import { NextRequest, NextResponse } from 'next/server'; import { buildShopifyAuthUrl } from '@/lib/shopify/oauth'; import { isValidShopifyDomain } from '@/lib/shopify/hmac'; import { APP_CONFIG, APP_URLS, buildAppUrl } from '@/config/app'; import { SHOPIFY_CONFIG } from '@/config/shopify'; import { extractShopDomainFromRequest } from '@/lib/auth/storeContext'; export const dynamic = 'force-dynamic'; export async function GET(req: NextRequest) { const { searchParams } = new URL(req.url); let shop = searchParams.get('shop') || searchParams.get('shopify_domain'); // If shop not in query params, inspect session tokens, referer header, or cookies if (!shop) { const extracted = extractShopDomainFromRequest(req); if (extracted) { shop = extracted; } } // 1. If valid shop domain identified, proceed with OAuth authorization if (shop && isValidShopifyDomain(shop)) { const cleanShop = shop.trim().toLowerCase(); const redirectUri = APP_URLS.authCallback(); try { const { url: authorizeUrl } = buildShopifyAuthUrl(cleanShop, redirectUri); // Return JSON directly if requested by client component (settings/catalog page) if (searchParams.get('format') === 'json' || req.headers.get('accept')?.includes('application/json')) { return NextResponse.json({ success: true, shop: cleanShop, url: authorizeUrl, }); } // Check if request is loaded inside an iframe const secFetchDest = req.headers.get('sec-fetch-dest'); const isEmbedded = searchParams.get('embedded') === '1' || Boolean(searchParams.get('host')); const isIframe = secFetchDest === 'iframe' || isEmbedded; // Direct top-level navigation (e.g. from browser address bar or form submit) if (!isIframe) { return NextResponse.redirect(authorizeUrl); } // If loaded inside an iframe, escape directly to window.top WITHOUT App Bridge script // (App Bridge script was incorrectly intercepting and rewriting the URL to admin.shopify.com 404) return new Response( ` Connecting to ${cleanShop}...

⚡

Connecting to Shopify

Redirecting to authorize permissions for ${cleanShop}. If not redirected automatically, please click below:

Authorize App on Shopify →

`, { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8', 'Content-Security-Policy': "frame-ancestors https://*.myshopify.com https://admin.shopify.com https://*.shopify.com https://shopify.com 'self';", }, } ); } catch (err) { return NextResponse.json( { error: err instanceof Error ? err.message : 'OAuth Initialization Failed' }, { status: 500 } ); } } // 2. If NO shop parameter provided (e.g. direct visit, reviewer audit, or public landing): // Render a clean, standalone Shopify install landing page with store input form. const authEndpoint = buildAppUrl('/api/auth/shopify'); return new Response( ` Install ${APP_CONFIG.name}

⚡

${APP_CONFIG.name}

Connect multiple Facebook Pixels, Conversions API (CAPI), and live dynamic product feeds to your Shopify store.

🔒 Official Shopify Partner

🛡️ 100% Embedded App