OAuth Integration Guide

// app/api/auth/login/route.ts — start the OAuth flow
import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import crypto from "crypto";

const BASE = "https://makemesafe.antqr.xyz";
const CLIENT_ID = process.env.MAKEMESAFE_CLIENT_ID!;
const REDIRECT_URI = process.env.MAKEMESAFE_REDIRECT_URI!;

export async function GET() {
  const state = crypto.randomBytes(16).toString("hex");
  const verifier = crypto.randomBytes(32).toString("base64url");
  const challenge = crypto
    .createHash("sha256").update(verifier).digest("base64url");

  const store = await cookies();
  store.set("oauth_state", state, { httpOnly: true, sameSite: "lax" });
  store.set("oauth_verifier", verifier, { httpOnly: true, sameSite: "lax" });

  const params = new URLSearchParams({
    client_id: CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    response_type: "code",
    state,
    code_challenge: challenge,
    code_challenge_method: "S256",
  });

  redirect(BASE + "/api/oauth/authorize?" + params);
}

// app/api/auth/callback/route.ts — exchange the code
import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import { NextResponse } from "next/server";

const BASE = "https://makemesafe.antqr.xyz";
const CLIENT_ID = process.env.MAKEMESAFE_CLIENT_ID!;
const CLIENT_SECRET = process.env.MAKEMESAFE_CLIENT_SECRET!;
const REDIRECT_URI = process.env.MAKEMESAFE_REDIRECT_URI!;

export async function GET(request: Request) {
  const { searchParams } = new URL(request.url);
  const code = searchParams.get("code");
  const state = searchParams.get("state");
  const store = await cookies();
  const storedState = store.get("oauth_state")?.value;
  const verifier = store.get("oauth_verifier")?.value;

  if (!code || !state || state !== storedState) {
    return NextResponse.json({ error: "invalid_state" }, { status: 400 });
  }

  const tokenRes = await fetch(BASE + "/api/oauth/token", {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      code,
      grant_type: "authorization_code",
      redirect_uri: REDIRECT_URI,
      code_verifier: verifier ?? "",
    }),
  });
  const data = await tokenRes.json();
  if (!tokenRes.ok) {
    return NextResponse.json({ error: "token_exchange_failed" }, { status: 400 });
  }

  // data.user = { id, name, email, avatarUrl, emailVerified }
  redirect("/welcome?name=" + encodeURIComponent(data.user.name));
}