SSO Integration (JWT)

<?php
// Generate a new RSA key pair (run once)
$config = [
    'private_key_bits' => 2048,
    'private_key_type' => OPENSSL_KEYTYPE_RSA,
];

$keyPair = openssl_pkey_new($config);

// Export private key (keep this secret!)
openssl_pkey_export($keyPair, $privateKey);
file_put_contents('private_key.pem', $privateKey);

// Export public key (share with Terang AI)
$publicKey = openssl_pkey_get_details($keyPair)['key'];
file_put_contents('public_key.pem', $publicKey);

echo "Keys generated successfully.\n";
echo "Share public_key.pem with the Terang AI team.\n";

<?php
// Install: composer require firebase/php-jwt
use Firebase\JWT\JWT;

$privateKey = file_get_contents('/path/to/private_key.pem');
$now = time();

$payload = [
    'iss'          => 'your-domain.com',  // Your domain
    'aud'          => 'terang.ai',
    'sub'          => 'member',          // 'member' | 'umum' | 'mahasiswa'
    'email'        => $member->email,
    'name'         => $member->name,
    'membershipId' => $member->id,
    'iat'          => $now,
    'exp'          => $now + 300,         // 5 minutes
    'jti'          => $member->signon_md5,
];

$token = JWT::encode($payload, $privateKey, 'RS256', 'key-1');

// Call Terang AI gateway from your backend (so api.terang.ai sees your whitelisted IP)
$ch = curl_init('https://api.terang.ai/sso/verify?token=' . urlencode($token));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);  // CRITICAL: do NOT follow redirects
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_NOBODY, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Gateway should return 302 with a Location header pointing to the LMS
if ($httpCode === 302 && preg_match('/^Location:\s*(.+)$/mi', $response, $m)) {
    // Forward the user's browser to the LMS — the session cookie will be
    // set on the browser as it follows the rest of the redirect chain.
    header('Location: ' . trim($m[1]));
    exit;
}

// Surface gateway errors (400 / 401 / 403 / etc.)
http_response_code($httpCode ?: 500);
echo "SSO gateway returned unexpected status: $httpCode";
exit;

<?php
// Serve this at: https://your-domain.com/.well-known/jwks.json
$publicKey = file_get_contents('/path/to/public_key.pem');
$keyData = openssl_pkey_get_details(openssl_pkey_get_public($publicKey));

$jwks = [
    'keys' => [
        [
            'kty' => 'RSA',
            'kid' => 'key-1',
            'use' => 'sig',
            'alg' => 'RS256',
            'n' => rtrim(strtr(base64_encode($keyData['rsa']['n']), '+/', '-_'), '='),
            'e' => rtrim(strtr(base64_encode($keyData['rsa']['e']), '+/', '-_'), '='),
        ],
    ],
];

header('Content-Type: application/json');
echo json_encode($jwks);

import { generateKeyPairSync } from 'crypto';
import fs from 'fs';

const { publicKey, privateKey } = generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: { type: 'spki', format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
});

fs.writeFileSync('private_key.pem', privateKey);
fs.writeFileSync('public_key.pem', publicKey);

console.log('Keys generated. Share public_key.pem with the Terang AI team.');

// Express handler — wire this to whatever route triggers the SSO hand-off
import jwt from 'jsonwebtoken';
import fs from 'fs';

const privateKey = fs.readFileSync('./private_key.pem', 'utf8');

app.get('/open-terang', async (req, res) => {
  const member = req.user; // from your own session

  const token = jwt.sign(
    {
      iss: 'your-domain.com',
      aud: 'terang.ai',
      sub: 'member', // 'member' | 'umum' | 'mahasiswa'
      email: member.email,
      name: member.name,
      membershipId: member.id,
      jti: member.signon_md5,
    },
    privateKey,
    {
      algorithm: 'RS256',
      expiresIn: '5m',
      keyid: 'key-1', // Must match the kid in your JWKS
    }
  );

  // Call the gateway from your backend so api.terang.ai sees your whitelisted IP.
  const gatewayResp = await fetch(
    `https://api.terang.ai/sso/verify?token=${encodeURIComponent(token)}`,
    { method: 'GET', redirect: 'manual' }  // CRITICAL: do NOT follow redirects
  );

  if (gatewayResp.status !== 302) {
    return res
      .status(gatewayResp.status)
      .send(`SSO gateway returned unexpected status: ${gatewayResp.status}`);
  }

  const location = gatewayResp.headers.get('location');

  // Forward the user's browser to the LMS — the session cookie will be set
  // on the browser as it follows the rest of the redirect chain.
  return res.redirect(302, location);
});

import express from 'express';
import { createPublicKey } from 'crypto';
import fs from 'fs';

const app = express();

app.get('/.well-known/jwks.json', (req, res) => {
  const publicKey = createPublicKey(
    fs.readFileSync('./public_key.pem', 'utf8')
  );

  const jwk = publicKey.export({ format: 'jwk' });

  res.json({
    keys: [
      {
        kty: jwk.kty,
        kid: 'key-1',
        use: 'sig',
        alg: 'RS256',
        n: jwk.n,
        e: jwk.e,
      },
    ],
  });
});

app.listen(3000);