organoid_Symbionts/script at main · baum777/organoid_Symbionts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
#requires -Version 7.0

param(
    [Parameter(Mandatory = $true)]
    [string]$ClientId,

    [Parameter(Mandatory = $true)]
    [string]$ClientSecret,

    [string]$RedirectUri = "http://127.0.0.1:8080/callback",
    [string]$Scopes = "tweet.read tweet.write users.read offline.access",
    [string]$TokenOutputPath = ".\x-oauth-tokens.json"
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

function ConvertTo-Base64Url {
    param([byte[]]$Bytes)
    $b64 = [Convert]::ToBase64String($Bytes)
    return $b64.TrimEnd('=').Replace('+', '-').Replace('/', '_')
}

function New-RandomString {
    param([int]$Length = 64)
    $bytes = New-Object byte[] $Length
    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
    return ConvertTo-Base64Url -Bytes $bytes
}

function New-CodeVerifier {
    # RFC 7636: 43-128 chars
    $raw = New-RandomString -Length 64
    if ($raw.Length -lt 43) {
        $raw = $raw.PadRight(43, 'A')
    }
    if ($raw.Length -gt 128) {
        $raw = $raw.Substring(0, 128)
    }
    return $raw
}

function New-CodeChallenge {
    param([string]$CodeVerifier)
    $sha = [System.Security.Cryptography.SHA256]::Create()
    $bytes = [System.Text.Encoding]::ASCII.GetBytes($CodeVerifier)
    $hash = $sha.ComputeHash($bytes)
    return ConvertTo-Base64Url -Bytes $hash
}

function Start-CallbackListener {
    param([string]$Prefix)

    $listener = [System.Net.HttpListener]::new()
    $listener.Prefixes.Add($Prefix)
    $listener.Start()
    return $listener
}

function Get-CallbackPrefixFromRedirectUri {
    param([string]$Uri)

    $u = [System.Uri]$Uri
    $prefix = "{0}://{1}:{2}{3}/" -f $u.Scheme, $u.Host, $u.Port, $u.AbsolutePath.TrimEnd('/')
    return $prefix
}

# --- PKCE / State ---
$codeVerifier  = New-CodeVerifier
$codeChallenge = New-CodeChallenge -CodeVerifier $codeVerifier
$state         = New-RandomString -Length 24

# --- Authorize URL ---
$encodedRedirect = [uri]::EscapeDataString($RedirectUri)
$encodedScopes   = [uri]::EscapeDataString($Scopes)

$authorizeUrl = "https://x.com/i/oauth2/authorize" +
    "?response_type=code" +
    "&client_id=$([uri]::EscapeDataString($ClientId))" +
    "&redirect_uri=$encodedRedirect" +
    "&scope=$encodedScopes" +
    "&state=$([uri]::EscapeDataString($state))" +
    "&code_challenge=$([uri]::EscapeDataString($codeChallenge))" +
    "&code_challenge_method=S256"

# --- Local callback listener ---
$callbackPrefix = Get-CallbackPrefixFromRedirectUri -Uri $RedirectUri
$listener = Start-CallbackListener -Prefix $callbackPrefix

Write-Host ""
Write-Host "Authorize URL:"
Write-Host $authorizeUrl
Write-Host ""
Write-Host "Öffne Browser. Bitte dort mit dem BOT-ACCOUNT (@organoid_on_sol) einloggen und autorisieren..."
Write-Host "Listener: $callbackPrefix"
Write-Host ""

Start-Process $authorizeUrl

try {
    $context = $listener.GetContext()
    $request = $context.Request
    $response = $context.Response

    $query = [System.Web.HttpUtility]::ParseQueryString($request.Url.Query)
    $returnedCode  = $query["code"]
    $returnedState = $query["state"]
    $returnedError = $query["error"]
    $errorDesc     = $query["error_description"]

    $html = ""
    if ($returnedError) {
        $html = "<html><body><h2>OAuth fehlgeschlagen</h2><p>$returnedError</p><p>$errorDesc</p></body></html>"
    }
    else {
        $html = "<html><body><h2>OAuth erfolgreich</h2><p>Du kannst dieses Fenster schließen.</p></body></html>"
    }

    $buffer = [System.Text.Encoding]::UTF8.GetBytes($html)
    $response.ContentLength64 = $buffer.Length
    $response.ContentType = "text/html; charset=utf-8"
    $response.OutputStream.Write($buffer, 0, $buffer.Length)
    $response.OutputStream.Close()

    if ($returnedError) {
        throw "OAuth-Fehler vom Callback: $returnedError - $errorDesc"
    }

    if (-not $returnedCode) {
        throw "Kein authorization code im Callback gefunden."
    }

    if ($returnedState -ne $state) {
        throw "State-Mismatch. Möglicher CSRF oder Redirect-Fehler."
    }

    Write-Host "Authorization code empfangen."
}
finally {
    $listener.Stop()
    $listener.Close()
}

# --- Token Exchange ---
$tokenUrl = "https://api.x.com/2/oauth2/token"

$body = @{
    grant_type    = "authorization_code"
    code          = $returnedCode
    client_id     = $ClientId
    redirect_uri  = $RedirectUri
    code_verifier = $codeVerifier
}

Write-Host "Tausche authorization code gegen Access/Refresh Token..."

$tokenResponse = Invoke-RestMethod `
    -Method Post `
    -Uri $tokenUrl `
    -ContentType "application/x-www-form-urlencoded" `
    -Body $body

# --- Ausgabe ---
Write-Host ""
Write-Host "Token-Antwort erhalten." -ForegroundColor Green
Write-Host ""

$tokenResponse | ConvertTo-Json -Depth 10 | Set-Content -Path $TokenOutputPath -Encoding UTF8

Write-Host "Gespeichert in: $TokenOutputPath"
Write-Host ""

if ($tokenResponse.refresh_token) {
    Write-Host "REFRESH TOKEN:" -ForegroundColor Cyan
    Write-Host $tokenResponse.refresh_token
    Write-Host ""
} else {
    Write-Warning "Kein refresh_token enthalten. Prüfe, ob offline.access wirklich als Scope genehmigt wurde."
}

Write-Host "ACCESS TOKEN:" -ForegroundColor Cyan
Write-Host $tokenResponse.access_token
Write-Host ""

Write-Host "EXPIRES IN:" -ForegroundColor Cyan
Write-Host $tokenResponse.expires_in
Write-Host ""

Write-Host "SCOPE:" -ForegroundColor Cyan
Write-Host $tokenResponse.scope