// Google returns standardized OpenID Connect claims
const googleUser = {
  id: '123456789',
  email: '[email protected]',
  name: 'John Doe',
  picture: 'https://lh3.googleusercontent.com/...',
  verified_email: true
};

// GitHub OAuth URLs
const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize';
const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token';
const GITHUB_API_URL = 'https://api.github.com';

// Authorization request - note comma-separated scopes
const params = new URLSearchParams({
  client_id: GITHUB_CLIENT_ID,
  redirect_uri: 'http://localhost:3000/auth/github/callback',
  scope: 'read:user,user:email',   // Comma-separated, not space-separated!
  state: generateState()
});

// Fetch user info after token exchange
const userResponse = await fetch(`${GITHUB_API_URL}/user`, {
  headers: {
    Authorization: `Bearer ${accessToken}`,
    Accept: 'application/vnd.github.v3+json'
  }
});

const DISCORD_AUTH_URL = 'https://discord.com/api/oauth2/authorize';
const DISCORD_TOKEN_URL = 'https://discord.com/api/oauth2/token';
const DISCORD_API_URL = 'https://discord.com/api/v10';

// Authorization
const params = new URLSearchParams({
  client_id: DISCORD_CLIENT_ID,
  redirect_uri: 'http://localhost:3000/auth/discord/callback',
  response_type: 'code',
  scope: 'identify email',
  state: generateState()
});

// User info - avatar requires constructing the URL manually
const userResponse = await fetch(`${DISCORD_API_URL}/users/@me`, {
  headers: { Authorization: `Bearer ${accessToken}` }
});

app.get('/auth/:provider/callback', async (req, res) => {
  const { provider } = req.params;
  const { code, state, error, error_description } = req.query;

  // 1. Handle user denial
  if (error === 'access_denied') {
    return res.redirect('/login?error=user_denied');
  }

  // 2. Handle other provider errors
  if (error) {
    console.error('OAuth error:', error_description);
    return res.redirect('/login?error=oauth_failed');
  }

  // 3. Validate state parameter (CSRF protection)
  if (state !== req.session.oauthState) {
    return res.status(403).send('Invalid state parameter');
  }

  // 4. Exchange code for tokens and fetch user info
  try {
    const tokens = await exchangeCodeForTokens(provider, code);
    const userInfo = await fetchUserInfo(provider, tokens.access_token);

    // 5. Link or create user account
    const user = await findOrCreateUser(provider, userInfo);

    // 6. Create session and redirect
    req.session.userId = user.id;
    res.redirect('/dashboard');

  } catch (err) {
    console.error('OAuth callback error:', err);
    res.redirect('/login?error=authentication_failed');
  }
});

async function findOrCreateUser(provider, oauthUser) {
  // Strategy 1: user already linked this provider
  let user = await db.findUserByOAuthId(provider, oauthUser.id);
  if (user) return user;

  // Strategy 2: link by verified email to an existing account
  if (oauthUser.verified_email || oauthUser.verified) {
    user = await db.findUserByEmail(oauthUser.email);
    if (user) {
      await db.linkOAuthAccount(user.id, {
        provider,
        providerId: oauthUser.id,
        email: oauthUser.email
      });
      return user;
    }
  }

  // Strategy 3: create a brand new account
  return await db.createUser({
    email: oauthUser.email,
    name: oauthUser.name,
    avatar: oauthUser.picture || oauthUser.avatar_url,
    oauthAccounts: [{
      provider,
      providerId: oauthUser.id,
      email: oauthUser.email
    }]
  });
}

-- One user can have multiple OAuth connections
CREATE TABLE oauth_accounts (
  id SERIAL PRIMARY KEY,
  user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
  provider VARCHAR(50) NOT NULL,        -- 'google', 'github', 'discord'
  provider_id VARCHAR(255) NOT NULL,
  email VARCHAR(255),
  created_at TIMESTAMP DEFAULT NOW(),
  UNIQUE(provider, provider_id)         -- Each provider+id pair is unique
);

function normalizeUserInfo(provider, rawInfo) {
  const normalizers = {
    google: (info) => ({
      id: info.id,
      email: info.email,
      name: info.name,
      avatar: info.picture,
      verified: info.verified_email
    }),
    github: (info) => ({
      id: info.id.toString(),
      email: info.email,
      name: info.name || info.login,   // login is the @username fallback
      avatar: info.avatar_url,
      verified: true                   // GitHub requires email verification
    }),
    discord: (info) => ({
      id: info.id,
      email: info.email,
      name: info.global_name || info.username,
      avatar: info.avatar
        ? `https://cdn.discordapp.com/avatars/${info.id}/${info.avatar}.png`
        : null,
      verified: info.verified
    })
  };

  return normalizers[provider](rawInfo);
}