Single Sign-On (SSO)

import jwt
import os
from datetime import datetime, timedelta, timezone
# pip install PyJWT

PRODUCTBRIDGE_SECRET = os.environ['PRODUCTBRIDGE_WIDGET_SECRET']

def handle_sso_callback(request):
    redirect_url = request.args.get('redirect')
    organization_id = request.args.get('organizationId')
    return_to = request.args.get('returnTo')
    user = current_user  # your authenticated user

    payload = {
        # Required
        'email': user.email,

        # Recommended
        'name': user.name,
        'id': str(user.id),
        'avatarURL': user.avatar_url,

        # Optional: company & plan data
        'company_name': user.company_name,
        'company_id': str(user.company_id) if user.company_id else None,
        'company_mrr': user.mrr,
        'customer_status': user.status,
        'renewal_date': user.renewal_date,
        'renewal_risk': user.renewal_risk,

        # Token lifetime
        'exp': datetime.now(tz=timezone.utc) + timedelta(hours=1),
    }

    token = jwt.encode(payload, PRODUCTBRIDGE_SECRET, algorithm='HS256')

    from urllib.parse import urlparse, urlencode, parse_qs
    import urllib.parse

    params = {'ssoToken': token, 'organizationId': organization_id}
    if return_to:
        params['returnTo'] = return_to

    callback = f"{redirect_url}?{urlencode(params)}"
    return redirect(callback)

<?php
use Firebase\JWT\JWT;
// composer require firebase/php-jwt

class SSOController extends Controller
{
    public function callback(Request $request): \Illuminate\Http\RedirectResponse
    {
        $redirectUrl    = $request->query('redirect');
        $organizationId = $request->query('organizationId');
        $returnTo       = $request->query('returnTo');
        $user           = $request->user();

        $payload = array_filter([
            // Required
            'email'           => $user->email,

            // Recommended
            'name'            => $user->name,
            'id'              => (string) $user->id,
            'avatarURL'       => $user->avatar_url,

            // Optional
            'company_name'    => $user->company_name,
            'company_id'      => $user->company_id ? (string) $user->company_id : null,
            'company_mrr'     => $user->mrr,
            'customer_status' => $user->status,
            'renewal_date'    => $user->renewal_date,
            'renewal_risk'    => $user->renewal_risk,

            'exp'             => time() + 3600,
        ]);

        $token = JWT::encode($payload, env('PRODUCTBRIDGE_WIDGET_SECRET'), 'HS256');

        $params = http_build_query(array_filter([
            'ssoToken'       => $token,
            'organizationId' => $organizationId,
            'returnTo'       => $returnTo,
        ]));

        return redirect("{$redirectUrl}?{$params}");
    }
}

require 'jwt'

class SSOController < ApplicationController
  def callback
    redirect_url    = params[:redirect]
    organization_id = params[:organizationId]
    return_to       = params[:returnTo]
    user            = current_user

    payload = {
      # Required
      email: user.email,

      # Recommended
      name: user.name,
      id: user.id.to_s,
      avatarURL: user.avatar_url,

      # Optional
      company_name: user.company_name,
      company_id: user.company_id&.to_s,
      company_mrr: user.mrr,
      customer_status: user.status,
      renewal_date: user.renewal_date,
      renewal_risk: user.renewal_risk,

      exp: 1.hour.from_now.to_i,
    }.compact

    token = JWT.encode(payload, ENV['PRODUCTBRIDGE_WIDGET_SECRET'], 'HS256')

    query = { ssoToken: token, organizationId: organization_id, returnTo: return_to }.compact
    redirect_to "#{redirect_url}?#{query.to_query}"
  end
end

package handlers

import (
    "net/http"
    "net/url"
    "os"
    "time"

    "github.com/golang-jwt/jwt/v5"
)

var secret = []byte(os.Getenv("PRODUCTBRIDGE_WIDGET_SECRET"))

type SSOClaims struct {
    Email          string  `json:"email"`
    Name           string  `json:"name,omitempty"`
    ID             string  `json:"id,omitempty"`
    AvatarURL      string  `json:"avatarURL,omitempty"`
    CompanyName    string  `json:"company_name,omitempty"`
    CompanyID      string  `json:"company_id,omitempty"`
    CompanyMRR     float64 `json:"company_mrr,omitempty"`
    CustomerStatus string  `json:"customer_status,omitempty"`
    RenewalDate    string  `json:"renewal_date,omitempty"`
    RenewalRisk    string  `json:"renewal_risk,omitempty"`
    jwt.RegisteredClaims
}

func SSOCallback(w http.ResponseWriter, r *http.Request) {
    q           := r.URL.Query()
    redirectURL := q.Get("redirect")
    orgID       := q.Get("organizationId")
    returnTo    := q.Get("returnTo")
    user        := userFromContext(r.Context())

    claims := SSOClaims{
        Email:          user.Email,
        Name:           user.Name,
        ID:             user.ID,
        AvatarURL:      user.AvatarURL,
        CompanyName:    user.CompanyName,
        CompanyID:      user.CompanyID,
        CompanyMRR:     user.MRR,
        CustomerStatus: user.Status,
        RenewalDate:    user.RenewalDate,
        RenewalRisk:    user.RenewalRisk,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
            IssuedAt:  jwt.NewNumericDate(time.Now()),
        },
    }

    token, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(secret)

    cb, _ := url.Parse(redirectURL)
    p := url.Values{"ssoToken": {token}, "organizationId": {orgID}}
    if returnTo != "" {
        p.Set("returnTo", returnTo)
    }
    cb.RawQuery = p.Encode()

    http.Redirect(w, r, cb.String(), http.StatusFound)
}