feat: add OAuth 2.0 PKCE authentication flow

.npmrc

@@ -0,0 +1 @@
+@cosmonexus:registry=http://localhost:4873

biome.json

@@ -6,10 +6,22 @@
 		"rules": {
 			"recommended": true
 		},
-		"includes": ["**", "!**/dist", "!**/*.bs.js", "!**/lib", "!**/__generated__"]
+		"includes": [
+			"**",
+			"!**/dist",
+			"!**/*.bs.js",
+			"!**/lib",
+			"!**/__generated__"
+		]
 	},
 	"formatter": {
 		"enabled": true,
-		"includes": ["**", "!**/dist", "!**/*.bs.js", "!**/lib", "!**/__generated__"]
+		"includes": [
+			"**",
+			"!**/dist",
+			"!**/*.bs.js",
+			"!**/lib",
+			"!**/__generated__"
+		]
 	}
 }

mock-server/index.js

@@ -22,7 +22,7 @@ const users = [
 	},
 ];
 
-let posts = [
+const posts = [
 	{
 		id: "post-1",
 		title: "Getting Started with ReScript",
@@ -87,8 +87,92 @@ const yoga = createYoga({
 	},
 });
 
-const server = createServer(yoga);
+// Store pending auth codes for the mock OAuth flow
+const pendingCodes = new Map();
+
+const server = createServer((req, res) => {
+	const url = new URL(req.url, `http://${req.headers.host}`);
+
+	// Mock OAuth authorize endpoint
+	if (url.pathname === "/oauth/authorize") {
+		const redirectUri = url.searchParams.get("redirect_uri");
+		const state = url.searchParams.get("state");
+		const code = `mock-code-${Date.now()}`;
+
+		// Store the code verifier expectation
+		pendingCodes.set(code, {
+			codeChallenge: url.searchParams.get("code_challenge"),
+			clientId: url.searchParams.get("client_id"),
+		});
+
+		// Redirect back with code and state (simulates user approving)
+		const callbackUrl = `${redirectUri}?code=${code}&state=${state}`;
+		res.writeHead(302, { Location: callbackUrl });
+		res.end();
+		return;
+	}
+
+	// Mock OAuth token endpoint
+	if (url.pathname === "/oauth/token" && req.method === "POST") {
+		let body = "";
+		req.on("data", (chunk) => {
+			body += chunk;
+		});
+		req.on("end", () => {
+			const params = new URLSearchParams(body);
+			const code = params.get("code");
+
+			if (code && pendingCodes.has(code)) {
+				pendingCodes.delete(code);
+				res.writeHead(200, {
+					"Content-Type": "application/json",
+					"Access-Control-Allow-Origin": "http://localhost:8080",
+				});
+				res.end(
+					JSON.stringify({
+						access_token: `mock-token-${Date.now()}`,
+						token_type: "Bearer",
+						expires_in: 3600,
+					}),
+				);
+			} else {
+				res.writeHead(400, {
+					"Content-Type": "application/json",
+					"Access-Control-Allow-Origin": "http://localhost:8080",
+				});
+				res.end(JSON.stringify({ error: "invalid_grant" }));
+			}
+		});
+		return;
+	}
+
+	// Mock OAuth logout endpoint
+	if (url.pathname === "/oauth/logout") {
+		const postLogoutUri =
+			url.searchParams.get("post_logout_redirect_uri") || "http://localhost:8080";
+		res.writeHead(302, { Location: postLogoutUri });
+		res.end();
+		return;
+	}
+
+	// CORS preflight for token endpoint
+	if (url.pathname === "/oauth/token" && req.method === "OPTIONS") {
+		res.writeHead(204, {
+			"Access-Control-Allow-Origin": "http://localhost:8080",
+			"Access-Control-Allow-Methods": "POST, OPTIONS",
+			"Access-Control-Allow-Headers": "Content-Type",
+		});
+		res.end();
+		return;
+	}
+
+	// Pass everything else to GraphQL yoga
+	yoga(req, res);
+});
 
 server.listen(4000, () => {
 	console.log("GraphQL server running at http://localhost:4000/graphql");
+	console.log(
+		"OAuth endpoints at http://localhost:4000/oauth/authorize and /oauth/token",
+	);
 });

mock-server/schema.graphql

@@ -1,28 +1,28 @@
 type Query {
-  posts: [Post!]!
-  post(id: ID!): Post
-  me: User
+	posts: [Post!]!
+	post(id: ID!): Post
+	me: User
 }
 
 type Mutation {
-  createPost(title: String!, body: String!): Post!
+	createPost(title: String!, body: String!): Post!
 }
 
 type User implements Node {
-  id: ID!
-  name: String!
-  email: String!
-  avatarUrl: String
+	id: ID!
+	name: String!
+	email: String!
+	avatarUrl: String
 }
 
 type Post implements Node {
-  id: ID!
-  title: String!
-  body: String!
-  createdAt: String!
-  author: User!
+	id: ID!
+	title: String!
+	body: String!
+	createdAt: String!
+	author: User!
 }
 
 interface Node {
-  id: ID!
+	id: ID!
 }