"use server";

import "server-only";
import { signIn, signOut } from "@/lib/auth";
import { redirect } from "next/navigation";

/**
 * Sign out and clear the Neon Auth session cookie.
 */
export async function signOutAction(): Promise<void> {
  console.log("[auth/sign-out] Signing out");
  await signOut();
  redirect("/login");
}

/**
 * Kick off a Google OAuth sign-in. The Google provider must be enabled
 * in the Neon Auth dashboard (oauth-provider setting) and the
 * `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` env vars must be set
 * in the runtime environment.
 *
 * Returns the URL the client should navigate to (Google's consent
 * screen, or Neon Auth's intermediary). The client should do
 * `window.location.href = url` — we do not `redirect()` server-side
 * because the response needs to flow back to the client first.
 */
export async function signInWithGoogleAction(input: {
  callbackURL?: string;
  errorCallbackURL?: string;
}): Promise<{ url: string | null; error: string | null }> {
  const callbackURL = input.callbackURL ?? "/admin";
  const errorCallbackURL = input.errorCallbackURL ?? "/login?error=oauth";

  try {
    // Neon Auth's better-auth client returns `{ data, error }`. For
    // social sign-in, `data` is `{ redirect, url, token?, user? }`.
    // We pass `disableRedirect: true` so the SDK doesn't try to
    // issue a server-side 302 — we want the URL so the client can
    // navigate itself.
    const result = await signIn.social({
      provider: "google",
      callbackURL,
      errorCallbackURL,
    });

    if (result.error) {
      console.error("[auth/google] signIn.social error:", result.error);
      return {
        url: null,
        error:
          result.error.message ??
          result.error.code ??
          "Could not start Google sign-in.",
      };
    }

    const url = result.data?.url ?? null;
    if (!url) {
      return {
        url: null,
        error: "Google sign-in returned no redirect URL.",
      };
    }
    return { url, error: null };
  } catch (err) {
    console.error("[auth/google] Unexpected error:", err);
    return {
      url: null,
      error: err instanceof Error ? err.message : "An unexpected error occurred.",
    };
  }
}
