Prepare your backend for Corbado Connect

app.post('/auth/createConnectToken', async (req, res) => {
    try {
        // 1. Get access token from the Authorization header
        const authHeader = req.headers['authorization'];
        const accessToken = authHeader && authHeader.split(' ')[1];
        if (accessToken == null) {
            return res.sendStatus(401);
        }

        // 2. Verify the access token
        const user = await yourAuthSystem.verifyAccessToken(accessToken);
        if (!user) {
            return res.status(401).json({ error: 'Invalid access token' });
        }

        // 3. Request connect token from Corbado Backend API
        const response = await fetch('https://backendapi.cloud.corbado.io/v2/connectTokens', {
            method: 'POST',
            headers: {
                'Authorization': `Bearer ${CORBADO_BACKEND_API_KEY}`,
                'Content-Type': 'application/json',
            },
            body: JSON.stringify({
                type: req.body.connectTokenType, // e.g., 'passkey-append'
                data: {
                    displayName: user.displayName,
                    identifier: user.email,
                }
            })
        });
        if (!response.ok) {
            console.error('Failed to get connect token:', await response.text());

            return res.status(500).json({ error: 'Failed to get connect token' });
        }

        const data = await response.json();
        
        // 3. Return the connect token to the frontend
        res.json({
            connectToken: data.secret
        });
    } catch (error) {
        console.error('Error getting connect token:', error);
        res.status(500).json({ error: 'Internal server error' });
    }
});

app.post('/auth/completeLogin', async (req, res) => {
    try {
        const { signedPasskeyData } = req.body;

        // Decode only to prepare verification. These claims are not trusted yet.
        const userInfo = extractUserInfo(signedPasskeyData);
        if (typeof userInfo?.webauthnId !== 'string' || !userInfo.webauthnId) {
            return res.status(401).json({ success: false, error: 'Invalid signedPasskeyData' });
        }

        // 1. Verify signedPasskeyData with Corbado Backend API
        const verifyResult = await fetch('https://backendapi.cloud.corbado.io/v2/passkey/verifySignedData', {
            method: 'POST',
            headers: {
                'Authorization': `Bearer ${CORBADO_BACKEND_API_KEY}`,
                'Content-Type': 'application/json',
            },
            body: JSON.stringify({ signedPasskeyData, username: userInfo.webauthnId })
        });

        const data = await verifyResult.json();
        if (!verifyResult.ok || data.verificationResult !== "success") {
            return res.status(401).json({ success: false, error: 'Invalid signedPasskeyData' });
        }

        // 2. Resolve the verified identity to an existing account
        const user = await yourAuthSystem.findUserByWebAuthnId(userInfo.webauthnId);
        if (!user) {
            return res.status(401).json({ success: false, error: 'Unknown user' });
        }
        // Apply your existing account eligibility and MFA policies before issuing a session.

        // 3. Create an access token
        const accessToken = await yourAuthSystem.createAccessToken({
            userId: user.id,
        });

        // 4. Send the access token to the client
        res.json({
            success: true,
            accessToken: accessToken,
        });
    } catch (error) {
        console.error('Verification failed:', error);
        res.status(500).json({ success: false, error: 'Verification failed' });
    }
});