import { NextResponse } from "next/server";
import { createSession, getOrCreateUser, isSettingEnabled, SESSION_COOKIE, siteUrl, STATE_COOKIE_PREFIX } from "@/lib/auth";

export async function GET(request: Request) {
  const url = new URL(request.url);
  const publicUrl = siteUrl(request);
  if (!(await isSettingEnabled("auth_enabled")) || !(await isSettingEnabled("auth_vk_enabled"))) return NextResponse.redirect(new URL("/?auth=disabled", publicUrl));
  const state = (await import("next/headers")).cookies;
  const stateCookie = (await state()).get(`${STATE_COOKIE_PREFIX}vk`)?.value;
  if (!url.searchParams.get("state") || url.searchParams.get("state") !== stateCookie) return NextResponse.redirect(new URL("/?auth=error", publicUrl));
  try {
    const tokenUrl = new URL("https://oauth.vk.com/access_token");
    tokenUrl.search = new URLSearchParams({ client_id: process.env.VK_APP_ID || "", client_secret: process.env.VK_SECURE_KEY || "", redirect_uri: process.env.VK_REDIRECT_URI || `${publicUrl}/api/auth/vk/callback`, code: url.searchParams.get("code") || "" }).toString();
    const token = await fetch(tokenUrl, { cache: "no-store" }).then((r) => r.json()) as { access_token?: string; user_id?: number; email?: string };
    if (!token.access_token || !token.user_id) throw new Error("VK token exchange failed");
    const apiToken = process.env.VK_SERVICE_TOKEN || token.access_token;
    const profile = await fetch(`https://api.vk.com/method/users.get?${new URLSearchParams({ user_ids: String(token.user_id), fields: "photo_200", access_token: apiToken, v: "5.199" })}`, { cache: "no-store" }).then((r) => r.json()) as { response?: Array<{ first_name?: string; last_name?: string; photo_200?: string }> };
    const vkUser = profile.response?.[0];
    const user = await getOrCreateUser("vk", String(token.user_id), { email: token.email, displayName: `${vkUser?.first_name || "Пользователь"} ${vkUser?.last_name || ""}`.trim(), avatarUrl: vkUser?.photo_200 });
    const session = await createSession(user.id);
    const response = NextResponse.redirect(new URL("/?auth=success", publicUrl));
    response.cookies.set(SESSION_COOKIE, session, { httpOnly: true, sameSite: "lax", secure: process.env.NODE_ENV === "production", maxAge: 30 * 24 * 60 * 60, path: "/" });
    response.cookies.delete(`${STATE_COOKIE_PREFIX}vk`);
    return response;
  } catch { return NextResponse.redirect(new URL("/?auth=error", publicUrl)); }
}