/**
 * GET /api/auth/steam/callback — Steam OpenID return_to.
 */
import {
  createSessionToken,
  envOf,
  fetchSteamPersona,
  sessionCookieHeaderForRequest,
  steamId64ToAccountId,
  verifySteamOpenId,
} from "../_steam_common.js";

export async function onRequestGet(context) {
  const env = envOf(context);
  const secret = (env.SESSION_SECRET || "").trim();
  const apiKey = (env.STEAM_API_KEY || "").trim();
  const origin = new URL(context.request.url).origin;

  if (!secret || !apiKey) {
    return Response.redirect(`${origin}/?auth=unconfigured`, 302);
  }

  const url = new URL(context.request.url);
  let verified;
  try {
    verified = await verifySteamOpenId(url.searchParams);
  } catch {
    return Response.redirect(`${origin}/?auth=error`, 302);
  }
  if (!verified.ok) {
    return Response.redirect(`${origin}/?auth=denied`, 302);
  }

  const steamid = verified.steamid;
  const accountId = steamId64ToAccountId(steamid);
  if (!accountId) {
    return Response.redirect(`${origin}/?auth=error`, 302);
  }

  const persona = await fetchSteamPersona(apiKey, steamid);
  const token = await createSessionToken(secret, {
    steamid,
    account_id: accountId,
    personaname: persona.personaname,
    avatar: persona.avatar,
  });

  return new Response(null, {
    status: 302,
    headers: {
      Location: `${origin}/home`,
      "Set-Cookie": sessionCookieHeaderForRequest(context.request, token),
      "Cache-Control": "no-store",
    },
  });
}