04 · 拉式登入（Login with GPTBots Workspace / M-Auth）

                      
                      { "code": "…", "codeVerifier": "…" }

                    

                      
                      {
  "code": 0,
  "msg": "OK",
  "data": { "wsa": "eyJhbGciOiJIUzI1NiJ9...", "token_type": "Bearer", "expires_in": 300 }
}

                    

                      
                      import { startWorkspaceLogin } from '@gptbots/workspace-extension-sdk';

// 點擊「Login with GPTBots Workspace」時：
await startWorkspaceLogin({
  authorizeUrl: 'https://www.gptbots.ai/api/console/account/extension-app/authorize',
  clientId: 'https://app.example.com/land',      // = 你註冊的 app home URL
  redirectUri: 'https://app.example.com/callback', // host 必須與 clientId 同域
  // workspaceId: 'p-xxx',   // 可選：預選工作空間，跳過組織選擇頁
  // state: '...',           // 可選：預設自動產生 16 位元組隨機 CSRF state
});
// SDK 自動：產生 PKCE(verifier→challenge)、把 verifier+state 存 sessionStorage、
// 校驗 authorizeUrl 是絕對 URL、要求安全上下文(HTTPS/localhost)，然後跳轉到 /authorize

                    

                      
                      import { exchangeWorkspaceCode, verifyWsa } from '@gptbots/workspace-extension-verify';

// POST /session/workspace-login  { code, codeVerifier }
app.post('/session/workspace-login', async (req, res) => {
  try {
    const { wsa } = await exchangeWorkspaceCode({
      tokenUrl: 'https://www.gptbots.ai/api/console/account/extension-app/token',
      code: req.body.code,
      codeVerifier: req.body.codeVerifier,
      // timeoutMs: 10000,   // 預設 10s，防平台慢回應掛住你的請求；傳 0 關閉
    });
    const identity = verifyWsa(wsa, {
      secret: process.env.EXTENSION_APP_SECRET,
      audience: 'app.example.com',
    });
    const sid = createSession(identity);
    res.cookie('sid', sid, { httpOnly: true, secure: true, sameSite: 'lax' });
    res.json(identity);
  } catch (e) {
    res.status(401).json({ error: String(e) });
  }
});