web/apps/partner-sas/auth/scandic/getToken.ts

import { config } from "./config"
import { endpoints } from "./endpoints"

export async function getToken({ code }: { code: string }) {
  const params = new URLSearchParams({
    grant_type: "authorization_code",
    code,
    redirect_uri: config.redirect_uri,
    client_id: config.client_id,
    client_secret: config.client_secret,
  })

  const res = await fetch(endpoints.token_endpoint.toString(), {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
      Accept: "application/json",
    },
    body: params,
    signal: AbortSignal.timeout(15_000),
  })

  if (!res.ok) {
    const text = await res.text()
    throw new Error(`Token endpoint returned ${res.status}: ${text}`)
  }

  const payload = await res.json()

  return payload as {
    access_token: string
    token_type?: string
    expires_in: number
    refresh_token?: string
    id_token?: string
    scope?: string
  }
}