Sign in with VISH for developers

https://d1.vish-app.ru/api/v1/oauth/.well-known/openid-configuration

 Приложение (клиент)                 ВИШ                                  Человек
        |                             |                                       |
        | 1. code_verifier, state, nonce — создаются и сохраняются у себя     |
        |------------------------------------------------------------------->|
        | 2. переход на authorization_endpoint (/oauth/authorize):            |
        |    response_type=code, client_id, redirect_uri, scope, state,       |
        |    nonce, code_challenge, code_challenge_method=S256                |
        |                             |<--- 3. вход через Telegram или MAX ---|
        |                             |<--- 4. «Разрешить» на экране согласия |
        |<--- 5. 302 на redirect_uri?code=…&state=…&iss=… --------------------|
        | 6. проверка: state совпадает с сохранённым, iss — с issuer          |
        |---- 7. POST /oauth/token: grant_type=authorization_code, code,      |
        |        redirect_uri, client_id, code_verifier ------------------->|
        |<--- 8. JSON: access_token, refresh_token, id_token, expires_in ----|
        | 9. проверка id_token: iss, aud, nonce, exp                          |
        |---- 10. GET /oauth/userinfo, Authorization: Bearer access_token -->|
        |<--- 11. sub, name, vish_group, vish_role … -------------------------|

// PKCE (S256), state and nonce with Web Crypto (the same code runs in a browser); the authorize URL
// from discovery; the callback check.
const API = process.env.VISH_API ?? 'https://d1.vish-app.ru/api/v1'
const CLIENT_ID = process.env.VISH_CLIENT_ID ?? 'vc_your_client_id'
const REDIRECT_URI = 'http://127.0.0.1:8080/callback'

const base64url = (bytes) =>
	btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
const randomString = () => base64url(crypto.getRandomValues(new Uint8Array(32))) // 43 characters
const challengeOf = async (verifier) =>
	base64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier)))

// RFC 7636, appendix B: the reference verifier and its challenge.
if ((await challengeOf('dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk')) !== 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM') {
	throw new Error('S256 is computed wrongly')
}

const response = await fetch(`${API}/oauth/.well-known/openid-configuration`)
if (!response.ok) throw new Error(`discovery: HTTP ${response.status}`)
const discovery = await response.json()
if (!discovery.code_challenge_methods_supported?.includes('S256')) throw new Error('S256 not offered')

// Keep these three until the callback: sessionStorage of this tab, or the server-side session.
const codeVerifier = randomString()
const state = randomString()
const nonce = randomString()

const authorizeUrl = new URL(discovery.authorization_endpoint)
authorizeUrl.search = new URLSearchParams({
	response_type: 'code',
	client_id: CLIENT_ID,
	redirect_uri: REDIRECT_URI,
	scope: 'openid profile group schedule:read',
	state,
	nonce,
	code_challenge: await challengeOf(codeVerifier),
	code_challenge_method: 'S256',
}).toString()
console.log('authorize URL:', authorizeUrl.href)

// What the callback handler does with ?code=…&state=…&iss=…
const acceptCallback = (callbackUrl) => {
	const params = new URL(callbackUrl).searchParams
	if (params.get('state') !== state) throw new Error('state mismatch: not our request')
	if (params.get('iss') !== discovery.issuer) throw new Error('iss mismatch')
	if (params.has('error')) throw new Error(`${params.get('error')}: ${params.get('error_description')}`)
	return params.get('code')
}

const issuer = encodeURIComponent(discovery.issuer)
if (acceptCallback(`${REDIRECT_URI}?code=abc&state=${state}&iss=${issuer}`) !== 'abc') throw new Error('valid callback refused')
let forgedAccepted = true
try {
	acceptCallback(`${REDIRECT_URI}?code=abc&state=forged-state&iss=${issuer}`)
} catch {
	forgedAccepted = false
}
if (forgedAccepted) throw new Error('forged state accepted')
console.log('PKCE, state and iss checks work; keep codeVerifier, state and nonce until the callback')

// Full sign-in with VISH for a public client: loopback redirect, PKCE, token exchange, userinfo.
import { createHash, randomBytes } from 'node:crypto'
import { createServer } from 'node:http'

const API = process.env.VISH_API ?? 'https://d1.vish-app.ru/api/v1'
const CLIENT_ID = process.env.VISH_CLIENT_ID
if (!CLIENT_ID) throw new Error('set VISH_CLIENT_ID to your public app id (vc_...)')
const REDIRECT_URI = 'http://127.0.0.1:8080/callback'

const discovery = await (await fetch(`${API}/oauth/.well-known/openid-configuration`)).json()
const codeVerifier = randomBytes(32).toString('base64url')
const state = randomBytes(32).toString('base64url')
const nonce = randomBytes(32).toString('base64url')

const authorizeUrl = new URL(discovery.authorization_endpoint)
authorizeUrl.search = new URLSearchParams({
	response_type: 'code',
	client_id: CLIENT_ID,
	redirect_uri: REDIRECT_URI,
	scope: 'openid profile group',
	state,
	nonce,
	code_challenge: createHash('sha256').update(codeVerifier).digest('base64url'),
	code_challenge_method: 'S256',
}).toString()
console.log(`Open in a browser:\n${authorizeUrl.href}`)

const params = await new Promise((resolve) => {
	const server = createServer((request, response) => {
		const url = new URL(request.url ?? '/', REDIRECT_URI)
		if (url.pathname !== '/callback') return void response.writeHead(404).end()
		response.end('Signed in. You can close this tab.')
		server.close()
		resolve(url.searchParams)
	}).listen(8080, '127.0.0.1')
})

if (params.get('state') !== state) throw new Error('state mismatch: not our request')
if (params.get('iss') !== discovery.issuer) throw new Error('iss mismatch')
if (params.has('error')) throw new Error(`${params.get('error')}: ${params.get('error_description')}`)

const tokenResponse = await fetch(discovery.token_endpoint, {
	method: 'POST',
	headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
	body: new URLSearchParams({
		grant_type: 'authorization_code',
		code: params.get('code') ?? '',
		redirect_uri: REDIRECT_URI,
		client_id: CLIENT_ID,
		code_verifier: codeVerifier,
	}),
})
const tokens = await tokenResponse.json()
if (!tokenResponse.ok) throw new Error(`${tokens.error}: ${tokens.error_description}`)

// Received straight from the token endpoint over TLS, so the claims are checked; the signature can be
// checked too, with the keys at discovery.jwks_uri (ES256).
const claims = JSON.parse(Buffer.from(tokens.id_token.split('.')[1], 'base64url').toString())
if (claims.iss !== discovery.issuer || claims.aud !== CLIENT_ID || claims.nonce !== nonce || claims.exp * 1000 < Date.now()) {
	throw new Error('id_token rejected')
}

const userinfo = await fetch(discovery.userinfo_endpoint, { headers: { Authorization: `Bearer ${tokens.access_token}` } })
if (!userinfo.ok) throw new Error(`userinfo: HTTP ${userinfo.status}`)
console.log(await userinfo.json())

// Protocol errors are RFC 6749 objects: { error, error_description }.
const API = process.env.VISH_API ?? 'https://d1.vish-app.ru/api/v1'

const token = await fetch(`${API}/oauth/token`, {
	method: 'POST',
	headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
	body: new URLSearchParams({
		grant_type: 'authorization_code',
		code: 'made-up-code',
		redirect_uri: 'http://127.0.0.1:8080/callback',
		client_id: 'vc_made_up',
		code_verifier: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
	}),
})
const tokenError = await token.json()
if (token.status !== 401 || tokenError.error !== 'invalid_client') throw new Error(`token: ${token.status} ${JSON.stringify(tokenError)}`)

const userinfo = await fetch(`${API}/oauth/userinfo`)
const userinfoError = await userinfo.json()
if (userinfo.status !== 401 || userinfoError.error !== 'invalid_token') throw new Error(`userinfo: ${userinfo.status}`)

console.log('POST /oauth/token  ->', token.status, tokenError.error)
console.log('GET /oauth/userinfo ->', userinfo.status, userinfoError.error)