Function exchangeCodeForToken

src/xauth.ts:39–77

(code: string, verifier: string)

}

async function exchangeCodeForToken(code: string, verifier: string): Promise<XOAuthTokenSet> {
  const cfg = loadXApiConfig();
  if (!cfg.callbackUrl) {
    throw new Error('Missing X_CALLBACK_URL in .env.local');
  }

  const basic = Buffer.from(`${cfg.clientId}:${cfg.clientSecret}`).toString('base64');
  const body = new URLSearchParams({
    grant_type: 'authorization_code',
    code,
    redirect_uri: cfg.callbackUrl,
    code_verifier: verifier,
    client_id: cfg.clientId,
  });

  const response = await fetch('https://api.x.com/2/oauth2/token', {
    method: 'POST',
    headers: {
      Authorization: `Basic ${basic}`,
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body,
  });

  const text = await response.text();
  const parsed = JSON.parse(text);
  if (!response.ok) {
    throw new Error(`Token exchange failed (HTTP ${response.status}). Check your X API credentials.`);
  }

  return {
    access_token: parsed.access_token,
    refresh_token: parsed.refresh_token,
    expires_in: parsed.expires_in,
    scope: parsed.scope,
    token_type: parsed.token_type,
    obtained_at: new Date().toISOString(),
  };
}

export async function saveTwitterOAuthToken(token: XOAuthTokenSet): Promise<string> {
  ensureDataDir();