Autenticación OAuth

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "9f2c8a...",
  "scope": "read_shops read_products read_orders",
  "installation_id": "6710b3c2e4a1f20012ab34cd",
  "store": { "id": "6710b3c2e4a1f20012ab34ce", "name": "Mi Tienda" }
}

{ "error": "invalid_grant", "error_description": "install_limit_reached" }

const crypto = require("crypto");

const API = "https://api.commercy.com.ar";
const CLIENT_ID = process.env.COMMERCY_CLIENT_ID;
const CLIENT_SECRET = process.env.COMMERCY_CLIENT_SECRET;
const REDIRECT_URI = "https://miapp.example.com/callback";

const b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

// 1) Armá la URL de autorización y guardá verifier + state en la sesión del comerciante.
function startInstall() {
  const verifier = b64url(crypto.randomBytes(32)); // 43 caracteres
  const challenge = b64url(crypto.createHash("sha256").update(verifier).digest());
  const state = b64url(crypto.randomBytes(16));
  const url = new URL(`${API}/oauth/apps/authorize`);
  url.search = new URLSearchParams({
    client_id: CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    response_type: "code",
    state,
    code_challenge: challenge,
    code_challenge_method: "S256",
  }).toString();
  return { url: url.toString(), verifier, state };
}

async function tokenRequest(params) {
  const res = await fetch(`${API}/oauth/apps/token`, {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
      Authorization: "Basic " + Buffer.from(`${encodeURIComponent(CLIENT_ID)}:${encodeURIComponent(CLIENT_SECRET)}`).toString("base64"),
    },
    body: new URLSearchParams(params),
  });
  const body = await res.json();
  if (!res.ok) throw new Error(`OAuth ${res.status}: ${body.error} ${body.error_description ?? ""}`);
  return body;
}

// 2) En /callback: verificá el state y canjeá el code.
function exchangeCode({ code, verifier }) {
  return tokenRequest({
    grant_type: "authorization_code",
    code,
    code_verifier: verifier,
    redirect_uri: REDIRECT_URI,
  });
}

// 3) Renová antes de que venza. Guardá SIEMPRE el refresh_token nuevo.
function refresh(refreshToken) {
  return tokenRequest({ grant_type: "refresh_token", refresh_token: refreshToken });
}

module.exports = { startInstall, exchangeCode, refresh };