import { NextResponse } from "next/server";

import {
  getOidcCookieOptions,
  getSsoMode,
  OIDC_COOKIE_NAMES,
} from "@/lib/sso/config";
import { createOidcAuthorizationRequest } from "@/lib/sso/oidc";

export const dynamic = "force-dynamic";
export const runtime = "nodejs";

export async function GET() {
  try {
    if (getSsoMode() !== "oidc") {
      return NextResponse.json(
        { message: "OIDC SSO is disabled" },
        { status: 503 },
      );
    }

    const authorization = createOidcAuthorizationRequest();
    const cookieOptions = getOidcCookieOptions();
    const response = NextResponse.redirect(authorization.url);

    response.cookies.set({
      name: OIDC_COOKIE_NAMES.state,
      value: authorization.state,
      ...cookieOptions,
    });
    response.cookies.set({
      name: OIDC_COOKIE_NAMES.nonce,
      value: authorization.nonce,
      ...cookieOptions,
    });
    response.cookies.set({
      name: OIDC_COOKIE_NAMES.verifier,
      value: authorization.codeVerifier,
      ...cookieOptions,
    });
    response.headers.set("Cache-Control", "no-store");
    response.headers.set("Referrer-Policy", "no-referrer");

    return response;
  } catch (error) {
    console.error(
      "[sso] Unable to start OIDC authentication",
      error instanceof Error ? error.message : error,
    );

    return NextResponse.json(
      { message: "SSO configuration unavailable" },
      { status: 503 },
    );
  }
}