$ show manfredsteyer/angular-oauth2-oidc
angular-oauth2-oidc is an Angular client library for OAuth 2.0 and OpenID Connect authentication in browser SPAs. Its core is OAuthService, a large stateful injectable that loads OIDC discovery documents, drives login via implicit flow, code flow + PKCE, or password flow, stores tokens through a pluggable OAuthStorage (default sessionStorage, with MemoryStorage fallback), validates tokens through pluggable ValidationHandler implementations, runs silent refresh/session checks via hidden iframes, and emits a typed event stream (OAuthEvent hierarchy) for lifecycle notifications. DefaultOAuthInterceptor attaches bearer tokens to outgoing HTTP calls against configured allowed URLs; UrlHelperService extracts tokens from redirect URLs for both hash and query strategies.
The LLM identified 5 files worth highlighting for reuse:
A complete SHA-256, HMAC-SHA256, HKDF, and PBKDF2 implementation inlined from fast-sha256-js with zero internal imports. It lets the library compute PKCE code-challenge hashes without depending on Web Crypto API (unavailable in some SSR/worker contexts) or a runtime crypto package the Angular optimizer might mangle. Fully self-contained: an engineer could drop it into any JS/TS project needing synchronous hashing with no modification.
A typed event hierarchy (OAuthEvent base; OAuthSuccessEvent, OAuthInfoEvent, and OAuthErrorEvent subclasses) modeling the OAuth lifecycle: token received, silent refresh completed, session terminated, discovery failures. Demonstrates a clean typed-event pattern with type discrimination, isolated from the rest of the library, and easily extracted into any event-centric system.
WebHttpUrlEncodingCodec overrides Angular's HttpUrlEncodingCodec to encode characters ($, &, +, comma, /, :, ;, =, ?, @) that Angular's default codec deliberately leaves unencoded. This is a subtle interop fix: without it, password-flow credentials containing special characters get silently corrupted when Angular encodes the request body. Small, dependency-free, and directly reusable in any Angular app posting form-encoded data.
Parses the post-redirect URL to recover OAuth tokens and state from both the query string (code flow) and the hash fragment (implicit flow), handling array-style and nested parameters. It is what makes hash-strategy routing and popup login work, and it ships with a dedicated spec file. Although it injects the internal OAuthLogger, the parsing logic itself is an isolated, battle-tested utility for any SPA that must salvage tokens from a redirect URL.
The real JWKS signature validator, released as a separate npm package so tree-shaking can drop it from the main bundle. It fetches the issuer's JWKS via HttpClient, resolves the signing key matching the token's kid, validates RS*/PS* signatures with jsrsasign, enforces expiry with leeway, and caches keys. It is both a clean implementation of the ValidationHandler strategy abstraction and a working example of a cross-package migration pattern: the main library ships a stub that logs a pointer to this package.