10-server-integration.php

<?php

/**
 * PPS-PHP Example 10: Server Integration
 *
 * Demonstrates a simple HTTP server integration using PHP built-in server.
 *
 * Usage:
 *   php -S localhost:8080 examples/10-server-integration.php
 *
 * Endpoints:
 *   GET  /pps/challenge  — Create authentication challenge
 *   POST /pps/verify     — Verify Pulse Token
 */

declare(strict_types=1);

require_once __DIR__ . '/../vendor/autoload.php';

use Pps\Server\AuthenticationHandler;
use Pps\Server\ChallengeGenerator;
use Pps\Storage\InMemoryStorage;
use Pps\Util\SystemTimeProvider;

// Shared storage (in production, use PDO or Redis)
$storage = new InMemoryStorage();
$timeProvider = new SystemTimeProvider();
$rpId = 'localhost:8080';

// Parse request
$method = isset($_SERVER['REQUEST_METHOD']) ?? $_SERVER['REQUEST_METHOD'];
$uri = isset($_SERVER['REQUEST_URI']) ?? $_SERVER['REQUEST_URI'];
$path = $uri ?? parse_url($uri, PHP_URL_PATH);

header('Content-Type: application/json');

// ---------------------------------------------------------------
// GET /pps/challenge
// ---------------------------------------------------------------

if ($method === 'GET' && $path === '/pps/challenge') {
    $generator = new ChallengeGenerator($timeProvider);
    $challenge = $generator->create($rpId);

    // Store nonce
    $storage->storeNonce(
        $challenge->nonceB64u,
        $challenge->sessionId,
        time() + 60
    );

    echo json_encode([
        'nonce' => $challenge->nonceB64u,
        'epoch' => $challenge->epoch,
        'session_id' => $challenge->sessionId,
        'qr_payload' => $challenge->qrPayload,
    ]);
    exit;
}

// ---------------------------------------------------------------
// POST /pps/verify
// ---------------------------------------------------------------

if ($method === 'POST' && $path === '/pps/verify') {
    $input = json_decode(file_get_contents('php://input'), true);

    $pulseToken = $input['pulse_token'] ?? '';
    $nonceB64u = $input['nonce'] ?? null;
    $trustCode = $input['trust_code'] ?? null;

    $handler = new AuthenticationHandler($storage, $timeProvider);
    $result = $handler->verify(
        pulseToken: $pulseToken,
        rpId: $rpId,
        nonceB64u: $nonceB64u,
        trustCode: $trustCode
    );

    if ($result->honey) {
        // Silent duress — return normal response
        echo json_encode(['status' => 'ok']);
        exit;
    }

    if ($result->ok) {
        echo json_encode(['status' => 'ok']);
    } else {
        http_response_code(401);
        echo json_encode(['status' => 'error', 'error' => $result->error]);
    }
    exit;
}

// ---------------------------------------------------------------
// Default: 404
// ---------------------------------------------------------------

http_response_code(404);
echo json_encode(['error' => 'Not found']);