Connect with MatchaiComing soon

import { createHash, randomBytes } from 'node:crypto';
import cookieParser from 'cookie-parser';
import express from 'express';

// Your own code: who is signed in to your product, and where tokens are kept.
declare function currentCustomerId(request: express.Request): string;
declare function saveConnection(connection: {
  customerId: string;
  matchaiUserId: string;
  accessToken: string;
  refreshToken: string;
  expiresAt: Date;
}): Promise<void>;

const clientId = process.env.MATCHAI_CLIENT_ID!;
const clientSecret = process.env.MATCHAI_CLIENT_SECRET!;
const redirectUri = 'https://app.your-website-company.example/matchai/callback';
const scopes = ['profile:read', 'listings:read', 'contacts:write', 'webhooks:manage'];

const base64url = (bytes: Buffer) => bytes.toString('base64url');

const app = express();
app.use(cookieParser());

// Steps 1 and 2: send the professional to Matchai.
app.get('/matchai/connect', (request, response) => {
  currentCustomerId(request); // Only a signed-in customer can start a connection.

  const state = base64url(randomBytes(24));
  const verifier = base64url(randomBytes(48));
  const challenge = base64url(createHash('sha256').update(verifier).digest());

  // Keep both values in a cookie that only this browser sends back.
  response.cookie('matchai_oauth', JSON.stringify({ state, verifier }), {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    maxAge: 10 * 60 * 1000,
  });

  const authorize = new URL('https://matchai.co/oauth/authorize');
  authorize.search = new URLSearchParams({
    response_type: 'code',
    client_id: clientId,
    redirect_uri: redirectUri,
    scope: scopes.join(' '),
    state,
    code_challenge: challenge,
    code_challenge_method: 'S256',
  }).toString();

  response.redirect(authorize.toString());
});

// Steps 4 and 5: Matchai sends the professional back here.
app.get('/matchai/callback', async (request, response) => {
  const customerId = currentCustomerId(request);
  const saved = JSON.parse(request.cookies.matchai_oauth ?? 'null') as
    | { state: string; verifier: string }
    | null;
  response.clearCookie('matchai_oauth');

  if (request.query.error === 'access_denied') {
    return response.redirect('/settings/website?matchai=declined');
  }

  const { code, state } = request.query;
  if (!saved || typeof code !== 'string' || state !== saved.state) {
    return response.status(400).send('This connection request is not valid. Please start again.');
  }

  const tokenResponse = await fetch('https://api.matchai.co/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code,
      redirect_uri: redirectUri,
      client_id: clientId,
      client_secret: clientSecret,
      code_verifier: saved.verifier,
    }),
  });
  if (!tokenResponse.ok) {
    return response.status(502).send('Matchai did not accept the connection. Please try again.');
  }
  const tokens = await tokenResponse.json();

  // Learn which Matchai account just connected.
  const me = await fetch('https://api.matchai.co/v1/me', {
    headers: { Authorization: `Bearer ${tokens.access_token}` },
  }).then((result) => result.json());

  await saveConnection({
    customerId,
    matchaiUserId: me.user_id,
    accessToken: tokens.access_token,
    refreshToken: tokens.refresh_token,
    expiresAt: new Date(Date.now() + tokens.expires_in * 1000),
  });

  response.redirect('/settings/website?matchai=connected');
});

app.listen(3000);

type Tokens = { accessToken: string; refreshToken: string; expiresAt: Date };

// Your own code: tokens are stored per customer.
declare function loadTokens(customerId: string): Promise<Tokens>;
declare function saveTokens(customerId: string, tokens: Tokens): Promise<void>;
declare function markDisconnected(customerId: string): Promise<void>;

async function refresh(refreshToken: string): Promise<Tokens | null> {
  const response = await fetch('https://api.matchai.co/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: process.env.MATCHAI_CLIENT_ID!,
      client_secret: process.env.MATCHAI_CLIENT_SECRET!,
    }),
  });
  if (!response.ok) return null;

  const tokens = await response.json();
  return {
    accessToken: tokens.access_token,
    // Keep the newest refresh token you were given.
    refreshToken: tokens.refresh_token ?? refreshToken,
    expiresAt: new Date(Date.now() + tokens.expires_in * 1000),
  };
}

export async function matchaiFetch(
  customerId: string,
  path: string,
  init: RequestInit & { headers?: Record<string, string> } = {},
): Promise<Response> {
  let tokens = await loadTokens(customerId);

  const call = () =>
    fetch(`https://api.matchai.co/v1${path}`, {
      ...init,
      headers: { ...init.headers, Authorization: `Bearer ${tokens.accessToken}` },
    });

  const response = await call();
  if (response.status !== 401) return response;

  // The access token expired, or the professional disconnected. Refresh once.
  const refreshed = await refresh(tokens.refreshToken);
  if (!refreshed) {
    await markDisconnected(customerId); // Show "Reconnect Matchai" in your product.
    return response;
  }
  await saveTokens(customerId, refreshed);
  tokens = refreshed;
  return call();
}