Connect an app with one click

import { createHash, randomBytes } from 'node:crypto';
import { VocalStack } from '@vocalstack/sdk';

const DASHBOARD = process.env.VOCALSTACK_DASHBOARD_URL ?? 'https://app.vocalstack.com';
const REDIRECT_URI = 'https://example.com/api/vocalstack/callback';
// One sign-in in flight; keep these in your session store instead.
const pending = new Map<string, string>();

export function connectUrl(): string {
  const state = randomBytes(24).toString('base64url');
  const verifier = randomBytes(48).toString('base64url');
  pending.set(state, verifier);
  const url = new URL('/connect', DASHBOARD);
  url.search = new URLSearchParams({
    response_type: 'code',
    client_name: 'example.com (My CMS)',
    redirect_uri: REDIRECT_URI,
    state,
    code_challenge: createHash('sha256').update(verifier).digest('base64url'),
    code_challenge_method: 'S256',
    scope: 'read write',
  }).toString();
  return url.toString();
}

export async function callback(query: URLSearchParams): Promise<string> {
  const verifier = pending.get(query.get('state') ?? '');
  pending.delete(query.get('state') ?? '');
  if (!verifier) throw new Error('unknown or reused state');
  if (query.get('error')) throw new Error(`not connected: ${query.get('error')}`);

  const vs = new VocalStack({ baseUrl: 'https://api.vocalstack.com' });
  const token = await vs.connect.token({ code: query.get('code') ?? '', codeVerifier: verifier, redirectUri: REDIRECT_URI });
  console.log(`connected to ${token.account.name} (${token.scope})`);

  const me = await new VocalStack({ baseUrl: 'https://api.vocalstack.com', apiKey: token.access_token }).me.get();
  console.log(me.apiKeyId === token.key_id);
  return token.access_token;
}

import base64
import hashlib
import os
import secrets
from urllib.parse import urlencode

from vocalstack import VocalStack

DASHBOARD = os.environ.get("VOCALSTACK_DASHBOARD_URL", "https://app.vocalstack.com")
REDIRECT_URI = "https://example.com/api/vocalstack/callback"
# One sign-in in flight; keep these in your session store instead.
pending: dict[str, str] = {}


def connect_url() -> str:
    state = secrets.token_urlsafe(24)
    verifier = secrets.token_urlsafe(48)
    pending[state] = verifier
    challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
    return f"{DASHBOARD}/connect?" + urlencode({
        "response_type": "code",
        "client_name": "example.com (My CMS)",
        "redirect_uri": REDIRECT_URI,
        "state": state,
        "code_challenge": challenge,
        "code_challenge_method": "S256",
        "scope": "read write",
    })


async def callback(query: dict[str, str]) -> str:
    verifier = pending.pop(query.get("state", ""), None)
    if verifier is None:
        raise RuntimeError("unknown or reused state")
    if "error" in query:
        raise RuntimeError(f"not connected: {query['error']}")

    async with VocalStack("https://api.vocalstack.com") as vs:
        token = await vs.connect.token(code=query.get("code", ""), code_verifier=verifier, redirect_uri=REDIRECT_URI)
    print(f"connected to {token['account']['name']} ({token['scope']})")

    async with VocalStack("https://api.vocalstack.com", api_key=token["access_token"]) as vs:
        me = await vs.me.get()
        print(me["apiKeyId"] == token["key_id"])
    return token["access_token"]

#!/usr/bin/env bash
# curl, openssl and jq, no SDK.
set -euo pipefail
API=https://api.vocalstack.com
DASHBOARD=${VOCALSTACK_DASHBOARD_URL:-https://app.vocalstack.com}
REDIRECT_URI=https://example.com/api/vocalstack/callback

STATE=$(openssl rand -base64 24 | tr '+/' '-_' | tr -d '=')
VERIFIER=$(openssl rand -base64 48 | tr '+/' '-_' | tr -d '=\n')
CHALLENGE=$(printf %s "$VERIFIER" | openssl dgst -sha256 -binary | openssl base64 | tr '+/' '-_' | tr -d '=')
echo "Open: $DASHBOARD/connect?response_type=code&client_name=My%20script&redirect_uri=$(jq -rn --arg u "$REDIRECT_URI" '$u|@uri')&state=$STATE&code_challenge=$CHALLENGE&code_challenge_method=S256&scope=read%20write"

read -rp "Paste the code from the address you were sent back to: " CODE

TOKEN=$(curl -sS "$API/v1/connect/token" \
  --data-urlencode grant_type=authorization_code \
  --data-urlencode "code=$CODE" \
  --data-urlencode "code_verifier=$VERIFIER" \
  --data-urlencode "redirect_uri=$REDIRECT_URI")
jq '{token_type, key_id, scope, account, error, error_description}' <<<"$TOKEN"

curl -sSf "$API/v1/me" -H "Authorization: Bearer $(jq -r .access_token <<<"$TOKEN")" | jq '{principalId, apiKeyId, scopes}'