Build with PickFu OAuth

https://connect.pickfu.com/.well-known/oauth-authorization-server

openid email profile offline_access

import { createHash, randomBytes } from "crypto"

const ISSUER = "https://connect.pickfu.com"
const REDIRECT_URI = `${process.env.APP_BASE_URL}/auth/callback` // must match DCR exactly
const SCOPE = "openid email profile offline_access"

// PKCE helpers
const randomToken = (bytes = 32) => randomBytes(bytes).toString("base64url")
const pkceChallenge = (verifier: string) =>
  createHash("sha256").update(verifier).digest("base64url")

// 1. Discovery — fetch once, cache
let _disc: any
async function discovery() {
  if (_disc) return _disc
  const r = await fetch(`${ISSUER}/.well-known/oauth-authorization-server`)
  if (!r.ok) throw new Error(`discovery ${r.status}`)
  return (_disc = await r.json())
}

// 2. Dynamic Client Registration — once at boot, cache the client_id by issuer
async function ensureClient() {
  const cached = await db.getOAuthClient(ISSUER)
  if (cached) return cached
  const d = await discovery()
  const r = await fetch(d.registration_endpoint, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      client_name: "Your App Name",
      redirect_uris: [REDIRECT_URI],
      grant_types: ["authorization_code", "refresh_token"],
      response_types: ["code"],
      token_endpoint_auth_method: "none", // public client
      scope: SCOPE,
    }),
  })
  if (!r.ok) throw new Error(`DCR ${r.status}: ${await r.text()}`)
  const j = await r.json()
  // WorkOS may still return a client_secret — store it encrypted and send if present.
  return db.saveOAuthClient(ISSUER, j.client_id, j.client_secret ?? null)
}

// 3. Authorization URL — store `verifier` keyed by `state` (10-min TTL) before redirecting
export async function authorizationUrl(state: string, verifier: string) {
  const d = await discovery()
  const { clientId } = await ensureClient()
  const u = new URL(d.authorization_endpoint)
  u.searchParams.set("client_id", clientId)
  u.searchParams.set("redirect_uri", REDIRECT_URI)
  u.searchParams.set("response_type", "code")
  u.searchParams.set("scope", SCOPE)
  u.searchParams.set("code_challenge", pkceChallenge(verifier))
  u.searchParams.set("code_challenge_method", "S256") // S256 only; `plain` is rejected
  u.searchParams.set("state", state)
  return u.toString()
}

// 4. Token exchange (callback) + 5. refresh
async function tokenRequest(form: Record<string, string>) {
  const d = await discovery()
  const { clientId, clientSecret } = await ensureClient()
  form.client_id = clientId
  if (clientSecret) form.client_secret = clientSecret
  const r = await fetch(d.token_endpoint, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams(form).toString(),
  })
  if (!r.ok) throw new Error(`token ${r.status}: ${await r.text()}`)
  return r.json() // { access_token, refresh_token, expires_in, id_token, ... }
}

export const exchangeCode = (code: string, verifier: string) =>
  tokenRequest({ grant_type: "authorization_code", code, redirect_uri: REDIRECT_URI, code_verifier: verifier })

export const refresh = (refreshToken: string) =>
  tokenRequest({ grant_type: "refresh_token", refresh_token: refreshToken })

// 6. Always call before a PickFu request — refreshes proactively within 60s of expiry
export async function getValidAccessToken(userId: string) {
  const row = await db.getTokens(userId)
  if (!row) throw new Error("Not connected to PickFu")
  if (row.expiresAt - Date.now() < 60_000 && row.refreshTokenEnc) {
    const t = await refresh(decrypt(row.refreshTokenEnc))
    await db.saveTokens(userId, {
      accessTokenEnc: encrypt(t.access_token),
      refreshTokenEnc: t.refresh_token ? encrypt(t.refresh_token) : row.refreshTokenEnc,
      expiresAt: Date.now() + t.expires_in * 1000,
    })
    return t.access_token
  }
  return decrypt(row.accessTokenEnc)
}

const token = await getValidAccessToken(userId)
await fetch("https://api.pickfu.com/v1/surveys", {
  headers: { Authorization: `Bearer ${token}` },
})