Authentication (Messenger chatbot)

var decodedToken = jwt.verify(idToken, clientSecret);

{
  "sub": "AVPw-jHcQG5c_BvJk9e_",
  "given_name": "John",
  "family_name": "Doe",
  "email": "john.doe@example.com"
}

var express = require('express');
var request = require('request');
var jwt = require('jsonwebtoken');
var router = express.Router();

router.get(
  '/messenger-login',
  function(req, res) {
    res.render('index');
  }
);

router.post(
  '/messenger-webhook',
  function(req, res) {
    /*
      You must send back a status of 200(success) within 20 seconds
      to let messenger know you've successfully received the callback.
      Otherwise, the request will time out.
      When a request times out from Facebook messenger the service attempts
      to resend the message.
      This is why it is good to send a response immediately so you
      don't get duplicate messages in the event that a request takes
      a while to process.
    */
    res.sendStatus(200);

    const data = req.body;

    // Make sure this is a page subscription
    if (data.object === 'page') {
      // Iterate over each entry
      // There may be multiple if batched
      data.entry.forEach((pageEntry) => {
        if (!pageEntry.messaging) {
          return;
        }
        // Iterate over each messaging event
        pageEntry.messaging.forEach((messagingEvent) => {
          console.log({messagingEvent});
          if (messagingEvent.account_linking && messagingEvent.account_linking.status === 'linked') {
            // This information is available in your ReachFive account's settings
            var domain = 'YOUR_REACHFIVE_DOMAIN';
            var clientId = 'YOUR_REACHFIVE_CLIENT_ID';
            var clientSecret = 'YOUR_REACHFIVE_CLIENT_SECRET';

            // This is the authorization code to exchange
            var code = messagingEvent.account_linking.authorization_code

            // This is the redirect uri corresponding to the current callback
            var redirectUri = 'https://facebook.com/messenger_platform/account_linking/';

            // Send an POST HTTP request using the "application/x-www-form-urlencoded"
            // format to ReachFive's token endpoint
            request.post(
              'https://' + domain + '/oauth/token',
              {
                form: {
                  'code': code,
                  'client_id': clientId,
                  'redirect_uri': redirectUri,
                  'grant_type': 'authorization_code'
                }
              },
              function(err, response, body) {
                if (!err) {
                  // Unexpected error
                  return;
                }
                if (response.statusCode != 200) {
                  // Expected error
                  // Those types of error can occurred when the authorization code is expired for example.
                  return;
                }

                // Success response

                // Parse JSON response
                var authResult = JSON.parse(body);

                // Retrieve id token from response
                var idToken = authResult['id_token'];

                // Parse and validate ID Token
                var decodedToken = jwt.verify(idToken, clientSecret);

                var id = decodedToken.sub;
                var givenName = decodedToken.given_name;
                var familyName = decodedToken.family_name;
                var email = decodedToken.email;

                // Send a welcome message via messenger send API
                // ...
              }
            );
          } else {
            // handle other message events
          }
        });
      });
    }
  }
);