Class OAuthAdapter

src/server/web/auth/oauth-auth.ts:79–276

 *   ADMIN_USERS          — comma-separated user IDs or emails that get admin role
 */
export class OAuthAdapter implements AuthAdapter {
  private readonly store: SessionStore;
  private readonly clientId: string;
  private readonly clientSecret: string;
  private readonly issuer: string;
  private readonly callbackUrl: string;
  private readonly scopes: string;
  private readonly adminUsers: ReadonlySet<string>;
  /** Cached OIDC discovery document. */
  private discovery: OIDCDiscovery | null = null;
  /** In-flight state tokens to prevent CSRF. */
  private readonly pendingStates = new Map<string, number>();

  constructor(store: SessionStore) {
    this.store = store;
    this.clientId = process.env.OAUTH_CLIENT_ID ?? "";
    this.clientSecret = process.env.OAUTH_CLIENT_SECRET ?? "";
    this.issuer = (process.env.OAUTH_ISSUER ?? "").replace(/\/$/, "");
    this.callbackUrl =
      process.env.OAUTH_CALLBACK_URL ?? "http://localhost:3000/auth/callback";
    this.scopes = process.env.OAUTH_SCOPES ?? "openid email profile";
    this.adminUsers = new Set(
      (process.env.ADMIN_USERS ?? "")
        .split(",")
        .map((s) => s.trim())
        .filter(Boolean),
    );

    // Periodically prune stale state tokens (>10 min old).
    setInterval(() => {
      const cutoff = Date.now() - 10 * 60_000;
      for (const [s, t] of this.pendingStates) {
        if (t < cutoff) this.pendingStates.delete(s);
      }
    }, 5 * 60_000).unref();
  }

  authenticate(req: IncomingMessage): AuthUser | null {
    const session = this.store.getFromRequest(req);
    if (!session) return null;
    return {
      id: session.userId,
      email: session.email,
      name: session.name,
      isAdmin:
        session.isAdmin ||
        this.adminUsers.has(session.userId) ||
        (session.email ? this.adminUsers.has(session.email) : false),
    };
  }

  setupRoutes(app: Application): void {
    // GET /auth/login — redirect to the identity provider
    app.get("/auth/login", async (_req, res) => {
      try {
        const disc = await this.getDiscovery();
        const state = randomBytes(16).toString("hex");
        this.pendingStates.set(state, Date.now());