Carlos Arias
1f33296e30
Generic framework features, code-only — the tables come from the schema snapshot:
- controllers/account.php — email signup (verified) + Google OAuth (server-side auth-code
flow, async-popup friendly); native password_hash sessions on sp_users; sp_oauth_accounts +
sp_user_tokens; PublicController origin+throttle guards; {ok,data,error} envelope.
- Helpers/Mailer.php — transactional email: Brevo HTTP API (Guzzle) -> SMTP fallback
(PHPMailer) -> logs; config in sp_settings (encrypted).
- cli/rebuild.php — queue a static rebuild (sp_settings rebuild_pending flag) after DB edits.
- cli/resources.php — read a curated source registry (mde_resources) per agent_type.
- db/seed_google_oauth.php, db/seed_email.php — env-seeded encrypted secrets into sp_settings.
- templates/emails/verify.html — verification email template.
- composer.json — declare guzzlehttp/guzzle ^7.10 (account.php + Mailer use GuzzleHttp\Client).
Depends on the schema-snapshot branch (sp_users / sp_oauth_accounts / sp_user_tokens /
sp_settings / mde_resources) plus `composer require guzzlehttp/guzzle`. No data.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FMQeUnUrAeexcZ7P2Hxa6G
49 lines
2 KiB
PHP
49 lines
2 KiB
PHP
<?php
|
|
/**
|
|
* Seed Google OAuth credentials into sp_settings (encrypted secret).
|
|
*
|
|
* Values are read from ENVIRONMENT VARIABLES so no secret is ever committed. Only the
|
|
* client_secret is encrypted (encrypted=1); client_id and redirect_uri are not secret.
|
|
* The Account controller decrypts the secret server-side for the token exchange. This
|
|
* row is NEVER exposed through /api/config.
|
|
*
|
|
* Run (from api/):
|
|
* GOOGLE_OAUTH_CLIENT_ID='....apps.googleusercontent.com' \
|
|
* GOOGLE_OAUTH_CLIENT_SECRET='GOCSPX-...' \
|
|
* GOOGLE_OAUTH_REDIRECT='https://medellin.co/api/account/google' \
|
|
* php db/seed_google_oauth.php
|
|
*
|
|
* The redirect must EXACTLY match an Authorized redirect URI in the Google Cloud
|
|
* OAuth client (APIs & Services → Credentials).
|
|
*/
|
|
require __DIR__ . '/../vendor/autoload.php';
|
|
require __DIR__ . '/../config.php';
|
|
|
|
$clientId = getenv('GOOGLE_OAUTH_CLIENT_ID');
|
|
$clientSecret = getenv('GOOGLE_OAUTH_CLIENT_SECRET');
|
|
$redirect = getenv('GOOGLE_OAUTH_REDIRECT') ?: (URL . '/api/account/google');
|
|
|
|
if ($clientId === false || $clientId === '' || $clientSecret === false || $clientSecret === '') {
|
|
fwrite(STDERR, "Set GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET in the environment.\n");
|
|
exit(1);
|
|
}
|
|
|
|
$meta = [
|
|
'provider' => 'google',
|
|
'client_id' => $clientId,
|
|
'client_secret' => \Functions::Encrypt($clientSecret),
|
|
'redirect_uri' => $redirect,
|
|
'auth_uri' => 'https://accounts.google.com/o/oauth2/v2/auth',
|
|
'token_uri' => 'https://oauth2.googleapis.com/token',
|
|
'userinfo_uri' => 'https://www.googleapis.com/oauth2/v3/userinfo',
|
|
'scope' => 'openid email profile',
|
|
];
|
|
|
|
\Db::execute("DELETE FROM sp_settings WHERE keyval = ?", ['google_oauth']);
|
|
\Db::execute(
|
|
"INSERT INTO sp_settings (keyval, `group`, metval, status, encrypted, createdate) VALUES (?, 'auth', ?, 1, 1, ?)",
|
|
['google_oauth', json_encode($meta), date('Y-m-d H:i:s')]
|
|
);
|
|
|
|
echo "saved google_oauth (group=auth, encrypted=1)\n";
|
|
echo "redirect_uri = {$redirect}\n";
|