class OmniauthCallbacksController < ApplicationController
  skip_before_action :login_required
  skip_before_action :set_time_zone

  def okta
    auth = request.env['omniauth.auth']
    if auth.blank?
      flash[:alert] = I18n.t('flash.failed_connection')
      return redirect_to(root_url)
    end

    email = extracted_email(auth)
    user = User.find_by(email: email)

    if user && user.has_okta_login?
      session[:okta_login_user_id] = user.id
      redirect_to okta_callback_user_session_url
    else
      flash[:alert] = I18n.t('flash.failed_connection')
      logger.warn "Failed Okta login from #{request.remote_ip} at #{Time.now}, reason: no active user for #{email}"
      return redirect_to(root_url)
    end
  rescue => e
    logger.error "Okta callback error: #{e.class} - #{e.message}"
    flash[:alert] = I18n.t('flash.failed_connection')
    redirect_to(root_url)
  end

  def failure
    flash[:alert] = I18n.t('flash.failed_connection')
    redirect_to(root_url)
  end

  private

  def extracted_email(auth)
    auth.info.try(:email) || auth.dig(:info, :email) || auth.dig('info', 'email')
  end
end