@loop8id/auth-express

Express middleware for Loop8ID OpenID Connect authentication.

Installation

npm install @loop8id/auth-express @loop8id/auth-node-js

Quick Start

import express from 'express';
import { authRouter, requireAuth, optionalAuth } from '@loop8id/auth-express';

const AUTH = {
  clientId:      process.env.L8P8_CLIENT_ID!,
  sessionSecret: process.env.SESSION_SECRET!,   // min 32 chars
  redirectUri:   'http://localhost:3000/auth/callback',
};

const app = express();

// ── Mount auth routes ──────────────────────────────────────────────────────
// GET /auth/login    → builds PKCE redirect
// GET /auth/callback → exchanges code, sets session cookie
// GET /auth/logout   → clears session, redirects to OIDC end_session
app.use(authRouter(AUTH));

// ── Protected page route ───────────────────────────────────────────────────
app.get('/dashboard', requireAuth(AUTH), (req, res) => {
  res.json({ user: req.user });
});

// ── Protected API route (401 JSON, no redirect) ────────────────────────────
app.get('/api/me', requireAuth({ ...AUTH, apiMode: true }), (req, res) => {
  res.json({ user: req.user, token: req.tokenSet?.accessToken });
});

// ── Public route with optional auth ───────────────────────────────────────
app.get('/', optionalAuth(AUTH), (req, res) => {
  res.json({ isAuthenticated: req.isAuthenticated(), user: req.user ?? null });
});

app.listen(3000);

Options

All @loop8id/auth-node-js options, plus:

| Option | Default | Description | |---|---|---| | loginPath | /auth/login | Login route path | | callbackPath | /auth/callback | Callback route path | | logoutPath | /auth/logout | Logout route path | | afterLoginPath | / | Redirect after login (if no returnTo stored) | | afterLogoutPath | (OIDC end_session) | Redirect after logout | | apiMode | false | Return 401 JSON instead of redirecting |

Request Properties

After requireAuth or optionalAuth, the following are available on req:

req.user            // UserClaims | undefined
req.tokenSet        // TokenSet | undefined
req.isAuthenticated() // boolean

TypeScript — Register .env

L8P8_CLIENT_ID=your-client-id
SESSION_SECRET=at-least-32-random-characters

License

MIT © Loop8ID