trypost/app/Http/Controllers/Auth/LinkedInController.php

<?php

declare(strict_types=1);

namespace App\Http\Controllers\Auth;

use App\Enums\SocialAccount\Platform as SocialPlatform;
use App\Enums\SocialAccount\Status;
use App\Models\Workspace;
use App\Services\Social\LinkedInTokenSynchronizer;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Log;
use Illuminate\View\View;
use Laravel\Socialite\Facades\Socialite;
use Symfony\Component\HttpFoundation\Response;

class LinkedInController extends SocialController
{
    protected string $driver = 'linkedin';

    protected SocialPlatform $platform = SocialPlatform::LinkedIn;

    public function connect(Request $request): Response|RedirectResponse
    {
        $this->ensurePlatformEnabled();

        $workspace = $request->user()->currentWorkspace;

        if (! $workspace) {
            return redirect()->route('app.workspaces.create');
        }

        $this->authorize('manageAccounts', $workspace);

        return $this->redirectToProvider($request, $this->driver, $this->resolveScopes());
    }

    /**
     * Merge the default LinkedIn scopes with any extra scopes the operator
     * configured via `LINKEDIN_EXTRA_SCOPES` — comma-separated, e.g.
     * `r_basicprofile`. Useful when the connected LinkedIn dev app has legacy
     * or enterprise products not covered by the default Sign-In +
     * Share-on-LinkedIn pair. Both live under
     * `config/trypost.php` → `platforms.linkedin`.
     *
     * @return array<int, string>
     */
    protected function resolveScopes(): array
    {
        /** @var array<int, string> $scopes */
        $scopes = config('trypost.platforms.linkedin.scopes', []);

        $extra = (string) config('trypost.platforms.linkedin.extra_scopes', '');

        if ($extra === '') {
            return $scopes;
        }

        $extraScopes = array_filter(array_map('trim', explode(',', $extra)));

        return array_values(array_unique([...$scopes, ...$extraScopes]));
    }

    public function callback(Request $request): View
    {
        $workspaceId = session('social_connect_workspace');

        if (! $workspaceId) {
            return $this->popupCallback(false, __('accounts.popup_callback.session_expired'), $this->platform->value);
        }

        $workspace = Workspace::find($workspaceId);

        if (! $workspace || ! $request->user()->can('manageAccounts', $workspace)) {
            return $this->popupCallback(false, __('accounts.popup_callback.workspace_not_found'), $this->platform->value);
        }

        try {
            $socialUser = Socialite::driver($this->driver)->user();

            // Fetch vanityName from LinkedIn API (not available via OpenID)
            $username = $this->fetchVanityName($socialUser->token);

            $avatarPath = uploadFromUrl($socialUser->getAvatar());

            $account = $workspace->socialAccounts()->updateOrCreate(
                [
                    'platform' => $this->platform->value,
                    'platform_user_id' => $socialUser->getId(),
                ],
                [
                    'username' => $username,
                    'display_name' => $socialUser->getName(),
                    'avatar_url' => $avatarPath,
                    'access_token' => $socialUser->token,
                    'refresh_token' => $socialUser->refreshToken,
                    'token_expires_at' => $socialUser->expiresIn ? now()->addSeconds($socialUser->expiresIn) : null,
                    // LinkedIn returns scope CSV-joined but Socialite splits on space, so re-split here.
                    'scopes' => explode(',', implode(',', $socialUser->approvedScopes)),
                    'status' => Status::Connected,
                    'error_message' => null,
                    'disconnected_at' => null,
                ],
            );

            // Sync tokens to LinkedIn Page if it exists
            app(LinkedInTokenSynchronizer::class)->syncTokens($account);

            return $this->popupCallback(true, __('accounts.popup_callback.connected'), $this->platform->value);
        } catch (\Exception $e) {
            Log::error('LinkedIn OAuth Error', [
                'error' => $e->getMessage(),
            ]);

            return $this->popupCallback(false, __('accounts.popup_callback.error_connecting'), $this->platform->value);
        }
    }

    private function fetchVanityName(string $accessToken): ?string
    {
        try {
            $response = Http::withToken($accessToken)
                ->withHeaders(['X-RestLi-Protocol-Version' => '2.0.0'])
                ->get(config('trypost.platforms.linkedin.api').'/v2/me', [
                    'projection' => '(id,vanityName,localizedFirstName,localizedLastName)',
                ]);

            if ($response->successful()) {
                return $response->json('vanityName');
            }
        } catch (\Exception $e) {
            Log::warning('Failed to fetch LinkedIn vanityName', [
                'error' => $e->getMessage(),
            ]);
        }

        return null;
    }
}