fix: return proper token response from casdoor-callback API route + remove hardcoded secret

src/app/api/auth/casdoor-callback/route.ts

@@ -1,83 +1,76 @@
 import { NextRequest, NextResponse } from "next/server";
 
-const CLIENT_ID = process.env.NEXT_PUBLIC_CASDOOR_CLIENT_ID || "272f91105da5cf984773";
-const CLIENT_SECRET = process.env.CASDOOR_CLIENT_SECRET;
-const CASDOOR_TOKEN_URL = "https://auth.falahos.my/api/login/oauth/access_token";
-const CASDOOR_USERINFO_URL = "https://auth.falahos.my/api/userinfo";
-
 export async function GET(req: NextRequest) {
   try {
     const code = req.nextUrl.searchParams.get("code");
-    const state = req.nextUrl.searchParams.get("state");
-
     if (!code) {
-      return NextResponse.json({ error: "Missing authorization code" }, { status: 400 });
+      return NextResponse.json({ error: "Missing code" }, { status: 400 });
     }
-
-    if (!CLIENT_SECRET) {
-      return NextResponse.json({ error: "Casdoor client secret not configured" }, { status: 500 });
+    const clientId = process.env.NEXT_PUBLIC_CASDOOR_CLIENT_ID || "272f91105da5cf984773";
+    const clientSecret = process.env.CASDOOR_CLIENT_SECRET;
+    if (!clientSecret) {
+      return NextResponse.json({ error: "Secret not configured" }, { status: 500 });
     }
+    const redirectUri = process.env.NEXT_PUBLIC_CASDOOR_REDIRECT_URI || "https://mobile2.falahos.my/mobile/auth/callback";
 
-    // Exchange authorization code for tokens
-    const REDIRECT_URI =
-      process.env.NEXT_PUBLIC_CASDOOR_REDIRECT_URI ||
-      "https://mobile2.falahos.my/mobile/auth/callback";
+    const params = new URLSearchParams();
+    params.append("grant_type", "authorization_code");
+    params.append("client_id", clientId);
+    params.append("client_secret", clientSecret);
+    params.append("code", code);
+    params.append("redirect_uri", redirectUri);
 
-    const tokenRes = await fetch(CASDOOR_TOKEN_URL, {
+    const r = await fetch("https://auth.falahos.my/api/login/oauth/access_token", {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        client_id: CLIENT_ID,
-        client_secret: CLIENT_SECRET,
-        code,
-        // redirect_uri must match exactly what was used in authorize request
-        redirect_uri: REDIRECT_URI,
-      }),
+      body: params,
     });
 
-    if (!tokenRes.ok) {
-      const errBody = await tokenRes.text();
-      console.error("[casdoor-oidc] Token exchange failed:", tokenRes.status, errBody);
-      return NextResponse.json({ error: "Token exchange failed" }, { status: 502 });
+    const text = await r.text();
+    let tokenData: Record<string, unknown> = {};
+
+    try {
+      tokenData = JSON.parse(text);
+    } catch {
+      return NextResponse.json(
+        { error: "Token exchange failed", detail: text.substring(0, 200) },
+        { status: 502 }
+      );
     }
 
-    const tokenData = await tokenRes.json();
-    const accessToken = tokenData.access_token;
-    const idToken = tokenData.id_token;
-
-    if (!accessToken) {
-      return NextResponse.json({ error: "No access_token in response" }, { status: 502 });
+    if (!r.ok || tokenData.error) {
+      return NextResponse.json(
+        { error: tokenData.error_description || tokenData.error || "Token exchange failed" },
+        { status: r.status }
+      );
     }
 
-    // Fetch userinfo from Casdoor
-    const userRes = await fetch(CASDOOR_USERINFO_URL, {
-      headers: { Authorization: `Bearer ${accessToken}` },
-    });
-
-    let userInfo = null;
-    if (userRes.ok) {
-      userInfo = await userRes.json();
+    // Fetch user info with access token
+    let user = null;
+    const accessToken = tokenData.access_token as string | undefined;
+    if (accessToken) {
+      try {
+        const u = await fetch("https://auth.falahos.my/api/userinfo", {
+          headers: { Authorization: "Bearer " + accessToken },
+        });
+        if (u.ok) {
+          user = await u.json();
+        }
+      } catch {
+        // userinfo optional
+      }
     }
 
     return NextResponse.json({
-      success: true,
       access_token: accessToken,
-      id_token: idToken,
-      token_type: tokenData.token_type || "Bearer",
-      expires_in: tokenData.expires_in || 3600,
-      refresh_token: tokenData.refresh_token || null,
-      user: userInfo
-        ? {
-            id: userInfo.sub || userInfo.id,
-            email: userInfo.email,
-            name: userInfo.name || userInfo.displayName || userInfo.preferred_username,
-            avatar: userInfo.avatar || userInfo.picture,
-          }
-        : null,
+      id_token: tokenData.id_token as string | undefined,
+      refresh_token: tokenData.refresh_token as string | undefined,
+      token_type: tokenData.token_type as string | undefined,
+      expires_in: tokenData.expires_in as number | undefined,
+      user,
     });
-  } catch (error) {
-    console.error("[casdoor-oidc] Callback error:", error);
-    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : "Error";
+    return NextResponse.json({ error: msg }, { status: 500 });
   }
 }

src/app/api/auth/test-deep/route.ts

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from "next/server";
+
+export async function GET(req: NextRequest) {
+  try {
+    const code = req.nextUrl.searchParams.get("code") || "none";
+    
+    // Step 1: Just try the simplest fetch
+    const testUrl = "https://auth.falahos.my/api/login/oauth/access_token";
+    const params = new URLSearchParams();
+    params.append("grant_type", "authorization_code");
+    params.append("client_id", process.env.NEXT_PUBLIC_CASDOOR_CLIENT_ID || "");
+    params.append("client_secret", process.env.CASDOOR_CLIENT_SECRET || "");
+    params.append("code", code);
+    params.append("redirect_uri", (process.env.NEXT_PUBLIC_CASDOOR_REDIRECT_URI || "https://mobile2.falahos.my/mobile/auth/callback"));
+
+    const res = await fetch(testUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: params,
+    });
+
+    const body = await res.text();
+    
+    return NextResponse.json({
+      ok: true,
+      code,
+      hasSecret: !!process.env.CASDOOR_CLIENT_SECRET,
+      casdoorStatus: res.status,
+      casdoorBody: body.substring(0, 300),
+    });
+  } catch (e: any) {
+    return NextResponse.json({ error: e.message, stack: e.stack?.substring(0, 500) }, { status: 500 });
+  }
+}

src/app/auth/callback/page.tsx

@@ -24,7 +24,7 @@ function AuthCallbackContent() {
 
     // --- Casdoor OIDC flow: exchange authorization code for tokens ---
     if (code) {
-      fetch(`/api/auth/casdoor-callback?code=${encodeURIComponent(code)}`)
+      fetch(`/mobile/api/auth/casdoor-callback?code=${encodeURIComponent(code)}`)
         .then((res) => res.json())
         .then((data) => {
           if (data.error) {