Zaloguj przez 1g.pl

<a class="logowanie-1g"
   href="https://1g.pl/api/oauth/authorize.php
        ?client_id=TWOJ_CLIENT_ID
        &redirect_uri=https%3A%2F%2Ftwoja.pl%2Fodbior
        &response_type=code
        &scope=profil%20email
        &state=LOSOWY_CIAG_Z_SESJI">
  <img src="https://1g.pl/assets/img/logowanie-1g.svg" alt="" width="20" height="20">
  Zaloguj przez 1g.pl
</a>

.logowanie-1g {
  display: inline-flex; align-items: center; gap: 9px;
  padding: 11px 20px; min-height: 44px;
  border: 1px solid #d0d5dd; border-radius: 9px;
  background: #fff; color: #1a202c;
  font: 600 15px/1 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
  text-decoration: none;
}
.logowanie-1g:hover { background: #f7f9fc; }

<?php
session_start();

const CLIENT_ID     = 'TWOJ_CLIENT_ID';
const CLIENT_SECRET = 'TWOJ_SEKRET';          // tylko tutaj, nigdy w kodzie strony
const REDIRECT_URI  = 'https://twoja.pl/odbior.php';

/* ── Wyjście: przenosimy użytkownika do 1g.pl ─────────────────────────── */
if (!isset($_GET['code'])) {
    $_SESSION['1g_state']    = bin2hex(random_bytes(16));
    $_SESSION['1g_verifier'] = rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '=');

    $wyzwanie = rtrim(strtr(base64_encode(
        hash('sha256', $_SESSION['1g_verifier'], true)), '+/', '-_'), '=');

    header('Location: https://1g.pl/api/oauth/authorize.php?' . http_build_query([
        'client_id'             => CLIENT_ID,
        'redirect_uri'          => REDIRECT_URI,
        'response_type'         => 'code',
        'scope'                 => 'profil email',
        'state'                 => $_SESSION['1g_state'],
        'code_challenge'        => $wyzwanie,
        'code_challenge_method' => 'S256',
    ]));
    exit;
}

/* ── Powrót: najpierw state, potem cokolwiek innego ───────────────────── */
if (!hash_equals($_SESSION['1g_state'] ?? '', $_GET['state'] ?? '')) {
    http_response_code(400);
    exit('Niezgodny state — to logowanie nie zaczęło się u nas.');
}

/* ── Kod → token (serwer–serwer) ──────────────────────────────────────── */
$ch = curl_init('https://1g.pl/api/oauth/token.php');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_POSTFIELDS     => http_build_query([
        'grant_type'    => 'authorization_code',
        'code'          => $_GET['code'],
        'redirect_uri'  => REDIRECT_URI,      // ten sam co wyżej, co do znaku
        'client_id'     => CLIENT_ID,
        'client_secret' => CLIENT_SECRET,
        'code_verifier' => $_SESSION['1g_verifier'],
    ]),
]);
$odp = json_decode((string)curl_exec($ch), true);
curl_close($ch);

if (empty($odp['access_token'])) {
    http_response_code(400);
    exit('Logowanie nieudane: ' . ($odp['error_description'] ?? $odp['error'] ?? '?'));
}

/* ── Token → dane użytkownika ─────────────────────────────────────────── */
$ch = curl_init('https://1g.pl/api/oauth/userinfo.php');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $odp['access_token']],
]);
$user = json_decode((string)curl_exec($ch), true);
curl_close($ch);

/* $user['sub'] to stały numer konta w 1g.pl — po nim rozpoznajesz powracającego.
   Nie po e-mailu: e-mail wolno zmienić, numer nie. */
$_SESSION['moj_uzytkownik'] = $user;
header('Location: /');

import crypto from 'node:crypto';

const CLIENT_ID = 'TWOJ_CLIENT_ID';
const CLIENT_SECRET = process.env.CLIENT_SECRET_1G;   // ze zmiennej środowiskowej
const REDIRECT_URI = 'https://twoja.pl/odbior';

const b64url = (buf) => buf.toString('base64url');

// Wyjście
export function adresLogowania(sesja) {
  sesja.state = b64url(crypto.randomBytes(16));
  sesja.verifier = b64url(crypto.randomBytes(32));
  const wyzwanie = b64url(crypto.createHash('sha256').update(sesja.verifier).digest());

  const p = new URLSearchParams({
    client_id: CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    response_type: 'code',
    scope: 'profil email',
    state: sesja.state,
    code_challenge: wyzwanie,
    code_challenge_method: 'S256',
  });
  return `https://1g.pl/api/oauth/authorize.php?${p}`;
}

// Powrót
export async function odbior(sesja, query) {
  if (query.state !== sesja.state) throw new Error('Niezgodny state');

  const odp = await fetch('https://1g.pl/api/oauth/token.php', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: query.code,
      redirect_uri: REDIRECT_URI,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      code_verifier: sesja.verifier,
    }),
  }).then(r => r.json());

  if (!odp.access_token) throw new Error(odp.error_description || odp.error);

  return fetch('https://1g.pl/api/oauth/userinfo.php', {
    headers: { Authorization: `Bearer ${odp.access_token}` },
  }).then(r => r.json());
}

{
  "sub": "84213",
  "iss": "https://1g.pl",
  "name": "Anna Kowalska",
  "given_name": "Anna",
  "family_name": "Kowalska",
  "picture": "https://cdn.1g.pl/avatars/84213.webp",
  "email": "anna.kowalska@example.com",
  "email_verified": true
}