chore(docs): Fix syntax error in RBAC guide

[benhovinga]

☕️ Reasoning

Moved the Ellipsis ( ... ) onto a separate line as a comment. The Ellipsis was throwing "Expression Expected" error. I assume this was used to indicate to the developer that more properties can be added here. Moving it inside of a comment performs the same function without throwing any errors.

Before

export const { handlers, auth } = NextAuth({
  providers: [
    Google({
      profile(profile) {
        return { role: profile.role ?? "user", ... }
      },
    })
  ],
})

After

export const { handlers, auth } = NextAuth({
  providers: [
    Google({
      profile(profile) {
        return {
          role: profile.role ?? "user",
          // ...
        }
      },
    })
  ],
})

This fix has been applied to all frameworks.

🧢 Checklist

• Documentation
• Tests - N/A
• Ready to be merged

🎫 Affected issues

Fixes: #12462

📌 Resources

• Security guidelines
• Contributing guidelines
• Code of conduct
• Contributing to Open Source

[vercel]

@benhovinga is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
auth-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jun 22, 2025 11:20am

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
next-auth-docs	⬜️ Ignored (Inspect)	Visit Preview		Jun 22, 2025 11:20am

[tgeorge73]

I believe the proposed documentation update is incorrect. The ... is not an ellipse, but the spread operator. (The error occurs in typescript because the spread operator is missing the object to spread, in this case profile).

So removing the ", ..." as proposed causes the user to be created in the database with ONLY the properties in the function. changing "..." to "...profile" causes the properties from the profile to be merged with the values set manually in the function.

One other note, specific to the spread operator, is the order of statements with respect to the spread operator. When the spread operator is last, the properties of the profile (object being spread) from the IdP will override and matching property statement manually set -- this seems safest as a pattern such that the IdP identity information is most accurate. If the spread operator is first, then any manually set properties will override matching properties returned from the IdP profile. (This would only be appropriate if there was a valid reason to change an IdP provided value -- which arguably should not be done.) While not applicable to the role property because it does not exist in the profile, this is an important note in my opinion as it can be a source of confusion to newer devs (maybe link out to spread operator documentation here?)

[benhovinga]

@tgeorge73

The ... is not an ellipse, but the spread operator. (The error occurs in typescript because the spread operator is missing the object to spread, in this case profile).

Ah, this makes more sense. Usually when I see ... on it's own I assume this is a placeholder. It is clear now that profile was missing after it to make it a spread operator.

So this should be the correct version

export const { handlers, auth } = NextAuth({
  providers: [
    Google({
      profile(profile) {
        return { role: profile.role ?? "user", ...profile }
      },
    })
  ],
})

When I get on my dev machine I will update the PR.

[ndom91]

Thanks!

EDIT: Ah just read the comments. Not sure if it was meant as a spread operator where the author just forgot the profile part. But that should ideally be there, so let's go that route.

If you update it I can get this merged. Sorry for the delay!

[benhovinga]

Corrected the spread operator to ...profile