OAuth 2.0 de xstarmail

https://xstarmail.es/authorize?
  response_type=code
  &client_id=TU_CLIENT_ID
  &redirect_uri=https://tuapp.com/callback
  &scope=openid profile email
  &state=VALOR_ALEATORIO

https://tuapp.com/callback?code=AUTHORIZATION_CODE&state=VALOR_ALEATORIO

POST /api/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTHORIZATION_CODE
&client_id=TU_CLIENT_ID
&client_secret=TU_CLIENT_SECRET
&redirect_uri=https://tuapp.com/callback

{
  "access_token": "eyJ...",
  "refresh_token": "dGhp...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid profile email"
}

GET /api/oauth/userinfo
Authorization: Bearer ACCESS_TOKEN

{
  "sub": "clxyz123abc",
  "name": "María García",
  "email": "maria@xstarmail.es",
  "email_verified": true
}

// 1. Genera code_verifier (random string)
const verifier = crypto.randomUUID() + crypto.randomUUID();

// 2. Genera code_challenge (SHA-256 hash del verifier)
const encoder = new TextEncoder();
const digest = await crypto.subtle.digest('SHA-256', encoder.encode(verifier));
const challenge = btoa(String.fromCharCode(...new Uint8Array(digest)))
  .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

// 3. Incluye en la URL de autorización
const authUrl = `https://xstarmail.es/authorize?
  response_type=code
  &client_id=TU_CLIENT_ID
  &redirect_uri=https://tuapp.com/callback
  &scope=openid profile email
  &code_challenge=${challenge}
  &code_challenge_method=S256`;

// 4. Al intercambiar el código, incluye el verifier
fetch('https://xstarmail.es/api/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    grant_type: 'authorization_code',
    code: CODE,
    client_id: 'TU_CLIENT_ID',
    redirect_uri: 'https://tuapp.com/callback',
    code_verifier: verifier,
  }),
});

<!-- Botón oscuro -->
<a href="https://xstarmail.es/authorize?response_type=code&client_id=TU_CLIENT_ID&redirect_uri=TU_REDIRECT&scope=openid profile email"
   style="display:inline-flex;align-items:center;gap:12px;padding:10px 20px;
          background:#0A0A0A;border:1px solid #262626;border-radius:8px;
          color:#fff;font-size:14px;font-weight:500;text-decoration:none;
          font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;">
  <svg viewBox="0 0 100 100" width="16" height="16" fill="none" stroke="currentColor" stroke-width="5">
    <rect x="5" y="20" width="90" height="60" rx="8"/><polyline points="5,20 50,55 95,20"/>
  </svg>
  Iniciar sesión con xstarmail
</a>

const express = require('express');
const app = express();

const CLIENT_ID = 'tu_client_id';
const CLIENT_SECRET = 'tu_client_secret';
const REDIRECT_URI = 'http://localhost:3000/callback';

// Redirigir al usuario para login
app.get('/login', (req, res) => {
  const state = crypto.randomUUID();
  req.session.oauthState = state;
  res.redirect(`https://xstarmail.es/authorize?response_type=code&client_id=${CLIENT_ID}&redirect_uri=${encodeURIComponent(REDIRECT_URI)}&scope=openid profile email&state=${state}`);
});

// Callback — intercambiar código por token
app.get('/callback', async (req, res) => {
  const { code, state } = req.query;
  
  if (state !== req.session.oauthState) {
    return res.status(403).send('State mismatch');
  }

  // Intercambiar código por token
  const tokenRes = await fetch('https://xstarmail.es/api/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      redirect_uri: REDIRECT_URI,
    }),
  });
  const tokens = await tokenRes.json();

  // Obtener perfil del usuario
  const userRes = await fetch('https://xstarmail.es/api/oauth/userinfo', {
    headers: { Authorization: `Bearer ${tokens.access_token}` },
  });
  const user = await userRes.json();

  // user = { sub: "...", name: "María", email: "maria@xstarmail.es", email_verified: true }
  req.session.user = user;
  res.redirect('/dashboard');
});

app.listen(3000);

from flask import Flask, redirect, request, session
import requests, secrets

app = Flask(__name__)
app.secret_key = 'tu-secret-key'

CLIENT_ID = 'tu_client_id'
CLIENT_SECRET = 'tu_client_secret'
REDIRECT_URI = 'http://localhost:5000/callback'

@app.route('/login')
def login():
    state = secrets.token_urlsafe(32)
    session['oauth_state'] = state
    return redirect(
        f'https://xstarmail.es/authorize?response_type=code'
        f'&client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}'
        f'&scope=openid profile email&state={state}'
    )

@app.route('/callback')
def callback():
    if request.args.get('state') != session.get('oauth_state'):
        return 'State mismatch', 403

    # Intercambiar código por token
    token_res = requests.post('https://xstarmail.es/api/oauth/token', data={
        'grant_type': 'authorization_code',
        'code': request.args['code'],
        'client_id': CLIENT_ID,
        'client_secret': CLIENT_SECRET,
        'redirect_uri': REDIRECT_URI,
    })
    tokens = token_res.json()

    # Obtener perfil
    user_res = requests.get('https://xstarmail.es/api/oauth/userinfo',
        headers={'Authorization': f'Bearer {tokens["access_token"]}'})
    user = user_res.json()

    session['user'] = user
    return redirect('/dashboard')

// app/api/auth/xstarmail/route.ts
import { redirect } from 'next/navigation';

export async function GET() {
  const state = crypto.randomUUID();
  // Guarda state en cookie/session para verificar después
  
  redirect(`https://xstarmail.es/authorize?${new URLSearchParams({
    response_type: 'code',
    client_id: process.env.XSTARMAIL_CLIENT_ID!,
    redirect_uri: process.env.XSTARMAIL_REDIRECT_URI!,
    scope: 'openid profile email',
    state,
  })}`);
}

// app/api/auth/xstarmail/callback/route.ts
import { NextResponse } from 'next/server';

export async function GET(req: Request) {
  const url = new URL(req.url);
  const code = url.searchParams.get('code');

  const tokenRes = await fetch('https://xstarmail.es/api/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: code!,
      client_id: process.env.XSTARMAIL_CLIENT_ID!,
      client_secret: process.env.XSTARMAIL_CLIENT_SECRET!,
      redirect_uri: process.env.XSTARMAIL_REDIRECT_URI!,
    }),
  });
  const tokens = await tokenRes.json();

  const userRes = await fetch('https://xstarmail.es/api/oauth/userinfo', {
    headers: { Authorization: `Bearer ${tokens.access_token}` },
  });
  const user = await userRes.json();

  // Crear sesión con los datos del usuario
  const response = NextResponse.redirect(new URL('/dashboard', req.url));
  // ... guardar user en cookie/sesión
  return response;
}