OAuth Authorization Flow

function connectToDoorFlow() {
  const params = new URLSearchParams({
    response_type: 'code',
    client_id: 'YOUR_CLIENT_ID',
    redirect_uri: 'YOUR_REDIRECT_URI',
    scope: 'account.person account.event.access.readonly',
    state: generateRandomString(32) // CSRF protection
  });

  // Store state for verification
  sessionStorage.setItem('oauth_state', params.get('state'));

  // Redirect user to DoorFlow
  window.location.href = `https://api.doorflow.com/oauth/authorize?${params}`;
}

function generateRandomString(length) {
  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
  let result = '';
  for (let i = 0; i < length; i++) {
    result += chars.charAt(Math.floor(Math.random() * chars.length));
  }
  return result;
}

// Node.js/Express example
app.get('/callback', async (req, res) => {
  const { code, state, error } = req.query;

  // 1. Verify state (CSRF protection)
  if (state !== req.session.oauth_state) {
    return res.status(403).send('Invalid state - possible CSRF attack');
  }

  // 2. Check for errors
  if (error) {
    console.log('User denied authorization:', error);
    return res.redirect('/error?message=Authorization denied');
  }

  // 3. Exchange code for token
  try {
    const tokens = await exchangeCodeForToken(code);

    // 4. Store tokens securely
    req.session.access_token = tokens.access_token;
    req.session.refresh_token = encrypt(tokens.refresh_token); // Encrypt!

    // 5. Redirect to app
    res.redirect('/dashboard');

  } catch (error) {
    console.error('Token exchange failed:', error);
    res.redirect('/error?message=Authentication failed');
  }
});

async function exchangeCodeForToken(code) {
  const response = await fetch('https://api.doorflow.com/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: code,
      redirect_uri: process.env.REDIRECT_URI,
      client_id: process.env.CLIENT_ID,
      client_secret: process.env.CLIENT_SECRET // Server-side only!
    })
  });

  if (!response.ok) {
    const error = await response.json();
    throw new Error(`Token exchange failed: ${error.error_description}`);
  }

  return await response.json();
}

{
  "access_token": "eyJhbGci...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "a1b2c3...",
  "scope": "account.person account.event.access.readonly",
  "created_at": 1704067200
}

async function callDoorFlowAPI(endpoint, options = {}) {
  const response = await fetch(`https://api.doorflow.com${endpoint}`, {
    ...options,
    headers: {
      'Authorization': `Bearer ${accessToken}`,
      'Content-Type': 'application/json',
      ...options.headers
    }
  });

  return await response.json();
}

// Example: Get account info
const account = await callDoorFlowAPI('/api/3/account');
console.log('Connected to:', account.name);

// Store tokens (encrypt refresh token!)
async function saveTokens(userId, tokens) {
  await db.query(
    'INSERT INTO oauth_tokens (user_id, access_token, refresh_token, expires_at) VALUES (?, ?, ?, ?)',
    [
      userId,
      tokens.access_token,
      encrypt(tokens.refresh_token), // Encrypt!
      Date.now() + (tokens.expires_in * 1000)
    ]
  );
}

// Retrieve tokens
async function getTokens(userId) {
  const row = await db.query(
    'SELECT access_token, refresh_token, expires_at FROM oauth_tokens WHERE user_id = ?',
    [userId]
  );

  return {
    access_token: row.access_token,
    refresh_token: decrypt(row.refresh_token),
    expires_at: row.expires_at
  };
}

// server.js (Node.js/Express)
const express = require('express');
const session = require('express-session');
const crypto = require('crypto');

const app = express();

app.use(session({
  secret: 'your-session-secret',
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true }
}));

// Connect to DoorFlow button
app.get('/connect', (req, res) => {
  const state = crypto.randomBytes(32).toString('hex');
  req.session.oauth_state = state;

  const params = new URLSearchParams({
    response_type: 'code',
    client_id: process.env.DOORFLOW_CLIENT_ID,
    redirect_uri: process.env.DOORFLOW_REDIRECT_URI,
    scope: 'account.person account.event.access.readonly',
    state: state
  });

  res.redirect(`https://api.doorflow.com/oauth/authorize?${params}`);
});

// OAuth callback
app.get('/callback', async (req, res) => {
  const { code, state, error } = req.query;

  // Verify state
  if (state !== req.session.oauth_state) {
    return res.status(403).send('Invalid state');
  }

  // Handle denial
  if (error) {
    return res.redirect('/error?message=Authorization denied');
  }

  try {
    // Exchange code for token
    const tokenResponse = await fetch('https://api.doorflow.com/oauth/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'authorization_code',
        code: code,
        redirect_uri: process.env.DOORFLOW_REDIRECT_URI,
        client_id: process.env.DOORFLOW_CLIENT_ID,
        client_secret: process.env.DOORFLOW_CLIENT_SECRET
      })
    });

    if (!tokenResponse.ok) {
      throw new Error('Token exchange failed');
    }

    const tokens = await tokenResponse.json();

    // Store tokens securely
    req.session.access_token = tokens.access_token;
    // In production: encrypt and store refresh_token in database

    // Get account info
    const accountResponse = await fetch('https://api.doorflow.com/api/3/account', {
      headers: { 'Authorization': `Bearer ${tokens.access_token}` }
    });

    const account = await accountResponse.json();

    res.redirect(`/dashboard?connected=${account.name}`);

  } catch (error) {
    console.error('OAuth error:', error);
    res.redirect('/error?message=Authentication failed');
  }
});

app.listen(3000);