Backend Proxy (BFF) Integration

const BASE = process.env.CANOPY_AUTH_BASE_URL;
const COOKIE = "app_refresh";

// httpOnly so no script can read it. Secure so it never crosses plain HTTP.
// SameSite=Lax so a cross-site POST cannot ride it. Path limited to your auth
// routes so it is not attached to every request your app makes.
const COOKIE_OPTIONS = {
  httpOnly: true,
  secure: true,
  sameSite: "lax",
  path: "/auth",
  maxAge: 180 * 24 * 60 * 60 * 1000,
};

// One credential per request: the secret API key, and no Authorization header,
// which these calls do not need. The browser's address and user agent ride
// along, so Canopy throttles per person and records their device, not yours;
// both are honoured only because a secret key of the same Environment is on
// the same request.
async function callCanopy(path, body, req) {
  const upstream = await fetch(`${BASE}${path}`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-API-Key": process.env.CANOPY_SECRET_API_KEY,
      "X-Canopy-Client-IP": req.ip,
      "X-Canopy-Client-User-Agent": req.get("user-agent") ?? "",
    },
    body: JSON.stringify(body),
  });

  return { status: upstream.status, body: await upstream.json() };
}

// POST /auth/login
async function login(req, res) {
  const { email, password } = req.body;
  const { status, body } = await callCanopy(
    "/login",
    { publishable_key: process.env.CANOPY_PUBLISHABLE_KEY, email, password },
    req,
  );

  if (status !== 200) {
    return res.status(status).json(body);
  }

  const { refresh_token, ...session } = body.data;

  // An MFA challenge or an enrolment continuation carries no refresh token.
  // Pass it through unchanged and let the frontend drive the next step.
  if (refresh_token) {
    res.cookie(COOKIE, refresh_token, COOKIE_OPTIONS);
  }

  return res.json({ data: session });
}

// POST /auth/refresh
async function refresh(req, res) {
  const stored = req.cookies?.[COOKIE];

  if (!stored) {
    return res
      .status(401)
      .json({ error: { code: "auth.invalid_refresh_token" } });
  }

  const { status, body } = await callCanopy(
    "/refresh",
    { refresh_token: stored },
    req,
  );

  if (status !== 200) {
    res.clearCookie(COOKIE, COOKIE_OPTIONS);

    return res.status(status).json(body);
  }

  const { refresh_token, ...session } = body.data;

  // Rotation: ALWAYS overwrite. The token you just presented is already dead,
  // and presenting it again is treated as theft.
  res.cookie(COOKIE, refresh_token, COOKIE_OPTIONS);

  return res.json({ data: session });
}

// POST /auth/logout
// The refresh token alone ends its session, so this works even after the
// person's access token has expired.
async function logout(req, res) {
  const stored = req.cookies?.[COOKIE];

  if (stored) {
    await callCanopy("/logout", { refresh_token: stored }, req);
  }

  res.clearCookie(COOKIE, COOKIE_OPTIONS);

  return res.json({ data: { message: "Signed out" } });
}