04 · 拉式登录（Login with GPTBots Workspace / M-Auth）

                      
                      { "code": "…", "codeVerifier": "…" }

                    

                      
                      {
  "code": 0,
  "msg": "OK",
  "data": { "wsa": "eyJhbGciOiJIUzI1NiJ9...", "token_type": "Bearer", "expires_in": 300 }
}

                    

                      
                      import { startWorkspaceLogin } from '@gptbots/workspace-extension-sdk';

// 点击「Login with GPTBots Workspace」时：
await startWorkspaceLogin({
  authorizeUrl: 'https://www.gptbots.ai/api/console/account/extension-app/authorize',
  clientId: 'https://app.example.com/land',      // = 你注册的 app home URL
  redirectUri: 'https://app.example.com/callback', // host 必须与 clientId 同域
  // workspaceId: 'p-xxx',   // 可选：预选工作空间，跳过组织选择页
  // state: '...',           // 可选：默认自动生成 16 字节随机 CSRF state
});
// SDK 自动：生成 PKCE(verifier→challenge)、把 verifier+state 存 sessionStorage、
// 校验 authorizeUrl 是绝对 URL、要求安全上下文(HTTPS/localhost)，然后跳转到 /authorize

                    

                      
                      import { exchangeWorkspaceCode, verifyWsa } from '@gptbots/workspace-extension-verify';

// POST /session/workspace-login  { code, codeVerifier }
app.post('/session/workspace-login', async (req, res) => {
  try {
    const { wsa } = await exchangeWorkspaceCode({
      tokenUrl: 'https://www.gptbots.ai/api/console/account/extension-app/token',
      code: req.body.code,
      codeVerifier: req.body.codeVerifier,
      // timeoutMs: 10000,   // 默认 10s，防平台慢响应挂住你的请求；传 0 关闭
    });
    const identity = verifyWsa(wsa, {
      secret: process.env.EXTENSION_APP_SECRET,
      audience: 'app.example.com',
    });
    const sid = createSession(identity);
    res.cookie('sid', sid, { httpOnly: true, secure: true, sameSite: 'lax' });
    res.json(identity);
  } catch (e) {
    res.status(401).json({ error: String(e) });
  }
});