Skip to content

Instantly share code, notes, and snippets.

@0xdevalias
Last active April 23, 2025 02:05
Show Gist options
  • Save 0xdevalias/683751eea0a328e5743c9f1657156d88 to your computer and use it in GitHub Desktop.
Save 0xdevalias/683751eea0a328e5743c9f1657156d88 to your computer and use it in GitHub Desktop.
Web App tech stack things

Web App Tech Stack Things

Table of Contents

From GitHub Issues

Configure prettier

This is an issue to remind me to review our current prettier configuration, and ensure it matches how I like things to work.

Set up .editorconfig

Set up .editorconfig and ensure it aligns with our prettier config:

  • https://editorconfig.org/
    • What is EditorConfig? EditorConfig helps maintain consistent coding styles for multiple developers working on the same project across various editors and IDEs. The EditorConfig project consists of a file format for defining coding styles and a collection of text editor plugins that enable editors to read the file format and adhere to defined styles. EditorConfig files are easily readable and they work nicely with version control systems.

Set up husky + lint-staged to run eslint / prettier

Conventional Commits, Conventional Changelog, Semantic Release, release.yml, semantic.yml, Commitlint, Commitizen, etc

See:

Implement Next Auth refresh_token rotation

Implement Next Auth Federated Logout (eg. OpenID Connect Federated Logout)

X Also asked about whether Next Auth has a logout callback URI, which from some quick googling, sounds like it might relate to OpenID Connect federated logout; which isn't built in to Next Auth:

  • https://stackoverflow.com/questions/74557856/next-auth-azure-ad-b2c-signout-problem-session-kills-on-app-but-not-on-azure-ad
    • Next Auth Azure Ad B2C signout problem session kills on app but not on azure AD

    • I am integrating Next Auth with Azure AD B2C i am able to create a login session when i login or signup on azure AD but when i signout using next Auth i am not signing out of azure AD and it automatically signins me in till the azure AD session expires that is 1 day after a day i will get option again to sign in.

    • You can either..

  • https://next-auth.js.org/configuration/events#signout
  • nextauthjs/next-auth#3938
    • https://kinderas.com/technology/implementing-federated-sign-out-when-using-next-auth-in-you-next-js-app
      • Implementing federated sign out when using next-auth in you Next.js app

      • When using federated auth, such a Google or a custom oAuth & OpenId Connect setup, a user will in some cases expect to be signed out from the original provider as well as your Next application. In this post I'll go into detail on how this can be achieved using next-auth v4.

        Next-auth will as writing this (v4.10) not automatically handle federated sign out defined by the OpenId standard, so we have to manually implement this.

        This post is based on this Github discussion over at the next-auth repo. See sources below.

  • https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-user-flow#sign-out
    • Sign out When you want to sign the user out of the application, it isn't enough to clear the application's cookies or otherwise end the session with the user. You must redirect the user to Azure AD B2C to sign out. Otherwise, the user might be able to reauthenticate to your applications without entering their credentials again.

      Upon a sign-out request, Azure AD B2C:

      • Invalidates the Azure AD B2C cookie-based session.
      • Attempts to sign out from federated identity providers.

      The sign-out clears the user's single sign-on state with Azure AD B2C, but it might not sign the user out of their social identity provider session. If the user selects the same identity provider during a subsequent sign-in, they might reauthenticate without entering their credentials. If a user wants to sign out of the application, it doesn't necessarily mean they want to sign out of their Facebook account. However, if local accounts are used, the user's session ends properly.

  • https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior#secure-your-logout-redirect
    • Secure your logout redirect After logout, the user is redirected to the URI specified in the post_logout_redirect_uri parameter, regardless of the reply URLs that you specify for the application. However, if a valid id_token_hint is passed and the Require ID Token in logout requests is turned on, Azure AD B2C verifies that the value of post_logout_redirect_uri matches one of the application's configured redirect URIs before performing the redirect. If no matching reply URL was configured for the application, an error message is displayed and the user isn't redirected.

    • To require an ID Token in logout requests: ..snip..

    • To configure your application Logout URL: ..snip..

  • https://dev.to/aryaman_/implementing-federated-sign-out-with-authjs-in-nextjs-14-app-router-44jj
    • Implementing Federated Sign-Out with Auth.js in Next.js 14 App Router

    • The Challenge Auth.js doesn't provide built-in support for federated sign-out as defined by the OpenID Connect standard. This means we need to implement it manually to ensure our users are properly signed out from both the client application and the identity provider.

Implement 'copy on write' drafts

See also:

Some random thoughts/notes from Messenger the other day:

Random article about copy on write: https://softwarepatternslexicon.com/103/4/5/

The article itself doesn’t matter hugely, but the ‘related patterns’ at the end reminded me of this:

Event Sourcing: Used to record changes as a sequence of events, which enables reconstructing states from these events, similar to CoW’s rollback and history features.

Which coincides with something that was floating in my mind recently RE: how we could store ‘in progress drafts’ of responses in case the user’s browser crashes or similar.

Obviously wouldn’t want to pollute the main response table with this as it would get too big too quickly; so probably would be a new table with a single ‘in progress draft’ per user at most.

Could also just store this in browser local storage if we didn’t want to persist it in the DB.

But anyways; then I was thinking about undo history, or being able to see more fine grained changes on a version; and that’s where the event sourcing pattern could fit in.

Whether it’s on an in progress draft, or on a saved response version itself; there could be an additional field (probably JSON field) that stores the ‘edit history’ events since the last ‘snapshot’ (for a saved model, that would basically be the edits made since the last saved model)

That would allow seeing finer grained edits as a sort of metadata; while having a single ‘snapshot’ of the main content as a single block of text still.

Monaco - Save/restore undo history

See also:

Further reading RE: 'edit history':

Explore/embody the best practices described in Stripe's 'Designing APIs for Humans' blog series and similar

Explore/embody the best practices described in Stripe's 'Designing APIs for Humans' blog series and similar:

Explore methods for prefixing generated database record IDs by type

See also:

It can be useful for DB record IDs to include a prefix that represents their type. This is used by companies such as Stripe/etc, and improves developer experience, as well as providing other tangible benefits:

Currently Prisma doesn't support generating IDs with prefixes natively in their schema definitions:

Consider JSON:API best practices (eg. error formats, etc)

Explore best methods for unit/integration tests

My default answer for unit tests used to be Jest:

But these days I think a better option might actually be Vitest:

Possibly also combined with something like testing-library:

For integration tests (eg. browser tests) I don't have as deep knowledge, but I believe Playwright is probably a good place to start from memory:

There are no doubt more options/considerations here.. but that is a quick 'top of mind' context dump.

Some other random things vaguely in this space:

  • https://storybook.js.org/
    • Build UIs without the grunt work Storybook is a frontend workshop for building UI components and pages in isolation. Thousands of teams use it for UI development, testing, and documentation. It's open source and free.

    • https://github.com/storybookjs/storybook
      • Storybook is the industry standard workshop for building, documenting, and testing UI components in isolation

  • https://mswjs.io/
    • Industry standard API mocking for JavaScript. Mock Service Worker is an API mocking library that allows you to write client-agnostic mocks and reuse them across any frameworks, tools, and environments.

    • https://github.com/mswjs/msw
      • Mock Service Worker Mock Service Worker (MSW) is a seamless REST/GraphQL API mocking library for browser and Node.js.

See Also

Set up .devcontainer/devcontainer.json for Copilot Workspace / etc

See Also

My Other Related Deepdive Gist's and Projects

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment