import { WorkOS } from '@workos-inc/node'

const workos = new WorkOS(process.env.WORKOS_API_KEY)

// Customer's IT admin configures their IdP
const connection = await workos.sso.getConnection('conn_01HXYZ...')

console.log(connection)
// {
//   id: 'conn_01HXYZ...',
//   organizationId: 'org_01ABC...',
//   name: 'Acme Corp Okta',
//   type: 'OktaSAML',
//   state: 'active',
//   domains: [
//     { domain: 'acme.com' }
//   ]
// }

// Step 1: Initiate SSO
const authorizationUrl = workos.sso.getAuthorizationURL({
  organization: 'org_01ABC...', // or domain: 'acme.com'
  clientId: process.env.WORKOS_CLIENT_ID,
  redirectUri: 'https://yourapp.do/auth/callback',
  state: 'optional-state-value'
})

// Redirect user to authorizationUrl

// Step 2: Handle callback
const { profile } = await workos.sso.getProfileAndToken({
  code: 'authorization_code',
  clientId: process.env.WORKOS_CLIENT_ID
})

console.log(profile)
// {
//   id: 'prof_01XYZ...',
//   organizationId: 'org_01ABC...',
//   connectionId: 'conn_01HXYZ...',
//   connectionType: 'OktaSAML',
//   email: '[email protected]',
//   firstName: 'Jane',
//   lastName: 'Doe',
//   idpId: 'okta-user-id',
//   rawAttributes: { ... }
// }

// User enters email: [email protected]
const email = '[email protected]'
const domain = email.split('@')[1]

// Find organization by domain
const organizations = await workos.organizations.listOrganizations({
  domains: [domain]
})

if (organizations.data.length > 0) {
  const org = organizations.data[0]
  // Redirect to SSO for this organization
  const authUrl = workos.sso.getAuthorizationURL({
    organization: org.id,
    clientId: process.env.WORKOS_CLIENT_ID,
    redirectUri: 'https://yourapp.do/auth/callback'
  })
  // Redirect user to authUrl
} else {
  // Fall back to password authentication
}

// Generate Admin Portal link for customer
const { link } = await workos.portal.generateLink({
  organization: 'org_01ABC...',
  intent: 'sso', // or 'dsync' for Directory Sync
  returnUrl: 'https://platform.do/settings'
})

// Send link to customer's IT admin
console.log(link)
// https://id.workos.com/portal/launch?secret=secret_01XYZ...

on($.User.sso.authenticated, async ({ profile }) => {
  // Check if user exists
  let user = await db.find($.User, { email: profile.email })

  if (!user) {
    // Create user on first login (JIT provisioning)
    user = await $.User.create({
      email: profile.email,
      firstName: profile.firstName,
      lastName: profile.lastName,
      organizationId: profile.organizationId,
      idpId: profile.idpId,
      authMethod: 'sso'
    })

    // Assign default role
    await $.User.assign.Role({
      userId: user.id,
      roleId: 'default-employee-role'
    })

    await send($.Email.send, {
      to: user.email,
      template: 'welcome-sso',
      data: { user }
    })
  }

  // Create session
  return { userId: user.id }
})

const { profile } = await workos.sso.getProfileAndToken({ code })

// Verify organization
if (profile.organizationId !== expectedOrgId) {
  throw new Error('User does not belong to this organization')
}

const connection = await workos.sso.getConnection(connectionId)

if (connection.state !== 'active') {
  // Show error: "SSO is not configured for your organization"
  return
}

const session = await createSession({
  userId: user.id,
  organizationId: profile.organizationId,
  authMethod: 'sso',
  expiresIn: '24h'
})

// Set secure cookie
setCookie('session', session.token, {
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
  maxAge: 86400
})

await send($.Event.log, {
  type: 'auth.sso.success',
  userId: user.id,
  organizationId: profile.organizationId,
  metadata: {
    connectionType: profile.connectionType,
    ipAddress: request.ip,
    userAgent: request.headers['user-agent']
  }
})

// Use magic link SSO in development
const authUrl = workos.sso.getAuthorizationURL({
  provider: 'authkit', // Magic link provider
  clientId: process.env.WORKOS_CLIENT_ID,
  redirectUri: 'http://localhost:3000/auth/callback'
})

# Create test organization
curl -X POST https://api.workos.com/organizations \
  -H "Authorization: Bearer $WORKOS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Test Corp",
    "domains": ["testcorp.local"]
  }'

// Auth0
const auth0 = new AuthenticationClient({
  domain: 'your-domain.auth0.com',
  clientId: '...'
})

// WorkOS equivalent
const workos = new WorkOS(process.env.WORKOS_API_KEY)
const authUrl = workos.sso.getAuthorizationURL({
  organization: 'org_...',
  clientId: process.env.WORKOS_CLIENT_ID,
  redirectUri: 'https://yourapp.do/callback'
})

// Okta
const authClient = new OktaAuth({
  issuer: 'https://dev-12345.okta.com',
  clientId: '...'
})

// WorkOS equivalent
const workos = new WorkOS(process.env.WORKOS_API_KEY)
// Customers configure Okta via Admin Portal
// You just handle the standardized WorkOS response

// Get connection events
const events = await workos.events.listEvents({
  events: ['connection.activated', 'connection.deactivated'],
  organizationId: 'org_01ABC...'
})

// Monitor authentication success/failure rates
const metrics = await db.query(`
  SELECT
    date_trunc('day', timestamp) as day,
    count(*) FILTER (WHERE event_type = 'auth.sso.success') as successes,
    count(*) FILTER (WHERE event_type = 'auth.sso.failure') as failures
  FROM events
  WHERE organization_id = $1
  GROUP BY day
  ORDER BY day DESC
`, [organizationId])

const workos = new WorkOS(process.env.WORKOS_API_KEY, {
  https: {
    timeout: 30000
  }
})

// Log all requests
workos.on('request', (req) => {
  console.log('WorkOS Request:', req)
})

workos.on('response', (res) => {
  console.log('WorkOS Response:', res)
})