package auth

import (
	"context"
	"log"
	"net/http"

	"golang.org/x/oauth2"
)

// this is usually served at /callback
func OAuthCallback(w http.ResponseWriter, r *http.Request) {
	state := r.FormValue("state")
	code := r.FormValue("code")

	stateCookie, err := r.Cookie("oauth_state")
	if err != nil {
		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
		return
	}
	if state != stateCookie.Value {
		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
		return
	}

	http.SetCookie(w, &http.Cookie{
		Name:   "oauth_state",
		Value:  "",
		Path:   "/",
		MaxAge: -1,
	})

	verifierCookie, err := r.Cookie("pkce_verifier")
	if err != nil {
		http.Error(w, "Missing PKCE verifier", http.StatusBadRequest)
		return
	}

	verifier := verifierCookie.Value

	token, err := OAuthConfigs[0].Exchange(context.Background(), code, oauth2.VerifierOption(verifier))
	if err != nil {
		http.Error(w, "Failed to exchange token: "+err.Error(), http.StatusInternalServerError)
		return
	}

	// Store the token securely
	if err := TestTokenStore.Save(token); err != nil {
		log.Printf("Failed to save token: %v", err)
	}

	http.Redirect(w, r, "/user", http.StatusTemporaryRedirect)
}