import { NextRequest, NextResponse } from "next/server";
import { getToken } from "next-auth/jwt";

type KeycloakToken = {
  idToken?: string;
};

const sessionCookiePrefixes = [
  "next-auth.session-token",
  "__Secure-next-auth.session-token",
];

const isSessionCookie = (name: string) =>
  sessionCookiePrefixes.some((prefix) => name.startsWith(prefix));

export const GET = async (request: NextRequest) => {
  const localLoginUrl = new URL(
    "/login",
    process.env.NEXTAUTH_URL ?? request.nextUrl.origin,
  );
  const issuer = process.env.KEYCLOAK_ISSUER?.replace(/\/$/, "");
  const clientId = process.env.KEYCLOAK_CLIENT_ID;
  const token = (await getToken({
    req: request,
    secret: process.env.NEXTAUTH_SECRET,
  })) as KeycloakToken | null;
  const logoutUrl = issuer
    ? new URL(`${issuer}/protocol/openid-connect/logout`)
    : localLoginUrl;

  if (issuer) {
    if (clientId) logoutUrl.searchParams.set("client_id", clientId);
    if (token?.idToken) logoutUrl.searchParams.set("id_token_hint", token.idToken);
  }

  const response = NextResponse.redirect(logoutUrl);
  for (const { name } of request.cookies.getAll()) {
    if (isSessionCookie(name)) {
      response.cookies.delete({
        name,
        path: "/",
        secure: name.startsWith("__Secure-"),
      });
    }
  }

  return response;
};