Final Class Yiisoft\Yii\AuthClient\Client\OpenIdConnect

                public function __construct(
    ClientInterface $httpClient,
    RequestFactoryInterface $requestFactory,
    StateStorageInterface $stateStorage,
    Factory $factory,
    SessionInterface $session,
    CacheInterface $cache,
    string $name,
    string $title,
) {
    $this->cache = $cache;
    $this->name = $name;
    $this->title = $title;
    parent::__construct($httpClient, $requestFactory, $stateStorage, $factory, $session);
}

            

                #[\Override]
protected function applyClientCredentialsToRequest(RequestInterface $request): RequestInterface
{
    $supportedAuthMethods = (array) $this->getConfigParam('token_endpoint_auth_methods_supported');
    if (in_array('client_secret_basic', $supportedAuthMethods, true)) {
        $request = $request->withHeader(
            'Authorization',
            'Basic ' . base64_encode($this->clientId . ':' . $this->clientSecret)
        );
    } elseif (in_array('client_secret_post', $supportedAuthMethods, true)) {
        $request = RequestUtil::addParams(
            $request,
            [
                'client_id' => $this->clientId,
                'client_secret' => $this->clientSecret,
            ]
        );
    } elseif (in_array('client_secret_jwt', $supportedAuthMethods, true)) {
        $header = [
            'typ' => 'JWT',
            'alg' => 'HS256',
        ];
        $payload = [
            'iss' => $this->clientId,
            'sub' => $this->clientId,
            'aud' => $this->tokenUrl,
            'jti' => $this->generateAuthNonce(),
            'iat' => time(),
            'exp' => time() + 3600,
        ];
        $signatureBaseString = base64_encode(Json::encode($header)) . '.' . base64_encode(Json::encode($payload));
        $signatureMethod = new HmacSha('sha256');
        $signature = $signatureMethod->generateSignature($signatureBaseString, $this->clientSecret);
        $assertion = $signatureBaseString . '.' . $signature;
        $request = RequestUtil::addParams(
            $request,
            [
                'assertion' => $assertion,
            ]
        );
    } else {
        throw new InvalidConfigException(
            'Unable to authenticate request: No auth method supported'
        );
    }
    return $request;
}

            

                #[\Override]
public function buildAuthUrl(
    ServerRequestInterface $incomingRequest,
    array $params = []
): string {
    if (strlen($this->authUrl) == 0) {
        $this->authUrl = (string) $this->getConfigParam('authorization_endpoint');
    }
    return parent::buildAuthUrl($incomingRequest, $params);
}

            

                #[\Override]
protected function createToken(array $tokenConfig = []): OAuthToken
{
    $params = (array) $tokenConfig['params'];
    $idToken = (string) $params['id_token'];
    if ($this->validateJws) {
        $jwsData = $this->loadJws($idToken);
        $this->validateClaims($jwsData);
        $tokenConfig['params'] = array_merge($params, $jwsData);
        if ($this->getValidateAuthNonce()) {
            $nonce = isset($jwsData['nonce']) ? (string) $jwsData['nonce'] : '';
            $authNonce = (string) $this->getState('authNonce');
            if (!isset($jwsData['nonce']) || empty($authNonce) || strcmp($nonce, $authNonce) !== 0) {
                throw new ClientException('Invalid auth nonce', 400);
            }
            $this->removeState('authNonce');
        }
    }
    return parent::createToken($tokenConfig);
}

            

                #[\Override]
protected function defaultReturnUrl(ServerRequestInterface $request): string
{
    $params = $request->getQueryParams();
    // OAuth2 specifics :
    unset($params['code'], $params['state'], $params['nonce'], $params['authuser'], $params['session_state'], $params['prompt']);
    // OpenIdConnect specifics :
    return $request->getUri()->withQuery(http_build_query($params, '', '&', PHP_QUERY_RFC3986))->__toString();
}

            

                #[\Override]
protected function defaultViewOptions(): array
{
    return [
        'popupWidth' => 860,
        'popupHeight' => 480,
    ];
}

            

                #[\Override]
public function fetchAccessToken(ServerRequestInterface $incomingRequest, string $authCode, array $params = []): OAuthToken
{
    if (empty($this->tokenUrl)) {
        $this->tokenUrl = (string) $this->getConfigParam('token_endpoint');
    }
    if (!isset($params['nonce']) && $this->getValidateAuthNonce()) {
        $nonce = $this->generateAuthNonce();
        $this->setState('authNonce', $nonce);
        $params['nonce'] = $nonce;
    }
    return parent::fetchAccessToken($incomingRequest, $authCode, $params);
}

            

                protected function generateAuthNonce(): string
{
    return Random::string();
}

            

                #[\Override]
public function getButtonClass(): string
{
    return '';
}

            

                public function getConfigParam(string $name): mixed
{
    $params = $this->getConfigParams();
    /**
     * @psalm-suppress PossiblyInvalidArrayOffset
     */
    return $params[$name];
}

            

                public function getConfigParams(): array|string
{
    if (empty($this->configParams)) {
        $cacheKey = $this->configParamsCacheKeyPrefix . $this->getName();
        if (empty($configParams = (array) $this->cache->get($cacheKey))) {
            $configParams = $this->discoverConfig();
        }
        $this->configParams = $configParams;
        $this->cache->set($cacheKey, $configParams);
    }
    return $this->configParams;
}

            

                protected function getJwkSet(): ?JWKSet
{
    $jwkSet = $this->jwkSet;
    if (!($this->jwkSet instanceof JWKSet)) {
        $cacheKey = $this->configParamsCacheKeyPrefix . 'jwkSet';
        /** @var mixed $jwkSetRaw */
        $jwkSetRaw = $this->cache->get($cacheKey);
        /** @var JWKSet|null $jwkSet */
        $jwkSet = $jwkSetRaw instanceof JWKSet ? $jwkSetRaw : null;
        if ($jwkSet === null) {
            /** @var mixed $jwksUriRaw */
            $jwksUriRaw = $this->getConfigParam('jwks_uri');
            $jwksUri = is_string($jwksUriRaw) ? $jwksUriRaw : '';
            $request = $this->createRequest('GET', $jwksUri);
            $response = $this->sendRequest($request);
            /** @var mixed $jsonBody */
            $jsonBody = Json::decode($response->getBody()->getContents());
            $jsonBody = is_array($jsonBody) ? $jsonBody : [];
            $jwkSet = JWKFactory::createFromValues($jsonBody);
        }
        $this->cache->set($cacheKey, $jwkSet);
    }
    return $jwkSet instanceof JWKSet ? $jwkSet : null;
}

            

                protected function getJwsLoader(): JWSLoader
{
    if (!($this->jwsLoader instanceof JWSLoader)) {
        $algorithms = [];
        /** @var string $algorithm */
        foreach ($this->allowedJwsAlgorithms as $algorithm) {
            $class = '\Jose\Component\Signature\Algorithm\\' . $algorithm;
            if (!class_exists($class)) {
                throw new InvalidConfigException("Algorithm class $class doesn't exist");
            }
            /**
             * @psalm-suppress MixedMethodCall new $class()
             */
            $algorithms[] = new $class();
        }
        /**
         * @psalm-suppress ArgumentTypeCoercion
         */
        $algorithmManager = new AlgorithmManager($algorithms);
        $compactSerializer = new CompactSerializer();
        /** @psalm-var string[] $this->allowedJwsAlgorithms */
        $checker = new AlgorithmChecker($this->allowedJwsAlgorithms);
        $this->jwsLoader = new JWSLoader(
            new JWSSerializerManager([$compactSerializer]),
            new JWSVerifier($algorithmManager),
            new HeaderCheckerManager(
                [new AlgorithmChecker($checker)],
                [new JWSTokenSupport()]
            )
        );
    }
    return $this->jwsLoader;
}

            

                #[\Override]
public function getName(): string
{
    /**
     * Note 1: Change OpenIdConnect::class to OAuth, Google,
     * Note 2: Keep 'oidc' unchanged
     * Related logic: app's config/web/di/yii-auth-client
     * `@var array $paramsClients['oidc']`
     * `$openidconnectClient = $paramsClients['oidc'];`
     *
     * Related logic: app's config/common/params [yiisoft/yii-auth-client] =>
     *  [
     *      'oidc' => [
     *          'class' => 'Yiisoft\Yii\AuthClient\Client\OpenIdConnect::class',
     *          'issuerUrl' => 'dev-0yporhwwkgkdmu1g.uk.auth0.com',
     *          'clientId' => $_ENV['OIDC_API_CLIENT_ID'] ?? '',
     *          'clientSecret' => $_ENV['OIDC_API_CLIENT_SECRET'] ?? '',
     *          'returnUrl' => $_ENV['OIDC_API_CLIENT_RETURN_URL'] ?? '',
     *  ],
     */
    return 'oidc';
}

            

                #[\Override]
public function getTitle(): string
{
    return 'Open Id Connect';
}

            

                public function getValidateAuthNonce(): bool
{
    if ($this->validateAuthNonce === null) {
        $this->validateAuthNonce = $this->validateJws && in_array(
            'nonce',
            (array) $this->getConfigParam('claims_supported'),
            true
        );
    }
    return $this->validateAuthNonce;
}

            

                protected function initUserAttributes(): array
{
    return $this->api((array) $this->getConfigParam('userinfo_endpoint'), 'GET');
}

            

                protected function loadJws(string $jws): array
{
    try {
        $jwsLoader = $this->getJwsLoader();
        $signature = null;
        $jwsVerified = $jwsLoader->loadAndVerifyWithKeySet($jws, $this->getJwkSet(), $signature);
        return (array) Json::decode($jwsVerified->getPayload(), true);
    } catch (Exception $e) {
        throw new ClientException('Loading JWS: Exception: ' . $e->getMessage(), $e->getCode());
    }
}

            

                #[\Override]
public function refreshAccessToken(OAuthToken $token): OAuthToken
{
    if (strlen($this->tokenUrl) == 0) {
        $this->tokenUrl = (string) $this->getConfigParam('token_endpoint');
    }
    return parent::refreshAccessToken($token);
}

            

                public function setIssuerUrl(string $url): void
{
    $this->issuerUrl = rtrim($url, '/');
}

            

                public function setValidateAuthNonce($validateAuthNonce): void
{
    $this->validateAuthNonce = $validateAuthNonce;
}

            

                protected function validateClaims(array $claims): void
{
    $iss = isset($claims['iss']) ? (string) $claims['iss'] : '';
    $issuerUrl = $this->issuerUrl;
    if (!isset($claims['iss']) || strcmp(rtrim($iss, '/'), rtrim($issuerUrl, '/')) !== 0) {
        throw new ClientException('Invalid "iss"', 400);
    }
    if (!isset($claims['aud']) || (strcmp((string) $claims['aud'], $this->clientId) !== 0)) {
        throw new ClientException('Invalid "aud"', 400);
    }
}