Security

app.use((req, res, next) => {
  res.setHeader('Strict-Transport-Security', 'max-age=31536000');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('Content-Security-Policy',
    "frame-ancestors 'self' zoom.us *.zoom.us"
  );
  res.setHeader('Referrer-Policy', 'same-origin');
  next();
});

// Express cookie-session example
app.use(require('cookie-session')({
  name: 'session',
  keys: [process.env.SESSION_SECRET],
  maxAge: 24 * 60 * 60 * 1000, // 24 hours
  sameSite: 'none',  // REQUIRED - Zoom embeds your app cross-origin
  secure: true       // REQUIRED - SameSite=None requires Secure
}));

const crypto = require('crypto');

// Generate PKCE pair
const verifier = crypto.randomBytes(32).toString('hex');
const challenge = crypto.createHash('sha256')
  .update(verifier)
  .digest('base64url');

// Store verifier in session (server-side)
req.session.codeVerifier = verifier;

// Send challenge to frontend (or include in OAuth redirect URL)
res.json({ codeChallenge: challenge, state: req.session.state });

// Redis token storage example
const Redis = require('ioredis');
const redis = new Redis(process.env.REDIS_URL);

async function storeTokens(zoomUserId, tokens) {
  await redis.set(
    `zoom:tokens:${zoomUserId}`,
    JSON.stringify(tokens),
    'EX', tokens.expires_in // Auto-expire with token
  );
}

async function getTokens(zoomUserId) {
  const data = await redis.get(`zoom:tokens:${zoomUserId}`);
  return data ? JSON.parse(data) : null;
}

const crypto = require('crypto');

// Generate state before OAuth redirect
const state = crypto.randomBytes(16).toString('hex');
req.session.oauthState = state;

// Validate state on callback
app.get('/auth', (req, res) => {
  if (req.query.state !== req.session.oauthState) {
    return res.status(403).send('Invalid state - possible CSRF attack');
  }
  // Proceed with token exchange
});