Oplyon Partner API

Node.js 18+ (fetch e crypto integrati, nessuna dipendenza):

import crypto from "node:crypto";

const TENANT = "<tenant>.oplyon.com";
const CLIENT_ID = "YOUR_CLIENT_ID";
const CLIENT_SECRET = "YOUR_CLIENT_SECRET";
const REDIRECT_URI = "YOUR_REDIRECT_URI";

function base64url(buf) {
  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
}

// 1. PKCE pair — store codeVerifier server-side, keyed by state, until the callback arrives
const codeVerifier = base64url(crypto.randomBytes(32));
const codeChallenge = base64url(crypto.createHash("sha256").update(codeVerifier).digest());
const state = base64url(crypto.randomBytes(16));

// 2. Redirect the user's browser to this URL
const authorizeUrl = new URL(`https://${TENANT}/connect/authorize`);
authorizeUrl.search = new URLSearchParams({
  response_type: "code",
  client_id: CLIENT_ID,
  redirect_uri: REDIRECT_URI,
  scope: "oplyon.products.read offline_access",
  state,
  code_challenge: codeChallenge,
  code_challenge_method: "S256",
}).toString();

// 3. In your redirect_uri handler, exchange the received ?code=... for tokens
async function exchangeCodeForTokens(code) {
  const res = await fetch(`https://${TENANT}/connect/token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      redirect_uri: REDIRECT_URI,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      code_verifier: codeVerifier,
    }),
  });
  if (!res.ok) throw new Error(`token exchange failed: ${res.status}`);
  return await res.json(); // { access_token, refresh_token, expires_in, ... }
}

// 4. Call an endpoint with the access token
async function listProducts(accessToken, { limit = 50, offset = 0 } = {}) {
  const url = `https://${TENANT}/api/partner/v1/products?limit=${limit}&offset=${offset}`;
  const res = await fetch(url, { headers: { Authorization: `Bearer ${accessToken}` } });
  if (res.status === 401) throw new Error("access token expired or invalid — refresh it");
  if (!res.ok) throw new Error(`API call failed: ${res.status}`);
  return await res.json(); // { items: [...], total, limit, offset }
}

// 5. Refresh when the access token expires (no new consent needed)
async function refreshAccessToken(refreshToken) {
  const res = await fetch(`https://${TENANT}/connect/token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: refreshToken,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
    }),
  });
  if (!res.ok) throw new Error(`refresh failed: ${res.status}`);
  return await res.json();
}

.NET 8 / HttpClient:

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

const string Tenant = "<tenant>.oplyon.com";
const string ClientId = "YOUR_CLIENT_ID";
const string ClientSecret = "YOUR_CLIENT_SECRET";
const string RedirectUri = "YOUR_REDIRECT_URI";

static string Base64Url(byte[] bytes) =>
    Convert.ToBase64String(bytes).Replace('+', '-').Replace('/', '_').TrimEnd('=');

// 1. PKCE pair — keep codeVerifier server-side, keyed by state, until the callback arrives
var codeVerifier = Base64Url(RandomNumberGenerator.GetBytes(32));
var codeChallenge = Base64Url(SHA256.HashData(Encoding.ASCII.GetBytes(codeVerifier)));
var state = Base64Url(RandomNumberGenerator.GetBytes(16));

// 2. Redirect the user's browser here
var authorizeUrl = $"https://{Tenant}/connect/authorize" +
    $"?response_type=code&client_id={ClientId}&redirect_uri={Uri.EscapeDataString(RedirectUri)}" +
    $"&scope=oplyon.products.read+offline_access&state={state}" +
    $"&code_challenge={codeChallenge}&code_challenge_method=S256";

using var http = new HttpClient();

// 3. In your redirect_uri handler, exchange ?code=... for tokens
async Task<JsonDocument> ExchangeCodeAsync(string code)
{
    var form = new Dictionary<string, string>
    {
        ["grant_type"] = "authorization_code",
        ["code"] = code,
        ["redirect_uri"] = RedirectUri,
        ["client_id"] = ClientId,
        ["client_secret"] = ClientSecret,
        ["code_verifier"] = codeVerifier,
    };
    var res = await http.PostAsync($"https://{Tenant}/connect/token", new FormUrlEncodedContent(form));
    res.EnsureSuccessStatusCode();
    return JsonDocument.Parse(await res.Content.ReadAsStringAsync());
}

// 4. Call an endpoint with the access token
async Task<JsonDocument> ListProductsAsync(string accessToken, int limit = 50, int offset = 0)
{
    using var req = new HttpRequestMessage(HttpMethod.Get,
        $"https://{Tenant}/api/partner/v1/products?limit={limit}&offset={offset}");
    req.Headers.Authorization = new("Bearer", accessToken);
    var res = await http.SendAsync(req);
    res.EnsureSuccessStatusCode(); // 401 here means the access token expired — refresh it
    return JsonDocument.Parse(await res.Content.ReadAsStringAsync()); // { items, total, limit, offset }
}

// 5. Refresh when the access token expires (no new consent needed)
async Task<JsonDocument> RefreshAsync(string refreshToken)
{
    var form = new Dictionary<string, string>
    {
        ["grant_type"] = "refresh_token",
        ["refresh_token"] = refreshToken,
        ["client_id"] = ClientId,
        ["client_secret"] = ClientSecret,
    };
    var res = await http.PostAsync($"https://{Tenant}/connect/token", new FormUrlEncodedContent(form));
    res.EnsureSuccessStatusCode();
    return JsonDocument.Parse(await res.Content.ReadAsStringAsync());
}