// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
// GET /auth/sign-in/start: the redirect to the identity provider (spec §7). The transaction cookie it
// sets carries the state, the nonce and the PKCE verifier, sealed; the browser gets no token. The
// page people see before it is /auth/sign-in. A deployment with no provider has nothing to redirect
// to, and sends the visitor back to that page, which says so.
import { loadAuthConfig } from "@conusai-kit/auth"
import { authRoutes } from "../../../../src/server/app"
import { authResponse, redirectTo } from "../../../../src/server/auth-response"

export const dynamic = "force-dynamic"
export const runtime = "nodejs"

export async function GET(request: Request): Promise<Response> {
  if (!loadAuthConfig().oidc) return redirectTo("/auth/sign-in")
  return authResponse(request, async () => (await authRoutes()).signIn(request))
}