<?php
/*
|--------------------------------------------------------------------------
| Shared SSO secret between Seven Credit System and Service Portal.
| This EXACT value must match service-portal/sso_config.php.
| Keep this file private.
|--------------------------------------------------------------------------
*/
define('SSO_SHARED_SECRET', '7868b404bff558b86264d6805c5b4df943c71dff1aadb3ab1434b81f023101b9');

// Base URL of the Service Portal SSO entry point.
define('SSO_SERVICE_PORTAL_ENTRY', 'https://7d-lao.com/service-portal/sso_enter.php');

// Token lifetime in seconds (must be >= the value in the Service Portal).
define('SSO_TOKEN_TTL', 120);

/*
| Build a signed one-time SSO link into the Service Portal.
| $role = 'admin' or 'staff'
| $code = the Seven staff_code (e.g. S009)
*/
function sso_service_portal_link(string $role, string $code): string
{
    $exp = time() + SSO_TOKEN_TTL;
    $sig = hash_hmac('sha256', $role . '|' . $code . '|' . $exp, SSO_SHARED_SECRET);
    return SSO_SERVICE_PORTAL_ENTRY . '?' . http_build_query([
        'role' => $role,
        'code' => $code,
        'exp'  => $exp,
        'sig'  => $sig,
    ]);
}
