Connect Quota Wallet

# Use a developer session token from POST /auth/login
curl -X POST https://api.usequota.ai/developers/apps \
  -H "Authorization: Bearer sess_…" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My App",
    "redirect_uris": ["http://localhost:5180/auth/quota/callback"],
    "allowed_scopes": ["credits.read", "credits.spend"]
  }'

# → { "client_id": "quota_client_…", "client_secret": "quota_secret_…", … }
# The client_secret is only shown once. Capture it.

# Required
QUOTA_CLIENT_ID=quota_client_…
QUOTA_CLIENT_SECRET=quota_secret_…
SESSION_SECRET=any-random-32-char-string

import crypto from "node:crypto";

// Trust the reverse proxy so req.protocol returns "https" in production.
app.set("trust proxy", true);

function callbackUrl(req) {
  return `${req.protocol}://${req.get("host")}/auth/quota/callback`;
}

app.get("/auth/quota/connect", (req, res) => {
  if (!req.session?.user) {
    return res.status(401).json({ error: "Sign in first." });
  }
  const state = crypto.randomBytes(32).toString("hex");
  const redirectUri = callbackUrl(req);

  // PKCE: generate a random verifier, hash it to a challenge, stash the
  // verifier on the session for the callback to replay on /oauth/token.
  const verifier = crypto.randomBytes(32).toString("base64url");
  const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");

  req.session.oauthState = state;
  req.session.redirectUri = redirectUri;
  req.session.oauthVerifier = verifier;

  const u = new URL("/oauth/authorize", process.env.QUOTA_BASE_URL || "https://api.usequota.ai");
  u.searchParams.set("response_type", "code");
  u.searchParams.set("client_id", process.env.QUOTA_CLIENT_ID);
  u.searchParams.set("redirect_uri", redirectUri);
  u.searchParams.set("scope", "credits.read credits.spend");
  u.searchParams.set("state", state);
  u.searchParams.set("code_challenge", challenge);
  u.searchParams.set("code_challenge_method", "S256");
  res.redirect(u.toString());
});

app.get("/auth/quota/callback", async (req, res) => {
  const { code, state, error } = req.query;
  if (error)                             return res.redirect(`/?quota_error=${error}`);
  if (!code || !state)                   return res.redirect("/?quota_error=invalid_callback");
  if (state !== req.session?.oauthState) return res.redirect("/?quota_error=state_mismatch");

  // The redirect_uri sent here MUST match what we sent to /authorize.
  // We stashed it (and the PKCE verifier) on the session at connect time.
  const redirectUri = req.session.redirectUri;
  const codeVerifier = req.session.oauthVerifier;
  req.session.oauthState = undefined;
  req.session.redirectUri = undefined;
  req.session.oauthVerifier = undefined;

  const r = await fetch(`${process.env.QUOTA_BASE_URL || "https://api.usequota.ai"}/oauth/token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code: String(code),
      redirect_uri: redirectUri,
      client_id: process.env.QUOTA_CLIENT_ID,
      client_secret: process.env.QUOTA_CLIENT_SECRET,
      code_verifier: codeVerifier,
    }),
  });
  if (!r.ok) return res.redirect("/?quota_error=token_exchange_failed");

  const t = await r.json();
  // Demo: store on the cookie session. Production: store in your DB
  // keyed by your user id (see section 05).
  req.session.quota = {
    access_token: t.access_token,
    refresh_token: t.refresh_token,
    expires_at: Date.now() + t.expires_in * 1000,
  };
  res.redirect("/");
});

import OpenAI from "openai";

app.post("/api/chat", async (req, res) => {
  const token = await getQuotaToken(req);    // refresh if needed
  if (!token) return res.status(401).json({ error: "Wallet not connected." });

  const client = new OpenAI({
    apiKey: token,                            // user's quota_token_… token
    baseURL: `${process.env.QUOTA_BASE_URL}/v1`,
  });

  const completion = await client.chat.completions.create({
    model: req.body.model ?? "gpt-4o-mini",
    messages: req.body.messages ?? [],
  });
  res.json(completion);
});

async function getQuotaToken(req) {
  const t = req.session?.quota;
  if (!t) return null;
  if (Date.now() < t.expires_at - 30_000) return t.access_token;

  const r = await fetch(`${process.env.QUOTA_BASE_URL}/oauth/token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: t.refresh_token,
      client_id: process.env.QUOTA_CLIENT_ID,
      client_secret: process.env.QUOTA_CLIENT_SECRET,
    }),
  });
  if (!r.ok) { req.session.quota = undefined; return null; }
  const fresh = await r.json();
  req.session.quota = {
    access_token: fresh.access_token,
    refresh_token: fresh.refresh_token,
    expires_at: Date.now() + fresh.expires_in * 1000,
  };
  return fresh.access_token;
}