// pages/api/auth/apple.js
import jwt from 'jsonwebtoken';
import axios from 'axios';
import fs from 'fs';
import path from 'path';

const dotenv = require("dotenv");

export default async function handler(req, res) {
    if (req.method === 'GET') {
        // Generate the client secret
        const clientSecret = generateClientSecret();
        // const redirectUri = `${req.headers.origin}/api/auth/apple/callback`;
        const redirectUri = `https://sofia.mwitnessing.com/api/auth/callback/apple`;

        // Redirect to Apple's authorization page
        const url = `https://appleid.apple.com/auth/authorize?response_type=code&client_id=${process.env.APPLE_APP_ID}&redirect_uri=${encodeURIComponent(redirectUri)}&scope=email&response_mode=form_post&state=initial&usePopup=true&client_secret=${encodeURIComponent(clientSecret)}`;
        res.redirect(url);
    } else {
        res.status(405).json({ error: 'Method not allowed' });
    }
}

function generateClientSecret() {
    const appleKey = fs.readFileSync(path.resolve('./_deploy/appleKey.p8'), 'utf8');
    const teamID = process.env.APPLE_TEAM_ID || "XC57P9SXDK";
    const keyID = process.env.APPLE_KEY_ID || "TB3V355G5Y";
    const appleAppID = process.env.APPLE_APP_ID;

    // Token expiration
    const now = Math.floor(Date.now() / 1000);
    const exp = now + 86400 * 180;  // 6 months

    const claims = {
        iss: teamID,
        iat: now,
        exp: exp,
        aud: 'https://appleid.apple.com',
        sub: appleAppID,
    };

    const token = jwt.sign(claims, appleKey, { algorithm: 'ES256', header: { alg: 'ES256', kid: keyID } });
    console.log("generated new token:" + token);
    return token;
}
