// ID Token の完全な検証実装
import { jwtVerify, createRemoteJWKSet, JWTVerifyResult } from 'jose';
 
// Google の JWKS URL
const GOOGLE_JWKS = createRemoteJWKSet(
  new URL('https://www.googleapis.com/oauth2/v3/certs')
);
 
// JWKS のキャッシュ設定（jose ライブラリ内蔵）
// デフォルトで鍵はキャッシュされ、kid が見つからない場合に再取得される
 
interface VerifiedIdToken {
  sub: string;
  email: string;
  name: string;
  picture: string;
  emailVerified: boolean;
  authTime?: number;
  amr?: string[];
}
 
async function verifyIdToken(
  idToken: string,
  expectedNonce: string,
  options?: {
    maxAge?: number; // 秒
    requiredAmr?: string[]; // 必要な認証方式
  }
): Promise<VerifiedIdToken> {
  // Step 1-5: jose ライブラリが自動で検証
  // - JWT 形式チェック
  // - 署名検証（JWKS から公開鍵を取得）
  // - issuer の検証
  // - audience の検証
  // - exp の検証
  let result: JWTVerifyResult;
  try {
    result = await jwtVerify(idToken, GOOGLE_JWKS, {
      issuer: 'https://accounts.google.com',
      audience: process.env.GOOGLE_CLIENT_ID!,
      algorithms: ['RS256'],
      clockTolerance: 5, // 5秒のクロックスキュー許容
    });
  } catch (error) {
    if (error instanceof Error) {
      throw new Error(`ID Token verification failed: ${error.message}`);
    }
    throw error;
  }
 
  const { payload } = result;
 
  // Step 6: iat の追加検証
  if (payload.iat && payload.iat > Date.now() / 1000 + 5) {
    throw new Error('ID Token was issued in the future');
  }
 
  // Step 7: nonce の検証（リプレイ攻撃防止）
  if (payload.nonce !== expectedNonce) {
    throw new Error('Invalid nonce - possible replay attack');
  }
 
  // Step 8: auth_time の検証（max_age が指定された場合）
  if (options?.maxAge) {
    const authTime = payload.auth_time as number | undefined;
    if (!authTime) {
      throw new Error('auth_time claim is required when maxAge is specified');
    }
    if (Date.now() / 1000 - authTime > options.maxAge) {
      throw new Error(
        `Authentication is too old (${Math.floor(Date.now() / 1000 - authTime)}s > ${options.maxAge}s)`
      );
    }
  }
 
  // 追加: amr（認証方式）の検証
  if (options?.requiredAmr) {
    const amr = payload.amr as string[] | undefined;
    if (!amr) {
      throw new Error('amr claim is required');
    }
    for (const required of options.requiredAmr) {
      if (!amr.includes(required)) {
        throw new Error(`Required authentication method not used: ${required}`);
      }
    }
  }
 
  return {
    sub: payload.sub!,
    email: payload.email as string,
    name: payload.name as string,
    picture: payload.picture as string,
    emailVerified: payload.email_verified as boolean,
    authTime: payload.auth_time as number | undefined,
    amr: payload.amr as string[] | undefined,
  };
}

// JWKS キャッシュの手動実装（jose ライブラリ内蔵のキャッシュを使わない場合）
class JWKSCache {
  private keys: Map<string, CryptoKey> = new Map();
  private lastFetch: number = 0;
  private readonly cacheDuration = 24 * 60 * 60 * 1000; // 24時間
 
  constructor(private jwksUrl: string) {}
 
  async getKey(kid: string): Promise<CryptoKey> {
    // キャッシュにある場合はそれを返す
    if (this.keys.has(kid) && Date.now() - this.lastFetch < this.cacheDuration) {
      return this.keys.get(kid)!;
    }
 
    // JWKS を再取得
    await this.refresh();
 
    const key = this.keys.get(kid);
    if (!key) {
      throw new Error(`Key with kid "${kid}" not found in JWKS`);
    }
 
    return key;
  }
 
  private async refresh(): Promise<void> {
    const res = await fetch(this.jwksUrl);
    const jwks = await res.json();
 
    this.keys.clear();
    for (const jwk of jwks.keys) {
      const key = await crypto.subtle.importKey(
        'jwk',
        jwk,
        { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
        false,
        ['verify']
      );
      this.keys.set(jwk.kid, key);
    }
 
    this.lastFetch = Date.now();
  }
}

// OIDC Discovery を活用した汎用プロバイダー
interface OIDCConfig {
  issuer: string;
  authorization_endpoint: string;
  token_endpoint: string;
  userinfo_endpoint: string;
  jwks_uri: string;
  scopes_supported: string[];
  response_types_supported: string[];
  id_token_signing_alg_values_supported: string[];
  token_endpoint_auth_methods_supported: string[];
  claims_supported: string[];
  revocation_endpoint?: string;
  end_session_endpoint?: string;
}
 
class OIDCProvider {
  private config: OIDCConfig | null = null;
  private configFetchedAt: number = 0;
  private readonly configCacheDuration = 24 * 60 * 60 * 1000; // 24時間
 
  constructor(
    private issuerUrl: string,
    private clientId: string,
    private clientSecret: string
  ) {}
 
  // Discovery で設定を取得（キャッシュ付き）
  async discover(): Promise<OIDCConfig> {
    if (
      this.config &&
      Date.now() - this.configFetchedAt < this.configCacheDuration
    ) {
      return this.config;
    }
 
    const url = `${this.issuerUrl}/.well-known/openid-configuration`;
    const res = await fetch(url);
 
    if (!res.ok) {
      throw new Error(`OIDC Discovery failed: ${res.status} ${res.statusText}`);
    }
 
    this.config = await res.json();
    this.configFetchedAt = Date.now();
 
    // issuer の一致を検証
    if (this.config!.issuer !== this.issuerUrl) {
      throw new Error(
        `Issuer mismatch: expected ${this.issuerUrl}, got ${this.config!.issuer}`
      );
    }
 
    return this.config!;
  }
 
  // 認可 URL を生成
  async getAuthorizationUrl(
    redirectUri: string,
    state: string,
    nonce: string,
    options?: {
      scope?: string;
      prompt?: 'none' | 'login' | 'consent' | 'select_account';
      loginHint?: string;
      maxAge?: number;
      acrValues?: string;
    }
  ): Promise<string> {
    const config = await this.discover();
    const params = new URLSearchParams({
      response_type: 'code',
      client_id: this.clientId,
      redirect_uri: redirectUri,
      scope: options?.scope || 'openid email profile',
      state,
      nonce,
    });
 
    // オプションパラメータ
    if (options?.prompt) params.set('prompt', options.prompt);
    if (options?.loginHint) params.set('login_hint', options.loginHint);
    if (options?.maxAge !== undefined) params.set('max_age', String(options.maxAge));
    if (options?.acrValues) params.set('acr_values', options.acrValues);
 
    return `${config.authorization_endpoint}?${params}`;
  }
 
  // トークン交換
  async exchangeCode(
    code: string,
    redirectUri: string
  ): Promise<{
    accessToken: string;
    idToken: string;
    refreshToken?: string;
    expiresIn: number;
    tokenType: string;
  }> {
    const config = await this.discover();
    const res = await fetch(config.token_endpoint, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'authorization_code',
        code,
        redirect_uri: redirectUri,
        client_id: this.clientId,
        client_secret: this.clientSecret,
      }),
    });
 
    if (!res.ok) {
      const error = await res.json();
      throw new Error(
        `Token exchange failed: ${error.error} - ${error.error_description}`
      );
    }
 
    const data = await res.json();
    return {
      accessToken: data.access_token,
      idToken: data.id_token,
      refreshToken: data.refresh_token,
      expiresIn: data.expires_in,
      tokenType: data.token_type,
    };
  }
 
  // UserInfo エンドポイント
  async getUserInfo(accessToken: string): Promise<Record<string, any>> {
    const config = await this.discover();
    const res = await fetch(config.userinfo_endpoint, {
      headers: { Authorization: `Bearer ${accessToken}` },
    });
 
    if (!res.ok) {
      throw new Error(`UserInfo request failed: ${res.status}`);
    }
 
    return res.json();
  }
 
  // トークンの無効化
  async revokeToken(token: string, tokenTypeHint?: 'access_token' | 'refresh_token') {
    const config = await this.discover();
    if (!config.revocation_endpoint) {
      throw new Error('Revocation endpoint not supported');
    }
 
    const body = new URLSearchParams({
      token,
      client_id: this.clientId,
      client_secret: this.clientSecret,
    });
    if (tokenTypeHint) body.set('token_type_hint', tokenTypeHint);
 
    await fetch(config.revocation_endpoint, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body,
    });
  }
 
  // OIDC ログアウト
  async getLogoutUrl(idTokenHint: string, postLogoutRedirectUri: string): Promise<string | null> {
    const config = await this.discover();
    if (!config.end_session_endpoint) return null;
 
    const params = new URLSearchParams({
      id_token_hint: idTokenHint,
      post_logout_redirect_uri: postLogoutRedirectUri,
      client_id: this.clientId,
    });
 
    return `${config.end_session_endpoint}?${params}`;
  }
}
 
// 使用例: 複数プロバイダーの一元管理
const providers = {
  google: new OIDCProvider(
    'https://accounts.google.com',
    process.env.GOOGLE_CLIENT_ID!,
    process.env.GOOGLE_CLIENT_SECRET!
  ),
  microsoft: new OIDCProvider(
    'https://login.microsoftonline.com/common/v2.0',
    process.env.MICROSOFT_CLIENT_ID!,
    process.env.MICROSOFT_CLIENT_SECRET!
  ),
  auth0: new OIDCProvider(
    `https://${process.env.AUTH0_DOMAIN}`,
    process.env.AUTH0_CLIENT_ID!,
    process.env.AUTH0_CLIENT_SECRET!
  ),
};

// Auth0 でカスタムクレームを追加する例
// Auth0 の Action / Rule で設定
 
// Action: Login / Post Login
exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'https://myapp.com/claims';
 
  // カスタムクレームを ID Token に追加
  api.idToken.setCustomClaim(`${namespace}/roles`, event.authorization?.roles || []);
  api.idToken.setCustomClaim(`${namespace}/org_id`, event.user.app_metadata?.org_id);
  api.idToken.setCustomClaim(`${namespace}/permissions`, event.authorization?.permissions || []);
 
  // Access Token にもカスタムクレームを追加
  api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization?.roles || []);
};
 
// クライアント側でカスタムクレームを使用
interface CustomIdTokenClaims {
  sub: string;
  email: string;
  name: string;
  'https://myapp.com/claims/roles': string[];
  'https://myapp.com/claims/org_id': string;
  'https://myapp.com/claims/permissions': string[];
}
 
function extractCustomClaims(payload: any): {
  roles: string[];
  orgId: string;
  permissions: string[];
} {
  const namespace = 'https://myapp.com/claims';
  return {
    roles: payload[`${namespace}/roles`] || [],
    orgId: payload[`${namespace}/org_id`] || '',
    permissions: payload[`${namespace}/permissions`] || [],
  };
}

// OIDC 認証フロー（Next.js App Router）
import crypto from 'crypto';
import { cookies } from 'next/headers';
import { redirect } from 'next/navigation';
import { jwtVerify, createRemoteJWKSet } from 'jose';
 
// PKCE: code_verifier と code_challenge の生成
function generatePKCE(): { codeVerifier: string; codeChallenge: string } {
  // code_verifier: 43-128文字のランダム文字列
  const codeVerifier = crypto.randomBytes(32).toString('base64url');
 
  // code_challenge: SHA256(code_verifier) の Base64URL エンコード
  const codeChallenge = crypto
    .createHash('sha256')
    .update(codeVerifier)
    .digest('base64url');
 
  return { codeVerifier, codeChallenge };
}
 
// GET /api/auth/login — 認証開始
export async function GET(request: Request) {
  const state = crypto.randomUUID();
  const nonce = crypto.randomUUID();
  const { codeVerifier, codeChallenge } = generatePKCE();
 
  // セッションに state, nonce, code_verifier を保存
  const cookieStore = await cookies();
  cookieStore.set('oauth_state', state, {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    maxAge: 600, // 10分
    path: '/',
  });
  cookieStore.set('oauth_nonce', nonce, {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    maxAge: 600,
    path: '/',
  });
  cookieStore.set('oauth_code_verifier', codeVerifier, {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    maxAge: 600,
    path: '/',
  });
 
  // 認可リクエスト URL の構築
  const provider = providers.google;
  const authUrl = await provider.getAuthorizationUrl(
    `${process.env.APP_URL}/api/auth/callback`,
    state,
    nonce,
    {
      prompt: 'select_account', // アカウント選択画面を表示
    }
  );
 
  // PKCE パラメータを追加
  const url = new URL(authUrl);
  url.searchParams.set('code_challenge', codeChallenge);
  url.searchParams.set('code_challenge_method', 'S256');
 
  return Response.redirect(url.toString());
}
 
// GET /api/auth/callback — コールバック処理
export async function GET(request: Request) {
  const url = new URL(request.url);
  const code = url.searchParams.get('code');
  const state = url.searchParams.get('state');
  const error = url.searchParams.get('error');
 
  // エラーチェック（ユーザーがキャンセルした場合等）
  if (error) {
    const errorDescription = url.searchParams.get('error_description') || 'Unknown error';
    console.error(`OIDC error: ${error} - ${errorDescription}`);
    return Response.redirect(`${process.env.APP_URL}/login?error=${error}`);
  }
 
  const cookieStore = await cookies();
  const storedState = cookieStore.get('oauth_state')?.value;
  const storedNonce = cookieStore.get('oauth_nonce')?.value;
  const codeVerifier = cookieStore.get('oauth_code_verifier')?.value;
 
  // state 検証（CSRF 防止）
  if (!code || !state || state !== storedState) {
    return Response.redirect(`${process.env.APP_URL}/login?error=invalid_state`);
  }
 
  if (!storedNonce || !codeVerifier) {
    return Response.redirect(`${process.env.APP_URL}/login?error=missing_session`);
  }
 
  try {
    // トークン交換（code_verifier を含む）
    const tokens = await providers.google.exchangeCode(
      code,
      `${process.env.APP_URL}/api/auth/callback`
    );
 
    // ID Token 検証
    const userInfo = await verifyIdToken(tokens.idToken, storedNonce, {
      maxAge: 3600, // 1時間以内の認証を要求
    });
 
    // ユーザーの作成 or 更新（Upsert）
    const dbUser = await prisma.user.upsert({
      where: {
        provider_providerId: {
          provider: 'google',
          providerId: userInfo.sub,
        },
      },
      create: {
        email: userInfo.email,
        name: userInfo.name,
        avatar: userInfo.picture,
        provider: 'google',
        providerId: userInfo.sub,
        emailVerified: userInfo.emailVerified ? new Date() : null,
      },
      update: {
        name: userInfo.name,
        avatar: userInfo.picture,
        emailVerified: userInfo.emailVerified ? new Date() : null,
        lastLoginAt: new Date(),
      },
    });
 
    // セッション作成
    const sessionToken = await createSession(dbUser.id);
 
    // Cookie クリーンアップ
    cookieStore.delete('oauth_state');
    cookieStore.delete('oauth_nonce');
    cookieStore.delete('oauth_code_verifier');
 
    // セッション Cookie 設定
    cookieStore.set('session', sessionToken, {
      httpOnly: true,
      secure: true,
      sameSite: 'lax',
      maxAge: 30 * 24 * 60 * 60, // 30日
      path: '/',
    });
 
    return Response.redirect(`${process.env.APP_URL}/dashboard`);
  } catch (error) {
    console.error('OIDC callback error:', error);
    return Response.redirect(`${process.env.APP_URL}/login?error=auth_failed`);
  }
}
 
// GET /api/auth/logout — ログアウト
export async function GET(request: Request) {
  const cookieStore = await cookies();
  const sessionToken = cookieStore.get('session')?.value;
 
  if (sessionToken) {
    // セッション削除
    await deleteSession(sessionToken);
 
    // IdP のログアウト URL を取得（オプション）
    const logoutUrl = await providers.google.getLogoutUrl(
      sessionToken, // ID Token Hint（保存している場合）
      `${process.env.APP_URL}/`
    );
 
    cookieStore.delete('session');
 
    if (logoutUrl) {
      return Response.redirect(logoutUrl);
    }
  }
 
  return Response.redirect(`${process.env.APP_URL}/`);
}

// 同一ユーザーが複数のプロバイダーでログインする場合
// schema.prisma のモデル設計
 
// model User {
//   id            String    @id @default(cuid())
//   email         String    @unique
//   name          String?
//   avatar        String?
//   accounts      Account[]
//   sessions      Session[]
// }
//
// model Account {
//   id                String  @id @default(cuid())
//   userId            String
//   provider          String  // "google", "github", "microsoft"
//   providerAccountId String  // IdP 側のユーザー ID
//   accessToken       String?
//   refreshToken      String?
//   expiresAt         Int?
//   tokenType         String?
//   scope             String?
//   idToken           String?
//
//   user User @relation(fields: [userId], references: [id])
//
//   @@unique([provider, providerAccountId])
// }
 
// アカウントリンクの実装
async function handleOIDCCallback(
  provider: string,
  userInfo: VerifiedIdToken,
  tokens: TokenResponse
) {
  // 1. 既存のアカウントリンクを確認
  const existingAccount = await prisma.account.findUnique({
    where: {
      provider_providerAccountId: {
        provider,
        providerAccountId: userInfo.sub,
      },
    },
    include: { user: true },
  });
 
  if (existingAccount) {
    // 既存アカウントでログイン
    await prisma.account.update({
      where: { id: existingAccount.id },
      data: {
        accessToken: tokens.accessToken,
        refreshToken: tokens.refreshToken,
        expiresAt: tokens.expiresIn ? Math.floor(Date.now() / 1000) + tokens.expiresIn : null,
        idToken: tokens.idToken,
      },
    });
    return existingAccount.user;
  }
 
  // 2. メールアドレスで既存ユーザーを検索
  if (userInfo.email && userInfo.emailVerified) {
    const existingUser = await prisma.user.findUnique({
      where: { email: userInfo.email },
    });
 
    if (existingUser) {
      // 既存ユーザーに新しいプロバイダーをリンク
      await prisma.account.create({
        data: {
          userId: existingUser.id,
          provider,
          providerAccountId: userInfo.sub,
          accessToken: tokens.accessToken,
          refreshToken: tokens.refreshToken,
          idToken: tokens.idToken,
        },
      });
      return existingUser;
    }
  }
 
  // 3. 新規ユーザー作成
  const newUser = await prisma.user.create({
    data: {
      email: userInfo.email,
      name: userInfo.name,
      avatar: userInfo.picture,
      accounts: {
        create: {
          provider,
          providerAccountId: userInfo.sub,
          accessToken: tokens.accessToken,
          refreshToken: tokens.refreshToken,
          idToken: tokens.idToken,
        },
      },
    },
  });
 
  return newUser;
}

// GitHub は標準 OIDC ではないため、独自実装が必要
class GitHubOAuthProvider {
  private readonly authUrl = 'https://github.com/login/oauth/authorize';
  private readonly tokenUrl = 'https://github.com/login/oauth/access_token';
  private readonly apiUrl = 'https://api.github.com';
 
  constructor(
    private clientId: string,
    private clientSecret: string
  ) {}
 
  getAuthorizationUrl(redirectUri: string, state: string): string {
    const params = new URLSearchParams({
      client_id: this.clientId,
      redirect_uri: redirectUri,
      scope: 'user:email read:user',
      state,
    });
    return `${this.authUrl}?${params}`;
  }
 
  async exchangeCode(code: string): Promise<string> {
    const res = await fetch(this.tokenUrl, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        Accept: 'application/json',
      },
      body: JSON.stringify({
        client_id: this.clientId,
        client_secret: this.clientSecret,
        code,
      }),
    });
 
    const data = await res.json();
    if (data.error) {
      throw new Error(`GitHub token exchange failed: ${data.error_description}`);
    }
    return data.access_token;
  }
 
  // GitHub の /user API でユーザー情報取得（ID Token の代替）
  async getUser(accessToken: string) {
    const [userRes, emailsRes] = await Promise.all([
      fetch(`${this.apiUrl}/user`, {
        headers: { Authorization: `Bearer ${accessToken}` },
      }),
      fetch(`${this.apiUrl}/user/emails`, {
        headers: { Authorization: `Bearer ${accessToken}` },
      }),
    ]);
 
    const user = await userRes.json();
    const emails: Array<{ email: string; primary: boolean; verified: boolean }> =
      await emailsRes.json();
 
    // プライマリかつ認証済みメールを取得
    const primaryEmail = emails.find((e) => e.primary && e.verified);
 
    return {
      sub: String(user.id),
      email: primaryEmail?.email || user.email,
      emailVerified: primaryEmail?.verified ?? false,
      name: user.name || user.login,
      picture: user.avatar_url,
      login: user.login, // GitHub 固有: ユーザー名
    };
  }
}

// トークン漏洩の防止策
 
// 1. Authorization Code は1回のみ使用可能
// → IdP 側で実装されているが、クライアント側でも確認
 
// 2. Token をログに出力しない
function safeLog(message: string, data: any) {
  const sanitized = { ...data };
  const sensitiveFields = ['access_token', 'id_token', 'refresh_token', 'code', 'client_secret'];
  for (const field of sensitiveFields) {
    if (sanitized[field]) {
      sanitized[field] = `[REDACTED:${sanitized[field].length}chars]`;
    }
  }
  console.log(message, sanitized);
}
 
// 3. Referrer-Policy で Token の漏洩を防止
// HTTP ヘッダー:
// Referrer-Policy: no-referrer
// → リダイレクト時に URL パラメータ（code, state）が漏洩しない
 
// 4. Token の安全な保存
// → Access Token: メモリ内（変数）
// → Refresh Token: HttpOnly Cookie or サーバーサイド
// → ID Token: 検証後に破棄（必要な情報はセッションに保存）