OAuth 2.0 implementation guide for the Fanvue API

import { randomBytes, createHash } from 'crypto';

// Helper for Base64URL encoding
function base64URLEncode(buffer) {
  return buffer
    .toString('base64')
    .replace(/=/g, '')
    .replace(/\+/g, '-')
    .replace(/\//g, '_');
}

// Generate code verifier (43-128 characters)
function generateCodeVerifier() {
  return base64URLEncode(randomBytes(32));
}

// Generate code challenge from verifier
function generateCodeChallenge(verifier) {
  return base64URLEncode(
    createHash('sha256').update(verifier).digest()
  );
}

const codeVerifier = generateCodeVerifier();
const codeChallenge = generateCodeChallenge(codeVerifier);
// Store codeVerifier in session/cookie; send codeChallenge with the auth request

import express from 'express';
import { randomBytes } from 'crypto';

const app = express();

// Step 1: Initiate OAuth flow
app.get('/auth/fanvue', (req, res) => {
  const codeVerifier = generateCodeVerifier();
  const codeChallenge = generateCodeChallenge(codeVerifier);
  const state = randomBytes(32).toString('hex');

  // Store code_verifier and state in session
  req.session.codeVerifier = codeVerifier;
  req.session.oauthState = state;

  const authUrl = new URL('https://auth.fanvue.com/oauth2/auth');
  authUrl.searchParams.append('client_id', process.env.CLIENT_ID);
  authUrl.searchParams.append('redirect_uri', process.env.REDIRECT_URI);
  authUrl.searchParams.append('response_type', 'code');
  authUrl.searchParams.append('scope', 'openid offline_access offline read:self');
  authUrl.searchParams.append('state', state);
  authUrl.searchParams.append('code_challenge', codeChallenge);
  authUrl.searchParams.append('code_challenge_method', 'S256');

  res.redirect(authUrl.toString());
});

// Step 2: Handle OAuth callback
app.get('/callback', async (req, res) => {
  const { code, state } = req.query;

  // Validate state parameter (CSRF protection)
  if (!state || state !== req.session.oauthState) {
    return res.status(400).send('Invalid state parameter');
  }

  // Retrieve the stored code_verifier
  const codeVerifier = req.session.codeVerifier;
  if (!codeVerifier) {
    return res.status(400).send('Code verifier not found in session');
  }

  // Clear session data
  delete req.session.oauthState;
  delete req.session.codeVerifier;

  try {
    // Authenticate the client with HTTP Basic Auth (client_secret_basic)
    const basicAuth = Buffer.from(
      `${process.env.CLIENT_ID}:${process.env.CLIENT_SECRET}`
    ).toString('base64');

    // Exchange authorization code for tokens
    const tokenResponse = await fetch('https://auth.fanvue.com/oauth2/token', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Authorization': `Basic ${basicAuth}`,
      },
      body: new URLSearchParams({
        grant_type: 'authorization_code',
        code: code,
        redirect_uri: process.env.REDIRECT_URI,
        code_verifier: codeVerifier,
      }),
    });

    if (!tokenResponse.ok) {
      const error = await tokenResponse.json();
      throw new Error(`Token exchange failed: ${error.error_description}`);
    }

    const tokens = await tokenResponse.json();

    // Store tokens securely (e.g., encrypted in database)
    req.session.accessToken = tokens.access_token;
    req.session.refreshToken = tokens.refresh_token;
    req.session.tokenExpiry = Date.now() + (tokens.expires_in * 1000);

    res.redirect('/dashboard');
  } catch (error) {
    console.error('OAuth callback error:', error);
    res.status(500).send('Authentication failed');
  }
});

class FanvueClient {
  constructor(accessToken, refreshToken, expiresAt) {
    this.accessToken = accessToken;
    this.refreshToken = refreshToken;
    this.tokenExpiresAt = expiresAt;
    this.refreshPromise = null;
  }

  async ensureValidToken() {
    // Refresh if expired or about to expire (within 5 minutes)
    const now = Date.now();
    const bufferTime = 5 * 60 * 1000; // 5 minutes

    if (now + bufferTime >= this.tokenExpiresAt) {
      // If already refreshing, wait for that promise
      if (this.refreshPromise) {
        return this.refreshPromise;
      }

      this.refreshPromise = this.refreshAccessToken();

      try {
        await this.refreshPromise;
      } finally {
        this.refreshPromise = null;
      }
    }

    return this.accessToken;
  }

  async refreshAccessToken() {
    const basicAuth = Buffer.from(
      `${process.env.CLIENT_ID}:${process.env.CLIENT_SECRET}`
    ).toString('base64');

    const response = await fetch('https://auth.fanvue.com/oauth2/token', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Authorization': `Basic ${basicAuth}`,
      },
      body: new URLSearchParams({
        grant_type: 'refresh_token',
        refresh_token: this.refreshToken,
      }),
    });

    if (!response.ok) {
      const error = await response.json();
      throw new Error(`Token refresh failed: ${error.error_description}`);
    }

    const tokens = await response.json();

    // Update both tokens; the response always includes a new refresh token
    this.accessToken = tokens.access_token;
    this.refreshToken = tokens.refresh_token;
    this.tokenExpiresAt = Date.now() + (tokens.expires_in * 1000);

    await this.saveTokens(); // persist to your storage
    return this.accessToken;
  }

  async makeApiRequest(endpoint, options = {}) {
    const token = await this.ensureValidToken();

    const response = await fetch(`https://api.fanvue.com${endpoint}`, {
      ...options,
      headers: {
        ...options.headers,
        'Authorization': `Bearer ${token}`,
        'X-Fanvue-API-Version': '2025-06-26',
      },
    });

    // If the token expired mid-request, refresh and retry once
    if (response.status === 401) {
      await this.refreshAccessToken();
      return fetch(`https://api.fanvue.com${endpoint}`, {
        ...options,
        headers: {
          ...options.headers,
          'Authorization': `Bearer ${this.accessToken}`,
          'X-Fanvue-API-Version': '2025-06-26',
        },
      });
    }

    return response;
  }

  async saveTokens() {
    // Implement your storage logic (database, encrypted session, etc.)
  }
}

// Usage
const client = new FanvueClient(accessToken, refreshToken, expiresAt);
const response = await client.makeApiRequest('/v1/users/me');
const user = await response.json();