Tokens

import { createTassyirApp, type TokenSet, type TokenStore } from '@tassyir/app';

/** Your durable storage: a database table, a key-value store. */
export interface KeyValue {
  get(key: string): Promise<string | undefined>;
  set(key: string, value: string): Promise<void>;
  delete(key: string): Promise<void>;
}

export function createTassyir(kv: KeyValue) {
  // Encrypt the tokens at rest in a real deployment: they are secrets.
  const tokenStore: TokenStore = {
    async get(installationId) {
      const value = await kv.get(`tassyir:tokens:${installationId}`);
      return value === undefined ? undefined : (JSON.parse(value) as TokenSet);
    },
    async set(installationId, tokens) {
      await kv.set(`tassyir:tokens:${installationId}`, JSON.stringify(tokens));
    },
    async delete(installationId) {
      await kv.delete(`tassyir:tokens:${installationId}`);
    },
  };

  return createTassyirApp({
    clientId: setting('TASSYIR_CLIENT_ID'), // app_…
    clientSecret: setting('TASSYIR_CLIENT_SECRET'), // tsy_cs_…
    appId: setting('TASSYIR_APP_ID'), // the numeric id in the console
    tokenStore,
    retries: 3,
  });
}

function setting(name: string): string {
  const value = process.env[name];
  if (!value)
    throw new Error(`Set ${name}: see your app in the developer console`);
  return value;
}

import { TassyirVerificationError } from '@tassyir/app';

// GET /api/business, called by your page with a new ID token as a bearer.
export async function handle(request: Request): Promise<Response> {
  const header = request.headers.get('authorization') ?? '';
  const idToken = /^Bearer (\S+)$/.exec(header)?.[1];
  if (idToken === undefined) return new Response(null, { status: 401 });
  try {
    const { idToken: who } = await tassyir.authenticate(idToken);
    const { data: business } = await tassyir
      .admin(who.installationId)
      .get('/business');
    return Response.json({ business: business.name, user: who.userId });
  } catch (error) {
    if (error instanceof TassyirVerificationError) {
      return new Response(null, { status: 401 }); // not genuine, not yours, or expired
    }
    throw error;
  }
}

export async function ordersForThisPerson(idToken: string) {
  const session = await tassyir.authenticate(idToken, { tokenType: 'online' });
  // An online token is not stored and cannot be refreshed: it lives an hour.
  const admin = tassyir.adminWithToken(session.tokens);
  const { data } = await admin.get('/orders', { query: { limit: 20 } });
  return data;
}

// GET <auth.callback_url>?code=tsy_ic_…
export async function callback(request: Request): Promise<Response> {
  const code = new URL(request.url).searchParams.get('code');
  if (code === null) return new Response('Missing code', { status: 400 });
  const tokens = await tassyir.redeemInstallCode(code); // stored for you
  return new Response(`Installed on business ${tokens.businessId}`);
}

curl https://api.tassyir.io/apps/oauth/token \
  -u "$TASSYIR_CLIENT_ID:$TASSYIR_CLIENT_SECRET" \
  -d grant_type=refresh_token \
  -d refresh_token="$REFRESH_TOKEN"

{
  "access_token": "tsy_at_…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "tsy_rt_…",
  "refresh_token_expires_in": 7776000,
  "scope": "read_orders read_products write_orders",
  "installation_id": "755000000000000001",
  "business_id": "632000000000000001"
}