import "github.com/statebyte/go-telegram-login/teleauth"

package main

import (
	"context"
	"net/http"

	"github.com/statebyte/go-telegram-login/teleauth"
)

func main() {
	ta, _ := teleauth.New(teleauth.Config{
		ClientID:     123456789,
		ClientSecret: "BOT_CLIENT_SECRET",
		RedirectURI:  "https://example.com/auth/callback",
		// Audience defaults to ClientID when omitted.
	})

	// Example: start authorization
	http.HandleFunc("/auth/start", func(w http.ResponseWriter, r *http.Request) {
		res, err := ta.StartAuth(r.Context(), teleauth.StartAuthOptions{
			GenerateNonce: true,
			// Scopes defaults to: ["openid", "profile", "phone"]
		})
		if err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}

		// IMPORTANT:
		// Store res.State and res.CodeVerifier (and res.Nonce if used) in a user session/CSRF-safe storage.
		// Do not rely on client-provided values without checking them.

		http.Redirect(w, r, res.URL, http.StatusFound)
	})

	// Example: callback handler
	http.HandleFunc("/auth/callback", func(w http.ResponseWriter, r *http.Request) {
		ctx := context.Background()
		q := r.URL.Query()

		code := q.Get("code")
		state := q.Get("state")
		_ = state // Verify it against the stored value from your session.

		// IMPORTANT:
		// Load codeVerifier (and expectedNonce if you enabled it) from your session.
		codeVerifier := "CODE_VERIFIER_FROM_SESSION"
		expectedNonce := "NONCE_FROM_SESSION" // or "" if you didn't include nonce

		user, err := ta.ExchangeAndValidate(ctx, code, codeVerifier, expectedNonce)
		if err != nil {
			http.Error(w, err.Error(), http.StatusUnauthorized)
			return
		}

		_ = user
		w.WriteHeader(http.StatusOK)
	})

	_ = http.ListenAndServe(":8080", nil)
}