const express = require('express');
const crypto = require('crypto');
const app = express();

const CLIENT_ID = process.env.TDB_CLIENT_ID;
const CLIENT_SECRET = process.env.TDB_CLIENT_SECRET;
const REDIRECT_URI = 'https://myapp.com/oauth/callback';
const TDB = 'https://api.tenantsdb.com';

// PKCE helpers — generate a random verifier and its SHA-256 challenge.
function base64url(buf) {
  return buf.toString('base64')
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}
function pkcePair() {
  const verifier = base64url(crypto.randomBytes(32));
  const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
  return { verifier, challenge };
}

// Step 2: kick off the flow
app.get('/oauth/start', (req, res) => {
  const state = crypto.randomBytes(16).toString('hex');
  const { verifier, challenge } = pkcePair();

  // Both must be stashed: state for CSRF check, verifier for the token call.
  req.session.oauthState = state;
  req.session.oauthVerifier = verifier;

  const url = `${TDB}/oauth/authorize?` + new URLSearchParams({
    client_id: CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    response_type: 'code',
    scope: 'project:read project:write',
    state,
    code_challenge: challenge,
    code_challenge_method: 'S256',
  });
  res.redirect(url);
});

// Step 3: exchange the code for tokens
app.get('/oauth/callback', async (req, res) => {
  const { code, state, error } = req.query;

  if (error) return res.status(400).send(`OAuth error: ${error}`);
  if (state !== req.session.oauthState) return res.status(400).send('State mismatch');

  const response = await fetch(`${TDB}/oauth/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code,
      redirect_uri: REDIRECT_URI,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      code_verifier: req.session.oauthVerifier,
    }),
  });

  const tokens = await response.json();
  // Store tokens.access_token and tokens.refresh_token in your DB, keyed to this user.
  res.send('Connected!');
});

// Step 4: call TenantsDB on behalf of the user
async function listWorkspaces(accessToken) {
  const r = await fetch(`${TDB}/workspaces`, {
    headers: { Authorization: `Bearer ${accessToken}` },
  });
  return r.json();
}

// Step 5: refresh the token
async function refresh(refreshToken) {
  const r = await fetch(`${TDB}/oauth/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
    }),
  });
  return r.json();
}

app.listen(3000);

npm install express express-session

import os
import base64
import hashlib
import secrets
import requests
from flask import Flask, redirect, request, session, url_for

app = Flask(__name__)
app.secret_key = os.environ["FLASK_SECRET"]

CLIENT_ID = os.environ["TDB_CLIENT_ID"]
CLIENT_SECRET = os.environ["TDB_CLIENT_SECRET"]
REDIRECT_URI = "https://myapp.com/oauth/callback"
TDB = "https://api.tenantsdb.com"

# PKCE helpers — generate a random verifier and its SHA-256 challenge.
def pkce_pair():
    verifier = secrets.token_urlsafe(32)
    digest = hashlib.sha256(verifier.encode("ascii")).digest()
    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
    return verifier, challenge

# Step 2: kick off the flow
@app.route("/oauth/start")
def oauth_start():
    state = secrets.token_urlsafe(16)
    verifier, challenge = pkce_pair()

    # Both must be stashed: state for CSRF check, verifier for the token call.
    session["oauth_state"] = state
    session["oauth_verifier"] = verifier

    params = {
        "client_id": CLIENT_ID,
        "redirect_uri": REDIRECT_URI,
        "response_type": "code",
        "scope": "project:read project:write",
        "state": state,
        "code_challenge": challenge,
        "code_challenge_method": "S256",
    }
    return redirect(f"{TDB}/oauth/authorize?{requests.compat.urlencode(params)}")

# Step 3: exchange the code for tokens
@app.route("/oauth/callback")
def oauth_callback():
    error = request.args.get("error")
    if error:
        return f"OAuth error: {error}", 400

    if request.args.get("state") != session.get("oauth_state"):
        return "State mismatch", 400

    r = requests.post(f"{TDB}/oauth/token", data={
        "grant_type": "authorization_code",
        "code": request.args["code"],
        "redirect_uri": REDIRECT_URI,
        "client_id": CLIENT_ID,
        "client_secret": CLIENT_SECRET,
        "code_verifier": session["oauth_verifier"],
    })
    tokens = r.json()
    # Store tokens["access_token"] and tokens["refresh_token"] for this user.
    return "Connected!"

# Step 4: call TenantsDB on behalf of the user
def list_workspaces(access_token):
    r = requests.get(
        f"{TDB}/workspaces",
        headers={"Authorization": f"Bearer {access_token}"},
    )
    return r.json()

# Step 5: refresh the token
def refresh(refresh_token):
    r = requests.post(f"{TDB}/oauth/token", data={
        "grant_type": "refresh_token",
        "refresh_token": refresh_token,
        "client_id": CLIENT_ID,
        "client_secret": CLIENT_SECRET,
    })
    return r.json()

pip install flask requests