<?php

declare(strict_types=1);

use App\App\Bootstrap;
use App\Security\EntraAuth;

require dirname(__DIR__) . '/src/autoload.php';
Bootstrap::init();

$auth = new EntraAuth();

// Entra reported an error (e.g. user cancelled or consent denied).
if (isset($_GET['error'])) {
    Bootstrap::log('portal', 'Entra-Callback-Fehler: ' . (string) ($_GET['error'])
        . ' - ' . (string) ($_GET['error_description'] ?? ''));
    header('Location: ' . Bootstrap::url('portal/login.php?error=auth_failed'));
    exit;
}

$code = (string) ($_GET['code'] ?? '');
$state = (string) ($_GET['state'] ?? '');

if ($auth->handleCallback($code, $state)) {
    header('Location: ' . Bootstrap::url('portal/index.php'));
    exit;
}

// Distinguish "signed in but not allowlisted" is not possible here without extra state;
// a generic failure keeps the flow simple and avoids leaking allowlist membership.
header('Location: ' . Bootstrap::url('portal/login.php?error=auth_failed'));
exit;