<?php

namespace Sulu\OidcCode\Security\AccessToken\Oidc;

use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Uid\Uuid;

class OidcAuthRedirectController
{
    public function __construct(
        private string $baseUri,
        private string $clientId,
        private string $redirectUri,
        private string $responseType = 'code',
        private string $scope = 'openid',
        private ?string $codeChallenge = null,
    ) {
    }

    public function __invoke(Request $request): Response
    {
        $state = Uuid::v4()->__toString();
        $request->getSession()->set('_oidc_state', $state);

        $nonce = Uuid::v4()->__toString();

        $query = [
            'response_type' => $this->responseType,
            'scope' => $this->scope,
            'client_id' => $this->clientId,
            'state' => $state,
            'nonce' => $nonce,
            'redirect_uri' => $this->redirectUri,
        ];

        if (!$this->codeChallenge) {
            $codeVerifier = base64_encode(random_bytes(32));
            $codeChallenge = base64_encode(match(strtolower($this->codeChallenge)) {
                'S256' => hash('sha256', $codeVerifier, true),
                'plain' => $codeVerifier,
                default => throw new \RuntimeException('Code challange algorithm not found: ' . $this->codeChallenge),
            });
            $codeChallenge = rtrim($codeChallenge, '=');
            $codeChallenge = urlencode($codeChallenge);
            $query['code_challenge'] = $codeChallenge;
            $query['code_challenge_method'] = $this->codeChallenge;
            $request->getSession()->set('_oidc_code_verifier', $codeVerifier);
        }

        return new RedirectResponse($this->baseUri . 'auth?' . http_build_query($query));
    }
}

<?php

namespace Sulu\OidcCode\Security\AccessToken\Oidc;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Security\Http\AccessToken\AccessTokenExtractorInterface;

final class OidcCodeExtractor implements AccessTokenExtractorInterface
{
    public function extractAccessToken(Request $request): ?string
    {
        // maybe add additional check so this check is only done on redirect_uri and not on other routes
    
        $parameter = $request->query->get('code');

        $code = \is_string($parameter) ? $parameter : null;

        if ($code === null) {
            return null;
        }

        $state = $request->query->get('state');
        $sessionState = $request->query->get('sessionState');
        $savedState = $request->getSession()->get('_oidc_state');

        if (!$state || $state !== $savedState) {
            return null; // exception?
        }

        return $code;
    }
}

<?php

namespace Sulu\OidcCode\Security\AccessToken\Oidc;

use Psr\Log\LoggerInterface;
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
use Symfony\Component\Security\Http\AccessToken\AccessTokenHandlerInterface;
use Symfony\Component\Security\Http\AccessToken\Oidc\Exception\MissingClaimException;
use Symfony\Component\Security\Http\AccessToken\Oidc\OidcUserInfoTokenHandler;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use Symfony\Contracts\HttpClient\HttpClientInterface;

final class OidcCodeHandler implements AccessTokenHandlerInterface
{
    private OidcUserInfoTokenHandler $oidcUserInfoTokenHandler;

    public function __construct(
        private HttpClientInterface $client, // client with base_uri 
        string $baseUri, `http://127.0.0.1:8080/realms/master/protocol/openid-connect/`
        #[\SensitiveParameter] private string $clientId, // openid/keycloak clientId
        #[\SensitiveParameter] private string $clientSecret, // openid/keycloak credentials client secret
        private string $redirectUri, // need to be same as for OidcAuthRedirectController
        private ?LoggerInterface $logger = null,
        string $claim = 'sub',
    ) {
        $this->oidcUserInfoTokenHandler = new OidcUserInfoTokenHandler(
            $client->withOptions([
                'base_uri' => $baseUri . 'userinfo', // see https://github.com/symfony/symfony/issues/50433 for better solution
            ]),
            $logger,
            $claim
        );
    }

    public function getUserBadgeFrom(#[\SensitiveParameter] string $accessToken): UserBadge
    {
        try {
            $data = $this->client->request(
                'POST',
                'token',
                [
                    'auth_basic' => $this->clientId . ':' . $this->clientSecret,
                    'headers' => [
                        'Content-Type' => 'application/x-www-form-urlencoded',
                    ],
                    'body' => 'grant_type=authorization_code&code=' . $accessToken . '&redirect_uri=' . $this->redirectUri,
                ],
            )->toArray();

            $accessToken = $data['access_token'] ?? null;

            if (!$accessToken) {
                throw new MissingClaimException(sprintf('The "access_token" not found on OIDC server response.'));
            }

            return $this->oidcUserInfoTokenHandler->getUserBadgeFrom($accessToken);
        } catch (BadCredentialsException $e) {
            throw $e; // avoid double logging for BadCredentialsException
        } catch (\Exception $e) {
            $this->logger?->error('An error occurred on OIDC server.', [
                'error' => $e->getMessage(),
                'trace' => $e->getTraceAsString(),
            ]);

            throw new BadCredentialsException('Invalid code.', $e->getCode(), $e);
        }
    }
}