route.ts

import { NextRequest, NextResponse } from "next/server"
import { upsertUser, setUserGithubTokens } from "@/lib/db/queries"
import { createSessionToken, getSessionCookieOptions } from "@/lib/auth"
import { encryptSecret } from "@/lib/security/encryption"

const OAUTH_STATE_COOKIE = "cla-github-oauth-state"
const OAUTH_STATE_TTL_SECONDS = 60 * 10

type OAuthStateCookie = {
  nonce: string
  returnTo: string
}

type ResolvedGitHubEmail = {
  email: string
  verified: boolean
  source: "profile" | "primary_verified" | "verified" | "any" | "none"
}

/**
 * GitHub OAuth Callback
 *
 * Flow:
 * 1. User clicks "Sign in with GitHub" -> GET with no code -> redirect to GitHub authorize URL
 * 2. GitHub redirects back here with a `code` query param
 * 3. Exchange code for access token
 * 4. Fetch user profile from GitHub API
 * 5. Upsert user in Neon DB
 * 6. Create JWT session cookie
 * 7. Redirect to the original destination (or /dashboard)
 */

export async function GET(request: NextRequest) {
  const { searchParams } = new URL(request.url)
  const code = searchParams.get("code")
  const state = searchParams.get("state")

  if (!code) {
    // Step 1: Redirect to GitHub authorize
    const clientId = process.env.GITHUB_CLIENT_ID
    if (!clientId) {
      return NextResponse.json({ error: "GITHUB_CLIENT_ID is not configured" }, { status: 500 })
    }

    const redirectUri = `${new URL(request.url).origin}/api/auth/github`
    const returnTo = sanitizeReturnTo(searchParams.get("returnTo"), "/dashboard")
    const nonce = crypto.randomUUID()
    const githubAuthUrl = new URL("https://github.com/login/oauth/authorize")
    githubAuthUrl.searchParams.set("client_id", clientId)
    githubAuthUrl.searchParams.set("redirect_uri", redirectUri)
    githubAuthUrl.searchParams.set("scope", "read:user,read:org,user:email")
    githubAuthUrl.searchParams.set("state", nonce)

    const response = NextResponse.redirect(githubAuthUrl.toString())
    response.cookies.set(OAUTH_STATE_COOKIE, encodeOAuthStateCookie({ nonce, returnTo }), {
      httpOnly: true,
      secure: process.env.NODE_ENV === "production",
      sameSite: "lax",
      path: "/",
      maxAge: OAUTH_STATE_TTL_SECONDS,
    })
    return response
  }

  const makeAuthErrorRedirect = (reason: string) => {
    const response = NextResponse.redirect(new URL(`/auth/signin?error=${reason}`, request.url))
    clearOAuthStateCookie(response)
    return response
  }

  const oauthState = parseOAuthStateCookie(request.cookies.get(OAUTH_STATE_COOKIE)?.value ?? null)
  if (!state || !oauthState || oauthState.nonce !== state) {
    return makeAuthErrorRedirect("github_state")
  }
  const returnTo = sanitizeReturnTo(oauthState.returnTo, "/dashboard")

  // Step 2: Exchange code for access token
  const clientId = process.env.GITHUB_CLIENT_ID
  const clientSecret = process.env.GITHUB_CLIENT_SECRET
  if (!clientId || !clientSecret) {
    return NextResponse.json({ error: "GitHub OAuth credentials not configured" }, { status: 500 })
  }

  const tokenRes = await fetch("https://github.com/login/oauth/access_token", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Accept: "application/json",
    },
    body: JSON.stringify({
      client_id: clientId,
      client_secret: clientSecret,
      code,
    }),
  })

  const tokenData = await tokenRes.json()
  if (tokenData.error) {
    console.error("GitHub OAuth token error:", tokenData)
    return makeAuthErrorRedirect("github_token")
  }

  const accessToken: string | undefined = tokenData.access_token
  const refreshToken: string | undefined = tokenData.refresh_token
  const expiresIn: number | undefined =
    typeof tokenData.expires_in === "number" ? tokenData.expires_in : undefined
  const refreshTokenExpiresIn: number | undefined =
    typeof tokenData.refresh_token_expires_in === "number"
      ? tokenData.refresh_token_expires_in
      : undefined

  if (!accessToken) {
    console.error("GitHub OAuth token error: missing access token", tokenData)
    return makeAuthErrorRedirect("github_token")
  }
  if (!refreshToken || !expiresIn || !refreshTokenExpiresIn) {
    console.error(
      "GitHub OAuth token error: response missing refresh_token / expires_in fields. " +
        "Confirm that 'Expire user authorization tokens' is enabled on the GitHub App.",
      {
        hasRefreshToken: Boolean(refreshToken),
        hasExpiresIn: Boolean(expiresIn),
        hasRefreshTokenExpiresIn: Boolean(refreshTokenExpiresIn),
      }
    )
    return makeAuthErrorRedirect("github_token")
  }

  // Step 3: Fetch user profile from GitHub API
  const userRes = await fetch("https://api.github.com/user", {
    headers: {
      Authorization: `Bearer ${accessToken}`,
      Accept: "application/vnd.github+json",
    },
  })

  if (!userRes.ok) {
    console.error("GitHub user fetch error:", userRes.status)
    return makeAuthErrorRedirect("github_user")
  }

  const githubUser = await userRes.json()
  const githubEmail = await resolveGitHubEmail(accessToken, githubUser.email)

  // Step 4: Upsert user in DB
  const user = await upsertUser({
    githubId: githubUser.id,
    githubUsername: githubUser.login,
    avatarUrl: githubUser.avatar_url,
    name: githubUser.name || githubUser.login,
    email: githubEmail.email,
    emailVerified: githubEmail.verified,
    emailSource: githubEmail.source,
  })

  const encryptedAccessToken = encryptSecret(accessToken)
  const encryptedRefreshToken = encryptSecret(refreshToken)
  if (!encryptedAccessToken || !encryptedRefreshToken) {
    console.error(
      "Failed to encrypt GitHub OAuth tokens: ENCRYPTION_KEY or SESSION_SECRET is missing"
    )
    return makeAuthErrorRedirect("server_config")
  }

  const now = Date.now()
  await setUserGithubTokens(user.id, {
    accessTokenEncrypted: encryptedAccessToken,
    accessTokenExpiresAt: new Date(now + expiresIn * 1000).toISOString(),
    refreshTokenEncrypted: encryptedRefreshToken,
    refreshTokenExpiresAt: new Date(now + refreshTokenExpiresIn * 1000).toISOString(),
    tokenScopes: tokenData.scope ?? "",
  })

  // Step 5: Determine role — check if user is admin of any org
  // For now, use the role from the DB (set during org creation or default "contributor")
  const role = user.role as "admin" | "contributor"

  // Step 6: Create JWT session and set cookie
  const token = await createSessionToken({
    userId: user.id,
    githubUsername: user.githubUsername,
    role,
    jti: crypto.randomUUID(),
  })

  const response = NextResponse.redirect(new URL(returnTo, request.url))
  clearOAuthStateCookie(response)
  const cookieOpts = getSessionCookieOptions()
  response.cookies.set(cookieOpts.name, token, {
    httpOnly: cookieOpts.httpOnly,
    secure: cookieOpts.secure,
    sameSite: cookieOpts.sameSite,
    path: cookieOpts.path,
    maxAge: cookieOpts.maxAge,
  })

  return response
}

function sanitizeReturnTo(raw: string | null, fallback: string): string {
  if (!raw) return fallback
  if (!raw.startsWith("/") || raw.startsWith("//")) return fallback
  return raw
}

function encodeOAuthStateCookie(value: OAuthStateCookie): string {
  return `${value.nonce}:${encodeURIComponent(value.returnTo)}`
}

function parseOAuthStateCookie(raw: string | null): OAuthStateCookie | null {
  if (!raw) return null
  const separatorIndex = raw.indexOf(":")
  if (separatorIndex <= 0) return null

  const nonce = raw.slice(0, separatorIndex)
  const encodedReturnTo = raw.slice(separatorIndex + 1)
  if (!nonce || !encodedReturnTo) return null

  try {
    return {
      nonce,
      returnTo: decodeURIComponent(encodedReturnTo),
    }
  } catch {
    return null
  }
}

function clearOAuthStateCookie(response: NextResponse) {
  response.cookies.set(OAUTH_STATE_COOKIE, "", {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    path: "/",
    maxAge: 0,
  })
}

async function resolveGitHubEmail(
  accessToken: string,
  profileEmail: unknown
): Promise<ResolvedGitHubEmail> {
  if (typeof profileEmail === "string" && profileEmail.trim()) {
    return {
      email: profileEmail.trim(),
      verified: false,
      source: "profile",
    }
  }

  try {
    const emailsRes = await fetch("https://api.github.com/user/emails", {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        Accept: "application/vnd.github+json",
      },
    })

    if (!emailsRes.ok) {
      return {
        email: "",
        verified: false,
        source: "none",
      }
    }

    const emails = (await emailsRes.json()) as Array<{
      email?: string
      primary?: boolean
      verified?: boolean
    }>

    const primaryVerified = emails.find((entry) => entry.primary && entry.verified && entry.email)
    if (primaryVerified?.email) {
      return {
        email: primaryVerified.email,
        verified: true,
        source: "primary_verified",
      }
    }

    const verified = emails.find((entry) => entry.verified && entry.email)
    if (verified?.email) {
      return {
        email: verified.email,
        verified: true,
        source: "verified",
      }
    }

    const any = emails.find((entry) => entry.email)
    if (any?.email) {
      return {
        email: any.email,
        verified: Boolean(any.verified),
        source: "any",
      }
    }
    return {
      email: "",
      verified: false,
      source: "none",
    }
  } catch {
    return {
      email: "",
      verified: false,
      source: "none",
    }
  }
}