# Configure Discord

The package contains two independent Discord features:

1. **Player login** — session-only Discord OAuth for setup ownership.
2. **Slash commands** — `/setup`, `/ratios`, `/stance`, `/member`, and `/random-event`.

No Discord access token or user profile is written to the content library. The player session contains the Discord ID, display name, avatar reference, and relevant server role IDs until logout or session expiry.

## 1. Create the application

Create a Discord application in the Discord Developer Portal. Record:

- Application / Client ID
- Client Secret
- Public Key
- Bot Token, only when slash commands will be registered

## 2. Add redirect URI

Add this exact OAuth redirect URI:

```text
https://YOUR-DOMAIN.example/auth/discord-callback.php
```

Local testing can use:

```text
http://localhost:8080/auth/discord-callback.php
```

## 3. Edit `config/config.php`

```php
'discord' => [
    'enabled' => true,
    'client_id' => 'APPLICATION_ID',
    'client_secret' => 'CLIENT_SECRET',
    'redirect_uri' => 'https://YOUR-DOMAIN.example/auth/discord-callback.php',
    'guild_id' => 'YOUR_SERVER_ID',
    'public_key' => 'APPLICATION_PUBLIC_KEY',
    'bot_token' => 'BOT_TOKEN',
    'admin_role_ids' => ['ROLE_ID'],
    'team_role_ids' => ['ROLE_ID'],
],
```

Keep this file private. PHP source is not normally served, and the included `.htaccess` blocks the entire config directory, but credentials should still be treated as secrets.

## 4. Configure the interactions endpoint

In the Discord application settings, set:

```text
https://YOUR-DOMAIN.example/api/discord/interactions.php
```

Discord will verify the endpoint by sending a signed PING. The endpoint rejects unsigned requests.

## 5. Register slash commands

From SSH or a local copy with the production config:

```bash
php tools/register-discord-commands.php
```

When `guild_id` is configured, commands register to that server and update quickly. Without it, they register globally and may take longer to appear.

## Privacy behavior

- `/setup` can show public and unlisted records when the code is known.
- Private setup commands require the owner Discord ID or an allowed team/admin role.
- Discord email is never requested.
- The OAuth scope is limited to `identify` and `guilds.members.read`.