Third-Party Auth Kit

Description

A social-login toolkit. ProviderButtons: branded sign-in buttons for WeChat (扫码), Alipay, Google, GitHub, Apple, Microsoft, and X — each with the official logo, hover states, and loading/disabled states during the flow. AuthModal: a sign-in modal with email/password + social buttons, 'continue as guest', and a terms checkbox. OAuthFlow: the redirect dance — opens the provider, shows a 'waiting for authorization' spinner, and completes with a success screen; handles popup-vs-redirect modes.

AccountLinking: when a user signs in with a new provider, detect a possible duplicate by email and offer to link accounts (merge) with a clear UI. Includes the state machine for token exchange, error surfaces for common failures (canceled, denied scope, email-mismatch), and a SecurityPanel that surfaces which providers are connected with revoke buttons. Works with NextAuth.js/Auth.js or any backend — provider config is data-driven. Guidance included for OAuth security (state + nonce, PKCE for mobile, validating the id_token signature).

Metadata