code: /*
   * Copyright (c) 2022 Airbyte, Inc., all rights reserved.
   */
  
  package io.airbyte.oauth.flows;
  
  import com.fasterxml.jackson.databind.JsonNode;
  import com.google.common.annotations.VisibleForTesting;
  import com.google.common.collect.ImmutableMap;
  import io.airbyte.commons.json.Jsons;
  import io.airbyte.config.persistence.ConfigRepository;
  import io.airbyte.oauth.BaseOAuth2Flow;
  import java.io.IOException;
  import java.net.URI;
  import java.net.URISyntaxException;
  import java.net.http.HttpClient;
  import java.net.http.HttpRequest;
  import java.net.http.HttpResponse;
  import java.nio.charset.StandardCharsets;
  import java.util.Base64;
  import java.util.Map;
  import java.util.UUID;
  import java.util.function.Supplier;
  import org.apache.http.client.utils.URIBuilder;
  
  /**
   * Following docs from https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/
   */
  public class OktaOAuthFlow extends BaseOAuth2Flow {
  
    public OktaOAuthFlow(final ConfigRepository configRepository, final HttpClient httpClient) {
      super(configRepository, httpClient);
    }
  
    @VisibleForTesting
    public OktaOAuthFlow(final ConfigRepository configRepository, final HttpClient httpClient, final Supplier<String> stateSupplier) {
      super(configRepository, httpClient, stateSupplier);
    }
  
    @Override
    protected String formatConsentUrl(final UUID definitionId,
                                      final String clientId,
                                      final String redirectUrl,
                                      final JsonNode inputOAuthConfiguration)
        throws IOException {
  
      // getting domain value from user's config
      final String domain = getConfigValueUnsafe(inputOAuthConfiguration, "domain");
  
      final URIBuilder builder = new URIBuilder()
          .setScheme("https")
          .setHost(domain + ".okta.com")
          .setPath("oauth2/v1/authorize")
          // required
          .addParameter("client_id", clientId)
          .addParameter("redirect_uri", redirectUrl)
          .addParameter("scope", "okta.users.read okta.logs.read okta.groups.read okta.roles.read offline_access")
          .addParameter("response_type", "code")
          .addParameter("state", getState());
  
      try {
        return builder.build().toString();
      } catch (final URISyntaxException e) {
        throw new IOException("Failed to format Consent URL for OAuth flow", e);
      }
    }
  
    @Override
    protected Map<String, String> getAccessTokenQueryParameters(String clientId,
                                                                String clientSecret,
                                                                String authCode,
                                                                String redirectUrl) {
      return ImmutableMap.<String, String>builder()
          // required
          .put("code", authCode)
          .put("redirect_uri", redirectUrl)
          .put("grant_type", "authorization_code")
          .build();
    }
  
    @Override
    protected String getAccessTokenUrl(final JsonNode inputOAuthConfiguration) {
      // getting domain value from user's config
      final String domain = getConfigValueUnsafe(inputOAuthConfiguration, "domain");
      return "https://" + domain + ".okta.com/oauth2/v1/token";
    }
  
    @Override
    protected Map<String, Object> completeOAuthFlow(final String clientId,
                                                    final String clientSecret,
                                                    final String authCode,
                                                    final String redirectUrl,
                                                    final JsonNode inputOAuthConfiguration,
                                                    final JsonNode oAuthParamConfig)
        throws IOException {
      final var accessTokenUrl = getAccessTokenUrl(inputOAuthConfiguration);
      final byte[] authorization = Base64.getEncoder()
          .encode((clientId + ":" + clientSecret).getBytes(StandardCharsets.UTF_8));
      final HttpRequest request = HttpRequest.newBuilder()
          .POST(HttpRequest.BodyPublishers
              .ofString(tokenReqContentType.getConverter().apply(
                  getAccessTokenQueryParameters(clientId, clientSecret, authCode, redirectUrl))))
          .uri(URI.create(accessTokenUrl))
          .header("Content-Type", tokenReqContentType.getContentType())
          .header("Accept", "application/json")
          .header("Authorization", "Basic " + new String(authorization, StandardCharsets.UTF_8))
          .build();
      try {
        final HttpResponse<String> response = httpClient.send(request,
            HttpResponse.BodyHandlers.ofString());
  
        return extractOAuthOutput(Jsons.deserialize(response.body()), accessTokenUrl);
      } catch (final InterruptedException e) {
        throw new IOException("Failed to complete OAuth flow", e);
      }
    }
  
  }
  