Enhance authentication strategies with improved type safety and additional options #387

sergiodxa · 2025-10-09T22:24:17Z

Improve type safety in authentication strategies, allowing for more flexible and secure user verification.

Also adds support for extra authenticate options defined by strategies.

This PR refactors the authentication system to provide better type safety and a more intuitive API:

Replaces the generic User type with a more accurate SessionData type
Introduces a new constructor pattern that accepts a record of strategies
Adds support for passing extra parameters to strategy authenticate methods
Provides type inference utilities via Authenticator.infer<typeof authenticator>
Renames verify to callback for clarity and consistency
Updates documentation with modern TypeScript patterns and examples
Removes the need to manually define session data types

…support to extra authenticate options

Copilot

Pull Request Overview

This PR enhances authentication strategies with improved type safety and additional options, making the authentication system more flexible and secure. The changes introduce a more strongly-typed approach to strategy configuration and callback handling.

Refactored Strategy class to use CallbackFunction instead of VerifyFunction with better parameter naming
Redesigned Authenticator to accept a record of strategies at construction time with improved type inference
Added support for strategies that accept additional authenticate method parameters

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/strategy.ts	Updated Strategy class with improved generics, callback function terminology, and support for extra authenticate parameters
src/strategy.test.ts	Removed existing test file (complete deletion)
src/index.ts	Completely refactored Authenticator class with constructor-based strategy registration and enhanced type safety
src/index.test.ts	Added new comprehensive tests demonstrating the enhanced API with form and login strategies
README.md	Updated documentation to reflect the new API design and improved examples

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

src/index.ts

Copilot

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot

Pull Request Overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/strategies/oauth2.ts

src/strategies/oauth2.test.ts

Co-authored-by: Copilot <[email protected]>

…rity

Copilot

Pull Request Overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 10 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-12T06:59:53Z

src/lib/state-store.ts

+	set(state: string, verifier?: string) {
+		this.state = state;
+		this.codeVerifier = verifier;
+
+		this.states.add(state);
+		if (verifier) this.codeVerifiers.set(state, verifier);
+	}


Potential race condition: The StateStore class uses instance properties state and codeVerifier that are set in the set() method and read in the toString() method. If multiple calls to set() happen before toString() is called, only the last set values will be serialized. This could be problematic in concurrent scenarios where multiple authentication flows are happening simultaneously.

However, looking at the usage in OAuth2Strategy, this appears to be intentional - each OAuth2 flow creates its own StateStore instance, and the instance properties track the "current" state being set. The class also maintains Sets and Maps for all states/verifiers. Consider adding documentation to clarify this design.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-11-12T06:59:53Z

src/lib/state-store.ts

+	toSetCookie(
+		cookieName = "oauth2",
+		options: Omit<SetCookieInit, "value"> = {},
+	) {
+		let id = crypto.randomUUID();
+		return new SetCookie({
+			value: this.toString(),
+			httpOnly: true, // Prevents JavaScript from accessing the cookie
+			maxAge: 60 * 5, // 5 minutes
+			path: "/", // Allow the cookie to be sent to any path
+			sameSite: "Lax", // Prevents it from being sent in cross-site requests
+			...options,
+			name: `${cookieName}:${id}`,
+		});


The toSetCookie method generates a random UUID but never uses it for anything meaningful. The variable id is generated on line 84 but only used to construct the cookie name. However, this creates a unique cookie name every time toSetCookie is called, which means:

Every call creates a new cookie with a different name

Old cookies are never cleaned up

The cookie name pattern ${cookieName}:${id} is used for retrieval in fromRequest, but since a new UUID is generated each time, there's potential for cookie accumulation

Consider documenting this behavior or revising the approach to cookie naming.

src/strategies/oauth2.ts

src/index.ts

README.md

src/strategies/oauth2.ts

Copilot · 2025-11-12T06:59:54Z

src/lib/state-store.ts

+	codeVerifier: string | undefined;
+
+	constructor(params = new URLSearchParams()) {
+		for (let [state, verifier] of params) {


The logic for skipping the "state" parameter in the constructor is unclear and potentially buggy. The code iterates over URLSearchParams entries and skips when state === "state", but this compares the key (first element of the tuple) with the string "state". This means if there's a parameter with key "state", it will be skipped. However, looking at the toString() method, it adds both params.set("state", this.state) and params.set(this.state, this.codeVerifier), so the "state" key is used as metadata. The skip logic should be documented or clarified with a comment explaining why "state" key entries are skipped.

Suggested change

for (let [state, verifier] of params) {

for (let [state, verifier] of params) {

// The "state" key is used to store the current state value as metadata.

// We skip it here to avoid treating it as a state-codeVerifier pair.

src/strategies/oauth2.ts

README.md

Copilot · 2025-11-12T08:45:30Z

@sergiodxa I've opened a new pull request, #401, to work on those changes. Once the pull request is ready, I'll request review from you.

…n safety (#401)

Enhance authentication strategies with improved type safety, and add …

41d7971

…support to extra authenticate options

sergiodxa requested a review from Copilot October 9, 2025 22:24

sergiodxa self-assigned this Oct 9, 2025

Copilot AI reviewed Oct 9, 2025

View reviewed changes

src/index.ts Outdated Show resolved Hide resolved

sergiodxa added 5 commits October 9, 2025 17:25

Remove unnecessary error handling for unknown strategies

ae5816e

Merge branch 'main' into type-safety

5e9d736

Improve code formatting and consistency in Authenticator class

10912fa

Merge branch 'main' into type-safety

b3f73fa

Merge branch 'main' into type-safety

6fa2421

sergiodxa requested a review from Copilot October 10, 2025 04:28

Copilot AI reviewed Oct 10, 2025

View reviewed changes

sergiodxa added 5 commits November 12, 2025 01:43

Merge branch 'main' into type-safety

51fe1b8

Update dependencies

59f619f

Implement OAuth2 strategy with state management and redirect handling

ab9ab0d

Add FormStrategy for form-based authentication

c4831aa

Add exports for oauth2 and form strategies

186f404

sergiodxa requested a review from Copilot November 12, 2025 06:46

Copilot started reviewing on behalf of sergiodxa November 12, 2025 06:46 View session

Copilot finished reviewing on behalf of sergiodxa November 12, 2025 06:48

Copilot AI reviewed Nov 12, 2025

View reviewed changes

src/strategies/oauth2.ts Outdated Show resolved Hide resolved

src/strategies/oauth2.ts Show resolved Hide resolved

src/strategies/oauth2.ts Outdated Show resolved Hide resolved

src/strategies/oauth2.test.ts Outdated Show resolved Hide resolved

sergiodxa and others added 2 commits November 12, 2025 01:51

Fix typo

297c56f

Co-authored-by: Copilot <[email protected]>

Correct error type in authentication test and update comments for cla…

acd1e7e

…rity

sergiodxa requested a review from Copilot November 12, 2025 06:54

Copilot started reviewing on behalf of sergiodxa November 12, 2025 06:54 View session

Copilot finished reviewing on behalf of sergiodxa November 12, 2025 06:58

Copilot AI reviewed Nov 12, 2025

View reviewed changes

Copilot AI mentioned this pull request Nov 12, 2025

Document StateStore instance property design to clarify race condition safety #401

Merged

Document StateStore instance property design to clarify race conditio…

33410b4

…n safety (#401)

Uh oh!

Enhance authentication strategies with improved type safety and additional options #387

Are you sure you want to change the base?

Enhance authentication strategies with improved type safety and additional options #387

Uh oh!

Conversation

sergiodxa commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

sergiodxa Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Nov 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sergiodxa commented Oct 9, 2025 •

edited

Loading