using System.Security.Claims;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Identity.Web;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization().AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => {
        options.Authority = "https://auth.localhost.direct";
        options.Audience = "my-awesome-api";
    });

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/", (ClaimsPrincipal user) => user.Claims.Select(c => new KeyValuePair<string, string>(c.Type, c.Value)).ToList());

app.Run();

     +--------+                               +---------------+
     |        |--(A)- Authorization Request ->|   Resource    |
     |        |                               |     Owner     |
     |        |<-(B)-- Authorization Grant ---|               |
     |        |                               +---------------+
     |        |
     |        |                               +---------------+
     |        |--(C)-- Authorization Grant -->| Authorization |
     | Client |                               |     Server    |
     |        |<-(D)----- Access Token -------|               |
     |        |                               +---------------+
     |        |
     |        |                               +---------------+
     |        |--(E)----- Access Token ------>|    Resource   |
     |        |                               |     Server    |
     |        |<-(F)--- Protected Resource ---|               |
     +--------+                               +---------------+

                     Figure 1: Abstract Protocol Flow

  +--------+                                           +---------------+
  |        |--(A)------- Authorization Grant --------->|               |
  |        |                                           |               |
  |        |<-(B)----------- Access Token -------------|               |
  |        |               & Refresh Token             |               |
  |        |                                           |               |
  |        |                            +----------+   |               |
  |        |--(C)---- Access Token ---->|          |   |               |
  |        |                            |          |   |               |
  |        |<-(D)- Protected Resource --| Resource |   | Authorization |
  | Client |                            |  Server  |   |     Server    |
  |        |--(E)---- Access Token ---->|          |   |               |
  |        |                            |          |   |               |
  |        |<-(F)- Invalid Token Error -|          |   |               |
  |        |                            +----------+   |               |
  |        |                                           |               |
  |        |--(G)----------- Refresh Token ----------->|               |
  |        |                                           |               |
  |        |<-(H)----------- Access Token -------------|               |
  +--------+           & Optional Refresh Token        +---------------+

               Figure 2: Refreshing an Expired Access Token

     +----------+
     | Resource |
     |   Owner  |
     |          |
     +----------+
          ^
          |
         (B)
     +----|-----+          Client Identifier      +---------------+
     |         -+----(A)-- & Redirection URI ---->|               |
     |  User-   |                                 | Authorization |
     |  Agent  -+----(B)-- User authenticates --->|     Server    |
     |          |                                 |               |
     |         -+----(C)-- Authorization Code ---<|               |
     +-|----|---+                                 +---------------+
       |    |                                         ^      v
      (A)  (C)                                        |      |
       |    |                                         |      |
       ^    v                                         |      |
     +---------+                                      |      |
     |         |>---(D)-- Authorization Code ---------'      |
     |  Client |          & Redirection URI                  |
     |         |                                             |
     |         |<---(E)----- Access Token -------------------'
     +---------+       (w/ Optional Refresh Token)

   Note: The lines illustrating steps (A), (B), and (C) are broken into
   two parts as they pass through the user-agent.

                     Figure 3: Authorization Code Flow

GET /authorize?response_type=code&client_id=s6BhdRkqt3&state=xyz&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1
Host: server.example.com

HTTP/1.1 302 Found
Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA&state=xyz

HTTP/1.1 302 Found
Location: https://client.example.com/cb?error=access_denied&state=xyz

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
  "access_token":"2YotnFZFEjr1zCsicMWpAA",
  "token_type":"example",
  "expires_in":3600,
  "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
  "example_parameter":"example_value"
}

 +----------+
     | Resource |
     |  Owner   |
     |          |
     +----------+
          ^
          |
         (B)
     +----|-----+          Client Identifier     +---------------+
     |         -+----(A)-- & Redirection URI --->|               |
     |  User-   |                                | Authorization |
     |  Agent  -|----(B)-- User authenticates -->|     Server    |
     |          |                                |               |
     |          |<---(C)--- Redirection URI ----<|               |
     |          |          with Access Token     +---------------+
     |          |            in Fragment
     |          |                                +---------------+
     |          |----(D)--- Redirection URI ---->|   Web-Hosted  |
     |          |          without Fragment      |     Client    |
     |          |                                |    Resource   |
     |     (F)  |<---(E)------- Script ---------<|               |
     |          |                                +---------------+
     +-|--------+
       |    |
      (A)  (G) Access Token
       |    |
       ^    v
     +---------+
     |         |
     |  Client |
     |         |
     +---------+

   Note: The lines illustrating steps (A) and (B) are broken into two
   parts as they pass through the user-agent.

                       Figure 4: Implicit Grant Flow

GET /authorize?response_type=token&client_id=s6BhdRkqt3&state=xyz&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1
Host: server.example.com

HTTP/1.1 302 Found
Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA&state=xyz&token_type=example&expires_in=3600

HTTP/1.1 302 Found
Location: https://client.example.com/cb#error=access_denied&state=xyz

     +----------+
     | Resource |
     |  Owner   |
     |          |
     +----------+
          v
          |    Resource Owner
         (A) Password Credentials
          |
          v
     +---------+                                  +---------------+
     |         |>--(B)---- Resource Owner ------->|               |
     |         |         Password Credentials     | Authorization |
     | Client  |                                  |     Server    |
     |         |<--(C)---- Access Token ---------<|               |
     |         |    (w/ Optional Refresh Token)   |               |
     +---------+                                  +---------------+

            Figure 5: Resource Owner Password Credentials Flow

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=johndoe&password=A3ddj3w

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
  "access_token":"2YotnFZFEjr1zCsicMWpAA",
  "token_type":"example",
  "expires_in":3600,
  "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
  "example_parameter":"example_value"
}

     +---------+                                  +---------------+
     |         |                                  |               |
     |         |>--(A)- Client Authentication --->| Authorization |
     | Client  |                                  |     Server    |
     |         |<--(B)---- Access Token ---------<|               |
     |         |                                  |               |
     +---------+                                  +---------------+

                     Figure 6: Client Credentials Flow

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
  "access_token":"2YotnFZFEjr1zCsicMWpAA",
  "token_type":"example",
  "expires_in":3600,
  "example_parameter":"example_value"
}

POST /token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-
bearer&assertion=PEFzc2VydGlvbiBJc3N1ZUluc3RhbnQ9IjIwMTEtMDU
[...omitted for brevity...]aG5TdGF0ZW1lbnQ-PC9Bc3NlcnRpb24-

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
  "access_token":"2YotnFZFEjr1zCsicMWpAA",
  "token_type":"example",
  "expires_in":3600,
  "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
  "example_parameter":"example_value"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
  "error":"invalid_request"
}

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA

GET /resource/1 HTTP/1.1
Host: example.com
Authorization: Bearer mF_9.B5f-4.1JqM

GET /resource/1 HTTP/1.1
Host: example.com
Authorization: MAC id="h480djs93hd8", nonce="274312:dj83hs9s", mac="kDZvddkndxvhGRXZhvuDjEWhGeE="

https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=98447827252-l09s8hofp0ek6tshhnc5l93e71li5mvv.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A5000%2Fcallback&scope=email%20profile

http://localhost:5000/callback?code=4%2F0Adeu5BWehrhh2fFclFQn8_cwWuukfLYXMBVXAIsRNXgDbW66aAI39W-nDDL-EM7i-CoTqA&scope=email+profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+openid&authuser=0&prompt=consent#

curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" "https://oauth2.googleapis.com/token" -d "code=4%2F0Adeu5BWehrhh2fFclFQn8_cwWuukfLYXMBVXAIsRNXgDbW66aAI39W-nDDL-EM7i-CoTqA&client_id=98447827252-l09s8hofp0ek6tshhnc5l93e71li5mvv.apps.googleusercontent.com&client_secret=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&grant_type=authorization_code&redirect_uri=http://localhost:5000/callback"

{
  "access_token": "ya29.a0AfB_byD5HIEUFeALUFpqJ2AUM4tlbOioFuZeeftBvsh-8Y8Xl2dotb8xSwd10LN5iBOn2Lbbi2D0QftPKnJIqwaSJCBjJSBA8vtOMXDTanov19wvqKvHaOQHYgvcbp4_bSf2xpPOuaurqDzWaIuwObnGMgNXaCgYKAXISARASFQHsvYls1sBqtXDt-sJ6djCS_6ki6g0163",
  "expires_in": 3599,
  "scope": "https://www.googleapis.com/auth/userinfo.profile openid https://www.googleapis.com/auth/userinfo.email",
  "token_type": "Bearer",
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjkxMWUzOWUyNzkyOGFlOWYxZTlkMWUyMTY0NmRlOTJkMTkzNTFiNDQiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiI5ODQ0NzgyNzI1Mi1sMDlzOGhvZnAwZWs2dHNoaG5jNWw5M2U3MWxpNW12di5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsImF1ZCI6Ijk4NDQ3ODI3MjUyLWwwOXM4aG9mcDBlazZ0c2hobmM1bDkzZTcxbGk1bXZ2LmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwic3ViIjoiMTE0MjU5MDY0MTkxNzkwNjk2ODEzIiwiZW1haWwiOiJtYXJjaGVua28uYWxleGFuZHJAZ21haWwuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImF0X2hhc2giOiIzekFfNVZUVzY2dlNpeGhMLU9QR3h3IiwibmFtZSI6IkFsZXhhbmRyIE1hcmNoZW5rbyIsInBpY3R1cmUiOiJodHRwczovL2xoMy5nb29nbGV1c2VyY29udGVudC5jb20vYS9BQWNIVHRkWTRXR29oek5TNXZJaG9neEF5aVRta0Rvc2FLYy00MFZoVGw1RUY4am5fanc9czk2LWMiLCJnaXZlbl9uYW1lIjoiQWxleGFuZHIiLCJmYW1pbHlfbmFtZSI6Ik1hcmNoZW5rbyIsImxvY2FsZSI6ImVuIiwiaWF0IjoxNjkxMjM3MjQ1LCJleHAiOjE2OTEyNDA4NDV9.4cqF51TwCPwuICYVADIGBqxYbyMesbo-Bhu8yZ9hSEoOwbi0C0GeNnyWJqV3lOIAkMaDRs2E51AnIkBGXRqD1eM75OoRkEnz0C_EdbuXA48QHmTyOWpF9Ia3u1LumTx5v6fo_NJAbbUdjgJaYgk80EhbtFuOh1kzy57YAOSMNHQWmtSgviDXZfHe4PaQueGsqv6hkk7s5Qoskgph5p_AeOWToSXEx-RaEACldKqqRDMok_lNc7pRZhtUxJrMaMs8e4VS1zPjtGLN1uT8-j80L-k5T09luTNufllmTM3o5X0R4dRVddREdnfJ46D67oJ2DP7aE2-EMBt91uRhqC2TMw"
}

const { readFileSync } = require('fs')
const http = require('http')
const https = require('https') // const http2 = require('http2')

http.createServer((req, res) => res.setHeader('Location', `https://${req.headers.host}${req.url}`).writeHead(302).end()).listen(80)

https.createServer({
  key: readFileSync('localhost.direct.key'),
  cert: readFileSync('localhost.direct.crt')
}, (req, res) => {
  console.log('HTTPS')
  res.writeHead(200)
  res.end('HTTPS\n')
}).listen(443)

const crypto = require('crypto')
const { readFileSync } = require('fs')
const http = require('http')
const https = require('https') // const http2 = require('http2')

// As described in "2. Client Registration" and "2.3 Client Authentication" we should have at least `client_id` and `client_secret`, also `redirect_uris`, other possible settings will be `enabled`, `allowed_scopes`, etc
const clients = [{
  client_id: '1',
  client_secret: '2',
  redirect_uris: ['https://spa.localhost.direct/callback']
}]

const codes = []

http.createServer((req, res) => res.setHeader('Location', `https://${req.headers.host}${req.url}`).writeHead(302).end()).listen(80)

https.createServer({
  key: readFileSync('localhost.direct.key'),
  cert: readFileSync('localhost.direct.crt')
}, async (req, res) => {
  const url = new URL(req.url, `https://${req.headers.host}`)
  if (url.pathname === '/authorization') {
    return await authorization(req, res)
  }
  else if (url.pathname === '/token') {
    console.log('Token')
    res.writeHead(500)
    res.end('Not implemented\n')
  }
  // Handle not found
  else {
    console.log(`Not Found: ${req.url}`)
    return res.writeHead(404).end('Not Found\n')
  }
}).listen(443)

// Responsible for interaction with user, display authorization form, consent, etc
async function authorization(req, res) {
  if (req.method !== 'GET' && req.method !== 'POST') {
    console.log(`Method Not Allowed: ${req.method}`)
    return res.writeHead(405).end('Method Not Allowed\n')
  }

  const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
  const response_type = qs.get('response_type')

  if (response_type === 'code') {
    return await authorization_code_grant(req, res)
  } else {
    console.log(`Unsupported response_type: ${response_type}`)
    return res.setHeader('content-type', 'text/html').writeHead(400).end('<h1>Invalid request</h1><p>Unsupported <code>response_type</code></p>\n')
  }
}

// 4.1. Authorization Code Grant
async function authorization_code_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')

      const code = crypto.randomUUID()
      // as described - code should have short lifetime (~10min) and if possible be one time use, also we are saving everything we can about request to validate it in future when exchanging
      codes.push({
        username,
        client_id,
        response_type,
        redirect_uri,
        code,
        at: Date.now()
      })

      const url = new URL(redirect_uri)
      if (qs.get('scope')) {
        url.searchParams.set('scope', qs.get('scope'))
      }
      url.searchParams.set('code', code)
      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

https://auth.localhost.direct/authorization?response_type=code&client_id=client1&redirect_uri=https%3A%2F%2Fspa.localhost.direct%3A4200%2Fcallback

https://spa.localhost.direct:4200/callback?code=0f38ec84-39d0-4682-b3bf-6fcbecd174e0

const crypto = require('crypto')
const { readFileSync } = require('fs')
const http = require('http')
const https = require('https') // const http2 = require('http2')

// As described in "2. Client Registration" and "2.3 Client Authentication" we should have at least `client_id` and `client_secret`, also `redirect_uris`, other possible settings will be `enabled`, `allowed_scopes`, etc
const clients = [{
  client_id: '1',
  client_secret: '2',
  redirect_uris: ['https://spa.localhost.direct/callback']
}]

const codes = [{
  // for demo purposes, single code is hardcoded so we may skip authorization and call token directly
  username: 'mac',
  client_id: '1',
  response_type: 'code',
  redirect_uri: 'https://spa.localhost.direct/callback',
  code: '123',
  at: Date.now() - 60
}]

const tokens = []

http.createServer((req, res) => res.setHeader('Location', `https://${req.headers.host}${req.url}`).writeHead(302).end()).listen(80)

https.createServer({
  key: readFileSync('localhost.direct.key'),
  cert: readFileSync('localhost.direct.crt')
}, async (req, res) => {
  const url = new URL(req.url, `https://${req.headers.host}`)
  if (url.pathname === '/authorization') {
    return await authorization(req, res)
  }
  else if (url.pathname === '/token') {
    return await token(req, res)
  }
  else {
    console.log(`Not Found: ${req.url}`)
    return res.writeHead(404).end('Not Found\n')
  }
}).listen(443)

// Responsible for interaction with user, display authorization form, consent, etc
async function authorization(req, res) {
  if (req.method !== 'GET' && req.method !== 'POST') {
    console.log(`Method Not Allowed: ${req.method}`)
    return res.writeHead(405).end('Method Not Allowed\n')
  }

  const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
  const response_type = qs.get('response_type')

  if (response_type === 'code') {
    return await authorization_code_grant(req, res)
  } else {
    console.log(`Unsupported response_type: ${response_type}`)
    return res.setHeader('content-type', 'text/html').writeHead(400).end('<h1>Invalid request</h1><p>Unsupported <code>response_type</code></p>\n')
  }
}

// 4.1. Authorization Code Grant
async function authorization_code_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')

      const code = crypto.randomUUID()
      // as described - code should have short lifetime (~10min) and if possible be one time use, also we are saving everything we can about request to validate it in future when exchanging
      codes.push({
        username,
        client_id,
        response_type,
        redirect_uri,
        code,
        at: Date.now()
      })

      const url = new URL(redirect_uri)
      if (qs.get('scope')) {
        url.searchParams.set('scope', qs.get('scope'))
      }
      url.searchParams.set('code', code)
      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}


async function token(req, res) {
  let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      // const grant_type = body.get('grant_type')
      const redirect_uri = body.get('redirect_uri')
      const client_id = body.get('client_id')
      // const code = body.get('code')
      const code = codes.find(c => c.code === body.get('code'))
      // validate everything, do not forget that code is short lived and should be one time used

      // for simplicity we are using HS256, later it will be RSA and then JWKS, for not to keep things simple
      const expires = 3600
      const secret = 'HelloWorld_mac_was_here'
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'HS256',
      })).toString('base64url')

      const payload = Buffer.from(JSON.stringify({
        sub: code.username,
        nbf: Date.now() - 30,
        iat: Date.now(),
        exp: Date.now() + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id,
      })).toString('base64url')

      const signature = crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url')

      return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
        access_token: `${header}.${payload}.${signature}`,
        token_type: 'Bearer',
        expires_in: expires
      }))

    })
}

curl -s -X POST https://auth.localhost.direct/token \
  --data-urlencode "grant_type=authorization_code" \
  --data-urlencode "code=123" \
  --data-urlencode "redirect_uri=https://spa.localhost.direct:4200/callback" \
  --data-urlencode "client_id=1"

{
  "access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJtYWMiLCJuYmYiOjE2OTEzMDczMzMwNTIsImlhdCI6MTY5MTMwNzMzMzA4MiwiZXhwIjoxNjkxMzA3MzM2NjgyLCJpc3MiOiJodHRwczovL2F1dGgubG9jYWxob3N0LmRpcmVjdCIsImF1ZCI6IjEifQ.DcRud510QNoZCYGPVnoaZQEyKeD6oZyUa2PJt2onWeI",
  "token_type":"Bearer",
  "expires_in":3600
}

{
  "sub": "mac",
  "nbf": 1691307224585,
  "iat": 1691307224615,
  "exp": 1691307228215,
  "iss": "https://auth.localhost.direct",
  "aud": "1"
}

const crypto = require('crypto')
const { readFileSync } = require('fs')
const http = require('http')
const https = require('https') // const http2 = require('http2')

// As described in "2. Client Registration" and "2.3 Client Authentication" we should have at least `client_id` and `client_secret`, also `redirect_uris`, other possible settings will be `enabled`, `allowed_scopes`, etc
const clients = [{
  client_id: '1',
  client_secret: '2',
  redirect_uris: ['https://spa.localhost.direct/callback']
}]

const codes = [{
  // for demo purposes, single code is hardcoded so we may skip authorization and call token directly
  username: 'mac',
  client_id: '1',
  response_type: 'code',
  redirect_uri: 'https://spa.localhost.direct/callback',
  code: '123',
  at: Date.now() - 60
}]

const tokens = []

http.createServer((req, res) => res.setHeader('Location', `https://${req.headers.host}${req.url}`).writeHead(302).end()).listen(80)

https.createServer({
  key: readFileSync('localhost.direct.key'),
  cert: readFileSync('localhost.direct.crt')
}, async (req, res) => {
  const url = new URL(req.url, `https://${req.headers.host}`)
  if (url.pathname === '/authorization') {
    return await authorization(req, res)
  }
  else if (url.pathname === '/token') {
    return await token(req, res)
  }
  else {
    console.log(`Not Found: ${req.url}`)
    return res.writeHead(404).end('Not Found\n')
  }
}).listen(443)

// Responsible for interaction with user, display authorization form, consent, etc
async function authorization(req, res) {
  if (req.method !== 'GET' && req.method !== 'POST') {
    console.log(`Method Not Allowed: ${req.method}`)
    return res.writeHead(405).end('Method Not Allowed\n')
  }

  const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
  const response_type = qs.get('response_type')

  if (response_type === 'code') {
    return await authorization_code_grant(req, res)
  }
  else if (response_type === 'token') {
    return await authorization_implicit_grant(req, res)
  }
  else {
    console.log(`Unsupported response_type: ${response_type}`)
    return res.setHeader('content-type', 'text/html').writeHead(400).end('<h1>Invalid request</h1><p>Unsupported <code>response_type</code></p>\n')
  }
}

// 4.1. Authorization Code Grant
async function authorization_code_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')

      const code = crypto.randomUUID()
      // as described - code should have short lifetime (~10min) and if possible be one time use, also we are saving everything we can about request to validate it in future when exchanging
      codes.push({
        username,
        client_id,
        response_type,
        redirect_uri,
        code,
        at: Date.now()
      })

      const url = new URL(redirect_uri)
      if (qs.get('scope')) {
        url.searchParams.set('scope', qs.get('scope'))
      }
      url.searchParams.set('code', code)
      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

// 4.2. Implicit Grant
async function authorization_implicit_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere

    // it is the same as in code flow
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')
      const url = new URL(redirect_uri)

      // the difference here is that we are not storing/dealing with code anymore and goind to redirect to url passinng access token in url fragment
      // token generation copy pasted from token endpoint, later will be extracted, do not bother
      const expires = 3600
      const secret = 'HelloWorld_mac_was_here'
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'HS256',
      })).toString('base64url')

      const payload = Buffer.from(JSON.stringify({
        sub: username,
        nbf: Date.now() - 30,
        iat: Date.now(),
        exp: Date.now() + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id,
      })).toString('base64url')

      const signature = crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url')

      const fragment = new URLSearchParams()
      fragment.set('access_token', `${header}.${payload}.${signature}`)
      fragment.set('token_type', 'Bearer')
      fragment.set('expires_in', expires)

      url.hash = fragment

      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

async function token(req, res) {
  let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      // const grant_type = body.get('grant_type')
      const redirect_uri = body.get('redirect_uri')
      const client_id = body.get('client_id')
      // const code = body.get('code')
      const code = codes.find(c => c.code === body.get('code'))
      // validate everything, do not forget that code is short lived and should be one time used

      // for simplicity we are using HS256, later it will be RSA and then JWKS, for not to keep things simple
      const expires = 3600
      const secret = 'HelloWorld_mac_was_here'
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'HS256',
      })).toString('base64url')

      const payload = Buffer.from(JSON.stringify({
        sub: code.username,
        nbf: Date.now() - 30,
        iat: Date.now(),
        exp: Date.now() + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id,
      })).toString('base64url')

      const signature = crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url')

      return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
        access_token: `${header}.${payload}.${signature}`,
        token_type: 'Bearer',
        expires_in: expires
      }))

    })
}

https://auth.localhost.direct/authorization?response_type=token&client_id=1&redirect_uri=https%3A%2F%2Fspa.localhost.direct%3A4200%2Fcallback

https://spa.localhost.direct:4200/callback#access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhYWEiLCJuYmYiOjE2OTEzMDg2NTk2MjcsImlhdCI6MTY5MTMwODY1OTY1NywiZXhwIjoxNjkxMzA4NjYzMjU3LCJpc3MiOiJodHRwczovL2F1dGgubG9jYWxob3N0LmRpcmVjdCIsImF1ZCI6IjEifQ.9EWlJF8abRX8aTmNQ8JsPFQ7W6P6NUS2syNe9LM6Qi0&token_type=Bearer&expires_in=3600

const crypto = require('crypto')

// just for example we are generating keys on the fly, there is quadrillion ways to create them, find more at https://github.com/mac2000/cryptography
const {privateKey, publicKey} = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {type: 'spki',format: 'pem'},
  privateKeyEncoding: {type: 'pkcs8', format: 'pem'}
})

const text = 'The string that we want to sign with our private key'
console.log('text', text)

const signature = crypto.sign('sha256', Buffer.from(text), privateKey).toString('base64url')
console.log('signature', signature)

const result = crypto.verify('sha256', Buffer.from(text), publicKey, Buffer.from(signature, 'base64url'))
console.log('result', result)

#!/usr/bin/env bash

# create keys
openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

# the payload we are going to sign
echo "The string that we want to sign with our private key" > text.txt

# sign
openssl dgst -sha256 -sign private.pem -out text.sign text.txt

# verify
openssl dgst -sha256 -verify public.pem -signature text.sign text.txt

const crypto = require('crypto')
const { readFileSync } = require('fs')
const http = require('http')
const https = require('https') // const http2 = require('http2')

// As described in "2. Client Registration" and "2.3 Client Authentication" we should have at least `client_id` and `client_secret`, also `redirect_uris`, other possible settings will be `enabled`, `allowed_scopes`, etc
const clients = [{
  client_id: '1',
  client_secret: '2',
  redirect_uris: ['https://spa.localhost.direct/callback']
}]

const codes = [{
  // for demo purposes, single code is hardcoded so we may skip authorization and call token directly
  username: 'mac',
  client_id: '1',
  response_type: 'code',
  redirect_uri: 'https://spa.localhost.direct/callback',
  code: '123',
  at: Date.now() - 60
}]

const tokens = []

http.createServer((req, res) => res.setHeader('Location', `https://${req.headers.host}${req.url}`).writeHead(302).end()).listen(80)

https.createServer({
  key: readFileSync('localhost.direct.key'),
  cert: readFileSync('localhost.direct.crt')
}, async (req, res) => {
  const url = new URL(req.url, `https://${req.headers.host}`)
  if (url.pathname === '/.well-known/openid-configuration') {
    return await oidc(req, res)
  }
  else if (url.pathname === '/authorization') {
    return await authorization(req, res)
  }
  else if (url.pathname === '/token') {
    return await token(req, res)
  }
  else {
    console.log(`Not Found: ${req.url}`)
    return res.writeHead(404).end('Not Found\n')
  }
}).listen(443)

// Responsible for interaction with user, display authorization form, consent, etc
async function authorization(req, res) {
  if (req.method !== 'GET' && req.method !== 'POST') {
    console.log(`Method Not Allowed: ${req.method}`)
    return res.writeHead(405).end('Method Not Allowed\n')
  }

  const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
  const response_type = qs.get('response_type')

  if (response_type === 'code') {
    return await authorization_code_grant(req, res)
  }
  else if (response_type === 'token') {
    return await authorization_implicit_grant(req, res)
  }
  else {
    console.log(`Unsupported response_type: ${response_type}`)
    return res.setHeader('content-type', 'text/html').writeHead(400).end('<h1>Invalid request</h1><p>Unsupported <code>response_type</code></p>\n')
  }
}

// 4.1. Authorization Code Grant
async function authorization_code_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')

      const code = crypto.randomUUID()
      // as described - code should have short lifetime (~10min) and if possible be one time use, also we are saving everything we can about request to validate it in future when exchanging
      codes.push({
        username,
        client_id,
        response_type,
        redirect_uri,
        code,
        at: Date.now()
      })

      const url = new URL(redirect_uri)
      if (qs.get('scope')) {
        url.searchParams.set('scope', qs.get('scope'))
      }
      url.searchParams.set('code', code)
      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

// 4.2. Implicit Grant
async function authorization_implicit_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere

    // it is the same as in code flow
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')
      const url = new URL(redirect_uri)

      // the difference here is that we are not storing/dealing with code anymore and goind to redirect to url passinng access token in url fragment
      // token generation copy pasted from token endpoint, later will be extracted, do not bother
      const expires = 3600
      const secret = 'HelloWorld_mac_was_here'
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'HS256',
      })).toString('base64url')

      const payload = Buffer.from(JSON.stringify({
        sub: username,
        nbf: Date.now() - 30,
        iat: Date.now(),
        exp: Date.now() + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id,
      })).toString('base64url')

      const signature = crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url')

      const fragment = new URLSearchParams()
      fragment.set('access_token', `${header}.${payload}.${signature}`)
      fragment.set('token_type', 'Bearer')
      fragment.set('expires_in', expires)

      url.hash = fragment

      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

async function token(req, res) {
  let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      // const grant_type = body.get('grant_type')
      const redirect_uri = body.get('redirect_uri')
      const client_id = body.get('client_id')
      // const code = body.get('code')
      const code = codes.find(c => c.code === body.get('code'))
      // validate everything, do not forget that code is short lived and should be one time used

      // for simplicity we are using HS256, later it will be RSA and then JWKS, for not to keep things simple
      const expires = 3600
      const secret = 'HelloWorld_mac_was_here'
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'HS256',
      })).toString('base64url')

      const payload = Buffer.from(JSON.stringify({
        sub: code.username,
        nbf: Date.now() - 30,
        iat: Date.now(),
        exp: Date.now() + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id,
      })).toString('base64url')

      const signature = crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url')

      return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
        access_token: `${header}.${payload}.${signature}`,
        token_type: 'Bearer',
        expires_in: expires
      }))

    })
}

// 3. OpenID Provider Metadata
// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
async function oidc(req, res) {
  return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
    issuer: 'https://auth.localhost.direct',
    authorization_endpoint: 'https://auth.localhost.direct/authorization',
    token_endpoint: 'https://auth.localhost.direct/token',
    jwks_uri: 'https://auth.localhost.direct/jwks', // TODO: we need to implement this in next step
    response_types_supported: ['code', 'token'], // [ "code", "token", "id_token", "code token", "code id_token", "token id_token", "code token id_token", "none" ]
    subject_types_supported: ['public'], // [ "public", "pairwise" ]
    id_token_signing_alg_values_supported: ['RS256'], // [ "RS256", "ES256" ]
  }, null, 4))
}

https://auth.localhost.direct/.well-known/openid-configuration

{
    "issuer": "https://auth.localhost.direct",
    "authorization_endpoint": "https://auth.localhost.direct/authorization",
    "token_endpoint": "https://auth.localhost.direct/token",
    "jwks_uri": "https://auth.localhost.direct/jwks",
    "response_types_supported": [
        "code",
        "token"
    ],
    "subject_types_supported": [
        "public"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ]
}

https://www.googleapis.com/oauth2/v3/certs

{
  "keys": [
    {
      "n": "8KImylelEspnZ0X-ekZb9VPbUFhgB_yEPJuLKOhXOWJLVsU0hJP6B_mQOfVk0CHm66UsAhqV8qrINk-RXgwVaaFLMA827pbOOBhyvHsThcyo7AY5s6M7qbftFKKnkfVHO6c9TsQ9wpIfmhCVL3QgTlqlgFQWcNsY-qemSKpqvVi-We9I3kPvbTf0PKJ_rWA7GQQnU_GA5JRU46uvw4I1ODf0icNBHw7pWc7oTvmSl1G8OWABEyiFakcUG2Xd4qZnmWaKwLHBvifPuIyy2vK-yHH91mVZCuleVu53Vzj77RgUtF2EEuB-zizwC-fzaBmvnfx1kgQLsdK22J0Ivgu4Xw",
      "kty": "RSA",
      "alg": "RS256",
      "kid": "fd48a75138d9d48f0aa635ef569c4e196f7ae8d6",
      "use": "sig",
      "e": "AQAB"
    },
    {
      "n": "4kGxcWQdTW43aszLmftsGswmwDDKdfcse-lKeT_zjZTB2KGw9E6LVY6IThJVxzYF6mcyU-Z5_jDAW_yi7D_gXep2rxchZvoFayXynbhxyfjK6RtJ6_k30j-WpsXCSAiNAkupYHUyDIBNocvUcrDJsC3U65l8jl1I3nW98X6d-IlAfEb2In2f0fR6d-_lhIQZjXLupjymJduPjjA8oXCUZ9bfAYPhGYj3ZELUHkAyDpZNrnSi8hFVMSUSnorAt9F7cKMUJDM4-Uopzaqcl_f-HxeKvxN7NjiLSiIYaHdgtTpCEuNvsch6q6JTsllJNr3c__BxrG4UMlJ3_KsPxbcvXw",
      "kid": "911e39e27928ae9f1e9d1e21646de92d19351b44",
      "e": "AQAB",
      "alg": "RS256",
      "use": "sig",
      "kty": "RSA"
    }
  ]
}

const crypto = require('crypto')

// just for example we are generating keys on the fly, there is quadrillion ways to create them, find more at https://github.com/mac2000/cryptography
const {privateKey, publicKey} = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {type: 'spki',format: 'pem'},
  privateKeyEncoding: {type: 'pkcs8', format: 'pem'}
})

// const publicKey = fs.readFileSync('public.pem');

const rsa = crypto.createPublicKey(publicKey);
const modulus = rsa.export({ type: 'pkcs1', format: 'der' }).subarray(28, 28 + 256).toString('base64url');
const exponent = rsa.export({ type: 'pkcs1', format: 'der' }).subarray(-3).toString('base64url');

console.log({n: modulus, e: exponent});

// -------------------------------------

console.log(crypto.createPublicKey(publicKey).export({ format: 'jwk' }))

const crypto = require('crypto')
const { readFileSync } = require('fs')
const http = require('http')
const https = require('https') // const http2 = require('http2')

// here are our keys that we will use to sign keys, also we will expose public key to the world
const {privateKey, publicKey} = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {type: 'spki',format: 'pem'},
  privateKeyEncoding: {type: 'pkcs8', format: 'pem'}
})

// As described in "2. Client Registration" and "2.3 Client Authentication" we should have at least `client_id` and `client_secret`, also `redirect_uris`, other possible settings will be `enabled`, `allowed_scopes`, etc
const clients = [{
  client_id: '1',
  client_secret: '2',
  redirect_uris: ['https://spa.localhost.direct/callback']
}]

const codes = [{
  // for demo purposes, single code is hardcoded so we may skip authorization and call token directly
  username: 'mac',
  client_id: '1',
  response_type: 'code',
  redirect_uri: 'https://spa.localhost.direct/callback',
  code: '123',
  at: Date.now() - 60
}]

const tokens = []

http.createServer((req, res) => res.setHeader('Location', `https://${req.headers.host}${req.url}`).writeHead(302).end()).listen(80)

https.createServer({
  key: readFileSync('localhost.direct.key'),
  cert: readFileSync('localhost.direct.crt')
}, async (req, res) => {
  const url = new URL(req.url, `https://${req.headers.host}`)
  if (url.pathname === '/.well-known/openid-configuration') {
    return await oidc(req, res)
  }
  else if (url.pathname === '/jwks') {
    return await jwks(req, res)
  }
  else if (url.pathname === '/authorization') {
    return await authorization(req, res)
  }
  else if (url.pathname === '/token') {
    return await token(req, res)
  }
  else {
    console.log(`Not Found: ${req.url}`)
    return res.writeHead(404).end('Not Found\n')
  }
}).listen(443)

// Responsible for interaction with user, display authorization form, consent, etc
async function authorization(req, res) {
  if (req.method !== 'GET' && req.method !== 'POST') {
    console.log(`Method Not Allowed: ${req.method}`)
    return res.writeHead(405).end('Method Not Allowed\n')
  }

  const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
  const response_type = qs.get('response_type')

  if (response_type === 'code') {
    return await authorization_code_grant(req, res)
  }
  else if (response_type === 'token') {
    return await authorization_implicit_grant(req, res)
  }
  else {
    console.log(`Unsupported response_type: ${response_type}`)
    return res.setHeader('content-type', 'text/html').writeHead(400).end('<h1>Invalid request</h1><p>Unsupported <code>response_type</code></p>\n')
  }
}

// 4.1. Authorization Code Grant
async function authorization_code_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')

      const code = crypto.randomUUID()
      // as described - code should have short lifetime (~10min) and if possible be one time use, also we are saving everything we can about request to validate it in future when exchanging
      codes.push({
        username,
        client_id,
        response_type,
        redirect_uri,
        code,
        at: Date.now()
      })

      const url = new URL(redirect_uri)
      if (qs.get('scope')) {
        url.searchParams.set('scope', qs.get('scope'))
      }
      url.searchParams.set('code', code)
      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

// 4.2. Implicit Grant
async function authorization_implicit_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere

    // it is the same as in code flow
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')
      const url = new URL(redirect_uri)

      // the difference here is that we are not storing/dealing with code anymore and goind to redirect to url passinng access token in url fragment
      // token generation copy pasted from token endpoint, later will be extracted, do not bother
      const expires = 3600
      const secret = 'HelloWorld_mac_was_here'
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'HS256',
      })).toString('base64url')

      const payload = Buffer.from(JSON.stringify({
        sub: username,
        nbf: Date.now() - 30,
        iat: Date.now(),
        exp: Date.now() + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id,
      })).toString('base64url')

      const signature = crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url')

      const fragment = new URLSearchParams()
      fragment.set('access_token', `${header}.${payload}.${signature}`)
      fragment.set('token_type', 'Bearer')
      fragment.set('expires_in', expires)

      url.hash = fragment

      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

async function token(req, res) {
  let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      // const grant_type = body.get('grant_type')
      const redirect_uri = body.get('redirect_uri')
      const client_id = body.get('client_id')
      // const code = body.get('code')
      const code = codes.find(c => c.code === body.get('code'))
      // validate everything, do not forget that code is short lived and should be one time used

      // for simplicity we are using HS256, later it will be RSA and then JWKS, for not to keep things simple
      const expires = 3600
      const secret = 'HelloWorld_mac_was_here'
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'HS256',
      })).toString('base64url')

      const payload = Buffer.from(JSON.stringify({
        sub: code.username,
        nbf: Date.now() - 30,
        iat: Date.now(),
        exp: Date.now() + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id,
      })).toString('base64url')

      const signature = crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url')

      return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
        access_token: `${header}.${payload}.${signature}`,
        token_type: 'Bearer',
        expires_in: expires
      }))

    })
}

// 3. OpenID Provider Metadata
// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
async function oidc(req, res) {
  return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
    issuer: 'https://auth.localhost.direct',
    authorization_endpoint: 'https://auth.localhost.direct/authorization',
    token_endpoint: 'https://auth.localhost.direct/token',
    jwks_uri: 'https://auth.localhost.direct/jwks', // TODO: we need to implement this in next step
    response_types_supported: ['code', 'token'], // [ "code", "token", "id_token", "code token", "code id_token", "token id_token", "code token id_token", "none" ]
    subject_types_supported: ['public'], // [ "public", "pairwise" ]
    id_token_signing_alg_values_supported: ['RS256'], // [ "RS256", "ES256" ]
  }, null, 4))
}

// https://datatracker.ietf.org/doc/html/rfc7517
async function jwks(req, res) {
  return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
    keys: [{
      kid: '1',
      kty: 'RSA',
      alg: 'RS256',
      use: 'sig',
      n: crypto.createPublicKey(publicKey).export({ type: 'pkcs1', format: 'der' }).subarray(28, 28 + 256).toString('base64url'),
      e: crypto.createPublicKey(publicKey).export({ type: 'pkcs1', format: 'der' }).subarray(-3).toString('base64url')
    }]
  }, null, 4))
}

https://auth.localhost.direct/jwks

{
    "keys": [
        {
            "kid": "1",
            "kty": "RSA",
            "alg": "RS256",
            "use": "sig",
            "n": "t-WswdPi6x8mdO9kstaUB7SMRFRiIy2cRGrZt5soZJHPytfQtQ-uQksl5ksXj-Rqop2XdTpOkk0ktk2OpfHEbwOjAW-IRykC8wB9KGNaVNxB1Ox7IerBqi4S3AvdoYdDF2CanpTHlM_T3omBFccrWqonmZYpzEn2XlK6CoLICq9yyu2bLlgFGr863RXej6A4_MbT7MuJaFiyooEMfRaSgu0ajYMANl8Xb4zmJrgGGsF_sTf-GLKDH-CDWyO-yBn7vtwUzMEURl_NHpncHfzyIXjwxfCHmqileHfc_bBPa8bh2f0q7vtqJJi7_iFpAgMBAAE",
            "e": "AQAB"
        }
    ]
}

const crypto = require('crypto')
const { readFileSync } = require('fs')
const http = require('http')
const https = require('https') // const http2 = require('http2')

// here are our keys that we will use to sign keys, also we will expose public key to the world
const {privateKey, publicKey} = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {type: 'spki',format: 'pem'},
  privateKeyEncoding: {type: 'pkcs8', format: 'pem'}
})

// read private.pem into privateKey variable
// const privateKey = crypto.createPrivateKey(readFileSync('private.pem'))
// const publicKey = crypto.createPrivateKey(readFileSync('public.pem'))

// As described in "2. Client Registration" and "2.3 Client Authentication" we should have at least `client_id` and `client_secret`, also `redirect_uris`, other possible settings will be `enabled`, `allowed_scopes`, etc
const clients = [{
  client_id: '1',
  client_secret: '2',
  redirect_uris: ['https://spa.localhost.direct/callback']
}]

const codes = [{
  // for demo purposes, single code is hardcoded so we may skip authorization and call token directly
  username: 'mac',
  client_id: '1',
  response_type: 'code',
  redirect_uri: 'https://spa.localhost.direct/callback',
  code: '123',
  at: Date.now() - 60
}]

const tokens = []

http.createServer((req, res) => res.setHeader('Location', `https://${req.headers.host}${req.url}`).writeHead(302).end()).listen(80)

https.createServer({
  key: readFileSync('localhost.direct.key'),
  cert: readFileSync('localhost.direct.crt')
}, async (req, res) => {
  const url = new URL(req.url, `https://${req.headers.host}`)
  if (url.pathname === '/.well-known/openid-configuration') {
    return await oidc(req, res)
  }
  else if (url.pathname === '/jwks') {
    return await jwks(req, res)
  }
  else if (url.pathname === '/authorization') {
    return await authorization(req, res)
  }
  else if (url.pathname === '/token') {
    return await token(req, res)
  }
  else {
    console.log(`Not Found: ${req.url}`)
    return res.writeHead(404).end('Not Found\n')
  }
}).listen(443)

// Responsible for interaction with user, display authorization form, consent, etc
async function authorization(req, res) {
  if (req.method !== 'GET' && req.method !== 'POST') {
    console.log(`Method Not Allowed: ${req.method}`)
    return res.writeHead(405).end('Method Not Allowed\n')
  }

  const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
  const response_type = qs.get('response_type')

  if (response_type === 'code') {
    return await authorization_code_grant(req, res)
  }
  else if (response_type === 'token') {
    return await authorization_implicit_grant(req, res)
  }
  else {
    console.log(`Unsupported response_type: ${response_type}`)
    return res.setHeader('content-type', 'text/html').writeHead(400).end('<h1>Invalid request</h1><p>Unsupported <code>response_type</code></p>\n')
  }
}

// 4.1. Authorization Code Grant
async function authorization_code_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')

      const code = crypto.randomUUID()
      // as described - code should have short lifetime (~10min) and if possible be one time use, also we are saving everything we can about request to validate it in future when exchanging
      codes.push({
        username,
        client_id,
        response_type,
        redirect_uri,
        code,
        at: Date.now()
      })

      const url = new URL(redirect_uri)
      if (qs.get('scope')) {
        url.searchParams.set('scope', qs.get('scope'))
      }
      url.searchParams.set('code', code)
      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

// 4.2. Implicit Grant
async function authorization_implicit_grant(req, res) {
  if (req.method === 'GET') {
    const qs = new URL(req.url, `https://${req.headers.host}`).searchParams
    // TODO: validate wellknown incomming parameters here, if something wrong - warn user and do not redirect him anywhere

    // it is the same as in code flow
    return res.setHeader('content-type', 'text/html').writeHead(200).end(`
      <fieldset>
        <legend>login</legend>
        <form method="POST">
          <table>
            <tr>
              <td>
                <label for="username">username</label>
              </td>
              <td>
                <input type="text" name="username" id="username" required />
              </td>
            </tr>
            <tr>
              <td>
                <label for="password">password</label>
              </td>
              <td>
                <input type="password" name="password" id="password" required />
              </td>
            </tr>
            <tr>
              <td>
              </td>
              <td>
                <input type="hidden" name="csrf" value="TODO: do not forget about CSRF" />
                <input type="submit" value="submit" />
              </td>
            </tr>
          </table>
        </form>
      </fieldset>
    `)
  } else {
    let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      const username = body.get('username')
      // const password = body.get('password')
      const qs = new URL(req.headers.referer).searchParams
      const response_type = qs.get('response_type')
      const client_id = qs.get('client_id')
      const redirect_uri = qs.get('redirect_uri')
      const url = new URL(redirect_uri)

      // the difference here is that we are not storing/dealing with code anymore and goind to redirect to url passinng access token in url fragment
      // token generation copy pasted from token endpoint, later will be extracted, do not bother
      const expires = 3600
      const secret = 'HelloWorld_mac_was_here'
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'RS256',
        kid: '1'
      })).toString('base64url')

      const now = Math.floor(Date.now() / 1000)

      const payload = Buffer.from(JSON.stringify({
        sub: username,
        nbf: now - 30,
        iat: now,
        exp: now + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id
      })).toString('base64url')

      const signature = crypto.sign('sha256', Buffer.from(`${header}.${payload}`), privateKey).toString('base64url')

      const fragment = new URLSearchParams()
      fragment.set('access_token', `${header}.${payload}.${signature}`)
      fragment.set('token_type', 'Bearer')
      fragment.set('expires_in', expires)

      url.hash = fragment

      res.setHeader('Location', url).writeHead(302).end()
    })
  }
}

async function token(req, res) {
  let body = ''
    req.on('data', chunk => body += chunk)
    req.on('end', () => {
      body = new URLSearchParams(body)
      // const grant_type = body.get('grant_type')
      const redirect_uri = body.get('redirect_uri')
      const client_id = body.get('client_id')
      // const code = body.get('code')
      const code = codes.find(c => c.code === body.get('code'))
      // validate everything, do not forget that code is short lived and should be one time used

      // for simplicity we are using HS256, later it will be RSA and then JWKS, for not to keep things simple
      const expires = 3600
      const header = Buffer.from(JSON.stringify({
        typ: 'JWT',
        alg: 'RS256',
        kid: '1'
      })).toString('base64url')

      const now = Math.floor(Date.now() / 1000)

      const payload = Buffer.from(JSON.stringify({
        sub: code.username,
        nbf: now - 30,
        iat: now,
        exp: now + expires,
        iss: 'https://auth.localhost.direct',
        aud: client_id
      })).toString('base64url')

      const signature = crypto.sign('sha256', Buffer.from(`${header}.${payload}`), privateKey).toString('base64url')

      return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
        access_token: `${header}.${payload}.${signature}`,
        token_type: 'Bearer',
        expires_in: expires
      }))

    })
}

// 3. OpenID Provider Metadata
// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
async function oidc(req, res) {
  console.log('OIDC discovery')
  return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
    issuer: 'https://auth.localhost.direct',
    authorization_endpoint: 'https://auth.localhost.direct/authorization',
    token_endpoint: 'https://auth.localhost.direct/token',
    jwks_uri: 'https://auth.localhost.direct/jwks', // TODO: we need to implement this in next step
    response_types_supported: ['code', 'token'], // [ "code", "token", "id_token", "code token", "code id_token", "token id_token", "code token id_token", "none" ]
    subject_types_supported: ['public'], // [ "public", "pairwise" ]
    id_token_signing_alg_values_supported: ['RS256'], // [ "RS256", "ES256" ]
  }, null, 4))
}

// https://datatracker.ietf.org/doc/html/rfc7517
async function jwks(req, res) {
  console.log('JWKS')
  return res.setHeader('content-type', 'application/json').writeHead(200).end(JSON.stringify({
    keys: [
      // {
      //   kid: '1',
      //   kty: 'RSA',
      //   alg: 'RS256',
      //   use: 'sig',
      //   n: crypto.createPublicKey(publicKey).export({ type: 'pkcs1', format: 'der' }).subarray(28, 28 + 256).toString('base64url'),
      //   e: crypto.createPublicKey(publicKey).export({ type: 'pkcs1', format: 'der' }).subarray(-3).toString('base64url')
      // },
      {
        kid: '1',
        kty: 'RSA',
        alg: 'RS256',
        use: 'sig',
        ...crypto.createPublicKey(publicKey).export({ format: 'jwk' })
      }
  ]
  }, null, 4))
}

https://auth.localhost.direct/authorization?response_type=code&client_id=client1&redirect_uri=https%3A%2F%2Fspa.localhost.direct%3A4200%2Fcallback

https://spa.localhost.direct:4200/callback?code=eacf7f83-6bc9-47d1-9639-74d6f87f8a8c

curl -s -X POST https://auth.localhost.direct/token \
  --data-urlencode "grant_type=authorization_code" \
  --data-urlencode "code=eacf7f83-6bc9-47d1-9639-74d6f87f8a8c" \
  --data-urlencode "redirect_uri=https://spa.localhost.direct:4200/callback" \
  --data-urlencode "client_id=1"

{"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSU0EyNTYifQ.eyJzdWIiOiJoZWxsbyIsIm5iZiI6MTY5MTMxNTIxODMwMSwiaWF0IjoxNjkxMzE1MjE4MzMxLCJleHAiOjE2OTEzMTUyMjE5MzEsImlzcyI6Imh0dHBzOi8vYXV0aC5sb2NhbGhvc3QuZGlyZWN0IiwiYXVkIjoiMSJ9.imetzopnd046Yx8nVKfpVTJxPEQbd7F85pZUC2ZgzlvohHrS1cR0utqrWL7LKqG7jLJhzO3yiIEwBHoQI9Z2FUWByXHTbmQHn7TA89LYEEcCLQa4bX1o50Vu8bM8mT4VMK9Gk_SDjv2fLqEmoiUs8SsTn24TN2K-Q1NtieuJUPhCS2gT3wgLkZjSBvgd3AHQ0GZkPnpKKOwn2NY7v1PJrp6oJlquYWXCbTms2CL0LaxbolSmxbDNgKcd6BekqpJHw8IiKAO_I5f3jz0lKJFn6Z5pPkAidqdmM8Q6ZocRDNajcnuAU3WQYUjnzkZviXxK-7uF3ChKx6Qp77Ceawc0Nw","token_type":"Bearer","expires_in":3600}

{
  "sub": "hello",
  "nbf": 1691315218301,
  "iat": 1691315218331,
  "exp": 1691315221931,
  "iss": "https://auth.localhost.direct",
  "aud": "1"
}

curl -s -X POST https://auth.localhost.direct/token \
  --data-urlencode "grant_type=authorization_code" \
  --data-urlencode "code=123" \
  --data-urlencode "redirect_uri=https://spa.localhost.direct:4200/callback" \
  --data-urlencode "client_id=1"

https://auth.localhost.direct/authorization?response_type=token&client_id=client1&redirect_uri=https%3A%2F%2Fspa.localhost.direct%3A4200%2Fcallback

https://spa.localhost.direct:4200/callback#access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSU0EyNTYifQ.eyJzdWIiOiJoZWxsbyIsIm5iZiI6MTY5MTMxNTM1MDA1MCwiaWF0IjoxNjkxMzE1MzUwMDgwLCJleHAiOjE2OTEzMTUzNTM2ODAsImlzcyI6Imh0dHBzOi8vYXV0aC5sb2NhbGhvc3QuZGlyZWN0IiwiYXVkIjoiY2xpZW50MSJ9.oLLmr4D2NfAeP0UDWNLMPTgPoCsSj7o7fPxlPBKPeuYEe6Tj2bWrvzYwHkNXceItXhHoCW3PLZ6e8Bz4FXmFLCr415in1Ze02hyexkR4Qvw5b9kxMfCkH-CVMGm4YTNskq8HBp3t0Y9SeHUTBlcH8FNVvNof6LxpLiO-9cqpfhiyUUx45PvxSUrnkH5Azz_8mh_MdRVGntKki88NKOE3nbdCJjNAsd_-TDqrtA-kP2p5rPCf0kIA4qqfi-vtzccxIPk-ZT_KAZH1z6eTljxDzY_3QF4zZCPAct5OiLBTqVI_BcRw5bTi7iZwwGoClEOkPdxC9tR2F8AZIYRrNxZL5g&token_type=Bearer&expires_in=3600

using System.Security.Claims;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Identity.Web;

Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true; // for extended logging

/*
mkdir comments
cd comments
dotnet new web --no-https --exclude-launch-settings
dotnet add package Microsoft.Identity.Web
*/
var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization().AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => {
        options.Authority = "https://auth.localhost.direct";
        options.Audience = "1";

        // for extended logging
        options.Events = new JwtBearerEvents
        {
            OnMessageReceived = context =>
            {
                ILogger logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>().CreateLogger("JwtBearer");
                logger.LogDebug("Message received: {0}", context.Token);
                return Task.CompletedTask;
            },
            OnAuthenticationFailed = context =>
            {
                ILogger logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>().CreateLogger("JwtBearer");
                logger.LogError("Authentication failed: {0}", context.Exception);
                return Task.CompletedTask;
            },
            OnTokenValidated = context =>
            {
                ILogger logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>().CreateLogger("JwtBearer");
                logger.LogDebug("Token validated: {0}", context.SecurityToken);
                return Task.CompletedTask;
            }
        };
    });

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/", (ClaimsPrincipal user) => user.Claims.Select(c => new KeyValuePair<string, string>(c.Type, c.Value)).ToList());

app.Run();