@ameshkin/ticket-mate 0.1.20

package/public/lib/auth/options.js

@@ -0,0 +1,893 @@
+import AtlassianProvider from "next-auth/providers/atlassian";
+import GitHubProvider from "next-auth/providers/github";
+import GoogleProvider from "next-auth/providers/google";
+import AppleProvider from "next-auth/providers/apple";
+import CredentialsProvider from "next-auth/providers/credentials";
+import { PrismaAdapter } from "@next-auth/prisma-adapter";
+import { prisma } from "@/lib/prisma";
+import { verifyPassword } from "@/lib/password";
+import { encrypt } from "@/lib/encryption";
+import { upsertUserFromAtlassianProfile, } from "@/server/auth/atlassian-user-mapping";
+import { logJiraConnectEvent, getRemediationHint, } from "@/lib/events/jira-connect-events";
+import { ensureAccountForUser, getPrimaryAccountId, } from "@/server/auth/account-provisioning";
+/**
+ * Extract Atlassian identity from OAuth profile with fallback logic
+ *
+ * Atlassian returns different field names depending on the OAuth flow:
+ * - profile.id (common)
+ * - profile.account_id (OAuthProfile)
+ * - profile.accountId (legacy)
+ * - profile.sub (OIDC standard)
+ * - account.providerAccountId (NextAuth adapter)
+ */
+function getAtlassianIdentity({ profile, account, user, }) {
+    // Try all possible sources for accountId
+    const accountId = profile?.id ||
+        profile?.account_id ||
+        profile?.accountId ||
+        profile?.sub ||
+        account?.providerAccountId ||
+        "";
+    // Try all possible sources for email
+    const email = user?.email || profile?.email || profile?.emailAddress || "";
+    // Try all possible sources for name
+    const name = user?.name || profile?.name || profile?.displayName || null;
+    // Try all possible sources for picture
+    const picture = profile?.picture || profile?.avatarUrl || profile?.avatar || null;
+    // Validate we have the minimum required fields
+    if (!accountId || !email) {
+        console.error("[ticket-mate] ❌ Failed to extract Atlassian identity. Missing accountId or email.", {
+            hasAccountId: !!accountId,
+            hasEmail: !!email,
+            profileKeys: profile ? Object.keys(profile) : [],
+            accountKeys: account ? Object.keys(account) : [],
+            userKeys: user ? Object.keys(user) : [],
+            // Log full objects once for debugging (sanitize sensitive data)
+            profile: profile
+                ? { ...profile, access_token: undefined, refresh_token: undefined }
+                : null,
+        });
+        return null;
+    }
+    return { accountId, email, name, picture };
+}
+// Validate critical environment variables at module load time
+// Skip validation in test environment (tests mock these dependencies or use different env setup)
+const isTestEnv = process.env.NODE_ENV === "test" ||
+    typeof process.env.VITEST !== "undefined" ||
+    process.argv.some((arg) => arg.includes("vitest"));
+const requiredEnvVars = {
+    NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET,
+    NEXTAUTH_URL: process.env.NEXTAUTH_URL,
+    DATABASE_URL: process.env.DATABASE_URL,
+};
+const missingVars = Object.entries(requiredEnvVars)
+    .filter(([_, value]) => !value)
+    .map(([key]) => key);
+if (missingVars.length > 0 && !isTestEnv) {
+    console.error("[ticket-mate] ⚠️  Missing required environment variables:", missingVars.join(", "));
+    console.error("[ticket-mate] NextAuth will not work without these variables.");
+    console.error("[ticket-mate] Please set them in your .env.local file or Vercel environment variables.");
+}
+// Use ATLASSIAN_CLIENT_ID and ATLASSIAN_CLIENT_SECRET as canonical env vars
+const atlassianClientId = process.env.ATLASSIAN_CLIENT_ID?.trim();
+const atlassianClientSecret = process.env.ATLASSIAN_CLIENT_SECRET?.trim();
+// Validate required Atlassian OAuth env vars
+if (!atlassianClientId) {
+    console.warn("⚠️  ATLASSIAN_CLIENT_ID is not set. " +
+        "Atlassian OAuth will not work. " +
+        "Set ATLASSIAN_CLIENT_ID and ATLASSIAN_CLIENT_SECRET in your .env file.");
+}
+if (!atlassianClientSecret) {
+    console.warn("⚠️  ATLASSIAN_CLIENT_SECRET is not set. " +
+        "Atlassian OAuth will not work. " +
+        "Set ATLASSIAN_CLIENT_ID and ATLASSIAN_CLIENT_SECRET in your .env file.");
+}
+// Check if GitHub OAuth is enabled (only log once at startup, not on every request)
+const githubEnabled = !!(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET);
+/**
+ * Jira OAuth Scopes Configuration
+ *
+ * Two-tier scope design:
+ * 1. BASELINE scopes: Minimal set required for login and basic Jira read access
+ * 2. ELEVATED scopes: Additional admin permissions for workspace management
+ *
+ * Use ATLASSIAN_USE_ELEVATED_SCOPES=true to request elevated scopes.
+ * Start with baseline scopes (default) to ensure consent works, then enable elevated scopes
+ * after confirming your Atlassian app is configured for those permissions.
+ */
+// Baseline scopes: Minimal set for login and basic Jira read access
+// These scopes almost always work and don't require special Atlassian app configuration
+export const BASELINE_JIRA_SCOPES = [
+    "offline_access", // Required for refresh tokens
+    "read:me", // Read current user profile
+    "read:account", // Read account information
+    "read:jira-user", // Read Jira user information
+    "read:jira-work", // Read Jira issues and work items
+    "write:jira-work", // Create/update Jira issues
+].join(" ");
+// Elevated scopes: Additional permissions for workspace management and admin operations
+// These scopes require your Atlassian app to be configured with the appropriate permissions
+export const ELEVATED_JIRA_SCOPES = [
+    ...BASELINE_JIRA_SCOPES.split(" "),
+    "write:jira-work", // Create/update Jira issues
+    "manage:jira-project", // Manage Jira projects
+    "manage:jira-configuration", // Manage Jira configuration
+    "manage:jira-webhook", // Manage Jira webhooks
+    "manage:jira-data-provider", // Manage Jira data providers
+].join(" ");
+// Determine which scope set to use
+// Default to BASELINE for maximum compatibility
+// Set ATLASSIAN_USE_ELEVATED_SCOPES=true to request elevated permissions
+const useElevatedScopes = process.env.ATLASSIAN_USE_ELEVATED_SCOPES === "true";
+const jiraScopes = useElevatedScopes
+    ? ELEVATED_JIRA_SCOPES
+    : BASELINE_JIRA_SCOPES;
+// Log minimal config info
+if (process.env.NODE_ENV === "development") {
+    console.log(`[ticket-mate] Jira Scopes: ${useElevatedScopes ? "ELEVATED" : "BASELINE"}`);
+}
+// Log Atlassian OAuth config in all environments to debug production issues
+// This helps identify when NEXTAUTH_URL is misconfigured (e.g., localhost in production)
+const nextAuthUrl = process.env.NEXTAUTH_URL?.trim();
+// Enforce callback path normalization (ANTIGRAVITY DIRECTIVE)
+if (!nextAuthUrl) {
+    console.error("[ticket-mate] 🚨 NEXTAUTH_URL is missing! Hard failing.");
+    if (process.env.NODE_ENV === "production") {
+        throw new Error("NEXTAUTH_URL must be set in production");
+    }
+}
+const expectedCallbackPath = "/api/auth/callback/atlassian";
+const callbackUrl = nextAuthUrl
+    ? `${nextAuthUrl}${expectedCallbackPath}`
+    : "(NEXTAUTH_URL not set)";
+console.log("[ticket-mate] 🔒 Atlassian OAuth Configuration:");
+console.log(`[ticket-mate]    Provider ID:        atlassian`);
+console.log(`[ticket-mate]    Callback Path:      ${expectedCallbackPath}`);
+console.log(`[ticket-mate]    Full Callback URL:  ${callbackUrl}`);
+console.log(`[ticket-mate]    NEXTAUTH_URL:       ${nextAuthUrl}`);
+const githubCallbackPath = "/api/auth/callback/github";
+const githubCallbackUrl = nextAuthUrl
+    ? `${nextAuthUrl}${githubCallbackPath}`
+    : "(NEXTAUTH_URL not set)";
+console.log("[ticket-mate] 🐙 GitHub OAuth Configuration:");
+console.log(`[ticket-mate]    Provider ID:        github`);
+console.log(`[ticket-mate]    Enabled:            ${githubEnabled}`);
+console.log(`[ticket-mate]    Callback Path:      ${githubCallbackPath}`);
+console.log(`[ticket-mate]    Full Callback URL:  ${githubCallbackUrl}`);
+console.log(`[ticket-mate]    Client ID Set:      ${!!process.env.GITHUB_CLIENT_ID}`);
+// Hard validation of environment
+if (nextAuthUrl &&
+    nextAuthUrl.includes("localhost") &&
+    process.env.NODE_ENV === "production") {
+    console.error("[ticket-mate] 🚨 NEXTAUTH_URL is localhost in PRODUCTION! This will break OAuth.");
+}
+// Check if we're actually in a production deployment (Vercel sets VERCEL=1)
+const isProductionDeployment = process.env.VERCEL === "1" || process.env.VERCEL_ENV === "production";
+const isLocalBuild = !isProductionDeployment && process.env.NODE_ENV === "production";
+/**
+ * NextAuth Configuration
+ *
+ * IMPORTANT: NextAuth v4 does NOT support a `url` property in authOptions.
+ * The base URL is controlled by the NEXTAUTH_URL environment variable.
+ *
+ * NextAuth automatically constructs callback URLs as:
+ *   ${NEXTAUTH_URL}/api/auth/callback/atlassian
+ *
+ * This must match EXACTLY what's registered in Atlassian Developer Console.
+ * The callback URL is derived from NEXTAUTH_URL environment variable.
+ *
+ * Environment Configuration:
+ *   - Local dev (.env.local): NEXTAUTH_URL="http://localhost:4000"
+ *   - Vercel production: Set NEXTAUTH_URL="https://ticket-mate.app" in Vercel dashboard
+ *
+ * NOTE: Do not test /api/auth/callback/atlassian directly.
+ * It must be reached via the "Sign in with Jira" button,
+ * so NextAuth can set and validate the state cookie correctly.
+ */
+// Validate NEXTAUTH_SECRET (required for NextAuth to work)
+if (!process.env.NEXTAUTH_SECRET) {
+    console.error("[ticket-mate] ⚠️  NEXTAUTH_SECRET is not set! NextAuth will not work.");
+    console.error("[ticket-mate] Set NEXTAUTH_SECRET in your environment:");
+    console.error("[ticket-mate]   - Generate a secret: openssl rand -base64 32");
+    console.error('[ticket-mate]   - Add to .env.local: NEXTAUTH_SECRET="your-secret-here"');
+    console.error("[ticket-mate]   - For production: Set in Vercel dashboard → Environment Variables");
+}
+export const authOptions = {
+    adapter: PrismaAdapter(prisma),
+    secret: process.env.NEXTAUTH_SECRET, // Required for JWT signing
+    session: {
+        strategy: "jwt", // Use JWT even with adapter for better control
+    },
+    // NextAuth automatically uses secure cookies when NEXTAUTH_URL starts with https://
+    providers: [
+        CredentialsProvider({
+            name: "Credentials",
+            credentials: {
+                email: { label: "Email", type: "email" },
+                password: { label: "Password", type: "password" },
+            },
+            async authorize(credentials) {
+                try {
+                    console.log("[ticket-mate] CredentialsProvider: authorize called for email:", credentials?.email);
+                    if (!credentials?.email || !credentials?.password) {
+                        console.log("[ticket-mate] CredentialsProvider: Missing email or password");
+                        return null;
+                    }
+                    let user;
+                    try {
+                        console.log("[ticket-mate] CredentialsProvider: Looking up user in database...");
+                        console.log("[ticket-mate] Database connection:", {
+                            url: process.env.DATABASE_URL
+                                ? process.env.DATABASE_URL.replace(/:[^:@]+@/, ":****@")
+                                : "(not set)",
+                        });
+                        user = await prisma.user.findUnique({
+                            where: { email: credentials.email },
+                        });
+                        console.log("[ticket-mate] CredentialsProvider: User lookup result:", user ? `Found user ID: ${user.id}` : "User not found");
+                    }
+                    catch (dbError) {
+                        console.error("[ticket-mate] Database error in CredentialsProvider:", dbError);
+                        return null;
+                    }
+                    if (!user) {
+                        // User not found - don't reveal this to prevent email enumeration
+                        console.log("[ticket-mate] CredentialsProvider: User not found (silent return)");
+                        return null;
+                    }
+                    // Check if user has a password set (for local auth)
+                    if (!user.hashedPassword) {
+                        // User exists but no password set - they need to use OAuth or set a password
+                        console.log("[ticket-mate] CredentialsProvider: User has no password set, must use OAuth");
+                        return null;
+                    }
+                    // Check if email is verified (allow login if emailVerified is null for backward compatibility)
+                    // TODO: Implement email verification flow if required
+                    // For now, we allow login even if emailVerified is null to support existing users
+                    // if (!user.emailVerified) {
+                    //     console.log('[ticket-mate] CredentialsProvider: Email not verified for', credentials.email);
+                    //     throw new Error('Please verify your email address before signing in.');
+                    // }
+                    // Verify password
+                    console.log("[ticket-mate] CredentialsProvider: Verifying password...");
+                    const isValid = await verifyPassword(credentials.password, user.hashedPassword);
+                    if (!isValid) {
+                        console.log("[ticket-mate] CredentialsProvider: Password verification failed for", credentials.email);
+                        return null;
+                    }
+                    console.log("[ticket-mate] CredentialsProvider: Login successful for", credentials.email, "userId:", user.id);
+                    // Return user object for NextAuth
+                    return {
+                        id: user.id,
+                        email: user.email,
+                        name: user.name || undefined,
+                    };
+                }
+                catch (error) {
+                    console.error("[ticket-mate] CredentialsProvider authorize error:", error);
+                    return null;
+                }
+            },
+        }),
+        // GitHub OAuth App (NextAuth) - for user login and identity
+        // Purpose: User authentication, consent, mapping GitHub user → internal User
+        // Callback URL: https://ticket-mate.app/api/auth/callback/github (handled by NextAuth)
+        //
+        // IMPORTANT: This is separate from GitHub App (installation/automation)
+        // - OAuth App = Human identity + consent
+        // - GitHub App = System authority (repos, PRs, automation)
+        // Never use OAuth tokens for repo mutations in production
+        ...(githubEnabled
+            ? [
+                GitHubProvider({
+                    clientId: process.env.GITHUB_CLIENT_ID,
+                    clientSecret: process.env.GITHUB_CLIENT_SECRET,
+                    allowDangerousEmailAccountLinking: true, // Allow linking accounts with same email
+                    authorization: {
+                        params: {
+                            scope: "read:user user:email repo",
+                        },
+                    },
+                    // NextAuth automatically constructs callback URL as:
+                    // ${NEXTAUTH_URL}/api/auth/callback/github
+                    // This must match what's configured in GitHub OAuth App settings
+                }),
+            ]
+            : []),
+        AtlassianProvider({
+            /**
+             * Jira/Atlassian OAuth Provider Configuration
+             *
+             * Uses ATLASSIAN_CLIENT_ID and ATLASSIAN_CLIENT_SECRET env vars.
+             * These must be set in your environment:
+             *   - ATLASSIAN_CLIENT_ID - must match Atlassian Developer Console Client ID exactly
+             *   - ATLASSIAN_CLIENT_SECRET - from same Atlassian app
+             *   - NEXTAUTH_URL (REQUIRED - no default, must be set per environment)
+             *   - ATLASSIAN_USE_ELEVATED_SCOPES (optional) - set to "true" to request admin scopes
+             *
+             * The callback URL is automatically constructed by NextAuth as:
+             *   ${NEXTAUTH_URL}/api/auth/callback/atlassian
+             *
+             * Atlassian Developer Console Configuration:
+             *   - Go to: https://developer.atlassian.com/console/myapps/
+             *   - Select your TICKET MATE app → Authorization → OAuth 2.0 (3LO)
+             *   - Client ID must match ATLASSIAN_CLIENT_ID exactly
+             *   - Callback URLs (one per line, EXACT match, no trailing slash):
+             *     * http://localhost:4000/api/auth/callback/atlassian
+             *     * https://ticket-mate.app/api/auth/callback/atlassian
+             *   - Permissions: Ensure your app has the permissions for the requested scopes
+             *     * Baseline scopes: Usually work by default
+             *     * Elevated scopes: Require explicit permission configuration in Atlassian
+             *
+             * Scope Configuration:
+             *   - Default: BASELINE scopes (read-only, recommended for initial setup)
+             *   - Elevated: Set ATLASSIAN_USE_ELEVATED_SCOPES=true for admin permissions
+             *   - If consent fails, start with baseline scopes and add elevated scopes incrementally
+             */
+            id: "atlassian",
+            clientId: atlassianClientId,
+            clientSecret: atlassianClientSecret,
+            authorization: {
+                url: "https://auth.atlassian.com/authorize",
+                params: {
+                    audience: "api.atlassian.com",
+                    prompt: "consent",
+                    // NextAuth will automatically add: client_id, redirect_uri, response_type=code
+                    scope: jiraScopes,
+                },
+            },
+            token: "https://auth.atlassian.com/oauth/token",
+            allowDangerousEmailAccountLinking: true,
+        }),
+        GoogleProvider({
+            clientId: process.env.GOOGLE_CLIENT_ID ?? "",
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET ?? "",
+            allowDangerousEmailAccountLinking: true,
+        }),
+        AppleProvider({
+            clientId: process.env.APPLE_ID ?? "",
+            clientSecret: process.env.APPLE_SECRET ?? "",
+            allowDangerousEmailAccountLinking: true,
+        }),
+    ],
+    callbacks: {
+        // redirect callback moved to avoid duplication - see below
+        async jwt({ token, account, user, profile }) {
+            // On first sign-in (when account and user are present), map Atlassian profile to internal User
+            if (account && user && account.provider === "atlassian" && profile) {
+                try {
+                    // Extract Atlassian profile data using helper with fallback logic
+                    const identity = getAtlassianIdentity({ profile, account, user });
+                    if (!identity) {
+                        console.error("[ticket-mate] ❌ JWT callback: Failed to extract Atlassian identity");
+                        // Don't block token creation - use what we have from user object
+                    }
+                    else {
+                        // Construct AtlassianProfile for upsert
+                        const atlassianProfile = {
+                            accountId: identity.accountId,
+                            email: identity.email,
+                            name: identity.name,
+                            picture: identity.picture,
+                            avatarUrl: identity.picture,
+                        };
+                        // Upsert user from Atlassian profile - this ensures we have an internal User id
+                        const internalUserId = await upsertUserFromAtlassianProfile(atlassianProfile);
+                        // Store internal User id in token (this is the Prisma pk, not Atlassian account id)
+                        token.userId = internalUserId;
+                        token.id = String(internalUserId);
+                        token.email = atlassianProfile.email;
+                        token.name = atlassianProfile.name || atlassianProfile.email;
+                        token.atlassianAccountId = atlassianProfile.accountId; // Store for reference only
+                        console.log("[ticket-mate] Atlassian profile mapped to User:", {
+                            atlassianAccountId: atlassianProfile.accountId,
+                            internalUserId,
+                            email: atlassianProfile.email,
+                        });
+                    }
+                }
+                catch (error) {
+                    console.error("[ticket-mate] Error mapping Atlassian profile in jwt callback:", error);
+                    // Don't block token creation - use what we have
+                }
+            }
+            // Ensure token.userId is set if user object is present (standard login)
+            // This must happen BEFORE processing account-specific logic below (like GitHub credential storage)
+            if (user) {
+                if (!token.userId) {
+                    token.userId = user.id;
+                    token.id = String(user.id);
+                    console.log("[ticket-mate] JWT callback: Set userId from user object:", user.id, "(type:", typeof user.id, ")");
+                }
+                if (!token.email && user.email) {
+                    token.email = user.email || undefined;
+                }
+                if (!token.name && user.name) {
+                    token.name = user.name || undefined;
+                }
+            }
+            if (account) {
+                // Store provider-specific tokens (for reference, but adapter stores in DB)
+                if (account.provider === "github") {
+                    token.githubAccessToken = account.access_token;
+                    // GITHUB-1: Store GitHub credentials persistently
+                    if (token.userId && account.access_token) {
+                        console.log("[ticket-mate] 💾 Storing GitHub credentials...");
+                        const { encrypt } = await import("@/lib/encryption");
+                        const encryptedToken = encrypt(account.access_token);
+                        const encryptedRefreshToken = account.refresh_token
+                            ? encrypt(account.refresh_token)
+                            : null;
+                        const githubProfile = profile;
+                        const userIdStr = String(token.userId);
+                        await prisma.gitHubCredential.upsert({
+                            where: { userId: userIdStr },
+                            create: {
+                                userId: userIdStr,
+                                accessToken: encryptedToken,
+                                refreshToken: encryptedRefreshToken,
+                                scope: account.scope || null,
+                                githubUserId: githubProfile.id ? parseInt(String(githubProfile.id)) : null,
+                                githubLogin: githubProfile.login || null,
+                                githubName: githubProfile.name || null,
+                                githubEmail: githubProfile.email || null,
+                            },
+                            update: {
+                                accessToken: encryptedToken,
+                                refreshToken: encryptedRefreshToken,
+                                scope: account.scope || null,
+                                githubUserId: githubProfile.id ? parseInt(String(githubProfile.id)) : null,
+                                githubLogin: githubProfile.login || null,
+                                githubName: githubProfile.name || null,
+                                githubEmail: githubProfile.email || null,
+                            },
+                        });
+                        console.log("[ticket-mate] ✅ GitHub credentials stored");
+                        token.hasGitHub = true;
+                    }
+                }
+                else if (account.provider === "atlassian") {
+                    token.atlassianAccessToken = account.access_token;
+                    token.atlassianRefreshToken = account.refresh_token;
+                    if (typeof account.expires_at === "number") {
+                        token.atlassianExpiresAt = account.expires_at * 1000;
+                    }
+                    // Store Atlassian account ID for reference (but use internal User id as primary)
+                    token.atlassianAccountId =
+                        token.atlassianAccountId || profile?.accountId;
+                    // ANTIGRAVITY DIRECTIVE: Normalize Credential Storage
+                    // Store Jira credentials immediately upon login/link to avoid needing a separate flow
+                    console.log("[ticket-mate] 🔍 Jira credential storage check:", {
+                        hasUserId: !!token.userId,
+                        userId: token.userId,
+                        hasAccessToken: !!account.access_token,
+                        hasRefreshToken: !!account.refresh_token,
+                    });
+                    if (token.userId && account.access_token && account.refresh_token) {
+                        console.log("[ticket-mate] ✅ All conditions met, attempting to store Jira credentials...");
+                        // Log connect start event
+                        await logJiraConnectEvent({
+                            eventType: "jira.connect.start",
+                            userId: String(token.userId),
+                            metadata: {
+                                atlassianCallbackUrlResolved: `${process.env.NEXTAUTH_URL}/api/auth/callback/atlassian`,
+                                nextAuthUrlResolved: process.env.NEXTAUTH_URL,
+                            },
+                        });
+                        try {
+                            const userIdStr = String(token.userId);
+                            // 1. Fetch accessible resources (Jira Cloud ID)
+                            console.log("[ticket-mate] 📡 Fetching accessible Jira resources...");
+                            const resourcesResponse = await fetch("https://api.atlassian.com/oauth/token/accessible-resources", {
+                                headers: {
+                                    Authorization: `Bearer ${account.access_token}`,
+                                    Accept: "application/json",
+                                },
+                            });
+                            console.log("[ticket-mate] 📡 Resources response status:", resourcesResponse.status);
+                            if (resourcesResponse.ok) {
+                                const resources = (await resourcesResponse.json());
+                                console.log("[ticket-mate] 📡 Found", resources.length, "accessible resources");
+                                const jiraResource = resources.find((r) => r.url.includes(".atlassian.net"));
+                                if (jiraResource) {
+                                    console.log("[ticket-mate] 🎯 Found Jira resource:", {
+                                        id: jiraResource.id,
+                                        url: jiraResource.url,
+                                        name: jiraResource.name,
+                                    });
+                                    console.log("[ticket-mate] 🔐 Encrypting tokens...");
+                                    const encryptedAccessToken = encrypt(account.access_token);
+                                    const encryptedRefreshToken = encrypt(account.refresh_token);
+                                    console.log("[ticket-mate] ✅ Tokens encrypted successfully");
+                                    const expiresAt = typeof account.expires_at === "number"
+                                        ? new Date(account.expires_at * 1000)
+                                        : new Date(Date.now() + 3600 * 1000);
+                                    // Ensure User exists before creating JiraCredential (prevents P2025)
+                                    const { ensureUserExists } = await import("../../server/jira/ensure-user");
+                                    await ensureUserExists(userIdStr);
+                                    console.log("[ticket-mate] 💾 Upserting Jira credential to database...");
+                                    await prisma.jiraCredential.upsert({
+                                        where: { userId: userIdStr },
+                                        create: {
+                                            userId: userIdStr,
+                                            cloudId: jiraResource.id,
+                                            jiraBaseUrl: jiraResource.url,
+                                            accessToken: encryptedAccessToken,
+                                            refreshToken: encryptedRefreshToken,
+                                            scope: account.scope || "",
+                                            expiresAt,
+                                        },
+                                        update: {
+                                            cloudId: jiraResource.id,
+                                            jiraBaseUrl: jiraResource.url,
+                                            accessToken: encryptedAccessToken,
+                                            refreshToken: encryptedRefreshToken,
+                                            scope: account.scope || "",
+                                            expiresAt,
+                                        },
+                                    });
+                                    console.log("[ticket-mate] ✅ ✅ ✅ Auto-stored Jira credentials for user:", userIdStr);
+                                    // Log success event
+                                    await logJiraConnectEvent({
+                                        eventType: "jira.connect.callback.success",
+                                        userId: userIdStr,
+                                        metadata: {
+                                            cloudId: jiraResource.id,
+                                            jiraBaseUrl: jiraResource.url,
+                                            scope: account.scope || "",
+                                            expiresAt,
+                                        },
+                                    });
+                                }
+                                else {
+                                    console.warn("[ticket-mate] ⚠️  No Jira resource found in accessible resources");
+                                }
+                            }
+                            else {
+                                console.error("[ticket-mate] ❌ Failed to fetch accessible resources:", resourcesResponse.statusText);
+                            }
+                        }
+                        catch (credError) {
+                            console.error("[ticket-mate] ❌ Failed to auto-store Jira credential:", credError);
+                            console.error("[ticket-mate] ❌ Error stack:", credError.stack);
+                            // Log failure event
+                            await logJiraConnectEvent({
+                                eventType: "jira.connect.callback.failed",
+                                userId: String(token.userId),
+                                metadata: {
+                                    errorClass: credError.name,
+                                    errorMessage: credError.message,
+                                    remediationHint: getRemediationHint(credError),
+                                },
+                            });
+                        }
+                    }
+                    else {
+                        console.warn("[ticket-mate] ⚠️  Skipping Jira credential storage - missing required data");
+                    }
+                }
+                else if (account.provider === "google") {
+                    token.googleAccessToken = account.access_token;
+                }
+                else if (account.provider === "apple") {
+                    token.appleAccessToken = account.access_token;
+                }
+                // Store provider info for session
+                token.lastProvider = account.provider;
+            }
+            // Note: User info assignment moved to top of function (lines 533+) to ensure token.userId is available
+            // ANTIGRAVITY DIRECTIVE: Tenancy - Ensure Account Exists
+            // This runs on every JWT generation (sign-in, refresh), creating a safe checkpoint
+            if (token.userId) {
+                try {
+                    // We use token.email/name which might be populated from user object above
+                    const userId = String(token.userId);
+                    const userEmail = token.email || null;
+                    const userName = token.name || null;
+                    // Ensure account exists and get active account ID
+                    // This is efficient because ensureAccountForUser checks existence first
+                    const accountId = await ensureAccountForUser(userId, userEmail, userName);
+                    // Store in token for session callback to use without DB hit (optimization)
+                    token.accountId = accountId;
+                }
+                catch (err) {
+                    console.error("[ticket-mate] ❌ Failed to ensure account tenancy in JWT callback:", err);
+                }
+            }
+            return token;
+        },
+        async session({ session, token }) {
+            try {
+                // session.user.id is the internal User id (Prisma pk), not Atlassian account id
+                // This is set from token.userId which comes from user.id in jwt callback
+                if (token.userId) {
+                    // token.userId is already a string (from Prisma User.id)
+                    session.user.id = String(token.userId); // Ensure it's a string for NextAuth compatibility
+                    session.userId = token.userId; // Internal User id (string, for backward compatibility)
+                    console.log("[ticket-mate] Session callback: Set user.id from token.userId:", token.userId);
+                }
+                else if (token.id) {
+                    session.user.id = String(token.id);
+                    // token.id is a string (from Prisma User.id), so userId should also be string
+                    session.userId = String(token.id);
+                    console.log("[ticket-mate] Session callback: Set user.id from token.id:", token.id);
+                }
+                else {
+                    console.warn("[ticket-mate] Session callback: No userId or id in token!", {
+                        tokenKeys: Object.keys(token),
+                    });
+                }
+                // Add provider info to session
+                // Note: We don't expose access tokens in session for security
+                // Tokens are stored in DB via PrismaAdapter and can be accessed server-side
+                session.atlassian = {
+                    hasJira: Boolean(token.atlassianAccessToken),
+                    accountId: token.atlassianAccountId || null, // Atlassian account ID for reference
+                    // Do NOT expose accessToken in session (security risk)
+                };
+                // ANTIGRAVITY DIRECTIVE: Tenancy - Expose Account ID
+                if (token.accountId) {
+                    session.user.accountId = token.accountId;
+                }
+                else if (token.userId) {
+                    // Fallback: If token doesn't have it (legacy), fetch from DB
+                    const pId = await getPrimaryAccountId(String(token.userId));
+                    if (pId) {
+                        session.user.accountId = pId;
+                    }
+                }
+                // GITHUB-1: Query GitHubCredential to get actual connection status
+                if (token.userId) {
+                    try {
+                        const githubCred = await prisma.gitHubCredential.findUnique({
+                            where: { userId: String(token.userId) },
+                            // select: { githubLogin: true }, // Removed to avoid Prisma mismatch
+                        });
+                        if (githubCred) {
+                            session.github = {
+                                hasGitHub: true,
+                                login: githubCred.githubLogin || githubCred.login,
+                            };
+                        }
+                        else {
+                            session.github = {
+                                hasGitHub: false,
+                            };
+                        }
+                    }
+                    catch (error) {
+                        console.warn("[ticket-mate] Failed to check GitHub credential:", error);
+                        session.github = {
+                            hasGitHub: Boolean(token.githubAccessToken),
+                        };
+                    }
+                }
+                else {
+                    session.github = {
+                        hasGitHub: Boolean(token.githubAccessToken),
+                    };
+                }
+                session.google = {
+                    hasGoogle: Boolean(token.googleAccessToken),
+                };
+                session.apple = {
+                    hasApple: Boolean(token.appleAccessToken),
+                };
+                session.lastProvider = token.lastProvider; // Last provider used for sign-in
+                return session;
+            }
+            catch (error) {
+                console.error("[ticket-mate] Session callback error:", error);
+                return session; // Return existing session on error
+            }
+        },
+        async signIn({ user, account, profile }) {
+            // Validate Atlassian sign-in has required profile data
+            // The actual user mapping happens in jwt callback where we have full control
+            if (account?.provider === "atlassian") {
+                if (!profile) {
+                    console.error("[ticket-mate] Atlassian sign-in missing profile data");
+                    return false;
+                }
+                // Use helper to extract identity with comprehensive fallback logic
+                const identity = getAtlassianIdentity({ profile, account, user });
+                if (!identity) {
+                    console.error("[ticket-mate] ❌ Atlassian sign-in rejected: Could not extract accountId or email from profile");
+                    return false;
+                }
+                console.log("[ticket-mate] ✅ Atlassian identity extracted successfully:", {
+                    accountId: identity.accountId,
+                    email: identity.email,
+                    hasName: !!identity.name,
+                    hasPicture: !!identity.picture,
+                });
+                // Sign-in is valid - user mapping will happen in jwt callback
+                // NOTE: We do NOT store JiraCredential here
+                // Credential storage happens in the "Connect Jira workspace" flow (separate from login)
+                // This separation ensures login = identity, workspace connection = which Jira site to use
+            }
+            else if (account?.provider === "github" && user?.email) {
+                // Handle GitHub sign-in (existing logic)
+                try {
+                    let dbUser = await prisma.user.findUnique({
+                        where: { email: user.email },
+                    });
+                    if (!dbUser) {
+                        // Create new user for GitHub
+                        // Note: firstName, lastName, isNewUser, onboardingStep, status don't exist in simplified User schema
+                        // User.id is String in schema and required - generate a cuid
+                        const { randomUUID } = await import("crypto");
+                        dbUser = await prisma.user.create({
+                            data: {
+                                id: randomUUID(),
+                                email: user.email,
+                                name: user.name || null,
+                                subscription: "free", // Default subscription
+                            },
+                        });
+                    }
+                    // Store GitHub tokens
+                    if (account.access_token) {
+                        const expiresAt = account.expires_at
+                            ? new Date(account.expires_at * 1000)
+                            : undefined;
+                        // Note: githubAccessToken, githubRefreshToken, githubTokenExpiresAt, onboardingStep don't exist in simplified User schema
+                        // GitHub tokens are not stored in User model - they're handled by NextAuth Account model (if it exists)
+                        // For now, just update the user's name if provided
+                        if (user.name && user.name !== dbUser.name) {
+                            await prisma.user.update({
+                                where: { id: dbUser.id },
+                                data: {
+                                    name: user.name,
+                                },
+                            });
+                        }
+                    }
+                    // Update user object with internal id
+                    user.id = String(dbUser.id);
+                }
+                catch (error) {
+                    console.error("[ticket-mate] Error handling GitHub sign-in:", error);
+                    // Allow sign-in to proceed even if token storage fails
+                }
+            }
+            // Allow all sign-ins (authentication succeeded)
+            return true;
+        },
+        // Explicit redirect callback to ensure URLs are properly constructed
+        // For Atlassian OAuth, NextAuth automatically constructs the callback URL as:
+        // ${NEXTAUTH_URL}/api/auth/callback/atlassian
+        // This must match exactly what's registered in Atlassian Developer Console
+        async redirect({ url, baseUrl }) {
+            if (process.env.OAUTH_DEBUG === "true") {
+                try {
+                    console.log("[oauth-debug] NEXTAUTH_REDIRECT_CALLBACK", JSON.stringify({ url, baseUrl }, null, 2));
+                }
+                catch {
+                    console.log("[oauth-debug] NEXTAUTH_REDIRECT_CALLBACK", {
+                        url,
+                        baseUrl,
+                    });
+                }
+            }
+            // baseUrl is automatically set from NEXTAUTH_URL or request origin
+            // For local dev: http://localhost:4000
+            // For production: ${NEXTAUTH_URL}
+            // Force admin dashboard for root and dashboard paths
+            if (url === "/" ||
+                url === "/dashboard" ||
+                url === `${baseUrl}/` ||
+                url === `${baseUrl}/dashboard`) {
+                return `${baseUrl}/admin/dashboard`;
+            }
+            if (url.startsWith("/")) {
+                return `${baseUrl}${url}`;
+            }
+            if (new URL(url).origin === baseUrl) {
+                return url;
+            }
+            return `${baseUrl}/admin/dashboard`;
+        },
+    },
+    pages: {
+        signIn: "/login",
+        error: "/login?error=oauth_error", // Error page redirects to login with error param
+    },
+    events: {
+        async signIn({ user, account, profile, isNewUser }) {
+            if (account?.provider === "atlassian") {
+                console.log("[ticket-mate] ✅ Atlassian sign-in successful:", {
+                    userId: user.id,
+                    email: user.email,
+                    accountId: account.providerAccountId,
+                    isNewUser,
+                });
+            }
+            // ANTIGRAVITY DIRECTIVE: FEAT-002 - Token Encryption
+            // Clear plain text tokens from the Account table immediately after sign-in.
+            // We store encrypted tokens in JiraCredential (for Atlassian) or rely on re-auth (for others).
+            if (account && user) {
+                try {
+                    console.log("[ticket-mate] 🔒 Clearing plain-text tokens from Account table...");
+                    await prisma.account.updateMany({
+                        where: {
+                            provider: account.provider,
+                            providerAccountId: account.providerAccountId,
+                        },
+                        data: {
+                            access_token: null,
+                            refresh_token: null,
+                        },
+                    });
+                    console.log("[ticket-mate] ✨ Account tokens cleared successfully");
+                }
+                catch (error) {
+                    // Non-critical: if the account record isn't found yet (race condition) or update fails
+                    console.warn("[ticket-mate] ⚠️ Failed to clear account tokens:", error);
+                }
+            }
+        },
+    },
+    logger: {
+        error(code, metadata) {
+            // Enhanced error logging for OAuth/OAuthCallback errors
+            if (code === "OAUTH_CALLBACK_ERROR" ||
+                code === "OAUTH_CALLBACK_HANDLER_ERROR") {
+                console.error("[ticket-mate] ❌ Atlassian OAuth Callback Error:", {
+                    code,
+                    message: metadata?.message,
+                    error: metadata?.error,
+                    // Safely log error_description if present (Atlassian often includes this)
+                    errorDescription: metadata?.error_description,
+                    // Log stack only in development
+                    stack: process.env.NODE_ENV === "development"
+                        ? metadata?.stack
+                        : undefined,
+                });
+                // If Atlassian returned error params, provide actionable hints
+                const error = metadata?.error;
+                const errorDescription = metadata?.error_description;
+                if (error || errorDescription) {
+                    console.error("[ticket-mate] 💡 Atlassian Error Details:", {
+                        error,
+                        errorDescription,
+                    });
+                    console.error("[ticket-mate] 💡 Common causes:");
+                    console.error("[ticket-mate]    1. Requested scopes not allowed in Atlassian app configuration");
+                    console.error("[ticket-mate]    2. Redirect URI mismatch (check Atlassian Developer Console)");
+                    console.error("[ticket-mate]    3. App not authorized for requested permissions");
+                    console.error("[ticket-mate]    💡 Try: Set ATLASSIAN_USE_ELEVATED_SCOPES=false to use baseline scopes");
+                }
+                return;
+            }
+            // Suppress JWT_SESSION_ERROR from console.error as it's often transient/recoverable (e.g. secret rotation)
+            // We log it as a warning to keep it in "logs" but reduce noise
+            if (code === "JWT_SESSION_ERROR") {
+                // Log strictly to stdout or a warning, avoiding the scary console.error trace
+                console.warn(`[ticket-mate] NextAuth Warning: ${code} - ${metadata?.message || "Decryption failed"}. This is expected if secrets rotated.`);
+                return;
+            }
+            // Log other errors
+            console.error(`[ticket-mate] NextAuth Error [${code}]:`, metadata);
+        },
+        warn(code, metadata) {
+            // Enhanced warning for OAuth-related warnings
+            if (code?.includes("OAUTH") || code?.includes("oauth")) {
+                console.warn(`[ticket-mate] ⚠️  NextAuth OAuth Warning [${code}]:`, metadata);
+            }
+            else {
+                console.warn(`[ticket-mate] NextAuth Warning [${code}]:`, metadata);
+            }
+        },
+        debug(code, metadata) {
+            // Enable debug logging in development for OAuth flows
+            if (process.env.NODE_ENV === "development" &&
+                (code?.includes("OAUTH") || code?.includes("oauth"))) {
+                console.debug(`[ticket-mate] 🔍 NextAuth OAuth Debug [${code}]:`, metadata);
+            }
+        },
+    },
+    debug: false, // Disable debug logging to reduce JWT error noise (errors still logged at error level)
+};
+//# sourceMappingURL=options.js.map