@yescure/auth-core

Framework-agnostic OIDC client for the YesCure identity provider. Use this directly if you're integrating from a framework that doesn't have a dedicated adapter yet — otherwise prefer @yescure/auth-node (Express/Fastify) or @yescure/auth-nextjs (Next.js).

Install

npm install @yescure/auth-core

Use

import { YescureClient } from "@yescure/auth-core";

const client = new YescureClient({
  issuer:       process.env.OIDC_ISSUER!,        // https://api.yescureapp.com
  clientId:     process.env.OIDC_CLIENT_ID!,
  clientSecret: process.env.OIDC_CLIENT_SECRET,  // omit for public/PKCE clients
  redirectUri:  process.env.OIDC_REDIRECT_URI!,
  sessionSecret: process.env.SESSION_SECRET!,    // openssl rand -hex 32
});

// 1. Start login
const { url, state, nonce, codeVerifier } = await client.createAuthorizationUrl();
// → persist {state, nonce, codeVerifier} in a signed cookie, redirect user to `url`

// 2. Handle callback
const { tokens, claims } = await client.handleCallback({
  code, state,                  // from the query string
  expectedState, expectedNonce, // from the cookie you persisted
  codeVerifier,                 // from the cookie you persisted
});
// claims.sub is the immutable YesCure user id — use it as your DB foreign key

// 3. Sign your own session cookie
const sessions = client.createSessionManager<{ sub: string; email?: string }>();
const cookie = sessions.encode({ sub: claims.sub, email: claims.email });
// → Set-Cookie: yescure_session=${cookie.value}; HttpOnly; Secure; Max-Age=${cookie.maxAge}

// 4. Read it back on subsequent requests
const session = sessions.decode(req.headers.cookie);

That's the entire flow. Everything else — PKCE, state, nonce, JWT verification, /userinfo, refresh-token rotation, backchannel-logout token verification — is handled inside the client.

What it does for you

• OIDC discovery with a 5-minute in-memory cache
• PKCE (S256) code verifier / challenge generation
• state and nonce generation
• Authorization-code exchange with optional client_secret
• ID-token verification (RS256, JWKS, iss, aud, nonce)
• /userinfo merging
• Refresh-token and revocation calls
• HMAC-SHA256 signed cookie sign/verify with timing-safe comparison
• Constant-time backchannel-logout token comparison

Related packages

• @yescure/auth-node — Express/Fastify adapter, three lines of wiring
• @yescure/auth-nextjs — Next.js App Router adapter