Sign in with Quota

curl -X POST https://api.usequota.ai/developers/apps \
  -H "Authorization: Bearer sess_…" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My App",
    "redirect_uris": ["http://localhost:5280/auth/quota/callback"],
    "allowed_scopes": [
      "openid", "profile", "email",
      "credits.read", "credits.spend"
    ]
  }'

# Required
QUOTA_CLIENT_ID=quota_client_…
QUOTA_CLIENT_SECRET=quota_secret_…
SESSION_SECRET=any-random-32-char-string

import { createRemoteJWKSet } from "jose";

const r = await fetch(`${process.env.QUOTA_BASE_URL}/.well-known/openid-configuration`);
const doc = await r.json();

export const oidc = {
  issuer: doc.issuer,                                  // verify id_token.iss
  jwks: createRemoteJWKSet(new URL(doc.jwks_uri)),     // verify id_token.signature
  authorize: `${process.env.QUOTA_BASE_URL}/oauth/authorize`,
  token: `${process.env.QUOTA_BASE_URL}/oauth/token`,
  endSession: doc.end_session_endpoint,                // for sign-out
};

import crypto from "node:crypto";

// Trust the reverse proxy so req.protocol returns "https" in production.
app.set("trust proxy", true);

function callbackUrl(req) {
  return `${req.protocol}://${req.get("host")}/auth/quota/callback`;
}

function pkcePair() {
  const verifier = crypto.randomBytes(32).toString("base64url");
  const challenge = crypto.createHash("sha256")
    .update(verifier).digest("base64url");
  return { verifier, challenge };
}

const SCOPES = process.env.QUOTA_SCOPES
  || "openid profile email credits.read credits.spend";

app.get("/auth/quota/start", (req, res) => {
  const state = crypto.randomBytes(16).toString("hex");
  const nonce = crypto.randomBytes(16).toString("hex");
  const { verifier, challenge } = pkcePair();
  const redirectUri = callbackUrl(req);
  req.session.oauth = { state, nonce, verifier, redirectUri };

  const u = new URL(oidc.authorize);
  u.searchParams.set("response_type", "code");
  u.searchParams.set("client_id", process.env.QUOTA_CLIENT_ID);
  u.searchParams.set("redirect_uri", redirectUri);
  u.searchParams.set("scope", SCOPES);
  u.searchParams.set("state", state);
  u.searchParams.set("nonce", nonce);
  u.searchParams.set("code_challenge", challenge);
  u.searchParams.set("code_challenge_method", "S256");
  res.redirect(u.toString());
});

import { jwtVerify } from "jose";

app.get("/auth/quota/callback", async (req, res) => {
  const { code, state } = req.query;
  const stash = req.session?.oauth;
  if (!stash || state !== stash.state)
    return res.redirect("/?quota_error=state_mismatch");
  req.session.oauth = undefined;

  // Exchange code + PKCE verifier for tokens.
  const r = await fetch(oidc.token, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      redirect_uri: stash.redirectUri,
      client_id: process.env.QUOTA_CLIENT_ID,
      client_secret: process.env.QUOTA_CLIENT_SECRET,
      code_verifier: stash.verifier,
    }),
  });
  if (!r.ok) return res.redirect("/?quota_error=token_exchange_failed");
  const tokens = await r.json();

  // Verify the id_token. jose throws on any failure — never log the raw
  // error to the client; it can include token internals.
  let claims;
  try {
    const { payload } = await jwtVerify(tokens.id_token, oidc.jwks, {
      issuer: oidc.issuer,
      audience: process.env.QUOTA_CLIENT_ID,
    });
    if (payload.nonce !== stash.nonce) throw new Error("nonce mismatch");
    claims = payload;
  } catch (err) {
    return res.redirect("/?quota_error=invalid_id_token");
  }

  // Build the app session from the verified claims.
  req.session.user = {
    sub: claims.sub,                  // your stable user id
    email: claims.email,
    name: claims.name ?? null,
    picture: claims.picture ?? null,
  };
  req.session.quota = {
    access_token: tokens.access_token,
    refresh_token: tokens.refresh_token,
    expires_at: Date.now() + tokens.expires_in * 1000,
    id_token: tokens.id_token,        // needed for end-session
  };

  res.redirect("/");
});

import OpenAI from "openai";

app.post("/api/chat", async (req, res) => {
  const token = await getQuotaToken(req);  // refresh if needed
  if (!token) return res.status(401).end();

  const client = new OpenAI({
    apiKey: token,
    baseURL: `${process.env.QUOTA_BASE_URL}/v1`,
  });

  const completion = await client.chat.completions.create({
    model: "gpt-4o-mini",
    messages: req.body.messages,
  });
  res.json(completion);
});

async function getQuotaToken(req) {
  const t = req.session?.quota;
  if (!t) return null;
  if (Date.now() < t.expires_at - 30_000) return t.access_token;

  const r = await fetch(oidc.token, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: t.refresh_token,
      client_id: process.env.QUOTA_CLIENT_ID,
      client_secret: process.env.QUOTA_CLIENT_SECRET,
    }),
  });
  if (!r.ok) { req.session.quota = undefined; return null; }
  const fresh = await r.json();
  req.session.quota = {
    ...t,
    access_token: fresh.access_token,
    refresh_token: fresh.refresh_token,
    expires_at: Date.now() + fresh.expires_in * 1000,
  };
  return fresh.access_token;
}

app.post("/auth/quota/logout", (req, res) => {
  const idToken = req.session?.quota?.id_token;
  const postLogout = `${req.protocol}://${req.get("host")}/`;
  req.session = null;

  if (!idToken) return res.json({ logout_url: "/" });
  const u = new URL(oidc.endSession);
  u.searchParams.set("id_token_hint", idToken);
  u.searchParams.set("post_logout_redirect_uri", postLogout);
  res.json({ logout_url: u.toString() });
});