/technology/modules/ · auth-meta Shipping
auth-meta
Facebook Login. Its own crate, because Meta is not an OpenID Connect provider however much it looks like one.
What it is
auth-meta.
The authorization code flow with PKCE, sealed into a signed cookie at /start and spent at the callback, then the linking rules and a session — the same shape auth-oidc uses for Google and Apple.
It is a separate crate because Meta is not an OpenID Connect provider. No discovery document, no ID token, no nonce: what comes back from the authorization code is a plain OAuth 2.0 access token, and who the person is comes from a Graph call made with it. Folding that into the OIDC flow would mean a provider descriptor with a hole in the middle of it, and every reader of that flow would have to know which providers fall through the hole. ADR 0204 records it.
Crate
factory0-auth-meta · in the repo, not yet on crates.io. MIT.
Ports
Database · Clock · IdGen · Signer · HttpClient
Routes
GET /v1/auth-meta/start?return_to=/path— builds the authorize URL with PKCE, seals the flow, redirectsGET /v1/auth-meta/callback?code&state— verifies the flow, exchanges the code, fetches the profile, issues a sessionPOST /v1/auth-meta/data-deletion— Meta's callback. Meta will not approve an app for public use without one. It answers synchronously with a status URL and a confirmation code, and records the work as a jobGET /v1/auth-meta/deletion-status?code=…— the page that answer points at
Rate limited
Every route here is reachable by anyone, and it is /callback that makes this service talk to Meta — the token exchange and the profile call both happen there. Limited wherever a limiter exists.
A Meta sign-in never links itself to an existing account, and that is the module's central decision rather than a gap. auth-core auto-links on a verified email, so a verified address is a key — and Meta does not assert verification in a form this service can rely on. Believing it would let anyone who can get an address onto a Facebook account walk into the matching account here, so this module reports the address as unverified, always.