first work

src/DelegateAuthServiceProvider.php

@@ -19,6 +19,8 @@ class DelegateAuthServiceProvider extends ServiceProvider
             __DIR__.'/../config/delegate-auth.php' => config_path('delegate-auth.php'),
         ], 'delegate-auth-config');
 
+        $this->loadRoutesFrom(__DIR__.'/../routes/web.php');
+
         if ($this->app->runningInConsole()) {
             $this->commands([
                 Console\InstallCommand::class,

src/Http/Controllers/DelegateAuthController.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace Rodev\DelegateAuth\Http\Controllers;
+
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Auth;
+
+class DelegateAuthController extends Controller
+{
+    public function login(Request $request)
+    {
+        $request->validate(['token' => 'required|string']);
+
+        $payload = $this->decryptToken($request->input('token'));
+
+        abort_if(! $payload, 401, 'Token invalide.');
+
+        $field = config('delegate-auth.user_field');
+
+        abort_if(empty($payload[$field]), 401, 'Token invalide : champ '.$field.' manquant.');
+
+        $guard = Auth::guard(config('delegate-auth.guard'));
+        $user  = $guard->getProvider()->retrieveByCredentials([$field => $payload[$field]]);
+
+        abort_if(! $user, 401, 'Utilisateur introuvable.');
+
+        $guard->login($user);
+
+        return redirect(config('delegate-auth.redirect_after_login'));
+    }
+
+    public function logout(Request $request)
+    {
+        $guard = Auth::guard(config('delegate-auth.guard'));
+        $guard->logout();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect(config('delegate-auth.redirect_after_logout'));
+    }
+
+    private function decryptToken(string $token): ?array
+    {
+        if (!str_contains($token, '.')) {
+            return null;
+        }
+
+        [$ivB64, $encrypted] = explode('.', $token, 2);
+
+        $iv  = base64_decode($ivB64, strict: true);
+        $key = substr(hash('sha256', config('delegate-auth.encrypt_key'), binary: true), 0, 32);
+
+        if ($iv === false || strlen($iv) !== 16) {
+            return null;
+        }
+
+        $payload = openssl_decrypt($encrypted, 'AES-256-CBC', $key, 0, $iv);
+
+        if ($payload === false) {
+            return null;
+        }
+
+        $data = json_decode($payload, associative: true);
+
+        return is_array($data) ? $data : null;
+    }
+}