OAuth Setup

// Server: /api/embed-token endpoint (Step A + Step B)
import { SignJWT, importPKCS8 } from 'jose';
import { readFileSync } from 'fs';

const TOKEN_ENDPOINT = 'https://<cgk2_host>/oauth2/v4/token';
const EC_TOKEN_ENDPOINT = 'https://<cgk2_host>/sms/v1/tokens';
const CLIENT_ID = '<client_id>';
const ORG_ID = '<your_org>'; // Must be a real portfolio ID
const KEY_ID = '<key_id_from_kms>';

const privateKeyPem = readFileSync('./private-key.pem', 'utf8');
const privateKey = await importPKCS8(privateKeyPem, 'RS256');

app.post('/api/embed-token', async (req, res) => {
// Step A: Get access_token via client_credentials + private_key_jwt
const assertion = await new SignJWT({
scope: 'transaction_search',
'v-c-merchant-id': 'internal',
acr: 'voice',
act: { sub: ORG_ID, org_id: ORG_ID, sub_id: req.user.id },
})
.setProtectedHeader({ alg: 'RS256', kid: KEY_ID, typ: 'JWT' })
.setSubject(CLIENT_ID)
.setIssuer(ORG_ID)
.setAudience(TOKEN_ENDPOINT)
.setIssuedAt()
.setExpirationTime('5m')
.setJti(crypto.randomUUID())
.sign(privateKey);

const tokenResp = await fetch(TOKEN_ENDPOINT, {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams({
grant_type: 'client_credentials',
client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
client_assertion: assertion,
scope: 'transaction_search',
}),
});

const { access_token } = await tokenResp.json();

// Step B: Exchange access_token for ec_token
const ecResp = await fetch(EC_TOKEN_ENDPOINT, {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
'Authorization': `Bearer ${access_token}`,
},
body: new URLSearchParams({
grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
subject_token: access_token,
subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
requested_token_type: 'urn:visa:params:oauth:token-type:ec-token',
component_type: 'transaction_search',
}),
});

const { access_token: ec_token, expires_in } = await ecResp.json();
res.json({ access_token: ec_token, expires_in });
});

@PostMapping("/api/embed-token")
public ResponseEntity<Map<String, Object>> getEmbedToken() {
    String assertion = Jwts.builder()
        .setHeaderParam("kid", keyId)
        .setSubject(clientId)
        .setIssuer(orgId)
        .setAudience(tokenEndpoint)
        .setIssuedAt(new Date())
        .setExpiration(Date.from(Instant.now().plusSeconds(300)))
        .setId(UUID.randomUUID().toString())
        .claim("scope", "transaction_search")
        .claim("v-c-merchant-id", "internal")
        .signWith(privateKey, SignatureAlgorithm.RS256)
        .compact();

    // Exchange assertion for access token
    MultiValueMap<String, String> body = new LinkedMultiValueMap<>();
    body.add("grant_type", "client_credentials");
    body.add("client_assertion_type",
        "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
    body.add("client_assertion", assertion);

    Map<String, Object> response = restTemplate.postForObject(
        tokenEndpoint, new HttpEntity<>(body, headers), Map.class);

    return ResponseEntity.ok(response);
}

// Frontend: Initialize SDK with OAuth
VisaAcceptance.init({
  auth: {
    type: 'oauth',
    getToken: async () => {
      // Call YOUR backend — never sign JWTs client-side in production
      const resp = await fetch('/api/embed-token', { method: 'POST' });
      const { access_token } = await resp.json();
      return access_token;
    },
    refreshToken: async () => {
      const resp = await fetch('/api/embed-token', { method: 'POST' });
      const { access_token } = await resp.json();
      return access_token;
    },
    expiryBufferSeconds: 60, // Proactive refresh 60s before expiry
  },
});

VisaAcceptance.render('transactions', document.getElementById('container'));