Add Harbor sign-in to your app

npm install openid-client@^6.8.7 redis

Set HARBOR_ISSUER, HARBOR_CLIENT_ID, HARBOR_CLIENT_TYPE,, HARBOR_SCOPES, and HARBOR_REDIRECT_URI from your app page before using this code. Configure REDIS_URL for your real session infrastructure. For Web backend, also set HARBOR_CLIENT_SECRET on the server to the secret shown once during creation. For Browser/mobile, leave it unset.

import * as oidc from 'openid-client';
import { createClient } from 'redis';
const transactions = createClient({ url: process.env.REDIS_URL });
transactions.on('error', () => console.error('Login transaction storage unavailable.'));
await transactions.connect();
const loginKey = session => 'harbor:login:' + session.id; // Trusted, opaque server session ID.

const redirectUri = process.env.HARBOR_REDIRECT_URI;
const clientType = process.env.HARBOR_CLIENT_TYPE;
if (!['public', 'confidential'].includes(clientType)) throw new Error('Set HARBOR_CLIENT_TYPE.');
if (clientType === 'confidential' && !process.env.HARBOR_CLIENT_SECRET) throw new Error('Set the server-held client secret.');
const harbor = await oidc.discovery(
  new URL(process.env.HARBOR_ISSUER),
  process.env.HARBOR_CLIENT_ID,
  undefined, clientType === 'confidential'
    ? oidc.ClientSecretBasic(process.env.HARBOR_CLIENT_SECRET)
    : oidc.None(),
  { execute: [oidc.enableNonRepudiationChecks] },
);

// Call from your existing sign-in route. Save the session before redirecting.
export async function startHarborSignIn(session) {
  const verifier = oidc.randomPKCECodeVerifier();
  const challenge = await oidc.calculatePKCECodeChallenge(verifier);
  const state = oidc.randomState();
  const nonce = oidc.randomNonce();
  await transactions.set(loginKey(session), JSON.stringify({ verifier, state, nonce }), { EX: 300 });
  return oidc.buildAuthorizationUrl(harbor, {
    redirect_uri: redirectUri, scope: process.env.HARBOR_SCOPES || 'openid',
    code_challenge: challenge, code_challenge_method: 'S256',
    state, nonce,
  }).href;
}

// Call from your registered callback route with its full URL.
export async function finishHarborSignIn(session, callbackUrl) {
  const raw = await transactions.getDel(loginKey(session)); // Atomic, one-time consume.
  const pending = raw ? JSON.parse(raw) : undefined;
  if (!pending) throw new Error('Sign-in expired. Start again.');
  const tokens = await oidc.authorizationCodeGrant(
    harbor, new URL(callbackUrl), {
      pkceCodeVerifier: pending.verifier,
      expectedState: pending.state,
      expectedNonce: pending.nonce,
      idTokenExpected: true,
    },
  );
  const subject = tokens.claims()?.sub;
  if (!subject) throw new Error('Harbor did not return a subject.');
  const userInfo = await oidc.fetchUserInfo(harbor, tokens.access_token, subject);
  return { issuer: tokens.claims().iss, subject,
    email: userInfo.email_verified === true ? userInfo.email : undefined };
  // Find the linked local customer by (issuer, subject).
  // If unfamiliar, offer Connect existing account / Create account; never auto-link by email.
}

Keep the PKCE verifier, state, and nonce in a short-lived server-side login transaction tied to the browser. Save it before redirecting and clear it when the callback is handled. Use your own session store for the signed-in user; do not put tokens or the verifier in browser storage.