import { NextResponse } from "next/server";
import { issueJwtToken } from "@/lib/jwt";
import { authenticateSsoUser } from "@/lib/auth";

export async function createSsoSession(profile: {
  email: string;
  name?: string | null;
  provider?: string;
  providerId?: string | null;
}) {
  const authUser = await authenticateSsoUser(profile);

  if (!authUser) {
    return NextResponse.redirect(
      `${process.env.FRONTEND_ORIGIN}/login?sso=unauthorized`,
    );
  }

  const token = issueJwtToken(authUser.username, authUser.role);

  const frontendOrigin = process.env.FRONTEND_ORIGIN;

  if (!frontendOrigin) {
    throw new Error("Missing required environment variable: FRONTEND_ORIGIN");
  }

  const redirectUrl = new URL("/login", frontendOrigin);
  redirectUrl.hash = new URLSearchParams({
    sso_token: token,
    sso_user: JSON.stringify({
      username: authUser.username,
      role: authUser.role,
    }),
  }).toString();

  const response = NextResponse.redirect(redirectUrl);

  response.cookies.set({
    name: "auth_token",
    value: token,
    httpOnly: true,
    sameSite: "lax",
    secure: redirectUrl.protocol === "https:",
    path: "/",
    maxAge: 24 * 60 * 60,
  });
  response.headers.set("Cache-Control", "no-store");
  response.headers.set("Referrer-Policy", "no-referrer");

  return response;
}