PHPの既存会員サイトに「Googleでログイン・新規会員登録」を追加する

<!-- Google Identity Services -->
<script src="https://accounts.google.com/gsi/client" async defer></script>

<p>Googleアカウントでログイン・新規会員登録</p>

<div id="g_id_onload"
     data-client_id="YOUR_WEB_CLIENT_ID.apps.googleusercontent.com"
     data-login_uri="https://www.example.com/google_login.php"
     data-auto_prompt="false">
</div>

<div class="g_id_signin"
     data-type="standard"
     data-shape="rectangular"
     data-theme="outline"
     data-text="continue_with"
     data-size="large"
     data-logo_alignment="left"
     data-width="360">
</div>

-- Existing users table is assumed to be:
--   users(id BIGINT PRIMARY KEY, email TEXT, display_name TEXT, ...)
-- Adapt the foreign key/table names to your application.

CREATE TABLE IF NOT EXISTS user_identity (
    provider      VARCHAR(32) NOT NULL,
    subject       VARCHAR(255) NOT NULL,
    user_id       BIGINT NOT NULL,
    email         VARCHAR(512),
    created_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    updated_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    PRIMARY KEY (provider, subject),
    UNIQUE (provider, user_id)
);

CREATE TABLE IF NOT EXISTS external_login_ticket (
    ticket_hash   CHAR(64) PRIMARY KEY,
    provider      VARCHAR(32) NOT NULL,
    subject       VARCHAR(255) NOT NULL,
    user_id       BIGINT NOT NULL,
    expires_at    TIMESTAMP NOT NULL,
    created_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
);

CREATE INDEX external_login_ticket_expires_i01
    ON external_login_ticket(expires_at);

<?php
declare(strict_types=1);

// Public sample for Google Identity Services.
// Environment variables used here:
//   GOOGLE_CLIENT_ID
//   DB_DSN       e.g. pgsql:host=localhost;dbname=example
//   DB_USER
//   DB_PASSWORD
//
// Existing application table assumed by this sample:
//   users(id, email, display_name)
//
// Adjust table/column names and the final redirect to your application.

require_once __DIR__ . '/vendor/autoload.php';

const TICKET_TTL_SECONDS = 120;

function failLogin(string $message): never
{
    http_response_code(400);
    header('Content-Type: text/plain; charset=UTF-8');
    echo $message;
    exit;
}

function googleIsAuthoritativeForEmail(array $payload): bool
{
    $email = strtolower((string)($payload['email'] ?? ''));

    if ($email !== '' && str_ends_with($email, '@gmail.com')) {
        return true;
    }

    return !empty($payload['email_verified']) && !empty($payload['hd']);
}

header('Cache-Control: no-store');
header('Pragma: no-cache');

if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
    failLogin('POST only');
}

// Google Identity Services sends the same CSRF token in a cookie and POST body.
$csrfCookie = $_COOKIE['g_csrf_token'] ?? '';
$csrfPost = $_POST['g_csrf_token'] ?? '';

if (!is_string($csrfCookie) || !is_string($csrfPost) ||
    $csrfCookie === '' || $csrfPost === '' ||
    !hash_equals($csrfCookie, $csrfPost)) {
    failLogin('CSRF check failed');
}

$credential = $_POST['credential'] ?? '';
if (!is_string($credential) || $credential === '' || strlen($credential) > 16384) {
    failLogin('credential is missing');
}

$clientId = getenv('GOOGLE_CLIENT_ID') ?: '';
$dsn = getenv('DB_DSN') ?: '';
$dbUser = getenv('DB_USER') ?: '';
$dbPassword = getenv('DB_PASSWORD') ?: '';

if ($clientId === '' || $dsn === '' || $dbUser === '') {
    throw new RuntimeException('Server configuration is incomplete');
}

// google/apiclient verifies the ID token signature and audience.
$client = new Google\Client(['client_id' => $clientId]);
$payload = $client->verifyIdToken($credential);

if (!is_array($payload)) {
    failLogin('Invalid Google ID token');
}

// Use sub as the permanent Google account identifier. Do not use email as ID.
$subject = (string)($payload['sub'] ?? '');
$email = strtolower((string)($payload['email'] ?? ''));
$emailVerified = !empty($payload['email_verified']);

if ($subject === '' || $email === '' || !$emailVerified) {
    failLogin('Required claims are missing');
}

$pdo = new PDO($dsn, $dbUser, $dbPassword, [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES => false,
]);

$pdo->beginTransaction();

try {
    // 1. Already linked? Login immediately.
    $st = $pdo->prepare(
        "SELECT user_id FROM user_identity " .
        "WHERE provider='google' AND subject=:subject"
    );
    $st->execute([':subject' => $subject]);
    $identity = $st->fetch();

    $userId = $identity ? (int)$identity['user_id'] : 0;

    if ($userId <= 0) {
        // 2. Look for an existing local account with the same email.
        $st = $pdo->prepare(
            'SELECT id FROM users WHERE lower(email)=lower(:email) ORDER BY id LIMIT 2'
        );
        $st->execute([':email' => $email]);
        $users = $st->fetchAll();

        if (count($users) > 1) {
            throw new RuntimeException('Multiple local accounts use the same email');
        }

        if (count($users) === 1) {
            // For Gmail / Google Workspace, Google can be authoritative for the
            // email address. For other email providers, do not silently link an
            // existing account: ask the user to prove ownership using your
            // existing password/OTP flow instead.
            if (!googleIsAuthoritativeForEmail($payload)) {
                throw new RuntimeException('Existing account requires additional verification');
            }

            $userId = (int)$users[0]['id'];
        } else {
            // 3. No local account: create one.
            // PostgreSQL example. For MySQL, replace RETURNING with lastInsertId().
            $displayName = trim((string)($payload['name'] ?? ''));
            if ($displayName === '') {
                $displayName = strstr($email, '@', true) ?: 'member';
            }

            $st = $pdo->prepare(
                'INSERT INTO users(email, display_name) ' .
                'VALUES(:email, :display_name) RETURNING id'
            );
            $st->execute([
                ':email' => $email,
                ':display_name' => $displayName,
            ]);
            $userId = (int)$st->fetchColumn();
        }

        // 4. Save Google sub <-> local user relation.
        $st = $pdo->prepare(
            "INSERT INTO user_identity(provider, subject, user_id, email) " .
            "VALUES('google', :subject, :user_id, :email)"
        );
        $st->execute([
            ':subject' => $subject,
            ':user_id' => $userId,
            ':email' => $email,
        ]);
    } else {
        $st = $pdo->prepare(
            "UPDATE user_identity SET email=:email, updated_at=CURRENT_TIMESTAMP " .
            "WHERE provider='google' AND subject=:subject"
        );
        $st->execute([':email' => $email, ':subject' => $subject]);
    }

    // 5. Bridge to the application's existing session/login code with a
    // short-lived, one-time ticket. Store only its SHA-256 hash in the DB.
    $ticket = bin2hex(random_bytes(32));
    $ticketHash = hash('sha256', $ticket);

    $st = $pdo->prepare(
        "INSERT INTO external_login_ticket" .
        "(ticket_hash, provider, subject, user_id, expires_at) " .
        "VALUES(:hash, 'google', :subject, :user_id, " .
        "CURRENT_TIMESTAMP + INTERVAL '120 seconds')"
    );
    $st->execute([
        ':hash' => $ticketHash,
        ':subject' => $subject,
        ':user_id' => $userId,
    ]);

    $pdo->commit();

    // This endpoint should atomically consume the ticket, create the normal
    // application session, then delete/invalidate the ticket.
    header('Location: /finish_external_login.php?ticket=' . rawurlencode($ticket), true, 303);
    exit;
} catch (Throwable $e) {
    if ($pdo->inTransaction()) {
        $pdo->rollBack();
    }
    error_log('google_login.php: ' . $e->getMessage());
    failLogin('Google login failed');
}