oauth.php library

Path in the Gestor bibliotecas/oauth.php

An OAuth 2.0 client to sign in with Google or Meta. Not to be confused with oauth2.php, the server of the Gestor API tokens. The screens and the login decision live in perfil-usuario (options social-login and oauth-callback).

Configuration

In the .env: OAUTH_GOOGLE_CLIENT_ID/OAUTH_GOOGLE_CLIENT_SECRET and OAUTH_META_APP_ID/OAUTH_META_APP_SECRET. Without the client id, the provider is unavailable (oauth_redirect_url() returns false).

In the provider console, register the return URL that oauth_redirect_uri() builds: https://<domain>/<root>/oauth-callback/?provider=google (or meta). It uses url-full-http, always with https.

The keys are read only from $_ENV, not from $_CONFIG.

Flow

1. oauth_redirect_url($provider) draws a state (128 bits), stores it in the session with the provider and returns the authorization URL. Scopes: openid email profile (Google) and email public_profile (Meta, Graph API v19.0).

2. The provider comes back with code and state. oauth_validate_state($state) compares it with the session (hash_equals).

3. oauth_authenticate_code($provider, $code) exchanges the code for the token and reads the profile. It returns ['provider', 'uid', 'email', 'nome'] or false.

oauth_http_post() and oauth_http_get() are the cURL helpers (20 s timeout).

What perfil-usuario does with the profile

• With a link in usuarios_provedores (provider + uid), it signs in as that user.

• Without a link, it looks for an active user with the same e-mail and creates the link by itself.

• From the security screen, the logged-in user can link a social account to theirs.

• After a social login, the user's 2FA still applies.

Internal helpers (used by the functions above; rarely called directly): oauth_config().

Functions

oauth_config(string $provider): array|false

oauth_redirect_uri(string $provider): string

oauth_redirect_url(string $provider): string|false

oauth_validate_state(string $state): bool

oauth_http_post($url, $data)

oauth_http_get($url, $bearer = null)

oauth_authenticate_code(string $provider, string $code): array|false