JWT Configuration

Jose Madrid Salsa uses JWT (JSON Web Token) sessions exclusively -- there is no database session table. The JWT is signed with NEXTAUTH_SECRET and stored in an HTTP-only cookie.

Session Strategy

session: {
  strategy: 'jwt',
  maxAge: 30 * 24 * 60 * 60, // 30 days
},

• Strategy: jwt (no database adapter)
• Max age: 30 days
• Storage: HTTP-only, secure cookie in production

Token Contents

The JWT token is enriched in the jwt callback with application-specific fields:

Session Object

The session callback maps token fields to session.user:

async session({ session, token }) {
  if (session.user) {
    session.user.id = token.id
    session.user.role = token.role
    if (token.fundraiserId) session.user.fundraiserId = token.fundraiserId
    if (token.avatar) session.user.image = token.avatar
  }
  return session
}

Accessing the Session

Server-side (Server Components, API routes):

import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'

const session = await getServerSession(authOptions)
const userId = session?.user?.id
const role = session?.user?.role

Client-side (Client Components):

import { useSession } from 'next-auth/react'

function MyComponent() {
  const { data: session } = useSession()
  const role = session?.user?.role
}

Cookie Configuration

Token Refresh Behavior

The JWT callback runs on every request that needs session data. The token enrichment follows this flow:

1. Initial sign-in: User data (id, role) is added from the credentials provider or OAuth upsert
2. Subsequent requests: Token already contains role; no database call needed
3. Missing role fallback: If token.role is somehow missing, queries the database by email

This design minimizes database calls -- most requests use the cached role from the token.

Signing Secret

The JWT is signed with NEXTAUTH_SECRET:

secret: process.env.NEXTAUTH_SECRET,

Generate a strong secret:

openssl rand -base64 32