Implement Sign in with Cativa

import express from 'express';
import crypto from 'crypto';

const app = express();
app.use(require('express-session')({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, sameSite: 'lax' }
}));

function base64UrlEncode(buf) {
  return buf.toString('base64')
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');
}

app.get('/login', (req, res) => {
  const verifier = base64UrlEncode(crypto.randomBytes(48));
  const challenge = base64UrlEncode(
    crypto.createHash('sha256').update(verifier).digest()
  );
  const state = crypto.randomBytes(16).toString('hex');

  req.session.pkceVerifier = verifier;
  req.session.oauthState = state;

  const params = new URLSearchParams({
    client_id: process.env.CATIVA_CLIENT_ID,
    redirect_uri: process.env.CATIVA_REDIRECT_URI,
    response_type: 'code',
    scope: 'openid profile email',
    code_challenge: challenge,
    code_challenge_method: 'S256',
    state
  });

  res.redirect(
    `https://apis.cativalab.digital/tenant/api/v2/sso/${process.env.CATIVA_CUSTOMER}/authorize?${params}`
  );
});

app.get('/callback', async (req, res) => {
  const { code, state } = req.query;

  if (!code || state !== req.session.oauthState) {
    return res.status(400).send('Invalid OAuth state');
  }

  const tokenRes = await fetch(
    `https://apis.cativalab.digital/tenant/api/v2/sso/${process.env.CATIVA_CUSTOMER}/token`,
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'authorization_code',
        code,
        client_id: process.env.CATIVA_CLIENT_ID,
        client_secret: process.env.CATIVA_CLIENT_SECRET,
        redirect_uri: process.env.CATIVA_REDIRECT_URI,
        code_verifier: req.session.pkceVerifier
      })
    }
  );

  if (!tokenRes.ok) {
    const err = await tokenRes.json();
    return res.status(400).send(`OAuth error: ${err.error_description}`);
  }

  const tokens = await tokenRes.json();
  // { access_token, token_type, expires_in, id_token, refresh_token }

  // Fetch the user profile
  const userRes = await fetch(
    `https://apis.cativalab.digital/tenant/api/v2/sso/${process.env.CATIVA_CUSTOMER}/userinfo`,
    { headers: { Authorization: `Bearer ${tokens.access_token}` } }
  );
  const user = await userRes.json();

  // Persist the user in the session
  req.session.user = user;
  req.session.cativa = {
    accessToken: tokens.access_token,
    idToken: tokens.id_token,
    refreshToken: tokens.refresh_token,
    expiresAt: Date.now() + tokens.expires_in * 1000
  };
  delete req.session.pkceVerifier;
  delete req.session.oauthState;

  res.redirect('/');
});

function requireAuth(req, res, next) {
  if (!req.session.user) return res.redirect('/login');
  next();
}

app.get('/dashboard', requireAuth, (req, res) => {
  res.render('dashboard', { user: req.session.user });
});

import AppAuth

let issuer = URL(string: "https://apis.cativalab.digital/tenant/api/v2/sso/\(customerName)")!

OIDAuthorizationService.discoverConfiguration(forIssuer: issuer) { config, error in
  guard let config = config else { return }

  let request = OIDAuthorizationRequest(
    configuration: config,
    clientId: clientId,
    clientSecret: clientSecret,
    scopes: [OIDScopeOpenID, OIDScopeProfile, OIDScopeEmail],
    redirectURL: URL(string: "myapp://callback")!,
    responseType: OIDResponseTypeCode,
    additionalParameters: nil
  )

  // Presents ASWebAuthenticationSession and completes PKCE automatically
  currentAuthorizationFlow = OIDAuthState.authState(
    byPresenting: request,
    presenting: viewController
  ) { authState, error in
    guard let authState = authState else { return }
    let accessToken = authState.lastTokenResponse?.accessToken
    // Persist authState in the Keychain
  }
}

val issuer = Uri.parse("https://apis.cativalab.digital/tenant/api/v2/sso/$customerName")

AuthorizationServiceConfiguration.fetchFromIssuer(issuer) { config, ex ->
  if (config == null) return@fetchFromIssuer

  val request = AuthorizationRequest.Builder(
    config,
    clientId,
    ResponseTypeValues.CODE,
    Uri.parse("myapp://callback")
  )
    .setScopes("openid", "profile", "email")
    .build()

  val authService = AuthorizationService(context)
  val intent = authService.getAuthorizationRequestIntent(request)
  startActivityForResult(intent, RC_AUTH)
}