spb/groupe-ka Public

1// Auteur : Simon-Pierre Boucher — contact@spboucher.ai2// Départ du flux Google OAuth : pose state + next en témoins, redirige3// vers l'écran de consentement Google.4import { NextRequest, NextResponse } from "next/server";5import crypto from "crypto";6import { BASE_URL, safeNext } from "@/lib/auth";78export async function GET(req: NextRequest) {9  const clientId = process.env.GOOGLE_CLIENT_ID;10  if (!clientId) {11    return NextResponse.redirect(12      new URL("/connexion?error=google-non-configure", BASE_URL),13    );14  }15  const next = safeNext(req.nextUrl.searchParams.get("next"));16  const state = crypto.randomBytes(16).toString("hex");1718  const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");19  url.searchParams.set("client_id", clientId);20  url.searchParams.set("redirect_uri", `${BASE_URL}/api/auth/callback/google`);21  url.searchParams.set("response_type", "code");22  url.searchParams.set("scope", "openid email profile");23  url.searchParams.set("state", state);24  url.searchParams.set("prompt", "select_account");2526  const res = NextResponse.redirect(url);27  const opts = {28    httpOnly: true,29    secure: process.env.NODE_ENV === "production",30    sameSite: "lax" as const,31    path: "/",32    maxAge: 600,33  };34  res.cookies.set("ka_oauth_state", state, opts);35  res.cookies.set("ka_oauth_next", next, opts);36  return res;37}38