Private Channels

app.post("/access-token", async (req, res) => {

    const { channel } = req.body;

    const userId = req.user?.id;

    // List of channels can be obtained from the Overlayed API
    const requestedChannel = channelsCache[channel];
    if (!requestedChannel) {
    	return res.status(404).json({ error: "Channel not found" });
    }

    if (!requestedChannel.private) {
    	return res.json({ access_token: null });
    }

    if (!userId) {
    	return res.status(401).json({ error: "Unauthorized" });
    }

    const userChannels = getUserChannels(userId);
    if (!userChannels.includes(channel)) {
    	return res.status(403).json({ error: "No access to this channel" });
    }

    const response = await fetch(
    	`https://api.overlayed.dev/v1/applications/${APPLICATION_ID}/channels/${requestedChannel.id}/tokens`,
    	{
    		method: "POST",
    		headers: {
    			Authorization: `Bearer ${OVERLAYED_API_KEY}`,
    			"Content-Type": "application/json",
    		},
    		body: JSON.stringify({
    			audience: userId,
    			expires_in_minutes: ACCESS_TOKEN_EXPIRATION_MINUTES,
    		}),
    	},
    );

    if (!response.ok) {
    	return res.status(500).json({ error: "Failed to generate token" });
    }

    const data = await response.json();
    return res.json({ access_token: data.access_token });

});