Simplifies admin password role checks

packages/features/auth/lib/next-auth-options.ts

@@ -21,6 +21,7 @@ import { clientSecretVerifier, hostedCal, isSAMLLoginEnabled } from "@calcom/fea
 import { APP_NAME, IS_TEAM_BILLING_ENABLED, WEBAPP_URL, WEBSITE_URL } from "@calcom/lib/constants";
 import { symmetricDecrypt } from "@calcom/lib/crypto";
 import { defaultCookies } from "@calcom/lib/default-cookies";
+import { isENVDev } from "@calcom/lib/env";
 import { randomString } from "@calcom/lib/random";
 import rateLimit from "@calcom/lib/rateLimit";
 import { serverConfig } from "@calcom/lib/serverConfig";
@@ -165,28 +166,25 @@ const providers: Provider[] = [
         }).length > 0;
 
       // authentication success- but does it meet the minimum password requirements?
-      if (
+      const validateRole = (role: UserPermissionRole) => {
-        user.role === "ADMIN" &&
+        // User's role is not "ADMIN"
-        ((user.identityProvider === IdentityProvider.CAL &&
+        if (role !== "ADMIN") return role;
-          !isPasswordValid(credentials.password, false, true)) ||
+        // User's identity provider is not "CAL"
-          !user.twoFactorEnabled)
+        if (user.identityProvider !== IdentityProvider.CAL) return role;
-      ) {
+        // User's password is valid and two-factor authentication is enabled
-        return {
+        if (isPasswordValid(credentials.password, false, true) && user.twoFactorEnabled) return role;
-          id: user.id,
+        // Code is running in a development environment
-          username: user.username,
+        if (isENVDev) return role;
-          email: user.email,
+        // By this point it is an ADMIN without valid security conditions
-          name: user.name,
+        return "INACTIVE_ADMIN";
-          role: "INACTIVE_ADMIN",
+      };
-          belongsToActiveTeam: hasActiveTeams,
-        };
-      }
 
       return {
         id: user.id,
         username: user.username,
         email: user.email,
         name: user.name,
-        role: user.role,
+        role: validateRole(user.role),
         belongsToActiveTeam: hasActiveTeams,
       };
     },