<?php
// Sign in with CodeB - PHP (jumbojett/openid-connect-php).
// European Digital Identity Wallet users can also arrive via /logineu.html;
// server-side treatment is identical.
// [oidc-signin-cookbook 2026-07-23]
// composer require jumbojett/openid-connect-php

require __DIR__ . '/vendor/autoload.php';
session_start();

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient(
    'https://<CODEB_TENANT_HOST>',
    '<YOUR_CLIENT_ID>',
    '<YOUR_CLIENT_SECRET>'          // pass '' for public clients
);
$oidc->setRedirectURL('<APP_CALLBACK>');
$oidc->addScope(['openid', 'profile', 'email']);
$oidc->setCodeChallengeMethod('S256');   // PKCE
// The library fetches /.well-known/openid-configuration on first use
// and caches endpoints in the session.

$oidc->authenticate();      // redirects to /oauth2/v1/authorize on first hit,
                            // handles the callback exchange on second hit.

$_SESSION['user'] = [
    'sub'  => $oidc->getVerifiedClaims('sub'),
    'name' => $oidc->requestUserInfo('preferred_username'),
    'role' => $oidc->requestUserInfo('role') ?: 'user',
];

header('Content-Type: application/json');
echo json_encode($_SESSION['user']);