50 lines
2 KiB
PHP
50 lines
2 KiB
PHP
|
<?php
|
||
|
|
/**
|
||
|
|
* Seed Google OAuth credentials into sp_settings (encrypted secret).
|
||
|
|
*
|
||
|
|
* Values are read from ENVIRONMENT VARIABLES so no secret is ever committed. Only the
|
||
|
|
* client_secret is encrypted (encrypted=1); client_id and redirect_uri are not secret.
|
||
|
|
* The Account controller decrypts the secret server-side for the token exchange. This
|
||
|
|
* row is NEVER exposed through /api/config.
|
||
|
|
*
|
||
|
|
* Run (from api/):
|
||
|
|
* GOOGLE_OAUTH_CLIENT_ID='....apps.googleusercontent.com' \
|
||
|
|
* GOOGLE_OAUTH_CLIENT_SECRET='GOCSPX-...' \
|
||
|
|
* GOOGLE_OAUTH_REDIRECT='https://medellin.co/api/account/google' \
|
||
|
|
* php db/seed_google_oauth.php
|
||
|
|
*
|
||
|
|
* The redirect must EXACTLY match an Authorized redirect URI in the Google Cloud
|
||
|
|
* OAuth client (APIs & Services → Credentials).
|
||
|
|
*/
|
||
|
|
require __DIR__ . '/../vendor/autoload.php';
|
||
|
|
require __DIR__ . '/../config.php';
|
||
|
|
|
||
|
|
$clientId = getenv('GOOGLE_OAUTH_CLIENT_ID');
|
||
|
|
$clientSecret = getenv('GOOGLE_OAUTH_CLIENT_SECRET');
|
||
|
|
$redirect = getenv('GOOGLE_OAUTH_REDIRECT') ?: (URL . '/api/account/google');
|
||
|
|
|
||
|
|
if ($clientId === false || $clientId === '' || $clientSecret === false || $clientSecret === '') {
|
||
|
|
fwrite(STDERR, "Set GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET in the environment.\n");
|
||
|
|
exit(1);
|
||
|
|
}
|
||
|
|
|
||
|
|
$meta = [
|
||
|
|
'provider' => 'google',
|
||
|
|
'client_id' => $clientId,
|
||
|
|
'client_secret' => \Functions::Encrypt($clientSecret),
|
||
|
|
'redirect_uri' => $redirect,
|
||
|
|
'auth_uri' => 'https://accounts.google.com/o/oauth2/v2/auth',
|
||
|
|
'token_uri' => 'https://oauth2.googleapis.com/token',
|
||
|
|
'userinfo_uri' => 'https://www.googleapis.com/oauth2/v3/userinfo',
|
||
|
|
'scope' => 'openid email profile',
|
||
|
|
];
|
||
|
|
|
||
|
|
\Db::execute("DELETE FROM sp_settings WHERE keyval = ?", ['google_oauth']);
|
||
|
|
\Db::execute(
|
||
|
|
"INSERT INTO sp_settings (keyval, `group`, metval, status, encrypted, createdate) VALUES (?, 'auth', ?, 1, 1, ?)",
|
||
|
|
['google_oauth', json_encode($meta), date('Y-m-d H:i:s')]
|
||
|
|
);
|
||
|
|
|
||
|
|
echo "saved google_oauth (group=auth, encrypted=1)\n";
|
||
|
|
echo "redirect_uri = {$redirect}\n";
|