Authentication

"use client"

import { useState } from "react"
import { supabase } from "@/utils/supabase/client"
import { Button } from "@/components/atoms/button"
import { Loader2 } from "lucide-react"

export function AdminSignIn() {
  const [loading, setLoading] = useState(false)

  const handleGoogleSignIn = async () => {
    setLoading(true)
    try {
      const nextPath = "/admin/registrations"
      const cookieParts = [
        `rm-auth-next=${encodeURIComponent(nextPath)}`,
        "Path=/",
        "Max-Age=600",
        "SameSite=Lax",
      ]
      // Ensure the cookie survives redirects between www and apex domain
      const host = window.location.hostname
      if (host.endsWith("njrajatmahotsav.com")) {
        cookieParts.push("Domain=.njrajatmahotsav.com")
      }
      if (window.location.protocol === "https:") cookieParts.push("Secure")
      document.cookie = cookieParts.join("; ")

      const { error } = await supabase.auth.signInWithOAuth({
        provider: "google",
        options: {
          redirectTo: `${window.location.origin}/auth/callback`,
        },
      })
      if (error) throw error
    } catch (err) {
      console.error("Sign-in error:", err)
      setLoading(false)
    }
  }

  return (
    <div className="flex flex-col items-center gap-6">
      <Button
        onClick={handleGoogleSignIn}
        disabled={loading}
        className="inline-flex items-center gap-2 rounded-full px-8 py-4"
      >
        {loading ? (
          <Loader2 className="size-5 animate-spin" />
        ) : (
          <svg className="size-5" viewBox="0 0 24 24">
            {/* Google icon SVG paths */}
          </svg>
        )}
        {loading ? "Signing in…" : "Sign in with Google"}
      </Button>
      <p className="text-sm text-gray-600 max-w-xs text-center">
        Access restricted to @nj.sgadi.us accounts
      </p>
    </div>
  )
}

import { NextResponse } from "next/server"
import { cookies } from "next/headers"
import { createClient } from "@/utils/supabase/server"

/**
 * OAuth callback route. Exchanges auth code for session and redirects.
 */
export async function GET(request: Request) {
  const { searchParams, origin } = new URL(request.url)
  const code = searchParams.get("code")
  const queryNext = searchParams.get("next")
  let next = queryNext ?? "/"
  
  // Check cookie for redirect path
  if (!queryNext) {
    const cookieStore = await cookies()
    const cookieNext = cookieStore.get("rm-auth-next")?.value
    if (cookieNext) next = decodeURIComponent(cookieNext)
  }
  
  // Validate redirect path (prevent open redirects)
  if (!next.startsWith("/") || next.includes("//") || next.includes(":")) {
    next = "/"
  }

  if (!code) {
    return NextResponse.redirect(`${origin}/auth/auth-code-error`)
  }

  const supabase = await createClient()
  const { error } = await supabase.auth.exchangeCodeForSession(code)

  if (error) {
    console.error("[auth/callback] exchangeCodeForSession error:", error.message)
    return NextResponse.redirect(`${origin}/auth/auth-code-error`)
  }

  const forwardedHost = request.headers.get("x-forwarded-host")
  const requestHost = request.headers.get("host")
  const effectiveHost = forwardedHost ?? requestHost ?? new URL(request.url).host
  const isLocalEnv = process.env.NODE_ENV === "development"

  const redirectUrl = isLocalEnv
    ? `${origin}${next}`
    : forwardedHost
      ? `https://${forwardedHost}${next}`
      : `${origin}${next}`

  const response = NextResponse.redirect(redirectUrl)
  
  // Clear the redirect cookie
  const clearCookieOptions: Parameters<typeof response.cookies.set>[2] = {
    path: "/",
    maxAge: 0,
  }
  if (effectiveHost.endsWith("njrajatmahotsav.com")) {
    clearCookieOptions.domain = ".njrajatmahotsav.com"
  }
  response.cookies.set("rm-auth-next", "", clearCookieOptions)
  
  return response
}

const ALLOWED_DOMAIN = "@nj.sgadi.us"

/**
 * Checks if the given email is allowed for admin access.
 * @param email - User email (e.g. from session.user.email)
 * @returns true if email ends with @nj.sgadi.us (case-insensitive)
 */
export function isAllowedAdminDomain(email: string | null | undefined): boolean {
  if (!email || typeof email !== "string") return false
  return email.toLowerCase().endsWith(ALLOWED_DOMAIN.toLowerCase())
}

/**
 * Checks if the given user has an allowed admin domain email.
 * @param user - User object with optional email (e.g. from session.user)
 * @returns true if user exists and email ends with @nj.sgadi.us
 */
export function isAdminDomainUser(user: { email?: string | null } | null | undefined): boolean {
  return isAllowedAdminDomain(user?.email)
}