Laravel guide

composer require firebase/php-jwt

SAI_SSO_ISSUER=https://accounts.society-ai.org
SAI_SSO_CLIENT_ID=paste-the-client-id
SAI_SSO_CLIENT_SECRET=paste-the-client-secret
SAI_SSO_REDIRECT_URI=https://kelas.society-ai.org/auth/callback
SAI_SSO_SCOPES="openid profile email membership"

'sai_sso' => [
    'issuer' => env('SAI_SSO_ISSUER', 'https://accounts.society-ai.org'),
    'client_id' => env('SAI_SSO_CLIENT_ID'),
    'client_secret' => env('SAI_SSO_CLIENT_SECRET'),
    'redirect' => env('SAI_SSO_REDIRECT_URI'),
    'scopes' => env('SAI_SSO_SCOPES', 'openid profile email membership'),
],

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::table('users', function (Blueprint $table): void {
            $table->string('sai_sub')->nullable()->unique()->after('id');
            $table->string('membership_status')->default('none');
            // Members never set a password in your app.
            $table->string('password')->nullable()->change();
        });
    }
};

use App\Http\Controllers\SaiSsoController;

Route::get('/auth/redirect', [SaiSsoController::class, 'redirect'])->name('login');
Route::get('/auth/callback', [SaiSsoController::class, 'callback']);
Route::post('/auth/logout', [SaiSsoController::class, 'logout'])->middleware('auth')->name('logout');
Route::post('/auth/backchannel-logout', [SaiSsoController::class, 'backchannelLogout']);

->withMiddleware(function (Middleware $middleware): void {
    // Society AI calls this from its server, without a CSRF token.
    $middleware->validateCsrfTokens(except: ['auth/backchannel-logout']);

    // Optional: recognise members who are already signed in elsewhere.
    $middleware->appendToGroup('web', \App\Http\Middleware\TrySilentLogin::class);
})

<?php

namespace App\Http\Controllers;

use App\Models\User;
use Firebase\JWT\JWK;
use Firebase\JWT\JWT;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

class SaiSsoController extends Controller
{
    /** Errors that only mean "this member is not signed in yet". */
    private const SILENT_MISSES = ['login_required', 'consent_required', 'interaction_required'];

    public function redirect(Request $request): RedirectResponse
    {
        $verifier = Str::random(64);
        $state = Str::random(40);
        $silent = $request->boolean('silent');
        $request->session()->put('sai_sso', compact('state', 'verifier', 'silent'));

        $query = [
            'response_type' => 'code',
            'client_id' => config('services.sai_sso.client_id'),
            'redirect_uri' => config('services.sai_sso.redirect'),
            'scope' => config('services.sai_sso.scopes'),
            'state' => $state,
            'code_challenge' => rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '='),
            'code_challenge_method' => 'S256',
        ];

        if ($silent) {
            $query['prompt'] = 'none';
        }

        return redirect()->away($this->discovery()['authorization_endpoint'].'?'.http_build_query($query));
    }

    public function callback(Request $request): RedirectResponse
    {
        $pending = $request->session()->pull('sai_sso');
        $silent = is_array($pending) && ($pending['silent'] ?? false);

        if (! is_array($pending) || ! hash_equals($pending['state'], (string) $request->query('state'))) {
            return $silent ? redirect()->intended('/') : redirect('/')->with('status', 'Sesi masuk sudah lewat. Coba masuk lagi.');
        }

        if ($request->filled('error')) {
            if ($silent && in_array($request->query('error'), self::SILENT_MISSES, true)) {
                return redirect()->intended('/'); // not signed in anywhere: carry on as a guest
            }

            return redirect('/')->with('status', 'Masuk dibatalkan. Coba lagi sebentar.');
        }

        $tokens = Http::asForm()
            ->withBasicAuth(config('services.sai_sso.client_id'), config('services.sai_sso.client_secret'))
            ->post($this->discovery()['token_endpoint'], [
                'grant_type' => 'authorization_code',
                'code' => (string) $request->query('code'),
                'redirect_uri' => config('services.sai_sso.redirect'),
                'code_verifier' => $pending['verifier'],
            ])->throw()->json();

        $claims = $this->verifyJwt($tokens['id_token']);

        $user = $this->findOrCreateUser($claims);

        Auth::login($user);
        $request->session()->regenerate();
        $request->session()->put('sai_id_token', $tokens['id_token']);

        // Back-channel logout only sends sid, so remember which session it belongs to.
        if (isset($claims['sid'])) {
            Cache::put('sai-sid:'.$claims['sid'], $request->session()->getId(), now()->addDays(30));
        }

        return redirect()->intended('/');
    }

    public function logout(Request $request): RedirectResponse
    {
        $idToken = $request->session()->get('sai_id_token');

        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();

        $query = $idToken ? '?'.http_build_query(['id_token_hint' => $idToken]) : '';

        // Society AI signs the member out everywhere and shows "Kamu sudah keluar".
        return redirect()->away($this->discovery()['end_session_endpoint'].$query);
    }

    public function backchannelLogout(Request $request): Response
    {
        try {
            $claims = $this->verifyJwt((string) $request->input('logout_token'));
        } catch (\Throwable) {
            return response('', 400);
        }

        $events = (array) ($claims['events'] ?? []);
        if (! array_key_exists('http://schemas.openid.net/event/backchannel-logout', $events) || isset($claims['nonce'])) {
            return response('', 400);
        }

        if (isset($claims['sid']) && ($sessionId = Cache::pull('sai-sid:'.$claims['sid']))) {
            app('session')->getHandler()->destroy($sessionId);
        }

        return response('', 200);
    }

    /** @param  array<string, mixed>  $claims */
    private function findOrCreateUser(array $claims): User
    {
        $user = User::query()->where('sai_sub', $claims['sub'])->first();

        // An account made in your app before Society AI login: link it once, by verified email.
        if (! $user && ($claims['email_verified'] ?? false) && isset($claims['email'])) {
            $user = User::query()->whereNull('sai_sub')->where('email', $claims['email'])->first();
        }

        $user ??= new User;
        $user->forceFill([
            'sai_sub' => $claims['sub'],
            'name' => $claims['name'] ?? '',
            'email' => $claims['email'] ?? null,
            'membership_status' => $claims['membership']['status'] ?? 'none',
        ])->save();

        return $user;
    }

    /** @return array<string, mixed> */
    private function verifyJwt(string $jwt): array
    {
        JWT::$leeway = 30;

        try {
            $decoded = JWT::decode($jwt, JWK::parseKeySet($this->keys()));
        } catch (\UnexpectedValueException) {
            // The signing key may have been rotated: fetch the keys once more.
            Cache::forget('sai-sso-jwks');
            $decoded = JWT::decode($jwt, JWK::parseKeySet($this->keys()));
        }

        $claims = json_decode(json_encode($decoded), true);
        $audience = (array) ($claims['aud'] ?? []);

        if (($claims['iss'] ?? null) !== config('services.sai_sso.issuer')
            || ! in_array(config('services.sai_sso.client_id'), $audience, true)) {
            throw new \UnexpectedValueException('Token is not for this app.');
        }

        return $claims;
    }

    /** @return array<string, mixed> */
    private function keys(): array
    {
        return Cache::remember('sai-sso-jwks', 3600, fn () => Http::get($this->discovery()['jwks_uri'])->throw()->json());
    }

    /** @return array<string, string> */
    private function discovery(): array
    {
        return Cache::remember('sai-sso-discovery', 3600, fn () => Http::get(
            rtrim(config('services.sai_sso.issuer'), '/').'/.well-known/openid-configuration'
        )->throw()->json());
    }
}

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

/**
 * Once per browser session, quietly ask Society AI whether this visitor is
 * already signed in. Members come back signed in; everyone else comes back
 * as a guest, without seeing a login screen.
 */
class TrySilentLogin
{
    public function handle(Request $request, Closure $next): Response
    {
        if ($request->isMethod('GET')
            && ! $request->user()
            && ! $request->expectsJson()
            && ! $request->is('auth/*')
            && ! $request->session()->has('sai_sso_checked')
            && ! preg_match('/bot|crawl|spider|slurp|preview|monitor/i', (string) $request->userAgent())) {
            $request->session()->put('sai_sso_checked', true);
            $request->session()->put('url.intended', $request->fullUrl());

            return redirect()->route('login', ['silent' => 1]);
        }

        return $next($request);
    }
}