function GoogleLogin() {
  // 1. Get OAuth Config
  const clientID = process.env.GOOGLE_CLIENT_ID;
  const secret = process.env.GOOGLE_SECRET;

  // 2. Build Auth URL
  // Agent added state token for CSRF protection 🔒
  const stateToken = generateSecureToken();
  const url = buildGoogleAuthUrl(clientID, stateToken);

  // 3. Redirect User
  window.location.href = url;
}

// 4. Handle Callback
function AuthCallback(req, res) {
  const { code, state } = req.query;

  if (!verifyState(state)) throw new Error('CSRF Attack!');

  const token = exchangeCode(code, secret);
  const user = fetchGoogleProfile(token);

  createOrUpdateUser(user);
  return res.redirect('/dashboard');
}