const express = require('express');
const crypto = require('crypto');
const app = express();

// Configuration
const CLIENT_ID = 'your_client_id';
const CLIENT_SECRET = 'your_client_secret';
const REDIRECT_URI = 'https://yourapp.com/callback';
const AUTH_BASE_URL = 'https://auth.savepoint.com.au';

// Generate PKCE challenge
function generatePKCE() {
  const codeVerifier = crypto.randomBytes(32).toString('base64url');
  const codeChallenge = crypto
    .createHash('sha256')
    .update(codeVerifier)
    .digest('base64url');
  return { codeVerifier, codeChallenge };
}

// Start OAuth flow
app.get('/login', (req, res) => {
  const { codeVerifier, codeChallenge } = generatePKCE();
  const state = crypto.randomBytes(16).toString('hex');
  
  // Store state and codeVerifier in session
  req.session.state = state;
  req.session.codeVerifier = codeVerifier;
  
  const authUrl = new URL('/oauth/authorize', AUTH_BASE_URL);
  authUrl.searchParams.set('response_type', 'code');
  authUrl.searchParams.set('client_id', CLIENT_ID);
  authUrl.searchParams.set('redirect_uri', REDIRECT_URI);
  authUrl.searchParams.set('scope', 'openid profile email');
  authUrl.searchParams.set('state', state);
  authUrl.searchParams.set('code_challenge', codeChallenge);
  authUrl.searchParams.set('code_challenge_method', 'S256');
  
  res.redirect(authUrl.toString());
});

// Handle callback
app.get('/callback', async (req, res) => {
  const { code, state } = req.query;
  
  if (state !== req.session.state) {
    return res.status(400).send('Invalid state');
  }
  
  try {
    const tokenResponse = await fetch(`${AUTH_BASE_URL}/oauth/token`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
      },
      body: new URLSearchParams({
        grant_type: 'authorization_code',
        code,
        redirect_uri: REDIRECT_URI,
        client_id: CLIENT_ID,
        client_secret: CLIENT_SECRET,
        code_verifier: req.session.codeVerifier,
      }),
    });
    
    const tokens = await tokenResponse.json();
    
    // Store tokens securely
    req.session.accessToken = tokens.access_token;
    req.session.idToken = tokens.id_token;
    
    res.redirect('/dashboard');
  } catch (error) {
    console.error('Token exchange failed:', error);
    res.status(500).send('Authentication failed');
  }
});

import { createAuthClient } from '@better-auth/react';

const authClient = createAuthClient({
  baseURL: 'https://auth.savepoint.com.au',
  plugins: [
    // Add any required plugins
  ],
});

export default function LoginButton() {
  const { signIn, data: session, isPending } = authClient.useSession();
  
  const handleLogin = async () => {
    try {
      await signIn.social({
        provider: 'savepoint',
        callbackURL: '/dashboard',
      });
    } catch (error) {
      console.error('Login failed:', error);
    }
  };
  
  if (session) {
    return (
      <div>
        <p>Welcome, {session.user.name}!</p>
        <button onClick={() => authClient.signOut()}>
          Sign Out
        </button>
      </div>
    );
  }
  
  return (
    <button 
      onClick={handleLogin}
      disabled={isPending}
      className="bg-blue-600 text-white px-4 py-2 rounded"
    >
      {isPending ? 'Signing in...' : 'Sign in with SavePoint'}
    </button>
  );
}