verify-openstreetmap.ts - hono + OpenStreetMap OAuth 2.0 provider test

verify-openstreetmap.ts

/**
 * Throwaway manual verification of the OpenStreetMap provider against the real
 * openstreetmap.org. Not part of the package -- excluded via .git/info/exclude.
 *
 *   OPENSTREETMAP_ID=... OPENSTREETMAP_SECRET=... bun run verify-openstreetmap.ts
 *
 * Register the app at https://www.openstreetmap.org/oauth2/applications with
 * the redirect URI http://127.0.0.1:3000/openstreetmap -- OpenStreetMap only
 * allows plain http for the hosts 127.0.0.1 and ::1, never for `localhost`.
 *
 * Tick "Read user preferences" (read_prefs). `read_email` is one of the
 * PRIVILEGED_SCOPES and is only offered to OpenStreetMap site administrators,
 * so `user.email` stays undefined here.
 */
import { Hono } from 'hono'
import { openstreetmapAuth, revokeToken } from './src/providers/openstreetmap'

const client_id = process.env.OPENSTREETMAP_ID
const client_secret = process.env.OPENSTREETMAP_SECRET

if (!client_id || !client_secret) {
  console.error('Set OPENSTREETMAP_ID and OPENSTREETMAP_SECRET.')
  process.exit(1)
}

let lastToken: string | undefined

const app = new Hono()

app.get('/', (c) =>
  c.html(
    '<h1>@hono/oauth-providers &mdash; OpenStreetMap</h1>' +
      '<p><a href="/openstreetmap">Log in with OpenStreetMap</a></p>' +
      (lastToken ? '<p><a href="/revoke">Revoke the last token</a></p>' : '')
  )
)

app.use(
  '/openstreetmap',
  openstreetmapAuth({
    client_id,
    client_secret,
    scope: ['read_prefs'],
  })
)

app.get('/openstreetmap', (c) => {
  const token = c.get('token')
  const grantedScopes = c.get('granted-scopes')
  const user = c.get('user-openstreetmap')

  lastToken = token?.token

  console.log('token         :', token)
  console.log('granted-scopes:', grantedScopes)
  console.log('user          :', user)

  return c.json({ token, grantedScopes, user })
})

app.get('/revoke', async (c) => {
  if (!lastToken) {
    return c.text('Log in first.', 400)
  }

  const revoked = await revokeToken(client_id, client_secret, lastToken)
  console.log('revoked       :', revoked)

  // A revoked token must stop working.
  const recheck = await fetch('https://api.openstreetmap.org/api/0.6/user/details.json', {
    headers: { Authorization: `Bearer ${lastToken}` },
  })
  console.log('recheck status:', recheck.status, await recheck.text())

  lastToken = undefined

  return c.json({ revoked, recheckStatus: recheck.status })
})

export default {
  port: 3000,
  hostname: '127.0.0.1',
  fetch: app.fetch,
}