feature/os2web key

.github/workflows/pr.yaml

@@ -8,7 +8,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 2
 
@@ -26,7 +26,7 @@ jobs:
         php-versions: [ '8.3' ]
         dependency-version: [ prefer-lowest, prefer-stable ]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
       - name: Setup PHP, with composer and extensions
         uses: shivammathur/setup-php@v2
         with:
@@ -56,9 +56,8 @@ jobs:
     strategy:
       matrix:
         php-versions: [ '8.3' ]
-        dependency-version: [ prefer-lowest, prefer-stable ]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
       - name: Setup PHP, with composer and extensions
         uses: shivammathur/setup-php@v2
         with:
@@ -76,6 +75,7 @@ jobs:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
           restore-keys: ${{ runner.os }}-composer-
+
       - name: Install Dependencies
         run: |
           composer install --no-interaction --no-progress
@@ -89,9 +89,8 @@ jobs:
     strategy:
       matrix:
         php-versions: [ '8.3' ]
-        dependency-version: [ prefer-lowest, prefer-stable ]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
       - name: Setup PHP, with composer and extensions
         uses: shivammathur/setup-php@v2
         with:
@@ -112,19 +111,18 @@ jobs:
       - name: Install Dependencies
         run: |
           composer install --no-interaction --no-progress
-      - name: twigcs
+      - name: twig-cs-fixer
         run: |
-          composer coding-standards-check/twigcs
+          composer coding-standards-check/twig-cs-fixer
 
   php-code-analysis:
     name: PHP code analysis
     runs-on: ubuntu-latest
     strategy:
       matrix:
         php-versions: [ '8.3' ]
-        dependency-version: [ prefer-lowest, prefer-stable ]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
       - name: Setup PHP, with composer and extensions
         uses: shivammathur/setup-php@v2
         with:
@@ -183,7 +181,7 @@ jobs:
     name: Markdown coding standards
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
         run: echo "::set-output name=dir::$(yarn cache dir)"

.gitignore

@@ -2,3 +2,4 @@ vendor
 composer.lock
 node_modules
 yarn.lock
+*.cache

.markdownlint.jsonc

@@ -0,0 +1,13 @@
+{
+  "default": true,
+  // https://github.com/DavidAnson/markdownlint/blob/main/doc/md013.md
+  "line-length": {
+    "line_length": 120,
+    "code_blocks": false,
+    "tables": false
+  },
+  // https://github.com/DavidAnson/markdownlint/blob/main/doc/md024.md
+  "no-duplicate-heading": {
+    "siblings_only": true
+  }
+}

CHANGELOG.md

@@ -8,7 +8,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
-## [2.2.1]
+## [2.3.0] 2025-12-11
+
+* [PR-20](https://github.com/itk-dev/os2forms_nemlogin_openid_connect/pull/20)
+  Added support for Key.
+
+## [2.2.1] 2025-03-13
 
 * Allowed `os2forms/os2forms` 4.0.
 * Updated GitHub action dependencies.
@@ -32,7 +37,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 * Allowed multiple providers.
 
-[Unreleased]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.2.1...HEAD
+[Unreleased]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.3.0...HEAD
+[2.3.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.2.1...2.3.0
 [2.2.1]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.2.0...2.2.1
 [2.2.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.1.0...2.2.0
 [2.1.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.0.1...2.1.0

README.md

@@ -94,5 +94,37 @@ $settings['os2forms_nemlogin_openid_connect']['another-plugin-id']['local_test_u
     'name' => 'User 87',
   ],
 ];
+```
+
+## Coding standards
+
+Our coding are checked by GitHub Actions (cf. [.github/workflows/pr.yml](.github/workflows/pr.yml)). Use the commands
+below to run the checks locally.
+
+### PHP
+
+```shell
+docker run --rm --volume ${PWD}:/app --workdir /app itkdev/php8.3-fpm composer install
+# Fix (some) coding standards issues
+docker run --rm --volume ${PWD}:/app --workdir /app itkdev/php8.3-fpm composer coding-standards-apply
+# Check that code adheres to the coding standards
+docker run --rm --volume ${PWD}:/app --workdir /app itkdev/php8.3-fpm composer coding-standards-check
+```
+
+### Markdown
+
+```shell
+docker run --rm --volume $PWD:/md peterdavehello/markdownlint markdownlint --ignore vendor --ignore LICENSE.md '**/*.md' --fix
+docker run --rm --volume $PWD:/md peterdavehello/markdownlint markdownlint --ignore vendor --ignore LICENSE.md '**/*.md'
+```
+
+## Code analysis
+
+We use [PHPStan](https://phpstan.org/) for static code analysis.
+
+Running statis code analysis on a standalone Drupal module is a bit tricky, so we use a helper script to run the
+analysis:
 
+```shell
+docker run --rm --volume ${PWD}:/app --workdir /app itkdev/php8.3-fpm ./scripts/code-analysis
 ```

composer.json

@@ -1,63 +1,79 @@
 {
     "name": "itk-dev/os2forms_nemlogin_openid_connect",
-    "type": "drupal-module",
-    "license": "MIT",
     "description": "os2forms_nemlogin_openid_connect",
-    "keywords": [],
+    "license": "MIT",
+    "type": "drupal-module",
     "homepage": "https://www.drupal.org/project/os2forms_nemlogin_openid_connect",
-    "minimum-stability": "dev",
-    "repositories": [
-        {
-            "type": "composer",
-            "url": "https://packages.drupal.org/8"
-        }
-    ],
     "require": {
+        "drupal/webform": "^6.0",
+        "itk-dev/drupal_psr6_cache": "^1.1",
         "itk-dev/openid-connect": "^3.1",
-        "itk-dev/drupal_psr6_cache": "^1.0",
-        "os2forms/os2forms": "^3.17 || ^4.0",
+        "os2web/os2web_audit": "^1.0",
+        "os2web/os2web_key": "^1.0",
         "os2web/os2web_nemlogin": "^1.2",
-        "drupal/webform": "^6.0",
         "symfony/options-resolver": "^5.4 || ^6.0"
     },
     "require-dev": {
+        "dealerdirect/phpcodesniffer-composer-installer": "^1.0",
         "drupal/coder": "^8.3",
-        "dealerdirect/phpcodesniffer-composer-installer": "^0.7.1",
-        "mglaman/drupal-check": "^1.4",
+        "ergebnis/composer-normalize": "^2.47",
+        "mglaman/drupal-check": "^1.5",
         "mglaman/phpstan-drupal": "~1.2.0",
-        "friendsoftwig/twigcs": "^6.0"
+        "vincentlanglet/twig-cs-fixer": "^3.5"
+    },
+    "repositories": [
+        {
+            "type": "composer",
+            "url": "https://packages.drupal.org/8"
+        }
+    ],
+    "minimum-stability": "dev",
+    "prefer-stable": true,
+    "config": {
+        "allow-plugins": {
+            "cweagans/composer-patches": true,
+            "dealerdirect/phpcodesniffer-composer-installer": true,
+            "ergebnis/composer-normalize": true,
+            "mglaman/composer-drupal-lenient": true,
+            "simplesamlphp/composer-module-installer": true,
+            "simplesamlphp/composer-xmlprovider-installer": true,
+            "zaporylie/composer-drupal-optimizations": true
+        }
+    },
+    "extra": {
+        "drupal-lenient": {
+            "allowed-list": [
+                "drupal/coc_forms_auto_export",
+                "drupal/webform_node_element"
+            ]
+        }
     },
     "scripts": {
+        "code-analysis": [
+            "@code-analysis/drupal-check"
+        ],
         "code-analysis/drupal-check": [
             "drupal-check --deprecations --analysis --exclude-dir=vendor *.* src"
         ],
-        "code-analysis": [
-            "@code-analysis/drupal-check"
+        "coding-standards-apply": [
+            "@coding-standards-apply/phpcbf",
+            "@coding-standards-apply/twig-cs-fixer"
         ],
-        "coding-standards-check/phpcs": [
-            "phpcs --standard=phpcs.xml.dist"
+        "coding-standards-apply/phpcbf": [
+            "phpcbf --standard=phpcs.xml.dist"
         ],
-        "coding-standards-check/twigcs": [
-            "twigcs templates"
+        "coding-standards-apply/twig-cs-fixer": [
+            "twig-cs-fixer --fix"
         ],
         "coding-standards-check": [
             "@coding-standards-check/phpcs",
             "@coding-standards-check/twigcs"
         ],
-        "coding-standards-apply/phpcbf": [
-            "phpcbf --standard=phpcs.xml.dist"
+        "coding-standards-check/phpcs": [
+            "phpcs --standard=phpcs.xml.dist"
         ],
-        "coding-standards-apply": [
-            "@coding-standards-apply/phpcbf"
+        "coding-standards-check/twig-cs-fixer": [
+            "twig-cs-fixer"
         ]
-    },
-    "config": {
-        "allow-plugins": {
-            "dealerdirect/phpcodesniffer-composer-installer": true,
-            "zaporylie/composer-drupal-optimizations": true,
-            "cweagans/composer-patches": true,
-            "simplesamlphp/composer-module-installer": true,
-            "mglaman/composer-drupal-lenient": true
-        }
     }
 }

os2forms_nemlogin_openid_connect.info.yml

@@ -11,5 +11,6 @@ dependencies:
   - drupal:os2forms_forloeb
   - drupal:os2web_nemlogin
   - os2web:os2web_audit
+  - os2web_key:os2web_key
 
 configure: os2forms_nemlogin_openid_connect.admin.settings

src/Controller/OpenIDConnectController.php

@@ -12,8 +12,11 @@
 use Drupal\Core\Site\Settings;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\Core\Url;
+use Drupal\key\KeyRepositoryInterface;
 use Drupal\os2forms_nemlogin_openid_connect\Exception\AuthenticationException;
 use Drupal\os2forms_nemlogin_openid_connect\Plugin\os2web\NemloginAuthProvider\OpenIDConnect;
+use Drupal\os2web_key\KeyHelper;
+use Drupal\os2web_key\Plugin\KeyType\OidcKeyType;
 use Drupal\os2web_nemlogin\Service\AuthProviderService;
 use ItkDev\OpenIdConnect\Security\OpenIdConfigurationProvider;
 use Psr\Cache\CacheItemPoolInterface;
@@ -77,8 +80,10 @@ public function __construct(
     private readonly SessionInterface $session,
     private readonly CacheItemPoolInterface $cacheItemPool,
     private readonly LanguageManagerInterface $languageManager,
-    LoggerInterface $logger,
     private readonly RendererInterface $renderer,
+    private readonly KeyRepositoryInterface $keyRepository,
+    private readonly KeyHelper $keyHelper,
+    LoggerInterface $logger,
   ) {
     $this->setLogger($logger);
   }
@@ -93,8 +98,10 @@ public static function create(ContainerInterface $container): self {
       $container->get('session'),
       $container->get('drupal_psr6_cache.cache_item_pool'),
       $container->get('language_manager'),
-      $container->get('logger.channel.os2forms_nemlogin_openid_connect'),
       $container->get('renderer'),
+      $container->get('key.repository'),
+      $container->get(KeyHelper::class),
+      $container->get('logger.channel.os2forms_nemlogin_openid_connect'),
     );
   }
 
@@ -140,12 +147,35 @@ public function main(string $id) {
   private function getOpenIdConfigurationProvider(): OpenIdConfigurationProvider {
     $pluginConfiguration = $this->plugin->getConfiguration();
 
+    if (OpenIDConnect::PROVIDER_TYPE_KEY === $pluginConfiguration[OpenIDConnect::PROVIDER_TYPE_KEY]) {
+      $discoveryUrl = $pluginConfiguration[OpenIDConnect::DISCOVERY_URL];
+      $clientId = $pluginConfiguration[OpenIDConnect::CLIENT_ID];
+      $clientSecret = $pluginConfiguration[OpenIDConnect::CLIENT_SECRET];
+    }
+    else {
+      try {
+        $keyId = $pluginConfiguration[OpenIDConnect::KEY] ?? '';
+        $key = $this->keyRepository->getKey($keyId);
+        if (NULL === $key) {
+          throw new \RuntimeException(sprintf('Cannot get key %s', $keyId));
+        }
+        [
+          OidcKeyType::DISCOVERY_URL => $discoveryUrl,
+          OidcKeyType::CLIENT_ID => $clientId,
+          OidcKeyType::CLIENT_SECRET => $clientSecret,
+        ] = $this->keyHelper->getOidcValues($key);
+      }
+      catch (\Exception $e) {
+        throw new AuthenticationException('Cannot get client id and secret', $e->getCode(), $e);
+      }
+    }
+
     $providerOptions = [
       'redirectUri' => $this->getRedirectUri(),
-      'openIDConnectMetadataUrl' => $pluginConfiguration['nemlogin_openid_connect_discovery_url'],
+      'openIDConnectMetadataUrl' => $discoveryUrl,
       'cacheItemPool' => $this->cacheItemPool,
-      'clientId' => $pluginConfiguration['nemlogin_openid_connect_client_id'],
-      'clientSecret' => $pluginConfiguration['nemlogin_openid_connect_client_secret'],
+      'clientId' => $clientId,
+      'clientSecret' => $clientSecret,
       'localTestMode' => FALSE,
       'allowHttp' => (bool) ($this->getSettings()['allow_http'] ?? FALSE),
     ];
@@ -273,7 +303,7 @@ public function endSession(string $id): Response {
   private function getPostLogoutRedirectUri(): string {
     try {
       $pluginConfiguration = $this->plugin->getConfiguration();
-      $url = $pluginConfiguration['nemlogin_openid_connect_post_logout_redirect_uri'] ?? '/';
+      $url = $pluginConfiguration[OpenIDConnect::POST_LOGOUT_REDIRECT_URI] ?? '/';
       $options = [
         'absolute' => TRUE,
         'path_processing' => FALSE,