datenba-ch/matrix-social-invites

Fork 0

Add Redis-backed Matrix OIDC auth backend and update AuthContext #1

Open

florianbeisel wants to merge 3 commits from codex/create-backend-auth-module-with-oidc into main

florianbeisel commented

2026-01-26 09:59:58 +01:00

(Migrated from github.com)

Motivation

Implement a real backend authentication flow using Matrix OIDC with server-side sessions instead of the frontend mock and localStorage storage.
Persist session state in Redis and protect session identifiers with a signed, httpOnly cookie so the frontend can rely on a secure server session.
Expose endpoints the frontend can call to start OIDC login, receive the callback, refresh tokens, fetch the current user, and logout.

Description

Add server/auth.ts which implements OIDC discovery or explicit endpoints, PKCE state generation, token exchange, userinfo fetching, and session persistence in Redis under keys session:<id> with a ff_session signed httpOnly cookie and a 7-day TTL.
Add server/index.ts which mounts an Express app with cookie-parser (signed via SESSION_COOKIE_SECRET) and routes POST /api/auth/login, GET /api/auth/callback, POST /api/auth/refresh, POST /api/auth/logout, and GET /api/me wired to the handlers in server/auth.ts.
Update src/contexts/AuthContext.tsx to remove the local mock/localStorage flow and instead call GET /api/me on mount, POST /api/auth/login to start the OIDC flow, and POST /api/auth/logout to clear the server session; add a fetchJson helper using credentials: 'include' so cookies are sent.
Update package.json to include backend runtime dependencies (express, cookie-parser, nanoid, redis) and type dev-dependencies for the new packages.

Testing

Attempted to install dependencies with npm install, but the run failed due to a 403 Forbidden error fetching @types/cookie-parser from the registry, so installation and runtime tests were not completed.
No automated unit or integration tests were added or executed in this change set due to the blocked dependency installation.
The new files were lint/compiled locally in this environment only to the extent of creating and saving them, but full verification requires a successful dependency installation and running the auth server.

Codex Task

### Motivation - Implement a real backend authentication flow using Matrix OIDC with server-side sessions instead of the frontend mock and localStorage storage. - Persist session state in Redis and protect session identifiers with a signed, `httpOnly` cookie so the frontend can rely on a secure server session. - Expose endpoints the frontend can call to start OIDC login, receive the callback, refresh tokens, fetch the current user, and logout. ### Description - Add `server/auth.ts` which implements OIDC discovery or explicit endpoints, PKCE state generation, token exchange, `userinfo` fetching, and session persistence in Redis under keys `session:<id>` with a `ff_session` signed `httpOnly` cookie and a 7-day TTL. - Add `server/index.ts` which mounts an Express app with `cookie-parser` (signed via `SESSION_COOKIE_SECRET`) and routes `POST /api/auth/login`, `GET /api/auth/callback`, `POST /api/auth/refresh`, `POST /api/auth/logout`, and `GET /api/me` wired to the handlers in `server/auth.ts`. - Update `src/contexts/AuthContext.tsx` to remove the local mock/localStorage flow and instead call `GET /api/me` on mount, `POST /api/auth/login` to start the OIDC flow, and `POST /api/auth/logout` to clear the server session; add a `fetchJson` helper using `credentials: 'include'` so cookies are sent. - Update `package.json` to include backend runtime dependencies (`express`, `cookie-parser`, `nanoid`, `redis`) and type dev-dependencies for the new packages. ### Testing - Attempted to install dependencies with `npm install`, but the run failed due to a `403 Forbidden` error fetching `@types/cookie-parser` from the registry, so installation and runtime tests were not completed. - No automated unit or integration tests were added or executed in this change set due to the blocked dependency installation. - The new files were lint/compiled locally in this environment only to the extent of creating and saving them, but full verification requires a successful dependency installation and running the auth server. ------ [Codex Task](https://chatgpt.com/codex/tasks/task_e_697726e63eb0832a85c2d21d3b4bdbb6)

chatgpt-codex-connector[bot] commented

2026-01-26 10:00:05 +01:00

(Migrated from github.com)

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

You have reached your Codex usage limits for code reviews. You can see your limits in the [Codex usage dashboard](https://chatgpt.com/codex/settings/usage). To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your [settings](https://chatgpt.com/codex/settings/code-review).

changeset-bot[bot] commented

2026-01-28 13:18:58 +01:00

(Migrated from github.com)

⚠️ No Changeset found

Latest commit: db07b8dcda

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

### ⚠️ No Changeset found Latest commit: db07b8dcda0c386897a1695265f16f5b4b8428b1 Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. **If these changes should result in a version bump, you need to add a changeset.** [Click here to learn what changesets are, and how to add one](https://github.com/changesets/changesets/blob/main/docs/adding-a-changeset.md). [Click here if you're a maintainer who wants to add a changeset to this PR](https://github.com/florianbeisel/forest-friend-invites/new/codex/create-backend-auth-module-with-oidc?filename=.changeset/pretty-plants-collect.md&value=---%0A%22%40fake-scope%2Ffake-pkg%22%3A%20patch%0A---%0A%0AAdd%20Redis-backed%20Matrix%20OIDC%20auth%20backend%20and%20update%20AuthContext%0A)

This pull request has changes conflicting with the target branch.

package.json
server/auth.ts
server/index.ts

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'Add Redis-backed Matrix OIDC auth backend and update AuthContext' (#1) from codex/create-backend-auth-module-with-oidc into main

Merge commit body

Reviewed-on: https://git.services.beisel.it/datenba-ch/matrix-social-invites/pulls/1

Merge pull request 'Add Redis-backed Matrix OIDC auth backend and update AuthContext' (#1) from codex/create-backend-auth-module-with-oidc into main

Reviewed-on: https://git.services.beisel.it/datenba-ch/matrix-social-invites/pulls/1

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin codex/create-backend-auth-module-with-oidc:codex/create-backend-auth-module-with-oidc

git switch codex/create-backend-auth-module-with-oidc

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff codex/create-backend-auth-module-with-oidc

git switch codex/create-backend-auth-module-with-oidc

git rebase main

git switch main

git merge --ff-only codex/create-backend-auth-module-with-oidc

git switch codex/create-backend-auth-module-with-oidc

git rebase main

git switch main

git merge --no-ff codex/create-backend-auth-module-with-oidc

git switch main

git merge --squash codex/create-backend-auth-module-with-oidc