import { NextRequest, NextResponse } from "next/server";
import { createClient } from "@/lib/supabase/server";

export async function GET(req: NextRequest) {
  const code = req.nextUrl.searchParams.get("code");
  const error = req.nextUrl.searchParams.get("error");
  const portalProfile = new URL("/portal/profile", req.url);

  if (error || !code) {
    portalProfile.searchParams.set("google", "denied");
    return NextResponse.redirect(portalProfile);
  }

  // Verify the user is logged in
  const supabase = await createClient();
  const { data: { user } } = await supabase.auth.getUser();
  if (!user) {
    return NextResponse.redirect(new URL("/login", req.url));
  }

  const clientId = process.env.GOOGLE_OAUTH_CLIENT_ID!;
  const clientSecret = process.env.GOOGLE_OAUTH_CLIENT_SECRET!;
  const origin = req.nextUrl.origin;
  const redirectUri = `${origin}/api/auth/google/callback`;

  try {
    // Exchange authorization code for tokens
    const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({
        code,
        client_id: clientId,
        client_secret: clientSecret,
        redirect_uri: redirectUri,
        grant_type: "authorization_code",
      }),
    });

    const tokens = await tokenRes.json();
    if (!tokenRes.ok || !tokens.refresh_token) {
      console.error("Google token exchange failed:", tokens);
      portalProfile.searchParams.set("google", "error");
      return NextResponse.redirect(portalProfile);
    }

    // Get the Google account email (optional, for display)
    let googleEmail: string | null = null;
    try {
      const infoRes = await fetch("https://www.googleapis.com/oauth2/v2/userinfo", {
        headers: { Authorization: `Bearer ${tokens.access_token}` },
      });
      const info = await infoRes.json();
      googleEmail = info.email ?? null;
    } catch {
      // Non-critical
    }

    // Store the refresh token
    const { error: dbError } = await supabase
      .from("google_tokens")
      .upsert({
        volunteer_id: user.id,
        refresh_token: tokens.refresh_token,
        email: googleEmail,
        connected_at: new Date().toISOString(),
      });

    if (dbError) {
      console.error("Failed to store Google token:", dbError);
      portalProfile.searchParams.set("google", "error");
      return NextResponse.redirect(portalProfile);
    }

    portalProfile.searchParams.set("google", "connected");
    return NextResponse.redirect(portalProfile);
  } catch (e) {
    console.error("Google OAuth error:", e);
    portalProfile.searchParams.set("google", "error");
    return NextResponse.redirect(portalProfile);
  }
}