Connect your first social account

import { NextRequest, NextResponse } from "next/server";
import { randomUUID } from "node:crypto";
import { getSession } from "@/lib/session"; // your session abstraction

export async function POST(req: NextRequest) {
  const form = await req.formData();
  const projectId = String(form.get("projectId"));
  const session = await getSession(req);

  const res = await fetch(
    `https://api.layers.com/v1/projects/${projectId}/social/oauth-url`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LAYERS_API_KEY!}`,
        "Idempotency-Key": randomUUID(),
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        platform: "tiktok",
        returnUrl: `${process.env.APP_BASE_URL}/connect/tiktok/return`,
        usageNote: "Connecting Acme Coffee's TikTok",
      }),
    },
  );

  if (!res.ok) {
    const err = await res.json();
    // VALIDATION (422), RETURN_URL_NOT_ALLOWED (403), or FORBIDDEN_SCOPE (403).
    // See https://docs.layers.com/docs/api/operational/errors
    console.error("layers oauth-url failed", err);
    return NextResponse.redirect(`${process.env.APP_BASE_URL}/connect/failed`);
  }

  const { authorizeUrl, state } = await res.json();

  // Persist `state` server-side so the /return handler and the poll loop can
  // both look it up. Keyed by session, not by cookie — see "State token
  // handling" on the oauth-url reference page.
  await session.set("pendingOAuth", { state, projectId, platform: "tiktok" });

  return NextResponse.redirect(authorizeUrl);
}

import express from "express";
import { randomUUID } from "node:crypto";

export const connectTikTok = express.Router();

connectTikTok.post("/connect/tiktok/start", async (req, res) => {
  const { projectId } = req.body;

  const r = await fetch(
    `https://api.layers.com/v1/projects/${projectId}/social/oauth-url`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LAYERS_API_KEY!}`,
        "Idempotency-Key": randomUUID(),
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        platform: "tiktok",
        returnUrl: `${process.env.APP_BASE_URL}/connect/tiktok/return`,
        usageNote: "Connecting Acme Coffee's TikTok",
      }),
    },
  );

  if (!r.ok) {
    console.error("layers oauth-url failed", await r.json());
    return res.redirect("/connect/failed");
  }

  const { authorizeUrl, state } = await r.json();
  // Express `req.session` from express-session, cookie-session, or your store.
  req.session.pendingOAuth = { state, projectId, platform: "tiktok" };
  res.redirect(authorizeUrl);
});

import os
import uuid
import requests
from flask import Blueprint, redirect, request, session

connect_tiktok_bp = Blueprint("connect_tiktok", __name__)

@connect_tiktok_bp.post("/connect/tiktok/start")
def start():
    project_id = request.form["projectId"]
    r = requests.post(
        f"https://api.layers.com/v1/projects/{project_id}/social/oauth-url",
        headers={
            "Authorization": f"Bearer {os.environ['LAYERS_API_KEY']}",
            "Idempotency-Key": str(uuid.uuid4()),
            "Content-Type": "application/json",
        },
        json={
            "platform": "tiktok",
            "returnUrl": f"{os.environ['APP_BASE_URL']}/connect/tiktok/return",
            "usageNote": "Connecting Acme Coffee's TikTok",
        },
        timeout=10,
    )
    if not r.ok:
        # See https://docs.layers.com/docs/api/operational/errors
        return redirect("/connect/failed")

    body = r.json()
    # Server-side session; do NOT put state in a cookie the user can read.
    session["pending_oauth"] = {
        "state": body["state"],
        "project_id": project_id,
        "platform": "tiktok",
    }
    return redirect(body["authorizeUrl"])

import { NextRequest, NextResponse } from "next/server";
import { getSession } from "@/lib/session";

export async function GET(req: NextRequest) {
  const session = await getSession(req);
  const pending = await session.get("pendingOAuth");
  if (!pending) return NextResponse.redirect("/connect/failed?reason=no_session");

  const error = req.nextUrl.searchParams.get("layers_oauth_error");
  if (error) {
    await session.delete("pendingOAuth");
    return NextResponse.redirect(`/connect/failed?reason=${error}`);
  }

  // Success path — Layers has persisted the account. Send the user to a
  // "Connecting…" UI; that page (or a background job) polls oauth-status.
  return NextResponse.redirect(`/connect/connecting?state=${pending.state}`);
}

connectTikTok.get("/connect/tiktok/return", (req, res) => {
  const pending = req.session.pendingOAuth;
  if (!pending) return res.redirect("/connect/failed?reason=no_session");

  const error = req.query.layers_oauth_error as string | undefined;
  if (error) {
    delete req.session.pendingOAuth;
    return res.redirect(`/connect/failed?reason=${error}`);
  }

  res.redirect(`/connect/connecting?state=${pending.state}`);
});

@connect_tiktok_bp.get("/connect/tiktok/return")
def callback():
    pending = session.get("pending_oauth")
    if not pending:
        return redirect("/connect/failed?reason=no_session")

    error = request.args.get("layers_oauth_error")
    if error:
        session.pop("pending_oauth", None)
        return redirect(f"/connect/failed?reason={error}")

    return redirect(f"/connect/connecting?state={pending['state']}")

const POLL_INTERVAL_MS = 5_000; // 5s floor: oauth-status is rate-limited and
                                // poll-budget-tight; under 5s wastes budget.
const MAX_POLL_MS = 10 * 60 * 1_000; // state row TTL.

export async function pollOAuthStatus(state: string): Promise<string> {
  const deadline = Date.now() + MAX_POLL_MS;
  // Only used when we hit 429. Normal pending polls keep the fixed cadence.
  let backoffMs = POLL_INTERVAL_MS;

  while (Date.now() < deadline) {
    const res = await fetch(
      `https://api.layers.com/v1/social/oauth-status/${state}`,
      { headers: { Authorization: `Bearer ${process.env.LAYERS_API_KEY!}` } },
    );

    if (res.status === 429) {
      const retryAfter = Number(res.headers.get("Retry-After") ?? "5") * 1_000;
      await new Promise(r => setTimeout(r, Math.max(retryAfter, backoffMs)));
      backoffMs = Math.min(backoffMs * 2, 30_000);
      continue;
    }

    // Successful response — reset the 429 backoff so we don't carry it
    // forward into the next pending poll.
    backoffMs = POLL_INTERVAL_MS;

    const body = await res.json();
    if (body.status === "completed") return body.socialAccountId as string;
    if (body.status === "failed") {
      throw new Error(`oauth failed: ${body.error?.code} — ${body.error?.message}`);
    }

    await new Promise(r => setTimeout(r, POLL_INTERVAL_MS));
  }

  throw new Error("oauth state expired before user completed consent");
}

import os
import time
import requests

POLL_INTERVAL_S = 5  # 5s floor.
MAX_POLL_S = 10 * 60  # state row TTL.

def poll_oauth_status(state: str) -> str:
    deadline = time.monotonic() + MAX_POLL_S
    # Only used when we hit 429. Normal pending polls keep the fixed cadence.
    backoff_s = POLL_INTERVAL_S

    while time.monotonic() < deadline:
        r = requests.get(
            f"https://api.layers.com/v1/social/oauth-status/{state}",
            headers={"Authorization": f"Bearer {os.environ['LAYERS_API_KEY']}"},
            timeout=10,
        )
        if r.status_code == 429:
            retry_after = int(r.headers.get("Retry-After", "5"))
            time.sleep(max(retry_after, backoff_s))
            backoff_s = min(backoff_s * 2, 30)
            continue

        # Successful response — reset the 429 backoff so we don't carry it
        # forward into the next pending poll.
        backoff_s = POLL_INTERVAL_S

        body = r.json()
        if body["status"] == "completed":
            return body["socialAccountId"]
        if body["status"] == "failed":
            err = body.get("error", {})
            raise RuntimeError(f"oauth failed: {err.get('code')} — {err.get('message')}")

        time.sleep(POLL_INTERVAL_S)

    raise RuntimeError("oauth state expired before user completed consent")