auth-server

An OAuth 2.0 authorization server in Node.js, Express and TypeScript, with MongoDB for storage and a small React client for the consent screen.

Published by LANGA Corporation S.r.l. under the MIT licence.

Read this first

This is archived work, not a maintained product. It was written in 2021, it never went into production at LANGA, and it has not been updated since. We are publishing it because the code is clean and worth reading, not because we suggest deploying it.

Before anyone considers using it:

• Dependencies are from 2021 and have not been audited since.
• It targets Node 14 and an older Express/Mongoose generation.
• There is no test suite.
• It was written for a single-dyno Heroku-style deployment.

What it does

• Registration and login with hashed credentials
• Access and refresh token issuing and rotation
• Authorization-code flow with a consent screen
• Password reset over SMTP
• Route protection middleware

Layout

src/controllers/   registration, login, token endpoints
src/services/      token signing and verification
src/models/        Mongoose schemas
src/middlewares/   auth guards
client/            React consent screen

Running it

npm install
cp .env-example .env    # fill in your own values
npm run dev

.env-example lists every variable the server expects, with empty values.

Why there is no commit history

The original 2021 repository contained credentials committed during development: a database URI, SMTP credentials, an email provider API key and the token signing secrets. Rather than rewrite that history, we published the final state of the code as a single commit. Nothing was removed from the code itself, only the secrets and one internal hostname.

Author attribution is preserved in CONTRIBUTORS.md.

Licence

MIT — see LICENSE. Copyright LANGA Corporation S.r.l.