Koppla din app till Tidvis Sign

https://tidvis.se/api/public/v1/oauth/authorize
  ?client_id=tvapp_xxxxxxxxxxxxxxxx
  &redirect_uri=https%3A%2F%2Fdin-app.se%2Fintegrationer%2Ftidvis-sign%2Fcallback
  &response_type=code
  &scope=agreements%3Aread%20agreements%3Acreate%20agreements%3Asend
  &state=8f3c1d9a2b
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256

https://din-app.se/integrationer/tidvis-sign/callback?code=tvac_...&state=8f3c1d9a2b

curl -X POST https://tidvis.se/api/public/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "tvac_...",
    "code_verifier": "<samma verifier som gav code_challenge>",
    "redirect_uri": "https://din-app.se/integrationer/tidvis-sign/callback",
    "client_id": "tvapp_...",
    "client_secret": "tvsec_..."
  }'

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "expires_at": "2026-01-01T12:00:00.000Z",
  "refresh_token": "tvrt_...",
  "scope": "agreements:read agreements:create agreements:send"
}

curl -X POST https://tidvis.se/api/public/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "tvrt_...",
    "client_id": "tvapp_...",
    "client_secret": "tvsec_..."
  }'

curl https://tidvis.se/api/public/v1/agreements \
  -H "Authorization: Bearer <access_token>"

curl -X POST https://tidvis.se/api/public/v1/oauth/revoke \
  -H "Content-Type: application/json" \
  -d '{"client_id":"tvapp_...","client_secret":"tvsec_...","token":"tvrt_..."}'

import crypto from "node:crypto";

const AUTHORIZE = "https://tidvis.se/api/public/v1/oauth/authorize";
const TOKEN = "https://tidvis.se/api/public/v1/oauth/token";
const CLIENT_ID = process.env.TIDVIS_CLIENT_ID!;
const CLIENT_SECRET = process.env.TIDVIS_CLIENT_SECRET!;
const REDIRECT_URI = "https://din-app.se/integrationer/tidvis-sign/callback";
const SCOPES = "agreements:read agreements:create agreements:send";

const b64url = (b: Buffer) => b.toString("base64url");

// 1. Knappen: skapa PKCE + state, spara i session, skicka vidare.
export function startConnect(session: Record<string, string>) {
  const verifier = b64url(crypto.randomBytes(32));
  const challenge = b64url(crypto.createHash("sha256").update(verifier).digest());
  const state = b64url(crypto.randomBytes(16));
  session["tidvis_verifier"] = verifier;
  session["tidvis_state"] = state;

  const url = new URL(AUTHORIZE);
  url.searchParams.set("client_id", CLIENT_ID);
  url.searchParams.set("redirect_uri", REDIRECT_URI);
  url.searchParams.set("response_type", "code");
  url.searchParams.set("scope", SCOPES);
  url.searchParams.set("state", state);
  url.searchParams.set("code_challenge", challenge);
  url.searchParams.set("code_challenge_method", "S256");
  return url.toString(); // redirecta hit
}

// 2 + 3. Callback: validera state, byt kod mot token.
export async function handleCallback(
  requestUrl: string,
  session: Record<string, string>,
) {
  const q = new URL(requestUrl).searchParams;
  if (q.get("error")) throw new Error(q.get("error_description") ?? q.get("error")!);
  if (!q.get("state") || q.get("state") !== session["tidvis_state"]) {
    throw new Error("Ogiltig state");
  }

  const res = await fetch(TOKEN, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      grant_type: "authorization_code",
      code: q.get("code"),
      code_verifier: session["tidvis_verifier"],
      redirect_uri: REDIRECT_URI,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
    }),
  });
  if (!res.ok) throw new Error(`Token-bytet misslyckades: ${await res.text()}`);
  return (await res.json()) as {
    access_token: string;
    refresh_token: string;
    expires_in: number;
    scope: string;
  };
}