<?php
/**
 * Seed Google OAuth credentials into sp_settings (encrypted secret).
 *
 * Values are read from ENVIRONMENT VARIABLES so no secret is ever committed. Only the
 * client_secret is encrypted (encrypted=1); client_id and redirect_uri are not secret.
 * The Account controller decrypts the secret server-side for the token exchange. This
 * row is NEVER exposed through /api/config.
 *
 * Run (from api/):
 *   GOOGLE_OAUTH_CLIENT_ID='....apps.googleusercontent.com' \
 *   GOOGLE_OAUTH_CLIENT_SECRET='GOCSPX-...' \
 *   GOOGLE_OAUTH_REDIRECT='https://medellin.co/api/account/google' \
 *   php db/seed_google_oauth.php
 *
 * The redirect must EXACTLY match an Authorized redirect URI in the Google Cloud
 * OAuth client (APIs & Services → Credentials).
 */
require __DIR__ . '/../vendor/autoload.php';
require __DIR__ . '/../config.php';

$clientId     = getenv('GOOGLE_OAUTH_CLIENT_ID');
$clientSecret = getenv('GOOGLE_OAUTH_CLIENT_SECRET');
$redirect     = getenv('GOOGLE_OAUTH_REDIRECT') ?: (URL . '/api/account/google');

if ($clientId === false || $clientId === '' || $clientSecret === false || $clientSecret === '') {
    fwrite(STDERR, "Set GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET in the environment.\n");
    exit(1);
}

$meta = [
    'provider'      => 'google',
    'client_id'     => $clientId,
    'client_secret' => \Functions::Encrypt($clientSecret),
    'redirect_uri'  => $redirect,
    'auth_uri'      => 'https://accounts.google.com/o/oauth2/v2/auth',
    'token_uri'     => 'https://oauth2.googleapis.com/token',
    'userinfo_uri'  => 'https://www.googleapis.com/oauth2/v3/userinfo',
    'scope'         => 'openid email profile',
];

\Db::execute("DELETE FROM sp_settings WHERE keyval = ?", ['google_oauth']);
\Db::execute(
    "INSERT INTO sp_settings (keyval, `group`, metval, status, encrypted, createdate) VALUES (?, 'auth', ?, 1, 1, ?)",
    ['google_oauth', json_encode($meta), date('Y-m-d H:i:s')]
);

echo "saved google_oauth (group=auth, encrypted=1)\n";
echo "redirect_uri = {$redirect}\n";