Shared sign-in

Introduction

@pilotoo/web-auth is the NestJS package behind the login of the standalone services. It implements Google OpenID Connect with PKCE, signed session cookies, an identity guard and the user tables. Pilotoo Connect and the Brain service both use it, each with its own options.

Usage

src/app.module.ts

import { webAuthControllers, webAuthProviders } from '@pilotoo/web-auth';

@Module({
  controllers: [...webAuthControllers],
  providers: [{ provide: POOL, useValue: pool }, ...webAuthProviders(options, { token: POOL, pool: (value: Pool) => value })],
})
export class AppModule {}

webAuthProviders provides the options, the user repository, the OIDC client and a global IdentityGuard. webAuthControllers serves GET /auth/google/start, GET /auth/google/callback and POST /auth/logout. Mark a route @Anonymous() to let it through without a session. Create the tables once at boot with createWebAuthTables(client, tables).

The package validates its options up front: table names must be plain lower-case identifiers, cookie names valid and different from each other, and the token prefix not empty.

Options

Option	Meaning
product	Namespaces the advisory locks, so two products on one database never wait on each other.
cookies	{session, login} cookie names. They must differ.
tokenPrefix	Prefix of the personal tokens web-auth issues.
tables	{users, identities, tokens}, schema-qualified (schema.table) or bare.
publicUrl	Public origin; the redirect URI is ${publicUrl}/auth/google/callback.
secureCookies	true for https.
sessionSecret	Signs the cookies.
oidc	{issuer, clientId, clientSecret}; GOOGLE_ISSUER is exported.
allowedEmails	A set of emails, or null to admit every verified account. An empty set admits nobody.
adminEmails	Emails that are administrators.
tenant	Tenant recorded for the signed-in user.
roles, adminRoles	Roles given to members and to administrators.

What each service configures

	Connect	Brain
product	connect	brain
Cookies	connect_session, connect_login	brain_session, brain_login
tokenPrefix	pc_	pbu_
Tables	pilotoo_app.connect_users, connect_identities, connect_tokens	pilotoo_brain.auth_users, auth_identities, auth_tokens

Brain’s agents use its own pb_ tokens, which Brain’s guard checks before web-auth sees the request; the pbu_ personal tokens of web-auth are not issued by Brain.

Tip

Two services can share one Google OAuth client: add each service’s /auth/google/callback URL as an authorised redirect URI.

Next steps

• Run the standalone service for the settings that feed these options.