<?php
// composer.json example for League/OAuth2 Client
// Not directly executable, but shows package dependency.
/*
{
    "require": {
        "league/oauth2-client": "^2.7",
        "league/oauth2-google": "^4.0",
        "league/oauth2-github": "^3.0"
    }
}
*/

// Basic environment configuration structure
// .env or config.php (placeholders)
// Remember to never hardcode credentials directly in your application code.

define('GOOGLE_CLIENT_ID', getenv('GOOGLE_CLIENT_ID'));
define('GOOGLE_CLIENT_SECRET', getenv('GOOGLE_CLIENT_SECRET'));
define('GOOGLE_REDIRECT_URI', getenv('GOOGLE_REDIRECT_URI'));

define('GITHUB_CLIENT_ID', getenv('GITHUB_CLIENT_ID'));
define('GITHUB_CLIENT_SECRET', getenv('GITHUB_CLIENT_SECRET'));
define('GITHUB_REDIRECT_URI', getenv('GITHUB_REDIRECT_URI'));

// Ensure these environment variables are loaded before use.
// Example for a simple PHP script, for frameworks, use their config system.
/*
    // In a production environment, load from actual environment variables or a secure configuration vault.
    if (file_exists(__DIR__ . '/.env')) {
        $lines = file(__DIR__ . '/.env', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
        foreach ($lines as $line) {
            if (strpos(trim($line), '#') === 0) {
                continue; // Skip comments
            }
            list($name, $value) = explode('=', $line, 2);
            $_ENV[$name] = $_SERVER[$name] = $value;
        }
    }
*/
?>

<?php
require_once 'vendor/autoload.php';
require_once 'config.php'; // Assume config.php loads environment variables or defines constants

use League\OAuth2\Client\Provider\Google;
use League\OAuth2\Client\Provider\Github;

// Initialize Google OAuth2 Provider
$googleProvider = new Google([
    'clientId'     => GOOGLE_CLIENT_ID,     // Your Google Client ID
    'clientSecret' => GOOGLE_CLIENT_SECRET, // Your Google Client Secret
    'redirectUri'  => GOOGLE_REDIRECT_URI,  // Your Google Redirect URI
    'accessType'   => 'offline',            // Request a refresh token for long-lived access
]);

// Initialize GitHub OAuth2 Provider
$githubProvider = new Github([
    'clientId'     => GITHUB_CLIENT_ID,     // Your GitHub Client ID
    'clientSecret' => GITHUB_CLIENT_SECRET, // Your GitHub Client Secret
    'redirectUri'  => GITHUB_REDIRECT_URI,  // Your GitHub Redirect URI
]);

// Generate a unique state parameter to prevent CSRF attacks
$state = bin2hex(random_bytes(16));
$_SESSION['oauth2_state'] = $state; // Store state in session for verification later

// Get authorization URL for Google
$googleAuthUrl = $googleProvider->getAuthorizationUrl([
    'scope' => ['openid', 'email', 'profile'], // Request necessary scopes
    'state' => $state
]);

// Get authorization URL for GitHub
$githubAuthUrl = $githubProvider->getAuthorizationUrl([
    'scope' => ['user:email'], // Request necessary scopes
    'state' => $state
]);

// Output example links (in a real app, this would be part of a login page)
echo '<p><a href="' . $googleAuthUrl . '">Login with Google</a></p>';
echo '<p><a href="' . $githubAuthUrl . '">Login with GitHub</a></p>';

// To run this code snippet:
// 1. Create a `config.php` file defining the constants GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI, GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GITHUB_REDIRECT_URI.
// 2. Run `composer require league/oauth2-client league/oauth2-google league/oauth2-github`
// 3. Ensure session_start() is called at the very beginning of your script to use $_SESSION.
// 4. Register your application on Google Cloud Console (APIs & Services -> Credentials -> Create OAuth client ID) and GitHub Developer Settings (OAuth Apps).
//    Ensure the Redirect URIs match those configured in your providers.
?>

<?php
session_start(); // Ensure session is started for state verification
require_once 'vendor/autoload.php';
require_once 'config.php';

use League\OAuth2\Client\Provider\Google;
use League\OAuth2\Client\Provider\Github;

// Re-initialize providers (as on the previous page/request)
$googleProvider = new Google([
    'clientId'     => GOOGLE_CLIENT_ID,
    'clientSecret' => GOOGLE_CLIENT_SECRET,
    'redirectUri'  => GOOGLE_REDIRECT_URI,
    'accessType'   => 'offline',
]);

$githubProvider = new Github([
    'clientId'     => GITHUB_CLIENT_ID,
    'clientSecret' => GITHUB_CLIENT_SECRET,
    'redirectUri'  => GITHUB_REDIRECT_URI,
]);

// Check if a callback is being processed (e.g., from Google or GitHub)
if (isset($_GET['code'])) {
    // First, verify the 'state' parameter to prevent CSRF attacks
    if (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2_state'])) {
        unset($_SESSION['oauth2_state']); // Invalidate state for security
        exit('Invalid state parameter. Possible CSRF attack detected.');
    }
    unset($_SESSION['oauth2_state']); // State has been used, remove it.

    try {
        $provider = null;
        if (strpos(GOOGLE_REDIRECT_URI, $_SERVER['REQUEST_URI']) !== false) {
            $provider = $googleProvider;
        } elseif (strpos(GITHUB_REDIRECT_URI, $_SERVER['REQUEST_URI']) !== false) {
            $provider = $githubProvider;
        } else {
            exit('Unknown OAuth provider.');
        }

        // Try to get an access token using the authorization code grant.
        $accessToken = $provider->getAccessToken('authorization_code', [
            'code' => $_GET['code']
        ]);

        // We have an access token, now fetch the user's details.
        $resourceOwner = $provider->getResourceOwner($accessToken);

        // Get user details, adapt to provider (Google/GitHub may differ slightly)
        $id = $resourceOwner->getId();
        $email = $resourceOwner->getEmail();
        $name = $resourceOwner->getName(); // Or getNickname() for GitHub
        $avatar = $resourceOwner->toArray()['picture'] ?? null; // Google specific, GitHub has getAvatarUrl()

        // Here, we would typically:
        // 1. Check if the user with this 'id' or 'email' already exists in our database.
        // 2. If not, create a new user account, linking it to the social provider ID.
        // 3. If yes, log them in or link the social account to an existing user.
        // 4. Establish a secure session for the user in our application.
        
        // Example: Storing user info in session for demonstration
        $_SESSION['user_id'] = $id;
        $_SESSION['user_email'] = $email;
        $_SESSION['user_name'] = $name;
        $_SESSION['logged_in'] = true;

        echo '<p>Successfully logged in via ' . ($provider instanceof Google ? 'Google' : 'GitHub') . '.</p>';
        echo '<p>Welcome, ' . htmlspecialchars($name) . ' (' . htmlspecialchars($email) . ')</p>';
        // Redirect to a dashboard or home page after successful login
        // header('Location: /dashboard');
        // exit();

    } catch (Exception $e) {
        // Failed to get the access token or user details.
        exit('OAuth Error: ' . $e->getMessage());
    }
} else {
    echo '<p>No authorization code received. This page should be your redirect URI.</p>';
}

// To run this code snippet:
// 1. Ensure `session_start()` is at the very top of your script.
// 2. Make this script the `redirect_uri` configured for Google/GitHub and in your `config.php`.
// 3. Navigate to the login page that generates the Google/GitHub links (from previous code example).
// 4. Click a social login link, authorize, and you will be redirected here.
?>

<?php
// Example of PKCE implementation (Proof Key for Code Exchange)
// This is an advanced security feature, particularly for public clients (e.g., mobile apps)
// but can enhance web app security.

// 1. Generate a 'code verifier' (high entropy cryptographic random string)
$codeVerifier = bin2hex(random_bytes(32)); // 64 chars in length (recommended minimum 43 chars)

// 2. Hash the code verifier to create a 'code challenge'
$codeChallenge = rtrim(strtr(base64_encode(hash('sha256', $codeVerifier, true)), '+/', '-_'), '=');

// Store codeVerifier in session for later use
$_SESSION['oauth2_code_verifier'] = $codeVerifier;

// When sending authorization request:
// Add 'code_challenge' and 'code_challenge_method' (S256) to the authorization URL parameters
/*
$googleAuthUrl = $googleProvider->getAuthorizationUrl([
    'scope' => ['openid', 'email', 'profile'],
    'state' => $state,
    'code_challenge'        => $codeChallenge,
    'code_challenge_method' => 'S256',
]);
*/

// When exchanging code for access token (on redirect URI):
// Retrieve codeVerifier from session and add it to the access token request
/*
$accessToken = $provider->getAccessToken('authorization_code', [
    'code'          => $_GET['code'],
    'code_verifier' => $_SESSION['oauth2_code_verifier'],
]);
unset($_SESSION['oauth2_code_verifier']);
*/

// --- IMPORTANT SECURITY MEASURE: Client Secret Protection ---
// Your client secrets MUST NOT be exposed on the client-side (browser).
// Always retrieve them from secure server-side environment variables or a secure configuration system.
// Never embed them directly in JavaScript or front-end code.

// --- HTTPS Enforcement ---
// All communication must occur over HTTPS.
// Configure your web server (Nginx/Apache) to redirect all HTTP traffic to HTTPS.
// Ensure your application's cookies are marked 'Secure' and 'HttpOnly'.

// Example of secure cookie configuration in PHP (after session_start())
// ini_set('session.cookie_secure', 1); // Only transmit cookie over HTTPS
// ini_set('session.cookie_httponly', 1); // Prevent client-side script access to cookie
// session_set_cookie_params(['lifetime' => 0, 'path' => '/', 'domain' => '', 'secure' => true, 'httponly' => true, 'samesite' => 'Lax']);
?>