asdsad

src/App/KeycloakAuth.php

@@ -181,6 +181,7 @@ final class KeycloakAuth
                 'username' => (string) ($userInfo['preferred_username'] ?? ''),
                 'name' => (string) ($userInfo['name'] ?? ''),
                 'email' => (string) ($userInfo['email'] ?? ''),
+                'groups' => $this->extractGroups($tokenPayload, $userInfo),
             ],
         ];
     }
@@ -312,6 +313,65 @@ final class KeycloakAuth
         return strtolower($first);
     }
 
+    /**
+     * @param array<string, mixed> $tokenPayload
+     * @param array<string, mixed> $userInfo
+     * @return array<int, string>
+     */
+    private function extractGroups(array $tokenPayload, array $userInfo): array
+    {
+        $groups = [];
+
+        foreach ([$userInfo, $this->decodeJwtClaims((string) ($tokenPayload['access_token'] ?? '')), $this->decodeJwtClaims((string) ($tokenPayload['id_token'] ?? ''))] as $source) {
+            $candidateGroups = $source['groups'] ?? [];
+
+            if (!is_array($candidateGroups)) {
+                continue;
+            }
+
+            foreach ($candidateGroups as $group) {
+                $group = trim((string) $group);
+
+                if ($group === '') {
+                    continue;
+                }
+
+                $group = trim($group, '/');
+                $groups[$group] = $group;
+            }
+        }
+
+        return array_values($groups);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function decodeJwtClaims(string $jwt): array
+    {
+        if ($jwt === '') {
+            return [];
+        }
+
+        $parts = explode('.', $jwt);
+
+        if (count($parts) < 2) {
+            return [];
+        }
+
+        $payload = $parts[1];
+        $payload .= str_repeat('=', (4 - strlen($payload) % 4) % 4);
+        $decoded = base64_decode(strtr($payload, '-_', '+/'), true);
+
+        if ($decoded === false) {
+            return [];
+        }
+
+        $claims = json_decode($decoded, true);
+
+        return is_array($claims) ? $claims : [];
+    }
+
     /**
      * @param array<string, string> $fields
      * @return array{success: bool, data?: array<string, mixed>, error?: string}