<?php
// callback.php
require __DIR__ . '/../vendor/autoload.php';
session_start();

$oidc = new \Jumbojett\OpenIDConnectClient(
    'https://auth.matt-cloud.com/oidc',
    'fitness-oidc',
    'egebuqzZfVnjjBG9JDQ8tjW3TzV9gJurvT7qfB6c2SX2nPBNeaGycDfx4788QzJd'
);
$oidc->setRedirectURL('https://fitness.matt-cloud.com/pgapi/auth/oidc/callback');

try {
    // Finish the auth flow – exchanges the code, validates the ID‑token, fetches userinfo
    $oidc->authenticate();

    // $oidc->idToken is a JWT object; you can cast to array if needed
    $idToken = $oidc->idToken;

    // Userinfo (includes groups because you requested the `groups` scope)
    $userInfo = $oidc->getUserInfo();   // or $oidc->requestUserInfo('email')

    // Store what you need in the session
    $_SESSION['user'] = [
        'id_token'    => $oidc->idToken,      // JWT string
        'access_token'=> $oidc->accessToken,   // opaque or JWT
        'refresh_token'=> $oidc->refreshToken,
        'expires_in'  => $oidc->expiresIn,
        'claims'      => (array)$idToken,      // decoded claims
        'userinfo'    => $userInfo,
    ];
} catch (Exception $e) {
    http_response_code(500);
    echo "Authentication failed: " . $e->getMessage();
    exit;
}

// Redirect to the site’s landing page
header('Location: /');
exit;