Integrar o Contas Voneka

// Laravel — redireccionar para login Contas
$state = Str::random(40);
session(['oauth_state' => $state]);

return redirect(config('services.contas.base').'oauth/authorize?'.http_build_query([
    'response_type' => 'code',
    'client_id'     => config('services.contas.client_id'),
    'redirect_uri'  => config('services.contas.redirect'),
    'scope'         => '',
    'state'         => $state,
]));

// Callback — trocar code + obter user
if ($request->state !== session('oauth_state')) {
    abort(403);
}

$token = Http::asForm()->post(config('services.contas.base').'oauth/token', [
    'grant_type'    => 'authorization_code',
    'client_id'     => config('services.contas.client_id'),
    'client_secret' => config('services.contas.client_secret'),
    'redirect_uri'  => config('services.contas.redirect'),
    'code'          => $request->code,
])->throw()->json();

$user = Http::withToken($token['access_token'])
    ->acceptJson()
    ->get(config('services.contas.base').'api/user')
    ->throw()
    ->json();

// $user['email'], $user['name'], $user['telefone'], …

// Node.js (Express) — callback
import crypto from 'crypto';
import express from 'express';

const BASE = process.env.OAUTH_BASE_URI; // https://contas.get.co.mz/
const app = express();

app.get('/login', (req, res) => {
  const state = crypto.randomBytes(20).toString('hex');
  req.session.oauth_state = state;
  const q = new URLSearchParams({
    response_type: 'code',
    client_id: process.env.OAUTH_CLIENT_ID,
    redirect_uri: process.env.OAUTH_REDIRECT_URI,
    scope: '',
    state,
  });
  res.redirect(`${BASE}oauth/authorize?${q}`);
});

app.get('/callback', async (req, res) => {
  if (req.query.state !== req.session.oauth_state) {
    return res.status(403).send('Invalid state');
  }
  const body = new URLSearchParams({
    grant_type: 'authorization_code',
    client_id: process.env.OAUTH_CLIENT_ID,
    client_secret: process.env.OAUTH_CLIENT_SECRET,
    redirect_uri: process.env.OAUTH_REDIRECT_URI,
    code: req.query.code,
  });
  const tok = await fetch(`${BASE}oauth/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body,
  }).then((r) => r.json());

  const user = await fetch(`${BASE}api/user`, {
    headers: {
      Authorization: `Bearer ${tok.access_token}`,
      Accept: 'application/json',
    },
  }).then((r) => r.json());

  // criar sessão local com user.email / user.name
  res.redirect('/');
});

# Python (Flask) — callback
import os, secrets, requests
from flask import Flask, redirect, request, session, abort
from urllib.parse import urlencode

BASE = os.environ["OAUTH_BASE_URI"]  # https://contas.get.co.mz/
app = Flask(__name__)

@app.get("/login")
def login():
    state = secrets.token_urlsafe(24)
    session["oauth_state"] = state
    q = urlencode({
        "response_type": "code",
        "client_id": os.environ["OAUTH_CLIENT_ID"],
        "redirect_uri": os.environ["OAUTH_REDIRECT_URI"],
        "scope": "",
        "state": state,
    })
    return redirect(f"{BASE}oauth/authorize?{q}")

@app.get("/callback")
def callback():
    if request.args.get("state") != session.get("oauth_state"):
        abort(403)
    tok = requests.post(
        f"{BASE}oauth/token",
        data={
            "grant_type": "authorization_code",
            "client_id": os.environ["OAUTH_CLIENT_ID"],
            "client_secret": os.environ["OAUTH_CLIENT_SECRET"],
            "redirect_uri": os.environ["OAUTH_REDIRECT_URI"],
            "code": request.args["code"],
        },
        timeout=15,
    ).json()
    user = requests.get(
        f"{BASE}api/user",
        headers={
            "Authorization": f"Bearer {tok['access_token']}",
            "Accept": "application/json",
        },
        timeout=15,
    ).json()
    # session["user"] = user["email"]
    return redirect("/")

// Browser / SPA com PKCE (sem client_secret)
async function loginWithContas() {
  const verifier = base64Url(crypto.getRandomValues(new Uint8Array(32)));
  const challenge = base64Url(
    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))
  );
  sessionStorage.setItem('pkce_verifier', verifier);
  const state = crypto.randomUUID();
  sessionStorage.setItem('oauth_state', state);

  const q = new URLSearchParams({
    response_type: 'code',
    client_id: 'CLIENT_ID_PUBLICO',
    redirect_uri: 'https://sua-spa.co.mz/callback',
    scope: '',
    state,
    code_challenge: challenge,
    code_challenge_method: 'S256',
  });
  location.href = 'https://contas.get.co.mz/oauth/authorize?' + q;
}

// No callback (idealmente via BFF; se no browser, só com cliente público)
async function exchange(code) {
  const body = new URLSearchParams({
    grant_type: 'authorization_code',
    client_id: 'CLIENT_ID_PUBLICO',
    redirect_uri: 'https://sua-spa.co.mz/callback',
    code,
    code_verifier: sessionStorage.getItem('pkce_verifier'),
  });
  const tok = await fetch('https://contas.get.co.mz/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body,
  }).then((r) => r.json());
  return tok.access_token;
}

function base64Url(buf) {
  const b = buf instanceof ArrayBuffer ? new Uint8Array(buf) : buf;
  let s = '';
  b.forEach((x) => (s += String.fromCharCode(x)));
  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}