import Elysia from 'elysia';
import { requireAdmin } from '../plugin/auth';

// Basic-auth is credential-less to the server until the browser sends an
// Authorization header. A GET /login gated by requireAdmin forces the browser
// to prompt for credentials on first visit; on success we just redirect home.
//
// The `next` query param lets callers send users back where they came from
// (defaults to /). We reject anything that doesn't start with "/" to prevent
// open-redirect abuse.
export default new Elysia().get(
	'/login',
	({ query, redirect }) => {
		const next = typeof query.next === 'string' && query.next.startsWith('/')
			? query.next
			: '/';
		return redirect(next, 303);
	},
	{ beforeHandle: requireAdmin }
);