// Auteur : Simon-Pierre Boucher — contact@spboucher.ai
// Départ du flux Google OAuth : pose state + next en témoins, redirige
// vers l'écran de consentement Google.
import { NextRequest, NextResponse } from "next/server";
import crypto from "crypto";
import { BASE_URL, safeNext } from "@/lib/auth";

export async function GET(req: NextRequest) {
  const clientId = process.env.GOOGLE_CLIENT_ID;
  if (!clientId) {
    return NextResponse.redirect(
      new URL("/connexion?error=google-non-configure", BASE_URL),
    );
  }
  const next = safeNext(req.nextUrl.searchParams.get("next"));
  const state = crypto.randomBytes(16).toString("hex");

  const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
  url.searchParams.set("client_id", clientId);
  url.searchParams.set("redirect_uri", `${BASE_URL}/api/auth/callback/google`);
  url.searchParams.set("response_type", "code");
  url.searchParams.set("scope", "openid email profile");
  url.searchParams.set("state", state);
  url.searchParams.set("prompt", "select_account");

  const res = NextResponse.redirect(url);
  const opts = {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax" as const,
    path: "/",
    maxAge: 600,
  };
  res.cookies.set("ka_oauth_state", state, opts);
  res.cookies.set("ka_oauth_next", next, opts);
  return res;
}