fastify-openid-auth

import Fastify from 'fastify'; import openIDAuthPlugin from 'fastify-openid-auth'; import { generators } from 'openid-client'; // Often used with openid-client // For session management, typically you'd also install and register @fastify/cookie and @fastify/session // import fastifyCookie from '@fastify/cookie'; // import fastifySession from '@fastify/session'; const fastify = Fastify({ logger: true }); // Dummy OpenID Provider configuration (replace with actual values) const openidConfig = { issuer: 'https://accounts.google.com', // Example, replace with your OIDC provider client_id: process.env.OIDC_CLIENT_ID ?? 'your-client-id-from-provider', client_secret: process.env.OIDC_CLIENT_SECRET ?? 'your-client-secret-from-provider', redirect_uris: ['http://localhost:3000/auth/callback'], response_types: ['code'] }; const AUTH_HANDLERS_SYMBOL = Symbol.for('auth-handlers'); // Register cookie and session plugins FIRST if using cookie-based authentication // fastify.register(fastifyCookie); // fastify.register(fastifySession, { // secret: process.env.SESSION_SECRET ?? 'a-very-long-and-secure-secret-key-for-session-encryption', // cookie: { secure: process.env.NODE_ENV === 'production' } // }); fastify.register(openIDAuthPlugin, { decorator: AUTH_HANDLERS_SYMBOL, config: openidConfig, login: { // Required since v12.0.0 for all handlers that manage OIDC state/tokens via session session: { get: async (request) => (request as any).session, // Placeholder: assumes @fastify/session is set up set: async (request, value) => { (request as any).session = value; }, // Placeholder destroy: async (request) => { delete (request as any).session; } // Placeholder }, client_redirect_uri: 'http://localhost:3000/auth/callback', parameters: { scope: 'openid email profile', prompt: 'login' }, code_verifier_generator: generators.codeVerifier, // Recommended for PKCE state_generator: generators.random // Recommended for state parameter }, verify: { session: { get: async (request) => (request as any).session, set: async (request, value) => { (request as any).session = value; }, destroy: async (request) => { delete (request as any).session; } } } }); fastify.get('/login', async (request, reply) => { const { login } = (fastify as any)[AUTH_HANDLERS_SYMBOL]; await login(request, reply); }); fastify.get('/auth/callback', async (request, reply) => { const { verify } = (fastify as any)[AUTH_HANDLERS_SYMBOL]; try { const tokens = await verify(request, reply); reply.send({ message: 'Login successful!', tokens }); } catch (error: any) { fastify.log.error(error); reply.status(401).send({ error: 'Authentication failed', details: error.message }); } }); fastify.get('/protected', async (request, reply) => { // In a real application, you would add authentication middleware here // to check for a valid session or bearer token after 'verify' has run. reply.send({ message: 'This is a protected route. Requires prior authentication.' }); }); const start = async () => { try { await fastify.listen({ port: 3000 }); fastify.log.info(`Server listening on port ${3000}`); } catch (err) { fastify.log.error(err); process.exit(1); } }; start();