alfa-bank-sdk/src/Services/H2HAuthService.php

<?php

declare(strict_types=1);

namespace Apoloz\AlfaBank\Services;

use Apoloz\AlfaBank\Core\AlfaBankConnector;
use Apoloz\AlfaBank\Data\Auth\TokenData;
use Apoloz\AlfaBank\Enums\Environment;

class H2HAuthService
{
    public function __construct(
        protected AlfaBankConnector $connector,
        protected string $clientId,
        protected string $redirectUri,
        protected Environment $environment = Environment::SANDBOX
    ) {}

    /**
     * Step 1: Generate the URL for the user to authorize via Alfa ID.
     *
     * @param array<string> $scopes List of scopes (e.g. ['beneficiaries', 'payment'])
     * @param string|null $state Optional state parameter for CSRF protection
     */
    public function getAuthUrl(array $scopes = ['beneficiaries'], ?string $state = null): string
    {
        $baseUrl = $this->environment === Environment::PRODUCTION
            ? 'https://id.alfabank.ru/oidc/authorize'
            : 'https://id-sandbox.alfabank.ru/oidc/authorize';

        $params = [
            'response_type' => 'code',
            'client_id' => $this->clientId,
            'redirect_uri' => $this->redirectUri,
            'scope' => implode(' ', $scopes),
        ];

        if ($state) {
            $params['state'] = $state;
        }

        return $baseUrl . '?' . http_build_query($params);
    }

    /**
     * Step 2: Exchange the received code for Access & Refresh Tokens.
     */
    public function exchangeCode(string $code): TokenData
    {
        return $this->connector->authWithCode($code, $this->redirectUri);
    }

    /**
     * Step 3: Refresh the token using a stored refresh token.
     */
    public function refreshToken(string $refreshToken): TokenData
    {
        return $this->connector->refreshToken($refreshToken);
    }
}