04.5 — Tek Tıkla Doğrudan Giriş (Direct Login SSO)

// app/api/auth/callback/route.ts
export async function GET(req: NextRequest) {
  const { searchParams } = new URL(req.url);
  const code = searchParams.get("code");
  const state = searchParams.get("state");

  const cookieStore = await cookies();
  const savedState = cookieStore.get("talost_oauth_state")?.value;
  const verifier = cookieStore.get("talost_pkce_verifier")?.value;

  // 1. Durum: Uygulama içinden başlatılan normal PKCE akışı
  if (savedState && state === savedState && verifier) {
    // Standart token takası...
  } 
  // 2. Durum: TALOST ID Panelinden tek tıkla doğrudan geliş (Direct Login)
  else if (state && state.startsWith("direct_login_")) {
    // Confidential istemci gizli anahtarı ile takas yapılır
    const tokenRes = await fetch(`${process.env.TALOST_ISSUER}/oauth/token`, {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({
        grant_type: "authorization_code",
        client_id: process.env.TALOST_CLIENT_ID!,
        client_secret: process.env.TALOST_CLIENT_SECRET!,
        code: code!,
        redirect_uri: process.env.TALOST_REDIRECT_URI!,
      }),
    });

    const tokens = await tokenRes.json();
    if (!tokenRes.ok) return NextResponse.json(tokens, { status: 400 });

    // Oturumu başlat
    cookieStore.set("session_user", JSON.stringify(tokens), { httpOnly: true, secure: true });
    return NextResponse.redirect(new URL("/dashboard", req.url));
  }
}