/**
 * POST /api/auth/idp-login
 *   body: { username, password, otp }
 *   → { ok, idp_logins: [{idp_host, ok, steps_completed?, final_url?, error?, post_login_terminal?}], error? }
 *
 * Drives one or more SAML IdP logins (template `_idp` may be array) via
 * the extension. Secrets stay in this request — never persisted.
 */

import { NextResponse } from 'next/server';
import { performIdpLogin } from '@/lib/auth/idp-login';

export async function POST(req: Request) {
  let body: any = {};
  try { body = await req.json(); } catch {}
  const r = await performIdpLogin({
    username: String(body?.username || '').trim(),
    password: String(body?.password || ''),
    otp: String(body?.otp || '').trim(),
  });
  return NextResponse.json(r, { status: r.ok ? 200 : 400 });
}
