Integrate Rayor Connect

// 1) Start: redirect to Rayor
header("Location: https://connect.rayor.fr/authorize.php?" . http_build_query([
    "client_id"     => "mon-site.fr",
    "redirect_uri"  => "https://mon-site.fr/callback.php",
    "scope"         => "openid profile email",
    "response_type" => "code",
    "state"         => $_SESSION["rc_state"] = bin2hex(random_bytes(16)),
]));

// 2) callback.php: check the state, then exchange the code (single use)
if (($_GET["state"] ?? "") !== ($_SESSION["rc_state"] ?? "x")) exit("invalid state");
$user = json_decode(file_get_contents(
    "https://connect.rayor.fr/api.php?code=" . urlencode($_GET["code"])
), true);
// $user["rayor_id"], $user["email"], $user["given_name"] ...

import crypto from "node:crypto";
// 1) Start
app.get("/login", (req, res) => {
  req.session.rcState = crypto.randomBytes(16).toString("hex");
  const q = new URLSearchParams({
    client_id: "mon-site.fr",
    redirect_uri: "https://mon-site.fr/callback",
    scope: "openid profile email",
    response_type: "code",
    state: req.session.rcState,
  });
  res.redirect("https://connect.rayor.fr/authorize.php?" + q);
});
// 2) Callback: check the state, then exchange the code
app.get("/callback", async (req, res) => {
  if (req.query.state !== req.session.rcState) return res.status(400).send("invalid state");
  const r = await fetch("https://connect.rayor.fr/api.php?code=" + encodeURIComponent(req.query.code));
  const user = await r.json();
  // user.rayor_id, user.email, user.given_name ...
});

import secrets, requests
from urllib.parse import urlencode
from flask import redirect, request, session

@app.get("/login")
def login():
    session["rc_state"] = secrets.token_hex(16)
    q = urlencode({
        "client_id": "mon-site.fr",
        "redirect_uri": "https://mon-site.fr/callback",
        "scope": "openid profile email",
        "response_type": "code",
        "state": session["rc_state"],
    })
    return redirect("https://connect.rayor.fr/authorize.php?" + q)

@app.get("/callback")
def callback():
    if request.args.get("state") != session.get("rc_state"):
        return "invalid state", 400
    user = requests.get("https://connect.rayor.fr/api.php",
                        params={"code": request.args["code"]}, timeout=10).json()
    return user  # user["rayor_id"], user["email"] ...

# 1) Open in the browser (the user consents):
https://connect.rayor.fr/authorize.php?client_id=mon-site.fr&redirect_uri=https://mon-site.fr/callback&scope=openid%20profile%20email&response_type=code&state=abc123

# 2) Rayor returns ?code=…: exchange it server-side
curl "https://connect.rayor.fr/api.php?code=THE_CODE"
# -> {"rayor_id":"RAY-42-XY","given_name":"Camille","email":"camille@exemple.fr","email_verified":true}