Case study — 05
Google and GitHub sign-in written by hand in Next.js — PKCE, revocable sessions, rate limits, and an audit log, with no auth library.
Auth libraries hide the decisions that matter: where the PKCE verifier lives, how a session is revoked, and where a failed login is recorded. Writing the flow by hand makes those decisions visible.
The Google flow uses the authorization code grant with an S256 code challenge.
Sessions live in SQLite. Logout ends the current device, and logout-everywhere revokes the rest.
The auth endpoints are rate limited, and every auth event is written to a log file.
Unit tests run with Vitest and end-to-end flows with Playwright. The README lists the exact redirect URIs needed for local development.