node-oauth / node-oauth2-server

🚀 The successor to oauthjs/oauth2-server. 🔒 Complete, compliant, maintained and well tested OAuth2 Server for node.js. Includes native async await and PKCE.
https://www.npmjs.com/package/@node-oauth/oauth2-server
MIT License
309 stars 45 forks source link

State of this project? #182

Closed shrihari-prakash closed 1 year ago

shrihari-prakash commented 1 year ago

Since past 6 months, I had been using oauthjs/node-oauth2-server to extend create my own user management framework called Liquid on top of it.

However, it was only yesterday that I noticed that the project hasn't gotten updates for quite some time now. It's pretty bad to find the README say that the project is back under active maintenance and the conversations in issues say the opposite.

I know this project is still starting from zero from a visibility point of view, but should I use this in my project? Or do you intend to discontinue support for this project sometime? If you do not wish to continue support, do you know any closest alternatives?

jankapunkt commented 1 year ago

Hi @shrihari-prakash we are still active on this one, however we got a pretty stable state right now so further development slowed down a bit. If there is an urgent issue or bug feel free to report and don't hesitate to open a PR if appropriate.

shrihari-prakash commented 1 year ago

Thanks for confirming @jankapunkt . Is there a counterpart for https://github.com/oauthjs/express-oauth-server available in this fork yet?

shrihari-prakash commented 1 year ago

@jankapunkt found this fork that uses the new oauth2-server: https://github.com/node-oauth/express-oauth-server, but I've not been able to find it on npm. Am I missing something?

jankapunkt commented 1 year ago

Might not be published since we haven't reviewed it. I can try to update and publish an rc which you could review. What do you think?

shrihari-prakash commented 1 year ago

Sounds perfect :) Would be available for any help to improve this eco system. @jankapunkt

shrihari-prakash commented 1 year ago

@jankapunkt , I know ETAs are irritating. I'm not going to ask that. But would this be worked upon in the near future?

jankapunkt commented 1 year ago

@shrihari-prakash I can't say as I personally don't use an express implementation so I am not the best person to review things.

@Uzlopak @HappyZombies @jorenvandeweyer is there one of you guys using the express adapter?

By the way there is an open PR that updated a few things: https://github.com/node-oauth/express-oauth-server/pull/6

Anyone checked on that?

HappyZombies commented 1 year ago

I use the project in express but not with the express wrapper, since I found my use case for it rather limiting.

Tbh I would honestly encourage to not use an express wrapper but that's just me 🤷‍♂️.

Not sure when/if I can take a look at the express wrapper as a whole but I'll see the MR 👍 but it is a big diff! Lol

shrihari-prakash commented 1 year ago

@HappyZombies do you have an example or a sample implementation connecting this with express?

HappyZombies commented 1 year ago

@shrihari-prakash Actually I do, see this example project branch I made a few years back.

https://github.com/node-oauth/node-oauth2-server-examples/tree/feature.mfa-example/mfa-example

Though this project implements a crude two factor implementation with the module, it's the same way I use it on my main app :)

You'll notice here that this does not use the express wrapper but rather just calls this project methods directly.

https://github.com/node-oauth/node-oauth2-server-examples/blob/feature.mfa-example/mfa-example/routes.js#L36

Is where the authorize peace works, this whole file uses everything directly. It's not fully implemented but it should give you a solid starting point on how I use it with express.

From here your OAuthModel.js file would run queries on whatever backing service you have (so mongo, redis, mysql, etc.)

The reason I say to do this without the wrapper, is because you will have more direct control over defining each route.

shrihari-prakash commented 1 year ago

Hello @HappyZombies , Thanks much for this! Let me try this on my side and get back. On a side note, I think it would be good if we include such examples for important connectors like express inside this repo and link it on the readme so getting started with this project would be much more developer friendly 🙂

HappyZombies commented 1 year ago

Yup, I hope to get some examples done...one day lol, but true that once those are ready I can link them in the README for sure 👍

shrihari-prakash commented 1 year ago

@HappyZombies , @jankapunkt

Let me know if you'd like me to send a PR to include some example files.

shrihari-prakash commented 1 year ago

@HappyZombies I was able to migrate my application to this package. Thanks for the samples.🙂

Uzlopak commented 1 year ago

I wanted to implement a standalone oidc provider in fastify based on the experience I gained by this project.

I even created a github org and reserved a domain for that.

https://www.cthulhu-oidc.dev/

But well... I have no time.

shrihari-prakash commented 1 year ago

@jankapunkt @HappyZombies ,

I created a sample express implementation of this package in https://github.com/shrihari-prakash/oauth-express-example, could you consider linking it to the readme of this repository?

jankapunkt commented 1 year ago

@shrihari-prakash I'd rather like to get our express adapter to be up2date and published. @HappyZombies any idea how we can make an actionable plan to get to this state?

jankapunkt commented 1 year ago

@shrihari-prakash please review this PR: https://github.com/node-oauth/express-oauth-server/pull/7 the more reviews we get tha faster we can publish

shrihari-prakash commented 1 year ago

Will test this later today with my project and let you know.

HappyZombies commented 1 year ago

@jankapunkt what do you mean? Are you saying you'd like an example express app with the adapter. Or you want to update/refactor the adapter?

jankapunkt commented 1 year ago

Express app is updated and released, I'm closing this issue. Feel free to reopen if further discussion is required.