const authBaseUrl = 'https://auth.example.com';
const clientId = 'YOUR_CLIENT_ID';
const redirectUri = 'https://app.example.com/auth/callback';

const state = crypto.randomUUID();
const codeVerifier = crypto.randomUUID();
window.localStorage.setItem('pkce_code_verifier', codeVerifier);

async function sha256(value) {
  const bytes = new TextEncoder().encode(value);
  const digest = await crypto.subtle.digest('SHA-256', bytes);
  return btoa(String.fromCharCode(...new Uint8Array(digest)))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');
}

async function login() {
  const codeChallenge = await sha256(codeVerifier);
  const authUrl = new URL(`${authBaseUrl}/oidc/authorize`);
  authUrl.searchParams.set('response_type', 'code');
  authUrl.searchParams.set('client_id', clientId);
  authUrl.searchParams.set('redirect_uri', redirectUri);
  authUrl.searchParams.set('scope', 'openid email profile');
  authUrl.searchParams.set('state', state);
  authUrl.searchParams.set('code_challenge', codeChallenge);
  authUrl.searchParams.set('code_challenge_method', 'S256');

  window.location.href = authUrl.toString();
}

import express from 'express';
import fetch from 'node-fetch';

const app = express();
app.use(express.json());

app.post('/auth/token', async (req, res) => {
  const { code, codeVerifier, redirectUri } = req.body;

  const tokenResponse = await fetch('https://auth.example.com/oidc/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      grant_type: 'authorization_code',
      code,
      client_id: process.env.CLIENT_ID,
      client_secret: process.env.CLIENT_SECRET,
      code_verifier: codeVerifier,
      redirect_uri: redirectUri,
    }),
  });

  const tokens = await tokenResponse.json();
  return res.json(tokens);
});

app.listen(3000);

const url = new URL(window.location.href);
const code = url.searchParams.get('code');
const state = url.searchParams.get('state');
const codeVerifier = window.localStorage.getItem('pkce_code_verifier');

fetch('/auth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    code,
    codeVerifier,
    redirectUri: 'https://app.example.com/auth/callback',
  }),
})
  .then((res) => res.json())
  .then((tokens) => {
    console.log('Tokens Captured Successfully', tokens);
  });

NEXTAUTH_URL=https://app.example.com
AUTH_URL=https://auth.example.com
PRABISHA_CLIENT_ID=your-client-id
PRABISHA_CLIENT_SECRET=your-client-secret

import NextAuth from 'next-auth';
import Providers from 'next-auth/providers';

export default NextAuth({
  providers: [
    Providers.OpenIDConnect({
      id: 'prabisha',
      name: 'Prabisha Auth',
      issuer: process.env.AUTH_URL,
      clientId: process.env.PRABISHA_CLIENT_ID,
      clientSecret: process.env.PRABISHA_CLIENT_SECRET,
      wellKnown: `${process.env.AUTH_URL}/oidc/.well-known/openid-configuration`,
      authorization: {
        params: {
          scope: 'openid email profile',
          response_type: 'code',
        },
      },
      profile(profile) {
        return {
          id: profile.sub,
          name: profile.name,
          email: profile.email,
        };
      },
    }),
  ],
  session: {
    strategy: 'jwt',
  },
});

import { Controller, Get, Query } from '@nestjs/common';
import { Issuer, generators } from 'openid-client';

@Controller('auth')
export class ExternalAuthController {
  private client: any;
  private codeVerifier: string;

  constructor() {
    this.initializeClient();
  }

  private async initializeClient() {
    const issuer = await Issuer.discover('https://auth.example.com/oidc/.well-known/openid-configuration');
    this.client = new issuer.Client({
      client_id: process.env.PRABISHA_CLIENT_ID,
      client_secret: process.env.PRABISHA_CLIENT_SECRET,
      redirect_uris: [process.env.PRABISHA_REDIRECT_URI],
      response_types: ['code'],
    });
  }

  @Get('login')
  async login() {
    this.codeVerifier = generators.codeVerifier();
    const codeChallenge = generators.codeChallenge(this.codeVerifier);

    const url = this.client.authorizationUrl({
      scope: 'openid email profile',
      response_type: 'code',
      code_challenge: codeChallenge,
      code_challenge_method: 'S256',
      state: generators.state(),
    });

    return { url };
  }

  @Get('callback')
  async callback(@Query('code') code: string, @Query('state') state: string) {
    const tokenSet = await this.client.callback(process.env.PRABISHA_REDIRECT_URI, { code, state }, { code_verifier: this.codeVerifier });
    return tokenSet;
  }
}