// GET /api/auth/callback — OIDC callback（V2：OA 签发 tlyq_session）
import { NextRequest } from 'next/server'
import { handleOidcCallback } from '@shared/lib/auth/handle-callback'
import { ldapUserExists } from '@/lib/ldap'

const autheliaUrl = process.env.AUTHELIA_URL || 'https://sso.tlyq.ai'
const oidcClientId = process.env.OIDC_CLIENT_ID || 'oa-oidc'
const oidcClientSecret = process.env.OIDC_CLIENT_SECRET || ''
const oidcRedirectUri = process.env.OIDC_REDIRECT_URI || 'https://oa.tlyq.ai/api/auth/callback'
const jwtSecret = process.env.JWT_SECRET || 'oa-shared-jwt-secret-tlyq-2026'
const cookieDomain = process.env.COOKIE_DOMAIN || '.tlyq.ai'

export async function GET(request: NextRequest) {
  return handleOidcCallback(request, {
    oidc: { autheliaUrl, clientId: oidcClientId, clientSecret: oidcClientSecret, redirectUri: oidcRedirectUri },
    jwtSecret,
    cookieDomain,

    // 强制验证 LLDAP 存在性（违反 §2.3 的旧行为已修正）
    getUser: async (username) => {
      const exists = await ldapUserExists(username)
      return exists ? { id: -1, role: 'admin' } : null
    },

    // OA 不通过 OIDC 创建/更新用户
  })
}