18c3c37eaf
Add all REST API endpoints for mobile app consumption: Routes: - GET /api/v1/routes — paginated list with cursor, Zod validation - GET /api/v1/routes/:id — full detail with GPX, versions - POST /api/v1/routes — create with Zod-validated body - PUT /api/v1/routes/:id — update, creates new version - DELETE /api/v1/routes/:id — returns 204 Activities: - GET /api/v1/activities — paginated list with cursor - GET /api/v1/activities/:id — full detail - POST /api/v1/activities — create with GPX stat extraction - DELETE /api/v1/activities/:id — returns 204 Supporting: - POST /api/v1/routes/compute — BRouter proxy - POST /api/v1/uploads — presigned upload URL generation Device management: - GET /api/v1/auth/devices — list connected devices with isCurrent - DELETE /api/v1/auth/devices/:id — revoke device token - Store device_name on token exchange Infrastructure: - requireApiUser() guard — returns 401 with structured error - apiError() helper for consistent error responses - All endpoints use Zod schemas from @trails-cool/api for validation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
72 lines
2.2 KiB
TypeScript
72 lines
2.2 KiB
TypeScript
import type { Route } from "./+types/oauth.token";
|
|
import {
|
|
exchangeCodeForTokens,
|
|
refreshAccessToken,
|
|
OAuthError,
|
|
} from "../lib/oauth.server.ts";
|
|
|
|
/**
|
|
* POST /oauth/token
|
|
*
|
|
* OAuth2 token endpoint. Supports two grant types:
|
|
* - authorization_code: Exchange code + PKCE verifier for tokens
|
|
* - refresh_token: Exchange refresh token for new token pair
|
|
*/
|
|
export async function action({ request }: Route.ActionArgs) {
|
|
if (request.method !== "POST") {
|
|
return new Response(null, { status: 405 });
|
|
}
|
|
|
|
const body = await request.formData();
|
|
const grantType = body.get("grant_type") as string | null;
|
|
|
|
try {
|
|
if (grantType === "authorization_code") {
|
|
const code = body.get("code") as string | null;
|
|
const clientId = body.get("client_id") as string | null;
|
|
const redirectUri = body.get("redirect_uri") as string | null;
|
|
const codeVerifier = body.get("code_verifier") as string | null;
|
|
|
|
if (!code || !clientId || !redirectUri || !codeVerifier) {
|
|
return oauthErrorResponse("invalid_request", "Missing required parameters");
|
|
}
|
|
|
|
const deviceName = body.get("device_name") as string | null;
|
|
const tokens = await exchangeCodeForTokens({
|
|
code,
|
|
clientId,
|
|
redirectUri,
|
|
codeVerifier,
|
|
deviceName: deviceName ?? undefined,
|
|
});
|
|
|
|
return Response.json(tokens);
|
|
}
|
|
|
|
if (grantType === "refresh_token") {
|
|
const refreshToken = body.get("refresh_token") as string | null;
|
|
const clientId = body.get("client_id") as string | null;
|
|
|
|
if (!refreshToken || !clientId) {
|
|
return oauthErrorResponse("invalid_request", "Missing required parameters");
|
|
}
|
|
|
|
const tokens = await refreshAccessToken({ refreshToken, clientId });
|
|
return Response.json(tokens);
|
|
}
|
|
|
|
return oauthErrorResponse("unsupported_grant_type", `Unsupported grant type: ${grantType}`);
|
|
} catch (err) {
|
|
if (err instanceof OAuthError) {
|
|
return oauthErrorResponse(err.code, err.message);
|
|
}
|
|
throw err;
|
|
}
|
|
}
|
|
|
|
function oauthErrorResponse(error: string, description: string) {
|
|
return Response.json(
|
|
{ error, error_description: description },
|
|
{ status: 400 },
|
|
);
|
|
}
|