LinkedIn API com JavaScript: Autenticação, Posts e Métricas sem SDK Oficial

// linkedin-auth.ts
const LINKEDIN_AUTH_URL = "https://www.linkedin.com/oauth/v2/authorization";
 
interface LinkedInAuthParams {
  clientId: string;
  redirectUri: string;
  // state previne CSRF: gere um valor aleatório e valide no callback
  state: string;
}
 
function buildAuthorizationUrl(params: LinkedInAuthParams): string {
  const searchParams = new URLSearchParams({
    response_type: "code",
    client_id: params.clientId,
    redirect_uri: params.redirectUri,
    state: params.state,
    // escopos separados por espaço, não por vírgula
    scope: "openid profile email w_member_social",
  });
 
  return `${LINKEDIN_AUTH_URL}?${searchParams.toString()}`;
}

// linkedin-token.ts
interface TokenResponse {
  access_token: string;
  expires_in: number;
  scope: string;
}
 
async function exchangeCodeForToken(
  code: string,
  clientId: string,
  clientSecret: string,
  redirectUri: string
): Promise<TokenResponse> {
  const response = await fetch(
    "https://www.linkedin.com/oauth/v2/accessToken",
    {
      method: "POST",
      headers: {
        // LinkedIn exige form-urlencoded aqui, não JSON
        "Content-Type": "application/x-www-form-urlencoded",
      },
      body: new URLSearchParams({
        grant_type: "authorization_code",
        code,
        client_id: clientId,
        client_secret: clientSecret,
        redirect_uri: redirectUri,
      }),
    }
  );
 
  if (!response.ok) {
    const error = await response.text();
    throw new Error(`LinkedIn token exchange failed: ${response.status} ${error}`);
  }
 
  return response.json() as Promise<TokenResponse>;
}

// linkedin-profile.ts
interface LinkedInProfile {
  sub: string; // identificador único do membro
  name: string;
  email: string;
  picture: string;
}
 
async function getProfile(accessToken: string): Promise<LinkedInProfile> {
  const response = await fetch("https://api.linkedin.com/v2/userinfo", {
    headers: {
      Authorization: `Bearer ${accessToken}`,
    },
  });
 
  if (!response.ok) {
    throw new Error(`Profile fetch failed: ${response.status}`);
  }
 
  return response.json() as Promise<LinkedInProfile>;
}

// linkedin-post.ts
interface CreatePostParams {
  accessToken: string;
  authorUrn: string; // formato: "urn:li:person:{sub}"
  text: string;
}
 
async function createTextPost(params: CreatePostParams): Promise<string> {
  const response = await fetch("https://api.linkedin.com/rest/posts", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${params.accessToken}`,
      "Content-Type": "application/json",
      // sem esse header, a API retorna 400 sem mensagem útil
      "LinkedIn-Version": "202401",
      "X-Restli-Protocol-Version": "2.0.0",
    },
    body: JSON.stringify({
      author: params.authorUrn,
      commentary: params.text,
      visibility: "PUBLIC",
      distribution: {
        feedDistribution: "MAIN_FEED",
        targetEntities: [],
        thirdPartyDistributionChannels: [],
      },
      lifecycleState: "PUBLISHED",
      isReshareDisabledByAuthor: false,
    }),
  });
 
  if (response.status === 201) {
    // o ID do post vem no header x-restli-id, não no body
    const postId = response.headers.get("x-restli-id");
    return postId ?? "created-without-id";
  }
 
  const error = await response.text();
  throw new Error(`Post creation failed: ${response.status} ${error}`);
}

// linkedin-image-upload.ts
interface InitializeUploadResponse {
  value: {
    uploadUrl: string;
    image: string; // URN da imagem para usar no post
  };
}
 
async function initializeImageUpload(
  accessToken: string,
  authorUrn: string
): Promise<InitializeUploadResponse["value"]> {
  const response = await fetch(
    "https://api.linkedin.com/rest/images?action=initializeUpload",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "Content-Type": "application/json",
        "LinkedIn-Version": "202401",
      },
      body: JSON.stringify({
        initializeUploadRequest: {
          owner: authorUrn,
        },
      }),
    }
  );
 
  if (!response.ok) {
    throw new Error(`Image upload init failed: ${response.status}`);
  }
 
  const data = (await response.json()) as InitializeUploadResponse;
  return data.value;
}
 
async function uploadImageBinary(
  uploadUrl: string,
  imageBuffer: ArrayBuffer
): Promise<void> {
  // o uploadUrl já contém autenticação embutida via query params
  // não envie o header Authorization aqui: causa 403
  const response = await fetch(uploadUrl, {
    method: "PUT",
    headers: {
      "Content-Type": "application/octet-stream",
    },
    body: imageBuffer,
  });
 
  if (!response.ok) {
    throw new Error(`Image binary upload failed: ${response.status}`);
  }
}

// linkedin-post-with-image.ts
async function createImagePost(
  accessToken: string,
  authorUrn: string,
  text: string,
  imageUrn: string
): Promise<string> {
  const response = await fetch("https://api.linkedin.com/rest/posts", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${accessToken}`,
      "Content-Type": "application/json",
      "LinkedIn-Version": "202401",
      "X-Restli-Protocol-Version": "2.0.0",
    },
    body: JSON.stringify({
      author: authorUrn,
      commentary: text,
      visibility: "PUBLIC",
      distribution: {
        feedDistribution: "MAIN_FEED",
        targetEntities: [],
        thirdPartyDistributionChannels: [],
      },
      lifecycleState: "PUBLISHED",
      isReshareDisabledByAuthor: false,
      content: {
        media: {
          // altText é obrigatório pela spec mas ignorado por muitos devs
          altText: "Imagem do post",
          id: imageUrn,
        },
      },
    }),
  });
 
  if (response.status !== 201) {
    const error = await response.text();
    throw new Error(`Image post creation failed: ${response.status} ${error}`);
  }
 
  return response.headers.get("x-restli-id") ?? "created-without-id";
}

// ERRADO: o uploadUrl do LinkedIn já tem credenciais na query string
const response = await fetch(uploadUrl, {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${accessToken}`, // causa 403
    "Content-Type": "application/octet-stream",
  },
  body: imageBuffer,
});

// ERRADO: escopos descontinuados
const scope = "r_liteprofile r_emailaddress w_member_social";

// CORRETO: escopos da OpenID Connect + Community Management API
const scope = "openid profile email w_member_social";

// ERRADO: sem LinkedIn-Version
const response = await fetch("https://api.linkedin.com/rest/posts", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${accessToken}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify(postData),
});
// retorna 400 com mensagem genérica

// linkedin-metrics.ts
interface PostMetrics {
  likes: number;
  comments: number;
  shares: number;
}
 
async function getPostMetrics(
  accessToken: string,
  postUrn: string
): Promise<PostMetrics> {
  // encode do URN porque contém ":" que precisa ser escapado na URL
  const encodedUrn = encodeURIComponent(postUrn);
 
  const [likesRes, commentsRes] = await Promise.all([
    fetch(
      `https://api.linkedin.com/v2/socialActions/${encodedUrn}/likes?count=0`,
      {
        headers: { Authorization: `Bearer ${accessToken}` },
      }
    ),
    fetch(
      `https://api.linkedin.com/v2/socialActions/${encodedUrn}/comments?count=0`,
      {
        headers: { Authorization: `Bearer ${accessToken}` },
      }
    ),
  ]);
 
  if (!likesRes.ok || !commentsRes.ok) {
    throw new Error("Failed to fetch post metrics");
  }
 
  const likesData = await likesRes.json();
  const commentsData = await commentsRes.json();
 
  return {
    // paging.total retorna o count sem precisar paginar todos os resultados
    likes: likesData.paging?.total ?? 0,
    comments: commentsData.paging?.total ?? 0,
    shares: 0, // shares não tem endpoint público separado na v2
  };
}

// linkedin-error.ts
interface LinkedInApiError {
  status: number;
  message: string;
  serviceErrorCode?: number;
}
 
async function parseLinkedInError(
  response: Response
): Promise<LinkedInApiError> {
  const contentType = response.headers.get("content-type") ?? "";
 
  if (contentType.includes("application/json")) {
    const body = await response.json();
    return {
      status: response.status,
      message: body.message ?? body.error_description ?? JSON.stringify(body),
      serviceErrorCode: body.serviceErrorCode,
    };
  }
 
  // alguns endpoints retornam texto puro em vez de JSON no erro
  const text = await response.text();
  return {
    status: response.status,
    message: text || `HTTP ${response.status}`,
  };
}