1
app.get("/callback", async (req, res) => {
2
  const { code, state } = req.query;
3
  if (!code) return res.status(400).send("No code provided");
4

5
  try {
6
    const { user, accessToken, refreshToken, authenticationMethod } =
7
      await workos.userManagement.authenticate({
8
        // 等同于 authenticateWithCode;Node SDK 将路由到 /user_management/authenticate
9
        clientId: process.env.WORKOS_CLIENT_ID,
10
        grantType: "authorization_code",
11
        code,
12
        ipAddress: req.ip,
13
        userAgent: req.headers["user-agent"],
14
      });
15

16
    // 会话封存(sealedSession)供 Web 使用
17
    const { sealedSession } = await workos.userManagement.refreshAndSealSessionData({
18
      sessionData: JSON.stringify({ accessToken, refreshToken }),
19
      cookiePassword: process.env.WORKOS_COOKIE_PASSWORD,
20
    });
21

22
    res.cookie("wos-session", sealedSession, {
23
      path: "/",
24
      httpOnly: true,
25
      secure: true,
26
      sameSite: "lax",
27
    });
28

29
    // 统一身份联邦映射(find_or_create)
30
    const localUser = await db.users.findOrCreateByWorkOS({
31
      workosUserId: user.id,
32
      email: user.email,
33
      profile: user,
34
      authMethod: authenticationMethod,
35
    });
36

37
    // 为 Native 颁发业务 JWT(不透传在 URI;由 Native 通过 HTTPS 拉取)
38
    const myAppJwt = await jwt.issueForUser(localUser.id, {
39
      roles: localUser.roles,
40
      orgId: user.organization_id,
41
    });
42
    await db.tokens.bindLatestJwt(localUser.id, myAppJwt);
43

44
    // 根据 state 判断来源并处理重定向
45
    if (state && String(state).includes("origin=native")) {
46
      // Native 登录成功:通过 URI Scheme 通知,不带敏感令牌
47
      const nativeUri = `yourappscheme://login/success?ok=1&uid=${encodeURIComponent(localUser.id)}`;
48
      return res.redirect(nativeUri);
49
    }
50

51
    // Web 登录成功:直接回首页或目标页
52
    return res.redirect("/");
53
  } catch (err) {
54
    // 错误码示例:access_denied/organization_invalid/ambiguous_connection_selector 等
55
    console.error("AuthKit callback error:", err);
56
    return res.redirect("/login?error=auth_failed");
57
  }
58
});

1
function withAuth(req, res, next) {
2
  const sealed = req.cookies["wos-session"];
3
  if (!sealed) return res.redirect("/login");
4

5
  (async () => {
6
    const authResp = await workos.userManagement.authenticateWithSessionCookie({
7
      sessionData: sealed,
8
      cookiePassword: process.env.WORKOS_COOKIE_PASSWORD,
9
    });
10

11
    if (authResp.authenticated) {
12
      req.authUser = authResp.user;
13
      return next();
14
    }
15

16
    // 无会话或过期:尝试刷新并回写 Cookie
17
    const refreshResp = await workos.userManagement.refreshAndSealSessionData({
18
      sessionData: sealed,
19
      cookiePassword: process.env.WORKOS_COOKIE_PASSWORD,
20
    });
21

22
    if (!refreshResp.authenticated) {
23
      res.clearCookie("wos-session");
24
      return res.redirect("/login");
25
    }
26

27
    res.cookie("wos-session", refreshResp.sealedSession, {
28
      path: "/",
29
      httpOnly: true,
30
      secure: true,
31
      sameSite: "lax",
32
    });
33
    return res.redirect(req.originalUrl); // 确保新会话生效
34
  })().catch(() => {
35
    res.clearCookie("wos-session");
36
    return res.redirect("/login");
37
  });
38
}
39

40
app.get("/dashboard", withAuth, (req, res) => {
41
  res.send(`Welcome ${req.authUser.email}`);
42
});

1
<!-- AndroidManifest.xml 配置深链接 -->
2
<activity android:name=".LoginCallbackActivity">
3
    <intent-filter>
4
        <action android:name="android.intent.action.VIEW" />
5
        <category android:name="android.intent.category.DEFAULT" />
6
        <category android:name="android.intent.category.BROWSABLE" />
7
        <data
8
            android:scheme="yourappscheme"
9
            android:host="login"
10
            android:pathPrefix="/success" />
11
    </intent-filter>
12
</activity>

1
// LoginCallbackActivity.kt - 处理登录回调
2
class LoginCallbackActivity : AppCompatActivity() {
3
    override fun onCreate(savedInstanceState: Bundle?) {
4
        super.onCreate(savedInstanceState)
5

6
        // 处理深链接
7
        intent?.data?.let { uri ->
8
            if (uri.scheme == "yourappscheme" &&
9
                uri.host == "login" &&
10
                uri.path == "/success") {
11

12
                val ok = uri.getQueryParameter("ok") == "1"
13
                val uid = uri.getQueryParameter("uid")
14

15
                if (ok && uid != null) {
16
                    // 通过 HTTPS 拉取 JWT(不在 URI 中携带令牌)
17
                    lifecycleScope.launch {
18
                        try {
19
                            val token = NativeApi.fetchJWT(
20
                                uid = uid,
21
                                deviceProof = DeviceProof.current()
22
                            )
23
                            Session.storeJWT(token)
24
                            AppState.setLoggedIn(true)
25

26
                            // 跳转到主界面
27
                            startActivity(Intent(this@LoginCallbackActivity, MainActivity::class.java))
28
                            finish()
29
                        } catch (e: Exception) {
30
                            Log.e("LoginCallback", "Failed to fetch JWT", e)
31
                            Toast.makeText(this@LoginCallbackActivity, "登录失败", Toast.LENGTH_SHORT).show()
32
                            finish()
33
                        }
34
                    }
35
                }
36
            }
37
        }
38
    }
39
}

1
// 后端:Native 拉取业务 JWT
2
app.post("/native/session/jwt", async (req, res) => {
3
  const { uid, deviceProof } = req.body;
4
  if (!uid) return res.status(400).json({ error: "missing_uid" });
5

6
  // 校验设备证明(防止任意人持 uid 取 JWT)
7
  const ok = await verifyDeviceProof(uid, deviceProof);
8
  if (!ok) return res.status(401).json({ error: "invalid_device_proof" });
9

10
  const record = await db.tokens.getLatestJwt(uid);
11
  if (!record) return res.status(404).json({ error: "no_jwt" });
12

13
  return res.json({ token: record.value, tokenType: "Bearer", expiresIn: 3600 });
14
});

1
app.get("/logout", async (req, res) => {
2
  try {
3
    const session = await workos.userManagement.loadSealedSession({
4
      sessionData: req.cookies["wos-session"],
5
      cookiePassword: process.env.WORKOS_COOKIE_PASSWORD,
6
    });
7

8
    const logoutUrl = await session.getLogOutUrl();
9
    res.clearCookie("wos-session");
10
    return res.redirect(logoutUrl);
11
  } catch {
12
    res.clearCookie("wos-session");
13
    return res.redirect("/login");
14
  }
15
});

1
// 生成 Gmail 授权 URL
2
app.get("/oauth/gmail/connect", (req, res) => {
3
  const authorizationUrl = workos.userManagement.getAuthorizationUrl({
4
    provider: "authkit",
5
    redirectUri: "https://yourapp.com/callback",
6
    clientId: process.env.WORKOS_CLIENT_ID,
7
    state: "feature=gmail",
8
    providerScopes: ["https://www.googleapis.com/auth/gmail.modify"],
9
  });
10
  res.redirect(authorizationUrl);
11
});