/**
 * GET /api/accounting/amazon-ads/connect → 302 to the Login-with-Amazon consent
 * (scope advertising::campaign_management). The callback stores the refresh token.
 */
import crypto from 'crypto'
import { buildAdsAuthorizeUrl, isAdsApiConfigured } from '../../../utils/amazonAds/adsApi'
import { setAdsSetting } from '../../../utils/amazonAds/adsStore'

export default defineEventHandler(async (event) => {
  if (!isAdsApiConfigured(event)) {
    return sendRedirect(event, '/accounting/amazon-ads-invoices?ads_error=' + encodeURIComponent('Amazon Ads API ist nicht konfiguriert (AMAZON_ADS_CLIENT_ID / AMAZON_ADS_CLIENT_SECRET)'), 302)
  }
  const state = crypto.randomBytes(16).toString('hex')
  setAdsSetting('oauth_state', state)
  const url = buildAdsAuthorizeUrl(event, state)
  if (!url) return sendRedirect(event, '/accounting/amazon-ads-invoices?ads_error=' + encodeURIComponent('Redirect-URI konnte nicht bestimmt werden'), 302)
  return sendRedirect(event, url, 302)
})