Implementing OAuth BFF proxy pattern with Remix

[Tyrannogyna]

Are there any examples of someone implementing this BFF proxy architecture in Remix?

I would love a tutorial on how to replace the demo authentication with an external auth server, or even just an skeleton idea on which files should contain which methods and a confirmation about if they are running in the browser or the server.

Questions I have are:

• Where to place the initial redirect to the login page of the external auth server
• Would this initial redirect prevent JS to be loaded into the browser?
• This app should be completely private, all routes require authentication. Is this in the FAQs the only way? Is there anything coming in 2.0 or later to simplify protected routes? I see there's some talk about a 'beforeLoader' but what's the state of development for this?
• Once the user has authenticated, hopefully through the backend, and we get a token, how do I ensure the frontend knows that the user is authenticated? If I save this token on the browser (session or cookie), how is the front end going to handle refresh tokens in a way the backend knows about the new token too? [EDIT: Nevermind, the BFF pattern should not share the tokens with the frontend, they communicate via cookies, according to the document linked at the start]