OIDC test - move to www base

web/callback.php

@@ -0,0 +1,59 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/config.php';
+require_once __DIR__ . '/vendor/autoload.php';
+
+use Fitness\OIDC\OIDC;
+
+// Ensure a state was sent back.
+if (!isset($_GET['state']) || !isset($_SESSION['oidc_state'])) {
+    http_response_code(400);
+    exit('Missing state parameter.');
+}
+
+// Verify the state matches what we stored.
+if ($_GET['state'] !== $_SESSION['oidc_state']) {
+    http_response_code(400);
+    exit('Invalid state.');
+}
+
+// Clean up the session variables.
+$state = $_SESSION['oidc_state'];
+$nonce = $_SESSION['oidc_nonce'];
+unset($_SESSION['oidc_state'], $_SESSION['oidc_nonce']);
+
+if (!isset($_GET['code'])) {
+    http_response_code(400);
+    exit('Missing authorization code.');
+}
+
+$code = $_GET['code'];
+$oidc = new OIDC();
+
+try {
+    // Exchange code for tokens.
+    $tokens = $oidc->exchangeCode($code);
+
+    // Validate ID token (minimal).
+    $idInfo = $oidc->validateIDToken($tokens['id_token'], $nonce);
+
+    // Get userinfo (includes groups because of scope).
+    $userInfo = $oidc->getUserInfo($tokens['access_token']);
+
+    // Store everything we need in the session.
+    $_SESSION['user'] = [
+        'id_token'    => $tokens['id_token'],
+        'access_token'=> $tokens['access_token'],
+        'refresh_token'=> $tokens['refresh_token'] ?? null,
+        'expires_in'  => $tokens['expires_in'] ?? null,
+        'id_info'     => $idInfo,
+        'user_info'   => $userInfo,
+    ];
+} catch (\Throwable $e) {
+    http_response_code(500);
+    exit('Error during OIDC exchange: ' . $e->getMessage());
+}
+
+// Clean up the query string (code, state) by redirecting to the home page.
+header('Location: /');
+exit;