Telegraph/controllers/Auth.php

<?php
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use \Firebase\JWT\JWT;

class Auth {

  public function login(Request $request, Response $response) {
    session_start();
    if(session('user_id')) {
      $response->setStatusCode(302);
      $response->headers->set('Location', '/dashboard');
    } else {
      $response->setContent(view('login', [
        'title' => 'Sign In to Telegraph',
        'return_to' => $request->get('return_to')
      ]));
    }
    return $response;
  }

  public function logout(Request $request, Response $response) {
    session_start();
    if(session('user_id')) {
      $_SESSION['user_id'] = null;
      session_destroy();
    }
    $response->setStatusCode(302);
    $response->headers->set('Location', '/login');
    return $response;
  }

  public function login_start(Request $request, Response $response) {

    if(!$request->get('url') || !($me = IndieAuth\Client::normalizeMeURL($request->get('url')))) {
      $response->setContent(view('login', [
        'title' => 'Sign In to Telegraph',
        'error' => 'Invalid URL',
        'error_description' => 'The URL you entered, "<strong>' . htmlspecialchars($request->get('url')) . '</strong>" is not valid.'
      ]));
      return $response;
    }

    // Check if the user's URL defines an authorization endpoint
    $authorizationEndpoint = IndieAuth\Client::discoverAuthorizationEndpoint($me);
    if(!$authorizationEndpoint) {
      $authorizationEndpoint = Config::$defaultAuthorizationEndpoint;
    }

    $codeVerifier = IndieAuth\Client::generatePKCECodeVerifier();
    $state = JWT::encode([
      'az' => $authorizationEndpoint,
      'me' => $me,
      'code_verifier' => $codeVerifier,
      'return_to' => $request->get('return_to'),
      'time' => time(),
      'exp' => time()+300 // verified by the JWT library
    ], Config::$secretKey);

    $authorizationURL = IndieAuth\Client::buildAuthorizationURL($authorizationEndpoint, [
      'me' => $me,
      'redirect_uri' => self::_buildRedirectURI(),
      'client_id' => Config::$clientID,
      'state' => $state,
      'code_verifier' => $codeVerifier,
    ]);

    $response->setStatusCode(302);
    $response->headers->set('Location', $authorizationURL);
    return $response;
  }

  public function login_callback(Request $request, Response $response) {

    if(!$request->get('state') || !$request->get('code')) {
      $response->setContent(view('login', [
        'title' => 'Sign In to Telegraph',
        'error' => 'Missing Parameters',
        'error_description' => 'The auth server did not return the necessary parameters, <code>state</code> and <code>code</code>.'
      ]));
      return $response;
    }

    // Validate the "state" parameter to ensure this request originated at this client
    try {
      $state = JWT::decode($request->get('state'), Config::$secretKey, ['HS256']);

      if(!$state) {
        $response->setContent(view('login', [
          'title' => 'Sign In to Telegraph',
          'error' => 'Invalid State',
          'error_description' => 'The <code>state</code> parameter was not valid.'
        ]));
        return $response;
      }
    } catch(Exception $e) {
      $response->setContent(view('login', [
        'title' => 'Sign In to Telegraph',
        'error' => 'Invalid State',
        'error_description' => 'The <code>state</code> parameter was invalid:<br>'.htmlspecialchars($e->getMessage())
      ]));
      return $response;
    }

    $authorizationEndpoint = $state->az;

    // Verify the code with the auth server
    $data = IndieAuth\Client::exchangeAuthorizationCode($state->az, [
      'code' => $request->get('code'),
      'redirect_uri' => self::_buildRedirectURI(),
      'client_id' => Config::$clientID,
      'code_verifier' => $state->code_verifier,
    ]);

    if(!isset($data['response']['me'])) {
      // The authorization server didn't return a "me" URL
      $response->setContent(view('login', [
        'title' => 'Sign In to Telegraph',
        'error' => 'Invalid Auth Server Response',
        'error_description' => 'The authorization server ('.$authorizationEndpoint.') did not return a valid response:<br><pre style="text-align:left; max-height: 400px; overflow: scroll;">HTTP '.$data['response_code']."\n\n".htmlspecialchars(json_encode($data)).'</pre>'
      ]));
      return $response;
    }

    // Verify the authorization endpoint matches
    if($data['response']['me'] != $state->me) {
      $newAuthorizationEndpoint = IndieAuth\Client::discoverAuthorizationEndpoint($data['response']['me']);
      if($newAuthorizationEndpoint != $authorizationEndpoint) {
        $response->setContent(view('login', [
          'title' => 'Sign In to Telegraph',
          'error' => 'Invalid Authorization Endpoint',
          'error_description' => 'The authorization endpoint for the returned profile URL ('.$data['response']['me'].') did not match the authorization endpoint used to begin the login.'
        ]));
        return $response;
      }
    }

    $me = $data['response']['me'];

    // Create or load the user
    $user = ORM::for_table('users')->where('url', $me)->find_one();
    if(!$user) {
      $user = ORM::for_table('users')->create();
      $user->url = $me;
      $user->created_at = date('Y-m-d H:i:s');
      $user->last_login = date('Y-m-d H:i:s');
      $user->save();

      // Create a site for them with the default role
      $site = ORM::for_table('sites')->create();
      $site->name = 'My Website';
      $site->url = $me;
      $site->created_by = $user->id;
      $site->created_at = date('Y-m-d H:i:s');
      $site->save();

      $role = ORM::for_table('roles')->create();
      $role->site_id = $site->id;
      $role->user_id = $user->id;
      $role->role = 'owner';
      $role->token = random_string(32);
      $role->save();

    } else {
      $user->last_login = date('Y-m-d H:i:s');
      $user->save();
    }

    q()->queue('Telegraph\ProfileFetcher', 'fetch', [$user->id]);

    session_start();
    $_SESSION['user_id'] = $user->id;
    $response->setStatusCode(302);
    $response->headers->set('Location', ($state->return_to ?: '/dashboard'));
    return $response;
  }

  private static function _buildRedirectURI() {
    return Config::$base . 'login/callback';
  }

}