// Step 1: Handle the launch request

app.get('/launch', async (req, res) => {
  const { launch, iss } = req.query;
  
  // Store launch token for later
  req.session.launch = launch;
  req.session.iss = iss;
  
  // Fetch SMART configuration
  const config = await fetch(`${iss}/.well-known/smart-configuration`)
    .then(r => r.json());
  
  // Build authorization URL
  const authUrl = new URL(config.authorization_endpoint);
  authUrl.searchParams.set('response_type', 'code');
  authUrl.searchParams.set('client_id', CLIENT_ID);
  authUrl.searchParams.set('redirect_uri', REDIRECT_URI);
  authUrl.searchParams.set('scope', 'launch patient/Patient.read patient/Observation.read');
  authUrl.searchParams.set('state', generateState());
  authUrl.searchParams.set('aud', iss);
  authUrl.searchParams.set('launch', launch);
  
  res.redirect(authUrl.toString());
});

// Step 2: Handle the callback and exchange code for token

app.get('/callback', async (req, res) => {
  const { code, state } = req.query;
  
  // Verify state to prevent CSRF
  if (state !== req.session.state) {
    return res.status(400).send('Invalid state');
  }
  
  // Exchange code for tokens
  const tokenResponse = await fetch(tokenEndpoint, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code,
      redirect_uri: REDIRECT_URI,
      client_id: CLIENT_ID,
    })
  }).then(r => r.json());
  
  // Store tokens and patient context
  req.session.accessToken = tokenResponse.access_token;
  req.session.patientId = tokenResponse.patient;
  
  res.redirect('/app');
});