OAuth 2.0 Integration

RegardingWork Hub supports standard OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange) for secure integration with external services.

// Generate PKCE challenge
function generatePKCE() {
    const codeVerifier = btoa(Array.from(crypto.getRandomValues(new Uint8Array(32)), b => String.fromCharCode(b)).join(''));
    const codeChallenge = btoa(String.fromCharCode.apply(null, new Uint8Array(
        crypto.subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier))
    ))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
    
    return { codeVerifier, codeChallenge };
}

// Initiate OAuth flow
function startOAuthFlow() {
    const { codeVerifier, codeChallenge } = generatePKCE();
    const state = crypto.randomUUID();
    
    // Store for later use
    sessionStorage.setItem('oauth_code_verifier', codeVerifier);
    sessionStorage.setItem('oauth_state', state);
    
    // Redirect to Hub
    const params = new URLSearchParams({
        client_id: 'ce',
        response_type: 'code',
        scope: 'profile email',
        redirect_uri: 'https://ce.regardingwork.com/api/auth/callback',
        state: state,
        code_challenge: codeChallenge,
        code_challenge_method: 'S256'
    });
    
    window.location.href = `https://hub.regardingwork.com/api/oauth/authorize?${params}`;
}

// Handle OAuth callback
async function handleOAuthCallback(code, state) {
    const storedState = sessionStorage.getItem('oauth_state');
    const codeVerifier = sessionStorage.getItem('oauth_code_verifier');
    
    if (state !== storedState) {
        throw new Error('Invalid state parameter');
    }
    
    // Exchange code for tokens
    const response = await fetch('https://hub.regardingwork.com/api/oauth/token', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
            grant_type: 'authorization_code',
            code: code,
            redirect_uri: 'https://ce.regardingwork.com/api/auth/callback',
            code_verifier: codeVerifier
        })
    });
    
    const tokens = await response.json();
    
    // Store tokens securely
    localStorage.setItem('access_token', tokens.access_token);
    localStorage.setItem('refresh_token', tokens.refresh_token);
    
    return tokens;
}