<?php
/**
 * Apple "Sign in with Apple" credentials for Dabil.
 * ----------------------------------------------------------------------------
 * Fill these in from your Apple Developer account (see
 * auth/APPLE_SIGNIN_SETUP.md). Kept separate from config/oauth.php so your
 * working Google config is never touched.
 */

// Apple Developer > Membership: your 10-character Team ID.
const APPLE_TEAM_ID   = '';            // e.g. ABCDE12345

// The **Services ID** identifier you create (this is the OAuth client_id).
const APPLE_CLIENT_ID = '';            // e.g. ng.com.dabil.web

// The Key ID of the "Sign in with Apple" key you create.
const APPLE_KEY_ID    = '';            // e.g. K1234ABCDE

/**
 * Absolute path to your AuthKey_XXXX.p8 private key file.
 * SECURITY: place it OUTSIDE the public web root if possible (e.g. one level
 * above /customer). If it must live inside, keep the filename secret and add
 * a deny rule (see the setup guide). Example values:
 *   __DIR__ . '/apple_key.p8'                      (inside config/)
 *   '/home/yqpqsjjj/secure/AuthKey_K1234ABCDE.p8'  (outside web root — best)
 */
const APPLE_PRIVATE_KEY_PATH = __DIR__ . '/apple_key.p8';

/**
 * Redirect URI Apple returns to. Leave blank to auto-detect (recommended), or
 * pin it explicitly. MUST match the Return URL registered on the Services ID.
 * Expected: https://dabil.com.ng/customer/auth/apple_callback.php
 */
const APPLE_REDIRECT_URI = '';

/** Build the Apple callback URL (apple.php + apple_callback.php share /auth). */
function dabil_apple_redirect_uri(): string
{
    if (APPLE_REDIRECT_URI !== '') {
        return APPLE_REDIRECT_URI;
    }
    $fwd   = $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '';
    $https = (!empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off')
             || ((int)($_SERVER['SERVER_PORT'] ?? 0) === 443)
             || strtolower($fwd) === 'https';
    $scheme = $https ? 'https' : 'http';
    $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
    $dir  = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/auth/apple.php')), '/');
    return $scheme . '://' . $host . $dir . '/apple_callback.php';
}
