// app/api/auth/[...auth]/route.ts
//
// Mounts the SDK's routes under /api/auth:
//   GET  /api/auth/signin    → redirects to your hosted sign-in page
//   GET  /api/auth/signup    → redirects to your hosted sign-up page
//   GET  /api/auth/callback  → redeems the one-time ?code=, sets the session cookies
//   POST /api/auth/sign-in   → embedded <SignIn /> (email + password)
//   POST /api/auth/sign-in-mfa → embedded <SignIn /> TOTP step
//   POST /api/auth/sign-up   → email + password sign-up
//   POST /api/auth/sign-out  → revokes the session, clears the cookies
//   GET  /api/auth/user      → the signed-in user, for useSession()
//   GET  /api/auth/organizations, POST /api/auth/switch-organization
import { handleAuth } from '@3een/auth/nextjs';
import { authConfig } from '@/lib/auth-config';

const handler = handleAuth(authConfig);

export { handler as GET, handler as POST };

// app/billing/page.tsx — a Server Component
import { notFound, redirect } from 'next/navigation';
import { getAuth } from '@3een/auth/nextjs';
import { authConfig } from '@/lib/auth-config';

export default async function BillingPage() {
  // Verified locally against the environment's published keys (no API call).
  const auth = await getAuth(authConfig);
  if (!auth) redirect('/api/auth/signin?redirect_uri=/billing');

  // Roles and permissions come from the verified token.
  if (!auth.has({ permission: 'billing:read' })) notFound();

  return <h1>Billing for {auth.claims.email}</h1>;
}