Integrate an Application

import express from "express";
import crypto from "node:crypto";
import { createRemoteJWKSet, jwtVerify } from "jose";

const ISSUER = "https://api.hawcx.com";
const CLIENT_ID = "acme-web";
const REDIRECT_URI = "https://app.acme.com/callback";

// Discovery resolves authorization_endpoint, token_endpoint, and jwks_uri.
const disco = await (await fetch(`${ISSUER}/.well-known/openid-configuration`)).json();
const jwks = createRemoteJWKSet(new URL(disco.jwks_uri));

const b64url = (b) => b.toString("base64url");
const app = express();
const store = new Map(); // demo only; use the user session in production

app.get("/login", (req, res) => {
  const verifier = b64url(crypto.randomBytes(32));
  const challenge = b64url(crypto.createHash("sha256").update(verifier).digest());
  const state = b64url(crypto.randomBytes(16));
  const nonce = b64url(crypto.randomBytes(16));
  store.set(state, { verifier, nonce });

  const url = new URL(disco.authorization_endpoint);
  url.search = new URLSearchParams({
    response_type: "code",
    client_id: CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    scope: "openid email",
    state,
    nonce,
    code_challenge: challenge,
    code_challenge_method: "S256",
  }).toString();
  res.redirect(url.toString());
});

app.get("/callback", async (req, res) => {
  const { code, state } = req.query;
  const saved = store.get(state);
  if (!saved) return res.status(400).send("Invalid state");
  store.delete(state);

  const tokenRes = await fetch(disco.token_endpoint, {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      code_verifier: saved.verifier,
      client_id: CLIENT_ID,
      redirect_uri: REDIRECT_URI,
    }),
  });
  if (!tokenRes.ok) return res.status(401).send("Token exchange failed");
  const { id_token } = await tokenRes.json();

  const { payload } = await jwtVerify(id_token, jwks, {
    issuer: ISSUER,
    audience: CLIENT_ID,
    algorithms: ["ES512"], // must match discovery's id_token_signing_alg_values_supported
  });
  if (payload.nonce !== saved.nonce) return res.status(401).send("Nonce mismatch");

  // payload.sub is the user; payload.sid ties this login to Back-Channel Logout.
  res.json({ signedInAs: payload.sub, email: payload.email });
});

app.listen(3000);