If you peek at that third party OAuth library, you will discover… it's complex. This is what I mean about pushing the complexity around on your plate. You can make it someone else's problem (and become dependent on them), but the complexity is still there. There is a minimum level of complexity that any OAuth system needs to have in order to function. QED
OAuth library is a perfect example of lousy engineers inventing complexity.
Here's a talk where Jack Diederich mentions it: https://youtu.be/o9pEzgHorH0?t=870
It is indeed complex: 200+ classes. Plenty of unit tests and mocks.
And then there's his implementation:
- 0% unit test coverage.
- Lightweight at less than 200 lines, including blanks and docstrings.
QED.
I strongly disagree on the ratio. If you're building Mastodon client, most of your effort should be spent on features and UX, not on OAuth and the like. If half of your time is spent on those, either you're at the beginning of the project, or you're at the beginning of your career. Or maybe you just care about engineering itself more than the end product.