podabio/callback.php at main · getphily/podabio · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
<?php
/**
 * Google OAuth Callback
 * PodaBio
 */

require_once __DIR__ . '/../../config/constants.php';
require_once __DIR__ . '/../../config/database.php';
require_once __DIR__ . '/../../includes/session.php';
require_once __DIR__ . '/../../includes/helpers.php';
require_once __DIR__ . '/../../classes/User.php';
require_once __DIR__ . '/../../classes/Page.php';
require_once __DIR__ . '/../../config/oauth.php';

$error = '';
$code = $_GET['code'] ?? '';
$state = $_GET['state'] ?? '';

// Debug: Log session state for troubleshooting (remove in production)
if (empty($state)) {
    error_log("OAuth Callback: No state parameter received");
    redirect('/login.php?error=' . urlencode('Missing authorization state. Please try again.'));
}

// Verify state token for CSRF protection
if (!isset($_SESSION['oauth_state'])) {
    error_log("OAuth Callback: Session oauth_state not found. Session ID: " . session_id());
    error_log("OAuth Callback: Session data: " . print_r($_SESSION, true));
    $error = 'Session expired. Please try logging in again.';
    redirect('/login.php?error=' . urlencode($error));
}

if ($state !== $_SESSION['oauth_state']) {
    error_log("OAuth Callback: State mismatch. Expected: " . $_SESSION['oauth_state'] . ", Got: " . $state);
    $error = 'Invalid authorization request. Please try again.';
    unset($_SESSION['oauth_state']);
    unset($_SESSION['oauth_mode']);
    redirect('/login.php?error=' . urlencode($error));
}

// Get OAuth mode (login or link)
$mode = $_SESSION['oauth_mode'] ?? 'login';
$isLoggedIn = isLoggedIn();
$currentUserId = getUserId();

// Clear OAuth state
unset($_SESSION['oauth_state']);
unset($_SESSION['oauth_mode']);

if (empty($code)) {
    $error = 'Authorization failed. No code received.';
    redirect($mode === 'link' && $isLoggedIn ? '/admin/userdashboard.php#/account/profile?error=' . urlencode($error) : '/login.php?error=' . urlencode($error));
}

// Exchange code for access token
$tokenData = getGoogleAccessToken($code);

if (!$tokenData || !isset($tokenData['access_token'])) {
    $error = 'Failed to get access token. Please try again.';
    redirect($mode === 'link' && $isLoggedIn ? '/admin/userdashboard.php#/account/profile?error=' . urlencode($error) : '/login.php?error=' . urlencode($error));
}

// Get user info from Google
$userInfo = getGoogleUserInfo($tokenData['access_token']);

if (!$userInfo || !isset($userInfo['id'])) {
    $error = 'Failed to get user information. Please try again.';
    redirect($mode === 'link' && $isLoggedIn ? '/admin/userdashboard.php#/account/profile?error=' . urlencode($error) : '/login.php?error=' . urlencode($error));
}

$googleId = $userInfo['id'];
$email = $userInfo['email'];
$user = new User();

// Handle link flow (user is logged in and wants to link Google account)
if ($mode === 'link' && $isLoggedIn) {
    $linkResult = $user->linkGoogleAccount($currentUserId, $googleId, $email);

    if ($linkResult['success']) {
        $successMsg = 'Google account linked successfully!';
        redirect('/admin/userdashboard.php#/account/profile?success=' . urlencode($successMsg));
    } else {
        redirect('/admin/userdashboard.php#/account/profile?error=' . urlencode($linkResult['error']));
    }
    exit;
}

// Handle login flow
// Check if user exists with Google ID
$existingUser = fetchOne("SELECT * FROM users WHERE google_id = ?", [$googleId]);

if ($existingUser) {
    // User with Google ID exists, log them in
    $result = $user->loginWithGoogle(
        $googleId,
        $email,
        [
            'name' => $userInfo['name'] ?? '',
            'picture' => $userInfo['picture'] ?? ''
        ]
    );

    if ($result['success']) {
        $pageClass = new Page();
        $userPage = $pageClass->getByUserId($result['user']['id'] ?? $existingUser['id']);
        redirect($userPage ? '/admin/userdashboard.php' : '/admin/userdashboard.php#/account/profile');
    } else {
        redirect('/login.php?error=' . urlencode($result['error']));
    }
    exit;
}

// Check if email exists with password (but no Google ID)
$existingEmail = fetchOne("SELECT * FROM users WHERE email = ? AND google_id IS NULL", [$email]);

if ($existingEmail) {
    // Email exists with password but no Google account linked
    // Store Google data in session and redirect to password verification
    $_SESSION['pending_google_link'] = [
        'google_id' => $googleId,
        'email' => $email,
        'user_id' => $existingEmail['id'],
        'name' => $userInfo['name'] ?? '',
        'picture' => $userInfo['picture'] ?? ''
    ];

    redirect('/verify-google-link.php');
    exit;
}

// No existing account, create new user with Google
$result = $user->loginWithGoogle(
    $googleId,
    $email,
    [
        'name' => $userInfo['name'] ?? '',
        'picture' => $userInfo['picture'] ?? ''
    ]
);

if ($result['success']) {
    $pageClass = new Page();
    $userPage = $pageClass->getByUserId($result['user']['id'] ?? null);
    redirect($userPage ? '/admin/userdashboard.php' : '/admin/userdashboard.php#/account/profile');
} else {
    redirect('/login.php?error=' . urlencode($result['error']));
}