<?php

return [
    // ... existing config

    'google' => [
        'client_id' => env('GOOGLE_CLIENT_ID'),
        'client_secret' => env('GOOGLE_CLIENT_SECRET'),
        'redirect' => env('GOOGLE_REDIRECT_URL'),
    ],
];

// Sudah ada di migration users
$table->string('google_id')->nullable()->index();
$table->text('profile_photo')->nullable();

<?php

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens;

    protected $fillable = [
        'name',
        'email',
        'password',
        'phone',
        'google_id',        // ← Add this
        'profile_photo',    // ← Add this
    ];

    protected $hidden = [
        'password',
        'remember_token',
    ];

    // Google OAuth methods
    public function isGoogleUser()
    {
        return !is_null($this->google_id);
    }

    public function getProfilePhotoAttribute($value)
    {
        if ($value) {
            return $value;
        }
        
        // Default avatar jika tidak ada foto
        return 'https://ui-avatars.com/api/?name=' . urlencode($this->name) . '&background=random';
    }
}

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Laravel\Socialite\Facades\Socialite;
use Illuminate\Support\Str;

class GoogleAuthController extends Controller
{
    /**
     * Redirect to Google OAuth
     */
    public function redirectToGoogle()
    {
        return Socialite::driver('google')
            ->scopes(['email', 'profile'])
            ->redirect();
    }

    /**
     * Handle Google OAuth callback
     */
    public function handleGoogleCallback()
    {
        try {
            $googleUser = Socialite::driver('google')->user();
            
            // Check if user already exists
            $user = User::where('email', $googleUser->getEmail())->first();
            
            if ($user) {
                // Update existing user with Google info
                $user->update([
                    'google_id' => $googleUser->getId(),
                    'profile_photo' => $googleUser->getAvatar(),
                ]);
            } else {
                // Create new user
                $user = User::create([
                    'name' => $googleUser->getName(),
                    'email' => $googleUser->getEmail(),
                    'google_id' => $googleUser->getId(),
                    'profile_photo' => $googleUser->getAvatar(),
                    'password' => Hash::make(Str::random(24)), // Random password
                    'email_verified_at' => now(), // Auto verify Google users
                ]);
            }

            // Login user
            Auth::login($user, true);

            // Redirect to intended page or dashboard
            return redirect()->intended('/dashboard')
                ->with('success', 'Successfully logged in with Google!');

        } catch (\Exception $e) {
            return redirect('/login')
                ->with('error', 'Google login failed. Please try again.');
        }
    }

    /**
     * Link existing account with Google
     */
    public function linkGoogleAccount()
    {
        if (!Auth::check()) {
            return redirect('/login')
                ->with('error', 'Please login first to link your Google account.');
        }

        try {
            $googleUser = Socialite::driver('google')->user();
            
            // Check if Google account is already linked to another user
            $existingUser = User::where('google_id', $googleUser->getId())
                ->where('id', '!=', Auth::id())
                ->first();
                
            if ($existingUser) {
                return redirect('/dashboard')
                    ->with('error', 'This Google account is already linked to another user.');
            }

            // Link Google account to current user
            Auth::user()->update([
                'google_id' => $googleUser->getId(),
                'profile_photo' => $googleUser->getAvatar(),
            ]);

            return redirect('/dashboard')
                ->with('success', 'Google account linked successfully!');

        } catch (\Exception $e) {
            return redirect('/dashboard')
                ->with('error', 'Failed to link Google account.');
        }
    }

    /**
     * Unlink Google account
     */
    public function unlinkGoogleAccount()
    {
        if (!Auth::check()) {
            return redirect('/login');
        }

        $user = Auth::user();
        
        // Check if user has password (safety check)
        if (!$user->password) {
            return redirect('/dashboard')
                ->with('error', 'Please set a password before unlinking Google account.');
        }

        $user->update([
            'google_id' => null,
            'profile_photo' => null,
        ]);

        return redirect('/dashboard')
            ->with('success', 'Google account unlinked successfully.');
    }
}

<?php

use App\Http\Controllers\Auth\GoogleAuthController;

// Google OAuth routes
Route::prefix('auth/google')->group(function () {
    Route::get('/', [GoogleAuthController::class, 'redirectToGoogle'])
        ->name('google.login');
    
    Route::get('/callback', [GoogleAuthController::class, 'handleGoogleCallback'])
        ->name('google.callback');
    
    Route::post('/link', [GoogleAuthController::class, 'linkGoogleAccount'])
        ->middleware('auth')
        ->name('google.link');
    
    Route::post('/unlink', [GoogleAuthController::class, 'unlinkGoogleAccount'])
        ->middleware('auth')
        ->name('google.unlink');
});

// Request additional permissions
return Socialite::driver('google')
    ->scopes(['email', 'profile', 'phone']) // Add phone if needed
    ->redirect();

// Add state for CSRF protection
return Socialite::driver('google')
    ->with(['state' => Str::random(40)])
    ->redirect();

// config/services.php
'google' => [
    'client_id' => env('GOOGLE_CLIENT_ID'),
    'client_secret' => env('GOOGLE_CLIENT_SECRET'),
    'redirect' => env('APP_ENV') === 'production' 
        ? 'https://yourdomain.com/auth/google/callback'
        : 'http://localhost:8000/auth/google/callback',
],

// Only allow specific email domains
$allowedDomains = ['gmail.com', 'company.com'];
$emailDomain = substr(strrchr($googleUser->getEmail(), '@'), 1);

if (!in_array($emailDomain, $allowedDomains)) {
    return redirect('/login')
        ->with('error', 'Email domain not allowed.');
}

// app/Http/Kernel.php
'google-auth' => [
    'throttle:5,1', // 5 attempts per minute
],

// Log OAuth activities
Log::info('Google OAuth login', [
    'user_id' => $user->id,
    'google_id' => $googleUser->getId(),
    'email' => $googleUser->getEmail(),
    'ip' => request()->ip(),
]);

// tests/Feature/GoogleAuthTest.php
<?php

namespace Tests\Feature;

use Tests\TestCase;
use App\Models\User;
use Laravel\Socialite\Facades\Socialite;

class GoogleAuthTest extends TestCase
{
    public function test_google_redirect()
    {
        $response = $this->get('/auth/google');
        
        $response->assertRedirect();
        $this->assertStringContains('accounts.google.com', $response->headers->get('Location'));
    }

    public function test_google_callback_creates_new_user()
    {
        // Mock Google user response
        $googleUser = new \Laravel\Socialite\Two\User();
        $googleUser->id = '123456789';
        $googleUser->email = '[email protected]';
        $googleUser->name = 'Test User';
        $googleUser->avatar = 'https://example.com/avatar.jpg';

        Socialite::shouldReceive('driver->user')
            ->andReturn($googleUser);

        $response = $this->get('/auth/google/callback');

        $this->assertDatabaseHas('users', [
            'email' => '[email protected]',
            'google_id' => '123456789',
        ]);

        $response->assertRedirect('/dashboard');
    }
}

// Temporary debug di callback controller
dd([
    'google_user' => $googleUser->user,
    'email' => $googleUser->getEmail(),
    'id' => $googleUser->getId(),
    'avatar' => $googleUser->getAvatar(),
]);