So I have GoogleSignin | @react-native-google-signin/google-signin correctly configured and working on the React Native client. Upon google login, it spits back my auth consent scopes (tokenId & profile).
This is what I'm thinking, send the access token Google gave me to my API, validate it, retrieve the profile within my API, create the user if they exist, and if not, fetch it. Then create a JWT token for that user session.
Do I need to use any passport strategies on the API for this, or can I use https://github.com/googleapis/google-api-nodejs-client to authenticate that access token?
So the auth flow in my mind is...
Every time a user signs in, we send the access token to the API, validate it, fetch the user, create a JWT token, spit back that JWT token / refreshToken back to the client, and depending on how you do it, fetch the user from the DB to the client.