A working solution

app/Controllers/auth/authSigmaUser.ts

 import Env from '@ioc:Adonis/Core/Env'
 import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
+import { SigmaUser } from 'App/Utils/types'
 import { ClientMetadata, Issuer, generators } from 'openid-client'
 
 const AUTH_URL = 'https://auth.binets.fr'
@@ -13,41 +14,58 @@ const clientOptions: ClientMetadata = {
   response_types: ['code'],
 }
 
+// ! Safe ? Works ? Risk of building up if people don't log in
+let verifiers: { [state: string]: string } = {}
+
 /** Login a user using `auth.binets.fr` which uses OpenId auth */
 export const loginSigmaUser = async ({ response }: HttpContextContract) => {
   const issuer = await Issuer.discover(AUTH_URL)
   const client = new issuer.Client(clientOptions)
 
-  console.log(issuer.metadata)
+  const codeVerifier = generators.codeVerifier()
+  const state = generators.state()
+
+  verifiers[state] = codeVerifier
 
-  const codeVerifier = '9ILex8ru5ZRZhedT-X2-ftF_Qm7mTP8WMFxiLLNPXYs' //generators.codeVerifier()
   const codeChallenge = generators.codeChallenge(codeVerifier)
 
   const url = client.authorizationUrl({
     scope: 'openid email profile groups',
     code_challenge: codeChallenge,
     code_challenge_method: 'S256',
-    state: 'tartiflettePomme123',
+    state,
   })
   return response.ok(url)
 }
 
 /** Callback for `auth.binets.fr` */
-export const callbackSigmaUser = async ({ request, auth }: HttpContextContract) => {
+export const callbackSigmaUser = async ({ response, request, auth }: HttpContextContract) => {
   const issuer = await Issuer.discover(AUTH_URL)
   const client = new issuer.Client(clientOptions)
 
-  const codeVerifier = '9ILex8ru5ZRZhedT-X2-ftF_Qm7mTP8WMFxiLLNPXYs' //generators.codeVerifier()
-
   const params = client.callbackParams(request.request)
+
+  if (!params.state) throw new Error("The response from the auth server doesn't have the state")
+  const codeVerifier = verifiers[params.state]
+
   const tokenSet = await client.callback(CALLBACK_URL, params, {
     code_verifier: codeVerifier,
-    state: 'tartiflettePomme123',
+    state: params.state,
   })
 
-  console.log(tokenSet.claims())
+  delete verifiers[params.state]
+
+  const userExtended = tokenSet.claims()
+  const user: SigmaUser = {
+    username: userExtended.preferred_username, // Unique ?
+    name: userExtended.name,
+    groups: userExtended.groups,
+  } as SigmaUser
+
+  // console.log(tokenSet.claims())
 
   // const user = ...
-  const token = await auth.use('api').login(user)
-  return token
+  // const token = await auth.use('api').login(user)
+  // return token
+  return response.ok(tokenSet.claims())
 }