const express = require('express')
const fetch = require('node-fetch')
const dotenv = require('dotenv')

dotenv.config();

const app = express()
const port = 4000
app.use(express.static('public'))

app.get('/oauth/chatwork', async function(req, res) {

    // Create the Authentication body

    const body = [ 
        'grant_type=authorization_code',
        `code=${req.query.code}`,
        'redirect_uri=https://cw.blog.wsd.sh/oauth/chatwork'
    ].join('&');

    // Create Authentication Header

    const basic =  `${process.env.CLIENT_ID}:${process.env.CLIENT_SECRET}`;
    const base64 = Buffer.from( basic ).toString( 'base64' );

    const url = 'https://oauth.chatwork.com/token';
    const params = {
        method : 'POST',
        headers : {
            'Authorization' : `Basic ${base64}`,
            'Content-Type': 'application/x-www-form-urlencoded'
        },
        body : body
    }

    // Send Authentication Response

    const ajax = await fetch( url, params );
    const json = await ajax.json();
    res.json( json );

});

app.listen(port, () => {
    console.log(`Example app listening at port: ${port}`)
});

Once the client either clicks “Allow” or “Deny” on the confirmation screen they
are redirected to the url we specified in GTE query parameters for the
confirmation screen. In this case since we’re using Express, I used a path
without an extension and doesn’t represent a folder to designate that callback
is being executed as a server-side process as opposed to a page that is displayed
to the user.

Admittedly this callback doesn’t handle the possibility of getting a “Deny” reply.
In reality, we should be checking the response and replying accordingly. In this case
we wanted to focus on how we accept the token on the condition the user clicks
on “Allow”. And we see that in the body which provides three values.

The two values that are passed to us as GET query parameters, is the state value we provided
and a code value. The first value we reply with is grant_type, which has a fixed value of
“authorization_code”. For the code we supply the GET query parameter that was sent to us.
And last is the redirect_uri, which shouldn’t be needed as is not required as we’re already
done with that part, but I found if I didn’t supply it, I got errors that the value didn’t
match or something.

From there we need to supply our secret to confirm to Chatwork OAuth, that it really is
us, and not somebody else using our client ID. The way we do this is a twist on
“Basic Authentication”, which really just means authenticating with “username:password”.
For the username we supply the Client Id from our OAuth settings page, followed by a colon
and the password is the Client Secret from our OAuth settings page.

We then take the string of “[Client_Id]:[Client_Secret]” and encode that as a base64
string. We then need to supply that as a header. The header value is “Authorization”, and
the value is the string “Basic” followed by a space and the base64 string of our
client id and client secret. The content type is application/x-www-form-urlencoded,
and the body is our form-urlencoded list of arguments made in the body.

We send this to Chatwork to get a token as a response. And that allows us to send
API requests on behalf of the user, but we still have some questions to fill in
from here. How do we renew a token? How do we get a token on login? And how do we
structure our app to recognize the token exists to act accordingly?