Merged PR 1089: changed session limit and scope of protection

changed session limit and scope of protection

Related work items: #10497

middleware.js

@@ -0,0 +1,37 @@
+// export { default } from "next-auth/middleware";
+
+// export const config = {
+//     matcher: ["/myportal/", "/myportal/:path*"],
+// };
+
+// import { withAuth } from 'next-auth/middleware';
+
+//   export default withAuth({
+// 	  pages: {
+// 		  signIn: '/login',
+// 	  },
+//   });
+
+import { withAuth } from "next-auth/middleware";
+
+export default withAuth({
+    callbacks: {
+        authorized: ({ req }) => {
+            // verify token and return a boolean
+            const sessionToken = req.cookies.get("next-auth.session-token");
+            if (sessionToken) return true;
+            else return false;
+        },
+    },
+});
+
+export const config = {
+    matcher: [
+        "/myportal",
+        "/myportal/:path*",
+        "/newappeal",
+        "/newappeal/:path*",
+        "/account",
+        "/account/:path*",
+    ],
+};

notusedmiddleware.js

@@ -1,13 +0,0 @@
-// export { default } from "next-auth/middleware";
-
-// export const config = {
-//     matcher: ["/myportal/", "/myportal/:path*"],
-// };
-
-// import { withAuth } from 'next-auth/middleware';
-
-//   export default withAuth({
-// 	  pages: {
-// 		  signIn: '/login',
-// 	  },
-//   });

pages/api/auth/[...nextauth].js

@@ -202,10 +202,13 @@ const authOptions = (locale, req, res) => {
         adapter: PrismaAdapter(prisma),
         secret: process.env.NEXTAUTH_SECRET,
         session: {
+            strategy: "database",
             jwt: true,
             pages: {},
             theme: "dark",
             debug: true,
+            maxAge: 30 * 60,
+            updateAge: 5 * 60, // 24 hours
         },
         cookies: {
             callbackUrl: {
@@ -227,7 +230,7 @@ const authOptions = (locale, req, res) => {
         },
         callbacks: {
             session: async (session, user) => {
-                //console.log(user);
+                console.log("callback in auth", session, user);
                 return Promise.resolve(session);
             },
             // redirect({ url, baseUrl }) {