Auth Flow Simulator

The Problem

Frontend auth work is miserable when it depends on a live identity provider. OAuth flows require registered redirect URIs, 2FA needs a real phone number, password reset emails land in a real inbox, and token expiry takes however long it actually takes — not the 30 seconds you need it to take to test your refresh logic.

Every time I needed to test an edge case — expired session, failed 2FA, locked account — I was either hitting production infrastructure or faking it with hardcoded booleans that didn't survive a realistic flow.

What I Built

Auth Flow Simulator is a drop-in local library that stands in for a real identity provider during development. It simulates the full range of auth flows and failure states without any external dependencies.

Covers:

• OAuth flows — authorization code, implicit, PKCE, with configurable callback URLs
• 2FA — TOTP and backup code flows, including failure states
• Password reset — full email → token → new password cycle, locally
• Session management — expiry, refresh, revocation, concurrent session limits

Key Decisions

No network calls. Every flow runs locally. There's no mock server to spin up — it's a library you import and configure in a few lines.

Configurable failure modes. The whole point is testing edge cases. Every flow accepts a config that tells it to fail at a specific step — expired token, wrong OTP, rate-limited login — so you can test your error handling without waiting for the real thing to fail.

Frontend-unblocking is the goal. The library exists so auth integration doesn't become a blocker for frontend work. Drop it in, simulate whatever you need, replace it with the real provider when you're ready.

Stack

TypeScript, Node.js, Express (for the optional local server mode), Jest, GitHub Actions for CI.