Codeus, The Three-Step Sovereign

// Step 1: Redirect user to authorization server
function initiateOAuthFlow() {
  const authUrl = 'https://auth-server.com/oauth/authorize';
  const params = new URLSearchParams({
    response_type: 'code',
    client_id: 'your-client-id',
    redirect_uri: 'https://yourapp.com/callback',
    scope: 'read write',
    state: generateRandomState() // CSRF protection
  });

  window.location.href = `${authUrl}?${params}`;
}

// Step 2: Handle the callback with authorization code
async function handleCallback(authCode, state) {
  // Verify state parameter matches (CSRF protection)
  if (state !== getStoredState()) {
    throw new Error('State mismatch - possible CSRF attack!');
  }

  // Exchange code for tokens (server-side only!)
  const tokenUrl = 'https://auth-server.com/oauth/token';
  const response = await fetch(tokenUrl, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: authCode,
      redirect_uri: 'https://yourapp.com/callback',
      client_id: 'your-client-id',
      client_secret: 'your-client-secret' // Keep this secret!
    })
  });

  const tokens = await response.json();
  // tokens = { access_token, refresh_token, expires_in, token_type }

  return tokens;
}

// Step 3: Use the access token
async function fetchProtectedResource(accessToken) {
  const response = await fetch('https://api.example.com/data', {
    headers: {
      'Authorization': `Bearer ${accessToken}`
    }
  });

  return response.json();
}