OAuth 2.0 flow (AUTH V2)

import { createHash, randomBytes } from "node:crypto";
import { createServer } from "node:http";

const CLIENT_ID = process.env.SIMKL_CLIENT_ID;          // required
const CLIENT_SECRET = process.env.SIMKL_CLIENT_SECRET;  // Server apps & services only
const PORT = 8910;
const REDIRECT_URI = `http://127.0.0.1:${PORT}/callback`;  // register this exact string
const ISSUER = "https://simkl.com";
const UA = "simkl-demo/1.0";

if (!CLIENT_ID) throw new Error("Set SIMKL_CLIENT_ID first");

const b64url = (buf) => buf.toString("base64url");
const verifier = b64url(randomBytes(32));                 // never leaves this process
const challenge = b64url(createHash("sha256").update(verifier).digest());
const state = b64url(randomBytes(16));

console.log("\nOpen this in your browser:\n\n" + ISSUER + "/oauth2/authorize?" +
  new URLSearchParams({
    client_id: CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    response_type: "code",
    scope: "media:read media:write",
    state,
    code_challenge: challenge,
    code_challenge_method: "S256",
  }) + "\n");

createServer(async (req, res) => {
  const url = new URL(req.url, REDIRECT_URI);
  if (url.pathname !== "/callback") return res.writeHead(404).end();
  const q = url.searchParams;
  const done = (m) => { console.log(m); res.end(m); process.exit(0); };

  if (q.get("iss") !== ISSUER) return done("Rejected: response did not come from Simkl");
  if (q.get("state") !== state) return done("Rejected: state mismatch");
  if (q.get("error")) return done(`Authorization failed: ${q.get("error")}`);

  const body = new URLSearchParams({
    grant_type: "authorization_code",
    client_id: CLIENT_ID,
    code: q.get("code"),
    redirect_uri: REDIRECT_URI,      // byte-identical to the one sent above
    code_verifier: verifier,
  });
  if (CLIENT_SECRET) body.set("client_secret", CLIENT_SECRET);

  const r = await fetch("https://api.simkl.com/oauth2/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": UA },
    body,
  });
  const token = await r.json();
  if (!r.ok) return done(`Token exchange failed: ${JSON.stringify(token)}`);
  console.log("scope granted:", token.scope);   // read this, do not assume

  const me = await fetch(
    `https://api.simkl.com/users/settings?client_id=${CLIENT_ID}&app-name=simkl-demo&app-version=1.0`,
    { headers: { Authorization: `Bearer ${token.access_token}`, "User-Agent": UA } },
  );
  done(`Signed in as ${(await me.json()).user.name}. You can close this tab.`);
}).listen(PORT, "127.0.0.1");