Unresolved strategy choice for Passport.js unit tests without live credentials?

Goal

Test a Passport.js authentication flow in a local test environment while avoiding any calls to external OAuth providers. The test must simulate the provider’s token exchange, user profile retrieval, and session handling without using real production credentials.

Constraints

To keep the tests deterministic, the OAuth endpoints must be intercepted (e.g., with nock) or replaced by a custom mock strategy. Session serialization and deserialization functions also need to be overridden so the test does not rely on the production implementation. Each approach carries risks: a mock strategy can hide signature‑validation bugs, while nock might allow unintended network traffic if mis‑scoped.

Unresolved Decision

Which combination of mocking techniques provides the most reliable isolation while still exercising the real Passport.js code paths? How should the test configuration be structured to avoid leaking production logic into the test suite?

• Which approach—custom mock strategy or passport-test utilities—offers the best balance between realism and isolation for unit tests?
• How should serializeUser and deserializeUser be overridden in test code to preserve session semantics without masking bugs?
• Does intercepting provider endpoints with nock adequately cover signature validation and rate‑limit scenarios that only surface with a real provider?