moeka-project/apps/ui-server-auth/src/modules/sign-in.ts

import type { OAuthProvider } from '@proj-airi/stage-ui/libs/auth'

import { getAuthClient } from './auth-client'
import { extractAuthError } from './auth-fetch'
import { buildAuthUiPath } from './auth-ui-base'

const TRUSTED_ADMIN_REDIRECT_ORIGINS = [
  'https://admin.airi.build',
  'https://server-dev.airi-server-admin.pages.dev',
]

const TRUSTED_LOCAL_ADMIN_REDIRECT_ORIGIN_PATTERNS = [
  /^http:\/\/localhost(:\d+)?$/,
  /^http:\/\/127\.0\.0\.1(:\d+)?$/,
  /^https:\/\/localhost(:\d+)?$/,
  /^https:\/\/127\.0\.0\.1(:\d+)?$/,
]

export interface ServerSignInContext {
  callbackURL: string
  requestedProvider: string | null
}

export interface SocialSignInRedirectParams {
  apiServerUrl: string
  provider: OAuthProvider
  callbackURL: string
  fetchImpl?: typeof fetch
}

export function createServerSignInContext(currentUrl: string, apiServerUrl: string): ServerSignInContext {
  const url = new URL(currentUrl)
  const oidcParams = new URLSearchParams(url.searchParams)
  const requestedProvider = oidcParams.get('provider')
  const redirect = oidcParams.get('redirect')

  oidcParams.delete('provider')
  oidcParams.delete('redirect')
  oidcParams.delete('prompt')
  oidcParams.delete('api_server_url')

  // NOTICE:
  // Only synthesize an OIDC authorize callback when the page query genuinely
  // looks like an OIDC handoff. Without this guard, a stray `?token=...` —
  // e.g. the 24-char password-reset token better-auth appends when it
  // redirects through redirectTo (better-auth/dist/api/routes/password.mjs L65, L118)
  // back into /auth/sign-in — would synthesize
  // `/api/auth/oauth2/authorize?token=...` as the callback. The OIDC zod
  // schema then rejects it for missing client_id / response_type
  // (oauth-provider/dist/index.mjs L2808-2826) and the user sees a
  // VALIDATION_ERROR instead of the sign-in form.
  // Removal condition: redirectTo origins are exhaustively scoped so reset /
  // verification redirects can never land on /auth/sign-in carrying a `token`.
  if (!oidcParams.has('client_id') || !oidcParams.has('response_type')) {
    return {
      callbackURL: normalizeStandaloneRedirect(url, redirect) ?? '/',
      requestedProvider,
    }
  }

  const authorizeUrl = new URL('/api/auth/oauth2/authorize', apiServerUrl)
  authorizeUrl.search = oidcParams.toString()

  return {
    callbackURL: authorizeUrl.toString(),
    requestedProvider,
  }
}

function normalizeStandaloneRedirect(currentUrl: URL, redirect: string | null): string | null {
  if (!redirect)
    return null

  const trustedAdminRedirect = normalizeTrustedAdminRedirect(redirect)
  if (trustedAdminRedirect)
    return trustedAdminRedirect

  if (!redirect.startsWith('/') || redirect.startsWith('//'))
    return null

  if (redirect.startsWith('/admin'))
    return `${currentUrl.origin}${redirect}`

  return `${currentUrl.origin}${buildAuthUiPath(redirect)}`
}

function normalizeTrustedAdminRedirect(redirect: string): string | null {
  try {
    const url = new URL(redirect)
    if (TRUSTED_ADMIN_REDIRECT_ORIGINS.includes(url.origin))
      return url.toString()

    if (TRUSTED_LOCAL_ADMIN_REDIRECT_ORIGIN_PATTERNS.some(pattern => pattern.test(url.origin)))
      return url.toString()

    return null
  }
  catch {
    return null
  }
}

export async function requestSocialSignInRedirect(params: SocialSignInRedirectParams): Promise<string> {
  const client = getAuthClient({ apiServerUrl: params.apiServerUrl, fetchImpl: params.fetchImpl })

  // Steam is OpenID 2.0, not OAuth2 — the server steam plugin exposes
  // `/sign-in/steam`, surfaced here as the typed `signIn.steam` action.
  // Other providers use the standard `/sign-in/social`.
  const result = params.provider === 'steam'
    ? await client.signIn.steam({ callbackURL: params.callbackURL, disableRedirect: true })
    : await client.signIn.social({ provider: params.provider, callbackURL: params.callbackURL, disableRedirect: true })

  const url = result.data?.url
  if (typeof url === 'string')
    return url

  throw new Error(extractAuthError(result.data ?? result.error) ?? 'Unexpected response')
}