class TokenManager {
  constructor(clientId, clientSecret, issuerUrl, projectId) {
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    this.tokenUrl = `${issuerUrl}/oauth/v2/token`;
    this.projectId = projectId;
    this.token = null;
    this.expiresAt = 0;
  }

  async getToken() {
    // Refresh if token expires within 5 minutes
    if (this.token && Date.now() / 1000 < this.expiresAt - 300) {
      return this.token;
    }

    const params = new URLSearchParams({
      grant_type: 'client_credentials',
      client_id: this.clientId,
      client_secret: this.clientSecret,
      scope: `openid urn:zitadel:iam:org:project:id:${this.projectId}:aud`,
    });

    const res = await fetch(this.tokenUrl, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: params,
    });

    const data = await res.json();
    this.token = data.access_token;
    this.expiresAt = Date.now() / 1000 + data.expires_in;
    return this.token;
  }
}

import time
import requests

class TokenManager:
    def __init__(self, client_id, client_secret, issuer_url, project_id):
        self.client_id = client_id
        self.client_secret = client_secret
        self.token_url = f"{issuer_url}/oauth/v2/token"
        self.project_id = project_id
        self.token = None
        self.expires_at = 0

    def get_token(self):
        # Refresh if token expires within 5 minutes
        if self.token and time.time() < self.expires_at - 300:
            return self.token

        response = requests.post(self.token_url, data={
            "grant_type": "client_credentials",
            "client_id": self.client_id,
            "client_secret": self.client_secret,
            "scope": f"openid urn:zitadel:iam:org:project:id:{self.project_id}:aud",
        })

        data = response.json()
        self.token = data["access_token"]
        self.expires_at = time.time() + data["expires_in"]
        return self.token