import { d as defineEventHandler, aG as requireFeature, c as createError, aR as findSsoProviderBySlug, j as getQuery, aT as createLoginState, aU as buildSamlLoginUrl, aP as sendRedirect, aV as buildAuthorizationUrl, aW as isSamlUnavailableError } from '../../../../../../nitro/nitro.mjs';
import { n as normalizeRedirectAfter, b as buildSsoCallbackUrl } from '../../../../../../_/url-helpers.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';

const login_get = defineEventHandler(async (event) => {
  var _a;
  await requireFeature("enterprise.sso", event);
  const slug = (_a = event.context.params) == null ? void 0 : _a.slug;
  if (!slug || typeof slug !== "string") {
    throw createError({
      statusCode: 400,
      statusMessage: "Bad Request",
      message: "Provider slug is required"
    });
  }
  const provider = await findSsoProviderBySlug(slug);
  if (!provider || !provider.isEnabled) {
    throw createError({
      statusCode: 404,
      statusMessage: "Not Found",
      message: "SSO provider not found or disabled"
    });
  }
  try {
    const query = getQuery(event);
    const redirectAfter = normalizeRedirectAfter(query.redirect);
    const bundle = await createLoginState(provider.id, redirectAfter);
    const callbackUrl = buildSsoCallbackUrl(event, provider.slug);
    if (provider.type === "saml") {
      const url = await buildSamlLoginUrl({
        config: provider.config,
        callbackUrl,
        relayState: bundle.state
      });
      return sendRedirect(event, url, 302);
    }
    const authUrl = await buildAuthorizationUrl({
      config: provider.config,
      redirectUri: callbackUrl,
      state: bundle.state,
      nonce: bundle.nonce,
      codeChallenge: bundle.codeChallenge
    });
    return sendRedirect(event, authUrl, 302);
  } catch (error) {
    const message = error instanceof Error ? error.message : "Unknown SSO login error";
    console.error(`[GET /api/admin/auth/sso/${slug}/login] Error:`, message);
    if (isSamlUnavailableError(error)) {
      throw createError({
        statusCode: 501,
        statusMessage: "SAML Support Not Available",
        message
      });
    }
    throw createError({
      statusCode: 500,
      statusMessage: "SSO Login Failed",
      message
    });
  }
});

export { login_get as default };
//# sourceMappingURL=login.get.mjs.map
