neonail-database/app/Http/Controllers/Auth/SsoController.php

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\SsoSetting;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

class SsoController extends Controller
{
    public function redirect(Request $request)
    {
        $sso = SsoSetting::get();

        if (!$sso->isConfigured()) {
            return redirect()->route('login')->with('error', 'SSO ist nicht konfiguriert.');
        }

        $state = Str::random(40);
        session(['sso_state' => $state]);

        $query = http_build_query([
            'client_id'     => $sso->client_id,
            'redirect_uri'  => route('sso.callback'),
            'response_type' => 'code',
            'scope'         => 'openid email profile',
            'state'         => $state,
        ]);

        return redirect($sso->authorizeUrl() . '?' . $query);
    }

    public function callback(Request $request)
    {
        $sso = SsoSetting::get();

        if (!$sso->isConfigured()) {
            return redirect()->route('login')->with('error', 'SSO ist nicht konfiguriert.');
        }

        // State prüfen
        if ($request->get('state') !== session('sso_state')) {
            return redirect()->route('login')->with('error', 'Ungültige SSO-Anfrage (state mismatch).');
        }
        session()->forget('sso_state');

        if ($request->has('error')) {
            return redirect()->route('login')->with('error', 'SSO-Anmeldung abgebrochen: ' . $request->get('error_description', $request->get('error')));
        }

        // Code gegen Token tauschen
        $tokenResponse = Http::asForm()->post($sso->tokenUrl(), [
            'grant_type'    => 'authorization_code',
            'client_id'     => $sso->client_id,
            'client_secret' => $sso->client_secret,
            'redirect_uri'  => route('sso.callback'),
            'code'          => $request->get('code'),
        ]);

        if ($tokenResponse->failed()) {
            return redirect()->route('login')->with('error', 'SSO-Token konnte nicht abgerufen werden.');
        }

        $accessToken = $tokenResponse->json('access_token');

        // Userinfo abrufen
        $userInfo = Http::withToken($accessToken)->get($sso->userInfoUrl());

        if ($userInfo->failed()) {
            return redirect()->route('login')->with('error', 'SSO-Benutzerinformationen konnten nicht abgerufen werden.');
        }

        $info = $userInfo->json();
        $providerId = $info['sub'] ?? null;
        $email      = $info['email'] ?? null;
        $name       = $info['name'] ?? $info['preferred_username'] ?? $email;

        if (!$providerId || !$email) {
            return redirect()->route('login')->with('error', 'Unvollständige Benutzerinformationen vom SSO-Provider.');
        }

        // User suchen oder anlegen
        $user = User::where('sso_provider_id', $providerId)->first()
             ?? User::where('email', $email)->first();

        if (!$user) {
            $user = User::create([
                'name'            => $name,
                'email'           => $email,
                'password'        => bcrypt(Str::random(32)),
                'sso_provider_id' => $providerId,
                'is_sso_user'     => true,
            ]);
        } elseif (!$user->sso_provider_id) {
            // Bestehenden Account mit SSO verknüpfen
            $user->sso_provider_id = $providerId;
            $user->is_sso_user     = true;
            $user->save();
        }

        Auth::login($user, true);

        return redirect()->intended(route('user-nail-polishes.index'));
    }
}