Dhanvantari User/Admin API Request Dashboard

React + Node.js based dashboard with built-in OAuth 2.0 / OpenID Connect support.

Main Highlights

• Separate Admin and User flows
• Local auth + optional OAuth login integration
• Built-in OIDC Authorization Server (Auth Code + PKCE)
• Redesigned OAuth pages:
  • Login UI (/oauth/login)
  • Consent UI (/oauth/consent)
• Strong security baseline (rate limits, CSRF/origin checks, signed cookies, audit logs)
• Postgres-first storage with optional local file mode for dev

Key OAuth/OIDC Endpoints

• GET /.well-known/openid-configuration
• GET /oauth/jwks
• GET /oauth/login / POST /oauth/login
• GET /oauth/consent / POST /oauth/consent
• POST /oauth/par
• GET /oauth/authorize
• POST /oauth/token
• GET /oauth/userinfo
• POST /oauth/revoke
• POST /oauth/introspect
• GET /oauth/logout

Quick Start

Install Anywhere In One Command

npx @cyrusdemon/doauth my-oauth --start

This scaffolds the full project, runs guided setup, installs dependencies, starts backend + frontend on free ports, and opens Super Admin panel.

One-command OAuth Setup (Recommended)

npm run setup:oauth

What this wizard does:

• checks required tools and asks Y/N before installing missing ones
• auto-selects free ports for backend/client
• accepts DB URL, Redis URL, and multiple OAuth redirect URLs
• applies secure OAuth defaults and starts the stack
• can auto-open Super Admin panel (/admin-login)

Server

cd server
cp .env.example .env
npm install
npm run dev

Client

cd client
npm install
npm run dev

Backend runs at http://localhost:4000 and frontend at http://localhost:5173.

Notes

• OAuth UI templates are currently defined in:
  • server/src/index.js (/oauth/login route HTML)
  • server/src/index.js (renderConsentPage function)
• Encryption key material is stored in .runtime/app-encryption.keys via APP_ENCRYPTION_KEYS_FILE

Full clean recreate:

RESET_OAUTH_STACK=true ./start

Stop local stack:

./stop
# or
./scripts/stop-local-oauth-stack.sh

Production notes

• Change default seeded admin credentials immediately.
• Keep ALLOW_DEMO_LOGIN=false in production.
• Keep STRICT_SESSION_BINDING=true.
• Keep REQUIRE_ADMIN_MFA=true.
• Set OIDC_ISSUER to your public HTTPS backend URL.
• In production, keep OIDC_DYNAMIC_CLIENT_REGISTRATION_ENABLED=false unless explicitly required.
• For HSM/KMS signing integration, switch to OIDC_SIGNER_MODE=remote and wire signer/JWKS envs.
• For PostgreSQL mode, run npm run db:migrate during deployment and before app startup.
• If migrating from file DB, run npm run db:import-file once after migrations (DB_IMPORT_SOURCE can override source path).
• Keep AADHAAR_OTP_PROVIDER=abdm in production and disable mock OTP response.
• Configure ABDM_CLIENT_ID, ABDM_CLIENT_SECRET, and ABDM endpoints in server/.env.
• If using Sandbox provider, set AADHAAR_OTP_PROVIDER=sandbox and configure:
  • SANDBOX_API_KEY, SANDBOX_API_SECRET
  • SANDBOX_AADHAAR_GENERATE_OTP_PATH (default: /kyc/aadhaar/okyc/otp)
  • SANDBOX_AADHAAR_VERIFY_OTP_PATH (default: /kyc/aadhaar/okyc/otp/verify)
• Keep NODE_ENV=production behind HTTPS only.
• Rotate secrets and monitor security event logs.