/* Login page logic for the Work Package Suite.

   One action: sign in with Okta. There is no local password anymore (D15/D16,
   T10.4) — this page's only job is building the link to /api/auth/okta/login
   (carrying ?next=, if there was one) and showing a plain-language message for
   the failure states server/app.py's okta_callback() sends back here (T10.5). */
(function () {
  'use strict';

  var errorBox = document.getElementById('error');
  var okBox = document.getElementById('ok');
  var signinLink = document.getElementById('okta-signin');

  function byId(id) { return document.getElementById(id); }

  function showError(msg) {
    okBox.classList.remove('show');
    errorBox.textContent = msg;
    errorBox.classList.add('show');
  }

  // Same-site path only — mirrors the check server/app.py's _safe_next_path()
  // makes again on the way back, so a crafted ?next= can't become an open
  // redirect even if this client-side check were somehow bypassed.
  function safeNext() {
    try {
      var next = new URLSearchParams(location.search).get('next') || '';
      if (next && next.charAt(0) === '/' && next.charAt(1) !== '/') return next;
    } catch (e) {}
    return '';
  }

  if (signinLink) {
    var next = safeNext();
    if (next) signinLink.href = '/api/auth/okta/login?next=' + encodeURIComponent(next);
  }

  var ERROR_MESSAGES = {
    disabled: 'Your account has been disabled. Contact an administrator.',
    cancelled: 'Sign-in was not completed. Select the button below to try again.'
  };

  (function showErrorFromQuery() {
    try {
      var code = new URLSearchParams(location.search).get('error') || '';
      if (!code) return;
      showError(ERROR_MESSAGES[code] || 'Sign-in was not completed. Select the button below to try again.');
      // Out of the address bar once shown — an error code has no reason to
      // survive a refresh or get copied along with the link.
      var url = new URL(location.href);
      url.searchParams.delete('error');
      history.replaceState(null, '', url.pathname + url.search);
    } catch (e) {}
  })();
})();