yauoi-auth-client

Framework-agnostic TypeScript client for a PKCE authorization-code SSO flow against a central login app and its backend. Implements the browser-side PKCE, state handling, and token exchange logic once so consuming apps don't each re-implement it.

firebase is a peer dependency — you pass in your app's own Auth instance so each app gets its own independent session.

Install

bun add yauoi-auth-client firebase

Usage

import { getAuth } from 'firebase/auth';
import { createSsoClient } from 'yauoi-auth-client';

export const sso = createSsoClient({
  auth: getAuth(firebaseApp),
  clientId: 'my-app',
  redirectUri: 'https://app.example.com/auth/callback',
  loginAppUrl: 'https://login.example.com',
  apiBaseUrl: 'https://api.example.com',
});

clientId and redirectUri must be registered in the backend's client allowlist for the exchange to succeed.

Start login (e.g. a "Sign in" button)

await sso.login(); // generates state + PKCE, redirects to the central login

Complete login (on your redirectUri callback route)

if (sso.isCallback()) {
  const user = await sso.handleCallback(); // verifies state, exchanges code, signInWithCustomToken
}

Logout (this app only) & profile

await sso.logout({ redirectTo: '/' }); // local signOut only — central session stays
const profile = await sso.getProfile(); // GET {apiBaseUrl}/users/me

API

| Method | Purpose | |---|---| | login(opts?) | Store PKCE/state, redirect to ${loginAppUrl}/authorize | | isCallback() | True if the current URL carries ?code=&state= | | handleCallback() | Verify state, exchange code for a token, signInWithCustomToken → returns the Firebase User | | logout(opts?) | signOut(auth) on this origin only (central session untouched) | | getProfile() | Fetch the current user's profile from the backend |

Errors are thrown as SsoError with a code (no_callback, state_mismatch, token_exchange_failed, not_authenticated).

Build

bun install
bun run build      # tsc → dist/ (JS + .d.ts)
bun run typecheck