view release on metacpan or  search on metacpan

lib/Catalyst/Plugin/OpenIDConnect/Context.pm  view on Meta::CPAN

The user parameter can be a hash reference or an object with accessor methods.

=cut

sub get_user_claims {
    my ( $self, $user ) = @_;

    $self->catalyst->log->debug('Extracting user claims') if $self->config->{debug};

    # Delegate to the custom claims provider when one has been registered.
    if ( my $provider = $self->claims_provider ) {
        $self->catalyst->log->debug('Using custom claims provider') if $self->config->{debug};
        return $provider->( $self->catalyst, $user );
    }

    my $claims_config = $self->config->{user_claims} || {
        sub      => 'id',
        name     => 'name',
        email    => 'email',
    };

    my %claims;

    for my $claim_name ( keys %$claims_config ) {
        my $accessor = $claims_config->{$claim_name};
        my @parts = split /\./, $accessor;

        my $value = $user;
        for my $part (@parts) {
            last unless defined $value;
            if ( ref $value eq 'HASH' ) {
                $value = $value->{$part};
            } else {
                $value = $value->$part() if $value->can($part);
            }
        }

        $claims{$claim_name} = $value if defined $value;
    }

    $self->catalyst->log->debug('User claims extracted: ' . join(', ', keys %claims)) if $self->config->{debug};

    return \%claims;
}

=head2 get_discovery()

Returns the OpenID Connect provider configuration document.

=cut

sub get_discovery {
    my ($self) = @_;

    $self->catalyst->log->debug('Building OpenID Connect discovery document') if $self->config->{debug};

    my $c = $self->catalyst;
    my $issuer_url = $self->config->{issuer}{url} || $c->uri_for('/')->as_string;

    # Extract scheme and authority from issuer URL to ensure endpoints match issuer scheme
    my $base_url = $issuer_url;
    $base_url =~ s{/$}{};  # Remove trailing slash if present

    $self->catalyst->log->debug("Discovery document built for issuer: $issuer_url") if $self->config->{debug};

    return {
        issuer                          => $issuer_url,
        authorization_endpoint          => "$base_url/openidconnect/authorize",
        token_endpoint                  => "$base_url/openidconnect/token",
        userinfo_endpoint               => "$base_url/openidconnect/userinfo",
        jwks_uri                        => "$base_url/openidconnect/jwks",
        end_session_endpoint            => "$base_url/openidconnect/logout",
        registration_endpoint           => undef,
        scopes_supported                => [qw(openid profile email phone address)],
        response_types_supported        => [qw(code)],
        response_modes_supported        => [qw(query fragment form_post)],
        grant_types_supported           => [qw(authorization_code refresh_token)],
        subject_types_supported         => [qw(public pairwise)],
        id_token_signing_alg_values_supported => ['RS256'],
        userinfo_signing_alg_values_supported => ['RS256'],
        request_parameter_supported    => 1,
        request_uri_parameter_supported => 1,
        claims_supported                => [
            qw(
                sub name given_name family_name middle_name nickname
                preferred_username profile picture website email email_verified
                gender birthdate zoneinfo locale phone_number phone_number_verified
                address updated_at
            )
        ],
        claim_types_supported          => [qw(normal aggregated distributed)],
    };
}

__PACKAGE__->meta->make_immutable;
1;

=head1 AUTHOR

Tim F. Rayner

=head1 LICENSE

This library is free software; you can redistribute it and/or modify
it under the terms of The Artistic License 2.0.

=cut