Login met ROUT

https://rout.be/.well-known/openid-configuration

// 1. Discovery ophalen (nooit endpoints hardcoden)
const oidc = await fetch("https://rout.be/.well-known/openid-configuration").then((r) => r.json());

// 2. Per poging: verifier, state en nonce — bewaar ze in een HttpOnly-cookie
const b64 = (b) => btoa(String.fromCharCode(...new Uint8Array(b)))
  .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
const verifier = b64(crypto.getRandomValues(new Uint8Array(32)));
const challenge = b64(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
const state = crypto.randomUUID();
const nonce = crypto.randomUUID();

// 3. Doorsturen
const url = new URL(oidc.authorization_endpoint);
url.search = new URLSearchParams({
  response_type: "code",
  client_id: process.env.ROUT_CLIENT_ID,
  redirect_uri: "https://jouwapp.be/auth/callback/rout",
  scope: "openid profile email",
  code_challenge: challenge,
  code_challenge_method: "S256",
  state, nonce,
}).toString();

// Op je server, in /auth/callback/rout — na controle van state
const res = await fetch(oidc.token_endpoint, {
  method: "POST",
  headers: { "content-type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "authorization_code",
    code, redirect_uri, code_verifier: verifier,
    client_id: process.env.ROUT_CLIENT_ID,
    client_secret: process.env.ROUT_CLIENT_SECRET, // nooit in de browser
  }),
});
const { id_token, access_token } = await res.json();
// Controleer id_token via jwks_uri (ES256): iss, aud === client_id, exp en nonce.

alter table users add column if not exists rout_id text unique;
alter table users add column if not exists email_verified boolean not null default false;
alter table users add column if not exists is_verified_person boolean not null default false;
alter table users add column if not exists is_verified_business boolean not null default false;
alter table users add column if not exists is_influencer boolean not null default false;

create table if not exists user_identities (
  user_id uuid not null references users(id) on delete cascade,
  provider text not null,          -- 'rout'
  subject text not null,           -- sub-claim
  primary key (provider, subject)
);

{
  "id": "evt_01J9Z8K3QH4M2N",
  "type": "user.handle.updated",
  "created_at": "2026-10-10T10:40:00Z",
  "client_id": "rout_your_client_id",
  "data": {
    "sub": "8f0c2a4e-…",
    "previous_handle": "oldname",
    "rout_handle": "newname"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyRoutSignature(rawBody: string, header: string, secret: string) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false; // replay window 5 min
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const got = Buffer.from(parts.v1 ?? "", "hex");
  return got.length === 32 && timingSafeEqual(got, Buffer.from(expected, "hex"));
}