API reference

const {
  OPENGAME_API_URL: origin,
  OPENGAME_TOKEN: token,
  OPENGAME_REQUEST_TIMEOUT_MS: timeout,
} = process.env;
const timeoutMs = Number(timeout);

if (!origin || !token) {
  throw new Error(
    "Set OPENGAME_API_URL and OPENGAME_TOKEN.",
  );
}

const whole = Number.isSafeInteger(timeoutMs);
if (!whole || timeoutMs < 1) {
  throw new Error(
    "Set a positive OPENGAME_REQUEST_TIMEOUT_MS.",
  );
}

let base;
try {
  base = new URL(origin);
} catch {
  throw new Error(
    "OPENGAME_API_URL must be a valid origin.",
  );
}

// HTTPS, or plain HTTP on an exact loopback name.
const { protocol, hostname } = base;
const local = ["localhost", "127.0.0.1", "[::1]"]
  .includes(hostname);
const secure = protocol === "https:" ||
  (local && protocol === "http:");
// Nothing but the origin itself.
const bare = base.pathname === "/" &&
  !base.username && !base.password &&
  !base.search && !base.hash;
if (!secure || !bare) {
  throw new Error(
    "Use HTTPS, or HTTP on localhost.",
  );
}

const url = new URL("/api/v1/auth/me", base);
const response = await fetch(url, {
  headers: { Authorization: `Bearer ${token}` },
  redirect: "error",
  signal: AbortSignal.timeout(timeoutMs),
});
if (!response.ok) {
  // Some errors, such as a 405, have no JSON body.
  const body = await response.json().catch(() => ({}));
  throw new Error(
    body.message ?? body.error ?? `HTTP ${response.status}`,
  );
}

const { handle, credential } = await response.json();
console.log({ handle, scopes: credential.scopes });