How accept invitation flow works?

[gnasamx]

I understood the first part i.e sending an email invite to user. But I'm struggling to understand the remaining part i.e "Accepting an invite".

File path: apps/web/lib/api/users.ts

export async function inviteUser({
  email,
  workspace,
  session,
}: {
  email: string;
  workspace: WorkspaceProps;
  session?: Session;
}) {
  // same method of generating a token as next-auth
  const token = randomBytes(32).toString("hex");
  const expires = new Date(Date.now() + TWO_WEEKS_IN_SECONDS * 1000);

  // create a workspace invite record and a verification request token that lasts for a week
  // here we use a try catch to account for the case where the user has already been invited
  // for which `prisma.projectInvite.create()` will throw a unique constraint error
  try {
    await prisma.projectInvite.create({
      data: {
        email,
        expires,
        projectId: workspace.id,
      },
    });
  } catch (error) {
    if (error.code === "P2002") {
      throw new DubApiError({
        code: "conflict",
        message: "User has already been invited to this workspace.",
      });
    }
  }

  await prisma.verificationToken.create({
    data: {
      identifier: email,
      token: hashToken(token),
      expires,
    },
  });

  const params = new URLSearchParams({
    callbackUrl: `${process.env.NEXTAUTH_URL}/${workspace.slug}`,
    email,
    token,
  });

❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓
  const url = `${process.env.NEXTAUTH_URL}/api/auth/callback/email?${params}`;   <-------- This is where I'm STRUGGLING
❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓❓

  return await sendEmail({
    subject: `You've been invited to join a workspace on ${process.env.NEXT_PUBLIC_APP_NAME}`,
    email,
    react: WorkspaceInvite({
      email,
      appName: process.env.NEXT_PUBLIC_APP_NAME as string,
      url,
      workspaceName: workspace.name,
      workspaceUser: session?.user.name || null,
      workspaceUserEmail: session?.user.email || null,
    }),
  });
}

Question: I understood that this /api/auth/callback/email is the link that will start the invitation accept flow. But I don't know where to find that code. I'm guessing this code is related to Next-Auth callback or pages.

/api/auth/callback/email this run on server side and then probably it redirects to invited Project.

But how can I understand the Next-auth part related to /api/auth/callback/email. That part is really an abstraction. Can you please help me.

[gnasamx]

I understood this. Currently dub is using next-auth 4 and Email Provider. This Email provider is deprecated in auth.js (next-auth 5 beta).

I understood the accept invitation by using Resend Provider. The flow is as below:

The below code if from Next Auth GitHub repo.

Resend provider has type: "email"

// packages/core/src/providers/resend.ts

export default function Resend(config: EmailUserConfig): EmailConfig {
  return {
    id: "resend",
    type: "email",   <------------------------------------
    name: "Resend",
    from: "Auth.js <no-reply@authjs.dev>",
    maxAge: 24 * 60 * 60,
    async sendVerificationRequest(params) { ... },
    options: config,
  }
}

The invitation url looks like this: http://localhost:3000/api/auth/callback/resend?callbackUrl=""&token=""&email=""

Once you click on accept invite, this will load the app and try to accept the invite. At this exact point below callback from Next Auth runs.

// packages/core/src/lib/actions/callback/index.ts

export async function callback(
  request: RequestInternal,
  options: InternalOptions,
  sessionStore: SessionStore,
  cookies: Cookie[]
): Promise<ResponseInternal> {
  if (!options.provider)
    throw new InvalidProvider("Callback route called without provider")
  const { query, body, method, headers } = request
  const {
    provider,
    adapter,
    url,
    callbackUrl,
    pages,
    jwt,
    events,
    callbacks,
    session: { strategy: sessionStrategy, maxAge: sessionMaxAge },
    logger,
  } = options

  const useJwtSession = sessionStrategy === "jwt"

  try {
    if (provider.type === "oauth" || provider.type === "oidc") {
     ...
    } else if (provider.type === "email") {     <------------------------------------
     ...
    } else if (provider.type === "credentials" && method === "POST") {
     ...
    } else if (provider.type === "webauthn" && method === "POST") {
      ...
    }
    throw new InvalidProvider(
      `Callback for provider type (${provider.type}) is not supported`
    )
  } catch (e) {
     ...
  }
}