@kanjijs/cli 0.2.0-beta.55 → 0.2.0-beta.57

package/templates/starter/node_modules/@auth/core/lib/actions/callback/index.js

@@ -0,0 +1,393 @@
+// TODO: Make this file smaller
+import { AuthError, AccessDenied, CallbackRouteError, CredentialsSignin, InvalidProvider, Verification, } from "../../../errors.js";
+import { handleLoginOrRegister } from "./handle-login.js";
+import { handleOAuth } from "./oauth/callback.js";
+import { handleState } from "./oauth/checks.js";
+import { createHash } from "../../utils/web.js";
+import { assertInternalOptionsWebAuthn, verifyAuthenticate, verifyRegister, } from "../../utils/webauthn-utils.js";
+/** Handle callbacks from login services */
+export async function callback(request, options, sessionStore, cookies) {
+    if (!options.provider)
+        throw new InvalidProvider("Callback route called without provider");
+    const { query, body, method, headers } = request;
+    const { provider, adapter, url, callbackUrl, pages, jwt, events, callbacks, session: { strategy: sessionStrategy, maxAge: sessionMaxAge }, logger, } = options;
+    const useJwtSession = sessionStrategy === "jwt";
+    try {
+        if (provider.type === "oauth" || provider.type === "oidc") {
+            // Use body if the response mode is set to form_post. For all other cases, use query
+            const payload = provider.authorization?.url.searchParams.get("response_mode") ===
+                "form_post"
+                ? body
+                : query;
+            const { proxyRedirect, randomState } = handleState(payload, provider, options.isOnRedirectProxy);
+            if (proxyRedirect) {
+                logger.debug("proxy redirect", { proxyRedirect, randomState });
+                return { redirect: proxyRedirect };
+            }
+            const authorizationResult = await handleOAuth(payload, request.cookies, options, randomState);
+            if (authorizationResult.cookies.length) {
+                cookies.push(...authorizationResult.cookies);
+            }
+            logger.debug("authorization result", authorizationResult);
+            const { user: userFromProvider, account, profile: OAuthProfile, } = authorizationResult;
+            // If we don't have a profile object then either something went wrong
+            // or the user cancelled signing in. We don't know which, so we just
+            // direct the user to the signin page for now. We could do something
+            // else in future.
+            // TODO: Handle user cancelling signin
+            if (!userFromProvider || !account || !OAuthProfile) {
+                return { redirect: `${url}/signin`, cookies };
+            }
+            // Check if user is allowed to sign in
+            // Attempt to get Profile from OAuth provider details before invoking
+            // signIn callback - but if no user object is returned, that is fine
+            // (that just means it's a new user signing in for the first time).
+            let userByAccount;
+            if (adapter) {
+                const { getUserByAccount } = adapter;
+                userByAccount = await getUserByAccount({
+                    providerAccountId: account.providerAccountId,
+                    provider: provider.id,
+                });
+            }
+            const redirect = await handleAuthorized({
+                user: userByAccount ?? userFromProvider,
+                account,
+                profile: OAuthProfile,
+            }, options);
+            if (redirect)
+                return { redirect, cookies };
+            const { user, session, isNewUser } = await handleLoginOrRegister(sessionStore.value, userFromProvider, account, options);
+            if (useJwtSession) {
+                const defaultToken = {
+                    name: user.name,
+                    email: user.email,
+                    picture: user.image,
+                    sub: user.id?.toString(),
+                };
+                const token = await callbacks.jwt({
+                    token: defaultToken,
+                    user,
+                    account,
+                    profile: OAuthProfile,
+                    isNewUser,
+                    trigger: isNewUser ? "signUp" : "signIn",
+                });
+                // Clear cookies if token is null
+                if (token === null) {
+                    cookies.push(...sessionStore.clean());
+                }
+                else {
+                    const salt = options.cookies.sessionToken.name;
+                    // Encode token
+                    const newToken = await jwt.encode({ ...jwt, token, salt });
+                    // Set cookie expiry date
+                    const cookieExpires = new Date();
+                    cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000);
+                    const sessionCookies = sessionStore.chunk(newToken, {
+                        expires: cookieExpires,
+                    });
+                    cookies.push(...sessionCookies);
+                }
+            }
+            else {
+                // Save Session Token in cookie
+                cookies.push({
+                    name: options.cookies.sessionToken.name,
+                    value: session.sessionToken,
+                    options: {
+                        ...options.cookies.sessionToken.options,
+                        expires: session.expires,
+                    },
+                });
+            }
+            await events.signIn?.({
+                user,
+                account,
+                profile: OAuthProfile,
+                isNewUser,
+            });
+            // Handle first logins on new accounts
+            // e.g. option to send users to a new account landing page on initial login
+            // Note that the callback URL is preserved, so the journey can still be resumed
+            if (isNewUser && pages.newUser) {
+                return {
+                    redirect: `${pages.newUser}${pages.newUser.includes("?") ? "&" : "?"}${new URLSearchParams({ callbackUrl })}`,
+                    cookies,
+                };
+            }
+            return { redirect: callbackUrl, cookies };
+        }
+        else if (provider.type === "email") {
+            const token = query?.token;
+            const identifier = query?.email;
+            if (!token || !identifier) {
+                const e = new TypeError("Missing token or email. The sign-in URL was manually opened without token/identifier or the link was not sent correctly in the email.", { cause: { hasToken: !!token, hasEmail: !!identifier } });
+                e.name = "Configuration";
+                throw e;
+            }
+            const secret = provider.secret ?? options.secret;
+            // @ts-expect-error -- Verified in `assertConfig`.
+            const invite = await adapter.useVerificationToken({
+                identifier,
+                token: await createHash(`${token}${secret}`),
+            });
+            const hasInvite = !!invite;
+            const expired = invite ? invite.expires.valueOf() < Date.now() : undefined;
+            const invalidInvite = !hasInvite || expired;
+            if (invalidInvite)
+                throw new Verification({ hasInvite, expired });
+            const user = (await adapter.getUserByEmail(identifier)) ?? {
+                id: crypto.randomUUID(),
+                email: identifier,
+                emailVerified: null,
+            };
+            const account = {
+                providerAccountId: user.email,
+                userId: user.id,
+                type: "email",
+                provider: provider.id,
+            };
+            const redirect = await handleAuthorized({ user, account }, options);
+            if (redirect)
+                return { redirect, cookies };
+            // Sign user in
+            const { user: loggedInUser, session, isNewUser, } = await handleLoginOrRegister(sessionStore.value, user, account, options);
+            if (useJwtSession) {
+                const defaultToken = {
+                    name: loggedInUser.name,
+                    email: loggedInUser.email,
+                    picture: loggedInUser.image,
+                    sub: loggedInUser.id?.toString(),
+                };
+                const token = await callbacks.jwt({
+                    token: defaultToken,
+                    user: loggedInUser,
+                    account,
+                    isNewUser,
+                    trigger: isNewUser ? "signUp" : "signIn",
+                });
+                // Clear cookies if token is null
+                if (token === null) {
+                    cookies.push(...sessionStore.clean());
+                }
+                else {
+                    const salt = options.cookies.sessionToken.name;
+                    // Encode token
+                    const newToken = await jwt.encode({ ...jwt, token, salt });
+                    // Set cookie expiry date
+                    const cookieExpires = new Date();
+                    cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000);
+                    const sessionCookies = sessionStore.chunk(newToken, {
+                        expires: cookieExpires,
+                    });
+                    cookies.push(...sessionCookies);
+                }
+            }
+            else {
+                // Save Session Token in cookie
+                cookies.push({
+                    name: options.cookies.sessionToken.name,
+                    value: session.sessionToken,
+                    options: {
+                        ...options.cookies.sessionToken.options,
+                        expires: session.expires,
+                    },
+                });
+            }
+            await events.signIn?.({ user: loggedInUser, account, isNewUser });
+            // Handle first logins on new accounts
+            // e.g. option to send users to a new account landing page on initial login
+            // Note that the callback URL is preserved, so the journey can still be resumed
+            if (isNewUser && pages.newUser) {
+                return {
+                    redirect: `${pages.newUser}${pages.newUser.includes("?") ? "&" : "?"}${new URLSearchParams({ callbackUrl })}`,
+                    cookies,
+                };
+            }
+            // Callback URL is already verified at this point, so safe to use if specified
+            return { redirect: callbackUrl, cookies };
+        }
+        else if (provider.type === "credentials" && method === "POST") {
+            const credentials = body ?? {};
+            // TODO: Forward the original request as is, instead of reconstructing it
+            Object.entries(query ?? {}).forEach(([k, v]) => url.searchParams.set(k, v));
+            const userFromAuthorize = await provider.authorize(credentials, 
+            // prettier-ignore
+            new Request(url, { headers, method, body: JSON.stringify(body) }));
+            const user = userFromAuthorize;
+            if (!user)
+                throw new CredentialsSignin();
+            else
+                user.id = user.id?.toString() ?? crypto.randomUUID();
+            const account = {
+                providerAccountId: user.id,
+                type: "credentials",
+                provider: provider.id,
+            };
+            const redirect = await handleAuthorized({ user, account, credentials }, options);
+            if (redirect)
+                return { redirect, cookies };
+            const defaultToken = {
+                name: user.name,
+                email: user.email,
+                picture: user.image,
+                sub: user.id,
+            };
+            const token = await callbacks.jwt({
+                token: defaultToken,
+                user,
+                account,
+                isNewUser: false,
+                trigger: "signIn",
+            });
+            // Clear cookies if token is null
+            if (token === null) {
+                cookies.push(...sessionStore.clean());
+            }
+            else {
+                const salt = options.cookies.sessionToken.name;
+                // Encode token
+                const newToken = await jwt.encode({ ...jwt, token, salt });
+                // Set cookie expiry date
+                const cookieExpires = new Date();
+                cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000);
+                const sessionCookies = sessionStore.chunk(newToken, {
+                    expires: cookieExpires,
+                });
+                cookies.push(...sessionCookies);
+            }
+            await events.signIn?.({ user, account });
+            return { redirect: callbackUrl, cookies };
+        }
+        else if (provider.type === "webauthn" && method === "POST") {
+            // Get callback action from request. It should be either "authenticate" or "register"
+            const action = request.body?.action;
+            if (typeof action !== "string" ||
+                (action !== "authenticate" && action !== "register")) {
+                throw new AuthError("Invalid action parameter");
+            }
+            // Return an error if the adapter is missing or if the provider
+            // is not a webauthn provider.
+            const localOptions = assertInternalOptionsWebAuthn(options);
+            // Verify request to get user, account and authenticator
+            let user;
+            let account;
+            let authenticator;
+            switch (action) {
+                case "authenticate": {
+                    const verified = await verifyAuthenticate(localOptions, request, cookies);
+                    user = verified.user;
+                    account = verified.account;
+                    break;
+                }
+                case "register": {
+                    const verified = await verifyRegister(options, request, cookies);
+                    user = verified.user;
+                    account = verified.account;
+                    authenticator = verified.authenticator;
+                    break;
+                }
+            }
+            // Check if user is allowed to sign in
+            await handleAuthorized({ user, account }, options);
+            // Sign user in, creating them and their account if needed
+            const { user: loggedInUser, isNewUser, session, account: currentAccount, } = await handleLoginOrRegister(sessionStore.value, user, account, options);
+            if (!currentAccount) {
+                // This is mostly for type checking. It should never actually happen.
+                throw new AuthError("Error creating or finding account");
+            }
+            // Create new authenticator if needed
+            if (authenticator && loggedInUser.id) {
+                await localOptions.adapter.createAuthenticator({
+                    ...authenticator,
+                    userId: loggedInUser.id,
+                });
+            }
+            // Do the session registering dance
+            if (useJwtSession) {
+                const defaultToken = {
+                    name: loggedInUser.name,
+                    email: loggedInUser.email,
+                    picture: loggedInUser.image,
+                    sub: loggedInUser.id?.toString(),
+                };
+                const token = await callbacks.jwt({
+                    token: defaultToken,
+                    user: loggedInUser,
+                    account: currentAccount,
+                    isNewUser,
+                    trigger: isNewUser ? "signUp" : "signIn",
+                });
+                // Clear cookies if token is null
+                if (token === null) {
+                    cookies.push(...sessionStore.clean());
+                }
+                else {
+                    const salt = options.cookies.sessionToken.name;
+                    // Encode token
+                    const newToken = await jwt.encode({ ...jwt, token, salt });
+                    // Set cookie expiry date
+                    const cookieExpires = new Date();
+                    cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000);
+                    const sessionCookies = sessionStore.chunk(newToken, {
+                        expires: cookieExpires,
+                    });
+                    cookies.push(...sessionCookies);
+                }
+            }
+            else {
+                // Save Session Token in cookie
+                cookies.push({
+                    name: options.cookies.sessionToken.name,
+                    value: session.sessionToken,
+                    options: {
+                        ...options.cookies.sessionToken.options,
+                        expires: session.expires,
+                    },
+                });
+            }
+            await events.signIn?.({
+                user: loggedInUser,
+                account: currentAccount,
+                isNewUser,
+            });
+            // Handle first logins on new accounts
+            // e.g. option to send users to a new account landing page on initial login
+            // Note that the callback URL is preserved, so the journey can still be resumed
+            if (isNewUser && pages.newUser) {
+                return {
+                    redirect: `${pages.newUser}${pages.newUser.includes("?") ? "&" : "?"}${new URLSearchParams({ callbackUrl })}`,
+                    cookies,
+                };
+            }
+            // Callback URL is already verified at this point, so safe to use if specified
+            return { redirect: callbackUrl, cookies };
+        }
+        throw new InvalidProvider(`Callback for provider type (${provider.type}) is not supported`);
+    }
+    catch (e) {
+        if (e instanceof AuthError)
+            throw e;
+        const error = new CallbackRouteError(e, { provider: provider.id });
+        logger.debug("callback route error details", { method, query, body });
+        throw error;
+    }
+}
+async function handleAuthorized(params, config) {
+    let authorized;
+    const { signIn, redirect } = config.callbacks;
+    try {
+        authorized = await signIn(params);
+    }
+    catch (e) {
+        if (e instanceof AuthError)
+            throw e;
+        throw new AccessDenied(e);
+    }
+    if (!authorized)
+        throw new AccessDenied("AccessDenied");
+    if (typeof authorized !== "string")
+        return;
+    return await redirect({ url: authorized, baseUrl: config.url.origin });
+}

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/callback.d.ts

@@ -0,0 +1,48 @@
+import * as o from "oauth4webapi";
+import type { InternalOptions, Profile, RequestInternal } from "../../../../types.js";
+import type { Cookie } from "../../../utils/cookie.js";
+/**
+ * Handles the following OAuth steps.
+ * https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+ * https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3
+ * https://openid.net/specs/openid-connect-core-1_0.html#UserInfoRequest
+ *
+ * @note Although requesting userinfo is not required by the OAuth2.0 spec,
+ * we fetch it anyway. This is because we always want a user profile.
+ */
+export declare function handleOAuth(query: RequestInternal["query"], cookies: RequestInternal["cookies"], options: InternalOptions<"oauth" | "oidc">, randomState?: string): Promise<{
+    profile: Profile;
+    cookies: Cookie[];
+    user?: {
+        id: `${string}-${string}-${string}-${string}-${string}`;
+        email: string | undefined;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+    } | undefined;
+    account?: {
+        provider: string;
+        type: "oauth" | "oidc";
+        providerAccountId: string;
+        access_token?: string | undefined;
+        expires_in?: number | undefined;
+        id_token?: undefined;
+        refresh_token?: string | undefined;
+        scope?: string | undefined;
+        authorization_details?: o.AuthorizationDetails[] | undefined;
+        token_type?: Lowercase<string> | undefined;
+        expires_at?: number | undefined;
+    } | {
+        provider: string;
+        type: "oauth" | "oidc";
+        providerAccountId: string;
+        access_token?: string | undefined;
+        expires_in?: number | undefined;
+        id_token?: string | undefined;
+        refresh_token?: string | undefined;
+        scope?: string | undefined;
+        authorization_details?: o.AuthorizationDetails[] | undefined;
+        token_type?: Lowercase<string> | undefined;
+        expires_at?: number | undefined;
+    } | undefined;
+}>;
+//# sourceMappingURL=callback.d.ts.map

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../src/lib/actions/callback/oauth/callback.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AAMjC,OAAO,KAAK,EAEV,eAAe,EAEf,OAAO,EACP,eAAe,EAGhB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AAGtD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAC/B,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EACnC,OAAO,EAAE,eAAe,CAAC,OAAO,GAAG,MAAM,CAAC,EAC1C,WAAW,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0LrB"}

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/callback.js

@@ -0,0 +1,158 @@
+import * as checks from "./checks.js";
+import * as o from "oauth4webapi";
+import { OAuthCallbackError, OAuthProfileParseError, } from "../../../../errors.js";
+import { isOIDCProvider } from "../../../utils/providers.js";
+/**
+ * Handles the following OAuth steps.
+ * https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+ * https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3
+ * https://openid.net/specs/openid-connect-core-1_0.html#UserInfoRequest
+ *
+ * @note Although requesting userinfo is not required by the OAuth2.0 spec,
+ * we fetch it anyway. This is because we always want a user profile.
+ */
+export async function handleOAuth(query, cookies, options, randomState) {
+    const { logger, provider } = options;
+    let as;
+    const { token, userinfo } = provider;
+    // Falls back to authjs.dev if the user only passed params
+    if ((!token?.url || token.url.host === "authjs.dev") &&
+        (!userinfo?.url || userinfo.url.host === "authjs.dev")) {
+        // We assume that issuer is always defined as this has been asserted earlier
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const issuer = new URL(provider.issuer);
+        const discoveryResponse = await o.discoveryRequest(issuer);
+        const discoveredAs = await o.processDiscoveryResponse(issuer, discoveryResponse);
+        if (!discoveredAs.token_endpoint)
+            throw new TypeError("TODO: Authorization server did not provide a token endpoint.");
+        if (!discoveredAs.userinfo_endpoint)
+            throw new TypeError("TODO: Authorization server did not provide a userinfo endpoint.");
+        as = discoveredAs;
+    }
+    else {
+        as = {
+            issuer: provider.issuer ?? "https://authjs.dev", // TODO: review fallback issuer
+            token_endpoint: token?.url.toString(),
+            userinfo_endpoint: userinfo?.url.toString(),
+        };
+    }
+    const client = {
+        client_id: provider.clientId,
+        client_secret: provider.clientSecret,
+        ...provider.client,
+    };
+    const resCookies = [];
+    const state = await checks.state.use(cookies, resCookies, options, randomState);
+    const codeGrantParams = o.validateAuthResponse(as, client, new URLSearchParams(query), provider.checks.includes("state") ? state : o.skipStateCheck);
+    /** https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2.1 */
+    if (o.isOAuth2Error(codeGrantParams)) {
+        const cause = { providerId: provider.id, ...codeGrantParams };
+        logger.debug("OAuthCallbackError", cause);
+        throw new OAuthCallbackError("OAuth Provider returned an error", cause);
+    }
+    const codeVerifier = await checks.pkce.use(cookies, resCookies, options);
+    let redirect_uri = provider.callbackUrl;
+    if (!options.isOnRedirectProxy && provider.redirectProxyUrl) {
+        redirect_uri = provider.redirectProxyUrl;
+    }
+    let codeGrantResponse = await o.authorizationCodeGrantRequest(as, client, codeGrantParams, redirect_uri, codeVerifier ?? "auth", // TODO: review fallback code verifier,
+    {
+        [o.customFetch]: (...args) => {
+            if (!provider.checks.includes("pkce") &&
+                args[1]?.body instanceof URLSearchParams) {
+                args[1].body.delete("code_verifier");
+            }
+            return fetch(...args);
+        },
+        clientPrivateKey: provider.token?.clientPrivateKey,
+    });
+    if (provider.token?.conform) {
+        codeGrantResponse =
+            (await provider.token.conform(codeGrantResponse.clone())) ??
+                codeGrantResponse;
+    }
+    let challenges;
+    if ((challenges = o.parseWwwAuthenticateChallenges(codeGrantResponse))) {
+        for (const challenge of challenges) {
+            console.log("challenge", challenge);
+        }
+        throw new Error("TODO: Handle www-authenticate challenges as needed");
+    }
+    let profile = {};
+    let tokens;
+    if (isOIDCProvider(provider)) {
+        const nonce = await checks.nonce.use(cookies, resCookies, options);
+        const processedCodeResponse = await o.processAuthorizationCodeOpenIDResponse(as, client, codeGrantResponse, nonce ?? o.expectNoNonce);
+        if (o.isOAuth2Error(processedCodeResponse)) {
+            console.log("error", processedCodeResponse);
+            throw new Error("TODO: Handle OIDC response body error");
+        }
+        const idTokenClaims = o.getValidatedIdTokenClaims(processedCodeResponse);
+        profile = idTokenClaims;
+        if (provider.idToken === false) {
+            const userinfoResponse = await o.userInfoRequest(as, client, processedCodeResponse.access_token);
+            profile = await o.processUserInfoResponse(as, client, idTokenClaims.sub, userinfoResponse);
+        }
+        tokens = processedCodeResponse;
+    }
+    else {
+        const processedCodeResponse = await o.processAuthorizationCodeOAuth2Response(as, client, codeGrantResponse);
+        tokens = processedCodeResponse;
+        if (o.isOAuth2Error(processedCodeResponse)) {
+            console.log("error", processedCodeResponse);
+            throw new Error("TODO: Handle OAuth 2.0 response body error");
+        }
+        if (userinfo?.request) {
+            const _profile = await userinfo.request({ tokens, provider });
+            if (_profile instanceof Object)
+                profile = _profile;
+        }
+        else if (userinfo?.url) {
+            const userinfoResponse = await o.userInfoRequest(as, client, processedCodeResponse.access_token);
+            profile = await userinfoResponse.json();
+        }
+        else {
+            throw new TypeError("No userinfo endpoint configured");
+        }
+    }
+    if (tokens.expires_in) {
+        tokens.expires_at =
+            Math.floor(Date.now() / 1000) + Number(tokens.expires_in);
+    }
+    const profileResult = await getUserAndAccount(profile, provider, tokens, logger);
+    return { ...profileResult, profile, cookies: resCookies };
+}
+/**
+ * Returns the user and account that is going to be created in the database.
+ * @internal
+ */
+export async function getUserAndAccount(OAuthProfile, provider, tokens, logger) {
+    try {
+        const userFromProfile = await provider.profile(OAuthProfile, tokens);
+        const user = {
+            ...userFromProfile,
+            id: crypto.randomUUID(),
+            email: userFromProfile.email?.toLowerCase(),
+        };
+        return {
+            user,
+            account: {
+                ...tokens,
+                provider: provider.id,
+                type: provider.type,
+                providerAccountId: userFromProfile.id ?? crypto.randomUUID(),
+            },
+        };
+    }
+    catch (e) {
+        // If we didn't get a response either there was a problem with the provider
+        // response *or* the user cancelled the action with the provider.
+        //
+        // Unfortunately, we can't tell which - at least not in a way that works for
+        // all providers, so we return an empty object; the user should then be
+        // redirected back to the sign up page. We log the error to help developers
+        // who might be trying to debug this when configuring a new provider.
+        logger.debug("getProfile error details", OAuthProfile);
+        logger.error(new OAuthProfileParseError(e, { provider: provider.id }));
+    }
+}