// B2C Auth with Ailacs Identity (Node.js / Express)
// npm install openid-client express-session

const express = require('express');
const { Issuer, generators } = require('openid-client');
const session = require('express-session');

const app = express();
app.use(session({
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: { secure: true, httpOnly: true, sameSite: 'lax' }
}));

let client;
Issuer.discover('https://auth.ailacs.com').then(issuer => {
    client = new issuer.Client({
        client_id:      process.env.AILACS_CLIENT_ID,
        redirect_uris:  ['https://yourapp.com/callback'],
        response_types: ['code'],
    });
});

// Initiate login — generate PKCE verifier + challenge
app.get('/login', (req, res) => {
    const codeVerifier = generators.codeVerifier();
    req.session.codeVerifier = codeVerifier;
    req.session.state        = generators.state();
    const authUrl = client.authorizationUrl({
        scope:                  'openid profile email',
        state:                  req.session.state,
        code_challenge:         generators.codeChallenge(codeVerifier),
        code_challenge_method:  'S256',
    });
    res.redirect(authUrl);
});

// Exchange authorisation code for tokens
app.get('/callback', async (req, res) => {
    const params   = client.callbackParams(req);
    const tokenSet = await client.callback(
        'https://yourapp.com/callback', params,
        { code_verifier: req.session.codeVerifier, state: req.session.state }
    );
    req.session.user = tokenSet.claims();
    res.redirect('/dashboard');
});

app.get('/logout', (req, res) => {
    req.session.destroy();
    res.redirect(client.endSessionUrl({ post_logout_redirect_uri: 'https://yourapp.com' }));
});

# B2C Auth with Ailacs Identity (Python / FastAPI)
# pip install authlib fastapi starlette uvicorn python-dotenv

from fastapi import FastAPI, Request, Depends, HTTPException
from fastapi.responses import RedirectResponse
from authlib.integrations.starlette_client import OAuth
from starlette.middleware.sessions import SessionMiddleware
import os

app = FastAPI()
app.add_middleware(SessionMiddleware, secret_key=os.environ['SESSION_SECRET'])

oauth = OAuth()
oauth.register(
    name='ailacs',
    server_metadata_url='https://auth.ailacs.com/.well-known/openid-configuration',
    client_id=os.environ['AILACS_CLIENT_ID'],
    client_kwargs={
        'scope': 'openid profile email',
        'code_challenge_method': 'S256',  # Enables PKCE automatically
    }
)

@app.get('/login')
async def login(request: Request):
    redirect_uri = str(request.url_for('auth_callback'))
    return await oauth.ailacs.authorize_redirect(request, redirect_uri)

@app.get('/callback')
async def auth_callback(request: Request):
    token = await oauth.ailacs.authorize_access_token(request)
    user  = token['userinfo']
    request.session['user'] = {'sub': user['sub'], 'name': user.get('name'), 'email': user.get('email')}
    return RedirectResponse(url='/dashboard')

@app.get('/logout')
async def logout(request: Request):
    request.session.pop('user', None)
    return RedirectResponse(url='/')

# Reusable auth dependency for protected routes
def require_auth(request: Request):
    if 'user' not in request.session:
        raise HTTPException(status_code=401, detail='Not authenticated')
    return request.session['user']

@app.get('/dashboard')
async def dashboard(user=Depends(require_auth)):
    return {'message': f"Hello, {user['name']}"}

// B2C Auth with Ailacs Identity (Java / Spring Boot 3)
// application.yml:
// spring.security.oauth2.client.registration.ailacs:
//   client-id: ${AILACS_CLIENT_ID}
//   client-authentication-method: none   # public client — PKCE, no secret
//   authorization-grant-type: authorization_code
//   redirect-uri: "{baseUrl}/login/oauth2/code/ailacs"
//   scope: openid,profile,email
// spring.security.oauth2.client.provider.ailacs:
//   issuer-uri: https://auth.ailacs.com

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.oauth2.client.oidc.web.logout.OidcClientInitiatedLogoutSuccessHandler;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final ClientRegistrationRepository clientRegistrationRepository;

    public SecurityConfig(ClientRegistrationRepository repo) {
        this.clientRegistrationRepository = repo;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/public/**", "/error").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .defaultSuccessUrl("/dashboard", true)
            )
            .logout(logout -> logout
                .logoutSuccessHandler(oidcLogoutHandler())
            );
        return http.build();
    }

    private OidcClientInitiatedLogoutSuccessHandler oidcLogoutHandler() {
        var handler = new OidcClientInitiatedLogoutSuccessHandler(clientRegistrationRepository);
        handler.setPostLogoutRedirectUri("https://yourapp.com");
        return handler;
    }
}

// B2C Auth with Ailacs Identity (Go)
// go get github.com/coreos/go-oidc/v3/oidc golang.org/x/oauth2

package main

import (
    "context"
    "crypto/rand"
    "encoding/base64"
    "net/http"
    "github.com/coreos/go-oidc/v3/oidc"
    "golang.org/x/oauth2"
)

var (
    provider     *oidc.Provider
    oauth2Conf   oauth2.Config
    oidcVerifier *oidc.IDTokenVerifier
)

func init() {
    ctx := context.Background()
    provider, _ = oidc.NewProvider(ctx, "https://auth.ailacs.com")
    oidcVerifier = provider.Verifier(&oidc.Config{ClientID: "your-client-id"})
    oauth2Conf = oauth2.Config{
        ClientID:    "your-client-id",
        RedirectURL: "https://yourapp.com/callback",
        Endpoint:    provider.Endpoint(),
        Scopes:      []string{oidc.ScopeOpenID, "profile", "email"},
    }
}

func loginHandler(w http.ResponseWriter, r *http.Request) {
    verifier := oauth2.GenerateVerifier() // PKCE code verifier
    state    := randomState()
    // Store in session (use gorilla/sessions in production)
    http.SetCookie(w, &http.Cookie{Name: "pkce_v", Value: verifier, HttpOnly: true, Secure: true})
    http.SetCookie(w, &http.Cookie{Name: "state",  Value: state,    HttpOnly: true, Secure: true})
    authURL := oauth2Conf.AuthCodeURL(state, oauth2.S256ChallengeOption(verifier))
    http.Redirect(w, r, authURL, http.StatusFound)
}

func callbackHandler(w http.ResponseWriter, r *http.Request) {
    ctx := context.Background()
    vc, _ := r.Cookie("pkce_v")
    token, err := oauth2Conf.Exchange(ctx, r.URL.Query().Get("code"),
        oauth2.VerifierOption(vc.Value))
    if err != nil { http.Error(w, "Exchange failed", 500); return }

    rawIDToken, _ := token.Extra("id_token").(string)
    idToken, err  := oidcVerifier.Verify(ctx, rawIDToken)
    if err != nil { http.Error(w, "Invalid token", 401); return }

    var claims struct{ Sub, Name, Email string }
    idToken.Claims(&claims)
    // Store claims in session and redirect to dashboard
    http.Redirect(w, r, "/dashboard", http.StatusFound)
}

func randomState() string {
    b := make([]byte, 16); rand.Read(b)
    return base64.URLEncoding.EncodeToString(b)
}

<?php
// B2C Auth with Ailacs Identity (PHP / Laravel 11)
// composer require laravel/socialite league/oauth2-client

// app/Http/Controllers/AuthController.php
class AuthController extends Controller
{
    public function login(Request $request)
    {
        // Generate PKCE code verifier + challenge
        $verifier  = bin2hex(random_bytes(32));
        $challenge = rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');

        session([
            'pkce_verifier' => $verifier,
            'oauth_state'   => bin2hex(random_bytes(16)),
        ]);

        $query = http_build_query([
            'response_type'         => 'code',
            'client_id'             => config('services.ailacs.client_id'),
            'redirect_uri'          => config('services.ailacs.redirect'),
            'scope'                 => 'openid profile email',
            'state'                 => session('oauth_state'),
            'code_challenge'        => $challenge,
            'code_challenge_method' => 'S256',
        ]);

        return redirect('https://auth.ailacs.com/connect/authorize?' . $query);
    }

    public function callback(Request $request)
    {
        abort_unless($request->state === session('oauth_state'), 422, 'State mismatch');

        $response = Http::asForm()->post('https://auth.ailacs.com/connect/token', [
            'grant_type'    => 'authorization_code',
            'code'          => $request->code,
            'redirect_uri'  => config('services.ailacs.redirect'),
            'client_id'     => config('services.ailacs.client_id'),
            'code_verifier' => session('pkce_verifier'),
        ]);

        $tokens = $response->json();
        // Parse + verify ID token claims (use firebase/php-jwt or web-token/jwt-framework)
        $claims = $this->verifyIdToken($tokens['id_token']);

        $user = User::updateOrCreate(
            ['sub' => $claims['sub']],
            ['name' => $claims['name'] ?? '', 'email' => $claims['email'] ?? '']
        );
        Auth::login($user, remember: true);
        return redirect('/dashboard');
    }

    public function logout(Request $request)
    {
        Auth::logout();
        $request->session()->invalidate();
        return redirect('https://auth.ailacs.com/connect/logout?post_logout_redirect_uri=' . urlencode(config('app.url')));
    }
}

# B2C Auth with Ailacs Identity (Ruby on Rails 7+)
# Gemfile:
# gem 'omniauth-openid-connect'
# gem 'omniauth-rails_csrf_protection'

# config/initializers/omniauth.rb
Rails.application.config.middleware.use OmniAuth::Builder do
  provider :openid_connect,
    name: :ailacs,
    scope: [:openid, :profile, :email],
    response_type: :code,
    issuer: 'https://auth.ailacs.com',
    discovery: true,
    pkce: true,
    client_options: {
      identifier:   ENV['AILACS_CLIENT_ID'],
      secret:       ENV['AILACS_CLIENT_SECRET'],
      redirect_uri: ENV['AILACS_REDIRECT_URI']
    }
end

# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  skip_before_action :require_login, only: [:create, :failure]

  def create
    auth = request.env['omniauth.auth']
    user = User.find_or_initialize_by(sub: auth.uid)
    user.update!(name: auth.info.name, email: auth.info.email)
    session[:user_id] = user.id
    redirect_to dashboard_path, notice: 'Signed in.'
  end

  def destroy
    session[:user_id] = nil
    redirect_to "https://auth.ailacs.com/connect/logout" \
                "?post_logout_redirect_uri=#{CGI.escape(root_url)}"
  end

  def failure
    redirect_to root_path, alert: "Login failed: #{params[:message]}"
  end
end

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  before_action :require_login

  private

  def require_login
    redirect_to '/auth/ailacs' unless current_user
  end

  def current_user
    @current_user ||= User.find_by(id: session[:user_id])
  end
  helper_method :current_user
end

// B2C Auth with Ailacs Identity (TypeScript / React + react-oidc-context)
// npm install oidc-client-ts react-oidc-context

// src/auth/authConfig.ts
import { UserManager, WebStorageStateStore } from 'oidc-client-ts';

export const userManager = new UserManager({
    authority:                'https://auth.ailacs.com',
    client_id:                import.meta.env.VITE_AILACS_CLIENT_ID,
    redirect_uri:             `${window.location.origin}/callback`,
    post_logout_redirect_uri: `${window.location.origin}/`,
    response_type:            'code',
    scope:                    'openid profile email',
    // PKCE is enabled by default in oidc-client-ts — no client_secret needed
    automaticSilentRenew:     true,
    silent_redirect_uri:      `${window.location.origin}/silent-renew`,
    userStore: new WebStorageStateStore({ store: window.sessionStorage }),
});

// src/main.tsx
import { AuthProvider } from 'react-oidc-context';
import { userManager } from './auth/authConfig';

ReactDOM.createRoot(document.getElementById('root')!).render(
    <AuthProvider userManager={userManager}>
        <App />
    </AuthProvider>
);

// src/components/ProtectedRoute.tsx
import { useAuth } from 'react-oidc-context';

export function ProtectedRoute({ children }: { children: React.ReactNode }) {
    const auth = useAuth();
    if (auth.isLoading) return <div>Loading...</div>;
    if (!auth.isAuthenticated) { auth.signinRedirect(); return null; }
    return <>{children}</>;
}

// src/pages/Callback.tsx
export function Callback() {
    const auth = useAuth();
    useEffect(() => {
        if (!auth.isLoading && !auth.activeNavigator) {
            window.location.replace('/dashboard');
        }
    }, [auth]);
    return <div>Completing sign-in...</div>;
}