admin / Synapse-Sonar

import type { NextAuthOptions } from "next-auth";
import CredentialsProvider from "next-auth/providers/credentials";
import bcrypt from "bcryptjs";
import { authenticator } from "otplib";
import { prisma } from "@/lib/prisma";
import { decryptJson, EncryptedBlob } from "@/lib/crypto";

/**
 * Tenant-aware credential auth. The login form must supply tenant slug, email,
 * password, and (when MFA is enabled) a TOTP token. The resolved tenantId/role
 * are carried in the JWT so every API route can scope by them.
 */
export const authOptions: NextAuthOptions = {
  session: { strategy: "jwt" },
  pages: { signIn: "/login" },
  providers: [
    CredentialsProvider({
      name: "Credentials",
      credentials: {
        username: { label: "Username", type: "text" },
        password: { label: "Password", type: "password" },
        totp: { label: "MFA Code", type: "text" },
      },
      async authorize(credentials) {
        if (!credentials?.username || !credentials.password) {
          return null;
        }

        // Username is the global login identifier; the tenant is derived from it.
        const user = await prisma.user.findUnique({
          where: { username: credentials.username },
        });
        if (!user || user.status !== "ACTIVE" || !user.passwordHash) return null;

        const ok = await bcrypt.compare(credentials.password, user.passwordHash);
        if (!ok) return null;

        // Enforce MFA ONLY when the user has enabled it. Users without MFA are
        // never asked for a code. Throw distinct errors so the UI can tell
        // "needs a code" apart from "wrong password".
        if (user.mfaEnabled && user.mfaSecret) {
          if (!credentials.totp) {
            throw new Error("MFA_REQUIRED");
          }
          const secret = decryptJson<{ secret: string }>(
            user.mfaSecret as unknown as EncryptedBlob
          ).secret;
          if (!authenticator.check(credentials.totp, secret)) {
            throw new Error("MFA_INVALID");
          }
        }

        await prisma.user.update({
          where: { id: user.id },
          data: { lastLoginAt: new Date() },
        });

        return {
          id: user.id,
          username: user.username,
          email: user.email ?? undefined,
          name: user.name ?? undefined,
          tenantId: user.tenantId,
          role: user.role,
        } as any;
      },
    }),
  ],
  callbacks: {
    async jwt({ token, user }) {
      if (user) {
        token.tenantId = (user as any).tenantId;
        token.role = (user as any).role;
        token.username = (user as any).username;
      }
      return token;
    },
    async session({ session, token }) {
      if (session.user) {
        (session.user as any).id = token.sub;
        (session.user as any).tenantId = token.tenantId;
        (session.user as any).role = token.role;
        (session.user as any).username = token.username;
      }
      return session;
    },
  },
};