# Continue with Google — setup guide

Everything in the code is built. To switch it on you need two values from Google
(a **Client ID** and **Client Secret**), pasted into `config/oauth.php`, plus a
one-time database migration. Budget ~15 minutes.

---

## Step 1 — Run the database migration (once)

Adds the columns social sign-in needs to the `users` table.

1. Open **phpMyAdmin** → select the `yqpqsjjj_dabil2` database → **SQL** tab.
2. Paste the contents of `auth/oauth_migration.sql` and click **Go**.

It only *adds* columns (`auth_provider`, `provider_uid`, `email_verified`) and an
index — nothing is dropped, so it's safe to run on live data.

---

## Step 2 — Create Google OAuth credentials

1. Go to **https://console.cloud.google.com/** and sign in.
2. Top bar → **project dropdown** → **New Project**. Name it `Dabil` → **Create**,
   then make sure it's selected.
3. Left menu → **APIs & Services** → **OAuth consent screen**.
   - User type: **External** → **Create**.
   - App name: `Dabil`. User support email: your email.
   - Add your domain under **Authorized domains**: `dabil.com.ng`.
   - Developer contact email: your email → **Save and continue**.
   - **Scopes**: Save and continue (the defaults `email`, `profile`, `openid`
     are all we use).
   - **Test users**: while the app is in "Testing", add the Google accounts
     you'll test with. (Publish later — see Step 5.)
4. Left menu → **APIs & Services** → **Credentials** → **+ Create credentials**
   → **OAuth client ID**.
   - Application type: **Web application**.
   - Name: `Dabil Web`.
   - Under **Authorized redirect URIs**, click **+ Add URI** and enter the
     callback URL **exactly** (see Step 3 to confirm yours):

         https://dabil.com.ng/customer/auth/google_callback.php

   - **Create**. A dialog shows your **Client ID** and **Client secret** — copy
     both.

---

## Step 3 — Confirm your exact callback URL

The redirect URI must match character-for-character. The callback file is
`customer/auth/google_callback.php`. So the URL is your site origin + the path
to that file. Examples:

| If the app is served at…           | Register this redirect URI                                  |
|------------------------------------|-------------------------------------------------------------|
| `https://dabil.com.ng/customer/…`  | `https://dabil.com.ng/customer/auth/google_callback.php`    |
| `https://dabil.com.ng/` (root → customer) | `https://dabil.com.ng/auth/google_callback.php`      |

Not sure which? Open `https://YOUR-SITE/customer/auth/google.php` in a browser
after Step 4. If the redirect URI is wrong, Google shows a
**"redirect_uri_mismatch"** error page that prints the exact URI it received —
copy that string into the Authorized redirect URIs list and you're done.

---

## Step 4 — Paste the credentials

Open `config/oauth.php` and fill in:

```php
const GOOGLE_CLIENT_ID     = '1234567890-abc123.apps.googleusercontent.com';
const GOOGLE_CLIENT_SECRET = 'GOCSPX-xxxxxxxxxxxxxxxxxxxx';
const GOOGLE_REDIRECT_URI  = '';   // leave blank = auto-detect (recommended)
```

Leave `GOOGLE_REDIRECT_URI` blank to auto-detect, **or** paste the exact URI you
registered if you prefer to pin it.

---

## Step 5 — Test, then publish

1. Visit `signin.php` (or `signup.php`) and click **Continue with Google**.
2. Pick a Google account → you should land on `dashboard.php`, signed in.
   - First time: a new `customer` row is created (name, email, avatar filled
     from Google; a random password it can never log in with).
   - Returning / same email as an existing account: you're logged into that
     account (linked by verified email).
3. When it works for your test users, go back to **OAuth consent screen** and
   click **Publish app** so any Google user can sign in (not just test users).

---

## How it works (for future reference)

```
signin.php  ──click──▶  auth/google.php  ──redirect──▶  Google consent
                                                              │
dashboard.php  ◀── session started ──  auth/google_callback.php  ◀── code+state
```

- `auth/google.php` sends the user to Google with a random `state` (CSRF guard).
- `auth/google_callback.php` re-checks `state`, swaps the `code` for tokens,
  reads the verified profile, finds-or-creates the customer, and starts the
  **same session** your `login.php` uses (plus the `dabil_returning` cookie).
- All Google logic is dependency-free PHP (cURL only). Secrets live in
  `config/oauth.php`.

## Security notes
- Keep `config/oauth.php` out of any public Git repo (it holds the secret).
- HTTPS is required by Google — you already have it.
- Only verified Google emails are accepted; unverified emails are rejected.

## Adding Apple later
Sign in with Apple follows the same shape but needs the paid Apple Developer
Program, a Services ID, and a `.p8` signing key (used to generate a JWT client
secret). The `auth/` folder and `users` columns added here already support it —
ping me when you have the Apple Developer account and I'll build the Apple side.
