// GET /api/auth/login/oidc — OIDC SSO 重定向
import { NextResponse } from 'next/server'
import { generatePkce, generateState, buildAuthorizeUrl } from '@shared/lib/auth/oidc'
import { authConfig } from '@/lib/auth-config'

export async function GET() {
  const { codeVerifier, codeChallenge } = generatePkce()
  const state = generateState()
  const nonce = generateState()

  const url = buildAuthorizeUrl(
    { autheliaUrl: authConfig.autheliaUrl, clientId: authConfig.oidcClientId, clientSecret: authConfig.oidcClientSecret, redirectUri: authConfig.oidcRedirectUri },
    { codeChallenge, state, nonce },
  )

  const response = NextResponse.redirect(url)

  // 存储 PKCE 参数到 httpOnly cookie（5 分钟过期）
  const cookieOpts = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' as const, maxAge: 300, path: '/' }
  response.cookies.set('oidc_code_verifier', codeVerifier, cookieOpts)
  response.cookies.set('oidc_state', state, cookieOpts)
  response.cookies.set('oidc_nonce', nonce, cookieOpts)

  return response
}