" + req.headers.host
+    }
+    const parsedUrl = parseUrl(multiTenantURL || process.env.NEXTAUTH_URL || process.env.VERCEL_URL)
     const baseUrl = parsedUrl.baseUrl
     const basePath = parsedUrl.basePath
 

src/server/lib/callbacks.js

@@ -47,7 +47,7 @@ const redirect = async (url, baseUrl) => {
  * @param  {object} token    JSON Web Token (if enabled)
  * @return {object}          Session that will be returned to the client
  */
-const session = async (session, token) => {
+const session = async (session, token, req) => {
   return Promise.resolve(session)
 }
 

src/server/routes/session.js

@@ -39,7 +39,7 @@ export default async (req, res, options, done) => {
 
       // Pass Session and JSON Web Token through to the session callback
       const jwtPayload = await callbacks.jwt(decodedJwt)
-      const sessionPayload = await callbacks.session(defaultSessionPayload, jwtPayload)
+      const sessionPayload = await callbacks.session(defaultSessionPayload, jwtPayload, req)
 
       // Return session payload as response
       response = sessionPayload
@@ -79,7 +79,7 @@ export default async (req, res, options, done) => {
         }
 
         // Pass Session through to the session callback
-        const sessionPayload = await callbacks.session(defaultSessionPayload, user)
+        const sessionPayload = await callbacks.session(defaultSessionPayload, user, req)
 
         // Return session payload as response
         response = sessionPayload

src/server/routes/signin.js

@@ -22,19 +22,34 @@ export default async (req, res, options, done) => {
     return done()
   }
 
+  const _baseUrl = function(){
+    if(process.env.MULTITENANT == "true"){
+      let protocol = 'http'
+      if( (req.headers.referer && req.headers.referer.split("://")[0] == 'https') || (req.headers['X-Forwarded-Proto'] && req.headers['X-Forwarded-Proto'] === 'https')){
+        protocol = 'https'
+      }
+      return protocol + "://" + req.headers.host + `${basePath}`
+    } else {
+      return `${baseUrl}${basePath}`
+    }
+  }
+
+  // Adding to handle multi tenant solutions where the base url changes
+
+
   if (type === 'oauth' && req.method === 'POST') {
     oAuthSignin(provider, csrfToken, (error, oAuthSigninUrl) => {
       if (error) {
         logger.error('SIGNIN_OAUTH_ERROR', error)
-        return redirect(`${baseUrl}${basePath}/error?error=OAuthSignin`)
+        return redirect(_baseUrl() + `/error?error=OAuthSignin`)
       }
 
       return redirect(oAuthSigninUrl)
     })
   } else if (type === 'email' && req.method === 'POST') {
     if (!adapter) {
       logger.error('EMAIL_REQUIRES_ADAPTER_ERROR')
-      return redirect(`${baseUrl}${basePath}/error?error=Configuration`)
+      return redirect(_baseUrl() + `/error?error=Configuration`)
     }
     const { getUserByEmail } = await adapter.getAdapter(options)
 
@@ -53,11 +68,11 @@ export default async (req, res, options, done) => {
     try {
       const signinCallbackResponse = await callbacks.signIn(profile, account, { email, verificationRequest: true })
       if (signinCallbackResponse === false) {
-        return redirect(`${baseUrl}${basePath}/error?error=AccessDenied`)
+        return redirect(_baseUrl() + `/error?error=AccessDenied`)
       }
     } catch (error) {
       if (error instanceof Error) {
-        return redirect(`${baseUrl}${basePath}/error?error=${encodeURIComponent(error)}`)
+        return redirect(_baseUrl() + `/error?error=${encodeURIComponent(error)}`)
       } else {
         return redirect(error)
       }
@@ -67,13 +82,12 @@ export default async (req, res, options, done) => {
       await emailSignin(email, provider, options)
     } catch (error) {
       logger.error('SIGNIN_EMAIL_ERROR', error)
-      return redirect(`${baseUrl}${basePath}/error?error=EmailSignin`)
+      return redirect(_baseUrl() + `/error?error=EmailSignin`)
     }
-
-    return redirect(`${baseUrl}${basePath}/verify-request?provider=${encodeURIComponent(
+    return redirect(_baseUrl() + `/verify-request?provider=${encodeURIComponent(
       provider.id
     )}&type=${encodeURIComponent(provider.type)}`)
   } else {
-    return redirect(`${baseUrl}${basePath}/signin`)
+    return redirect(_baseUrl() + `_baseUrl() + /signin`)
   }
 }