Callbacks

import express from 'express';

const app = express();

app.get('/emerge/callback', async (req, res) => {
  const { status, state, uid, error_code } = req.query;

  // 1. Verify state matches (CSRF protection)
  const expectedState = req.session.emergeState;
  if (state !== expectedState) {
    console.error('State mismatch - possible CSRF attack');
    return res.status(400).redirect('/error?reason=invalid_state');
  }

  // Clear stored state
  delete req.session.emergeState;

  // 2. Handle based on status
  switch (status) {
    case 'success':
      // First-time consent - data export will start automatically
      await saveUserConsent(uid as string, {
        consentedAt: new Date()
      });

      // Redirect to success page
      return res.redirect('/dashboard?connected=true');

    case 'reauthorized':
      // Existing consent refreshed
      await updateUserConsent(uid as string, {
        reauthorizedAt: new Date()
      });

      return res.redirect('/dashboard?reconnected=true');

    case 'failure':
      // Handle specific error codes
      const errorMessage = getErrorMessage(error_code as string);

      return res.redirect(`/connect?error=${encodeURIComponent(errorMessage)}`);

    default:
      return res.status(400).redirect('/error');
  }
});

function getErrorMessage(errorCode: string): string {
  const messages: Record<string, string> = {
    'user_failed': 'You cancelled the connection. Click below to try again.',
    'data_invalid': 'Your account doesn\'t have enough data history yet.',
    'access_denied': 'Permission was denied. We need access to provide this feature.',
    'admin_policy_enforced': 'Your organization\'s policy prevents this connection.'
  };

  return messages[errorCode] || 'Something went wrong. Please try again.';
}