import { t as OptionsRepository } from "../../../../../../options-DTTML-Tx.mjs";
import { n as getPublicOrigin } from "../../../../../../public-url-Danv47cS.mjs";
import { t as finalizeSetup } from "../../../../../../setup-complete-Cb3LRyzy.mjs";
import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-YLFLcH5F.mjs";
import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
import { OAuthError, Role, handleOAuthCallback } from "@emdash-cms/auth";

//#region src/astro/routes/api/auth/oauth/[provider]/callback.ts
const prerender = false;
const VALID_PROVIDERS = new Set(["github", "google"]);
function isValidProvider(provider) {
	return VALID_PROVIDERS.has(provider);
}
/** Safely extract a string value from an env-like record */
function envString(env, ...keys) {
	for (const key of keys) {
		const val = env[key];
		if (typeof val === "string" && val) return val;
	}
}
/**
* Get OAuth config from environment variables
*/
function getOAuthConfig(env) {
	const providers = {};
	const githubClientId = envString(env, "EMDASH_OAUTH_GITHUB_CLIENT_ID", "GITHUB_CLIENT_ID");
	const githubClientSecret = envString(env, "EMDASH_OAUTH_GITHUB_CLIENT_SECRET", "GITHUB_CLIENT_SECRET");
	if (githubClientId && githubClientSecret) providers.github = {
		clientId: githubClientId,
		clientSecret: githubClientSecret
	};
	const googleClientId = envString(env, "EMDASH_OAUTH_GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_ID");
	const googleClientSecret = envString(env, "EMDASH_OAUTH_GOOGLE_CLIENT_SECRET", "GOOGLE_CLIENT_SECRET");
	if (googleClientId && googleClientSecret) providers.google = {
		clientId: googleClientId,
		clientSecret: googleClientSecret
	};
	return providers;
}
const GET = async ({ params, request, locals, session, redirect }) => {
	const { emdash } = locals;
	const provider = params.provider;
	if (!provider || !isValidProvider(provider)) return redirect(`/_emdash/admin/login?error=invalid_provider&message=${encodeURIComponent("Invalid OAuth provider")}`);
	if (!emdash?.db) return redirect(`/_emdash/admin/login?error=server_error&message=${encodeURIComponent("Database not configured")}`);
	const url = new URL(request.url);
	const code = url.searchParams.get("code");
	const state = url.searchParams.get("state");
	const error = url.searchParams.get("error");
	const errorDescription = url.searchParams.get("error_description");
	if (error) {
		const message = errorDescription || error;
		return redirect(`/_emdash/admin/login?error=oauth_denied&message=${encodeURIComponent(message)}`);
	}
	if (!code || !state) return redirect(`/_emdash/admin/login?error=invalid_callback&message=${encodeURIComponent("Missing code or state parameter")}`);
	try {
		const providers = getOAuthConfig(locals.runtime?.env ?? import.meta.env);
		if (!providers[provider]) return redirect(`/_emdash/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`);
		const adapter = createKyselyAdapter(emdash.db);
		const stateStore = createOAuthStateStore(emdash.db);
		const config = {
			baseUrl: `${getPublicOrigin(url, emdash?.config)}/_emdash`,
			providers,
			canSelfSignup: async (email) => {
				const setupComplete = await new OptionsRepository(emdash.db).get("emdash:setup_complete");
				if (setupComplete !== true && setupComplete !== "true") return {
					allowed: true,
					role: Role.ADMIN
				};
				const domain = email.split("@")[1]?.toLowerCase();
				if (!domain) return null;
				const entry = await emdash.db.selectFrom("allowed_domains").selectAll().where("domain", "=", domain).where("enabled", "=", 1).executeTakeFirst();
				if (!entry) return null;
				const roleLevel = entry.default_role;
				const roleMap = {
					50: Role.ADMIN,
					40: Role.EDITOR,
					30: Role.AUTHOR,
					20: Role.CONTRIBUTOR,
					10: Role.SUBSCRIBER
				};
				const role = roleMap[roleLevel] ?? Role.CONTRIBUTOR;
				if (!roleMap[roleLevel]) console.warn(`[oauth] Unknown role level ${roleLevel} for domain ${domain}, defaulting to CONTRIBUTOR`);
				return {
					allowed: true,
					role
				};
			}
		};
		const setupCompleteBefore = await new OptionsRepository(emdash.db).get("emdash:setup_complete");
		const user = await handleOAuthCallback(config, adapter, provider, code, state, stateStore);
		if (setupCompleteBefore !== true && setupCompleteBefore !== "true") {
			await finalizeSetup(emdash.db);
			console.log(`[oauth] Setup complete: created admin user via ${provider} (${user.email})`);
		}
		if (session) session.set("user", { id: user.id });
		return redirect("/_emdash/admin");
	} catch (callbackError) {
		console.error("OAuth callback error:", callbackError);
		let message = "Authentication failed";
		let errorCode = "oauth_error";
		if (callbackError instanceof OAuthError) {
			errorCode = callbackError.code;
			switch (callbackError.code) {
				case "invalid_state":
					message = "OAuth session expired or invalid. Please try again.";
					break;
				case "signup_not_allowed":
					message = "Self-signup is not allowed for your email. Please contact an administrator.";
					break;
				case "user_not_found":
					message = "Your account was not found. It may have been deleted.";
					break;
				case "token_exchange_failed":
					message = "Failed to complete authentication. Please try again.";
					break;
				case "profile_fetch_failed":
					message = "Failed to retrieve your profile. Please try again.";
					break;
				default:
					message = "Authentication failed. Please try again.";
					break;
			}
		}
		return redirect(`/_emdash/admin/login?error=${errorCode}&message=${encodeURIComponent(message)}`);
	}
};

//#endregion
export { GET, prerender };
//# sourceMappingURL=callback.mjs.map