package com.google.musicanalysis.site;

import java.io.IOException;
import java.math.BigInteger;
import java.security.SecureRandom;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import com.google.musicanalysis.util.URLEncodedBuilder;

@WebServlet("/api/oauth/login/*")
public class OAuthLoginServlet extends HttpServlet {

  @Override
  protected void doGet(HttpServletRequest req, HttpServletResponse res)
      throws ServletException, IOException {
    var path = req.getPathInfo().substring(1);

    if (path == null) {
      res.setStatus(404);
      return;
    }

    // URI that user should be redirected to after logging in
    var redirectUri = System.getenv().get("OAUTH_CALLBACK_URI");
    String oauthLoginUriBase;
    URLEncodedBuilder oauthLoginUriParams;

    // generate a nonce to prevent CSRF
    var state = new BigInteger(130, new SecureRandom()).toString(32);
    var session = req.getSession(true);
    session.setAttribute("oauth:state", state);

    if (path.equalsIgnoreCase("spotify")) {
      session.setAttribute("oauth:service", "spotify");

      oauthLoginUriBase = "https://accounts.spotify.com/authorize";
      oauthLoginUriParams = new URLEncodedBuilder()
        .add("client_id", Constants.SPOTIFY_CLIENT_ID)
        .add("scope", "user-read-private user-top-read user-library-read");
    } else if (path.equalsIgnoreCase("youtube")) {
      session.setAttribute("oauth:service", "youtube");

      oauthLoginUriBase = "https://accounts.google.com/o/oauth2/v2/auth";
      oauthLoginUriParams = new URLEncodedBuilder()
        .add("client_id", Constants.YOUTUBE_CLIENT_ID)
        .add("scope", "https://www.googleapis.com/auth/youtube.readonly");
    } else {
      res.setStatus(404);
      return;
    }

    oauthLoginUriParams = oauthLoginUriParams
        .add("response_type", "code")
        .add("state", state)
        .add("redirect_uri", redirectUri);

    // redirect to OAuth landing page
    res.sendRedirect(oauthLoginUriBase + "?" + oauthLoginUriParams.build());
  }
}

@@ -106,29 +106,179 @@
 ava.
-security.SecureRandom
+net.URI;%0Aimport java.net.URISyntaxException;%0Aimport java.nio.file.Paths;%0Aimport java.security.SecureRandom;%0Aimport java.util.logging.Level;%0Aimport java.util.logging.Logger
 ;%0Aim
@@ -633,16 +633,108 @@
 ervlet %7B
+%0A  private static final Logger LOGGER = Logger.getLogger(OAuthLoginServlet.class.getName());
 %0A%0A  @Ove
@@ -1045,69 +1045,478 @@
     
-var redirectUri = System.getenv().get(%22OAUTH_CALLBACK_URI
+URI domainUri;%0A%0A    try %7B%0A      domainUri = new URI(System.getenv().get(%22DOMAIN%22));%0A    %7D catch (URISyntaxException e) %7B%0A      LOGGER.log(Level.SEVERE, %22The DOMAIN environment variable is invalid.%22);%0A      res.setStatus(500);%0A      return;%0A    %7D catch (NullPointerException e) %7B%0A      LOGGER.log(Level.SEVERE, %22The DOMAIN environment variable is not set.%22);%0A      res.setStatus(500);%0A      return;%0A    %7D%0A%0A    var redirectUri = domainUri.resolve(%22/api/oauth/callback
 %22);%0A
+%0A
     
@@ -2000,33 +2000,24 @@
 dedBuilder()
-%0A        
 .add(%22client
@@ -2043,32 +2043,34 @@
 TIFY_CLIENT_ID)%0A
+  
         .add(%22sc
@@ -2362,25 +2362,16 @@
 uilder()
-%0A        
 .add(%22cl
@@ -2409,32 +2409,34 @@
 ENT_ID)%0A        
+ 
+ 
 .add(%22scope%22, %22h
@@ -2591,25 +2591,16 @@
 riParams
-%0A        
 .add(%22re
@@ -2620,25 +2620,16 @@
  %22code%22)
-%0A        
 .add(%22st
@@ -2681,16 +2681,27 @@
 irectUri
+.toString()
 );%0A%0A    

Use domain env variable instead