Connect external applications with OAuth

php artisan migrate
npm run build

php artisan oauth:client "My external app" \
  --redirect-uri="https://my-app.example/oauth/askmydocs/callback" \
  --scope="kb:read" --scope="kb:chat"

import { randomBytes, createHash } from 'node:crypto';

const verifier = randomBytes(32).toString('base64url');
const state = randomBytes(32).toString('base64url');
const challenge = createHash('sha256').update(verifier).digest('base64url');

// Persist in the external application's session; expire after 10 minutes.
req.session.askmydocs = { verifier, state, startedAt: Date.now() };

const params = new URLSearchParams({
  client_id: process.env.ASKMYDOCS_CLIENT_ID,
  redirect_uri: 'https://my-app.example/oauth/askmydocs/callback',
  response_type: 'code',
  scope: 'kb:read kb:chat',
  state,
  code_challenge: challenge,
  code_challenge_method: 'S256',
});

res.redirect(`https://askmydocsdev.test/oauth/authorize?${params}`);

const pending = req.session.askmydocs;
delete req.session.askmydocs;
const issuer = 'https://askmydocsdev.test';

if (!pending || typeof req.query.state !== 'string' ||
    req.query.state !== pending.state || req.query.iss !== issuer ||
    Date.now() - pending.startedAt > 10 * 60 * 1000) {
  return res.status(400).send('Invalid or expired connection attempt');
}
if (req.query.error) return res.status(400).send('Connection was not authorised');
if (typeof req.query.code !== 'string') return res.status(400).send('Missing code');

const response = await fetch(`${issuer}/oauth/token`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
  body: new URLSearchParams({
    grant_type: 'authorization_code',
    client_id: process.env.ASKMYDOCS_CLIENT_ID,
    redirect_uri: 'https://my-app.example/oauth/askmydocs/callback',
    code: req.query.code,
    code_verifier: pending.verifier,
  }),
});
const result = await response.json();
if (!response.ok) return res.status(400).send('Unable to connect AskMyDocs');

// Save result.access_token, result.tenant_id and the calculated expiry in
// your encrypted credential store, bound to the signed-in external user.
// Never log the token or put it into a redirect URL.

{
  "access_token": "<Sanctum API key>",
  "token_type": "Bearer",
  "expires_in": 2592000,
  "scope": "kb:read kb:chat",
  "tenant_id": "acme"
}

curl https://askmydocsdev.test/oauth/userinfo \
  -H "Authorization: Bearer $ASKMYDOCS_API_KEY"

await fetch(`${issuer}/oauth/revoke`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({ client_id: clientId, token: apiKey }),
});

php artisan oauth:client-disable <client-id>