monacousa-portal/server/api/auth/callback.get.ts

export default defineEventHandler(async (event) => {
  console.log('🔄 Callback endpoint called at:', new Date().toISOString());
  
  const query = getQuery(event);
  const { code, state } = query;
  
  console.log('📝 Callback query params:', { 
    hasCode: !!code, 
    hasState: !!state,
    state: state ? 'present' : 'missing'
  });

  if (!code || !state) {
    throw createError({
      statusCode: 400,
      statusMessage: 'Missing authorization code or state',
    });
  }

  // Verify state
  const storedState = getCookie(event, 'oauth-state');
  if (state !== storedState) {
    throw createError({
      statusCode: 400,
      statusMessage: 'Invalid state parameter',
    });
  }

  try {
    const keycloak = createKeycloakClient();
    const sessionManager = createSessionManager();

    // Exchange code for tokens
    const tokens = await keycloak.exchangeCodeForTokens(code as string);
    
    // Get user info
    const userInfo = await keycloak.getUserInfo(tokens.access_token);

    // Tier determination logic - admin > board > user priority
    const determineTier = (groups: string[]): 'user' | 'board' | 'admin' => {
      if (groups.includes('admin')) return 'admin';
      if (groups.includes('board')) return 'board';
      return 'user'; // Default tier
    };

    // Create session
    const sessionData = {
      user: {
        id: userInfo.sub,
        email: userInfo.email,
        name: userInfo.name || `${userInfo.given_name || ''} ${userInfo.family_name || ''}`.trim(),
        firstName: userInfo.given_name,
        lastName: userInfo.family_name,
        username: userInfo.preferred_username,
        tier: determineTier(userInfo.groups || []),
        groups: userInfo.groups || ['user'],
      },
      tokens: {
        accessToken: tokens.access_token,
        refreshToken: tokens.refresh_token,
        expiresAt: Date.now() + (tokens.expires_in * 1000),
      },
      createdAt: Date.now(),
      lastActivity: Date.now(),
    };

    const sessionCookie = sessionManager.createSession(sessionData);
    
    // Set session cookie
    setHeader(event, 'Set-Cookie', sessionCookie);
    
    // Clear state cookie
    deleteCookie(event, 'oauth-state');

    return sendRedirect(event, '/dashboard');
  } catch (error) {
    console.error('Auth callback error:', error);
    throw createError({
      statusCode: 500,
      statusMessage: 'Authentication failed',
    });
  }
});