OAuth Setup

// Server: /api/embed-token endpoint (Step A + Step B)
import { SignJWT, importPKCS8 } from 'jose';
import { readFileSync } from 'fs';

const TOKEN_ENDPOINT = 'https://<cgk2_host>/oauth2/v4/token';
const EC_TOKEN_ENDPOINT = 'https://<ec_host>/sms/v1/tokens';
const CLIENT_ID = '<client_id>';
const ORG_ID = '<your_org>';  // Must be a real portfolio ID
const KEY_ID = '<key_id_from_kms>';

const privateKeyPem = readFileSync('./private-key.pem', 'utf8');
const privateKey = await importPKCS8(privateKeyPem, 'RS256');

app.post('/api/embed-token', async (req, res) => {
  // Step A: Get access_token via client_credentials + private_key_jwt
  const assertion = await new SignJWT({
    scope: 'transaction_search',
    'v-c-merchant-id': 'internal',
    acr: 'voice',
    act: { sub: ORG_ID, org_id: ORG_ID, sub_id: req.user.id },
  })
    .setProtectedHeader({ alg: 'RS256', kid: KEY_ID, typ: 'JWT' })
    .setSubject(CLIENT_ID)
    .setIssuer(ORG_ID)
    .setAudience(TOKEN_ENDPOINT)
    .setIssuedAt()
    .setExpirationTime('5m')
    .setJti(crypto.randomUUID())
    .sign(privateKey);

  const tokenResp = await fetch(TOKEN_ENDPOINT, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'client_credentials',
      client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
      client_assertion: assertion,
      scope: 'transaction_search',
    }),
  });

  const { access_token } = await tokenResp.json();

  // Step B: Exchange access_token for ec_token
  const ecResp = await fetch(EC_TOKEN_ENDPOINT, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': `Bearer ${access_token}`,
    },
    body: new URLSearchParams({
      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
      subject_token: access_token,
      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
      requested_token_type: 'urn:visa:params:oauth:token-type:ec-token',
      component_type: 'transaction_search',
    }),
  });

  const { access_token: ec_token, expires_in } = await ecResp.json();
  res.json({ access_token: ec_token, expires_in });
});

@PostMapping("/api/embed-token")
public ResponseEntity<Map<String, Object>> getEmbedToken() {
    String assertion = Jwts.builder()
        .setHeaderParam("kid", keyId)
        .setSubject(clientId)
        .setIssuer(orgId)
        .setAudience(tokenEndpoint)
        .setIssuedAt(new Date())
        .setExpiration(Date.from(Instant.now().plusSeconds(300)))
        .setId(UUID.randomUUID().toString())
        .claim("scope", "transaction_search")
        .claim("v-c-merchant-id", "internal")
        .signWith(privateKey, SignatureAlgorithm.RS256)
        .compact();

    // Exchange assertion for access token
    MultiValueMap<String, String> body = new LinkedMultiValueMap<>();
    body.add("grant_type", "client_credentials");
    body.add("client_assertion_type",
        "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
    body.add("client_assertion", assertion);

    Map<String, Object> response = restTemplate.postForObject(
        tokenEndpoint, new HttpEntity<>(body, headers), Map.class);

    return ResponseEntity.ok(response);
}

// Frontend: Initialize SDK with OAuth
VisaAcceptance.init({
  auth: {
    type: 'oauth',
    getToken: async () => {
      // Call YOUR backend — never sign JWTs client-side in production
      const resp = await fetch('/api/embed-token', { method: 'POST' });
      const { access_token } = await resp.json();
      return access_token;
    },
    refreshToken: async () => {
      const resp = await fetch('/api/embed-token', { method: 'POST' });
      const { access_token } = await resp.json();
      return access_token;
    },
    expiryBufferSeconds: 60, // Proactive refresh 60s before expiry
  },
});

VisaAcceptance.render('transactions', document.getElementById('container'));