'Google', self::Microsoft => 'Microsoft', self::Facebook => 'Facebook', self::LinkedIn => 'LinkedIn', self::Github => 'GitHub', self::Oidc => 'OpenID Connect', }; } /** * Whether this case is served by our own discovery-driven OIDC * provider rather than one of Socialite's. * * Microsoft Entra is an OpenID Connect server like any other, so it * gets the same implementation with its issuer built from the tenant. * That avoids a socialiteproviders/* dependency for a protocol we * already speak, and it is what lets `tid` be read at all. */ public function speaksOidc(): bool { return $this === self::Microsoft || $this === self::Oidc; } /** * @return class-string */ public function driver(): string { return match ($this) { self::Google => GoogleProvider::class, self::Facebook => FacebookProvider::class, self::LinkedIn => LinkedInOpenIdProvider::class, self::Github => GithubProvider::class, self::Microsoft, self::Oidc => OidcProvider::class, }; } /** Generic OIDC is configured entirely by its discovery document. */ public function needsIssuerUrl(): bool { return $this === self::Oidc; } /** * Microsoft, and only Microsoft, requires a tenant — see * SocialIdentity for why that is a security control rather than a * convenience. */ public function needsTenantId(): bool { return $this === self::Microsoft; } /** * Whether this provider can ever tell us an address was verified. * * False here does not disable the provider; it means the address can * never be used to reach an *existing* account while * `require_verified_email` is on. The settings screen says so on the * card, because an administrator who does not know this will read the * checkbox as doing nothing. */ public function canReportVerifiedEmail(): bool { return $this !== self::Facebook; } /** The URI to register with the provider. Shown on the settings card. */ public function redirectUri(): string { return route('social.callback', ['provider' => $this->value]); } }