feat(providers): add NetSuite OAuth Provider

[HeavenlyEntity]

Add NetSuite OAuth 2.0 Provider so users can use this integration with their NetSuite Account. Documentation has been added along with PNG of logo to render on Sign In. Additionally added to issue template.

NOTE:

• It's a good idea to open an issue first to discuss potential changes.
• Please make sure that you are NOT opening a PR to fix a potential security vulnerability. Instead, please follow the Security guidelines to disclose the issue to us confidentially.

☕️ Reasoning

Add NetSuite OAuth provider for new and existing users looking to get started with integrating NetSuite using Auth.js! Lots of people and low documentation out there to help users create such compatibility. This will be the plug-n-play for those using NetSuite as there backend database provider / ERP System. 🎉 - Please let me know if I can make any adjustments!

🧢 Checklist

• Documentation
• Tests
• Ready to be merged

🎫 Affected issues

None ✅

📌 Resources

• Security guidelines
• Contributing guidelines
• Code of conduct
• Contributing to Open Source

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
auth-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Apr 30, 2024 3:09pm

1 Ignored Deployment

Name	Status	Preview	Comments	Updated (UTC)
next-auth-docs	⬜️ Ignored (Inspect)	Visit Preview		Apr 30, 2024 3:09pm

[vercel]

@HeavenlyEntity is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.

[HeavenlyEntity]

When will new providers be considered to be added? This one I do have working in a production environment. Let me know if there is anything I need to do on my side or how I can help you guys to speed up the process. 🚀

[HeavenlyEntity]

Hello @ThangHuuVu I see the new docs are looking great! Let me know how I can add the NetSuite doc instructions into the list of providers. Provide me with any new links to instructions on this would be great. Thank you!

[ndom91]

Can we simplify / set as default any more of the configuration options?

In addition, a few things regarding the profile optoin.

First, we'd like to always return at least the basic 4 profile fields without requiring the user to add their own callback. So the profile option should look somethign like this:

  profile(profile) {
    return {
      id: profile.id,
      name: profile.full_name,
      email: profile.email,
      image: profile.avatar_url,
    }
  },

In addition, it looks like the token argument to the callback isn't used in your example etiher, can we just drop that?

Finally, I see a lot of formatting / whitespace issues in the code at the bottom, and the JSDoc comment should follow the normal JSDoc formatting. See the src/providers/netlify.ts (or any other provider) as an example 🙏

[ndom91]

One other tiny tweak, if we name this options, you can pull out whatever you need on like 213, and then just pass the rest of the options in under hte options key on like 250 and don't need to pull out clientId and clientSecret additionally, for example.

i.e.

export default function NetSuite<P extends NetSuiteProfile>(
-  config: OAuthNetSuiteOptions<P>
+  options: OAuthNetSuiteOptions<P>
): OAuthConfig<P> {
-  const { issuer, userinfo: userInfo, prompt = 'none', scope = 'restlets rest_webservices', clientId, clientSecret } = config
+  const { issuer, userinfo: userInfo, prompt = 'none', scope = 'restlets rest_webservices', clientId, clientSecret } = options

  return {
    id: "netsuite",
    name: "NetSuite",
    type: "oauth",
    checks: ["state"],
    authorization: {
      url: `https://${issuer}.app.netsuite.com/app/login/oauth2/authorize.nl`,
      params: {
        client_id: clientId,
        prompt: prompt,
        response_type: 'code',
        scope,
      }
    },
    token: {
      url: `https://${issuer}.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token`,
      params: {
        grant_type: "authorization_code",
      }
    },
    userinfo: userInfo,
    profile(profile) {
      // This is the default runtime.getCurrentUser() object returned from the RESTlet or SUITELet
      return {
        id: profile.id,
        name: profile.name,
        email: profile.email,
        location: profile.location,
        role: profile.role,
        contact: profile?.contact
      }
    },
-    clientId,
-    clientSecret,
    style: { logo: "/netsuite.png", bg: "#3a4f5f", text: "#fff" },
-    options: config,
+    options
  }
}

[HeavenlyEntity]

That is fine. You can commit this suggestion if you'd like. 👍🏼 @ndom91

[ndom91]

@HeavenlyEntity I pushed that fix and cleaned up a few other small thigns 😊

Can you give it another test to make sure it still works? If it does we can merge it finally haha 🎉

[ndom91]

Thanks for your patience with this! It'll be available in the next releases we cut (i.e. [email protected], @auth/[email protected], etc.), unfortunately I can't say exactly when that'll be but my best guess is within a week or two max 🙏

[mbaquerizo]

@HeavenlyEntity @ndom91 thanks for adding this provider! I have been trying to add NetSuite as a custom provider to my next.js app for a couple of days before I came across this PR. I have been unsuccessful and next-auth's errors aren't providing much help.

But I wanted to ask how you determined the NetSuite documentation to follow to get this to work? I'm asking because I assumed I could go the route of NetSuite as OIDC provider, following this documentation: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_160077062690.html

The main difference in my approach was passing in the wellKnown url, which contains the authorization, token, and even userinfo url ({issuer}.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/userinfo). I'm able to get to the NetSuite login screen, grant consent, and login. But I am getting an oauth callback error that looks like the following:

https://next-auth.js.org/errors#oauth_callback_error invalid_request {
  message: 'invalid_request',
  stack: 'Error: invalid_request\n' +
    '    at oAuthCallback (webpack-internal:///(rsc)/./node_modules/next-auth/core/lib/oauth/callback.js:56:23)\n' +
    '    at Object.callback (webpack-internal:///(rsc)/./node_modules/next-auth/core/routes/callback.js:18:107)\n' +
    '    at AuthHandler (webpack-internal:///(rsc)/./node_modules/next-auth/core/index.js:202:51)\n' +
    '    at async NextAuthRouteHandler (webpack-internal:///(rsc)/./node_modules/next-auth/next/index.js:50:30)\n' +
    '    at async NextAuth._args$ (webpack-internal:///(rsc)/./node_modules/next-auth/next/index.js:85:24)\n' +
    '    at async /Users/matthewbaquerizo/Projects/Arch Painting/vendor-portal-2/node_modules/next/dist/compiled/next-server/app-route.runtime.dev.js:6:62499',
  name: 'Error'
}

Am i mistaken in my understanding of the purpose of the NetSuite as OIDC Provider approach, and should I be using your approach instead? As far as I can tell it seems like you are passing the authorization and token urls/params explicitly and using a custom RESTlet as the userinfo url. For the authorization params, scope is set to 'restlets rest_webservices', which also differs from the documentation that I followed which only lists 'openid' and 'email' as supported scopes.

For reference here is my custom provider:

  {
      id: 'netsuite',
      name: 'NetSuite',
      clientId: process.env.NS_CLIENT_ID,
      clientSecret: process.env.NS_CLIENT_SECRET,
      type: 'oauth',
      wellKnown:
        `https://${process.env.NS_ACCOUNT_ID}.suitetalk.api.netsuite.com/.well-known/openid-configuration`,
      authorization: { params: { scope: 'openid email' } }, // by default only one of these is used, so i added params explicitly here
      profile(profile) {
        // I haven't gotten far enough to see what profile looks like yet
        return profile;
      },
    },

[HeavenlyEntity]

Hi @mbaquerizo ! Yeah I have not had luck with the OIDC method because NetSuite is really strict with permissions and roles. You have to set up the permissions to allow users to auth this way. Which is extremely tedious. My approach utilizes OAuth 2.0 User Flow which NetSuite recommends. What is cool about this method the token returned from the profile method allows you to auth each restlet as the signed in user in the api routes using the getServerSession. Super cool! 🚀

[HeavenlyEntity]

Thanks for your patience with this! It'll be available in the next releases we cut (i.e. [email protected], @auth/[email protected], etc.), unfortunately I can't say exactly when that'll be but my best guess is within a week or two max 🙏

@ndom91 Thank you for getting this in! I noticed the color is not right lol. Can you update that to be this color for the background #3a4f5f ➡️ #181a1b ? Then the text to #fbfbfb. Hope that can be committed directly. Thank you @ndom91! Wanna get it perfect before the release! 🚀