// npm install next-auth@5.0.0-beta.32 authio-provider-nextauth@^2

// .env.local — Auth.js resolves these three from the provider id, "authio".
//   AUTH_AUTHIO_ISSUER="https://auth.example.com/realms/acme"
//   AUTH_AUTHIO_ID="web-app"
//   AUTH_AUTHIO_SECRET="…"        omit entirely for a public client
//   AUTH_URL="https://app.example.com"
//   AUTH_SECRET="…"               npx auth secret — NOT the client secret

// auth.ts
import NextAuth from 'next-auth'
import { Authio } from 'authio-provider-nextauth/v5'

export const { handlers, signIn, signOut, auth } = NextAuth({
  providers: [
    Authio({
      // The v5 entry point sets no checks of its own, so Auth.js would
      // default to ['pkce'] alone. 'state' ties the callback to the
      // request that started it.
      checks: ['pkce', 'state'],
      // offline_access is what buys a refresh token. Nothing else does.
      authorization: {
        params: { scope: 'openid profile email offline_access' },
      },
    }),
  ],
  session: { strategy: 'jwt' },
  callbacks: {
    async jwt({ token, account }) {
      if (account) {
        token.accessToken = account.access_token
        token.refreshToken = account.refresh_token
      }
      return token
    },
    async session({ session, token }) {
      session.accessToken = token.accessToken as string
      return session
    },
  },
})

// app/api/auth/[...nextauth]/route.ts
import { handlers } from '@/auth'
export const { GET, POST } = handlers

// Register this exact callback on the client:
//   https://app.example.com/api/auth/callback/authio