Citra

bun install citra

import { createOAuth2Client } from 'citra';

const googleClient = await createOAuth2Client('google', {
  clientId: 'YOUR_CLIENT_ID',
  clientSecret: 'YOUR_CLIENT_SECRET',
  redirectUri: 'https://yourapp.com/auth/callback'
});

const currentState = generateState();
const codeVerifier = generateCodeVerifier();
const authUrl = await googleClient.createAuthorizationUrl({
	codeVerifier,
	scope: ['profile', 'openid'],
	searchParams: [
		['access_type', 'offline'],
		['prompt', 'consent']
	],
	state: currentState
});

// Store state and PKCE verifier in HttpOnly cookies
const headers = new Headers();
headers.set('Location', authUrl.toString());
headers.append(
	'Set-Cookie',
	`oauth_state=${currentState}; HttpOnly; Path=/; Secure; SameSite=Lax`
);
headers.append(
	'Set-Cookie',
	`pkce_code_verifier=${codeVerifier}; HttpOnly; Path=/; Secure; SameSite=Lax`
);

// Parse callback URL parameters
const request = new Request('https://yourapp.com/auth/callback');
const params = new URL(request.url).searchParams;
const code = params.get('code');
const callback_state = params.get('state');

// Retrieve stored state and code verifier from cookies
const cookieHeader = request.headers.get('cookie') ?? '';
const cookies = cookieHeader.trim()
  ? Object.fromEntries(
      cookieHeader
        .split('; ')
        .filter(c => c.includes('='))
        .map(c => c.split('='))
    )
  : {};

const stored_state = cookies['oauth_state'];
const codeVerifier = cookies['pkce_code_verifier'];

// Validate required cookies are present
if (!stored_state) {
  throw new Error('Missing oauth_state cookie');
}
if (!codeVerifier) {
  throw new Error('Missing pkce_code_verifier cookie');
}

// Validate state to prevent CSRF attacks
if (!callback_state || callback_state !== stored_state) {
  throw new Error('Invalid state mismatch');
}

// Validate code is present
if (!code) {
  throw new Error('Authorization code not found');
}

// Exchange authorization code for tokens
const tokenResponse = await googleClient.validateAuthorizationCode({
  code,
  codeVerifier
});

// Get the access token from server session
const session = await getSession(request);
const accessToken = session.accessToken;

const profile = await googleClient.fetchUserProfile(accessToken);
console.log(profile);

// Get the refresh token from server session
const session = await getSession(request);
const refreshToken = session.refreshToken;

if (refreshToken) {
  const newTokens = await googleClient.refreshAccessToken(refreshToken);
}

// Get the access token from server session
const session = await getSession(request);
const accessToken = session.accessToken;

if (isRevocableProviderOption('google')) {
  await googleClient.revokeToken(accessToken);
}

import { createOIDCClient } from 'citra';

// Discovery-driven: only the issuer + client credentials. The authorize, token,
// userinfo, and JWKS endpoints are resolved at runtime from
// {issuer}/.well-known/openid-configuration. Works with any compliant IdP.
const client = await createOIDCClient({
  issuer: 'https://acme.okta.com',
  clientId: 'YOUR_CLIENT_ID',
  clientSecret: 'YOUR_CLIENT_SECRET',
  redirectUri: 'https://yourapp.com/auth/callback'
});

const { url, state, codeVerifier, nonce } = await client.createAuthorizationUrl({
  scope: ['openid', 'email', 'profile']
});
// …redirect, then on callback:
const tokens = await client.validateAuthorizationCode({ code, codeVerifier });
const profile = await client.fetchUserProfile(tokens.access_token);

import { verifyIdToken } from 'citra';

// In-house JWKS verification (RS256 / ES256) via WebCrypto — no 'jose' dependency.
// Checks the signature against the issuer's JWKS plus iss / aud / exp (+skew) /
// nonce / sub. Network-free if you pass a cached JWKS.
const claims = await verifyIdToken(tokens.id_token, {
  issuer: 'https://acme.okta.com',
  audience: 'YOUR_CLIENT_ID',
  nonce
});

console.log(claims.sub, claims.email);