Bu ilova SETC ID'ga qanday ulangan

Ilova setc/id-laravel paketidan foydalanadi. Butun integratsiya — bitta trait, bitta "bog'lash" sahifasi va chiqish tugmasi. Kod: Pvipvip/setc-id-demo.

1. O'rnatish

composer require setc/id-laravel
php artisan vendor:publish --tag=setc-id-migrations && php artisan migrate
php vendor/bin/setc-id-keygen /etc/myapp/setc-id.pem   # ochiq JWKS → SETC ID administratoriga

SETC_ID_ENABLED=true
SETC_ID_ISSUER=https://idstage.demo.setc.uz
SETC_ID_CLIENT_ID=...
SETC_ID_KEY_FILE=/etc/myapp/setc-id.pem

SETC ID'da ro'yxatdan o'tkazishda: redirect https://iddemo.demo.setc.uz/auth/setc/callback, hodisalar https://iddemo.demo.setc.uz/setc/events, chiqishdan keyin https://iddemo.demo.setc.uz.

2. User modeli

class User extends Authenticatable
{
    use \Setc\Id\Laravel\Concerns\HasSetcId;   // setc_sub, setc_overrides
}

// config/setc-id.php
'claims' => ['phone_number' => 'phone', 'name' => 'name'],
'link_route' => 'setc.link',

phone_number — authoritative: har kirishda va profile-updated hodisasida yoziladi, bog'langan foydalanuvchida faqat o'qiladi. name — seed: foydalanuvchi ilovada o'zgartirsa (markSetcOverride('name')), SETC'dagi keyingi o'zgarishlar unga tegmaydi.

3. Kirish va bog'lash

Tugma route('setc-id.redirect') ga olib boradi (PKCE, private_key_jwt). Callback foydalanuvchini faqat setc_sub bo'yicha qidiradi. Topilmasa, link_route sahifasi ochiladi:

// "Mavjud akkauntim bor" — ilovaning o'z logini bilan tasdiqlangandan keyin
return redirect(SetcId::link($user));

// "Yangi akkaunt"
$user = User::create(['name' => SetcId::pending()['claims']['name']]);
return redirect(SetcId::link($user));

4. Hodisalar

POST /setc/events ni paket o'zi qabul qiladi: imzo, aud, takror (jti) tekshiriladi.

• session-revoked — shu SETC sessiyasiga bog'langan sessiyalar yopiladi;
• consent-revoked, account-disabled, account-purged — foydalanuvchining barcha SETC sessiyalari;
• profile-updated — claim'lar override'lar hisobga olingan holda yoziladi.

Event::listen(fn (SecurityEventReceived $e) => /* qo'shimcha ishlov */);

5. Chiqish

Route::post('/logout', fn (Request $r) => redirect()->away(SetcId::logout($r) ?? '/'));

Lokal sessiya yopiladi. SETC orqali kirilgan bo'lsa, SETC ID foydalanuvchidan faqat shu ilovadan yoki barcha SETC xizmatlaridan chiqishni so'raydi.