<?php
declare(strict_types=1);
require_once __DIR__ . '/config.php';
require_once __DIR__ . '/vendor/autoload.php';

use Fitness\OIDC\OIDC;

// Ensure a state was sent back.
if (!isset($_GET['state']) || !isset($_SESSION['oidc_state'])) {
    http_response_code(400);
    exit('Missing state parameter.');
}

// Verify the state matches what we stored.
if ($_GET['state'] !== $_SESSION['oidc_state']) {
    http_response_code(400);
    exit('Invalid state.');
}

// Clean up the session variables.
$state = $_SESSION['oidc_state'];
$nonce = $_SESSION['oidc_nonce'];
unset($_SESSION['oidc_state'], $_SESSION['oidc_nonce']);

if (!isset($_GET['code'])) {
    http_response_code(400);
    exit('Missing authorization code.');
}

$code = $_GET['code'];
$oidc = new OIDC();

try {
    // Exchange code for tokens.
    $tokens = $oidc->exchangeCode($code);

    // Validate ID token (minimal).
    $idInfo = $oidc->validateIDToken($tokens['id_token'], $nonce);

    // Get userinfo (includes groups because of scope).
    $userInfo = $oidc->getUserInfo($tokens['access_token']);

    // Store everything we need in the session.
    $_SESSION['user'] = [
        'id_token'    => $tokens['id_token'],
        'access_token'=> $tokens['access_token'],
        'refresh_token'=> $tokens['refresh_token'] ?? null,
        'expires_in'  => $tokens['expires_in'] ?? null,
        'id_info'     => $idInfo,
        'user_info'   => $userInfo,
    ];
} catch (\Throwable $e) {
    http_response_code(500);
    exit('Error during OIDC exchange: ' . $e->getMessage());
}

// Clean up the query string (code, state) by redirecting to the home page.
header('Location: /');
exit;