GET https://{web_host}/#/authorize?response_type=code&client_id={client_id}&redirect_uri={redirect_uri}

 app.get('/sign-in', async function (req, res) {

     const webHost = process.env.webHost;
     const redirectUri = buildRedirectUri(req); // E.g. https://acme-inc.com/auth
     let authorizeUri = `https://${webHost}/#/authorize`
     authorizeUri += '?response_type=code';
     authorizeUri += `&client_id=${process.env.clientId}`; // e.g. acme-inc
     authorizeUri += `&redirect_uri=${redirectUri}`;

     // Return sign in link
     res.send(`<a href="${authorizeUri}">Sign in to LawVu</a>`);
 });

 function buildRedirectUri(req) {
     // Get current host. E.g. https://acme-inc.com/
     const hostUrl = `${req.protocol}://${req.get('host')}`;

     // Build redirect_url. E.g. https://acme-inc.com/auth
     // Encode to avoid conflicts with special characters
     const encodedUri = encodeURI(`${hostUrl}/auth`);

     return encodedUri;
 }

 POST https://{api_host}/account-apis/v1/auth/token

app.get('/auth', async function (req, res) {

    // Build request to exchange auth code for an access token
    const authCode = req.query.code;
    const redirectUri = buildRedirectUri(req);
    const params = new URLSearchParams();
    params.append('code', authCode);
    params.append('grant_type', 'authorization_code');
    params.append('client_id', process.env.clientId); // e.g. acme-inc
    params.append('redirect_uri', redirectUri); // matches the redirect URI specified in the previous step
    params.append('client_secret', process.env.clientSecret); // never hard-code sensitive information

    const config = {
        headers: {
            'Content-Type': 'application/x-www-form-urlencoded'
        }
    };

    // Call LawVu Auth token API
    const apiHost = process.env.apiHost;
    const tokenUrl = `https://${apiHost}/account-apis/v1/auth/token`;
    const response = await axios.post(tokenUrl, params, config);

    // Store tokens for later use
    // For security best practice, tokens should be encrypted before storing
    await encryptAndPersistTokens({
        accessToken: response.data.access_token,
        refreshToken: response.data.refresh_token,
        expiresUtc: response.data.expires,
        gateway: response.data.gateway
    });

    // Send success response
    res.send('<h1>Signed in to LawVu!</h1>');
})

app.get('/user-list', async function (req, res) {

    // Retrieve a valid access from storage, refreshing if expired
    const accessToken = await getValidAccessToken(req, res);

    // Build authorized request
    const config = {
        headers: {
            'Authorization': `Bearer ${accessToken}`
        }
    };

    const apiHost = process.env.apiHost;
    const lawVuEndpoint = `${apiHost}/account-apis/v1/users`;
    const response = await axios.get(lawVuEndpoint, config);

    const users = response.data
        .map(user => `<li>${user.firstName} ${user.lastName}</li>`)
        .join('');

    res.send(`<ul>${users}</ul>`);
})

  POST https://{api_host}/account-apis/v1/auth/token

/**
* Retrieve a valid access from storage, refreshing if expired
* @returns string 
*/
async function getValidAccessToken() {

   // Retrieve decrypted token from secure storage
   const savedTokens = await getDecryptedTokens();

   const now = getUtcNowDate();
   const accessTokenExpiryDate = new Date(savedTokens.expiresUtc);
   const isTokenExpired = accessTokenExpiryDate < now; 

   if (!isTokenExpired) {
       return savedTokens.accessToken;
   }

   // Refresh token request payload
   const params = new URLSearchParams();
   params.append('grant_type', 'refresh_token');
   params.append('refresh_token', savedTokens.refreshToken);
   params.append('client_id', process.env.clientId); // e.g. acme-inc

   // Headers
   const config = {
       headers: {
           'Content-Type': 'application/x-www-form-urlencoded'
       }
   };

   // Refresh token request
   const apiHost = process.env.apiHost;
   const tokenUrl = `https://${apiHost}/account-apis/v1/auth/token`;
   const response = await axios.post(tokenUrl, params, config);

   // Store updated tokens and expiry timestamp
   // For security best practice, tokens should be encrypted before storing
   await encryptAndPersistTokens({
       accessToken: response.data.access_token,
       refreshToken: response.data.refresh_token,
       expiresUtc: response.data.expires,
       gateway: response.data.gateway
   });

   return response.data.access_token;
}

 app.get('/users/whats-my-org-id', async function (req, res) {

   // Retrieve a valid access from storage, refreshing if expired
   const accessToken = await getValidAccessToken(req, res);

   const decodedToken = jwt_decode(accessToken);

   res.send(`<h1>Your org id: ${decodedToken.organisationId}</h1>`);
})