Login with Locke

// Generate PKCE challenge
async function generatePKCE() {
  const verifier = crypto.randomUUID() + crypto.randomUUID();
  const hash = await crypto.subtle.digest('SHA-256',
    new TextEncoder().encode(verifier));
  const challenge = btoa(String.fromCharCode(...new Uint8Array(hash)))
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
  return { verifier, challenge };
}

// Start login
async function loginWithLocke() {
  const { verifier, challenge } = await generatePKCE();
  const state = crypto.randomUUID();

  sessionStorage.setItem('pkce_verifier', verifier);
  sessionStorage.setItem('oauth_state', state);

  const params = new URLSearchParams({
    client_id: 'YOUR_CLIENT_ID',
    redirect_uri: 'https://yourapp.com/callback',
    response_type: 'code',
    scope: 'openid profile email',
    state, code_challenge: challenge,
    code_challenge_method: 'S256'
  });

  window.location.href = `https://app.locke.id/oauth/consent?${params}`;
}

// Handle callback
async function handleCallback() {
  const params = new URLSearchParams(window.location.search);
  if (params.get('state') !== sessionStorage.getItem('oauth_state'))
    throw new Error('Invalid state');

  const tokens = await fetch('https://api.locke.id/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: params.get('code'),
      redirect_uri: 'https://yourapp.com/callback',
      client_id: 'YOUR_CLIENT_ID',
      code_verifier: sessionStorage.getItem('pkce_verifier')
    })
  }).then(r => r.json());

  // Fetch user profile
  const user = await fetch('https://api.locke.id/oauth/userinfo', {
    headers: { 'Authorization': `Bearer ${tokens.access_token}` }
  }).then(r => r.json());
}

package main

import (
    "crypto/rand"
    "crypto/sha256"
    "encoding/base64"
    "encoding/json"
    "net/http"
    "net/url"
)

const (
    clientID     = "YOUR_CLIENT_ID"
    redirectURI  = "https://yourapp.com/callback"
    authorizeURL = "https://app.locke.id/oauth/consent"
    tokenURL     = "https://api.locke.id/oauth/token"
    userInfoURL  = "https://api.locke.id/oauth/userinfo"
)

func generatePKCE() (string, string) {
    bytes := make([]byte, 64)
    rand.Read(bytes)
    verifier := base64.RawURLEncoding.EncodeToString(bytes)[:64]
    hash := sha256.Sum256([]byte(verifier))
    challenge := base64.RawURLEncoding.EncodeToString(hash[:])
    return verifier, challenge
}

func handleLogin(w http.ResponseWriter, r *http.Request) {
    verifier, challenge := generatePKCE()
    state := base64.RawURLEncoding.EncodeToString(make([]byte, 32))[:32]

    http.SetCookie(w, &http.Cookie{Name: "pkce", Value: verifier, HttpOnly: true})
    http.SetCookie(w, &http.Cookie{Name: "state", Value: state, HttpOnly: true})

    params := url.Values{
        "client_id":             {clientID},
        "redirect_uri":          {redirectURI},
        "response_type":         {"code"},
        "scope":                 {"openid profile email"},
        "state":                 {state},
        "code_challenge":        {challenge},
        "code_challenge_method": {"S256"},
    }
    http.Redirect(w, r, authorizeURL+"?"+params.Encode(), http.StatusFound)
}

func handleCallback(w http.ResponseWriter, r *http.Request) {
    stateCookie, _ := r.Cookie("state")
    if r.URL.Query().Get("state") != stateCookie.Value {
        http.Error(w, "Invalid state", http.StatusBadRequest)
        return
    }
    verifierCookie, _ := r.Cookie("pkce")

    resp, _ := http.PostForm(tokenURL, url.Values{
        "grant_type":    {"authorization_code"},
        "code":          {r.URL.Query().Get("code")},
        "redirect_uri": {redirectURI},
        "client_id":    {clientID},
        "code_verifier": {verifierCookie.Value},
    })
    defer resp.Body.Close()

    var tokens struct {
        AccessToken string `json:"access_token"`
        IDToken     string `json:"id_token"`
    }
    json.NewDecoder(resp.Body).Decode(&tokens)
    // Use tokens.AccessToken to call /oauth/userinfo
}

import hashlib, secrets, base64, requests
from flask import Flask, redirect, request, session

app = Flask(__name__)
app.secret_key = secrets.token_hex(32)

CLIENT_ID = "YOUR_CLIENT_ID"
REDIRECT_URI = "https://yourapp.com/callback"
AUTHORIZE_URL = "https://app.locke.id/oauth/consent"
TOKEN_URL = "https://api.locke.id/oauth/token"
USERINFO_URL = "https://api.locke.id/oauth/userinfo"

def generate_pkce():
    verifier = secrets.token_urlsafe(64)[:64]
    challenge = base64.urlsafe_b64encode(
        hashlib.sha256(verifier.encode()).digest()
    ).rstrip(b"=").decode()
    return verifier, challenge

@app.route("/login")
def login():
    verifier, challenge = generate_pkce()
    state = secrets.token_urlsafe(32)
    session["pkce_verifier"] = verifier
    session["oauth_state"] = state

    params = {
        "client_id": CLIENT_ID,
        "redirect_uri": REDIRECT_URI,
        "response_type": "code",
        "scope": "openid profile email",
        "state": state,
        "code_challenge": challenge,
        "code_challenge_method": "S256",
    }
    return redirect(f"{AUTHORIZE_URL}?{requests.compat.urlencode(params)}")

@app.route("/callback")
def callback():
    if request.args.get("state") != session.get("oauth_state"):
        return "Invalid state", 400

    tokens = requests.post(TOKEN_URL, data={
        "grant_type": "authorization_code",
        "code": request.args.get("code"),
        "redirect_uri": REDIRECT_URI,
        "client_id": CLIENT_ID,
        "code_verifier": session["pkce_verifier"],
    }).json()

    user = requests.get(USERINFO_URL, headers={
        "Authorization": f"Bearer {tokens['access_token']}"
    }).json()

    return f"Welcome, {user.get('name', user['sub'])}!"

const express = require('express');
const crypto = require('crypto');
const session = require('express-session');

const app = express();
app.use(session({ secret: crypto.randomBytes(32).toString('hex'), resave: false, saveUninitialized: false }));

const CLIENT_ID = 'YOUR_CLIENT_ID';
const REDIRECT_URI = 'https://yourapp.com/callback';
const AUTHORIZE_URL = 'https://app.locke.id/oauth/consent';
const TOKEN_URL = 'https://api.locke.id/oauth/token';
const USERINFO_URL = 'https://api.locke.id/oauth/userinfo';

function generatePKCE() {
  const verifier = crypto.randomBytes(64).toString('base64url').slice(0, 64);
  const challenge = crypto.createHash('sha256')
    .update(verifier).digest('base64url');
  return { verifier, challenge };
}

app.get('/login', (req, res) => {
  const { verifier, challenge } = generatePKCE();
  const state = crypto.randomUUID();
  req.session.pkceVerifier = verifier;
  req.session.oauthState = state;

  const params = new URLSearchParams({
    client_id: CLIENT_ID, redirect_uri: REDIRECT_URI,
    response_type: 'code', scope: 'openid profile email',
    state, code_challenge: challenge, code_challenge_method: 'S256',
  });
  res.redirect(`${AUTHORIZE_URL}?${params}`);
});

app.get('/callback', async (req, res) => {
  if (req.query.state !== req.session.oauthState)
    return res.status(400).send('Invalid state');

  const tokens = await fetch(TOKEN_URL, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: req.query.code, redirect_uri: REDIRECT_URI,
      client_id: CLIENT_ID, code_verifier: req.session.pkceVerifier,
    }),
  }).then(r => r.json());

  const user = await fetch(USERINFO_URL, {
    headers: { 'Authorization': `Bearer ${tokens.access_token}` },
  }).then(r => r.json());

  res.send(`Welcome, ${user.name || user.sub}!`);
});

app.listen(3000);