// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
// GET /auth/dev-login?email=…&return_to=…: a sign-in for a developer with no identity provider.
// @conusai-kit/auth refuses to build it in a production deployment, and refuses again at boot if
// AUTH_DEV_LOGIN is set there, so this route cannot become a way in (spec §7).
import { createDevLogin, loadAuthConfig } from "@conusai-kit/auth"
import { authRoutes, webRuntime } from "../../../src/server/app"
import { safeReturnTo, signInErrorHref } from "../../../src/server/auth-errors"
import { authResponse, redirectTo } from "../../../src/server/auth-response"

export const dynamic = "force-dynamic"
export const runtime = "nodejs"

export async function GET(request: Request): Promise<Response> {
  const config = loadAuthConfig()
  if (!config.devLogin) return new Response("dev login is not enabled for this deployment", { status: 404 })
  return authResponse(request, async () => {
    const runtime = webRuntime()
    const data = runtime.authData ?? runtime.data
    if (!data) throw new Error("The selected profile has no auth data source")
    const { sessions } = await authRoutes()
    const response = await createDevLogin({ config, data, sessions }).signIn(request)
    // An address the adapter would not take is a failed sign-in like any other, not a bare 400.
    if (response.status === 400) return redirectTo(signInErrorHref("failed"))
    // The adapter always lands on `/`; the person was going somewhere (the invitation they were sent).
    const target = safeReturnTo(new URL(request.url).searchParams.get("return_to"))
    if (response.status !== 302 || target === "/") return response
    const headers = new Headers(response.headers)
    headers.set("location", target)
    return new Response(null, { status: 302, headers })
  })
}