11-laravel-controller.php

<?php

/**
 * PPS-PHP Example 11: Laravel Controller
 *
 * Example Laravel controller for PPS authentication.
 *
 * Install:
 *   composer require pps-protocol/pps-php
 *
 * Routes:
 *   Route::get('/pps/challenge', [PpsAuthController::class, 'challenge']);
 *   Route::post('/pps/verify', [PpsAuthController::class, 'verify']);
 */

declare(strict_types=1);

namespace App\Http\Controllers;

use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Pps\Server\AuthenticationHandler;
use Pps\Server\ChallengeGenerator;
use Pps\Storage\PdoStorage;
use Pps\Util\SystemTimeProvider;

class PpsAuthController extends Controller
{
    /**
     * Create an authentication challenge.
     *
     * @return JsonResponse
     */
    public function challenge(): JsonResponse
    {
        $generator = new ChallengeGenerator(new SystemTimeProvider());
        $challenge = $generator->create(config('app.url'));

        // Store nonce in session or cache
        session(['pps_nonce' => $challenge->nonceB64u]);

        return response()->json([
            'nonce' => $challenge->nonceB64u,
            'epoch' => $challenge->epoch,
            'qr_payload' => $challenge->qrPayload,
        ]);
    }

    /**
     * Verify a Pulse Token.
     *
     * @param Request $request
     * @return JsonResponse
     */
    public function verify(Request $request): JsonResponse
    {
        $request->validate([
            'pulse_token' => 'required|string',
            'trust_code' => 'nullable|string',
        ]);

        $pdo = new \PDO(
            config('database.connections.mysql.dsn'),
            config('database.connections.mysql.username'),
            config('database.connections.mysql.password')
        );

        $storage = new PdoStorage($pdo);
        $handler = new AuthenticationHandler($storage, new SystemTimeProvider());

        $nonce = session('pps_nonce');

        $result = $handler->verify(
            pulseToken: $request->input('pulse_token'),
            rpId: config('app.url'),
            nonceB64u: $nonce,
            trustCode: $request->input('trust_code')
        );

        if ($result->honey) {
            // Silent duress handling
            // Log internally, restrict account, etc.
            return response()->json(['status' => 'ok']);
        }

        if (!$result->ok) {
            return response()->json(['status' => 'error'], 401);
        }

        // Clear nonce
        session()->forget('pps_nonce');

        return response()->json(['status' => 'ok']);
    }
}