import { SPOTIFY_CLIENT_ID } from '$app/env/private';
import { error, redirect } from '@sveltejs/kit';
import { requireOwner } from '#lib/server/owner.js';
import {
	authorizeUrl,
	CALLBACK_PATH,
	publicOrigin,
	STATE_COOKIE
} from '#lib/server/music/oauth.js';
import type { RequestHandler } from './$types';

// Owner only: start the Spotify Authorization Code flow for the listening tracker.
export const GET: RequestHandler = (event) => {
	requireOwner(event);
	const { url, cookies } = event;
	// The state cookie must be set on the host Spotify redirects back to.
	if (url.hostname === 'www.stanrunge.dev')
		redirect(302, 'https://stanrunge.dev/api/spotify/connect');
	if (!SPOTIFY_CLIENT_ID) error(503, 'Spotify is not configured on this server.');
	const state = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
	cookies.set(STATE_COOKIE, state, {
		path: '/api/spotify',
		httpOnly: true,
		secure: true,
		sameSite: 'lax',
		maxAge: 600
	});
	redirect(302, authorizeUrl(SPOTIFY_CLIENT_ID, `${publicOrigin(url)}${CALLBACK_PATH}`, state));
};