OAuth Configuration for Auth Service

# Resend (Email OTP)
RESEND_API_KEY=re_xxxxxxxxxxxx
AUTH_RESEND_FROM=auth@notifications.do.dev

# GitHub OAuth
AUTH_GITHUB_ID=xxxxxxxxxxxx
AUTH_GITHUB_SECRET=xxxxxxxxxxxx

# Google OAuth  
AUTH_GOOGLE_ID=xxxxxxxxxxxx.apps.googleusercontent.com
AUTH_GOOGLE_SECRET=xxxxxxxxxxxx

# JWT Secret (generate a random string)
JWT_SECRET=your-random-jwt-secret-string-here

// apps/auth/app/api/auth/oauth/github/route.ts
import { NextRequest } from "next/server";
import { api } from "@/convex/_generated/api";
import { fetchMutation } from "convex/nextjs";

export async function GET(request: NextRequest) {
  const { searchParams } = new URL(request.url);
  const app = searchParams.get("app") || "unknown";
  const returnUrl = searchParams.get("return") || "/";
  
  // Initiate OAuth state
  const { state } = await fetchMutation(api.auth.initiateOAuth, {
    provider: "github",
    appId: app,
    returnUrl,
  });
  
  // Redirect to GitHub OAuth
  const githubUrl = new URL("https://github.com/login/oauth/authorize");
  githubUrl.searchParams.set("client_id", process.env.AUTH_GITHUB_ID!);
  githubUrl.searchParams.set("redirect_uri", `${process.env.NEXT_PUBLIC_URL}/api/auth/callback/github`);
  githubUrl.searchParams.set("scope", "user:email");
  githubUrl.searchParams.set("state", state);
  
  return Response.redirect(githubUrl.toString());
}

// apps/auth/app/api/auth/callback/github/route.ts
import { NextRequest } from "next/server";
import { api } from "@/convex/_generated/api";
import { fetchMutation, fetchQuery } from "convex/nextjs";

export async function GET(request: NextRequest) {
  const { searchParams } = new URL(request.url);
  const code = searchParams.get("code");
  const state = searchParams.get("state");
  
  if (!code || !state) {
    return Response.redirect("/error?message=Invalid OAuth response");
  }
  
  // Validate state and get app info
  const oauthState = await fetchQuery(api.auth.validateOAuthState, { state });
  if (!oauthState) {
    return Response.redirect("/error?message=Invalid OAuth state");
  }
  
  // Exchange code for token
  const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
    method: "POST",
    headers: {
      "Accept": "application/json",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      client_id: process.env.AUTH_GITHUB_ID,
      client_secret: process.env.AUTH_GITHUB_SECRET,
      code,
    }),
  });
  
  const { access_token } = await tokenResponse.json();
  
  // Get user info from GitHub
  const userResponse = await fetch("https://api.github.com/user", {
    headers: {
      "Authorization": `Bearer ${access_token}`,
    },
  });
  
  const userData = await userResponse.json();
  
  // Create or update user and session
  const session = await fetchMutation(api.auth.completeOAuth, {
    provider: "github",
    providerId: userData.id.toString(),
    email: userData.email,
    name: userData.name || userData.login,
    image: userData.avatar_url,
    appId: oauthState.appId,
    returnUrl: oauthState.returnUrl,
  });
  
  // Redirect with session token
  const redirectUrl = new URL(oauthState.returnUrl);
  redirectUrl.searchParams.set("token", session.token);
  
  return Response.redirect(redirectUrl.toString());
}

// Client-side OAuth trigger
function handleOAuthLogin(provider: "github" | "google") {
  const authUrl = new URL(`${AUTH_SERVICE_URL}/api/auth/oauth/${provider}`);
  authUrl.searchParams.set("app", APP_ID);
  authUrl.searchParams.set("return", window.location.href);
  
  window.location.href = authUrl.toString();
}

// In OAuth handlers
console.log("OAuth initiated:", { provider, app, returnUrl });
console.log("OAuth callback received:", { code: !!code, state });
console.log("User data received:", { email: userData.email, name: userData.name });