OmniAuth Xero OAuth2 Strategy

gem 'omniauth-xero-oauth2-modern'

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :xero_oauth2_modern,
           ENV['XERO_CLIENT_ID'],
           ENV['XERO_CLIENT_SECRET'],
           scope: 'openid profile email accounting.transactions accounting.contacts accounting.settings'
end

# Required for OmniAuth 2.0+
OmniAuth.config.allowed_request_methods = %i[get post]

config.omniauth :xero_oauth2_modern,
                ENV['XERO_CLIENT_ID'],
                ENV['XERO_CLIENT_SECRET'],
                scope: 'openid profile email accounting.transactions accounting.contacts accounting.settings'

devise_for :users, controllers: { omniauth_callbacks: 'users/omniauth_callbacks' }

devise :omniauthable, omniauth_providers: [:xero_oauth2_modern]

class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def xero_oauth2_modern
    @user = User.from_omniauth(request.env['omniauth.auth'])

    if @user.persisted?
      flash[:notice] = I18n.t('devise.omniauth_callbacks.success', kind: 'Xero')
      sign_in_and_redirect @user, event: :authentication
    else
      session['devise.xero_data'] = request.env['omniauth.auth'].except('extra')
      redirect_to new_user_registration_url, alert: @user.errors.full_messages.join("\n")
    end
  end

  def failure
    redirect_to root_path, alert: "Authentication failed: #{failure_message}"
  end
end

provider :xero_oauth2_modern,
         ENV['XERO_CLIENT_ID'],
         ENV['XERO_CLIENT_SECRET'],
         scope: 'openid profile email accounting.transactions accounting.contacts accounting.settings',
         redirect_uri: 'https://myapp.com/auth/xero_oauth2_modern/callback'

{
  "provider" => "xero_oauth2_modern",
  "uid" => "tenant-uuid-123",  # First connected tenant's tenantId
  "info" => {
    "email" => "user@example.com",
    "first_name" => "John",
    "last_name" => "Doe",
    "name" => "John Doe",
    "tenant_id" => "tenant-uuid-123",
    "tenant_name" => "My Company"
  },
  "credentials" => {
    "token" => "ACCESS_TOKEN",
    "refresh_token" => "REFRESH_TOKEN",
    "expires_at" => 1704067200,
    "expires" => true
  },
  "extra" => {
    "tenant_id" => "tenant-uuid-123",
    "tenants" => [
      {
        "id" => "connection-uuid",
        "tenantId" => "tenant-uuid-123",
        "tenantType" => "ORGANISATION",
        "tenantName" => "My Company",
        "createdDateUtc" => "2026-01-01T00:00:00.0000000",
        "updatedDateUtc" => "2026-01-01T00:00:00.0000000"
      }
    ],
    "raw_info" => {
      "sub" => "user-uuid",
      "email" => "user@example.com",
      "given_name" => "John",
      "family_name" => "Doe",
      "xero_userid" => "user-uuid"
    }
  }
}

response = Faraday.get("https://api.xero.com/api.xro/2.0/Invoices") do |req|
  req.headers['Authorization'] = "Bearer #{access_token}"
  req.headers['Xero-Tenant-Id'] = tenant_id
  req.headers['Accept'] = 'application/json'
end

def self.from_omniauth(auth)
  user = where(provider: auth.provider, uid: auth.uid).first_or_create do |u|
    u.email = auth.info.email
    u.password = Devise.friendly_token[0, 20]
  end

  # Update tokens on each login
  user.update(
    xero_access_token: auth.credentials.token,
    xero_refresh_token: auth.credentials.refresh_token,
    xero_token_expires_at: Time.at(auth.credentials.expires_at),
    xero_tenant_id: auth.info.tenant_id,
    xero_tenant_name: auth.info.tenant_name
  )

  user
end

# Create a client instance
client = OmniAuth::XeroOauth2Modern::TokenClient.new(
  client_id: ENV['XERO_CLIENT_ID'],
  client_secret: ENV['XERO_CLIENT_SECRET']
)

# Refresh an expired token
result = client.refresh_token(account.xero_refresh_token)

if result.success?
  account.update!(
    xero_access_token: result.access_token,
    xero_refresh_token: result.refresh_token,
    xero_token_expires_at: Time.at(result.expires_at)
  )
else
  Rails.logger.error "Token refresh failed: #{result.error}"
end

# Check if token is expired (with 5-minute buffer by default)
client.token_expired?(account.xero_token_expires_at)

# Custom buffer (e.g., refresh 10 minutes before expiry)
client.token_expired?(account.xero_token_expires_at, buffer_seconds: 600)

# app/services/xero_api_service.rb
class XeroApiService
  def initialize(account)
    @account = account
    @client = OmniAuth::XeroOauth2Modern::TokenClient.new(
      client_id: ENV['XERO_CLIENT_ID'],
      client_secret: ENV['XERO_CLIENT_SECRET']
    )
  end

  def with_valid_token
    refresh_if_expired!
    yield @account.xero_access_token
  end

  private

  def refresh_if_expired!
    return unless @client.token_expired?(@account.xero_token_expires_at)

    result = @client.refresh_token(@account.xero_refresh_token)
    raise "Token refresh failed: #{result.error}" unless result.success?

    @account.update!(
      xero_access_token: result.access_token,
      xero_refresh_token: result.refresh_token,
      xero_token_expires_at: Time.at(result.expires_at)
    )
  end
end

# Usage
XeroApiService.new(current_account).with_valid_token do |token|
  # Make API calls with valid token
  response = Faraday.get("https://api.xero.com/api.xro/2.0/Invoices") do |req|
    req.headers['Authorization'] = "Bearer #{token}"
    req.headers['Xero-Tenant-Id'] = current_account.xero_tenant_id
    req.headers['Accept'] = 'application/json'
  end
end