<?php
/**
 * modules/oauth/token.php — canje del código OAuth por un token de dispositivo.
 * PÚBLICO (sin sesión). POST { code, redirect_uri }. Devuelve JSON { access_token }.
 */
if (!defined('IN_APP')) { die('Acceso denegado'); }

header('Content-Type: application/json; charset=utf-8');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(array('error' => 'method_not_allowed'));
    exit;
}

$code     = (string)($_POST['code'] ?? '');
$redirect = (string)($_POST['redirect_uri'] ?? '');

$res = $auth->consumeOAuthCode($code, $redirect);
if (!$res) {
    http_response_code(400);
    echo json_encode(array('error' => 'invalid_grant'));
    exit;
}

$token = $auth->createApiKey($res['id_user'], $res['device'] ?: 'KamiQuery (VSCode)');

// Datos de la cuenta para mostrarlos en la extensión (sesión).
$account = '';
$st = $mysqli->prepare('SELECT name, email FROM users WHERE id_user = ? LIMIT 1');
$st->bind_param('i', $res['id_user']);
$st->execute();
if ($u = $st->get_result()->fetch_assoc()) {
    $account = $u['name'] !== '' ? $u['name'] : $u['email'];
}
$st->close();

echo json_encode(array('access_token' => $token, 'token_type' => 'bearer', 'account' => $account, 'email' => $u['email'] ?? ''));