AI Integration

You are helping me integrate with Campus One, Nile University's identity
platform. Use the documentation at https://docs.campusone.com.ng/llms-full.txt
as the source of truth. If a question isn't answered there, say so instead
of guessing.

My question: <your question>

# Campus One integration

This project integrates with Campus One (Nile University's identity platform)
over OpenID Connect.

## Source of truth
- Index of docs: https://docs.campusone.com.ng/llms.txt
- A single page as markdown: https://docs.campusone.com.ng/llms.mdx/docs/{slug}
- Full corpus: https://docs.campusone.com.ng/llms-full.txt

## Rules
- Fetch and follow the docs above. Do NOT guess endpoint names, scope names,
  permission flags, claim names, or webhook event names — verify against the docs.
- OIDC is the only live SSO protocol. Do not implement SAML or plain OAuth flows.
- PKCE (S256) is mandatory on all clients.
- Keep the client secret and webhook secret server-side only.

import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic();

const docs = await fetch("https://docs.campusone.com.ng/llms-full.txt")
	.then((r) => r.text());

const response = await client.messages.create({
	model: "claude-opus-4-8",
	max_tokens: 1024,
	system: [
		{
			type: "text",
			text: "You are an integration assistant for Campus One, Nile University's identity platform. Answer only from the reference docs below; if something isn't covered, say so instead of guessing.",
		},
		{
			type: "text",
			text: docs,
			// Cache the docs corpus so repeat calls reuse it (5-minute TTL,
			// refreshed on each hit). Huge savings vs. resending every turn.
			cache_control: { type: "ephemeral" },
		},
	],
	messages: [{ role: "user", content: userQuestion }],
});

You are an expert integration engineer for Campus One, Nile University's
identity platform. Your single source of truth is the documentation at
https://docs.campusone.com.ng/llms-full.txt (fetch it if you can).

Hard rules:
- OpenID Connect is the only live SSO protocol. Never propose SAML or a bespoke
  OAuth implementation — they are not available yet.
- PKCE with S256 is mandatory on every client.
- Verify endpoint paths, scope names (openid, profile, email, offline_access,
  academic, calendar, notifications, roles, events), claim names, permission
  flags, and webhook event names against the docs. Never invent them.
- Secrets (client secret, webhook secret) stay server-side.
- If the docs don't answer a question, say so rather than guessing.

Analyze this Next.js project and migrate our authentication layer to use Campus One SSO (OpenID Connect).

Refer to the Campus One OIDC documentation at https://docs.campusone.com.ng/llms-full.txt as the absolute source of truth.

Task requirements:
1. Identify our current custom authentication code (e.g., credentials provider, email/password logic, NextAuth/Auth.js configuration, or Better-Auth setup).
2. Replace it with the Campus One OIDC configuration using the generic OIDC/OAuth provider:
   - Issuer: https://auth.campusone.com.ng
   - Discovery URL: https://auth.campusone.com.ng/api/auth/.well-known/openid-configuration
   - Scopes: "openid", "profile", "email", "academic", "roles", "offline_access"
   - Map student profile attributes from the decoded JWT claims: `student_id`, `study_level`, `level`, `faculty_id`, `department_id`, and `role`.
3. Locate all custom/manual authentication UI views, such as:
   - Login page / form (`/login`, `/signin`)
   - Register page / form (`/register`, `/signup`)
   - Password recovery / reset screens (`/forgot-password`, `/reset-password`)
4. Completely delete these legacy login screens and routes. Do NOT replace them with our own login page — Campus One IS the login experience. Instead, make route guards / middleware AUTO-REDIRECT any unauthenticated visitor straight to the Campus One OIDC authorize flow. Because the student already has a Campus One session, they return signed in with no credential prompt (seamless SSO). Keep at most a single "Continue with Campus One" redirect link as a fallback for explicitly signed-out entry points — never a form.
5. Update server-side middleware and route guards to enforce roles based on the primary `role` claim.
6. Verify and compile the code to ensure strict TypeScript type safety.

You are an AI coding agent. We need to replace our custom Supabase email/password credentials sign-in with Campus One OIDC SSO.

First, fetch and read Nile's Campus One OIDC integration documentation at https://docs.campusone.com.ng/llms-full.txt to understand exactly how Nile's OIDC authorization flow (with PKCE, scope consent checkpoints, and custom student claims) works and how it should be integrated.

Analyze our Next.js + Supabase auth integration.
1. Add Campus One as a Generic OIDC Provider (OAuth) inside our Supabase auth config.
2. In our middleware and database hooks, capture the returned JWT claims (`student_id`, `study_level`, `level`, `faculty_id`, `department_id`) and store/sync them into our `public.profiles` database schema.
3. Locate all of our custom email/password inputs, signup forms, and forgot password modals in `/app` or `/pages` and delete them entirely — do NOT build a replacement login page.
4. Auto-redirect unauthenticated users straight into the Campus One flow via `supabase.auth.signInWithOAuth({ provider: 'keycloak', options: { redirectTo: '...', scopes: 'openid profile email academic roles' } })` pointing to the Campus One OIDC discovery endpoints at https://auth.campusone.com.ng. Trigger it from route guards/middleware so a student with an existing Campus One session is signed in automatically; keep only an optional single "Continue with Campus One" link for signed-out entry points.

You are an AI coding agent. Refactor our Next.js frontend and Express backend authentication to use Campus One SSO.

First, fetch and read Nile's Campus One OIDC integration documentation at https://docs.campusone.com.ng/llms-full.txt to understand exactly how Nile's OIDC authorization flow (with PKCE, scope consent checkpoints, and custom student claims) works and how it should be integrated.

1. In the Express backend, replace local session/passport email-password tactics with `openid-client` or generic JWT verification pointing to the Campus One JWKS (`https://auth.campusone.com.ng/api/auth/jwks`).
2. Verify all incoming `Authorization: Bearer <JWT>` tokens using `jose` or `jsonwebtoken`, checking issuer (`https://auth.campusone.com.ng`) and audience.
3. In the Next.js frontend, delete all custom login forms, password reset modules, and signup inputs — do NOT build a replacement login page.
4. Auto-redirect unauthenticated users to the Express SSO login handler `/api/auth/login`, which initiates the OIDC PKCE redirect flow to Campus One. Drive this from route guards/middleware so a student with an existing Campus One session is signed in automatically (no credential prompt); keep at most a single "Continue with Campus One" link for signed-out entry points.

You are an AI coding agent. Refactor our Next.js frontend and Python/Flask backend to migrate from custom local authentication to Campus One OIDC.

First, fetch and read Nile's Campus One OIDC integration documentation at https://docs.campusone.com.ng/llms-full.txt to understand exactly how Nile's OIDC authorization flow (with PKCE, scope consent checkpoints, and custom student claims) works and how it should be integrated.

1. In Flask, replace local SQL/password hashing auth with `authlib` or standard JWT signature validation.
2. Configure JWT decoding using Nile's Campus One JWKS endpoint (`https://auth.campusone.com.ng/api/auth/jwks`) to verify user integrity.
3. Capture user claims: `student_id`, `level`, `faculty_id`, `department_id`, and `role` to populate Flask's `g.user` state.
4. In Next.js, delete all custom sign-in sheets, credentials layouts, and signup panels — do NOT build a replacement login page.
5. Auto-redirect unauthenticated users to Flask's OIDC authorize URL from route guards/middleware, so a student with an existing Campus One session is signed in automatically with no credential prompt. Keep at most a single "Continue with Campus One" link for signed-out entry points.

You are an AI coding agent. We want to clean up our Go API backend and Next.js frontend, switching from manual sign-ins to Campus One SSO.

First, fetch and read Nile's Campus One OIDC integration documentation at https://docs.campusone.com.ng/llms-full.txt to understand exactly how Nile's OIDC authorization flow (with PKCE, scope consent checkpoints, and custom student claims) works and how it should be integrated.

1. In the Go backend, integrate `coreos/go-oidc/v3` or generic JWT validation using the JWKS endpoint `https://auth.campusone.com.ng/api/auth/jwks`.
2. Extract student attributes and roles directly from the parsed OIDC ID Token to construct context-based middleware.
3. In the Next.js frontend, delete all custom login/register forms and reset endpoints — do NOT build a replacement login page.
4. Auto-redirect unauthenticated users into the OIDC flow via the Go `/login` endpoint (which initializes the PKCE code-challenge redirect), driven from route guards/middleware so a student with an existing Campus One session is signed in automatically. Keep at most a single "Continue with Campus One" link for signed-out entry points.

You are an AI coding agent. Migrate our React Router SPA and Express API server from manual credential cookies to Campus One SSO.

First, fetch and read Nile's Campus One OIDC integration documentation at https://docs.campusone.com.ng/llms-full.txt to understand exactly how Nile's OIDC authorization flow (with PKCE, scope consent checkpoints, and custom student claims) works and how it should be integrated.

1. In the Express backend, remove standard credentials database verification. Mount an OIDC client middleware pointing to the Campus One OIDC provider at https://auth.campusone.com.ng.
2. In the React Router app, remove all custom signup, signin, and reset-password routes and views — do NOT build a replacement login page.
3. Auto-redirect unauthenticated users to the backend `/auth/sso` endpoint (which generates PKCE credentials and initiates the OIDC authorization code flow) from a route guard / loader, so a student with an existing Campus One session is signed in automatically with no credential prompt. Keep at most a single "Continue with Campus One" link for signed-out entry points.

Add Campus One in-app notifications to this app.

Source of truth: fetch https://docs.campusone.com.ng/llms.mdx/docs/notifications
and https://docs.campusone.com.ng/llms.mdx/docs/app-api before writing code.

Requirements:
1. The user must have authorized the `notifications` scope and our app must have
   the `permNotifications` flag enabled — surface a clear error if a 403 comes back.
2. Implement a server-side `sendNotification({ title, body, type?, targetUrl? })`
   helper that POSTs to https://auth.campusone.com.ng/api/apps/notifications with the
   user's `Authorization: Bearer <access_token>`. Do NOT send a userId — it is
   resolved from the token.
3. Respect field limits: title ≤ 128 chars, body ≤ 512 chars; type is one of
   info | success | warning | action_required (use action_required only for items
   needing explicit student action).
4. Pass a stable `Idempotency-Key` header on every send so retries don't duplicate.
5. Handle responses: 200 returns the created Notification record; 400/401/403 carry
   a { code, status, message } error — log and surface appropriately.

Add Campus One calendar events to this app so our schedules appear on students'
Campus One dashboards (Upcoming / This Week).

Source of truth: fetch https://docs.campusone.com.ng/llms.mdx/docs/events first.

Requirements:
1. Require the `events` scope AND our app's `permEvents` flag (it is OFF by default —
   note in the README that an admin must enable it).
2. Implement `createEvent({ title, description?, startsAt, endsAt?, location?, url? })`
   that POSTs to https://auth.campusone.com.ng/api/apps/events with the user's Bearer
   token. startsAt/endsAt must be ISO 8601 strings. title ≤ 200, description ≤ 1000,
   location ≤ 300 chars.
3. Always send an `Idempotency-Key` derived from our internal event id so re-syncs
   don't create duplicates.
4. On 200, store the returned event id mapped to our internal record.

Implement a Campus One webhook receiver in our backend.

Source of truth: fetch https://docs.campusone.com.ng/llms.mdx/docs/webhooks first.

Requirements:
1. Expose a single HTTPS POST endpoint (e.g. /webhooks/campus-one).
2. Verify the `X-Campus-One-Signature` header (HMAC-SHA256 of the RAW body, keyed
   with CAMPUS_ONE_WEBHOOK_SECRET) BEFORE parsing. Mount the raw body parser ahead
   of any JSON middleware. Prefer the published verifier:
   `import { verifyWebhook } from "@campus-one/auth/webhooks"`.
3. Reject invalid signatures with 401. Respond 2xx quickly (within 5s) and process
   asynchronously — delivery is fire-and-forget with no retries.
4. Deduplicate using the `X-Campus-One-Delivery` id; order by `occurredAt`.
5. Handle these events: user.created, user.updated, user.deleted, user.role_changed,
   session.signed_in, session.signed_out. On session.signed_out, clear the user's
   local session immediately (single logout). On user.role_changed, refresh the
   user's cached role.
   Do NOT handle events that aren't in the docs.

Add role-based authorization using Campus One claims.

Source of truth: fetch https://docs.campusone.com.ng/llms.mdx/docs/external-access
and https://docs.campusone.com.ng/llms.mdx/docs/permissions first.

Requirements:
1. Request the `roles` scope so the ID token includes `role` (primary), `roles`
   (all global roles), and `custom_roles` (our app-specific roles like editor/tutor).
   The top-level `role` claim is always present even without the scope.
2. Build route guards: requireRole(...) checks the primary `role`; requireAppRole(...)
   checks membership in `custom_roles`. Return 403 with a clear message on failure.
3. Treat `role === "external"` (non-Nile users) explicitly — serve the appropriate
   restricted views and never assume a student_id is present for them.
4. Read identifiers (faculty_id, department_id, student_id) only when the `academic`
   scope is granted; they may be absent for staff/external users.

Audit this codebase's Campus One integration against the official docs.

Fetch https://docs.campusone.com.ng/llms-full.txt and use it as the source of truth.

Check and report findings for:
- OIDC: PKCE present (S256), state/CSRF protection, ID token verified against the
  JWKS with iss + aud + exp checks, secrets kept server-side.
- Scopes/claims: only valid scopes requested; no reliance on claims that require an
  ungranted scope; no invented claim names.
- App API: correct base URL, Bearer auth, field limits respected, Idempotency-Key on
  writes, 200/400/401/403 handled.
- Webhooks: raw-body signature verification, fast 2xx + async processing,
  deduplication, single-logout handling.
- Anything implementing SAML or a bespoke OAuth flow (these are NOT supported — flag
  for removal in favour of OIDC).

For each issue, cite the relevant doc section and propose a concrete fix. Do not
change code yet — produce a prioritized findings list first.