GC Connect

const params = new URLSearchParams({
  client_id: 'your-client-id',
  redirect_uri: 'https://example.com/callback',
  scope: 'read orders:read',
  state: crypto.randomUUID(), // store this in the user's session for CSRF check
  environment: 'production',  // or 'sandbox' during development
});

const authUrl = `https://gc.tybritelabs.com/connect/authorize?${params}`;
// Redirect the user: window.location.href = authUrl (browser), or res.redirect(authUrl) (server)

const data = await client.gcConnect.getConnectAuthorize({
  clientId: 'your-client-id',
  redirectUri: 'https://example.com/callback',
  scope: 'read orders:read',
  state: 'a8f3d2e1c9b7',
  environment: 'sandbox',
});

// {
//   valid: true,
//   client:  { client_id: "your-client-id", name: "Your App", description: "...", logo_url: "..." },
//   request: { redirect_uri: "https://example.com/callback",
//              scopes: ["read", "orders:read"], state: "a8f3d2e1c9b7", environment: "sandbox" }
// }
console.log(data.client.name);          // your application's display name
console.log(data.request.scopes);       // ["read", "orders:read"]
console.log(data.request.environment);  // "sandbox"

const { code, redirect_uri } = await client.gcConnect.postConnectAuthorize({
  requestBody: {
    client_id: 'your-client-id',
    redirect_uri: 'https://example.com/callback',   // must match the original request
    scope: 'read orders:read',                      // must match the original request
    state: 'a8f3d2e1c9b7',                          // carried through from the original request
    environment: 'sandbox',
    store_id: '3f1a2b4c-1111-2222-3333-444455556666'
  }
});

// In your callback handler (e.g. GET /callback?code=XXX&state=YYY)
async function handleCallback(req, res) {
  const { code, state } = req.query;

  // Always verify state before calling token exchange
  if (state !== req.session.oauthState) {
    return res.status(400).send('State mismatch — possible CSRF');
  }

  const result = await client.gcConnect.connectToken({
    requestBody: {
      code,
      client_id: 'your-client-id',
      client_secret: process.env.GC_CLIENT_SECRET,
      redirect_uri: 'https://example.com/callback',
    },
  });

  // Store the keys + signing secret — none are shown again
  await db.merchants.storeKeys(merchantId, {
    sk: result.sk,
    pk: result.pk,
    signing_secret: result.signing_secret, // sign order/payment writes with this
    pair_id: result.pair_id,
    store_id: result.store_id,
    environment: result.environment,
  });

  res.redirect('/dashboard?connected=true');
}

await client.gcConnect.connectRevoke({
  requestBody: {
    pair_id: storedPairId,
    client_id: 'your-client-id',
    client_secret: process.env.GC_CLIENT_SECRET,
    revoke_reason: 'subscription_cancelled', // optional
  },
});
// returns { success: true }
// (an already-revoked connection returns { success: true, message: 'Already revoked' })

const { sessions } = await client.gcConnect.listConnectSessions();

for (const session of sessions) {
  console.log(session.client_name);    // e.g. "Anvil"
  console.log(session.environment);   // "production"
  console.log(session.scopes);        // ["read", "orders:read"]
  console.log(session.connected_at);  // "2026-05-28T10:00:00Z"
  console.log(session.last_used_at);  // "2026-05-28T14:30:00Z"
  console.log(session.pair_id);       // UUID — use to revoke
}

// A store with no connected apps returns { sessions: [] }.

import { Tybrite } from '@tybrite-labs/sdk';

// Initialize without a global API key — for the Connect flow,
// auth is per-merchant and handled at exchange time.
const client = new Tybrite();

// Step 1 — build the authorization URL and redirect the merchant
export function buildAuthUrl(state: string): string {
  const params = new URLSearchParams({
    client_id: process.env.GC_CLIENT_ID!,
    redirect_uri: `${process.env.APP_URL}/callback`,
    scope: 'read orders:read customers:read',
    state,
    environment: process.env.NODE_ENV === 'production' ? 'production' : 'sandbox',
  });
  return `https://gc.tybritelabs.com/connect/authorize?${params}`;
}

// Step 2 — handle the callback and exchange the code
export async function handleCallback(code: string, state: string, sessionState: string) {
  if (state !== sessionState) throw new Error('CSRF check failed');

  const result = await client.gcConnect.connectToken({
    requestBody: {
      code,
      client_id: process.env.GC_CLIENT_ID!,
      client_secret: process.env.GC_CLIENT_SECRET!,
      redirect_uri: `${process.env.APP_URL}/callback`,
    },
  });

  return result; // { sk, pk, signing_secret, pair_id, store_id, environment, scopes }
}

// Step 3 — use the sk to call the API on behalf of the merchant
export function merchantClient(sk: string): Tybrite {
  return new Tybrite({ apiKey: sk });
}