bext-plugin-oauth2

OAuth2 / OpenID Connect for GitHub, Google, and custom providers.

Adds OAuth2 and OpenID Connect login flows to your bext app. Built-in support for GitHub, Google, and any spec-compliant provider. Handles the redirect dance, token exchange, and session management.

Install

bext plugin add oauth2

Config

[plugins.oauth2]
callback_path = "/auth/callback"
session_secret = "$SESSION_SECRET"

[plugins.oauth2.providers.github] client_id = "$GITHUB_CLIENT_ID" client_secret = "$GITHUB_CLIENT_SECRET" scopes = ["user:email"]

[plugins.oauth2.providers.google] client_id = "$GOOGLE_CLIENT_ID" client_secret = "$GOOGLE_CLIENT_SECRET" scopes = ["openid", "email", "profile"] ```

Login flow

1. User visits `/auth/login/github` (or `/google`, etc.) 2. Plugin redirects to the provider's authorization URL 3. Provider redirects back to `/auth/callback` with an auth code 4. Plugin exchanges the code for tokens, fetches user info 5. Creates a session and sets a cookie 6. Redirects to `/` (or the URL stored in the `redirect` query param)

Accessing the user

In your route handlers, `ctx.auth` contains the logged-in user:

const user = ctx.auth; // { id, email, name, avatar, provider }

`ctx.auth` is `null` if the user isn't logged in.

Logout

`GET /auth/logout` destroys the session and redirects to `/`.