const crypto = require('crypto');

// Langkah 1 OAuth2: arahkan pengguna ke halaman login GitHub.
module.exports = function handler(req, res) {
  const { GITHUB_CLIENT_ID, CALLBACK_URL } = process.env;
  if (!GITHUB_CLIENT_ID || !CALLBACK_URL) {
    res.status(500).json({ error: 'GITHUB_CLIENT_ID / CALLBACK_URL belum diatur di environment' });
    return;
  }

  // Cookie state hanya terkirim ke host yang sama dengan CALLBACK_URL, jadi login harus dimulai di host itu.
  const callbackUrl = new URL(CALLBACK_URL);
  if (req.headers.host !== callbackUrl.host) {
    res.redirect(`${callbackUrl.origin}/auth/login`);
    return;
  }

  // state acak disimpan di cookie lalu dicocokkan di /auth/callback (anti login-CSRF).
  const state = crypto.randomBytes(16).toString('hex');
  const secure = process.env.NODE_ENV === 'production' ? '; Secure' : '';
  res.setHeader(
    'Set-Cookie',
    `oauth_state=${state}; HttpOnly; SameSite=Lax; Path=/; Max-Age=600${secure}`
  );

  const params = new URLSearchParams({
    client_id: GITHUB_CLIENT_ID,
    redirect_uri: CALLBACK_URL,
    state,
  });
  res.redirect(`https://github.com/login/oauth/authorize?${params}`);
};