fix: Refresh authjs session cookie at payload "refresh-token" endpoint

CrawlerCode · CrawlerCode · commit 66e50fc95822 · 2025-03-26T23:28:02.000+01:00
diff --git a/packages/payload-authjs/src/payload/collection/endpoints/refresh.ts b/packages/payload-authjs/src/payload/collection/endpoints/refresh.ts
@@ -0,0 +1,97 @@
+import NextAuth from "next-auth";
+import type { Endpoint, PayloadRequest } from "payload";
+import { generatePayloadCookie, headersWithCors, refreshOperation } from "payload";
+
+import { withPayload } from "../../../authjs/withPayload";
+import { AUTHJS_STRATEGY_NAME } from "../../AuthjsAuthStrategy";
+import type { AuthjsPluginConfig } from "../../plugin";
+import { getRequestCollection } from "../../utils/getRequestCollection";
+
+/**
+ * Override the default refresh endpoint to refresh the authjs session cookie
+ *
+ * @see https://payloadcms.com/docs/authentication/operations#refresh
+ * @see https://github.com/payloadcms/payload/blob/main/packages/payload/src/auth/endpoints/refresh.ts
+ * @see https://github.com/payloadcms/payload/blob/main/packages/payload/src/auth/operations/refresh.ts
+ */
+export const refreshEndpoint: (pluginOptions: AuthjsPluginConfig) => Endpoint = pluginOptions => ({
+  method: "post",
+  path: "/refresh-token",
+  handler: async req => {
+    // --- Payload cms default logic ---
+    const collection = getRequestCollection(req);
+    const { t } = req;
+
+    const headers = headersWithCors({
+      headers: new Headers(),
+      req,
+    });
+
+    const result = await refreshOperation({
+      collection,
+      req,
+    });
+
+    if (result.setCookie) {
+      const cookie = generatePayloadCookie({
+        collectionAuthConfig: collection.config.auth,
+        cookiePrefix: req.payload.config.cookiePrefix,
+        token: result.refreshedToken,
+      });
+
+      if (collection.config.auth.removeTokenFromResponses) {
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-expect-error
+        delete result.refreshedToken;
+      }
+
+      headers.set("Set-Cookie", cookie);
+    }
+
+    const response = Response.json(
+      {
+        message: t("authentication:tokenRefreshSuccessful"),
+        ...result,
+      },
+      {
+        headers,
+        status: 200,
+      },
+    );
+
+    // --- Custom logic ---
+
+    // If the user is authenticated using authjs, we need to refresh the authjs session cookie
+    if (result.user?._strategy === AUTHJS_STRATEGY_NAME) {
+      await refreshAuthjsSessionCookie(req, response, pluginOptions);
+    }
+
+    return response;
+  },
+});
+
+/**
+ * Refresh the authjs session cookie
+ */
+const refreshAuthjsSessionCookie = async (
+  req: PayloadRequest,
+  response: Response,
+  pluginOptions: AuthjsPluginConfig,
+) => {
+  // Create authjs instance
+  const { auth } = NextAuth(
+    withPayload(pluginOptions.authjsConfig, {
+      payload: req.payload,
+      userCollectionSlug: pluginOptions.userCollectionSlug,
+    }),
+  );
+
+  // Execute authjs "auth" function to refresh the session and generate cookies
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const resp: Response = (await auth(req as any)) as any;
+
+  // Set cookies on response
+  for (const cookie of resp.headers.getSetCookie()) {
+    response.headers.append("Set-Cookie", cookie);
+  }
+};
diff --git a/packages/payload-authjs/src/payload/collection/index.ts b/packages/payload-authjs/src/payload/collection/index.ts
@@ -5,6 +5,7 @@ import type { AuthjsPluginConfig } from "../plugin";
 import { mergeFields } from "../utils/mergeFields";
 import { defaultAccess } from "./access";
 import { logoutEndpoint } from "./endpoints/logout";
+import { refreshEndpoint } from "./endpoints/refresh";
 import { accountsField } from "./fields/accounts";
 import { generalFields } from "./fields/general";
 import { sessionsField } from "./fields/session";
@@ -109,5 +110,7 @@ export const generateUsersCollection = (
     ...(collection.endpoints || []),
     // Add the logout endpoint
     logoutEndpoint(pluginOptions),
+    // Add the refresh endpoint
+    refreshEndpoint(pluginOptions),
   ];
 };
