assign('iframeSrc', $src); // Expose just the app origin so the parent-side postMessage // listener can validate event.origin. $this->assign('appOrigin', parse_url($appUrl, PHP_URL_SCHEME) . '://' . parse_url($appUrl, PHP_URL_HOST)); } $this->assign('configured', $configured); parent::run(); } /** * base64url(HMAC-SHA256(key, "webform-mw.staff-report.v1::")). * Must stay byte-for-byte compatible with signStaffToken() in the app. */ private static function sign(string $key, int $org, int $exp): string { $mac = hash_hmac('sha256', "webform-mw.staff-report.v1:{$org}:{$exp}", $key, TRUE); return rtrim(strtr(base64_encode($mac), '+/', '-_'), '='); } }