fix(#1025): prevent nextauth configuration crashes for unconfigured providers#1060
fix(#1025): prevent nextauth configuration crashes for unconfigured providers#1060aniruddhaadak80 wants to merge 1 commit intof:mainfrom
Conversation
📝 WalkthroughWalkthroughThe pull request adds runtime validation of required environment variables across all authentication provider plugins (Apple, Azure, GitHub, Google). Each plugin's Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR prevents NextAuth from throwing configuration errors when an OAuth provider is listed in PCHAT_AUTH_PROVIDERS but its required environment variables are missing/empty, allowing remaining providers (e.g., credentials) to continue working.
Changes:
- Updated
AuthPlugin.getProvider()to allow returningnullwhen a provider is not configured. - Added env-var guards to Google/GitHub/Azure AD/Apple auth plugins that warn and disable the provider instead of crashing NextAuth.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| src/lib/plugins/types.ts | Allows auth plugins to return null providers (disabling misconfigured providers). |
| src/lib/plugins/auth/google.ts | Skips Google provider init when env vars are missing; logs a warning. |
| src/lib/plugins/auth/github.ts | Skips GitHub provider init when env vars are missing; logs a warning. |
| src/lib/plugins/auth/azure.ts | Skips Azure AD provider init when env vars are missing; logs a warning. |
| src/lib/plugins/auth/apple.ts | Skips Apple provider init when env vars are missing; logs a warning. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| /** | ||
| * Returns the NextAuth provider configuration | ||
| */ | ||
| getProvider: () => NextAuthConfig["providers"][number]; | ||
| getProvider: () => NextAuthConfig["providers"][number] | null; |
There was a problem hiding this comment.
The JSDoc says getProvider "Returns the NextAuth provider configuration", but the signature now allows null. Update the comment to reflect that providers may be disabled (e.g., return null when required env vars are missing) so plugin authors and callers know to handle the nullable return.
| if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET) { | ||
| console.warn("Missing GOOGLE_CLIENT_ID or GOOGLE_CLIENT_SECRET. Google auth provider disabled."); | ||
| return null; | ||
| } | ||
| return Google({ | ||
| clientId: process.env.GOOGLE_CLIENT_ID, | ||
| clientSecret: process.env.GOOGLE_CLIENT_SECRET, | ||
| }); |
There was a problem hiding this comment.
After the env var guard, process.env.* is still typed as string | undefined (TypeScript does not narrow property accesses like process.env.GOOGLE_CLIENT_ID). With strict: true, passing these directly into the NextAuth provider options can cause a type error. Consider assigning to local const clientId = process.env.GOOGLE_CLIENT_ID / clientSecret = ... after the check (or using a non-null assertion after the check) so the provider receives string.
| if (!process.env.GITHUB_CLIENT_ID || !process.env.GITHUB_CLIENT_SECRET) { | ||
| console.warn("Missing GITHUB_CLIENT_ID or GITHUB_CLIENT_SECRET. GitHub auth provider disabled."); | ||
| return null; | ||
| } | ||
| return GitHub({ | ||
| clientId: process.env.GITHUB_CLIENT_ID, | ||
| clientSecret: process.env.GITHUB_CLIENT_SECRET, |
There was a problem hiding this comment.
TypeScript won't narrow process.env.GITHUB_CLIENT_ID / process.env.GITHUB_CLIENT_SECRET to string based on the preceding if check, so these properties remain string | undefined under strict mode. Passing them directly to GitHub({ clientId, clientSecret }) can fail type-checking; capture them into local const values after the guard (or use non-null assertions after the guard) before constructing the provider config.
| if (!process.env.AZURE_AD_CLIENT_ID || !process.env.AZURE_AD_CLIENT_SECRET) { | ||
| console.warn("Missing AZURE_AD_CLIENT_ID or AZURE_AD_CLIENT_SECRET. Azure AD auth provider disabled."); | ||
| return null; | ||
| } | ||
| return MicrosoftEntraID({ | ||
| clientId: process.env.AZURE_AD_CLIENT_ID, | ||
| clientSecret: process.env.AZURE_AD_CLIENT_SECRET, |
There was a problem hiding this comment.
Even after the env var guard, process.env.AZURE_AD_CLIENT_ID / process.env.AZURE_AD_CLIENT_SECRET remain typed as string | undefined (TypeScript does not narrow property access). With strict enabled, MicrosoftEntraID({ clientId, clientSecret }) may not type-check. Assign these env values to local const variables (or assert non-null after the guard) before passing them into the provider options.
| if (!process.env.AUTH_APPLE_ID || !process.env.AUTH_APPLE_SECRET) { | ||
| console.warn("Missing AUTH_APPLE_ID or AUTH_APPLE_SECRET. Apple auth provider disabled."); | ||
| return null; | ||
| } | ||
| return Apple({ | ||
| clientId: process.env.AUTH_APPLE_ID, | ||
| clientSecret: process.env.AUTH_APPLE_SECRET, |
There was a problem hiding this comment.
The env var check prevents runtime misconfiguration, but TypeScript still types process.env.AUTH_APPLE_ID / process.env.AUTH_APPLE_SECRET as string | undefined because property accesses aren’t narrowed. Passing them directly to Apple({ clientId, clientSecret }) can fail under strict mode; store them in local const variables after the guard (or use non-null assertions after the guard) before building the provider config.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/lib/plugins/auth/apple.ts (1)
7-10: Extract the missing-env guard into a shared helper.This same
envcheck +console.warn+return nullblock now exists here and insrc/lib/plugins/auth/azure.ts,src/lib/plugins/auth/google.ts, andsrc/lib/plugins/auth/github.ts. Centralizing it would keep the required keys and warning format consistent across providers.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/lib/plugins/auth/apple.ts` around lines 7 - 10, Extract the repeated environment check into a shared helper (e.g., export a function like ensureAuthEnv or getMissingAuthWarning) and replace the inline guard in each provider's getProvider (Apple's getProvider, and similarly in azure.ts, google.ts, github.ts) to call that helper; the helper should accept the required keys (or an array of required env names) and return null/emit the standardized console.warn when keys are missing, while getProvider should simply return the helper's result or proceed to create the provider when it returns a truthy signal. Ensure the helper is imported and used in getProvider so the check + warning + null return behavior is centralized and consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@src/lib/plugins/auth/apple.ts`:
- Around line 7-10: Extract the repeated environment check into a shared helper
(e.g., export a function like ensureAuthEnv or getMissingAuthWarning) and
replace the inline guard in each provider's getProvider (Apple's getProvider,
and similarly in azure.ts, google.ts, github.ts) to call that helper; the helper
should accept the required keys (or an array of required env names) and return
null/emit the standardized console.warn when keys are missing, while getProvider
should simply return the helper's result or proceed to create the provider when
it returns a truthy signal. Ensure the helper is imported and used in
getProvider so the check + warning + null return behavior is centralized and
consistent.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f13d2a25-6300-4ab0-ab0a-f5f5e1ed49de
📒 Files selected for processing (5)
src/lib/plugins/auth/apple.tssrc/lib/plugins/auth/azure.tssrc/lib/plugins/auth/github.tssrc/lib/plugins/auth/google.tssrc/lib/plugins/types.ts
This pull request directly addresses issue #1025 where users hosting via Docker encounter a \Configuration\ error redirect upon logging in.
The issue surfaces when users specify OAuth strategies (like github or google) in their \PCHAT_AUTH_PROVIDERS\ string but fail to provide the corresponding client IDs and secrets in their environment variables. NextAuth responds to the empty strings by throwing a strict configuration error, disabling the authentication interface entirely—including the standard working email/credentials mechanism.
To fix this, the OAuth provider plugin loaders natively check if their respective environment keys are present before attempting initialization. If they are missing, it emits a setup warning in the console but safely returns a null provider that filters gracefully. This guarantees NextAuth functions securely with the remaining active providers without entering a failure crash loop.
Summary by CodeRabbit