Method setupRoutes

src/server/web/auth/oauth-auth.ts:130–214

(app: Application)

  }

  setupRoutes(app: Application): void {
    // GET /auth/login — redirect to the identity provider
    app.get("/auth/login", async (_req, res) => {
      try {
        const disc = await this.getDiscovery();
        const state = randomBytes(16).toString("hex");
        this.pendingStates.set(state, Date.now());

        const authUrl = new URL(disc.authorization_endpoint);
        authUrl.searchParams.set("client_id", this.clientId);
        authUrl.searchParams.set("redirect_uri", this.callbackUrl);
        authUrl.searchParams.set("response_type", "code");
        authUrl.searchParams.set("scope", this.scopes);
        authUrl.searchParams.set("state", state);

        // Store state in a short-lived cookie for CSRF validation
        res.setHeader("Set-Cookie", [
          `oauth_state=${state}; HttpOnly; SameSite=Lax; Path=/auth; Max-Age=600`,
        ]);
        res.redirect(authUrl.toString());
      } catch (err) {
        console.error("[oauth] Failed to initiate login:", err);
        res.status(500).send("Authentication provider unavailable.");
      }
    });

    // GET /auth/callback — exchange code for tokens, create session
    app.get("/auth/callback", async (req, res) => {
      const { code, state, error } = req.query as Record<string, string | undefined>;

      if (error) {
        console.warn("[oauth] Provider error:", error);
        res.status(400).send(`Provider returned error: ${error}`);
        return;
      }

      if (!code || !state) {
        res.status(400).send("Missing code or state.");
        return;
      }

      // Validate state against cookie
      const storedState = this.extractStateCookie(req as unknown as IncomingMessage);
      if (!storedState || storedState !== state || !this.pendingStates.has(state)) {
        res.status(400).send("Invalid state parameter.");
        return;
      }
      this.pendingStates.delete(state);
      // Clear state cookie
      res.setHeader("Set-Cookie", [
        `oauth_state=; HttpOnly; SameSite=Lax; Path=/auth; Max-Age=0`,
      ]);

      try {
        const disc = await this.getDiscovery();
        const tokens = await this.exchangeCode(disc.token_endpoint, code);
        const userInfo = await this.getUserInfo(disc.userinfo_endpoint, tokens.access_token);