Autentificare OAuth si obtinere token JWT de la ANAF folosind PHP

Class Anaf{
	
	public $code; //codul furnizat de ANAF pentru obtinerea tokenului
	public $token; //tokenul obtinut
	public $authorization_link;
	private $anaf_resp; //raspunsul primit de la ANAF
	private $token_info; //retine detaliile tokenului furnizate de ANAF
	private $debug_info; //retine detaliile complete ale comunicatiei cu serverul ANAF
	
	public $authorize_url = "https://logincert.anaf.ro/anaf-oauth2/v1/authorize";
	public $token_url = "https://logincert.anaf.ro/anaf-oauth2/v1/token";
	public $revoke_url = "https://logincert.anaf.ro/anaf-oauth2/v1/revoke";

	public $client_id = "CLIENT_ID"; //Client ID furnizat de ANAF la inregistrarea aplicatiei
	public $client_secret = "CLIENT_SECRET"; //Client Secret furnizat de ANAF la inregistrarea aplicatiei
	public $redirect_uri = "CALLBACK_URL"; //Callback URL completat la inregistrarea aplicatiei
}

public function get_authorization_link(){
	$this->authorization_link = $this->authorize_url . "?response_type=code&token_content_type=jwt&client_id=" . $this->client_id . "&redirect_uri=" . $this->redirect_uri;
}

public function get_token(){
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $this->token_url);
	curl_setopt($ch, CURLOPT_POST, true);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
	curl_setopt($ch, CURLOPT_TIMEOUT, 30);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
	curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
	curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
	curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
		'code' => $this->code,
		'grant_type' => 'authorization_code',
		'redirect_uri' => $this->redirect_uri,
		'token_content_type' => 'jwt'
	)));
	curl_setopt($ch, CURLOPT_HTTPHEADER, array(
			'Cache-control: no-cache',
			"Content-type: application/x-www-form-urlencoded",
			"Accept: */*",
			"Accept-encoding: gzip, deflate, br",
			"Connection:keep-alive",
			'Authorization: Basic ' . base64_encode($this->client_id.":".$this->client_secret)
		)
	);
	
	//verbose - init
	curl_setopt($ch, CURLOPT_VERBOSE, true);
	$verbose = fopen('php://temp', 'w+');
	curl_setopt($ch, CURLOPT_STDERR, $verbose);
	
	//executa interogarea
	$this->anaf_resp = curl_exec($ch);
	
	//verbose - read
	rewind($verbose);
	$verboseLog = stream_get_contents($verbose);
	$this->debug_info = $verboseLog;
	
	//interpretarea raspunsului returnat
	if ($this->anaf_resp === FALSE){
		printf("Eroare la interogarea ANAF (#%d): %s<br>\n", curl_errno($ch), htmlspecialchars(curl_error($ch)));
		return false;
	}
	else{
		$this->token_info = json_decode($this->anaf_resp, true);
		if (isset($this->token_info['error'])){
			//eroare
			echo "Eroare la obtinerea tokenului.";
			return false;
		}
		else{
			//succes
			$this->save_token();
			return true;
		}
	}
}

public function save_token(){
	global $db;
	$r = $db->query("INSERT INTO `anaf_tokens`
					SET `access_token` = '" . $this->token_info['access_token'] . "',
						`expires_in` = '" . $this->token_info['expires_in'] . "',
						`token_type` = '" . $this->token_info['token_type'] . "',
						`scope` = '" . $this->token_info['scope'] . "',
						`refresh_token` = '" . $this->token_info['refresh_token'] . "',
						`anaf_raw` = '" . $db->real_escape($this->anaf_resp) . "',
						`debug_info` = '" . $db->real_escape($this->debug_info) . "',
						`flag_status` = 'new',
						`issued_date` = NOW();");
}

public function refresh_token($access_token){
	global $db;
	
	//selectam detaliile tokenului actual din baza de date
	$r = $db->query("SELECT * FROM anaf_tokens WHERE access_token = '$access_token' ORDER BY issued_date DESC LIMIT 0, 1;");
	$this->token_info = $r[0];
	
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $this->token_url);
	curl_setopt($ch, CURLOPT_POST, true);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
	curl_setopt($ch, CURLOPT_TIMEOUT, 30);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
	curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
	curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
	curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
		'client_id' => $this->client_id,
		'client_secret' => $this->client_secret,
		'refresh_token' => $this->token_info['refresh_token'],
		'grant_type' => 'refresh_token'
	)));
	curl_setopt($ch, CURLOPT_HTTPHEADER, array(
			'Authorization: Bearer ' . $this->token_info['access_token'],
			"Content-type: application/x-www-form-urlencoded",
		)
	);
	
	//verbose - init
	curl_setopt($ch, CURLOPT_VERBOSE, true);
	$verbose = fopen('php://temp', 'w+');
	curl_setopt($ch, CURLOPT_STDERR, $verbose);
	
	//do curl
	$this->anaf_resp = curl_exec($ch);
	
	//verbose - read
	rewind($verbose);
	$verboseLog = stream_get_contents($verbose);
	$this->debug_info = $verboseLog;
	
	if ($this->anaf_resp === FALSE){
		printf("Eroare la interogarea ANAF (#%d): %s<br>\n", curl_errno($ch), htmlspecialchars(curl_error($ch)));
		return false;
	}
	else{
		$this->token_info = json_decode($this->anaf_resp, true);
		if (isset($this->token_info['error'])){
			echo "Eroare la refresh-ul tokenului.";
			return false;
		}
		else{
			$this->update_token();
			return true;
		}
	}
}

public function update_token(){
	global $db, $user;
	//se va insera o noua inregistrare cu data curenta
	$r = $db->query("INSERT INTO `anaf_tokens`
					SET `access_token` = '" . $this->token_info['access_token'] . "',
						`expires_in` = '" . $this->token_info['expires_in'] . "',
						`token_type` = '" . $this->token_info['token_type'] . "',
						`scope` = '" . $this->token_info['scope'] . "',
						`refresh_token` = '" . $this->token_info['refresh_token'] . "',
						`debug_info` = '" . $db->real_escape($this->debug_info) . "',
						`flag_status` = 'refresh',
						`issued_date` = NOW();");
}

public function __construct(){
	$this->client_id		= ANAF_CLIENTID;
	$this->client_secret	= ANAF_SECRET;
	$this->redirect_uri		= ANAF_REDIRECT_URL;
	
	$this->get_authorization_link();
}

public function get_last_valid_token(){
	global $db;
	$r = $db->query("SELECT *, DATE_ADD(issued_date, INTERVAL expires_in SECOND) AS expiration_date
					FROM anaf_tokens
					WHERE DATE_ADD(issued_date, INTERVAL expires_in SECOND) > NOW()
					ORDER BY issued_date DESC
					LIMIT 0, 1;");
	if ($db->num_rows){
		$this->token_info = $r[0];
		return true;
	}
	return false;
}

public function set_code($code){
	$this->code = $code;
}

//initializare
$anaf = new ANAF();

if ($_GET['action'] == 'new'){
	
	//redirectionare spre autorizare ANAF si obtinere code
	header("Location: {$anaf->authorization_link}");
	exit();
	
}
elseif ($_GET['code'] != ''){
	
	//obtinere token
	$anaf->set_code($_GET['code']);
	if ($anaf->get_token()){
		header("Location: ./anaf-token.php");
		exit();
	}
	
}
elseif ($_GET['action'] == 'refresh'){
	
	//verific daca exista token valabil
	if ($anaf->get_last_valid_token()){
		//efectuez refresh la tokenul existent
		if ($anaf->refresh_token($anaf->token_info['access_token'])){
			header("Location: ./anaf-token.php");
			exit();
		}
	}
	
}
elseif ($_GET['error'] != ''){
	
	//eroare
	$anaf->token_info['error'] = $_GET['error'];
	
}
else{
	
	//afisarea informatiilor legate de tokenului curent
	
}