🔐

Mock OAuth2 Server

An application is requesting access

\n\n

Client ID: ${client_id}

Scope: ${scope || \"(none)\"}

Redirect: ${redirect_uri}

\n\n

\n Enter any username & password to simulate login and approve access.\n

\n\n

\n\n`;\n return c.html(html);\n});\n\n// ── POST /oauth/authorize ─────────────────────────────────────────────────────\n// Handles approve/deny, issues auth code, redirects\napp.post(\"/oauth/authorize\", async (c) => {\n const body = await c.req.parseBody();\n const { client_id, redirect_uri, scope, state, action } = body as Record;\n\n const redirectUrl = new URL(redirect_uri);\n\n if (action === \"deny\") {\n redirectUrl.searchParams.set(\"error\", \"access_denied\");\n if (state) redirectUrl.searchParams.set(\"state\", state);\n return c.redirect(redirectUrl.toString(), 302);\n }\n\n const code = randomId(24);\n authCodes[code] = {\n clientId: client_id,\n redirectUri: redirect_uri,\n scope: scope ?? \"\",\n expiresAt: Date.now() + 10 * 60 * 1000, // 10 min\n };\n\n redirectUrl.searchParams.set(\"code\", code);\n if (state) redirectUrl.searchParams.set(\"state\", state);\n return c.redirect(redirectUrl.toString(), 302);\n});\n\n// ── POST /oauth/token ─────────────────────────────────────────────────────────\n// Exchanges auth code for access token\napp.post(\"/oauth/token\", async (c) => {\n const body = await c.req.parseBody();\n const { grant_type, code, redirect_uri, client_id, client_secret, refresh_token } = body as Record;\n\n // Also support Basic auth header\n let resolvedClientId = client_id;\n let resolvedClientSecret = client_secret;\n const authHeader = c.req.header(\"Authorization\");\n if (authHeader?.startsWith(\"Basic \")) {\n const decoded = atob(authHeader.slice(6));\n [resolvedClientId, resolvedClientSecret] = decoded.split(\":\");\n }\n\n if (resolvedClientId !== MOCK_CLIENT_ID || resolvedClientSecret !== MOCK_CLIENT_SECRET) {\n return c.json({ error: \"invalid_client\" }, 401);\n }\n\n if (grant_type === \"authorization_code\") {\n const record = authCodes[code];\n if (!record || record.expiresAt < Date.now()) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n if (record.redirectUri !== redirect_uri) {\n return c.json({ error: \"invalid_grant\", error_description: \"redirect_uri mismatch\" }, 400);\n }\n delete authCodes[code];\n\n const accessToken = randomId(40);\n const refreshTokenVal = randomId(40);\n tokens[accessToken] = { clientId: resolvedClientId, scope: record.scope, expiresAt: Date.now() + 3600_000 };\n\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: refreshTokenVal,\n scope: record.scope,\n });\n }\n\n if (grant_type === \"refresh_token\") {\n // Just issue a new token for any refresh_token (mock)\n const accessToken = randomId(40);\n tokens[accessToken] = { clientId: resolvedClientId, scope: \"\", expiresAt: Date.now() + 3600_000 };\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n scope: \"\",\n });\n }\n\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n});\n\n// ── GET /api/me ───────────────────────────────────────────────────────────────\n// A protected mock resource endpoint\napp.get(\"/api/me\", (c) => {\n const auth = c.req.header(\"Authorization\");\n if (!auth?.startsWith(\"Bearer \")) return c.json({ error: \"unauthorized\" }, 401);\n const token = auth.slice(7);\n const record = tokens[token];\n if (!record || record.expiresAt < Date.now()) return c.json({ error: \"invalid_token\" }, 401);\n\n return c.json({ id: 1, name: \"Test User\", email: \"test@example.com\", scope: record.scope });\n});\n\n// ── GET /api/items ────────────────────────────────────────────────────────────\napp.get(\"/api/items\", (c) => {\n const auth = c.req.header(\"Authorization\");\n if (!auth?.startsWith(\"Bearer \")) return c.json({ error: \"unauthorized\" }, 401);\n const token = auth.slice(7);\n if (!tokens[token] || tokens[token].expiresAt < Date.now()) return c.json({ error: \"invalid_token\" }, 401);\n\n return c.json([\n { id: 1, name: \"Widget A\", price: 9.99 },\n { id: 2, name: \"Widget B\", price: 19.99 },\n { id: 3, name: \"Widget C\", price: 4.99 },\n ]);\n});\n\n// ── GET / — Info page ─────────────────────────────────────────────────────────\napp.get(\"/\", (c) => {\n const base = new URL(c.req.url).origin;\n const html = `\n\n\n \n Mock OAuth2 Server\n \n\n\n

🔐

Mock OAuth2 Server

Use the values below to configure your OAuth2 connection

\n\n

Configuration

\n Authorization URL\n ${base}/oauth/authorize\n

\n Token URL\n ${base}/oauth/token\n

\n Client ID\n mock-client-id\n

\n Client Secret\n mock-client-secret\n

\n Client Authentication\n Send client credentials in body\n

\n\n

Protected API Endpoints

\n GET\n /api/me\n — current user info\n

\n GET\n /api/items\n — list of mock items\n

Send token as: Authorization: Bearer <token>

\n\n

view source

\n\n`;\n return c.html(html);\n});\n\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\nexport default app.fetch;\n","deleted","label",[105],"permalink","https://www.val.town/x/omarestrella/mock-oauth2-server/code/main.ts","extension","actionData","errors"]