import { jsonOk } from "@/lib/api/errors";
import { isOidcConfigured } from "@/lib/auth/oidc";

/**
 * Public auth diagnostics (no secrets).
 * Useful to verify the running container sees OIDC env vars.
 */
export async function GET() {
  const authUrl = (process.env.AUTH_URL || "").replace(/\/$/, "");
  const oidcEnabled = isOidcConfigured();

  return jsonOk({
    oidcEnabled,
    oidcName: process.env.AUTH_OIDC_NAME || "SSO",
    issuer: process.env.AUTH_OIDC_ISSUER || null,
    clientIdSet: Boolean(process.env.AUTH_OIDC_CLIENT_ID?.trim()),
    clientSecretSet: Boolean(process.env.AUTH_OIDC_CLIENT_SECRET?.trim()),
    authUrl: authUrl || null,
    authSecretSet: Boolean(
      process.env.AUTH_SECRET?.trim() &&
        process.env.AUTH_SECRET !== "change-me-to-a-long-random-string"
    ),
    callbackUrl: authUrl
      ? `${authUrl}/api/auth/callback/oidc`
      : "/api/auth/callback/oidc",
    hint: oidcEnabled
      ? "OIDC looks configured. Register callbackUrl exactly in your IdP."
      : "Set AUTH_OIDC_ISSUER, AUTH_OIDC_CLIENT_ID, and AUTH_OIDC_CLIENT_SECRET, then restart.",
  });
}