<?php
defined( 'ABSPATH' ) || exit;
$avi_lang = 'en';
if ( function_exists( 'avi_get_current_lang' ) ) { $avi_lang = avi_get_current_lang(); }
if ( $avi_lang === 'en' && isset( $_SERVER['REQUEST_URI'] ) ) {
    $req = $_SERVER['REQUEST_URI'];
    if ( strpos( $req, '/fr/' ) === 0 ) { $avi_lang = 'fr'; }
    elseif ( strpos( $req, '/es/' ) === 0 ) { $avi_lang = 'es'; }
}
if ( $avi_lang !== 'en' ) { set_query_var( 'avi_lang', $avi_lang ); }
$is_fr = ( $avi_lang === 'fr' );
$is_es = ( $avi_lang === 'es' );

$avi_meta_title = function_exists( 'avi_get_content' )
	? avi_get_content( 'api-security', 'meta_title', 'API Security & OAuth — Avision' )
	: 'API Security & OAuth — Avision';
$avi_meta_desc  = function_exists( 'avi_get_content' )
	? avi_get_content( 'api-security', 'meta_desc', 'How Avision uses Google OAuth 2.0 to access Google Business Profile data only with explicit user consent.' )
	: 'How Avision uses Google OAuth 2.0 to access Google Business Profile data only with explicit user consent.';
$avi_schema_json = array(
	'@context'    => 'https://schema.org',
	'@type'       => 'WebPage',
	'name'        => 'API Security & OAuth — Avision',
	'description' => $avi_meta_desc,
	'url'         => 'https://avision.org/api-security/',
	'publisher'   => array(
		'@type' => 'Organization',
		'name'  => 'Advantage Synergies LLP',
	),
);

if ( ! class_exists( 'Avision_Page_Template' ) ) {
	require_once AVISION_PLUGIN_DIR . 'includes/class-avision-page-template.php';
}

$hero = array(
	'badge'       => 'Google API Authorized Program',
	'title'       => function_exists( 'avi_get_content' ) ? avi_get_content( 'api-security', 'hero_title', 'How Avision Handles Your Google Data' ) : 'How Avision Handles Your Google Data',
	'subtitle'    => function_exists( 'avi_get_content' ) ? avi_get_content( 'api-security', 'hero_sub', 'Built on OAuth 2.0. Your data, your control. Always.' ) : 'Built on OAuth 2.0. Your data, your control. Always.',
	'cta_primary' => array(
		'label' => function_exists( 'avi_get_content' ) ? avi_get_content( 'api-security', 'cta_label', 'View Privacy Policy' ) : 'View Privacy Policy',
		'url'   => function_exists( 'avi_get_content' ) ? avi_get_content( 'api-security', 'cta_url', '/privacy-policy/' ) : '/privacy-policy/',
	),
	'align'       => 'center',
	'size'        => 'small',
);

Avision_Page_Template::render(
	'api-security',
	$hero,
	static function () use ( $avi_schema_json ) {
		?>
		<section class="avi-content-section">
			<div class="avi-content-block">
				<?php
				$avi_body_override = function_exists( 'avi_get_content' ) ? avi_get_content( 'api-security', 'body', '' ) : '';
				if ( $avi_body_override !== '' ) {
					echo wp_kses_post( $avi_body_override );
				} else {
					?>
				<h2>You're Always in Control</h2>
				<p>Avision uses the Google OAuth 2.0 standard to connect to your Google Business Profile. No credentials are ever stored. Access is granted only by you, for your specific listing, and can be revoked at any time.</p>

				<ol class="avi-steps">
					<li>
						<div>
							<strong>You connect your Google account</strong>
							<p>You click "Connect with Google" and authenticate directly with Google — Avision never sees your Google password.</p>
						</div>
					</li>
					<li>
						<div>
							<strong>You grant access to your specific listing</strong>
							<p>Google shows you exactly which permissions Avision is requesting. You approve only what you choose.</p>
						</div>
					</li>
					<li>
						<div>
							<strong>Avision manages only what you authorized</strong>
							<p>We read and update your Google Business Profile data to deliver the service. Nothing else. No other Google services are ever accessed.</p>
						</div>
					</li>
				</ol>

				<h2>What Avision Accesses vs. Never Accesses</h2>

				<div class="avi-split">
					<div class="avi-info-card avi-info-card--highlight">
						<h3 style="color:#1DB88A;margin-top:0">✓ What we access</h3>
						<ul class="avi-checklist">
							<li>Your Business Profile information</li>
							<li>Customer reviews (read + respond)</li>
							<li>Posts and photos</li>
							<li>Business hours and attributes</li>
							<li>Performance insights</li>
						</ul>
					</div>
					<div class="avi-info-card">
						<h3 style="color:#E05050;margin-top:0">✗ What we never access</h3>
						<ul class="avi-checklist">
							<li class="avi-checklist--no">Your personal Google account</li>
							<li class="avi-checklist--no">Gmail, Drive, or other services</li>
							<li class="avi-checklist--no">Other Business Profiles not authorized</li>
							<li class="avi-checklist--no">Payment information</li>
							<li class="avi-checklist--no">Google Ads or Analytics</li>
						</ul>
					</div>
				</div>

				<h2>Security Standards</h2>
				<ul class="avi-checklist">
					<li>OAuth 2.0 (RFC 6749) — industry standard authorization</li>
					<li>TLS 1.3 encryption for all data in transit</li>
					<li>Encrypted token storage at rest</li>
					<li>Access revocable at any time via myaccount.google.com</li>
					<li>GDPR Article 28 (Data Processor) compliant</li>
					<li>Regular third-party security audits</li>
				</ul>

				<h2>Why Avision Doesn't Have Its Own Business Profile Listing</h2>
				<div class="avi-info-card">
					<p>Avision is an online-only SaaS platform. Under Google's own guidelines, online-only businesses are not eligible for a Google Business Profile listing — only businesses with a physical customer-facing location qualify.</p>
					<p>Our API access is exclusively on behalf of clients who do have physical-location businesses with verified Business Profiles. This is the standard authorized model for management platforms.</p>
					<p><strong>Each client explicitly authorizes Avision through Google's OAuth 2.0 consent screen</strong> — we never access any Business Profile without express permission.</p>
				</div>
					<?php
				}
				?>
			</div>
		</section>

		<script type="application/ld+json"><?php echo wp_json_encode( $avi_schema_json, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE ); ?></script>
		<?php
	}
);
