fix: use process.env.URL when deploying to production (#1680)

* chore: upgrade next-auth to latest

* chore: upgrade next-auth again

* fix: change how the base nextAuthUrl is created

* style: lint

* test: add test coverage for the next-auth url logic

* Apply suggestions from code review

Co-authored-by: Nick Taylor <nick@iamdeveloper.com>

Co-authored-by: Nick Taylor <nick@iamdeveloper.com>

Author: ericapisani

demos/next-auth/package.json

@@ -24,7 +24,7 @@
   "license": "MIT",
   "dependencies": {
     "next": "^12.3.2-canary.43",
-    "next-auth": "^4.7.0",
+    "next-auth": "^4.15.0",
     "nodemailer": "^6.6.3",
     "react": "^18.0.0",
     "react-dom": "^18.0.0"
@@ -45,4 +45,4 @@
   "engines": {
     "node": ">=16.0.0"
   }
-}
+}

package-lock.json

@@ -136,7 +136,11 @@ const plugin: NetlifyPlugin = {
 
         await updateRequiredServerFiles(publish, config)
       } else {
-        const nextAuthUrl = `${process.env.DEPLOY_PRIME_URL}${basePath}`
+        // Using the deploy prime url in production leads to issues because the unique deploy ID is part of the generated URL
+        // and will not match the expected URL in the callback URL of an OAuth application.
+        const nextAuthUrl = `${
+          process.env.CONTEXT === 'production' ? process.env.URL : process.env.DEPLOY_PRIME_URL
+        }${basePath}`
 
         console.log(`NextAuth package detected, setting NEXTAUTH_URL environment variable to ${nextAuthUrl}`)
         config.config.env.NEXTAUTH_URL = nextAuthUrl

packages/runtime/src/index.ts

@@ -232,6 +232,8 @@ describe('onBuild()', () => {
 
   afterEach(() => {
     delete process.env.DEPLOY_PRIME_URL
+    delete process.env.URL
+    delete process.env.CONTEXT
   })
 
   test('does not set NEXTAUTH_URL if value is already set', async () => {
@@ -253,6 +255,53 @@ describe('onBuild()', () => {
     expect(config.config.env.NEXTAUTH_URL).toEqual(mockUserDefinedSiteUrl)
   })
 
+  test('sets the NEXTAUTH_URL to the DEPLOY_PRIME_URL when CONTEXT env variable is not \'production\'', async () => {
+    const mockUserDefinedSiteUrl = chance.url()
+    process.env.DEPLOY_PRIME_URL = mockUserDefinedSiteUrl
+    process.env.URL = chance.url()
+    
+    // See https://docs.netlify.com/configure-builds/environment-variables/#build-metadata for all possible values
+    process.env.CONTEXT = 'deploy-preview'
+
+    await moveNextDist()
+
+    const initialConfig = await getRequiredServerFiles(netlifyConfig.build.publish)
+
+    initialConfig.config.env.NEXTAUTH_URL = mockUserDefinedSiteUrl
+    await updateRequiredServerFiles(netlifyConfig.build.publish, initialConfig)
+
+    await nextRuntime.onBuild(defaultArgs)
+
+    expect(onBuildHasRun(netlifyConfig)).toBe(true)
+    const config = await getRequiredServerFiles(netlifyConfig.build.publish)
+
+    expect(config.config.env.NEXTAUTH_URL).toEqual(mockUserDefinedSiteUrl)
+  })
+  
+  test('sets the NEXTAUTH_URL to the user defined site URL when CONTEXT env variable is \'production\'', async () => {
+    const mockUserDefinedSiteUrl = chance.url()
+    process.env.DEPLOY_PRIME_URL = chance.url()
+    process.env.URL = mockUserDefinedSiteUrl
+
+    // See https://docs.netlify.com/configure-builds/environment-variables/#build-metadata for all possible values
+    process.env.CONTEXT = 'production'
+
+    await moveNextDist()
+
+    const initialConfig = await getRequiredServerFiles(netlifyConfig.build.publish)
+
+    initialConfig.config.env.NEXTAUTH_URL = mockUserDefinedSiteUrl
+    await updateRequiredServerFiles(netlifyConfig.build.publish, initialConfig)
+
+    await nextRuntime.onBuild(defaultArgs)
+
+    expect(onBuildHasRun(netlifyConfig)).toBe(true)
+    const config = await getRequiredServerFiles(netlifyConfig.build.publish)
+
+    expect(config.config.env.NEXTAUTH_URL).toEqual(mockUserDefinedSiteUrl)
+  })
+  
+
   test('sets the NEXTAUTH_URL specified in the netlify.toml or in the Netlify UI', async () => {
     const mockSiteUrl = chance.url()
     process.env.NEXTAUTH_URL = mockSiteUrl