Function runTwitterOAuthFlow

src/xauth.ts:95–155

()

}

export async function runTwitterOAuthFlow(): Promise<{ tokenPath: string; scope?: string }> {
  const cfg = loadXApiConfig();
  if (!cfg.callbackUrl) {
    throw new Error('Missing X_CALLBACK_URL in .env.local');
  }

  const { url, state, verifier } = buildTwitterOAuthUrl();
  const callback = new URL(cfg.callbackUrl);
  const port = Number(callback.port || 80);
  const pathname = callback.pathname;

  const code = await new Promise<string>((resolve, reject) => {
    const server = http.createServer((req, res) => {
      try {
        const reqUrl = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
        if (reqUrl.pathname !== pathname) {
          res.statusCode = 404;
          res.end('Not found');
          return;
        }

        const returnedState = reqUrl.searchParams.get('state');
        const returnedCode = reqUrl.searchParams.get('code');
        const error = reqUrl.searchParams.get('error');

        if (error) {
          res.statusCode = 400;
          res.end(`OAuth error: ${error}`);
          server.close();
          reject(new Error(`OAuth error: ${error}`));
          return;
        }

        if (!returnedCode || returnedState !== state) {
          res.statusCode = 400;
          res.end('Invalid OAuth callback');
          server.close();
          reject(new Error('Invalid OAuth callback state/code'));
          return;
        }

        res.statusCode = 200;
        res.end('ft auth complete. You can close this tab.');
        server.close();
        resolve(returnedCode);
      } catch (err) {
        server.close();
        reject(err);
      }
    });

    server.listen(port, '127.0.0.1', () => {
      console.log('Open this URL in your browser to authorize X bookmarks access:');
      console.log(url);
    });
  });

  const token = await exchangeCodeForToken(code, verifier);