How to set up NetSuite Token-based Authentication (TBA) in Laravel

Route::get('/netsuite/callback', [NetSuiteController::class, 'handleCallback'])->name('netsuite.callback');

public function getRequestToken($formData)
{
    // Get details from the form
    $callback = route('netsuite.callback'); // Define the callback URL
    $accountId = $formData['account_id']; // NetSuite account ID
    $consumerId = $formData['consumer_id']; // Consumer ID from NetSuite
    $consumerSecret = $formData['consumer_secret']; // Consumer secret from NetSuite

    // Structure the parameters that will be passed to the request
    $params = [
        'oauth_callback' => $callback, // Callback URL
        'oauth_consumer_key' => $consumerId, // Consumer key (ID)
        'oauth_nonce' => Str::random(32), // Unique nonce for this request
        'oauth_signature_method' => 'HMAC-SHA256', // Signature method
        'oauth_timestamp' => time(), // Current timestamp
        'oauth_version' => '1.0', // OAuth version
    ];

    // Sort parameters by key
    ksort($params);

    // Encode each key-value pair and join them with '&'
    $paramString = [];
    foreach ($params as $key => $value) {
        $paramString[] = $key . '=' . rawurlencode($value);
    }

    // Create the base string by combining HTTP method, URL, and parameters
    $baseString = strtoupper('POST') . '&' . rawurlencode("https://{$accountId}.restlets.api.netsuite.com/rest/requesttoken") . '&' . rawurlencode(implode('&', $paramString));

    // Create the composite key for HMAC-SHA256 hashing
    $compositeKey = $consumerSecret . '&';

    // Generate the OAuth signature and add it to the parameters
    $params['oauth_signature'] = base64_encode(hash_hmac('sha256', $baseString, $compositeKey, true));

    // Build the Authorization header for the OAuth request
    $header = [];

    // Sort parameters by key
    ksort($params);

    // Encode each key-value pair and format them for the header
    foreach ($params as $key => $value) {
        $header[] = $key . '="' . rawurlencode($value) . '"';
    }

    // Combine all parts of the header
    $authorizationHeader = 'OAuth ' . implode(', ', $header);

    try {
        // Send the request to NetSuite to get the request token
        $response = Http::withHeaders(['Authorization' => $authorizationHeader])
            ->post("https://{$accountId}.restlets.api.netsuite.com/rest/requesttoken");

        // Handle failed response
        if ($response->failed()) {
            $responseBody = $response->body();
            $decodedResponse = json_decode($responseBody, true) ?? [];

            return [ 'error' => $decodedResponse['error']['message'] ];
        }

        // Get the response
        $responseBody = $response->body();

        // Parse the response into an array
        parse_str($responseBody, $parsedResponse);

        // Extract necessary data from the response and form
        $oauthToken = $parsedResponse['oauth_token'];
        $oauthTokenSecret = $parsedResponse['oauth_token_secret'];

        // We are storing the data in session because we will need it to handle the callback when the user is redirect back. We will clear the session data when handling the callback from NetSuite
        session([
           'oauth_token' => $oauthToken,
           'oauth_token_secret' => $oauthTokenSecret,
           'account_id' => $accountId,
           'consumer_id' => $consumerId,
           'consumer_secret' => $consumerSecret,
         ]);

        // Redirect the user to NetSuite for authorization
        return redirect("https://{$accountId}.app.netsuite.com/app/login/secure/authorizetoken.nl?oauth_token={$oauthToken}");
    } catch (\Exception $e) {
        // Handle exceptions and return an error message
        return ['error' => $e->getMessage()];
    }
}

    public function handleCallback(Request $request)
    {
        // Retrieve the tokens we saved in the session in the first step
        $sessionOauthToken = session('oauth_token');
        $sessionOauthTokenSecret = session('oauth_token_secret');
        $sessionAccountId = session('account_id');
        $sessionConsumerId = session('consumer_id');
        $sessionConsumerSecret = session('consumer_secret');

        // Retrieve the query params from the callback request which includes the account Id as company, oauth_verifier and new oauth_token that should match the oauth_token we saved in session for the firs step.
        $token = $request->query('oauth_token');
        $oauthVerifier = $request->query('oauth_verifier');
        $accountId = $request->query('company');

        // The oauth token from step one should match the oauth token from step two same as the accountId we sent from the form should match the company query param returned
        if ($sessionOauthToken != $token || $sessionAccountId !== $accountId) {
            return 'Invalid Request';
        }

        $params = [
            'oauth_token' => $token,
            'oauth_verifier' => $oauthVerifier,
            'oauth_consumer_key' => $sessionConsumerId,
            'oauth_nonce' => Str::random(32),
            'oauth_signature_method' => 'HMAC-SHA256',
            'oauth_timestamp' => time(),
            'oauth_version' => '1.0',
        ];

        // Sort parameters by key
        ksort($params);

        // Encode each key-value pair and join them with '&'
        $paramString = [];
        foreach ($params as $key => $value) {
            $paramString[] = $key.'='.rawurlencode($value);
        }

        // Create the base string by combining HTTP method, URL, and parameters
        $baseString = strtoupper('POST').'&'.rawurlencode("https://{$accountId}.restlets.api.netsuite.com/rest/accesstoken").'&'.rawurlencode(implode('&', $paramString));

        // Create the composite key for HMAC-SHA256 hashing
        $compositeKey = $sessionConsumerSecret.'&'.$sessionOauthTokenSecret;

        $signedBasedString = hash_hmac('sha256', $baseString, $compositeKey, true);

        $signature = base64_encode($signedBasedString);

        // Generate the OAuth signature and add it to the parameters
        $params['oauth_signature'] = $signature;

        // We need the realm to build the header but we do not need it to create the base string
        $params['realm'] = $accountId;

        // Build the Authorization header for the OAuth request
        $header = [];

        // Sort parameters by key
        ksort($params);

        // Encode each key-value pair and format them for the header
        foreach ($params as $key => $value) {
            $header[] = $key.'="'.rawurlencode($value).'"';
        }

        // Combine all parts of the header
        $authorizationHeader = 'OAuth '.implode(', ', $header);

        try {
            // Send the request to NetSuite to get the access tokens
            $response = Http::withHeaders(['Authorization' => $authorizationHeader])
                ->post("https://{$accountId}.restlets.api.netsuite.com/rest/accesstoken");

            // Handle failed response
            if ($response->failed()) {
                $responseBody = $response->body();
                $decodedResponse = json_decode($responseBody, true) ?? [];

                return ['error' => $decodedResponse['error']['message']];
            }

            // Get the response
            $responseBody = $response->body();

            // Parse the response into an array
            parse_str($responseBody, $parsedResponse);

            // Extract the access tokens the response, at this point we have handled the callback and retrieved the access tokens. From here you should save the access tokens somewhere safe and retreievable you will be using these tokens to be subsequent requests to pull in data from NetSuite to your application.
            $oauthToken = $parsedResponse['oauth_token'];
            $oauthTokenSecret = $parsedResponse['oauth_token_secret'];

            // Dump the response to see the data returned
            dd($parsedResponse);

            // Since we have successfully retrieved the tokens, we can now remove this values from the session as it is no longer needed.
            session()->forget([
                'oauth_token',
                'oauth_token_secret',
                'account_id',
                'consumer_id',
                'consumer_secret',
            ]);

            // Redirect the user to the appropriate page.
            return redirect('redirect user to appropriate page after successful login and access token retrieval')
        } catch (\Exception $e) {
            // Handle exceptions and return an error message
            return ['error' => $e->getMessage()];
        }
    }