Wenme OAuth 2.1 Integration

// Enable Conditional UI in your login form
const credential = await navigator.credentials.get({
  publicKey: {
    challenge: serverChallenge,
    rpId: 'wenme.net',
    allowCredentials: [],  // Empty = show all available passkeys
    userVerification: 'preferred'
  },
  mediation: 'conditional'  // Enables autofill UI
});

// HTML input with WebAuthn autofill
// <input type="text" autoComplete="username webauthn" />

// DPoP Proof JWT Header
{
  "typ": "dpop+jwt",
  "alg": "ES256",
  "jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "...",
    "y": "..."
  }
}

// DPoP Proof JWT Claims
{
  "jti": "unique-token-id",
  "htm": "POST",
  "htu": "https://identity.wenme.net/oauth/token",
  "iat": 1700000000
}

curl -X POST https://identity.wenme.net/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "DPoP: eyJhbGciOi...signature" \
  -d "grant_type=authorization_code" \
  -d "code=AUTH_CODE" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "code_verifier=PKCE_VERIFIER"

curl https://identity.wenme.net/oauth/userinfo \
  -H "Authorization: DPoP eyJhbGciOi...access_token" \
  -H "DPoP: eyJhbGciOi...fresh_proof"

// Generate DPoP key pair using Web Crypto API
const keyPair = await crypto.subtle.generateKey(
  { name: 'ECDSA', namedCurve: 'P-256' },
  false,  // non-extractable private key
  ['sign', 'verify']
);

// Export public key as JWK for the DPoP header
const publicJwk = await crypto.subtle.exportKey('jwk', keyPair.publicKey);

// Create DPoP proof
const header = btoa(JSON.stringify({
  typ: 'dpop+jwt', alg: 'ES256',
  jwk: { kty: publicJwk.kty, crv: publicJwk.crv,
         x: publicJwk.x, y: publicJwk.y }
}));
const payload = btoa(JSON.stringify({
  jti: crypto.randomUUID(),
  htm: 'POST',
  htu: 'https://identity.wenme.net/oauth/token',
  iat: Math.floor(Date.now() / 1000)
}));

curl -X POST https://identity.wenme.net/oauth/par \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "response_type=code" \
  -d "redirect_uri=https://yourapp.com/callback" \
  -d "scope=openid profile email" \
  -d "state=random_state" \
  -d "code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" \
  -d "code_challenge_method=S256"

# Response:
# {
#   "request_uri": "urn:ietf:params:oauth:request_uri:abc123",
#   "expires_in": 60
# }

// Redirect the user's browser
window.location.href =
  'https://identity.wenme.net/oauth/authorize' +
  '?client_id=YOUR_CLIENT_ID' +
  '&request_uri=urn:ietf:params:oauth:request_uri:abc123';

curl -X POST https://identity.wenme.net/oauth/bc-authorize \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=openid" \
  -d "login_hint=user@example.com" \
  -d "binding_message=Approve transfer of $500 to Account #1234"

# Response:
# {
#   "auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1",
#   "expires_in": 300,
#   "interval": 5
# }

curl -X POST https://identity.wenme.net/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:openid:params:grant-type:ciba" \
  -d "auth_req_id=1c266114-a1be-4252-8ad1-04986c5b9ac1" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

# Pending: { "error": "authorization_pending" }
# Denied:  { "error": "access_denied" }
# Expired: { "error": "expired_token" }
# Success: { "access_token": "...", "token_type": "Bearer" }

{
  "id": "evt_abc123",
  "event": "user.login",
  "timestamp": "2026-02-11T10:30:00Z",
  "data": {
    "user_id": "7fafe5c2-01ea-42e6-adb3-11c56e65fe17",
    "email": "user@example.com",
    "ip_address": "203.0.113.42",
    "user_agent": "Mozilla/5.0...",
    "method": "passkey",
    "risk_score": 15
  }
}

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// In your webhook handler:
app.post('/webhooks/wenme', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const isValid = verifyWebhookSignature(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );
  if (!isValid) return res.status(401).send('Invalid signature');

  // Process the event
  const { event, data } = req.body;
  console.log('Received:', event, data);
  res.status(200).send('OK');
});

curl -X POST https://identity.wenme.net/scim/v2/Users \
  -H "Authorization: Bearer wm_pk_your_api_key" \
  -H "Content-Type: application/scim+json" \
  -d '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "userName": "user@example.com",
    "name": {
      "givenName": "Jane",
      "familyName": "Doe"
    },
    "emails": [{
      "value": "user@example.com",
      "primary": true
    }],
    "active": true,
    "externalId": "azure-ad-object-id-123"
  }'

curl -X PATCH https://identity.wenme.net/scim/v2/Users/USER_ID \
  -H "Authorization: Bearer wm_pk_your_api_key" \
  -H "Content-Type: application/scim+json" \
  -d '{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [{
      "op": "replace",
      "path": "active",
      "value": false
    }]
  }'