import { NextResponse } from "next/server";
import { getAuthSettings } from "@/lib/db/queries";

export async function GET(request: Request) {
  const settings = await getAuthSettings();
  
  if (!settings.isDingTalkEnabled || !settings.dingTalkAppKey) {
    return NextResponse.json({ error: "DingTalk login is not enabled" }, { status: 400 });
  }

  // 动态构建回调地址
  const host = request.headers.get("host");
  const protocol = request.headers.get("x-forwarded-proto") || "http";
  const baseUrl = `${protocol}://${host}`;
  const redirectUri = `${baseUrl}/dingtalk-callback.html`;
  
  const state = Math.random().toString(36).substring(7);
  
  // 钉钉 OAuth 2.0 授权地址
  const url = `https://login.dingtalk.com/oauth2/auth?` +
    `redirect_uri=${encodeURIComponent(redirectUri)}&` +
    `response_type=code&` +
    `client_id=${settings.dingTalkAppKey}&` +
    `scope=openid&` +
    `state=${state}&` +
    `prompt=consent`;

  return NextResponse.redirect(url);
}