property-management-network/app/api/integrations/[provider]/callback/route.ts

import { NextResponse } from "next/server"
import { cookies } from "next/headers"
import { getSessionUser } from "@/lib/session"
import { getAccountContext } from "@/lib/account"
import { getProvider, saveConnection, type Provider } from "@/lib/accounting"
import { verifyState, OAUTH_NONCE_COOKIE } from "@/lib/accounting/state"

// OAuth callback — exchanges the code for tokens and stores the connection.
export async function GET(request: Request, { params }: { params: Promise<{ provider: string }> }) {
  const { provider: pid } = await params
  const prov = getProvider(pid)
  const settings = new URL("/settings/integrations", request.url)

  // Always clear the one-shot nonce cookie on the way out.
  const cookieStore = await cookies()
  const nonceCookie = cookieStore.get(OAUTH_NONCE_COOKIE)?.value
  const done = (params: Record<string, string>) => {
    for (const [k, v] of Object.entries(params)) settings.searchParams.set(k, v)
    const res = NextResponse.redirect(settings)
    res.cookies.set(OAUTH_NONCE_COOKIE, "", { path: "/", maxAge: 0 })
    return res
  }

  const url = new URL(request.url)
  const code = url.searchParams.get("code")
  const state = url.searchParams.get("state")
  const realmId = url.searchParams.get("realmId") // QuickBooks includes this
  const oauthError = url.searchParams.get("error")

  if (oauthError || !prov) return done({ error: "connect_failed" })

  const st = state ? verifyState(state) : null
  // CSRF: the state's nonce must match the cookie set at connect time, and the
  // current session must be the same owner that initiated the connect.
  if (!code || !st || st.provider !== pid || !nonceCookie || nonceCookie !== st.nonce) {
    return done({ error: "invalid_state" })
  }
  const user = await getSessionUser()
  if (!user) return done({ error: "invalid_state" })
  const ctx = await getAccountContext(user.id)
  if (ctx.ownerId !== st.ownerId) return done({ error: "invalid_state" })

  try {
    const tokens = await prov.exchangeCode(code, realmId)
    if (!tokens.realmId) throw new Error("No organisation returned from provider")
    await saveConnection(st.ownerId, pid as Provider, tokens)
    return done({ connected: pid })
  } catch {
    return done({ error: "connect_failed" })
  }
}