คู่มือ Integration SSO

# === SSO OAuth2 (ฝั่ง Server — ห้าม commit) ===
SSO_ENABLED=true
SSO_ISSUER=https://sso.doae.go.th
SSO_API_URL=https://sso.doae.go.th
SSO_PORTAL_URL=https://sso.doae.go.th
SSO_CLIENT_ID=<client_id จาก SSO Admin>
SSO_CLIENT_SECRET=<client_secret จาก SSO Admin>
SSO_REDIRECT_URI=https://your-app.doae.go.th/auth/callback
SSO_SCOPES=openid profile email

APP_URL=https://your-app.doae.go.th

https://sso.doae.go.th/oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fyour-app.doae.go.th%2Fauth%2Fcallback&response_type=code&scope=openid%20profile%20email&state=RANDOM_STATE

GET https://your-app.doae.go.th/auth/callback?code=UUID&state=RANDOM_STATE

POST https://sso.doae.go.th/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTHORIZATION_CODE
&redirect_uri=https://your-app.doae.go.th/auth/callback
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET

{
  "access_token": "eyJ...",
  "refresh_token": "eyJ...",
  "token_type": "Bearer",
  "expires_in": 86400
}

GET https://sso.doae.go.th/oauth/userinfo
Authorization: Bearer ACCESS_TOKEN

{
  "sub": "df5ddfbd-2ccf-4eb9-bc66-a843c031b335",
  "id": "df5ddfbd-2ccf-4eb9-bc66-a843c031b335",
  "email": "user@doae.go.th",
  "name": "นายทดสอบ ระบบ",
  "full_name": "นายทดสอบ ระบบ",
  "preferred_username": "user",
  "role": "admin",
  "role_id": "uuid-from-roles-table",
  "organization_id": "uuid",
  "organization_name": "สำนักงานเกษตรอำเภอ...",
  "organization_type": "district",
  "province": "เชียงใหม่",
  "region_id": "uuid-org-unit-region",
  "province_id": "uuid-org-unit-province",
  "district_id": "uuid-org-unit-district",
  "center_id": null,
  "admin_level": "district"
}

POST https://sso.doae.go.th/api/auth/refresh
Content-Type: application/json

{"refresh_token": "YOUR_REFRESH_TOKEN"}

{
  "success": true,
  "tokens": {
    "access_token": "eyJ...",
    "refresh_token": "eyJ...",
    "token_type": "Bearer",
    "expires_in": 86400
  }
}

// routes/web.php
Route::get('/auth/login', [SsoController::class, 'login']);
Route::get('/auth/callback', [SsoController::class, 'callback']);
Route::post('/auth/logout', [SsoController::class, 'logout']);

// SsoController — login
$state = Str::random(40);
session(['oauth_state' => $state]);
return redirect('https://sso.doae.go.th/oauth/authorize?' . http_build_query([
    'client_id'     => config('sso.client_id'),
    'redirect_uri'  => config('sso.redirect_uri'),
    'response_type' => 'code',
    'scope'         => 'openid profile email',
    'state'         => $state,
]));

// SsoController — callback
if ($request->state !== session('oauth_state')) abort(403);
$tokens = Http::asForm()->post('https://sso.doae.go.th/oauth/token', [
    'grant_type'    => 'authorization_code',
    'code'          => $request->code,
    'redirect_uri'  => config('sso.redirect_uri'),
    'client_id'     => config('sso.client_id'),
    'client_secret' => config('sso.client_secret'),
])->json();
$user = Http::withToken($tokens['access_token'])
    ->get('https://sso.doae.go.th/oauth/userinfo')->json();
// ใช้ $user['sub'] เป็น sso_user_id ใน DB

app.get('/auth/login', (req, res) => {
  const state = crypto.randomBytes(32).toString('hex');
  req.session.oauthState = state;
  const params = new URLSearchParams({
    client_id: process.env.SSO_CLIENT_ID,
    redirect_uri: process.env.SSO_REDIRECT_URI,
    response_type: 'code',
    scope: 'openid profile email',
    state,
  });
  res.redirect('https://sso.doae.go.th/oauth/authorize?' + params);
});

app.get('/auth/callback', async (req, res) => {
  if (req.query.state !== req.session.oauthState) return res.status(403).send('Invalid state');
  const { data: tokens } = await axios.post('https://sso.doae.go.th/oauth/token',
    new URLSearchParams({
      grant_type: 'authorization_code',
      code: req.query.code,
      redirect_uri: process.env.SSO_REDIRECT_URI,
      client_id: process.env.SSO_CLIENT_ID,
      client_secret: process.env.SSO_CLIENT_SECRET,
    }).toString(),
    { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } }
  );
  const { data: user } = await axios.get('https://sso.doae.go.th/oauth/userinfo', {
    headers: { Authorization: 'Bearer ' + tokens.access_token },
  });
  req.session.user = user;
  res.redirect('/dashboard');
});