[pull] main from nextauthjs:main

.github/CODEOWNERS

@@ -1 +1,2 @@
 /types/ @balazsorban44 @lluia
+/__tests__/ @lluia

.github/ISSUE_TEMPLATE/feature_request.yaml

@@ -71,4 +71,3 @@ body:
     attributes: 
       value: |
         It takes a lot of work 🏋🏻‍♀️ maintaining a library like `next-auth`; any contribution is more than welcome 💚
-

.github/labeler.yml

@@ -2,23 +2,15 @@ test:
   - test/**/*
   - types/tests/**/*
 
-documentation:
-  - www/**/*
-  - ./**/*.md
-
 providers:
   - src/providers/**/*
-  - www/docs/configuration/providers.md
   - test/integration/**/*
 
 adapters:
   - src/adapters/**/*
-  - www/docs/schemas/adapters.md
 
 databases:
-  - www/docs/schemas/*.md
   - test/docker/databases/**/*
-  - www/docs/configuration/databases.md
   - test/fixtures/**/*
 
 core:
@@ -29,11 +21,9 @@ style:
 
 client:
   - src/client/**/*
-  - www/docs/getting-started/client.md
 
 pages:
   - src/server/pages/**/*
-  - www/docs/configuration/pages.md
 
 TypeScript:
   - types/**/*

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Build
         run: npm run build
       - name: Run tests
-        run: npm test -- --coverage --verbose && npm run test:types
+        run: npm test -- --coverage --verbose
       - name: Coverage
         uses: codecov/codecov-action@v1
         with:
@@ -66,11 +66,21 @@ jobs:
           node-version: 16
       - name: Dependencies
         uses: bahmutov/npm-install@v1
+      - name: Determine version
+        uses: ./config/version-pr
+        id: determine-version
+        env:
+          PR_NUMBER: ${{ github.event.number }}
       - name: Publish to npm
         run: |
           echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> .npmrc
-          npm run version:pr
           npm publish --access public --tag experimental
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          PR_NUMBER: ${{ github.event.number }}
+      - name: Comment version on PR
+        uses: NejcZdovc/comment-pr@v1
+        with:
+          message: "🎉 Experimental release [published on npm](https://www.npmjs.com/package/next-auth/v/${{ env.VERSION }})!\n\n```sh\nnpm i next-auth@${{ env.VERSION }}\n```\n```sh\nyarn add next-auth@${{ env.VERSION }}\n```"
+        env:
+          VERSION: ${{ steps.determine-version.outputs.version }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -20,39 +20,41 @@ node_modules
 .next
 /build
 /dist
-/www/build
 
 # Generated files
 .docusaurus
 .cache-loader
-www/providers.json
-src/providers/index.js
-/internals
+/providers
+/src/providers/oauth-types.ts
+/client
+/css
+/lib
+/core
+/jwt
+/react
 /adapters.d.ts
-/adapters.js
-/client.d.ts
-/client.js
 /index.d.ts
 /index.js
-/jwt.d.ts
-/jwt.js
-/providers.d.ts
-/providers.js
-/errors.js
-/errors.d.ts
+/next
 
 # Development app
-app/next-auth
-app/dist/css
+app/src/css
 app/package-lock.json
 app/yarn.lock
+app/prisma/migrations
+app/prisma/dev.db*
+app/dist
+app/next-auth
 
 # VS
 /.vs/slnx.sqlite-journal
 /.vs/slnx.sqlite
 /.vs
 .vscode
 
+# Jetbrains
+.idea
+
 # GitHub Actions runner
 /actions-runner
 /_work
@@ -61,4 +63,4 @@ app/yarn.lock
 /prisma/migrations
 
 # Tests
-/coverage
+/coverage

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/bin/sh
 . "$(dirname "$0")/_/husky.sh"
 
-npx pretty-quick --staged
+# npx pretty-quick --staged

CONTRIBUTING.md

@@ -25,7 +25,7 @@ Anyone can be a contributor. Either you found a typo, or you have an awesome fea
 
 A quick guide on how to setup _next-auth_ locally to work on it and test out any changes:
 
-The dev application requires you to use `npm@7`.
+The developer application requires you to use `npm@7`.
 
 1. Clone the repo:
 
@@ -34,7 +34,7 @@ git clone git@github.com:nextauthjs/next-auth.git
 cd next-auth
 ```
 
-2. Install packages, set up the dev application:
+2. Install packages and set up the developer application:
 
 ```sh
 npm run dev:setup
@@ -47,23 +47,23 @@ npm run dev:setup
 > NOTE: You can add any environment variables to .env.local that you would like to use in your dev app.
 > You can find the next-auth config under`app/pages/api/auth/[...nextauth].js`.
 
-4. Start the dev application/server:
+1. Start the developer application/server:
 
 ```sh
 npm run dev
 ```
 
-Your dev application will be available on `http://localhost:3000`
+Your developer application will be available on `http://localhost:3000`
 
 That's it! 🎉
 
 If you need an example project to link to, you can use [next-auth-example](https://github.com/iaincollins/next-auth-example).
 
 #### Hot reloading
 
-When running `npm run dev`, you start a Next.js dev server on `http://localhost:3000`, which includes hot reloading out of the box. Make changes on any of the files in `src` and see the changes immediately.
+When running `npm run dev`, you start a Next.js developer server on `http://localhost:3000`, which includes hot reloading out of the box. Make changes on any of the files in `src` and see the changes immediately.
 
-> NOTE: When working on CSS, you will have to manually refresh the page after changes. The reason for this is our pages using CSS are server-side rendered. (Improving this through a PR is very welcome!)
+> NOTE: When working on CSS, you will have to manually refresh the page after changes. The reason for this is our pages using CSS are server-side rendered (using API routes). (Improving this through a PR is very welcome!)
 
 > NOTE: The setup is as follows: The development application lives inside the `app` folder, and whenever you make a change to the `src` folder in the root (where next-auth is), it gets copied into `app` every time (gitignored), so Next.js can pick them up and apply hot reloading. This is to avoid some annoying issues with how symlinks are working with different React builds, and also to provide a super-fast feedback loop while developing core features.
 

README.md

@@ -33,9 +33,10 @@ NextAuth.js is a complete open source authentication solution for [Next.js](http
 It is designed from the ground up to support Next.js and Serverless.
 
 This is the core repo for NextAuth.js. Check the repos below if you are interested in additional information:
+
 - Docs related: https://github.com/nextauthjs/docs
 - Adapter related: https://github.com/nextauthjs/adapters
-         
+
 ## Getting Started
 
 ```
@@ -71,61 +72,64 @@ NextAuth.js can be used with or without a database.
 
 ### Secure by default
 
-- Promotes the use of passwordless sign in mechanisms
-- Designed to be secure by default and encourage best practice for safeguarding user data
-- Uses Cross Site Request Forgery Tokens on POST routes (sign in, sign out)
+- Promotes the use of passwordless sign-in mechanisms
+- Designed to be secure by default and encourage best practices for safeguarding user data
+- Uses Cross-Site Request Forgery (CSRF) Tokens on POST routes (sign in, sign out)
 - Default cookie policy aims for the most restrictive policy appropriate for each cookie
 - When JSON Web Tokens are enabled, they are signed by default (JWS) with HS512
 - Use JWT encryption (JWE) by setting the option `encryption: true` (defaults to A256GCM)
 - Auto-generates symmetric signing and encryption keys for developer convenience
-- Features tab/window syncing and keepalive messages to support short lived sessions
-- Attempts to implement the latest guidance published by [Open Web Application Security Project](https://owasp.org/)
+- Features tab/window syncing and session polling to support short lived sessions
+- Attempts to implement the latest guidance published by [Open Web Application Security Project](https://owasp.org)
 
 Advanced options allow you to define your own routines to handle controlling what accounts are allowed to sign in, for encoding and decoding JSON Web Tokens and to set custom cookie security policies and session properties, so you can control who is able to sign in and how often sessions have to be re-validated.
 
 ### TypeScript
 
-NextAuth.js comes with built-in types. For more information and usage, check out the [TypeScript section](https://next-auth.js.org/getting-started/typescript) in the documentation.
-
-The package at `@types/next-auth` is now deprecated.
+NextAuth.js comes with built-in types. For more information and usage, check out
+the [TypeScript section](https://next-auth.js.org/getting-started/typescript) in the documentation.
 
 ## Example
 
 ### Add API Route
 
 ```javascript
+// pages/api/auth/[...nextauth].js
 import NextAuth from "next-auth"
-import Providers from "next-auth/providers"
+import AppleProvider from "next-auth/providers/apple"
+import GoogleProvider from "next-auth/providers/google"
+import EmailProvider from "next-auth/providers/email"
 
 export default NextAuth({
+  secret: process.env.SECRET,
   providers: [
     // OAuth authentication providers
-    Providers.Apple({
+    AppleProvider({
       clientId: process.env.APPLE_ID,
       clientSecret: process.env.APPLE_SECRET,
     }),
-    Providers.Google({
+    GoogleProvider({
       clientId: process.env.GOOGLE_ID,
       clientSecret: process.env.GOOGLE_SECRET,
     }),
     // Sign in with passwordless email link
-    Providers.Email({
+    EmailProvider({
       server: process.env.MAIL_SERVER,
       from: "<no-reply@example.com>",
     }),
   ],
-  // SQL or MongoDB database (or leave empty)
-  database: process.env.DATABASE_URL,
 })
 ```
 
-### Add React Component
+### Add React Hook
+
+The `useSession()` React Hook in the NextAuth.js client is the easiest way to check if someone is signed in.
 
 ```javascript
-import { useSession, signIn, signOut } from "next-auth/client"
+import { useSession, signIn, signOut } from "next-auth/react"
 
 export default function Component() {
-  const [session, loading] = useSession()
+  const { data: session } = useSession()
   if (session) {
     return (
       <>
@@ -143,7 +147,26 @@ export default function Component() {
 }
 ```
 
-## Acknowledgements
+### Share/configure session state
+
+Use the `<SessionProvider>` to allow instances of `useSession()` to share the session object across components. It also takes care of keeping the session updated and synced between tabs/windows.
+
+```jsx title="pages/_app.js"
+import { SessionProvider } from "next-auth/react"
+
+export default function App({
+  Component, 
+  pageProps: { session, ...pageProps }
+}) {
+  return (
+    <SessionProvider session={session}>
+      <Component {...pageProps} />
+    </SessionProvider>
+  )
+}
+```
+
+## Acknowledgments
 
 [NextAuth.js is made possible thanks to all of its contributors.](https://next-auth.js.org/contributors)
 
@@ -156,7 +179,7 @@ export default function Component() {
 
 ### Support
 
-We're happy to announce we've recently created an [OpenCollective](https://opencollective.org/nextauth) for individuals and companies looking to contribute financially to the project!
+We're happy to announce we've recently created an [OpenCollective](https://opencollective.com/nextauth) for individuals and companies looking to contribute financially to the project!
 
 <!--sponsors start-->
 <table>
@@ -176,13 +199,27 @@ We're happy to announce we've recently created an [OpenCollective](https://openc
         <div>Prisma</div><br />
         <sub>🥉 Bronze Financial Sponsor</sub>
       </td>
+      <td align="center" valign="top">
+        <a href="https://clerk.dev" target="_blank">
+          <img width="128px" src="https://github.com/avatars/u/49538330?s=200&v=4" alt="Prisma Logo" />
+        </a><br />
+        <div>Clerk</div><br />
+        <sub>🥉 Bronze Financial Sponsor</sub>
+      </td>
       <td align="center" valign="top">
         <a href="https://checklyhq.com" target="_blank">
           <img width="128px" src="https://github.com/avatars/u/25982255?v=4" alt="Checkly Logo" />
         </a><br />
         <div>Checkly</div><br />
         <sub>☁️ Infrastructure Support</sub>
       </td>
+      <td align="center" valign="top">
+        <a href="https://superblog.ai/" target="_blank">
+          <img width="128px" src="https://d33wubrfki0l68.cloudfront.net/cdc4a3833bd878933fcc131655878dbf226ac1c5/10cd6/images/logo_bolt_small.png" alt="superblog Logo" />
+        </a><br />
+        <div>superblog</div><br />
+        <sub>☁️ Infrastructure Support</sub>
+      </td>
     </tr><tr></tr>
   </tbody>
 </table>
@@ -191,7 +228,8 @@ We're happy to announce we've recently created an [OpenCollective](https://openc
 
 ## Contributing
 
-We're open to all community contributions! If you'd like to contribute in any way, please first read our [Contributing Guide](https://github.com/nextauthjs/next-auth/blob/canary/CONTRIBUTING.md).
+We're open to all community contributions! If you'd like to contribute in any way, please first read
+our [Contributing Guide](https://github.com/nextauthjs/next-auth/blob/canary/CONTRIBUTING.md).
 
 ## License
 

SECURITY.md

@@ -2,12 +2,6 @@
 
 NextAuth.js practices responsible disclosure.
 
-## Supported Versions
-
-Security updates are only released for the current version.
-
-Old releases are not maintained and do not receive updates.
-
 ## Reporting a Vulnerability
 
 We request that you contact us directly to report serious issues that might impact the security of sites using NextAuth.js.
@@ -19,6 +13,12 @@ If you contact us regarding a serious issue:
 - We will disclose the issue (and credit you, with your consent) once a fix to resolve the issue has been released.
 - If 90 days has elapsed and we still don't have a fix, we will disclose the issue publicly.
 
-Currently, the best way to report an issue is by contacting us via email at me@iaincollins.com or info@balazsorban.com and yo@ndo.dev.
+The best way to report an issue is by contacting us via email at info@balazsorban.com or me@iaincollins.com and yo@ndo.dev, or raise a public issue requesting someone get in touch with you via whatever means you prefer for more details. (Please do not disclose sensitive details publicly at this stage.)
 
-For less serious issues (e.g. RFC compliance for unsupported flows or potential issues that may cause a problem future or default behaviour / options) it is appropriate to submit these these publically as bug reports or feature requests or to raise a question to open a discussion around them.
+> For less serious issues (e.g. RFC compliance for unsupported flows or potential issues that may cause a problem in the future) it is appropriate to submit these these publically as bug reports or feature requests or to raise a question to open a discussion around them.
+
+## Supported Versions
+
+Security updates are only released for the current version.
+
+Old releases are not maintained and do not receive updates.