From 63d1361a7a999e7613a55d4fefbf6dbabab9eb11 Mon Sep 17 00:00:00 2001 From: Alex van Andel Date: Wed, 3 Dec 2025 10:21:20 +0100 Subject: [PATCH] fix: simplify credentials provider authorization flow (#25563) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../features/auth/lib/next-auth-options.ts | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/packages/features/auth/lib/next-auth-options.ts b/packages/features/auth/lib/next-auth-options.ts index 5e317ccf19..e4ee24a9f7 100644 --- a/packages/features/auth/lib/next-auth-options.ts +++ b/packages/features/auth/lib/next-auth-options.ts @@ -169,21 +169,15 @@ const providers: Provider[] = [ identifier: hashEmail(user.email), }); - if (!user.password?.hash && user.identityProvider !== IdentityProvider.CAL && !credentials.totpCode) { - throw new Error(ErrorCode.IncorrectEmailPassword); - } - if (!user.password?.hash && user.identityProvider == IdentityProvider.CAL) { + // Users without a password must use their identity provider (Google/SAML) to login + if (!user.password?.hash) { throw new Error(ErrorCode.IncorrectEmailPassword); } - if (user.password?.hash && !credentials.totpCode) { - if (!user.password?.hash) { - throw new Error(ErrorCode.IncorrectEmailPassword); - } - const isCorrectPassword = await verifyPassword(credentials.password, user.password.hash); - if (!isCorrectPassword) { - throw new Error(ErrorCode.IncorrectEmailPassword); - } + // Always verify password for users who have one + const isCorrectPassword = await verifyPassword(credentials.password, user.password.hash); + if (!isCorrectPassword) { + throw new Error(ErrorCode.IncorrectEmailPassword); } if (user.twoFactorEnabled && credentials.backupCode) {