async jwt ({ token, user, account, profile, isNewUser }) {
      if (user) {
        // reset signup cookie if any
        res.appendHeader('Set-Cookie', cookie.serialize('signin', '', { path: '/', expires: 0, maxAge: 0 }))
        // token won't have an id on it for new logins, we add it
        // note: token is what's kept in the jwt
        token.id = Number(user.id)

        // if referrer exists, set on user
        // isNewUser doesn't work for nostr/lightning auth because we create the user before nextauth can
        // this means users can update their referrer if they don't have one, which is fine
        if (req.cookies.sn_referrer && user?.id) {
          const referrerData = await getReferrerData(req.cookies.sn_referrer, req.cookies.sn_referee_landing)
          if (referrerData?.referrerId && referrerData.referrerId !== parseInt(user?.id)) {
            // if user doesn't have a referrer, record it in the db
            const { count } = await prisma.user.updateMany({ where: { id: user.id, referrerId: null }, data: { referrerId: referrerData.referrerId } })
            if (count > 0) {
              // if user has an associated landing, record it in the db
              if (referrerData.type && referrerData.typeId) {
                await prisma.oneDayReferral.create({ data: { ...referrerData, refereeId: user.id, landing: true } })
              }
              notifyReferral(referrerData.referrerId)
            }
          }
        }
      }

      if (token?.id) {
        // HACK token.sub is used by nextjs v4 internally and is used like a userId
        // setting it here allows us to link multiple auth method to an account
        // ... in v3 this linking field was token.user.id
        token.sub = Number(token.id)
      }

      if (user && req && res) {
        // add multi_auth cookie for user that just logged in
        const secret = process.env.NEXTAUTH_SECRET
        const jwt = await encodeJWT({ token, secret })
        const me = await prisma.user.findUnique({ where: { id: token.id } })
        setMultiAuthCookies(req, res, { ...me, jwt })
      }

      return token
    }
@param  {object}  token     Decrypted JSON Web Token
@param  {object}  user      User object      (only available on sign in)
@param  {object}  account   Provider account (only available on sign in)
@param  {object}  profile   Provider profile (only available on sign in)
@param  {boolean} isNewUser True if new user (only available on sign in)
@return {object}            JSON Web Token that will be saved