fix: narrow PR to verified bug fixes

packages/auth/events.ts

@@ -32,22 +32,15 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
 
     const groupsKey = env.AUTH_OIDC_GROUPS_ATTRIBUTE;
     // Groups from oidc provider are provided from the profile, it's not typed.
-    // Some providers send a single group as a string instead of an array — normalize it.
-    // Only accept string or string[] claims; reject null, numbers, objects, etc.
-    const oidcGroups = profile && groupsKey in profile ? profile[groupsKey] : undefined;
-    const normalizedOidcGroups: string[] | undefined = (() => {
-      if (typeof oidcGroups === "string") return [oidcGroups];
-      if (Array.isArray(oidcGroups) && oidcGroups.every((group): group is string => typeof group === "string")) {
-        return oidcGroups;
-      }
-      if (oidcGroups !== undefined) {
-        logger.warn(`Invalid OIDC groups claim "${groupsKey}"`);
-      }
-      return undefined;
-    })();
-    if (!env.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT && dbUser.provider === "oidc" && normalizedOidcGroups !== undefined) {
-      logger.debug(`Using profile groups (${groupsKey}): ${JSON.stringify(normalizedOidcGroups)}`);
-      await synchronizeGroupsWithExternalForUserAsync(db, user.id, normalizedOidcGroups);
+    if (
+      !env.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT &&
+      dbUser.provider === "oidc" &&
+      profile &&
+      groupsKey in profile &&
+      Array.isArray(profile[groupsKey])
+    ) {
+      logger.debug(`Using profile groups (${groupsKey}): ${JSON.stringify(profile[groupsKey])}`);
+      await synchronizeGroupsWithExternalForUserAsync(db, user.id, profile[groupsKey] as string[]);
     }
 
     // In ldap-authroization we return the groups from ldap, it's not typed.

packages/auth/test/events.spec.ts

@@ -152,48 +152,6 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
       });
       expect(dbGroupMembers?.groupId).toBe("1");
     });
-    test("should add membership when the groups claim is a single string", async () => {
-      // Arrange
-      const db = createDb();
-      await createUserAsync(db, "oidc");
-      await createGroupAsync(db);
-      const eventHandler = createSignInEventHandler(db);
-
-      // Act
-      await eventHandler?.({
-        user: { id: "1", name: "test" },
-        profile: { preferred_username: "test", someRandomGroupsKey: "test" },
-        account: null,
-      });
-
-      // Assert
-      const dbGroupMembers = await db.query.groupMembers.findFirst({
-        where: eq(groupMembers.userId, "1"),
-      });
-      expect(dbGroupMembers?.groupId).toBe("1");
-    });
-    test("should not change memberships for an invalid groups claim", async () => {
-      // Arrange
-      const db = createDb();
-      await createUserAsync(db, "oidc");
-      await createGroupAsync(db);
-      await db.insert(groupMembers).values({ userId: "1", groupId: "1" });
-      const eventHandler = createSignInEventHandler(db);
-
-      // Act
-      await eventHandler?.({
-        user: { id: "1", name: "test" },
-        profile: { preferred_username: "test", someRandomGroupsKey: 42 },
-        account: null,
-      });
-
-      // Assert
-      const dbGroupMembers = await db.query.groupMembers.findMany({
-        where: eq(groupMembers.userId, "1"),
-        columns: { groupId: true },
-      });
-      expect(dbGroupMembers).toEqual([{ groupId: "1" }]);
-    });
     test("should remove group membership", async () => {
       // Arrange
       const db = createDb();