<?php
/**
 * GET /api/auth/oauth_google.php
 * Entry point for the "Sign in with Google" button (plain link/redirect,
 * not AJAX - OAuth flows work by browser redirects).
 *
 * STATUS: STUB. The client ID/secret fields exist (Admin panel > Settings)
 * but are empty until a developer registers this app in the Google Cloud
 * Console and fills them in. Until then, this just bounces back to login
 * with a friendly message instead of pretending to work.
 *
 * TODO for the developer wiring this up for real:
 *   1. Register an OAuth 2.0 Client ID (Web application) in Google Cloud
 *      Console. Authorized redirect URI: <APP_URL>/api/auth/oauth_google_callback.php
 *   2. Paste the Client ID + Secret into Admin > Settings (stored in the
 *      `settings` table, read via get_setting() - already wired).
 *   3. Below, once $clientId is non-empty, redirect the browser to:
 *      https://accounts.google.com/o/oauth2/v2/auth?client_id=...&redirect_uri=...&response_type=code&scope=email+profile&state=<csrf-token>
 *   4. Implement oauth_google_callback.php to exchange the returned `code`
 *      for tokens (POST to https://oauth2.googleapis.com/token), fetch the
 *      user's email/profile, then find-or-create a `users` row with
 *      oauth_provider='google', oauth_id=<google sub>, and call
 *      login_user() exactly like auth/login.php does.
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/settings.php';

$pdo = Database::connect();
$clientId = get_setting($pdo, 'oauth_google_client_id', '');

if ($clientId === '') {
    header('Location: ' . APP_URL . '/login.html?oauth_error=google_not_configured');
    exit;
}

// TODO: build the real Google consent-screen redirect once $clientId is set.
header('Location: ' . APP_URL . '/login.html?oauth_error=google_not_implemented');
exit;
