@evenicanpm/storefront-core 1.0.0-alpha

package/src/api-manager/services/user/mutations/create-wishlist.ts

@@ -0,0 +1,21 @@
+import { useQueryClient } from "@tanstack/react-query";
+import { createApiPath } from "../../create-query";
+import { useCreateMutation } from "../../create-mutation";
+import {
+  CreateWishListInput,
+  WishList,
+} from "../../../datasources/e4/graphqlRequestSdk";
+
+const apiPath = createApiPath("user", "createWishlist");
+
+const useCreateWishlist = () => {
+  const queryClient = useQueryClient();
+
+  return useCreateMutation<CreateWishListInput, WishList>(apiPath, {
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["wishlists"] });
+    },
+  });
+};
+
+export default useCreateWishlist;

package/src/api-manager/services/user/mutations/delete-wishlist.ts

@@ -0,0 +1,17 @@
+import { useQueryClient } from "@tanstack/react-query";
+import { createApiPath } from "../../create-query";
+import { useCreateMutation } from "../../create-mutation";
+
+const apiPath = createApiPath("user", "deleteWishlist");
+
+const useDeleteWishlist = () => {
+  const queryClient = useQueryClient();
+
+  return useCreateMutation<string, string>(apiPath, {
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["wishlists"] });
+    },
+  });
+};
+
+export default useDeleteWishlist;

package/src/api-manager/services/user/mutations/update-user.ts

@@ -0,0 +1,18 @@
+import { useQueryClient } from "@tanstack/react-query";
+import { User } from "@/api-manager/schemas/user.schema";
+import { useCreateMutation } from "../../create-mutation";
+import { createApiPath } from "../../create-query";
+
+const apiPath = createApiPath("user", "updateUser");
+
+const useUpdateUser = () => {
+  const queryClient = useQueryClient();
+
+  return useCreateMutation<User, User>(apiPath, {
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["me"] });
+    },
+  });
+};
+
+export default useUpdateUser;

package/src/api-manager/services/user/queries/get-user-counts.ts

@@ -0,0 +1,10 @@
+import { UserCounts } from "@/api-manager/schemas/user.schema";
+import { createApiPath, createQuery } from "../../create-query";
+
+const apiPath = createApiPath("user", "getUserCounts");
+
+const getUserCounts = createQuery<string, UserCounts>(apiPath, {
+  queryKey: "user-counts",
+});
+
+export default getUserCounts;

package/src/api-manager/services/user/queries/get-user.ts

@@ -0,0 +1,10 @@
+import { createApiPath, createQuery } from "../../create-query";
+import { User } from "@/api-manager/schemas/user.schema";
+
+const apiPath = createApiPath("user", "getUser");
+
+const getUser = createQuery<null, User | null>(apiPath, {
+  queryKey: "me",
+});
+
+export default getUser;

package/src/api-manager/services/user/queries/get-wishlist-details.ts

@@ -0,0 +1,10 @@
+import { createApiPath, createQuery } from "../../create-query";
+import { WishList } from "../../../datasources/e4/graphqlRequestSdk";
+
+const apiPath = createApiPath("user", "getWishlistDetails");
+
+const getWishListDetails = createQuery<string, WishList>(apiPath, {
+  queryKey: "wish-list-details",
+});
+
+export default getWishListDetails;

package/src/api-manager/services/user/queries/get-wishlists.ts

@@ -0,0 +1,10 @@
+import { WishList } from "../../../datasources/e4/graphqlRequestSdk";
+import { createApiPath, createQuery } from "../../create-query";
+
+const apiPath = createApiPath("user", "getWishlists");
+
+const getWishlists = createQuery<null, WishList[]>(apiPath, {
+  queryKey: "wish-lists",
+});
+
+export default getWishlists;

package/src/api-manager/types/Datasource.ts

@@ -0,0 +1,197 @@
+import * as cartSchemas from "@/api-manager/schemas/cart.schema";
+import * as productSchemas from "@/api-manager/schemas/product.schema";
+import { User, UserCounts } from "@/api-manager/schemas/user.schema";
+import {
+  Session,
+  SessionInitInput,
+} from "@/api-manager/schemas/session.schema";
+import {
+  Address,
+  GetCountriesInput,
+  GetDeliveryOptionsInput,
+  GetStatesInput,
+} from "@/api-manager/schemas/address.schema";
+import {
+  ChannelConfiguration,
+  GetOrgUnitLocationsByAreaInput,
+  OrgUnitLocationReturnType,
+} from "@/api-manager/schemas/organization.schema";
+import {
+  GetSalesOrderDetailsInput,
+  SalesOrderInput,
+  SalesOrder,
+} from "@/api-manager/schemas/order.schema";
+import { CategoryHierarchy } from "../lib/category-helpers";
+import {
+  CardPaymentAcceptPoint,
+  CardPaymentAcceptResult,
+  CountryRegionInfo,
+  DeliveryOption,
+  ProductSearchResult,
+  SimpleProduct,
+  StateProvinceInfo,
+  ProductWarehouseInventoryAvailability,
+} from "@msdyn365-commerce/retail-proxy";
+import {
+  CategoriesQuery,
+  CreateWishListInput,
+  WishList,
+} from "../datasources/e4/graphqlRequestSdk";
+
+/**
+ * Datasource Interface, defines the methods and I/O types that a datasource must implement.
+ */
+export interface DatasourceApis {
+  user: UserApi;
+  session: SessionApi;
+  cart: CartApi;
+  product: ProductApi;
+  categories: CategoryApi;
+  order: OrderApi;
+  address: AddressApi;
+  organization: OrganizationApi;
+}
+
+export abstract class Datasource implements DatasourceApis {
+  public name: string;
+  abstract user: UserApi;
+  abstract cart: CartApi;
+  abstract product: ProductApi;
+  abstract categories: CategoryApi;
+  abstract order: OrderApi;
+  abstract address: AddressApi;
+  abstract organization: OrganizationApi;
+  abstract session: SessionApi;
+
+  constructor(name: string) {
+    this.name = name;
+  }
+}
+
+/**
+ * PrimaryDatasource Interface, all methods are required.
+ */
+export type PrimaryDatasource = Datasource;
+
+/**
+ * SecondaryDatasource Interface, all methods are optional.
+ */
+export type SecondaryDatasource = Partial<Datasource>;
+
+export interface OrganizationApi {
+  getChannelConfiguration(): Promise<ChannelConfiguration>;
+  getStoresList(
+    input: GetOrgUnitLocationsByAreaInput,
+  ): Promise<OrgUnitLocationReturnType[]>;
+}
+
+/**
+ * User Data Actions
+ */
+export interface UserApi {
+  updateUser(user: User): Promise<User>;
+  getUser(): Promise<User | null>;
+  getUserCounts(userId: string): Promise<UserCounts>;
+  // wishlists
+  getWishlists(): Promise<WishList[]>;
+  getWishlistDetails(id: string): Promise<WishList>;
+  createWishlist(wishlist: CreateWishListInput): Promise<WishList>;
+  deleteWishlist(id: string): Promise<string>;
+}
+
+/**
+ * Session Data Actions
+ */
+export interface SessionApi {
+  sessionInit(input: SessionInitInput): Promise<Session>;
+  sessionLogout(): Promise<boolean>;
+  getSession(): Promise<Session>;
+}
+
+// export interface Datasource extends Datasource {};
+/**
+ * Cart Data Actions
+ */
+export interface CartApi {
+  initCart(): Promise<cartSchemas.Cart>;
+  addToCart(input: cartSchemas.AddToCartInput): Promise<cartSchemas.Cart>;
+  updateCart(input: cartSchemas.UpdateCartInput): Promise<cartSchemas.Cart>;
+  deleteCartLine(
+    input: cartSchemas.DeleteCartLineInput,
+  ): Promise<cartSchemas.Cart>;
+  getCart(input?: { cartId: string }): Promise<cartSchemas.Cart>;
+  updateCartLines(
+    input: cartSchemas.UpdateCartLineInput,
+  ): Promise<cartSchemas.Cart>;
+  addDiscountCode(
+    input: cartSchemas.ManageDiscountCodeInput,
+  ): Promise<cartSchemas.Cart>;
+  removeDiscountcode(
+    input: cartSchemas.ManageDiscountCodeInput,
+  ): Promise<cartSchemas.Cart>;
+  updateLineDeliveryMode(
+    input: cartSchemas.UpdateCartLineDeliveryModeInput,
+  ): Promise<cartSchemas.Cart>;
+  removeLineDeliveryMode(
+    input: cartSchemas.RemoveCartLineDeliveryModeInput,
+  ): Promise<cartSchemas.Cart>;
+  getCardAcceptPoint(
+    input: cartSchemas.GetCardPaymentAcceptPointInput,
+  ): Promise<CardPaymentAcceptPoint>;
+  retrieveCardPaymentAcceptResult(
+    input: cartSchemas.RetrieveCardPaymentAcceptResultInput,
+  ): Promise<CardPaymentAcceptResult>;
+  checkout(input: cartSchemas.CheckoutInput): Promise<SalesOrder>;
+}
+
+/**
+ * Product Data Actions
+ */
+export interface ProductApi {
+  getProductById(
+    input: productSchemas.GetProductByIdInput,
+  ): Promise<productSchemas.ProductDetails>;
+  getProductByIds(
+    input: productSchemas.GetProductByIdsInput,
+  ): Promise<SimpleProduct[]>;
+  getProductsList(
+    input: productSchemas.SearchByCriteriaInput,
+  ): Promise<productSchemas.SearchByCriteriaResponse>;
+  searchProducts(
+    input: productSchemas.searchProductsInput,
+  ): Promise<ProductSearchResult[]>;
+  getCategoryList(): Promise<CategoriesQuery>;
+  getRelatedProducts(
+    input: productSchemas.GetRelatedProductsInput,
+  ): Promise<ProductSearchResult[]>;
+  getInventory(
+    input: productSchemas.InventorySearchCriteriaInput,
+  ): Promise<ProductWarehouseInventoryAvailability>;
+}
+
+/**
+ * CategoriesDataActions
+ */
+export interface CategoryApi {
+  getCategories(): Promise<CategoryHierarchy[]>;
+}
+
+/**
+ * Order Data Actions
+ */
+export interface OrderApi {
+  getSalesOrders(input: SalesOrderInput): Promise<SalesOrder[]>;
+  getSalesOrderDetails(input: GetSalesOrderDetailsInput): Promise<SalesOrder>;
+}
+
+/**
+ * Address Data Actions
+ */
+export interface AddressApi {
+  getCountries(input: GetCountriesInput): Promise<CountryRegionInfo[]>;
+  getStates(input: GetStatesInput): Promise<StateProvinceInfo[]>;
+  getDeliveryOptions(input: GetDeliveryOptionsInput): Promise<DeliveryOption[]>;
+  createAddress(address: Address): Promise<Address>;
+  updateAddress(address: Address): Promise<Address>;
+  deleteAddress(addressId: string): Promise<string>;
+}

package/src/auth/auth-options.test.ts

@@ -0,0 +1,127 @@
+import { describe, it, expect } from "vitest";
+import authOptions, { ExtendedJwtToken } from "./auth-options";
+import { JWT } from "next-auth/jwt";
+import { Account } from "next-auth";
+import { Session } from "next-auth";
+
+// vi.mock("./aadb2c-provider", () => ({
+//     azureADB2CProvider: {},
+//     refreshAccessToken: vi.fn(async (token) => ({
+//         ...token,
+//         accessToken: "newAccessToken",
+//         accessTokenExpiresAt: Date.now() + 3600 * 1000,
+//     })),
+// }));
+
+describe("next-auth option callbacks", () => {
+  describe("jwt callback", () => {
+    it("should store accessToken and refreshToken when account and profile are available", async () => {
+      const token: ExtendedJwtToken = {
+        accessToken: "",
+        accessTokenExpiresAt: 0,
+        provider: "azure-ad-b2c",
+        refreshTokenExpiresAt: 0,
+        exp: 0,
+      };
+      const account: Account = {
+        access_token: "testAccessToken",
+        refresh_token: "testRefreshToken",
+        expires_on: Math.floor(Date.now() / 1000) + 3600,
+        refresh_token_expires_in: 86400,
+        providerAccountId: "test-provider-account-id",
+        provider: "azure-ad-b2c",
+        type: "oauth",
+      };
+
+      let newToken;
+      if (
+        authOptions &&
+        authOptions().callbacks &&
+        authOptions().callbacks.jwt
+      ) {
+        newToken = await authOptions().callbacks.jwt({
+          token,
+          user: { id: "123" },
+          account,
+          profile: {},
+        });
+      }
+
+      expect(newToken?.accessToken).toBe("testAccessToken");
+      expect(newToken?.refreshToken).toBe("testRefreshToken");
+      expect(newToken?.accessTokenExpiresAt).toBe(token.accessTokenExpiresAt); // We're not setting this or using it anymore
+      expect(newToken?.refreshTokenExpiresAt).toBe(token.refreshTokenExpiresAt); // We're not setting this or using it anymore);
+    });
+
+    // it("should return token if access token is not expired", async () => {
+    //     const token: JWT = {
+    //         accessToken: "validToken",
+    //         accessTokenExpiresAt: Date.now() + 3600 * 1000,
+    //         refreshToken: "",
+    //         refreshTokenExpiresAt: 0
+    //     };
+
+    //     let newToken;
+    //     if (authOptions && authOptions.callbacks && authOptions.callbacks.jwt) {
+    //         newToken = await authOptions.callbacks.jwt({ token, user: { id: '123' }, account: null });
+    //     }
+
+    //     expect(newToken).toEqual(token);
+    // });
+
+    // it("should return error if refresh token is expired", async () => {
+    //     const token = { accessTokenExpiresAt: Date.now() - 1000, refreshTokenExpiresAt: Date.now() - 1000 };
+
+    //     let newToken;
+    //     if (authOptions && authOptions.callbacks && authOptions.callbacks.jwt) {
+    //         newToken = await authOptions.callbacks.jwt({ token, user: { id: '123' }, account: null });
+    //     }
+
+    //     expect(newToken?.error).toBe("RefreshTokenExpired");
+    // });
+
+    // it("should refresh access token if access token is expired but refresh token is valid", async () => {
+    //     const token = { accessToken: "oldToken", accessTokenExpiresAt: Date.now() - 1000, refreshToken: "validRefreshToken", refreshTokenExpiresAt: Date.now() + 3600 * 1000 };
+
+    //     let newToken;
+    //     if (authOptions && authOptions.callbacks && authOptions.callbacks.jwt) {
+    //         newToken = await authOptions.callbacks.jwt({ token, user: { id: '123' }, account: null });
+    //     }
+
+    //     // expect(refreshAccessToken).toHaveBeenCalledWith(token);
+    //     expect(newToken?.accessToken).toBe("newAccessToken");
+    // });
+  });
+
+  describe("session callback", () => {
+    it("should pass accessToken and error to session", async () => {
+      const session = { expires: "", user: { name: "123" } };
+      const token: JWT = {
+        accessToken: "sessionToken",
+        accessTokenExpiresAt: 0,
+        refreshToken: "",
+        refreshTokenExpiresAt: 0,
+        error: "SomeError",
+      };
+      let newSession: Session | null;
+      if (
+        authOptions &&
+        authOptions().callbacks &&
+        authOptions().callbacks.session
+      ) {
+        newSession = await authOptions().callbacks.session({
+          session,
+          token,
+          user: { id: "123", email: "", emailVerified: new Date(Date.now()) },
+          newSession: {},
+          trigger: "update",
+        });
+      } else {
+        newSession = null;
+      }
+
+      expect(newSession?.accessToken).toBe("sessionToken");
+      expect(newSession?.error).toBe("SomeError");
+    });
+  });
+});

package/src/auth/auth-options.ts

@@ -0,0 +1,68 @@
+import { Session, type NextAuthOptions } from "next-auth";
+import { getServerSession } from "next-auth/next";
+import { JWT } from "next-auth/jwt";
+import {
+  GetServerSidePropsContext,
+  NextApiRequest,
+  NextApiResponse,
+} from "next";
+import { getProviders } from "./providers";
+import { deleteCartCookie } from "@/lib/cart-cookie-handler";
+import { getConfig } from "@config";
+
+// Split providers into separate array so we can iterate them and match the provider ID
+export type ExtendedJwtToken = JWT & {
+  provider: string;
+  exp: number;
+};
+
+export type ExtendedSession = Session & { token?: JWT };
+
+const createAuthOptions = (): NextAuthOptions => {
+  const providers = getProviders();
+  const secret = getConfig().NEXTAUTH_SECRET;
+  return {
+    providers,
+    secret,
+    // Order in which callbacks are called = signin > redirect > jwt > session. Thats why session callback has token info.
+    callbacks: {
+      // By default, NextAuth uses "session" with strategy: "jwt"
+      async jwt({ token, account, profile }) {
+        const _token = token as ExtendedJwtToken;
+        // account and profile is available only in first callback after signin
+        if (account && profile) {
+          _token.provider = account.provider;
+          _token.accessToken = account.access_token;
+          _token.refreshToken = account.refresh_token;
+        }
+        return _token;
+        // return await checkAccessTokenExpiry(_token)
+      },
+      async session({ session, token }) {
+        const _session = { ...session } as ExtendedSession;
+        // Way to pass data to the browser
+        // Use this error to force logout in UI. No proper way to signout user from server.
+        _session.error = token?.error;
+        _session.accessToken = token.accessToken;
+
+        return _session;
+      },
+    },
+    events: {
+      signOut: async () => {
+        await deleteCartCookie();
+      },
+    },
+  };
+};
+
+export function auth( // <-- use this function to access the jwt from React components
+  ...args:
+    | [GetServerSidePropsContext["req"], GetServerSidePropsContext["res"]]
+    | [NextApiRequest, NextApiResponse]
+    | []
+) {
+  return getServerSession(...args, createAuthOptions());
+}
+
+export default createAuthOptions;

package/src/auth/msal.ts

@@ -0,0 +1,65 @@
+import { PublicClientApplication, Configuration } from "@azure/msal-browser";
+import { getConfig } from "@config";
+
+const createMsalConfig = (): Configuration => {
+  return {
+    auth: {
+      clientId: getConfig().AZURE_AD_B2C_CLIENTID, //process.env.NEXT_PUBLIC_AZURE_AD_B2C_CLIENTID || "",
+      authority: getConfig().AZURE_AD_B2C_LOGIN_AUTHORITY, //process.env.NEXT_PUBLIC_AZURE_AD_B2C_LOGIN_AUTHORITY || "",
+      redirectUri: "/", //process.env.NEXT_PUBLIC_AZURE_AD_B2C_REDIRECT || "/",
+      postLogoutRedirectUri: getConfig().AZURE_AD_B2C_POST_LOGOUT_REDIRECT, //process.env.NEXT_PUBLIC_AZURE_AD_B2C_POST_LOGOUT_REDIRECT || "/",
+      knownAuthorities: [
+        getConfig().AZURE_AD_B2C_KNOWN_AUTHORITY, //process.env.NEXT_PUBLIC_AZURE_AD_B2C_KNOWN_AUTHORITY || "",
+      ],
+      navigateToLoginRequestUrl: true,
+    },
+    system: {
+      allowNativeBroker: false, // Disables WAM Broker
+    },
+  };
+};
+
+// create module singleton (to pass the env variables)
+// const msalInstance = new PublicClientApplication(createMsalConfig());
+let msalInstance: PublicClientApplication | null = null;
+
+const initializeMsal = async () => {
+  try {
+    const config = createMsalConfig();
+    msalInstance = new PublicClientApplication(config);
+    await msalInstance.initialize();
+
+    const accounts = msalInstance.getAllAccounts();
+    if (accounts.length > 0) {
+      msalInstance.setActiveAccount(accounts[0]);
+    }
+  } catch (error) {
+    console.error("MSAL Initialization Error:", error);
+  }
+};
+
+const getMsalInstance = () => {
+  if (!msalInstance) throw new Error("msalInstance not initialized");
+  return msalInstance;
+};
+
+const getRequestConfig = (requestType?: string) => {
+  const editAuthority = getConfig().AZURE_AD_B2C_EDIT_AUTHORITY;
+  const resetAuthority = getConfig().AZURE_AD_B2C_RESET_AUTHORITY;
+
+  const baseRequest = {
+    scopes: [getConfig().AZURE_AD_B2C_API_PERMISSION],
+    authority: createMsalConfig().auth.authority,
+  };
+
+  switch (requestType) {
+    case "edit":
+      return { ...baseRequest, authority: editAuthority };
+    case "reset":
+      return { ...baseRequest, authority: resetAuthority };
+    default:
+      return baseRequest;
+  }
+};
+
+export { getMsalInstance, initializeMsal, getRequestConfig };

package/src/auth/next-auth-cookie-manager.ts

@@ -0,0 +1,86 @@
+"use server";
+import { RequestCookie } from "next/dist/compiled/@edge-runtime/cookies";
+import { cookies } from "next/headers";
+import { encode, decode, JWT } from "next-auth/jwt";
+import { ExtendedJwtToken } from "@/auth/auth-options";
+const NEXT_AUTH_COOKIE_NAME = "next-auth.session-token";
+const SECURE_COOKIE_PREFIX = "__Secure-";
+
+/**
+ * Retrieves and decodes the NextAuth session cookie from the request.
+ *
+ * This function handles both single and chunked session cookies:
+ * - If the session cookie is under 4KB, it is stored as a single cookie.
+ * - If the session cookie exceeds 4KB, it is split into multiple chunked cookies with indexed names.
+ *
+ * The function attempts to retrieve the single cookie first. If not found,
+ * it iteratively collects all chunked cookies, concatenates their values,
+ * and decodes the resulting token.
+ *
+ * @returns A Promise resolving to the decoded session object, or `undefined` if no session cookie is found.
+ */
+const manuallyRetrieveSessionCookie = async () => {
+  const cookieStore = await cookies();
+  let cookie: RequestCookie | undefined;
+  // Single token when the cookie size is < 4k
+  cookie = cookieStore.get(`${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}`);
+  //If the cookie is found, return it. the cookie is under 4kb
+  if (cookie) {
+    return decode({
+      token: cookie.value,
+      secret: process.env.NEXTAUTH_SECRET || "",
+    });
+  }
+  //If the cookie is not found, we need to see if there is a chunked cookie
+  //The chunked cookie is stored in multiple cookies with the same name and an index
+  //The cookie is chunked when the cookie size is > 4k
+  //The value is just split between the cookies, so we can just concat them.
+  let i = 0;
+  const cookieValues: string[] = [];
+  do {
+    cookie = cookieStore.get(
+      `${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}.${i}`,
+    );
+    if (cookie) {
+      cookieValues.push(cookie.value);
+    }
+    i++;
+  } while (cookie !== undefined);
+  if (cookieValues.length) {
+    return decode({
+      token: cookieValues.join(""),
+      secret: process.env.NEXTAUTH_SECRET || "",
+    });
+  }
+
+  //If no cookie is found, return undefined
+  return undefined;
+};
+
+/**
+ * Manually sets the NextAuth session cookie with the provided JWT token.
+ *
+ * This function encodes the given JWT or ExtendedJwtToken and sets it as a secure,
+ * HTTP-only cookie named `__Secure-next-auth.session-token`. The cookie is set using
+ * the current cookie store, and the encoding uses the secret from the `NEXTAUTH_SECRET`
+ * environment variable.
+ *
+ * @param token - The JWT or ExtendedJwtToken to be encoded and stored in the session cookie.
+ * @returns A promise that resolves when the cookie has been set.
+ */
+const manuallySetSessionCookie = async (token: JWT | ExtendedJwtToken) => {
+  const cookieStore = await cookies();
+  // Set the cookie with the name __Secure-next-auth.session-token
+  const value = await encode({
+    token,
+    secret: process.env.NEXTAUTH_SECRET || "",
+  });
+  cookieStore.set({
+    name: `${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}`,
+    value,
+    httpOnly: true,
+    secure: true,
+  });
+};
+
+export { manuallyRetrieveSessionCookie, manuallySetSessionCookie };

package/src/auth/providers/aadb2c-provider.ts

@@ -0,0 +1,33 @@
+import { getConfig } from "@config";
+import AzureADB2CProvider from "next-auth/providers/azure-ad-b2c";
+
+// By default, NextAuth tries to use either PKCE or Client Secret-based authentication, depending on how the provider is configured.
+// If clientSecret is provided, it assumes client secret authentication (which doesn't use code_challenge).
+// If clientSecret is missing, it assumes PKCE.
+// But Azure AD B2C sometimes requires PKCE explicitly, so NextAuth needs to be told to always use PKCE.
+const azureADB2CProvider = () => {
+  const CLIENT_ID = getConfig().AZURE_AD_B2C_CLIENTID;
+  const SCOPE = `${getConfig().AZURE_AD_B2C_API_PERMISSION} offline_access openid`;
+  const LOGIN_AUTHORITY = getConfig().AZURE_AD_B2C_LOGIN_AUTHORITY;
+
+  return AzureADB2CProvider({
+    clientId: CLIENT_ID,
+    clientSecret: "",
+    issuer: `${LOGIN_AUTHORITY}/v2.0`, // either (tenantId and primaryUserFlow) or issuer must be provided
+    authorization: {
+      // We can also send params from UI - signIn("azure-ad-b2c", {}, { prompt: "login" })
+      params: {
+        scope: SCOPE,
+        // When a user logs in once, the session remains active, and next time Azure AD B2C automatically logs the user in without showing the sign-in page again
+        // This option forces login screen every time.
+        prompt: "login",
+      },
+    },
+    checks: ["pkce"],
+    client: {
+      token_endpoint_auth_method: "none", // Disables Client Secret, ensuring that only PKCE is used
+    },
+  });
+};
+
+export default azureADB2CProvider;