How to sign in with OIDC

The oidc guard of @samveys/auth signs users in with the Organization's identity provider, using the authorization code flow with PKCE. Which provider is used is still open. The guard works with any OpenID Connect provider, so the answer only changes configuration.

import { auth, oidcGuard, sessionGuard } from '@samveys/auth'

const users = ormUserProvider(User) // must implement findOrCreateFromClaims(claims)
const sso = oidcGuard({
  issuer: process.env.OIDC_ISSUER!,           // e.g. https://accounts.google.com
  clientId: process.env.OIDC_CLIENT_ID!,
  clientSecret: process.env.OIDC_CLIENT_SECRET,
  redirectUri: 'https://app.example.com/auth/callback',
  provider: users,
})
export const authPlugin = auth({ guards: { web: sessionGuard({ provider: users }), sso }, default: 'web' })

router.group({ use: ['session'] }, (web) => {
  web.get('/auth/login', (ctx) => sso.redirectToProvider(ctx))
  web.get('/auth/callback', async (ctx) => {
    await sso.handleCallback(ctx)       // validates, signs in, regenerates the session id
    return ctx.response.redirect('/')
  })
})

What is checked on the callback. Any failure is 400 SVS_E095, and no user is signed in.

• state matches the value stored in the session.
• The PKCE verifier is sent to the token endpoint.
• The ID token signature verifies against the provider's JWKS (RS256 or ES256).
• iss equals the issuer.
• aud contains the client id.
• exp and iat are within 60 s of clock skew.
• nonce matches the value stored in the session.

CI tests the whole flow against a local test provider that runs in the test process. The tests also check that a wrong state, a tampered signature, a wrong nonce, and a PKCE mismatch are all rejected.