Identity verification

// SERVER - runs on your backend, so the secret never reaches the browser.
const jwt = require('jsonwebtoken');
const crypto = require('crypto');

function konradoIdentityToken(user) {
  const now = Math.floor(Date.now() / 1000);

  return jwt.sign(
    {
      sub: String(user.id),           // your id for this customer
      email: user.email ?? undefined, // optional, shown to the agent
      name: user.name ?? undefined,   // optional, shown to the agent
      // platform: 'supportpal',      // optional: the connected system this id is from
      iat: now,                       // required
      exp: now + 300,                 // 5 minutes - the chat redeems it on page load
      jti: crypto.randomUUID(),
    },
    process.env.AI_AGENT_IDENTITY_SECRET,
    { algorithm: 'HS256' },
  );
}

app.get('/*', (req, res) => {
  // Sign on every page render - the token is short-lived by design.
  res.render('page', { token: req.user ? konradoIdentityToken(req.user) : '' });
});

// TEMPLATE - signed-out visitors render the same tag with an empty token attribute,
// which the loader treats as anonymous.
<script async src="https://app.konrado.ai/website-chat/v1/loader.js"
        data-konrado-chat-id="wgt_9808d383733f4e62925c14e2e876eb3a"
        data-konrado-user-token="{{ token }}"></script>

<?php
/**
 * Konrado.ai chat - paste this block into your page template,
 * just before the closing </body> tag.
 */

// Your Konrado Chat signing key goes here - the dashboard's Copy button fills it in.
// Leave it empty to embed the chat anonymously.
if (!defined('KONRADO_IDENTITY_SECRET')) {
    define('KONRADO_IDENTITY_SECRET', '');
}

// Your signed-in user - swap this for however your app exposes the current user.
// Leave it null for visitors who aren't logged in: they get the same chat, anonymously.
$konradoUser = $_SESSION['user'] ?? null;

$konradoToken = '';

if (KONRADO_IDENTITY_SECRET !== '' && !empty($konradoUser['id'])) {
    $konradoNow = time();
    $konradoClaims = array_filter([
        'sub'   => (string) $konradoUser['id'],   // your id for this customer
        'email' => $konradoUser['email'] ?? null, // optional, shown to the agent
        'name'  => $konradoUser['name'] ?? null,  // optional, shown to the agent
        // 'platform' => 'supportpal',            // optional: the connected system this id is from
        'iat'   => $konradoNow,                   // required
        'exp'   => $konradoNow + 300,             // 5 min - redeemed on page load
        'jti'   => bin2hex(random_bytes(16)),     // random per render - single-use
    ], static function ($value) {
        return $value !== null;
    });

    // Minimal HS256 JWT signer - no Composer dependency needed. A closure rather than a
    // named function so pasting this block into more than one template can't fatal on a
    // duplicate declaration.
    $konradoEncode = static function ($part) {
        return rtrim(strtr(base64_encode(json_encode($part)), '+/', '-_'), '=');
    };
    $konradoPayload = $konradoEncode(['alg' => 'HS256', 'typ' => 'JWT'])
        . '.' . $konradoEncode($konradoClaims);
    $konradoToken = $konradoPayload . '.' . rtrim(strtr(base64_encode(
        hash_hmac('sha256', $konradoPayload, KONRADO_IDENTITY_SECRET, true)
    ), '+/', '-_'), '=');
}
?>
<script async src="https://app.konrado.ai/website-chat/v1/loader.js"
        data-konrado-chat-id="wgt_9808d383733f4e62925c14e2e876eb3a"
        data-konrado-user-token="<?= htmlspecialchars($konradoToken, ENT_QUOTES) ?>"></script>

<?php
/**
 * Konrado.ai chat for the WHMCS client area.
 * Upload this file to /includes/hooks/ - WHMCS picks it up automatically.
 */

if (!defined('WHMCS')) {
    die('This file cannot be accessed directly');
}

// Your Konrado Chat signing key goes here - the dashboard's Copy button fills it in.
// Leave it empty to embed the chat anonymously.
define('KONRADO_IDENTITY_SECRET', '');

add_hook('ClientAreaFooterOutput', 1, function (array $vars) {
    $client = $vars['clientsdetails'] ?? [];

    // Signed-out visitors - and installs with no key yet - get the plain tag. Same
    // install, no second snippet.
    if (KONRADO_IDENTITY_SECRET === '' || empty($client['id'])) {
        return '<script async src="https://app.konrado.ai/website-chat/v1/loader.js"
        data-konrado-chat-id="wgt_9808d383733f4e62925c14e2e876eb3a"></script>';
    }

    $now = time();
    $name = trim(($client['firstname'] ?? '') . ' ' . ($client['lastname'] ?? ''));
    $token = konrado_identity_token([
        'sub'   => (string) $client['id'],   // your id for this customer
        'email' => $client['email'] ?? null, // optional, shown to the agent
        'name'  => $name !== '' ? $name : null, // optional, shown to the agent
        'platform' => 'whmcs',               // the system this id belongs to
        'iat'   => $now,                     // required
        'exp'   => $now + 300,               // 5 min - redeemed on page load
        'jti'   => bin2hex(random_bytes(16)),
    ]);

    return str_replace('{{ token }}', htmlspecialchars($token, ENT_QUOTES), '<script async src="https://app.konrado.ai/website-chat/v1/loader.js"
        data-konrado-chat-id="wgt_9808d383733f4e62925c14e2e876eb3a"
        data-konrado-user-token="{{ token }}"></script>');
});

if (!function_exists('konrado_identity_token')) {
    /** Minimal HS256 JWT signer - no Composer dependency needed. */
    function konrado_identity_token(array $claims): string
    {
        $encode = static function ($part) {
            return rtrim(strtr(base64_encode(json_encode($part)), '+/', '-_'), '=');
        };

        $payload = $encode(['alg' => 'HS256', 'typ' => 'JWT'])
            . '.' . $encode(array_filter($claims, static function ($value) {
                return $value !== null;
            }));
        $signature = hash_hmac('sha256', $payload, KONRADO_IDENTITY_SECRET, true);

        return $payload . '.' . rtrim(strtr(base64_encode($signature), '+/', '-_'), '=');
    }
}