Add Native Support for SUAP Authentication in NextAuth

[Todpig]

Goals

SUAP (Sistema Unificado de Administração Pública) is widely used by federal educational institutions in Brazil, serving as a crucial authentication system for students, teachers, and staff. Currently, developers using Next.js and NextAuth must manually implement a provider for SUAP authentication.

To enhance accessibility and streamline the authentication process for the academic community, I propose adding native support for SUAP as an official provider in NextAuth. Below is a fully functional implementation that could serve as a foundation for this integration.

Non-Goals

No response

Background

import NextAuth from "next-auth";
import api from "@/lib/axios";

export const { signIn, signOut, auth, handlers } = NextAuth({
  providers: [
    {
      id: "suap",
      name: "SUAP",
      type: "oauth",
      authorization: {
        url: "https://suap.ifrn.edu.br/o/authorize/",
        params: { scope: "identificacao email" },
      },
      token: "https://suap.ifrn.edu.br/o/token/",
      userinfo: "https://suap.ifrn.edu.br/api/eu/",
      clientId: process.env.SUAP_CLIENT_ID,
      clientSecret: process.env.SUAP_CLIENT_SECRET,
      profile(profile) {
        return {
          id: profile.identificacao,
          username: profile.nome_social || profile.nome,
          email: profile.email,
          firstName: profile.primeiro_nome,
          lastName: profile.ultimo_nome,
          role: profile.tipo_usuario,
          avatar: profile.foto,
        };
      },
      options: {
        timeout: 10000,
      },
    },
  ],
  secret: process.env.NEXTAUTH_SECRET,
  callbacks: {
    async jwt({ token, account, profile }) {
      if (account && profile) {
        token.accessToken = account.access_token;
        token.refreshToken = account.refresh_token;
        token.name = profile.nome as string;
        token.email = profile.email_google_classroom as string;
        token.image = profile.foto as string;
        token.idToken = account.id_token;
      }
      return token;
    },
    async session({ session, token }) {
      session.accessToken = token.accessToken;
      session.refreshToken = token.refreshToken;
      session.name = token.name;
      session.email = token.email;
      session.image = token.image;
      session.idToken = token.idToken;

      if (session.accessToken && !token.isAuthenticated) {
        try {
          await api.post('/user/login/suap/', {
            access_token: session.accessToken,
          });
          token.isAuthenticated = true;
        } catch (error: any) {
          console.error(
            "Error sending accessToken to the backend:",
            error.message
          );
        }
      }

      return session;
    },
  },
});

Proposal

Provider Features
OAuth provider implementation for SUAP authentication.

Mapping user data retrieved from SUAP to NextAuth's expected format.

Optionally sending the access token to the backend (depending on project needs).