Function main

scripts/rest-oauth-test.mjs:31–201

()

}

async function main() {
  console.log(`\n🔑 REST OAuth Test — ${BASE_URL}/api\n`);

  // Step 1: Discover PRM for /api
  console.log('1️⃣  Fetching Protected Resource Metadata for /api...');
  const prmRes = await fetch(`${BASE_URL}/.well-known/oauth-protected-resource/api`);
  if (!prmRes.ok) {
    throw new Error(`PRM fetch failed: ${prmRes.status} ${await prmRes.text()}`);
  }
  const prm = await prmRes.json();
  console.log(`   Resource: ${prm.resource}`);
  console.log(`   Auth server: ${prm.authorization_servers[0]}`);
  console.log(`   Bearer methods: ${prm.bearer_methods_supported?.join(', ')}`);

  // Step 2: Discover AS metadata
  const asUrl = prm.authorization_servers[0];
  console.log('\n2️⃣  Fetching AS Metadata...');
  const asRes = await fetch(`${asUrl}/.well-known/oauth-authorization-server`);
  const as = await asRes.json();
  console.log(`   Token endpoint: ${as.token_endpoint}`);
  console.log(`   Registration: ${as.registration_endpoint}`);

  // Step 3: Dynamic client registration
  console.log('\n3️⃣  Registering dynamic client...');
  const regRes = await fetch(as.registration_endpoint, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      client_name: 'REST OAuth Test Script',
      redirect_uris: [REDIRECT_URI],
      grant_types: ['authorization_code', 'refresh_token'],
      response_types: ['code'],
      token_endpoint_auth_method: 'none',
    }),
  });
  const client = await regRes.json();
  if (!client.client_id) {
    console.error('   ❌ Registration failed:', JSON.stringify(client));
    process.exit(1);
  }
  console.log(`   Client ID: ${client.client_id}`);

  // Step 4: PKCE + authorization URL
  const codeVerifier = base64url(crypto.randomBytes(32));
  const codeChallenge = base64url(crypto.createHash('sha256').update(codeVerifier).digest());
  const state = base64url(crypto.randomBytes(16));

  const authUrl = new URL(as.authorization_endpoint);
  authUrl.searchParams.set('client_id', client.client_id);
  authUrl.searchParams.set('redirect_uri', REDIRECT_URI);
  authUrl.searchParams.set('response_type', 'code');
  authUrl.searchParams.set('scope', 'openid profile email');
  authUrl.searchParams.set('code_challenge', codeChallenge);
  authUrl.searchParams.set('code_challenge_method', 'S256');
  authUrl.searchParams.set('state', state);

  // Step 5: Start callback server and open browser
  console.log('\n4️⃣  Starting callback server and opening browser...');