API documentation.

// === PKCE Helper ===
async function generatePKCE() {
  const verifier = crypto.randomUUID() + crypto.randomUUID();
  const hash = await crypto.subtle.digest(
    'SHA-256', new TextEncoder().encode(verifier)
  );
  const challenge = btoa(String.fromCharCode(...new Uint8Array(hash)))
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
  return { verifier, challenge };
}

// === Step 1: Start OAuth Flow ===
async function signInWithEasyLegal() {
  const { verifier, challenge } = await generatePKCE();
  sessionStorage.setItem('pkce_verifier', verifier);

  const state = crypto.randomUUID();
  sessionStorage.setItem('oauth_state', state);

  window.location.href = 'https://easylegal-ai.com/oauth/authorize?' +
    new URLSearchParams({
      response_type: 'code',
      client_id: 'YOUR_CLIENT_ID',
      redirect_uri: window.location.origin + '/callback',
      scope: 'profile documents:read templates:read',
      state,
      code_challenge: challenge,
      code_challenge_method: 'S256',
    });
}

// === Step 2: Handle Callback ===
async function handleCallback() {
  const params = new URLSearchParams(window.location.search);

  // CSRF check
  if (params.get('state') !== sessionStorage.getItem('oauth_state')) {
    throw new Error('State mismatch — possible CSRF attack');
  }

  // Check for errors
  if (params.get('error')) {
    throw new Error(params.get('error_description') || params.get('error'));
  }

  const res = await fetch('https://rygushwlvmieeahockgj.supabase.co/functions/v1/oauth-token', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'apikey': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJ5Z3VzaHdsdm1pZWVhaG9ja2dqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTIwNjA4NTUsImV4cCI6MjA2NzYzNjg1NX0.H1oA1NBWwZ19Ka0KQj38aYl_uPttI4sDmMdtmaL5s8Y',
    },
    body: JSON.stringify({
      grant_type: 'authorization_code',
      code: params.get('code'),
      redirect_uri: window.location.origin + '/callback',
      client_id: 'YOUR_CLIENT_ID',
      code_verifier: sessionStorage.getItem('pkce_verifier'),
    }),
  });

  if (!res.ok) {
    const err = await res.json();
    throw new Error(err.error_description || err.error);
  }

  return res.json();
  // { access_token, refresh_token, expires_in, scope }
}

// === Step 3: Fetch User Data ===
async function getUserProfile(accessToken: string) {
  const res = await fetch('https://rygushwlvmieeahockgj.supabase.co/functions/v1/oauth-userinfo', {
    headers: {
      'Authorization': 'Bearer ' + accessToken,
      'apikey': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJ5Z3VzaHdsdm1pZWVhaG9ja2dqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTIwNjA4NTUsImV4cCI6MjA2NzYzNjg1NX0.H1oA1NBWwZ19Ka0KQj38aYl_uPttI4sDmMdtmaL5s8Y',
    },
  });
  return res.json();
  // { sub, email, name, picture, plan, documents, templates, ... }
}

// === Step 4: Refresh Token ===
async function refreshTokens(refreshToken: string) {
  const res = await fetch('https://rygushwlvmieeahockgj.supabase.co/functions/v1/oauth-token', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'apikey': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJ5Z3VzaHdsdm1pZWVhaG9ja2dqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTIwNjA4NTUsImV4cCI6MjA2NzYzNjg1NX0.H1oA1NBWwZ19Ka0KQj38aYl_uPttI4sDmMdtmaL5s8Y',
    },
    body: JSON.stringify({
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: 'YOUR_CLIENT_ID',
    }),
  });
  return res.json();
}

import requests

API_BASE = "https://rygushwlvmieeahockgj.supabase.co/functions/v1"
ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJ5Z3VzaHdsdm1pZWVhaG9ja2dqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTIwNjA4NTUsImV4cCI6MjA2NzYzNjg1NX0.H1oA1NBWwZ19Ka0KQj38aYl_uPttI4sDmMdtmaL5s8Y"
CLIENT_ID = "YOUR_CLIENT_ID"
CLIENT_SECRET = "YOUR_CLIENT_SECRET"

def exchange_code(auth_code: str, redirect_uri: str) -> dict:
    """Exchange authorization code for access + refresh tokens."""
    response = requests.post(
        f"{API_BASE}/oauth-token",
        headers={"apikey": ANON_KEY},
        json={
            "grant_type": "authorization_code",
            "code": auth_code,
            "redirect_uri": redirect_uri,
            "client_id": CLIENT_ID,
            "client_secret": CLIENT_SECRET,
        },
    )
    response.raise_for_status()
    return response.json()

def get_user_info(access_token: str) -> dict:
    """Fetch user profile and data based on granted scopes."""
    response = requests.get(
        f"{API_BASE}/oauth-userinfo",
        headers={
            "Authorization": f"Bearer {access_token}",
            "apikey": ANON_KEY,
        },
    )
    response.raise_for_status()
    return response.json()

def refresh_tokens(refresh_token: str) -> dict:
    """Refresh an expired access token."""
    response = requests.post(
        f"{API_BASE}/oauth-token",
        headers={"apikey": ANON_KEY},
        json={
            "grant_type": "refresh_token",
            "refresh_token": refresh_token,
            "client_id": CLIENT_ID,
        },
    )
    response.raise_for_status()
    return response.json()

def revoke_token(token: str) -> None:
    """Revoke an access or refresh token."""
    requests.post(
        f"{API_BASE}/oauth-revoke",
        headers={"apikey": ANON_KEY},
        json={"token": token},
    )

# --- Usage ---
tokens = exchange_code("AUTH_CODE_FROM_CALLBACK", "https://yourapp.com/callback")
user = get_user_info(tokens["access_token"])
print(f"Welcome, {user['name']}! Plan: {user['plan']}")
print(f"Documents: {len(user.get('documents', []))}")

# Exchange authorization code for tokens
curl -X POST https://rygushwlvmieeahockgj.supabase.co/functions/v1/oauth-token \
  -H "Content-Type: application/json" \
  -H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJ5Z3VzaHdsdm1pZWVhaG9ja2dqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTIwNjA4NTUsImV4cCI6MjA2NzYzNjg1NX0.H1oA1NBWwZ19Ka0KQj38aYl_uPttI4sDmMdtmaL5s8Y" \
  -d '{
    "grant_type": "authorization_code",
    "code": "AUTH_CODE",
    "redirect_uri": "https://yourapp.com/callback",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

# Fetch user info with access token
curl https://rygushwlvmieeahockgj.supabase.co/functions/v1/oauth-userinfo \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJ5Z3VzaHdsdm1pZWVhaG9ja2dqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTIwNjA4NTUsImV4cCI6MjA2NzYzNjg1NX0.H1oA1NBWwZ19Ka0KQj38aYl_uPttI4sDmMdtmaL5s8Y"

# Refresh expired token
curl -X POST https://rygushwlvmieeahockgj.supabase.co/functions/v1/oauth-token \
  -H "Content-Type: application/json" \
  -H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJ5Z3VzaHdsdm1pZWVhaG9ja2dqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTIwNjA4NTUsImV4cCI6MjA2NzYzNjg1NX0.H1oA1NBWwZ19Ka0KQj38aYl_uPttI4sDmMdtmaL5s8Y" \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "YOUR_REFRESH_TOKEN",
    "client_id": "YOUR_CLIENT_ID"
  }'

# Revoke a token
curl -X POST https://rygushwlvmieeahockgj.supabase.co/functions/v1/oauth-revoke \
  -H "Content-Type: application/json" \
  -H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJ5Z3VzaHdsdm1pZWVhaG9ja2dqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTIwNjA4NTUsImV4cCI6MjA2NzYzNjg1NX0.H1oA1NBWwZ19Ka0KQj38aYl_uPttI4sDmMdtmaL5s8Y" \
  -d '{"token": "TOKEN_TO_REVOKE", "token_type_hint": "access_token"}'