// app/api/auth/roblox/callback/route.js
import { NextResponse } from "next/server";
import { supabaseServer } from "@/utils/supabase/server";
import { createSessionToken } from "@/utils/auth";

async function postForm(url, data) {
  return fetch(url, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams(data).toString(),
  });
}

export async function GET(req) {
  try {
    const url = new URL(req.url);
    const code = url.searchParams.get("code");
    const returnedState = url.searchParams.get("state");

    if (!code) return new Response("Missing oauth code", { status: 400 });

    const cookieState = req.cookies.get("rbx_oauth_state")?.value;
    if (!cookieState || cookieState !== returnedState) {
      return new Response("Invalid state (possible CSRF)", { status: 400 });
    }

    const tokenRes = await postForm("https://apis.roblox.com/oauth/v1/token", {
      grant_type: "authorization_code",
      code,
      client_id: process.env.ROBLOX_CLIENT_ID,
      client_secret: process.env.ROBLOX_CLIENT_SECRET,
      redirect_uri: process.env.ROBLOX_REDIRECT_URI,
    });

    if (!tokenRes.ok) {
      const txt = await tokenRes.text();
      console.error("Roblox token exchange failed:", tokenRes.status, txt);
      return new Response("Failed to exchange token", { status: 500 });
    }

    const tokenData = await tokenRes.json();
    const accessToken = tokenData.access_token;
    if (!accessToken) {
      console.error("No access token in token response", tokenData);
      return new Response("Failed to get access token", { status: 500 });
    }

    const profileRes = await fetch("https://apis.roblox.com/oauth/v1/userinfo", {
      headers: { Authorization: `Bearer ${accessToken}` },
    });

    if (!profileRes.ok) {
      const txt = await profileRes.text();
      console.error("Roblox userinfo failed:", profileRes.status, txt);
      return new Response("Failed to fetch userinfo", { status: 500 });
    }

    const profile = await profileRes.json();
    const robloxId = profile.sub || profile.id || profile.userId || profile.user_id;
    if (!robloxId) {
      console.error("Failed to parse roblox id from profile:", profile);
      return new Response("Invalid userinfo", { status: 500 });
    }

    const supabase = supabaseServer();
    const { data: allowed, error } = await supabase
      .from("allowed_users")
      .select("roblox_user_id")
      .eq("roblox_user_id", String(robloxId))
      .maybeSingle();

    if (error) {
      console.error("DB error checking allowed_users:", error);
      return new Response("Server error", { status: 500 });
    }

    if (!allowed) {
      const res = NextResponse.json({ error: "Unauthorized" }, { status: 401 });
      res.cookies.set("rbx_oauth_state", "", { path: "/", maxAge: 0 });
      return res;
    }

    const token = createSessionToken({ robloxId, expiresInSeconds: 7 * 24 * 3600 });
    const redirectUrl = new URL("/dashboard", req.url);
    const response = NextResponse.redirect(redirectUrl);

    response.cookies.set("session", token, {
      httpOnly: true,
      secure: process.env.NODE_ENV === "production",
      sameSite: "lax",
      path: "/",
      maxAge: 7 * 24 * 3600,
    });

    response.cookies.set("rbx_oauth_state", "", { path: "/", maxAge: 0 });

    return response;
  } catch (err) {
    console.error("OAuth callback error:", err);
    return new Response("Internal server error", { status: 500 });
  }
}

utils/queries/robloxIDtoUser.js - getUsernames: HIT!
utils/queries/games.js - getGames: HIT!
utils/queries/gameRevenueTotals.js - getRevenueData: HIT!
utils/queries/robloxIDtoUser.js - getUsernames: HIT!
utils/queries/games.js - getGames: HIT!
utils/queries/jobOffers.js - getJobOffers: HIT!
utils/queries/games.js - getGames: HIT!

utils/queries/robloxIDtoUser.js - getUsernames: HIT!
 Cache  utils/queries/robloxIDtoUser.js - getUsernames: HIT!
utils/queries/games.js - getGames: HIT!
 Cache  utils/queries/games.js - getGames: HIT!
utils/queries/gameRevenueTotals.js - getRevenueData: HIT!
 Cache  utils/queries/gameRevenueTotals.js - getRevenueData: HIT!
utils/queries/robloxIDtoUser.js - getUsernames: HIT!
 Cache  utils/queries/robloxIDtoUser.js - getUsernames: HIT!
 Cache  utils/queries/robloxIDtoUser.js - getUsernames: HIT!
 Cache  utils/queries/games.js - getGames: HIT!
 Cache  utils/queries/gameRevenueTotals.js - getRevenueData: HIT!
 Cache  utils/queries/robloxIDtoUser.js - getUsernames: HIT!

export default function DashboardLayout({ children }) {
  return (
    <div className="h-screen p-8 antialiased overflow-hidden">
      <Suspense fallback={<div>Loading dashboard...</div>}>
          {children}
      </Suspense>
    </div>
  );
}