@php
/**
 * Google One Tap — the sign-in prompt Google draws in the corner of the page.
 *
 * Rendered ONLY when Admin → Settings → APIs has Google sign-in switched on AND the One Tap
 * presentation chosen, and only for a signed-out visitor. The default install ships the button
 * presentation, so nothing below is emitted and the page still makes no request to Google —
 * the same "opt in before anything external loads" rule the map providers follow.
 *
 * The credential goes to OUR endpoint through OUR form, so the POST carries the site's CSRF token
 * like every other. `next` is the page the prompt fired on, so a visitor signing in from a
 * restaurant page stays on it; the server re-validates it before trusting it as a redirect
 * target, because it arrives from the browser.
 */

use App\Support\App;

if (!\App\Services\GoogleAuth::oneTap() || \App\Support\Auth::check()) {
    return;
}

// App-relative, because redirect() prepends the install's base path. App::path() drops the query
// string, so it is re-attached — a visitor signing in halfway down a filtered list should land
// back on that list, not on its first page.
$qmTapQuery = (string) request()->getQueryString();
$qmTapNext  = App::path() . ($qmTapQuery !== '' ? '?' . $qmTapQuery : '');
@endphp
<div id="g_id_onload"
     data-client_id="{{ trim((string) setting('google_client_id', '')) }}"
     data-callback="qmGoogleOneTap"
     data-context="signin"
     data-auto_select="false"
     data-cancel_on_tap_outside="false"
     data-itp_support="true"></div>

<form id="qm-one-tap-form" method="post" action="{{ route('auth.google.one-tap') }}" hidden>
    @csrf
    <input type="hidden" name="credential" id="qm-one-tap-credential" value="">
    <input type="hidden" name="next" value="{{ $qmTapNext }}">
</form>

@php /* Ours first and synchronously: data-callback names a function that must exist on window
         before Google's library initialises and fires it. */
@endphp
<script src="{!! asset('js/google-one-tap.js') !!}"></script>
<script src="https://accounts.google.com/gsi/client" async defer></script>