/technology/modules/ · auth-oidc Shipping
auth-oidc
OpenID Connect login. A provider arrives as data plus whatever quirk it insists on, rather than as a second copy of the flow.
What it is
auth-oidc.
The authorization code flow with PKCE, sealed into a signed cookie at /start and spent at the callback. The flow is written once against a provider descriptor, so adding a provider is a row of data and the quirk it insists on, not a fork of the flow. An unknown provider is a 404; a known one whose credentials are not configured says exactly that rather than failing obscurely.
Apple posts its callback back to you. A form_post callback is a cross-site POST, so a SameSite=Lax session cookie does not arrive on it — which means the person who was signed in at /start looks like a stranger by the time the callback runs, and the linking rules quietly make them a second account. Who was signed in is therefore carried across inside the payload we signed, having been read and validated at /start, which is same-site.
Crate
factory0-auth-oidc · in the repo, not yet on crates.io. MIT.
Ports
Database · Clock · IdGen · Signer · HttpClient
Routes
GET /v1/auth-oidc/{provider}/start?return_to=/path— builds the authorize URL with PKCE, seals the flow into a signed cookie, redirectsGET /v1/auth-oidc/{provider}/callback?code&state— the redirect callback. Google.POST /v1/auth-oidc/{provider}/callback— the form_post callback, form-encoded. Apple.
Account linking happens in auth-core, and only ever on an email both sides say they verified.