# Sign in with CodeB - Python (Flask + Authlib).
# European Digital Identity Wallet users can also arrive via /logineu.html;
# server-side treatment is identical.
# [oidc-signin-cookbook 2026-07-23]
# pip install flask authlib requests

from flask import Flask, session, url_for, redirect, jsonify
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = "change-me"

oauth = OAuth(app)
oauth.register(
    name="codeb",
    server_metadata_url="https://<CODEB_TENANT_HOST>/.well-known/openid-configuration",
    client_id="<YOUR_CLIENT_ID>",
    client_secret="<YOUR_CLIENT_SECRET>",   # omit for public clients
    client_kwargs={
        "scope": "openid profile email",
        "code_challenge_method": "S256",     # PKCE
    },
)

@app.get("/login")
def login():
    return oauth.codeb.authorize_redirect(url_for("callback", _external=True))

@app.get("/oidc-callback")
def callback():
    token = oauth.codeb.authorize_access_token()
    # token["id_token"] is already validated by Authlib against JWKS.
    claims = token.get("userinfo") or oauth.codeb.userinfo(token=token)
    session["user"] = {
        "sub":  claims["sub"],
        "name": claims.get("preferred_username"),
        "role": claims.get("role", "user"),
    }
    return jsonify(session["user"])

if __name__ == "__main__":
    app.run(port=5000)