$ show sergiodxa/remix-auth-oauth2
remix-auth-oauth2 is a TypeScript library that provides an OAuth2 strategy for the Remix authentication framework (remix-auth). It implements the OAuth2 Authorization Code flow with PKCE, supporting standard endpoints, refresh tokens, token revocation, and OIDC discovery. The library is designed as a drop-in strategy for Remix apps, handling the redirect to the provider, state validation, token exchange, and invoking a user-supplied verify callback with the obtained tokens and request. It also exports error classes and the CodeChallengeMethod enum for convenience. The architecture is a single Strategy class extending remix-auth's Strategy base, backed by the arctic OAuth2 client library for protocol-level operations. The core logic lives in src/index.ts, with a small helper for redirects and a custom StateStore class that manages multiple concurrent OAuth flows by storing state and code verifiers in cookies. The StateStore is particularly well-crafted: it supports multiple simultaneous authorization attempts (e.g., multiple browser tabs) by merging cookie entries and using unique cookie names per flow, preventing race conditions. The codebase is clean, well-typed, and thoroughly tested with bun:test and MSW, covering redirect generation, state mismatch errors, token exchange, discovery, and concurrency. CI/CD is fully configured with GitHub Actions for build, typecheck, quality, tests, and npm publishing. The library is actively maintained, with recent commits, dependabot updates, and a low technical drift relative to its ecosystem.
The LLM identified 1 files worth highlighting for reuse:
StateStore is a self-contained class that manages OAuth2 state and PKCE code verifiers across multiple concurrent authentication flows. It stores multiple state-verifier pairs in a cookie, using a unique cookie name per flow (e.g., 'oauth2:<uuid>') to avoid collisions when users open multiple tabs. The class provides methods to set, check, and retrieve verifiers, serialize to a cookie string, and reconstruct from a Request. It is isolated (only depends on @mjackson/headers) and could be extracted into any web framework that needs multi-tab-safe OAuth state management, demonstrating a robust pattern for handling concurrent stateful redirects.