<?php
// login.php
session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['sso_login'])) {
    $state = bin2hex(random_bytes(16));
    $_SESSION['oauth_state'] = $state;
    
    $auth_url = 'https://accounts.lequangkhai.id.vn/authorize.php?' . http_build_query([
        'client_id' => 'YOUR_CLIENT_ID',
        'response_type' => 'code',
        'redirect_uri' => 'https://yourapp.com/callback.php',
        'scope' => 'openid profile email',
        'state' => $state
    ]);
    
    header('Location: ' . $auth_url);
    exit;
}
?>

<form method="POST">
    <button type="submit" name="sso_login" class="btn btn-primary">
        Đăng Nhập bằng SSO
    </button>
</form>

<?php
// callback.php
session_start();

$code = $_GET['code'] ?? null;
$state = $_GET['state'] ?? null;
$error = $_GET['error'] ?? null;

if ($error) die('Lỗi: ' . htmlspecialchars($error));
if (!$state || $state !== $_SESSION['oauth_state']) die('CSRF detected');
if (!$code) die('Code missing');

// Trao đổi code lấy token
$ch = curl_init('https://accounts.lequangkhai.id.vn/api/token');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'grant_type' => 'authorization_code',
    'code' => $code,
    'client_id' => 'YOUR_CLIENT_ID',
    'client_secret' => 'YOUR_CLIENT_SECRET',
    'redirect_uri' => 'https://yourapp.com/callback.php'
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$token_data = json_decode($response, true);

$_SESSION['access_token'] = $token_data['access_token'];
$_SESSION['refresh_token'] = $token_data['refresh_token'] ?? null;
$_SESSION['token_expires_at'] = time() + ($token_data['expires_in'] ?? 3600);

header('Location: /dashboard.php');
?>

<?php
// includes/auth.php
function getAuthenticatedUser() {
    session_start();
    
    if (!isset($_SESSION['access_token'])) return null;
    
    if (time() >= $_SESSION['token_expires_at']) {
        refreshAccessToken();
    }
    
    $ch = curl_init('https://accounts.lequangkhai.id.vn/api/userinfo');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
        'Authorization: Bearer ' . $_SESSION['access_token']
    ]);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    
    $response = curl_exec($ch);
    return json_decode($response, true);
}

function isLoggedIn() {
    session_start();
    return isset($_SESSION['access_token']) && time() < ($_SESSION['token_expires_at'] ?? 0);
}

function logout() {
    session_start();
    session_destroy();
    header('Location: /');
}
?>

<?php
// dashboard.php
require_once 'includes/auth.php';

session_start();

if (!isLoggedIn()) {
    header('Location: /login.php');
    exit;
}

$user = getAuthenticatedUser();
?>

<h1>Chào <?php echo htmlspecialchars($user['name']); ?>!</h1>
<p>Email: <?php echo htmlspecialchars($user['email']); ?></p>
<a href="/logout.php">Đăng Xuất</a>

SSO_CLIENT_ID=your_client_id
SSO_CLIENT_SECRET=your_client_secret
SSO_AUTHORIZATION_ENDPOINT=https://sso.example.com/authorize.php
SSO_TOKEN_ENDPOINT=https://sso.example.com/api/token
SSO_USERINFO_ENDPOINT=https://sso.example.com/api/userinfo