We use https://github.com/panva/node-oidc-provider internally and that is supposed to support PKCE. Not sure yet how to use it to test what this needs.
Until that is working, the options are a keycloak instance or a small backend which gives the SPA some kind of session while handling the oidc login bits.
