property-management-network/app/api/integrations/[provider]/callback/route.ts

import { NextResponse } from "next/server"
import { getProvider, saveConnection, type Provider } from "@/lib/accounting"
import { verifyState } from "@/lib/accounting/state"

// OAuth callback — exchanges the code for tokens and stores the connection.
export async function GET(request: Request, { params }: { params: Promise<{ provider: string }> }) {
  const { provider: pid } = await params
  const prov = getProvider(pid)
  const url = new URL(request.url)
  const settings = new URL("/settings/integrations", request.url)

  const code = url.searchParams.get("code")
  const state = url.searchParams.get("state")
  const realmId = url.searchParams.get("realmId") // QuickBooks includes this
  const oauthError = url.searchParams.get("error")

  if (oauthError || !prov) {
    settings.searchParams.set("error", "connect_failed")
    return NextResponse.redirect(settings)
  }

  const st = state ? verifyState(state) : null
  if (!code || !st || st.provider !== pid) {
    settings.searchParams.set("error", "invalid_state")
    return NextResponse.redirect(settings)
  }

  try {
    const tokens = await prov.exchangeCode(code, realmId)
    if (!tokens.realmId) throw new Error("No organisation returned from provider")
    await saveConnection(st.ownerId, pid as Provider, tokens)
    settings.searchParams.set("connected", pid)
  } catch {
    settings.searchParams.set("error", "connect_failed")
  }
  return NextResponse.redirect(settings)
}