Authentication

class TokenProvider {
  private token: string | null = null;
  private expiresAt = 0;

  async getToken(): Promise<string> {
    const now = Date.now();
    if (this.token && now < this.expiresAt - 60_000) return this.token;

    const r = await fetch(
      'https://auth.novatrade24.com/realms/nt24-idp/protocol/openid-connect/token',
      {
        method: 'POST',
        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
        body: new URLSearchParams({
          grant_type: 'client_credentials',
          client_id: process.env.NT24_CLIENT_ID!,
          client_secret: process.env.NT24_CLIENT_SECRET!,
        }),
      }
    );
    const { access_token, expires_in } = await r.json();
    this.token = access_token;
    this.expiresAt = now + expires_in * 1000;
    return this.token!;
  }
}

// Use Spring Security's OAuth2 client_credentials flow:
@Bean
OAuth2AuthorizedClientManager clientManager(
        ClientRegistrationRepository registrations,
        OAuth2AuthorizedClientService clientService) {

    var provider = OAuth2AuthorizedClientProviderBuilder.builder()
        .clientCredentials()
        .build();

    var manager = new AuthorizedClientServiceOAuth2AuthorizedClientManager(
        registrations, clientService);
    manager.setAuthorizedClientProvider(provider);
    return manager;
}

// Token is auto-refreshed by Spring.