// Built-in Google provider (OAuth2 / OpenID Connect). Endpoints are hardcoded —
// admins configure only Enabled + Client ID + Client Secret. Uses the OIDC
// userinfo endpoint; `sub` is Google's stable per-user id.

const OAuth2Provider = require('./oauth2.provider')

class GoogleProvider extends OAuth2Provider {
  constructor(config = {}) {
    super({ kind: 'google', name: 'Google', ...config, id: config.id || 'google' })
  }

  authEndpoint() {
    return 'https://accounts.google.com/o/oauth2/v2/auth'
  }
  tokenEndpoint() {
    return 'https://oauth2.googleapis.com/token'
  }
  userinfoEndpoint() {
    return 'https://openidconnect.googleapis.com/v1/userinfo'
  }
  scopeString() {
    return 'openid email profile'
  }
  authParams() {
    // Online access (no refresh token needed for login), and let the user pick
    // an account rather than silently reusing a signed-in one.
    return { access_type: 'online', prompt: 'select_account' }
  }
  normalizeProfile(p = {}) {
    return { subject: p.sub, email: p.email || null, name: p.name || p.email || null }
  }
}

module.exports = GoogleProvider
