@sviy/authglue 1.0.0 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README +92 -1
- package/package.json +1 -1
package/README
CHANGED
|
@@ -1,3 +1,94 @@
|
|
|
1
1
|
# @sviy/authglue
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
OIDC authentication glue for Express apps.
|
|
4
|
+
|
|
5
|
+
Wraps [`openid-client`](https://www.npmjs.com/package/openid-client) and [`express-session`](https://www.npmjs.com/package/express-session) into a single setup call. Your app redirects to any OIDC provider, handles the callback, creates a session, and gives you back `req.session.user`. No auth boilerplate per app.
|
|
6
|
+
|
|
7
|
+
## Install
|
|
8
|
+
|
|
9
|
+
```sh
|
|
10
|
+
npm install @sviy/authglue
|
|
11
|
+
```
|
|
12
|
+
|
|
13
|
+
## Usage
|
|
14
|
+
|
|
15
|
+
```js
|
|
16
|
+
import express from 'express';
|
|
17
|
+
import { setupAuth } from '@sviy/authglue';
|
|
18
|
+
|
|
19
|
+
const app = express();
|
|
20
|
+
|
|
21
|
+
const requireAuth = await setupAuth(app, {
|
|
22
|
+
issuerUrl: process.env.IDP_ISSUER,
|
|
23
|
+
clientId: process.env.IDP_CLIENT_ID,
|
|
24
|
+
clientSecret: process.env.IDP_CLIENT_SECRET,
|
|
25
|
+
callbackUrl: `${process.env.HOST}/callback`,
|
|
26
|
+
sessionSecret: process.env.SESSION_SECRET,
|
|
27
|
+
sessionPath: '/app/data/.session',
|
|
28
|
+
secure: true,
|
|
29
|
+
successRedirect: '/dashboard',
|
|
30
|
+
});
|
|
31
|
+
|
|
32
|
+
app.get('/dashboard', requireAuth, (req, res) => {
|
|
33
|
+
res.render('dashboard', { user: req.session.user });
|
|
34
|
+
});
|
|
35
|
+
|
|
36
|
+
app.listen(3000);
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
## Configuration
|
|
40
|
+
|
|
41
|
+
| Field | Required | Description |
|
|
42
|
+
|---|---|---|
|
|
43
|
+
| `issuerUrl` | Yes | OIDC provider issuer URL (e.g. `https://rauthy.example.com`) |
|
|
44
|
+
| `clientId` | Yes | Client ID registered with the OIDC provider |
|
|
45
|
+
| `clientSecret` | Yes | Client secret registered with the OIDC provider |
|
|
46
|
+
| `callbackUrl` | Yes | Redirect URI registered with the provider |
|
|
47
|
+
| `sessionSecret` | Yes | Secret used to sign session cookies |
|
|
48
|
+
| `sessionPath` | No | Where to persist session files. Default: `./sessions` |
|
|
49
|
+
| `scopes` | No | OIDC scopes to request. Default: `openid profile email offline_access` |
|
|
50
|
+
| `secure` | No | Set `true` to enable Secure cookies (requires HTTPS). Default: `false` |
|
|
51
|
+
| `loginPath` | No | Route that triggers login. Default: `/login` |
|
|
52
|
+
| `callbackPath` | No | Route the provider redirects to. Default: `/callback` |
|
|
53
|
+
| `logoutPath` | No | Route that triggers logout. Default: `/logout` |
|
|
54
|
+
| `successRedirect` | No | Where to send the user after successful login. Default: `/` |
|
|
55
|
+
|
|
56
|
+
## How It Works
|
|
57
|
+
|
|
58
|
+
1. User visits a protected route without a session
|
|
59
|
+
2. `requireAuth` redirects to `/login`
|
|
60
|
+
3. `authglue` generates PKCE verifier + state, redirects to the OIDC provider
|
|
61
|
+
4. User authenticates at the provider (password, passkey, 2FA — whatever the provider supports)
|
|
62
|
+
5. Provider redirects back to `/callback`
|
|
63
|
+
6. `authglue` exchanges the authorization code for tokens, creates an Express session
|
|
64
|
+
7. User is redirected to `successRedirect` with `req.session.user` populated
|
|
65
|
+
|
|
66
|
+
## Provider-Agnostic
|
|
67
|
+
|
|
68
|
+
Works with any OIDC-compatible provider:
|
|
69
|
+
|
|
70
|
+
- Rauthy
|
|
71
|
+
- Autentico
|
|
72
|
+
- Pocket ID
|
|
73
|
+
- Keycloak
|
|
74
|
+
- Zitadel
|
|
75
|
+
- Auth0
|
|
76
|
+
- Okta
|
|
77
|
+
- Google
|
|
78
|
+
- Any other OIDC provider
|
|
79
|
+
|
|
80
|
+
Switching providers means changing `issuerUrl`, `clientId`, and `clientSecret`. Nothing else.
|
|
81
|
+
|
|
82
|
+
## What This Package Does Not Do
|
|
83
|
+
|
|
84
|
+
- Does not store users or passwords — that's the IdP's job
|
|
85
|
+
- Does not provide an admin UI or login page — the IdP renders those
|
|
86
|
+
- Does not implement OIDC protocol details — [`openid-client`](https://www.npmjs.com/package/openid-client) does that
|
|
87
|
+
- Does not handle 2FA or passkeys — the IdP handles those
|
|
88
|
+
|
|
89
|
+
This package is the glue between your Express app and your OIDC provider. Nothing more.
|
|
90
|
+
|
|
91
|
+
## License
|
|
92
|
+
|
|
93
|
+
MIT
|
|
94
|
+
No responsibility, liability ro warranty. Use at your risk.
|