Struggling with Passport, is there a better way to handle auth for my app?

[river lodge]

Hey, I've spend a couple of hours today trying to implement magic-link auth with passport in my app

Which btw. now after taking a break from it, I think I was overcomplicating the whole process by using the passport-magic-login library. I could just generate token the moment that /login endpoint is hit, send it and verify the callback after user clicks a button on that email, right?

But that's not my main question, after fighting with this and having some time to think about it I came to conclusion that maybe there's something better that I could use for auth in my mobile app than passport as it feels not so great after todays fight with it. So my question is, what should I use for auth for my setup (nestjs + prisma + graphql)? From the initial research that I've did this ones looked the most promising: stick with passport, Supabase, Supertokens. Is there something better? Maybe I'm completely wrong and passport is not so bad in the end? Also please keep in mind that in the long term I would like support the following ways of authentication in my app: magic-link (for starters this is what I would like to implement), sign in with google account and sign in with apple account

Thanks, and I hope this question is not an issue as I've tried to research answer for it on Reddit/over Google and here on Discord but I couldn't find a definitive answer to it, especially for requirements as mine

[velvet goblet]

HI , to be honest I am not expert and I am still learning but until now passport was very hard to understand and very old actually with almost no documentation so I switched to
https://lucia-auth.com/
witch is new and very fun library to build project with ,
it supports google and apple but there is no magic link implementation as far as I know but the library make it very easy to implement as it don't have strict middleware's like passport , you may give it a try , I hope this maybe useful

just to tell you the library don't have a documentation or official module for nestjs so I used custom provider to solve this issue and it's easy

here is what idea i had to make it work
https://github.com/lucia-auth/lucia/issues/1275#issuecomment-1819597653

[river lodge]

Oh yeah, I was thinking about using Lucia as well, but as I couldn't find anything about Nestjs I just moved on from it. Thanks for the link tho, I will have a look at it for sure.

[fast quail]

Here's official blog post on how to build custom authentication in nest without passport.

Next, I'd recommend having a look at Firebase Auth. They have generous free tier, support magic links and other kinds of auth (2FA is tricky though from what I remember), and could probably save you some time building a login/signup/forgot password UI in your app if you use some lib (https://rnfirebase.io/auth/usage).

All you need in backend side is single AuthGuard that takes token from the authorization header and verifies it using firebase-admin node sdk (firebaseService.auth.verifyIdToken(token)).

[river lodge]

Thanks for the link for authentication without passport but while I know that's possible to create auth logic without it I think it's not a good idea for my needs as I want need something more complicated (google/apple login + magic link) - I'm sure this could also be written fully by myself but that really doesn't feel like a good idea to me.

And yeah I was thinking about using Firebase or Supabase but with Firebase I really don't want to be locked into Google with my most vital part of app. And Supabase felt really nice but the more I've read about it, the more people were complaining about issues they had with it.

I'm really suprised that there isn't a one or two standards ways of handling auth for nestjs backends, it feels to me that passport is/was like that but from the commit history it almost feels abandoned

[river lodge]

Hmm 🤔 I took a look into it and I'm really not sure if this is a good fit for my application.

From what I've understood from the docs, it doesn't support the default types for fields in postgres database, right? So you need to use the ones provides by Lucia, which would probably brake my setup as I'm using node-pg-migrate.

Also, I'm really not sure how I feel about the requirement of using 3 tables just to use Lucia and the fact you need to use "string" primary keys in tables.

Unless I've understood the docs incorrectly and all of that is invalid.

[river lodge]

Also, any chance that someone here used Supertokens (https://supertokens.com/) ? At first glance it looks quite promising

[velvet goblet]

the adapter for orm is the one who decide the types in the schema file so I didn't really understand what you mean by "it doesn't support the default types for fields in postgres database," but the point of string primary key is true until now it should be string

[velvet goblet]

it seems to me that supertokens is a service not just a library

if I understand it right it's a separate http service witch is great actually but all my project is smaller than that so I don't think I am going to use it 😂

[river lodge]

Here (https://lucia-auth.com/basics/database/#database-model) they mention "Lucia does not support default database values.". Maybe they only mean it for tables that will be used with Lucia for auth, and this part:

type UserSchema = {
    id: string;
} & Lucia.DatabaseUserAttributes;

So using Lucia.DatabaseUserAttributes feels a little bit confusing to me 😄

[velvet goblet]

default values like "Lucia does not support default (auto-generated) database values."

[velvet goblet]

this for ts types not for the database

types defind in prisma schema normally

[river lodge]

Ah, okay. My bad 😅

[velvet goblet]

you can try it in a side project and try super tokens then see what is best for you

if you have time ...