import { NextRequest, NextResponse } from 'next/server'
import {
  createDingtalkLoginHandoff,
  DINGTALK_LOGIN_HANDOFF_COOKIE,
} from '@/lib/dingtalk-login-handoff'
import { getTrustedDingtalkReturnOriginFromRequest } from '@/lib/dingtalk-return-origin'
import { normalizeInternalRedirectPath } from '@/lib/safe-redirect'
import { resolveSecureAuthCookieFromRequest } from '@/lib/auth-cookie'

export const runtime = 'nodejs'
export const dynamic = 'force-dynamic'

export async function POST(request: NextRequest) {
  const trustedOrigin = getTrustedDingtalkReturnOriginFromRequest(request)

  // 公网登录不需要、也不能创建内网回跳票据；保持既有的公网登录流程。
  if (!trustedOrigin) {
    return NextResponse.json(
      { success: true, enabled: false },
      { headers: { 'Cache-Control': 'no-store' } },
    )
  }

  const body = await request.json().catch(() => ({}))
  const handoff = await createDingtalkLoginHandoff({
    returnOrigin: trustedOrigin,
    redirectPath: normalizeInternalRedirectPath(body?.redirectPath),
  })

  const response = NextResponse.json(
    {
      success: true,
      enabled: true,
      handoffId: handoff.id,
    },
    { headers: { 'Cache-Control': 'no-store' } },
  )

  response.cookies.set(DINGTALK_LOGIN_HANDOFF_COOKIE, handoff.binding, {
    httpOnly: true,
    sameSite: 'lax',
    secure: resolveSecureAuthCookieFromRequest(request),
    path: '/api/dingtalk/session-ticket',
    maxAge: 5 * 60,
  })

  return response
}