<?php
// login.php
require __DIR__ . '/vendor/autoload.php';
session_start();

$oidc = new \Jumbojett\OpenIDConnectClient(
    'https://auth.matt-cloud.com/',    // ***ISSUER***
    'fitness-oidc',
    'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
);

// If you’re on a dev environment with a self‑signed cert:
# $oidc->setVerifyPeer(false);   // <-- DO NOT USE IN PRODUCTION

// PKCE – optional but recommended for public clients
$oidc->setCodeChallengeMethod('S256');

// Tell the client where to land after Auth
$oidc->setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback');

// Optional: hard‑code the discovery URL
$oidc->setDiscoveryEndpoint('https://auth.matt-cloud.com/.well-known/openid-configuration');

try {
    $oidc->authenticate();   // sends 302 → Authelia
} catch (Exception $e) {
    http_response_code(500);
    echo 'Login failed: ' . $e->getMessage();
    exit;
}